joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100558c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x100703c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push 4
pop ebx
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], 0x3fe
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x45c], esi
call sub.USER32.dll_IsSETEnabled
test eax, eax
je 0x10057a6
push esi
lea eax, [ebp - 0x468]
push eax
push esi
push 1
push esi
push esi
push esi
push 0x1001370
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10057a0
mov word [ebp - 0x4b0], ax
lea edi, [ebp - 0x4ae]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x4b0]
push eax
push esi
push esi
push 0x10016b8
push dword [ebp - 0x468]
mov dword [ebp - 0x470], 0x10
call edi
test eax, eax
jne 0x10056c4
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x10056c4
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x47c]
or eax, dword [ebp - 0x478]
je 0x10057a6
mov ecx, dword [ebp - 0x488]
sub ecx, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x484]
sbb eax, dword [ebp - 0x478]
cmp eax, 0x1792
jg 0x10057a6
jl 0x10056c4
cmp ecx, 0xf8648000
ja 0x10057a6
push 1
push esi
lea eax, [ebp - 0x464]
push eax
call sub.USER32.dll_BuildReasonArray
test eax, eax
je 0x10057a6
xor eax, eax
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x454]
push eax
push esi
push esi
push 0x1001698
push dword [ebp - 0x468]
mov dword [ebp - 0x10], esi
call edi
test eax, eax
je 0x1005713
xor eax, eax
mov word [ebp - 0x454], ax
mov dword [ebp - 0x14], esi
jmp 0x1005724
mov eax, dword [ebp - 0x46c]
shr eax, 1
mov dword [ebp - 0x14], eax
xor eax, eax
mov word [ebp - 0x56], ax
lea eax, [ebp - 0x464]
push eax
push 0x1005517
push esi
push 0x8a2
push dword [ebp - 0x480]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 0xffffffff
jne 0x1005753
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x454]
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x4a0]
push eax
mov dword [ebp - 0x4a0], 0x18
mov dword [ebp - 0x49c], 1
mov dword [ebp - 0x494], ebx
call dword [sym.imp.USER32.dll_RecordShutdownReason]
lea eax, [ebp - 0x464]
push eax
call sub.USER32.dll_DestroyReasons
jmp 0x10057a6
mov dword [ebp - 0x468], esi
cmp dword [ebp - 0x468], esi
pop edi
pop esi
pop ebx
je 0x10057bd
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x474]
xor ecx, ebp
call fcn.01005cd9
leave
ret 4
Function at 0x1005891
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100703c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10016e8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005966
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005955
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x100593f
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x1005955
push eax
push edi
push dword [ebp - 0x110]
call fcn.01005829
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x1005968
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01005cd9
leave
ret 4
Function at 0x1005cca
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1006288
call fcn.01005f54
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1007f10
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1005adf
cmp eax, esi
jne 0x1005ad2
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1005ae2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1005ab9
xor esi, esi
inc esi
mov eax, dword [0x1007f0c]
cmp eax, esi
jne 0x1005af5
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1005b30
mov eax, dword [0x1007f0c]
test eax, eax
jne 0x1005b2a
mov dword [0x1007f0c], esi
push 0x100120c
push 0x1001200
call fcn.01005a36
pop ecx
pop ecx
test eax, eax
je 0x1005b30
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1005bfa
mov dword [0x1007bdc], esi
mov eax, dword [0x1007f0c]
cmp eax, esi
jne 0x1005b54
push 0x10011fc
push 0x10011ec
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1007f0c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1005b61
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1007f1c], ebx
je 0x1005b82
push 0x1007f1c
call fcn.01005ec9
pop ecx
test eax, eax
je 0x1005b82
push ebx
push 2
push ebx
call dword [0x1007f1c]
push dword [0x1007bc4]
push dword [0x1007bc8]
push dword [0x1007bc0]
call fcn.0100499a
add esp, 0xc
mov dword [0x1007bd8], eax
cmp dword [0x1007bcc], ebx
jne 0x1005be0
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1007bdc], ebx
jne 0x1005bee
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1007bd8]
call fcn.01005f99
ret
call fcn.010060a2
jmp 0x1005a97
Function at 0x1121649e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pushfd
and dword [esp + 8], 0x3c59198c
cmp dword [esp + 8], 0x57ac320f
mov dword [esp + 8], 0x25604827
call fcn.111cc9ef
Function at 0x401e90
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404188
push 0x4028ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x1c], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid

Function at 0x402196
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404194
push 0x4028ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
jmp 0x402201
mov dword [ebp - 4], 0xffffffff
movzx eax, byte [ebp - 0x1c]
movzx eax, al
cmp eax, 1
jne 0x402222
push eax
mov dword [esp], 0
call fcn.00402c9c
pop ecx
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
Function at 0x402a0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2c], 0x33
mov byte [ebp - 0x2b], 0x32
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp eax, 1
je 0x402a61
mov eax, dword [ebp - 4]
cmp eax, 2
je 0x402a71
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x402a89
jmp 0x402aa1
call fcn.00402c44
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
jmp 0x402aa5
push eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.00402c60
pop ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
jmp 0x402aa5
push eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00402c60
pop ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
jmp 0x402aa5
xor eax, eax
leave
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x60]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, word [ebp + 0xe]
movzx eax, ax
test eax, eax
jne 0x402ae4
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
neg edx
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x402b67
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x18]
cmp eax, edx
jb 0x402b2b
jmp 0x402b56
inc dword [ebp - 0x38]
add dword [ebp - 0x40], 4
add dword [ebp - 0x3c], 2
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x18]
cmp eax, edx
jae 0x402b56
push eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00402bc8
pop ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x44]
cmp edx, eax
jne 0x402b13
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax]
movzx eax, ax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x18]
cmp eax, edx
jne 0x402b67
xor eax, eax
leave
ret
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x402bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
movsx eax, al
test eax, eax
je 0x402c18
mov eax, dword [ebp - 8]
shl eax, 7
mov edx, dword [ebp - 8]
shr edx, 0x19
or eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
movsx eax, al
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
movsx eax, al
test eax, eax
jne 0x402be8
mov eax, dword [ebp - 8]
leave
ret

Function at 0x402c44
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
mov esi, dword [ebp - 4]
leave
ret
Function at 0x402734
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403700
test esi, esi
jne 0x40276a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004037f0
jmp 0x402788
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402648
mov edi, eax
test esi, esi
je 0x402788
cmp dword [ebx], 0
je 0x402788
dec esi
jmp 0x402771
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40800c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402cd8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402cb8
xor eax, eax
push ebp
push 0x402cb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402cf4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402cb8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40800c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40800c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403584
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x409044], 0
je 0x4035e5
cmp word [0x409218], 0xd7b2
jne 0x4035ad
cmp dword [0x409220], 0
jbe 0x4035ad
mov eax, 0x409214
call dword [0x409230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40804c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40360c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x408018], 0
jne 0x403601
push 0
push 0x40806c
push 0x40804c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x403fe4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404214
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404067
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404214
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404067
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404230
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4040f0
xor eax, eax
push ebp
push 0x4040e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403e2c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040ce
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404250
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040ce
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040f0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40420a
cmp byte [ebp - 0xd], 0
jne 0x404137
cmp byte [ebp - 0x12], 0
je 0x40420a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404150
dec ebx
cmp byte [ebx], 0x2e
je 0x40415f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40414f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40420a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40419c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40420a
cmp byte [ebp - 0xd], 0
je 0x40420a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40420a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4040f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404214
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404067
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404214
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404067
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404230
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4040f0
xor eax, eax
push ebp
push 0x4040e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403e2c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040ce
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404250
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4040ce
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040f0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40420a
cmp byte [ebp - 0xd], 0
jne 0x404137
cmp byte [ebp - 0x12], 0
je 0x40420a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404150
dec ebx
cmp byte [ebx], 0x2e
je 0x40415f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40414f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40420a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40419c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40420a
cmp byte [ebp - 0xd], 0
je 0x40420a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40420a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40611c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406155
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004037f0
jmp 0x40615e
mov eax, ebx
mov edx, esi
call fcn.00403754
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406168
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406189
mov al, byte [esp]
jmp 0x40618b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406810
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406688
mov eax, dword [0x408394]
cmp byte [eax], 0
je 0x406878
mov eax, dword [0x4082f0]
call fcn.004027dc
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405574
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4068c0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4068ae
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4082d4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x409710]
call fcn.00403df0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x407240
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4072a4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403944
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004053d0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072ab
lea eax, [ebp - 0xc]
call fcn.00403700
ret

Function at 0x407de4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [0x408394]
mov byte [eax], 1
mov eax, 0x407d9c
call fcn.0040452c
xor eax, eax
push ebp
push 0x407e52
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x40984c
mov eax, 1
call fcn.00402734
mov eax, dword [0x40984c]
call fcn.00405468
test al, al
je 0x407e44
push 1
push 0
push 0
mov eax, dword [0x40984c]
call fcn.00403a40
push eax
push 0x407e60
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e59
ret
Function at 0x406830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x40684e
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406840
sub eax, edx
cmp eax, 0x10
je 0x40686a
mov eax, dword [ebx + 4]
push 0
push 0x417988
push 0x417994
push eax
call dword [0x415270]
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push edi
lea edi, [ebx + 0x7c]
mov esi, 0x417970
mov dword [ebx + 0x8c], 0
call fcn.00401eb0
mov edx, dword [ebx + 4]
push 1
lea ecx, [ebx + 0x64]
push ecx
push edx
call dword [0x4152d0]
mov eax, dword [ebx + 4]
push 0
push 0x3e8
push 1
push eax
call dword [0x415220]
lea ecx, [ebp - 4]
push ecx
push 0
push ebx
push 0x405f70
push 0
push 0
call fcn.0040a0bc
add esp, 0x18
pop edi
mov dword [ebx + 0x94], eax
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret