joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10085cc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov bl, byte [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x24], edx
mov byte [esp + 0xf], bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
test bl, 0x40
jne 0x10085d18
push ecx
lea ecx, [esi + 0x10]
push ecx
push esi
call eax
add esp, 0xc
movzx eax, bl
and eax, 7
mov ebx, 0xf
sub ebx, eax
mov byte [esi], al
mov eax, ebx
xor ecx, ecx
mov dword [esp + 0x20], ebx
cmp eax, 0xf
jae 0x10085d47
movzx edx, byte [esi + eax]
or ecx, edx
mov byte [esi + eax], 0
inc eax
shl ecx, 8
cmp eax, 0xf
jb 0x10085d34
movzx eax, byte [esi + 0xf]
mov ebp, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebp
je 0x10085d6e
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100d0738
add esp, 0x30
ret
push edi
mov edi, ebp
shr edi, 4
test edi, edi
je 0x10085daf
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x40]
shl edi, 4
mov edx, edi
add dword [esp + 0x34], edx
add dword [esp + 0x30], edx
add esp, 0x18
sub ebp, edx
je 0x10085e0a
shr edx, 4
mov ecx, esi
call fcn.10085a80
test ebp, ebp
je 0x10085e0a
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x2c]
add esp, 0xc
xor eax, eax
test ebp, ebp
jbe 0x10085df9
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov edx, ecx
sub edi, ecx
sub ebx, edx
lea ecx, [ecx]
lea edx, [esp + eax + 0x2c]
mov cl, byte [edi + edx]
xor cl, byte [edx]
inc eax
mov byte [ebx + edx], cl
xor byte [esi + eax + 0xf], cl
cmp eax, ebp
jb 0x10085de0
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call dword [esp + 0x2c]
add esp, 0xc
pop edi
cmp ebx, 0x10
jae 0x10085e26
mov edx, 0x10
sub edx, ebx
push edx
lea eax, [esi + ebx]
push 0
push eax
call fcn.100d4cc0
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
xor dword [esi + 0x14], eax
xor dword [esi + 0x10], edx
mov ecx, dword [esp + 0x3c]
xor dword [esi + 0x18], ecx
mov al, byte [esp + 0x1b]
mov edx, dword [esp + 0x40]
xor dword [esi + 0x1c], edx
mov ecx, dword [esp + 0x44]
add esp, 0xc
mov byte [esi], al
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100d0738
add esp, 0x30
ret
Function at 0x10086170
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x100861e5
cmp ebx, dword [esi]
je 0x100861dc
test edi, edi
je 0x100861c2
cmp dword [esp + 0xa0], eax
jge 0x100861dc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100d0738
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x100861eb
mov ebx, dword [esi]
test ebx, ebx
je 0x100861c2
push ebp
test edi, edi
je 0x100862bd
push ebx
call fcn.10078180
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x1008621b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.1007d940
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x10086275
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.10097c50
add esp, 0xc
test eax, eax
je 0x1008636a
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.10097e00
add esp, 0xc
test eax, eax
je 0x1008636a
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.10097e10
add esp, 0xc
test eax, eax
je 0x1008636a
jmp 0x1008629a
cmp eax, 0x80
ja 0x1008636a
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.100d4950
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x100862c5
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.100d4cc0
add esp, 0xc
jmp 0x100862c5
test eax, eax
je 0x10086356
xor eax, eax
jmp 0x100862d0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x100862d0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.10097c50
add esp, 0xc
test eax, eax
je 0x1008636a
push ebx
call fcn.10078180
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10097e00
add esp, 0x10
test eax, eax
je 0x1008636a
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x10086314
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.10097c50
add esp, 0xc
test eax, eax
je 0x1008636a
push ebx
call fcn.10078180
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10097e00
add esp, 0x10
test eax, eax
je 0x1008636a
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.10097f70
add esp, 8
test eax, eax
jne 0x1008636e
xor eax, eax
jmp 0x10086373
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x88
ret
Function at 0x10094aa0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x10094ae7
mov al, byte [edx]
test al, al
je 0x10094ae7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x10094ab7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10095b00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
dec edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
test eax, eax
jne 0x10095b5d
call fcn.100865a0
mov dword [esp + 0x10], eax
test esi, esi
jne 0x10095b65
mov dword [esp + 0x14], eax
push eax
call fcn.10082d40
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x10095ba9
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.1007e710
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100d0738
add esp, 0x5c
ret
inc eax
cmp dword [esp + 0x1c], eax
jge 0x10095bbb
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x10095b85
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.100980d0
add esp, 0x18
test eax, eax
je 0x10095b94
sub edi, ebp
dec edi
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.100d4cc0
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.100d4950
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.10082be0
add esp, 0x20
test eax, eax
jle 0x10095b94
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.1007b060
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x10095c56
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x10095b85
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.10095980
add esp, 0x14
test eax, eax
jl 0x10095ca8
test edi, edi
jle 0x10095c8f
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
lea esp, [esp]
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x10095c80
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.10095980
add esp, 0x14
test eax, eax
jge 0x10095cca
mov edx, dword [esp + 0x10]
push edx
call fcn.1007b260
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100d0738
add esp, 0x5c
ret
test esi, esi
jle 0x10095ce1
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x10095cd6
mov eax, dword [esp + 0x10]
push eax
call fcn.1007b260
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100d0738
add esp, 0x5c
ret
Function at 0x100964f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x100965b9
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10096511
cmp al, 0x6b
jne 0x100965b9
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x1009657a
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x10096531
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x10096531
cmp al, 0xbb
jne 0x1009655a
inc ecx
cmp ecx, esi
jl 0x10096521
sub esi, ecx
test ecx, ecx
jne 0x1009657d
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1007e710
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1007e710
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x100965a6
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.1007e710
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.100d4950
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.1007e710
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x100a1f40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x100a1f59
mov esi, ebx
mov ebx, eax
jmp 0x100a1f5b
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x10]
cmp eax, dword [edi + 8]
jg 0x100a1f6b
mov eax, edi
jmp 0x100a1f75
push eax
push edi
call fcn.1006ce20
add esp, 8
test eax, eax
jne 0x100a1f7d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x100a1f99
mov edx, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x100a1f84
cmp eax, dword [esi + 4]
jge 0x100a1fb0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x100a1fa0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
test eax, eax
jle 0x100a1fd1
mov ecx, dword [edi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100a1fce
dec eax
test eax, eax
jg 0x100a1fc0
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
jne 0x100a1fde
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x100bd070
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x100bd082
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.1009ec00
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x100bd132
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x100bd0d0
test esi, esi
jle 0x100bd111
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x100bd0c0
jmp 0x100bd111
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x100bd0f5
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.100d4cc0
add esp, 0xc
test esi, esi
jle 0x100bd111
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x100bd103
push esi
push ebx
push ebx
push edi
call fcn.10082d00
add esp, 0x10
pop ebp
test eax, eax
jne 0x100bd132
push esi
push ebx
call fcn.1007cbd0
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x100cf4a0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100cf230

Function at 0x100d0738
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10139d00]
jne 0x100d0742
repz ret
jmp fcn.100da8bb

Function at 0x100eb5d6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100db8b0
and dword [ebp - 4], 0
cmp dword [0x101d67b8], 0
mov ebx, eax
jne 0x100eb687
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100eb738
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10122448
push edi
call esi
test eax, eax
je 0x100eb738
push eax
call fcn.100db83e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101d67b8], eax
call esi
push eax
call fcn.100db83e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101d67bc], eax
call esi
push eax
call fcn.100db83e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101d67c0], eax
call esi
push eax
call fcn.100db83e
pop ecx
mov dword [0x101d67c8], eax
test eax, eax
je 0x100eb687
push 0x10122400
push edi
call esi
push eax
call fcn.100db83e
pop ecx
mov dword [0x101d67c4], eax
mov eax, dword [0x101d67c4]
cmp eax, ebx
je 0x100eb6df
cmp dword [0x101d67c8], ebx
je 0x100eb6df
push eax
call fcn.100db8b9
push dword [0x101d67c8]
mov esi, eax
call fcn.100db8b9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100eb6df
test edi, edi
je 0x100eb6df
call esi
test eax, eax
je 0x100eb6d6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100eb6d6
test byte [ebp - 0xc], 1
jne 0x100eb6df
or dword [ebp + 0x10], 0x200000
jmp 0x100eb718
mov eax, dword [0x101d67bc]
cmp eax, ebx
je 0x100eb718
push eax
call fcn.100db8b9
pop ecx
test eax, eax
je 0x100eb718
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100eb718
mov eax, dword [0x101d67c0]
cmp eax, ebx
je 0x100eb718
push eax
call fcn.100db8b9
pop ecx
test eax, eax
je 0x100eb718
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101d67b8]
call fcn.100db8b9
pop ecx
test eax, eax
je 0x100eb738
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100eb73a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4027bc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4027eb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403518
jmp 0x402809
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004026e4
mov edi, eax
test ebx, ebx
je 0x402809
cmp dword [esi], 0
je 0x402809
dec ebx
jmp 0x4027f2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4029f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402a8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402a6c
xor eax, eax
push ebp
push 0x402a65
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402aa8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402a6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x4048f8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404ab4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404959
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404ad0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4049cb
xor eax, eax
push ebp
push 0x4049c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00404750
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4049ad
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404af0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4049cb
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404aac
cmp byte [ebp - 0xd], 0
jne 0x404a0d
cmp byte [ebp - 0x12], 0
je 0x404aac
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404a26
dec ebx
cmp byte [ebx], 0x2e
je 0x404a35
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404a25
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404aac
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404a62
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404aac
cmp byte [ebp - 0xd], 0
je 0x404aac
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404aac
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405008
Capabilities:
Delete file

Disassembly:
mov edx, dword [eax + 4]
sub edx, 0xd7b0
cmp edx, 3
ja 0x40502f
lea eax, [eax + 0x48]
push eax
call sub.kernel32.dll_DeleteFileA
dec eax
jne 0x405023
ret
call sub.kernel32.dll_GetLastError
call fcn.0040267c
jmp 0x405022
mov eax, 0x66
jmp 0x405028
Function at 0x407658
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407691
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403518
jmp 0x40769a
mov eax, ebx
mov edx, esi
call fcn.00403484
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4076a4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4076c5
mov al, byte [esp]
jmp 0x4076c7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c704
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40c86d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004034c8
mov eax, dword [ebp - 0x10]
call fcn.0040c60c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x40c756
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.004038e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040c8e4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40c82b
xor eax, eax
push ebp
push 0x40c824
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040c700
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0040c87c
test al, al
je 0x40c802
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403518
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x40c802
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403864
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x40c7fc
mov eax, dword [ebp - 0x14]
call fcn.00403864
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004035e8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0040c704
dec ebx
cmp ebx, 0xffffffff
jne 0x40c7b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c82b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040c700
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403864
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0040c6ec
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c874
lea eax, [ebp - 0x3c]
call fcn.00403430
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403454
ret