joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fd3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [sym.imp.libav.dll_Ordinal_19]
mov ecx, dword [sym.imp.libav.dll_Ordinal_1003]
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ecx]
mov edi, eax
call dword [sym.imp.libav.dll_Ordinal_44284]
add esp, 0x1c
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40718d
lea edx, [ebp - 0x20]
mov ecx, eax
mov word [ebp - 0x1f], 0x7461
mov dword [ebp - 0x12], 0x79726f
mov word [ebp - 0x17], 0x7269
mov word [ebp - 0x14], 0x7463
mov word [ebp - 0x19], 0x4465
mov byte [ebp - 0x15], 0x65
mov word [ebp - 0x1c], 0x6162
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x1d], 0x61
call fcn.00406f1e
mov dword [ebp - 4], eax
cmp dword [eax + 0x18], ebx
je 0x40718d
mov esi, dword [eax + 8]
mov dword [ebp - 8], esi
mov edx, esi
mov ecx, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40707c
test al, al
je 0x407081
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40707c
add ecx, 2
add edx, 2
test al, al
jne 0x40705e
jmp 0x407081
sbb ebx, ebx
or ebx, 1
test ebx, ebx
je 0x40718d
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40708e
sub ecx, edx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40709c
sub edx, esi
lea eax, [ecx + 0x1e]
add eax, edx
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
push dword [ebp - 8]
mov ebx, dword [sym.imp.MSVCR110.dll_sprintf]
mov esi, eax
push 0x411dec
push esi
call ebx
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
add esp, 0x18
test eax, eax
je 0x4070e5
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x411dfc
push esi
call ebx
add esp, 0xc
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
pop ecx
pop ecx
test eax, eax
jne 0x407185
push esi
call dword [sym.imp.libav.dll_Ordinal_3]
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x407185
push edi
push 0x411e0c
push esi
call ebx
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
add esp, 0x14
test eax, eax
je 0x40712c
push edi
push 0x411e1c
push esi
call ebx
add esp, 0xc
push 4
push esi
call dword [sym.imp.libav.dll_Ordinal_44340]
pop ecx
pop ecx
test eax, eax
jne 0x40716b
push esi
call dword [sym.imp.libav.dll_Ordinal_3]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40716b
push esi
call dword [sym.imp.MSVCR110.dll_free]
mov esi, dword [ebp - 8]
pop ecx
mov ecx, dword [esi + 4]
cmp ecx, dword [ebx + 4]
jbe 0x407162
mov eax, dword [ebp - 4]
mov edi, dword [eax + 8]
push ebx
call dword [sym.imp.libav.dll_Ordinal_2]
jmp 0x40717b
push esi
call dword [sym.imp.MSVCR110.dll_free]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [eax + 8]
pop ecx
push esi
call dword [sym.imp.libav.dll_Ordinal_2]
jmp 0x40718c
push esi
call dword [sym.imp.MSVCR110.dll_free]
pop ecx
push edi
call dword [sym.imp.MSVCR110.dll__strdup]
pop ecx
mov ecx, dword [ebp - 0xc]
mov esi, eax
test ecx, ecx
je 0x4071a3
call fcn.00406efc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10001c20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
mov esi, dword [ebp + 0xc]
xor edx, edx
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
lea esp, [esp]
lea esp, [esp]
nop
mov dl, byte [esi]
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x10001060]
add esi, 1
sub ecx, 1
jne 0x10001c40
not eax
pop edx
pop ecx
pop esi
leave
ret 8

Function at 0x1000720e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x10007252
inc ecx
cmp ecx, dword [0x1000e4f9]
jne 0x10007252
push 0x400
push 0x10021e25
push 0x16
push dword [str.CreateThread]
call fcn.100076b6
push 0x10021e25
call fcn.10002ec0
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x14
cmp dword [ecx + esi], 0x4550
jne 0x1000721d
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x1000e4f9]
cmp dword [eax - 4], 0x32505564
jne 0x10007292
push 0x400
push 0x10022225
push 0x17
push dword [str.CreateThread]
call fcn.100076b6
push 0x10022225
call fcn.10002ec0
jmp 0x10007247
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
movzx ecx, word [esi + 0x14]
add esi, 0x18
add esi, ecx
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
mov dword [0x100069ed], 0
cmp dword [ebp + 0xc], 4
jne 0x100072c7
or dword [0x100069ed], 1
test dword [ebp + 0x18], 0x40
je 0x100072d7
or dword [0x100069ed], 2
mov ebx, dword [esi + 0x28]
mov dword [0x100069e5], ebx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x100072f9
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x100072fb
xor eax, eax
mov dword [0x100069f1], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x10006790
mov ebx, 0x278
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call fcn.100077d0
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [0x1000d860]
sub ebx, eax
push ebx
push ecx
push edx
call fcn.100077d0
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.10007b40
add dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.10007b40
mov dword [esi + 0x50], eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x1000e509]
mov byte [ecx - 1], 0x32
mov byte [ecx - 2], 0x50
mov byte [ecx - 3], 0x55
mov byte [ecx - 4], 0x64
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x14
Function at 0x10007467
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, ebx
movzx eax, word [ebx + 0x3c]
add ebx, eax
mov ebx, dword [ebx + 0x78]
add ebx, edx
or edi, edi
je 0x100074c6
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x20]
add esi, edx
push ebx
xor ebx, ebx
lodsd eax, dword [esi]
add eax, edx
push esi
push edi
xchg edi, esi
xchg edi, eax
lodsb al, byte [esi]
or al, al
jne 0x100074a5
cmp byte [edi], 0
je 0x100074ae
jmp 0x100074ac
cmp byte [edi], al
jne 0x100074ac
inc edi
jmp 0x10007499
mov al, 1
pop edi
pop esi
or al, al
je 0x100074b7
inc ebx
loop 0x10007491
xchg ebx, eax
pop ebx
mov esi, dword [ebx + 0x24]
add esi, edx
inc eax
shl eax, 1
add esi, eax
movzx ecx, word [esi]
mov esi, dword [ebx + 0x1c]
add esi, edx
sub ecx, dword [ebx + 0x10]
xchg ecx, eax
shl eax, 2
add esi, eax
mov eax, dword [esi]
add eax, edx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 8

Function at 0x10007a90
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x4c
push 0x10022630
call fcn.100077d6
mov eax, dword [ebp + 8]
mov word [eax], 0
mov esi, 0x10022630
mov dword [esi], 0x4c
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0x400
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 4], eax
push esi
call 0x1000b33c
or eax, eax
jne 0x10007ae5
mov eax, dword [ebp + 8]
mov dword [eax], 0
popal
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0x3a
jne 0x10007af6
mov eax, 1
jmp 0x10007af8
xor eax, eax
leave
ret 0x10

Function at 0x10007ca0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push edi
call fcn.10007842
or eax, eax
je 0x10007d07
mov ebx, eax
jmp 0x10007d02
lodsb al, byte [esi]
cmp al, 0x2f
jne 0x10007d02
push ebx
push edi
push ebx
push esi
push 1
push 0
call 0x1000b30c
cmp eax, 2
jne 0x10007d02
mov byte [ebp - 1], 1
mov edi, dword [ebp + 0x10]
or edi, edi
je 0x10007d00
add esi, ebx
inc esi
cmp word [esi], 0x2f20
je 0x10007cfd
cmp byte [esi], 0x2f
je 0x10007cfd
cmp byte [esi], 0
je 0x10007cfd
lodsb al, byte [esi]
cmp al, 0x22
je 0x10007cfb
stosb byte es:[edi], al
jmp 0x10007ce4
mov byte [edi], 0
jmp 0x10007d07
cmp byte [esi], 0
jne 0x10007cbf
popal
movzx eax, byte [ebp - 1]
leave
ret 0xc
Function at 0x10007d60
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.1000783c
mov esi, 0x10022680
mov dword [esi], 0x4c
push dword [ebp + 0xc]
pop dword [esi + 0xc]
push dword [ebp + 8]
pop dword [esi + 0x1c]
mov dword [esi + 0x20], 0x400
mov dword [esi + 0x34], 2
push dword [ebp + 0x10]
pop dword [esi + 0x2c]
push dword [ebp + 0x14]
pop dword [esi + 4]
push esi
call 0x1000b342
or eax, eax
jne 0x10007db3
mov eax, dword [ebp + 8]
mov dword [eax], 0
popal
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0x3a
jne 0x10007dc4
mov eax, 1
jmp 0x10007dc6
xor eax, eax
leave
ret 0x14

Function at 0x10007dd0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x10007e2a
push esi
call fcn.1000777c
cmp eax, 0xffffffff
jne 0x10007e2a
cmp byte [esi], 0
je 0x10007e2a
lea edi, [ebp - 0x401]
jmp 0x10007dff
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x10007e09
cmp byte [esi], 0
jne 0x10007dfd
cmp al, 0x3a
je 0x10007dfd
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [edi], 0
push 0
lea eax, [ebp - 0x401]
push eax
call 0x1000b312
cmp byte [esi - 1], 0
jne 0x10007dfb
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret 4

Function at 0x10007e40
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x10007eae
push esi
call fcn.10007842
or eax, eax
je 0x10007eae
mov ebx, eax
push 0
call 0x1000b2d6
cmp eax, 1
jne 0x10007eae
add ebx, 2
push ebx
push 0x2042
call 0x1000b318
or eax, eax
je 0x10007ea9
mov ebx, eax
push ebx
call 0x1000b31e
or eax, eax
je 0x10007ea9
mov edi, eax
push esi
push edi
call fcn.1000783c
call 0x1000b2d0
cmp eax, 1
jne 0x10007ea9
push edi
call 0x1000b324
push ebx
push 1
call 0x1000b2dc
call 0x1000b2ca
popal
movzx eax, byte [ebp - 1]
leave
ret 4
Function at 0x437c10
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x437c2d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x437c1e
add dl, dl
jne 0x437c38
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x437c84
xor eax, eax
add dl, dl
jne 0x437c45
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x437d21
add dl, dl
jne 0x437c54
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x437c5f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x437c6a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x437c75
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x437c7f
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x437c24
mov eax, 1
add dl, dl
jne 0x437c92
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x437c9d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x437c89
sub eax, 2
jne 0x437ccc
mov ecx, 1
add dl, dl
jne 0x437cb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x437cbd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x437ca9
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x437c24
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x437ce3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x437cee
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x437cda
cmp eax, 0x7d00
jae 0x437d11
cmp eax, 0x500
jb 0x437d0c
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x437c24
cmp eax, 0x7f
ja 0x437d14
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x437c24
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x437d3d
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x437c24
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x40296c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029a9
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029c9
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404520
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402ba0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004042b0
test esi, esi
jne 0x402bd6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004043a0
jmp 0x402bf4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402ab4
mov edi, eax
test esi, esi
je 0x402bf4
cmp dword [ebx], 0
je 0x402bf4
dec esi
jmp 0x402bdd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402ec0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x48e008], 0x8088405
inc edx
mov dword [ebx + 0x48e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403394
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40342c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40340c
xor eax, eax
push ebp
push 0x403405
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403448
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40340c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404114
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x498048], 0
je 0x404175
cmp word [0x49821c], 0xd7b2
jne 0x40413d
cmp dword [0x498224], 0
jbe 0x40413d
mov eax, 0x498218
call dword [0x498234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48e070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40419c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48e034], 0
jne 0x404191
push 0
push 0x48e068
push 0x48e070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a6c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c9c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405aef
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c9c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405aef
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cb8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405b78
xor eax, eax
push ebp
push 0x405b71
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004058b4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b56
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405cd8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b56
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b78
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405c92
cmp byte [ebp - 0xd], 0
jne 0x405bbf
cmp byte [ebp - 0x12], 0
je 0x405c92
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405bd8
dec ebx
cmp byte [ebx], 0x2e
je 0x405be7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405bd7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405c92
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c24
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c92
cmp byte [ebp - 0xd], 0
je 0x405c92
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c92
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406398
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4063fe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404520
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402edc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4063e8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406405
lea eax, [ebp - 0x10]
call fcn.004042b0
ret

Function at 0x408fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404770
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408ff9
test al, 0x10
jne 0x408ffd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40be34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40be6d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004043a0
jmp 0x40be76
mov eax, ebx
mov edx, esi
call fcn.00404304
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40be80
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bea1
mov al, byte [esp]
jmp 0x40bea3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c528
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c3a0
mov eax, dword [0x497bf8]
cmp byte [eax], 0
je 0x40c5a4
mov eax, dword [0x4979b4]
call fcn.00402cf0
call fcn.004028c0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004095a0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c5ec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c5da
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x497950]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x498664]
call fcn.00405878
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret