joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ba7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43033c]
jne 0x404bb1
repz ret
jmp fcn.0040ad86

Function at 0x40bdb4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404cac
and dword [ebp - 4], 0
cmp dword [0x43a9f4], 0
mov ebx, eax
jne 0x40be65
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bf16
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40bf16
push eax
call fcn.00404c3a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43a9f4], eax
call esi
push eax
call fcn.00404c3a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43a9f8], eax
call esi
push eax
call fcn.00404c3a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43a9fc], eax
call esi
push eax
call fcn.00404c3a
pop ecx
mov dword [0x43aa04], eax
test eax, eax
je 0x40be65
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404c3a
pop ecx
mov dword [0x43aa00], eax
mov eax, dword [0x43aa00]
cmp eax, ebx
je 0x40bebd
cmp dword [0x43aa04], ebx
je 0x40bebd
push eax
call fcn.00404cb5
push dword [0x43aa04]
mov esi, eax
call fcn.00404cb5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bebd
test edi, edi
je 0x40bebd
call esi
test eax, eax
je 0x40beb4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40beb4
test byte [ebp - 0xc], 1
jne 0x40bebd
or dword [ebp + 0x10], 0x200000
jmp 0x40bef6
mov eax, dword [0x43a9f8]
cmp eax, ebx
je 0x40bef6
push eax
call fcn.00404cb5
pop ecx
test eax, eax
je 0x40bef6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bef6
mov eax, dword [0x43a9fc]
cmp eax, ebx
je 0x40bef6
push eax
call fcn.00404cb5
pop ecx
test eax, eax
je 0x40bef6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43a9f4]
call fcn.00404cb5
pop ecx
test eax, eax
je 0x40bf16
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bf18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10004cfa
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10004cfa
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10004cfa
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10004cfa
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8
Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10004cfa
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x4688e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x500aab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xfba448]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x468a18
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x468946
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004f4869
xor eax, eax
jmp 0x468a8f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004f49a6
push esi
lea ecx, [esp + 0xc]
call fcn.004f4c35
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x468a6d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.00468870
test eax, eax
jne 0x468a6d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.00468870
test eax, eax
jne 0x468a6d
lea eax, [esp + 0x14]
push 0xfa5c04
push eax
call fcn.004dc783
mov esi, eax
add esp, 8
test esi, esi
jne 0x468a4c
lea ecx, [esp + 0x14]
push 0xfa5c00
push ecx
call fcn.004dc520
mov esi, eax
add esp, 8
test esi, esi
jne 0x468a4c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x468a4f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004f4956
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x46895e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004f4869
xor eax, eax
jmp 0x468a8f
mov byte [esi], 0
push 0xfa5bfc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004f4869
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x4f6c36
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f6c6e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f4cc4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f4c9c
jmp 0x4f6c7a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f8328
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f836a
call fcn.004fdda9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f836a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f8361
xor eax, eax
jmp 0x4f8372
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f8378
pop edi
pop esi
pop ebx
ret 4

Function at 0x22d279a3
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x4ae4ad76
jecxz 0x22d2799e
or byte [eax], ah
stc
mov ebp, 0x5d2945d0
cmp dword [ecx + 6], 0xffffffc2
mov ebp, dword [edx + 0x44]
inc ebp
mov edx, 0x446ec90d
mov cl, 0xa3
xchg edi, eax
inc edx
jmp 0x22d27993
or eax, 0xb1446ec9
mov dword [0xeb426497], eax
inc ebx
cmp ah, ah
stc
mov edx, 0xd0ed08ef
mov eax, dword [0xdc636221]
wait
push 0xe8f7767b
jmp 0x22d2792d
jnp 0x22d279bd
mul dword [esi + 0x62c11075]
aad 0x48
aas
push esp
cmp ah, byte [edi - 0x1620c631]
in eax, dx
push ss
add eax, dword [eax]
lea esp, [esp + 0x30]
call fcn.22d2572f
call fcn.22d2a9f3
call fcn.22d3efc2
push 0xffffffffffffffd4
sahf
test dword [esi], esi
jno 0x22d27945
push ebp
xchg ebp, eax
arpl word [edx], sp
in eax, dx
xlatb
mov eax, dword [0x419de34d]
jmp 0x22d2796f
add al, 0xeb
stosd dword es:[edi], eax
aad 0x93
cmp al, 0x5f
xor al, byte [eax + 0x66]
fld dword [esi - 0x62]
add bh, byte [edi]
jo 0x22d27a1f
mov dh, 0xba
and esi, dword [edx]
sub edi, dword [ecx + eax*4 - 0x1b]
mov ecx, 0x46899d4b
test byte [edx], dh
xor eax, 0x198d50a5
xor dh, byte [0x198d50a5]
movsb byte es:[edi], byte [esi]
pop edi
sahf
pop edx
mov al, byte [0x91787185]
xchg ecx, eax
jns 0x22d279dd
int1
xor al, 0x55
cli
sub dword [edx - 0xb807597], esi
lahf
pcmpeqd mm6, qword [ebp - 0x185d6db5]
adc al, 9
push edi
ret 0x11b7
dec eax
aas
push edx
fstp dword [esi + 0x2c]
rep movsb byte es:[edi], byte [esi]
pushfd
call fcn.22d5dd22
adc al, 0x8a
push 0xc3adc24f
xor al, 0xe5
mov ecx, dword [edx + 0x27]
adc dword [edi], ecx
int 0xa5
outsd dx, dword [esi]
inc edi
jmp 0x22d279ec
Function at 0x2a30195d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2a357578]
jne 0x2a301967
repz ret
jmp fcn.2a341dce

Function at 0x2a309f40
Capabilities:
Terminate thread

Disassembly:
push 0x10
mov eax, 0x2a342707
call fcn.2a30229e
mov esi, ecx
xor edi, edi
cmp dword [esi], 0xb
mov dword [ebp - 0x14], edi
jne 0x2a30a02b
mov edi, dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0xea60
push dword [esi + 0x2e0]
call edi
or dword [esi + 0x1ac], 0xffffffff
push 1
push dword [esi + 0x2dc]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
call ebx
shr eax, 4
add eax, 0x12c
mov dword [ebp - 0x10], eax
jmp 0x2a309fdb
push 0xea60
push dword [esi + 0x2e0]
call edi
push dword [esi + 0x2e0]
xor eax, eax
cmp dword [esi], 0xb
setne al
movzx eax, ax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp word [ebp - 0x1c], 0
jne 0x2a309fe5
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call ebx
shr eax, 4
cmp eax, dword [ebp - 0x10]
jb 0x2a309fa5
push 0xea60
push dword [esi + 0x2e0]
call edi
cmp dword [esi], 0xb
jne 0x2a30a00a
xor edi, edi
inc edi
push edi
push dword [esi + 0x2dc]
call dword [sym.imp.kernel32.dll_TerminateThread]
mov dword [ebp - 0x14], edi
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_CloseHandle]
and dword [esi + 0x2e0], 0
xor edi, edi
mov eax, dword [esi + 0x1c]
lea ebx, [esi + 0x1ac]
mov dword [ebx], edi
cmp eax, edi
je 0x2a30a05c
cmp word [ebp - 0x14], di
jne 0x2a30a059
push ebx
push eax
call fcn.2a3106ee
cmp dword [ebx], edi
jne 0x2a30a05c
push ebx
push dword [esi + 0x18]
mov dword [esi + 0x1c], edi
call fcn.2a3106ee
jmp 0x2a30a05c
mov dword [esi + 0x1c], edi
cmp word [esi + 0x14c], di
je 0x2a30a0c8
push edi
push edi
lea ecx, [ebp - 0x18]
call fcn.2a3106ee
mov ebx, dword [0x2a358a70]
push edi
lea eax, [esi + 0x48]
push eax
mov eax, dword [0x2a358a74]
push str.Cstring
mov dword [ebp - 4], edi
call dword [eax + 0x14]
movzx eax, ax
pop ecx
push eax
push edi
call dword [ebx + 0xd0]
add esp, 0x10
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.2a3106ee
cmp dword [ebp - 0x14], edi
je 0x2a30a0bc
lea ecx, [ebp - 0x18]
call fcn.2a3106ee
test al, al
je 0x2a30a0bc
lea ecx, [ebp - 0x18]
call fcn.2a330802
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a3032b3
mov eax, dword [esi + 0x3c]
cmp eax, edi
je 0x2a30a0df
push eax
mov eax, dword [0x2a358780]
call dword [eax + 0x284]
pop ecx
mov dword [esi + 0x3c], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x2a30a107
push eax
mov eax, dword [0x2a358a90]
cmp word [esi + 0x1a2], di
je 0x2a30a0fd
call dword [eax + 0x124]
jmp 0x2a30a103
call dword [eax + 0x11c]
pop ecx
mov dword [esi + 0x24], edi
mov dword [esi], 2
call fcn.2a3026e6
ret
Function at 0x2a3106ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x2a3106fd
pop dword [ebp - 0x30]
mov eax, 0x8f5e58b8
sub eax, 0x652d51bb
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xfb540613
sub dword [ebp - 0x40], 0xad01c0c8
mov dword [ebp - 0x3c], 0x38474290
add dword [ebp - 0x3c], 0xf9ec09b5
mov dword [ebp - 0x38], 0xaa41e511
sub dword [ebp - 0x38], 0x5df5a0e3
mov dword [ebp - 0x34], 0xf4f0434f
sub dword [ebp - 0x34], 0xf4f0434f
lea eax, [ebp - 0x40]
push eax
mov eax, 0xc6b857aa
add eax, 0x637c18a2
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xe3876fc1
sub dword [ebp - 0x40], 0x6f15066b
mov dword [ebp - 0x3c], 0x557d7e62
sub dword [ebp - 0x3c], 0x14111ced
mov dword [ebp - 0x38], 0x6bad2b73
add dword [ebp - 0x38], 0xf7c240f9
mov dword [ebp - 0x34], 0x953bb1ee
sub dword [ebp - 0x34], 0x953bb1ee
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x5a722c74
add eax, 0xcfc243e0
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4d991
push 0
call eax
mov ecx, 0x69c7
xor esi, esi
add esi, eax
mov edi, 0x2a36ba00
add edi, dword [ebp - 0x30]
mov ebx, 0xa8fb275c
sub ebx, 0x5087cf80
add dword [ebp - 0x14], 0xe5abb316
mov edx, dword [edi]
xor dword [ebp - 0x28], esi
xor edx, ebx
xor dword [ebp - 0x28], 0x699cbd33
mov dword [esi], edx
sub dword [ebp - 8], 0x108897f3
add esi, 0x6b84545c
add esi, 0x947baba8
add edi, 4
loop 0x2a310815
add eax, 0x199ef
xor ebx, ebx
add ebx, eax
add eax, 0x79bba609
sub eax, 0x79bba604
mov ecx, 0x2a300000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x2a323cd6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x2a3442a0
call fcn.2a30372f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x2a323d84
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.2a3106ee
add esp, 0xc
test eax, eax
js 0x2a323d84
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x2a323d6a
push edi
call fcn.2a3203ae
pop ecx
test al, al
je 0x2a323d6a
mov eax, edi
call fcn.2a341a00
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a323d76
push edi
lea ecx, [ebp - 0x428]
call fcn.2a3106ee
push 3
push edi
push esi
push eax
call fcn.2a3106ee
cmp eax, ebx
jne 0x2a323dc1
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a323d9d
lea ecx, [ebp - 0x418]
call fcn.2a31ffe1
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.2a31fe2e
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.2a303768
ret 0x10
push 2
push ebx
push eax
call fcn.2a3212fd
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x2a323de2
call fcn.2a31f619
mov esi, eax
jmp 0x2a323eac
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x2a323e05
call fcn.2a31f619
jmp 0x2a323e9e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x2a323dfb
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x2a323e35
mov esi, 0x8007000e
jmp 0x2a323ea0
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a3106ee
mov dword [ebp - 4], 1
jmp 0x2a323e63
cmp dword [ebp - 0x418], ebx
je 0x2a323e2e
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.2a3106ee
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2a3106ee
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a323da2
lea ecx, [ebp - 0x418]
call fcn.2a31ffe1
jmp 0x2a323da2
Function at 0x42315c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4f6020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4231f4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4231d4
xor eax, eax
push ebp
push 0x4231cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x423210
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4231d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4f6020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4f6020], ax
mov esp, ebp
pop ebp
ret

Function at 0x423fe0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f904c], 0
je 0x424041
cmp word [0x4f9220], 0xd7b2
jne 0x424009
cmp dword [0x4f9228], 0
jbe 0x424009
mov eax, 0x4f921c
call dword [0x4f9238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4f606c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x424068
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x4f6030], 0
jne 0x42405d
push 0
push 0x4f6064
push 0x4f606c
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret

Function at 0x424194
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004227e0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4f904d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x42415c
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x425ca4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x425ed4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x425d27
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x425ed4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x425d27
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x425ef0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x425db0
xor eax, eax
push ebp
push 0x425da9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00425aec
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x425d8e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x425f10
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x425d8e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425db0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x425eca
cmp byte [ebp - 0xd], 0
jne 0x425df7
cmp byte [ebp - 0x12], 0
je 0x425eca
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x425e10
dec ebx
cmp byte [ebx], 0x2e
je 0x425e1f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x425e0f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x425eca
inc ebx
cmp byte [ebp - 0x12], 0
je 0x425e5c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x425eca
cmp byte [ebp - 0xd], 0
je 0x425eca
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x425eca
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret