joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489290
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov esi, ecx
lea ecx, [ebp - 0x444]
push dword [ebp + 8]
call fcn.004683a0
add esp, 4
mov eax, dword [ebp - 0x444]
cmp eax, 0x80000000
jne 0x4892d2
lea ecx, [ebp - 0x444]
call fcn.00468630
mov dword [esi], 0x80000000
jmp 0x489468
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x20], esi
mov esi, 0x200
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], ecx
cmp esi, 0x201
jae 0x489340
jmp 0x48932e
jbe 0x4893c8
cmp esi, 0x201
jae 0x489340
mov dword [ebp - 0x28], 0x200
lea edi, [ebp - 0x444]
mov ebx, esi
jmp 0x489374
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub esi, ebx
sub eax, ebx
cmp eax, esi
jae 0x489365
mov edx, ebx
lea ecx, [ebp - 0x34]
push esi
call fcn.00468820
add esp, 4
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
push 0
call sub.kernel32.dll_SetLastError
push ebx
push edi
push dword [ebp - 0x1c]
call sub.kernel32.dll_GetEnvironmentVariableW
mov esi, eax
test eax, eax
jne 0x489398
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x489473
cmp esi, ebx
jne 0x489320
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x489490
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x48932e
jmp 0x489340
mov edx, dword [ebp - 0x28]
cmp esi, edx
ja 0x4894a9
mov edx, edi
lea ecx, [ebp - 0x44]
push esi
call fcn.0046abd0
add esp, 4
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0x489403
mov ecx, dword [ebp - 0x18]
mov edx, 2
call fcn.00404ac0
cmp edi, 0x80000000
jne 0x489444
mov eax, dword [ebp - 0x20]
cmp bl, 3
mov dword [eax], 0x80000000
jne 0x489455
mov edi, dword [esi + 4]
mov ebx, dword [esi]
mov eax, dword [edi]
push ebx
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x489436
mov edx, dword [edi + 8]
mov ecx, ebx
call fcn.00404ac0
mov ecx, esi
mov edx, 4
call fcn.00404ac0
jmp 0x489455
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
cmp dword [ebp - 0x24], 0
je 0x489468
mov ecx, dword [ebp - 0x1c]
mov edx, 2
call fcn.00404ac0
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
mov edi, 0x80000000
call sub.kernel32.dll_GetLastError
mov esi, eax
cmp dword [ebp - 0x14], 0
jne 0x4893f6
jmp 0x489403
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code_home_nydrani_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.1.10_src_dense.rs
push 0x50489c
call fcn.0040db80
add esp, 4
jmp 0x4894b8
mov ecx, esi
push 0x50488c
call fcn.0040d890
add esp, 4
ud2
Function at 0x48afa0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
xorps xmm0, xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push 0x10
push eax
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x48afe5
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov byte [esp + 0x20], 0
mov dword [esp + 0x24], eax
lea edi, [esp + 0x20]
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0x504408
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 0x489c20
mov dword [esp + 0x34], 1
lea ecx, [esp + 0x28]
mov edx, 0x504434
call fcn.0040cbc0
ud2

Function at 0x48d130
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4ab098]
test eax, eax
je 0x48d211
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x48d160
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x48d206
mov eax, dword [0x4ab098]
test eax, eax
je 0x48d220
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x48d1e3
mov esi, eax
test eax, eax
jne 0x48d1c4
movzx eax, byte [0x52314c]
mov ecx, 0x20
mov edx, 8
call fcn.00404a60
test eax, eax
je 0x48d23b
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4ab098
mov esi, eax
mov eax, dword [0x4ab098]
test eax, eax
je 0x48d22f
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x48d1e7
movaps xmm0, xmmword [esp]
jmp 0x48d1f5
xor esi, esi
jmp 0x48d209
lea ecx, [esp + 0x10]
call fcn.0048afa0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x4ab098
call fcn.004665d0
jmp 0x48d148
mov ecx, 0x4ab098
call fcn.004665d0
jmp 0x48d16e
mov ecx, 0x4ab098
call fcn.004665d0
jmp 0x48d1bd
mov ecx, 8
mov edx, 0x20
call fcn.00404f40
nop word [eax + eax]
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
mov eax, dword [esi]
test eax, eax
je 0x48d267
dec eax
jmp 0x48d26e
mov ecx, esi
call fcn.004665d0
push 1
push eax
call sub.kernel32.dll_TlsSetValue
mov ecx, edi
mov edx, 8
call fcn.00404ac0
mov eax, dword [esi]
test eax, eax
je 0x48d28b
dec eax
jmp 0x48d292
mov ecx, esi
call fcn.004665d0
push 0
push eax
call sub.kernel32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x48d250
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4ab098]
test eax, eax
je 0x48d211
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x48d160
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x48d206
mov eax, dword [0x4ab098]
test eax, eax
je 0x48d220
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x48d1e3
mov esi, eax
test eax, eax
jne 0x48d1c4
movzx eax, byte [0x52314c]
mov ecx, 0x20
mov edx, 8
call fcn.00404a60
test eax, eax
je 0x48d23b
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4ab098
mov esi, eax
mov eax, dword [0x4ab098]
test eax, eax
je 0x48d22f
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x48d1e7
movaps xmm0, xmmword [esp]
jmp 0x48d1f5
xor esi, esi
jmp 0x48d209
lea ecx, [esp + 0x10]
call fcn.0048afa0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x4ab098
call fcn.004665d0
jmp 0x48d148
mov ecx, 0x4ab098
call fcn.004665d0
jmp 0x48d16e
mov ecx, 0x4ab098
call fcn.004665d0
jmp 0x48d1bd
mov ecx, 8
mov edx, 0x20
call fcn.00404f40
nop word [eax + eax]
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
mov eax, dword [esi]
test eax, eax
je 0x48d267
dec eax
jmp 0x48d26e
mov ecx, esi
call fcn.004665d0
push 1
push eax
call sub.kernel32.dll_TlsSetValue
mov ecx, edi
mov edx, 8
call fcn.00404ac0
mov eax, dword [esi]
test eax, eax
je 0x48d28b
dec eax
jmp 0x48d292
mov ecx, esi
call fcn.004665d0
push 0
push eax
call sub.kernel32.dll_TlsSetValue
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x4a4350
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004a5060
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004a5060
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4a43b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x5231a8]
test esi, esi
jle 0x4a44d0
mov eax, dword [0x5231ac]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4a43e4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4a4467
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4a43d0
mov dword [esp], ebx
call fcn.004a4d40
mov edi, eax
test eax, eax
je 0x4a44f7
mov eax, dword [0x5231ac]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004a4e50
mov edx, dword [0x5231ac]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4a44d7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4a4460
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4a4470
add dword [0x5231a8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x5231ac]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4a4460
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004a4350
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4a43ee
mov eax, dword [0x5231ac]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004a4350
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004a4350
lea esi, [esi]
nop
Function at 0x4a49b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5231c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5231bc]
sub esp, 4
test ebx, ebx
je 0x4a4a05
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4a49fe
test esi, esi
je 0x4a49fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4a49e0
mov dword [esp], 0x5231c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x40292c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402969
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402989
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404900
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b50
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404698
test esi, esi
jne 0x402b86
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404788
jmp 0x402ba4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a04
mov edi, eax
test esi, esi
je 0x402ba4
cmp dword [ebx], 0
je 0x402ba4
dec esi
jmp 0x402b8d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4037a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47a00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40383c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40381c
xor eax, eax
push ebp
push 0x403815
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403858
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40381c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47a00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47a00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40451c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47c048], 0
je 0x40457d
cmp word [0x47c21c], 0xd7b2
jne 0x404545
cmp dword [0x47c224], 0
jbe 0x404545
mov eax, 0x47c218
call dword [0x47c234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47a054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47a01c], 0
jne 0x404599
push 0
push 0x47a074
push 0x47a054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406024
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406254
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4060a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406254
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4060a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406270
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406130
xor eax, eax
push ebp
push 0x406129
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405e6c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40610e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406290
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40610e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406130
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40624a
cmp byte [ebp - 0xd], 0
jne 0x406177
cmp byte [ebp - 0x12], 0
je 0x40624a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406190
dec ebx
cmp byte [ebx], 0x2e
je 0x40619f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40618f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40624a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4061dc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40624a
cmp byte [ebp - 0xd], 0
je 0x40624a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40624a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406130
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406254
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4060a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406254
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4060a7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406270
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406130
xor eax, eax
push ebp
push 0x406129
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405e6c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40610e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406290
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40610e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406130
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40624a
cmp byte [ebp - 0xd], 0
jne 0x406177
cmp byte [ebp - 0x12], 0
je 0x40624a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406190
dec ebx
cmp byte [ebx], 0x2e
je 0x40619f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40618f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40624a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4061dc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40624a
cmp byte [ebp - 0xd], 0
je 0x40624a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40624a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret