joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401db6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416b7c]
jne 0x401dc0
repz ret
jmp fcn.00402658

Function at 0x4077f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004035a2
and dword [ebp - 4], 0
cmp dword [0x4184b4], 0
mov ebx, eax
jne 0x4078a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407955
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407955
push eax
call fcn.00403530
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4184b4], eax
call esi
push eax
call fcn.00403530
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4184b8], eax
call esi
push eax
call fcn.00403530
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4184bc], eax
call esi
push eax
call fcn.00403530
pop ecx
mov dword [0x4184c4], eax
test eax, eax
je 0x4078a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403530
pop ecx
mov dword [0x4184c0], eax
mov eax, dword [0x4184c0]
cmp eax, ebx
je 0x4078fc
cmp dword [0x4184c4], ebx
je 0x4078fc
push eax
call fcn.004035ab
push dword [0x4184c4]
mov esi, eax
call fcn.004035ab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4078fc
test edi, edi
je 0x4078fc
call esi
test eax, eax
je 0x4078f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4078f3
test byte [ebp - 0xc], 1
jne 0x4078fc
or dword [ebp + 0x10], 0x200000
jmp 0x407935
mov eax, dword [0x4184b8]
cmp eax, ebx
je 0x407935
push eax
call fcn.004035ab
pop ecx
test eax, eax
je 0x407935
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407935
mov eax, dword [0x4184bc]
cmp eax, ebx
je 0x407935
push eax
call fcn.004035ab
pop ecx
test eax, eax
je 0x407935
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4184b4]
call fcn.004035ab
pop ecx
test eax, eax
je 0x407955
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407957
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5dc71788
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
test eax, eax
je 0x5dc717d2
mov eax, dword [ebp + 8]
add eax, 0xe4
push eax
lea eax, [ebp + 0x10]
push eax
push 0x800
lea eax, [ebp - 0x814]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
leave
ret 0xc

Function at 0x5dc717d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x7d0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
test eax, eax
je 0x5dc7181f
mov eax, dword [ebp + 8]
lea ecx, [eax + 0xe4]
push ecx
lea ecx, [eax + 0xb0]
push ecx
push dword [ebp + 0x10]
add eax, 0x20e
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
leave
ret 0xc

Function at 0x5dc71823
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
je 0x5dc71846
mov dword [ebp - 0xc], 0x61a8
jmp 0x5dc71866
cmp dword [esi + 0xd4], 4
je 0x5dc71863
mov eax, dword [esi + 0xb4]
neg eax
sbb eax, eax
and eax, 0x1adb0
add eax, 0x2710
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
test eax, eax
je 0x5dc7189e
mov eax, dword [esi + 0xb4]
lea ecx, [esi + 0xe4]
push ecx
lea eax, [eax + esi + 0x20e]
add esi, 0xb0
push esi
push 1
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
leave
ret 8

Function at 0x5dc718a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x1f4
mov dword [ebp - 0xc], 0xbb8
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
test eax, eax
je 0x5dc718fd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb4]
push esi
lea esi, [eax + 0xe4]
lea edx, [ecx + eax + 0x20e]
push esi
add eax, 0xb0
push eax
mov eax, 0x100
sub eax, ecx
push eax
push edx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
leave
ret 8
Function at 0x5dc7233a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 2
mov dword [ebp - 4], edi
pop ebx
mov eax, dword [esi + 0xd0]
sub eax, edi
je 0x5dc723d3
dec eax
je 0x5dc723b5
dec eax
jne 0x5dc7234e
cmp dword [ebp - 4], edi
je 0x5dc723ad
mov eax, dword [esi + 0xd4]
cmp eax, 1
je 0x5dc72423
cmp eax, ebx
je 0x5dc72396
jle 0x5dc723ad
cmp eax, 4
jg 0x5dc723ad
push esi
call fcn.5dc71d3a
cmp eax, edi
jne 0x5dc72512
push esi
call fcn.5dc71c24
jmp 0x5dc72512
mov eax, dword [esi + 0xd8]
push dword [esi + 0xa8]
mov dword [esi + 0xd4], eax
call fcn.5dc73c99
mov dword [esi + 0xd0], edi
jmp 0x5dc7234e
push dword [ebp + 0xc]
push esi
call fcn.5dc71eb6
cmp eax, edi
jne 0x5dc7242a
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xe0], edi
jmp 0x5dc7234e
lea eax, [esi + 0xbc]
push eax
lea eax, [esi + 0x10e]
push eax
push dword [esi + 0xa4]
lea eax, [ebp - 0x10]
push dword [esi + 0xd4]
push eax
call fcn.5dc72a40
push eax
push dword [esi + 0xa8]
call fcn.5dc74a5b
cmp eax, edi
je 0x5dc72445
cmp eax, 0x3397
jne 0x5dc72512
mov dword [ebp - 4], 1
mov dword [esi + 0xd0], ebx
jmp 0x5dc7234e
xor eax, eax
jmp 0x5dc72512
mov ecx, 0x258
cmp eax, ecx
je 0x5dc7243e
mov dword [esi + 0xe0], edi
jmp 0x5dc72512
mov eax, ecx
jmp 0x5dc72512
push dword [esi + 0x9c]
push dword [esi + 0xa8]
call fcn.5dc73cb7
mov dword [esi + 0xc0], eax
cmp dword [0x5dc76068], edi
je 0x5dc7247c
push dword [esi + 0xbc]
lea eax, [esi + 0x10e]
push eax
push 0x5dc71268
push esi
call fcn.5dc72c01
cmp dword [esi + 0xbc], edi
jne 0x5dc724ba
cmp dword [esi + 0xc0], edi
jne 0x5dc724ba
push 0x7d0
push dword [ebp + 0xc]
push esi
call fcn.5dc71788
test eax, eax
je 0x5dc724a5
mov eax, 0x2be
jmp 0x5dc72512
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x5dc72512
mov dword [esi + 0xd0], ebx
jmp 0x5dc7250d
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0x7d0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
lea eax, [esi + 0xe4]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xbc]
lea eax, [esi + 0x10e]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
mov dword [esi + 0xd0], 1
jne 0x5dc7250d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x5dc72512
mov eax, 0x258
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5dc72872
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5dc72887
push dword [esp + 0x10]
mov esi, 0x5dc713f4
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.5dc7280b
test eax, eax
jle 0x5dc728f3
cmp eax, 2
jle 0x5dc728dd
cmp eax, 3
je 0x5dc728c9
cmp eax, 4
jne 0x5dc728f3
dec ebx
mov edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5dc728b6
mov esi, 0x5dc713e8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x5dc72903
dec ebx
mov edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5dc728cc
mov esi, 0x5dc713e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x5dc72904
dec ebx
mov edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5dc728e0
mov esi, 0x5dc713d4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x5dc72904
dec ebx
mov edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5dc728f6
mov esi, 0x5dc71214
movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x5dc72a84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x5dc71428
push 0x80000002
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x5dc72ad6
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x5dc71420
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
je 0x5dc72ada
xor eax, eax
leave
ret
xor eax, eax
cmp dword [ebp - 0xc], 4
jne 0x5dc72ae8
cmp dword [ebp - 0x10], eax
setne al
leave
ret
Function at 0x5dc72aea
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push 0x100
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x114]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5dc72b0e
mov esi, 0x5dc713f4
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x114]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5dc72b25
mov esi, 0x5dc714ec
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
push 0x8000080
push 2
push esi
push 1
push 0x40000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x5dc76090], eax
jne 0x5dc72b6b
mov dword [0x5dc76068], esi
jmp 0x5dc72bfd
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0x14]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x12]
push eax
lea eax, [ebp - 0x114]
push 0x5dc714a8
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x20
push esi
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [0x5dc76090]
call ebx
push 0x11
pop ecx
mov esi, 0x5dc71460
lea edi, [ebp - 0x114]
lea eax, [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5dc72bdd
push 0
lea ecx, [ebp - 4]
push ecx
sub eax, esi
push eax
lea eax, [ebp - 0x114]
push eax
push dword [0x5dc76090]
call ebx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x5dc72c01
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push esi
push edi
mov esi, 0x5dc714fc
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
push 0
push dword [0x5dc76090]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x186a0
jbe 0x5dc72c3d
push dword [0x5dc76090]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.5dc72aea
xor eax, eax
mov cl, byte [ebp + eax - 8]
mov byte [ebp + eax - 0x15c], cl
inc eax
test cl, cl
jne 0x5dc72c3f
lea eax, [ebp - 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5dc72c55
mov esi, dword [ebp + 8]
sub eax, edx
add esi, 0x30e
mov ecx, eax
sub ecx, esi
mov edx, esi
lea edi, [ebp + ecx - 0x15c]
mov cl, byte [edx]
mov byte [edi + edx], cl
inc edx
test cl, cl
jne 0x5dc72c74
mov ecx, esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x5dc72c83
sub ecx, esi
add eax, ecx
mov ecx, dword [ebp + 0xc]
mov word [ebp + eax - 0x15c], 0x20
inc eax
mov edx, eax
sub edx, ecx
lea esi, [ebp + edx - 0x15c]
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x5dc72ca7
mov ecx, dword [ebp + 0xc]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x5dc72cb7
sub ecx, esi
mov esi, dword [ebp + 0x10]
add eax, ecx
mov ecx, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
lea edi, [ebp + eax - 0x15c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, edx
push 0
lea edi, [ebp + eax - 0x15c]
lea ecx, [ebp - 0xc]
push ecx
add eax, 2
push eax
mov esi, 0x5dc714f8
lea eax, [ebp - 0x15c]
movsw word es:[edi], word [esi]
push eax
push dword [0x5dc76090]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
leave
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x411d62
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x417678], 0
push ebx
push esi
mov esi, 0x417680
jne 0x411d8e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x417698], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x417678], 1
push dword [0x417698]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x411e2b
push 0x14
push 8
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x411e55
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x41767c]
test eax, eax
je 0x411dd0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x41767c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x411e5a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x417698]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x411e55
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404008
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404238
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40408b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404238
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40408b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404254
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404114
xor eax, eax
push ebp
push 0x40410d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403e50
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040f2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404274
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040f2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404114
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40422e
cmp byte [ebp - 0xd], 0
jne 0x40415b
cmp byte [ebp - 0x12], 0
je 0x40422e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404174
dec ebx
cmp byte [ebx], 0x2e
je 0x404183
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404173
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40422e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4041c0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40422e
cmp byte [ebp - 0xd], 0
je 0x40422e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40422e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404114
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404238
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40408b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404238
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40408b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404254
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404114
xor eax, eax
push ebp
push 0x40410d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403e50
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040f2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404274
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040f2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404114
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40422e
cmp byte [ebp - 0xd], 0
jne 0x40415b
cmp byte [ebp - 0x12], 0
je 0x40422e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404174
dec ebx
cmp byte [ebx], 0x2e
je 0x404183
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404173
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40422e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4041c0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40422e
cmp byte [ebp - 0xd], 0
je 0x40422e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40422e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret