joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ce8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
jne 0x401d17
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x401bcb
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x14], eax
jne 0x401d21
push 0xfffffffffffffffc
pop eax
jmp 0x401d63
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401d2c
push edi
call ebx
cmp dword [esi + 0x48], edi
je 0x401d29
lea eax, [esi + 0x28]
mov dword [esi + 0x44], edi
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x4c], edi
mov dword [esi + 0x44], 1
je 0x401d5c
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x50]
jmp 0x401d63
push edi
call ebx
cmp dword [esi + 0x48], edi
jne 0x401d59
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x401efb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4093fc], 0
push esi
jne 0x401f32
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x401f0c
mov dword [ecx*4 + 0x4093f8], eax
inc ecx
cmp ecx, 0x100
jl 0x401f07
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x401f63
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4093f8]
xor eax, esi
inc ecx
dec edx
jne 0x401f45
pop edi
not eax
pop esi
ret 0xc
Function at 0x403814
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x403886
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x40385f
cmp dword [ebp + 0x10], ebx
jne 0x40388d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00403814
test eax, eax
jne 0x403871
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x403846
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x403886
Function at 0x403cbf
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x403cec
mov ecx, dword [0x423f70]
push edi
add eax, ecx
push edi
push eax
mov dword [0x4174e4], eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403dea
cmp eax, edi
jl 0x403de3
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409094]
call ebx
test eax, eax
je 0x403de0
cmp dword [ebp - 4], esi
jne 0x403de0
push dword [ebp + 8]
add dword [0x4174e4], esi
call fcn.00403dea
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403de3
cmp dword [ebp + 0x10], edi
jne 0x403daf
cmp dword [ebp + 8], edi
jle 0x403ddb
mov esi, 0x4134a0
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403d5f
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409094]
call ebx
test eax, eax
je 0x403de0
cmp edi, dword [ebp - 4]
jne 0x403de0
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403dab
cmp dword [ebp + 0x14], edi
jne 0x403dab
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4174e4], eax
cmp dword [ebp + 8], 0
jg 0x403d52
jmp 0x403ddb
push 0xfffffffffffffffe
jmp 0x403de2
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403dba
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409094]
call ebx
test eax, eax
je 0x403de0
mov eax, dword [ebp - 4]
add dword [0x4174e4], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403de3
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403dea
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4174e4]
mov ebx, eax
sub esi, dword [0x40b444]
add ebx, 0x1f4
add esi, dword [esp + 0x38]
cmp esi, edi
jle 0x403fcb
push dword [0x41f4f4]
call fcn.00404009
push edi
push edi
push dword [0x40b444]
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f4f0], esi
mov dword [0x4174e0], edi
mov eax, dword [0x4174e8]
mov ebp, 0x4000
sub eax, dword [0x41f4f4]
cmp eax, ebp
jg 0x403e5e
mov ebp, eax
mov esi, 0x4134a0
push ebp
push esi
call fcn.00403fd7
test eax, eax
je 0x403fad
add dword [0x41f4f4], ebp
mov dword [0x40b460], esi
mov dword [0x40b464], ebp
cmp dword [0x423f28], edi
je 0x403f10
cmp dword [0x423f9c], edi
jne 0x403f10
cmp dword [esp + 0x10], edi
je 0x403edd
mov eax, dword [0x41f4f0]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
sub eax, dword [0x4174e4]
sub eax, dword [esp + 0x38]
add eax, dword [0x40b444]
mov dword [0x4174e0], eax
jmp 0x403ecb
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
call esi
test eax, eax
jne 0x403ec0
jmp 0x403f10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jbe 0x403f10
mov eax, dword [0x423f24]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x4038f8
push edi
push 0x6f
push dword [0x423f20]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
push 0x40b448
mov dword [0x40b468], 0x40b4a0
mov dword [0x40b46c], 0x8000
call fcn.00401ce8
test eax, eax
jl 0x403fb6
mov esi, dword [0x40b468]
mov eax, 0x40b4a0
sub esi, eax
je 0x403f77
lea ecx, [esp + 0x14]
push edi
push ecx
push esi
push eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403fb2
cmp esi, dword [esp + 0x14]
jne 0x403fb2
add dword [0x40b444], esi
cmp dword [0x40b464], edi
jne 0x403e84
jmp 0x403f83
cmp dword [0x40b464], edi
jne 0x403fb6
cmp ebp, edi
je 0x403fb6
mov eax, dword [0x4174e4]
mov ecx, eax
sub ecx, dword [0x40b444]
add ecx, dword [esp + 0x38]
test ecx, ecx
jg 0x403e48
push edi
push edi
push eax
push dword [0x409094]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x403fbb
or eax, 0xffffffff
jmp 0x403fcd
push 0xfffffffffffffffe
jmp 0x403fb8
push 0xfffffffffffffffd
pop eax
jmp 0x403fcd
cmp dword [esp + 0x10], edi
je 0x403fcb
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x404600
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x42a000], 0
push ebx
push ebp
push esi
push edi
mov edi, 0xffff
mov ebx, 0x42a000
je 0x40461f
push ebx
call fcn.00406916
jmp 0x404625
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
mov esi, dword [0x423f64]
test esi, esi
je 0x404678
mov ecx, dword [0x423f28]
mov ecx, dword [ecx + 0x5c]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x423f60]
add ecx, edx
dec esi
mov bp, word [ecx]
xor bp, ax
and ebp, edi
test bp, bp
je 0x40465d
test esi, esi
jne 0x404647
jmp 0x404678
mov edx, dword [ecx + 2]
mov dword [0x423700], edx
mov edx, dword [ecx + 6]
mov dword [0x423fa4], edx
lea edx, [ecx + 0xa]
mov dword [0x4236fc], edx
cmp dword [0x4236fc], 0
jne 0x404693
cmp di, 0xffff
jne 0x40468f
mov edi, 0x3ff
jmp 0x404627
xor edi, edi
jmp 0x404627
movzx eax, word [ecx]
push eax
push ebx
call fcn.004068fd
push 0xfffffffffffffffe
push 0x423720
call fcn.004069ab
push eax
push dword [0x420910]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40637d
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422138], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4063a1
test al, 0x10
jne 0x4063a4
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422138
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4063cf
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x406446
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040657f
test eax, eax
je 0x4064aa
test byte [ebp + 0xc], 1
push esi
je 0x406493
mov eax, dword [0x423f24]
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x20], eax
call sub.KERNEL32.dll_lstrlenA
and byte [eax + esi + 1], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
mov word [ebp - 0x10], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x4064aa
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4064aa
test byte [ebp + 0xc], 2
je 0x4064aa
push eax
push esi
call fcn.004066dc
pop esi
leave
ret 8
Function at 0x40657f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421d38
push esi
call sub.KERNEL32.dll_lstrcpyA
push esi
call fcn.0040652d
test eax, eax
jne 0x40659e
xor eax, eax
jmp 0x4065e7
test byte [0x423f30], 0x80
je 0x4065b2
mov cl, byte [eax]
test cl, cl
je 0x40659a
cmp cl, 0x5c
je 0x40659a
mov edi, eax
sub edi, esi
jmp 0x4065cc
call fcn.00406c7f
test eax, eax
je 0x4065c6
test byte [eax], 0x10
je 0x40659a
push esi
call fcn.004064db
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4065b8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x406664
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x406693
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40930c]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4066d8
test edi, edi
jne 0x40669e
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4066d2
Function at 0x4066dc
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x406714
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406714
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x406859
mov eax, dword [0x409338]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov dword [0x422ac0], eax
mov edi, 0x400
mov ebp, 0x422ac0
je 0x406758
push 1
push 0
push esi
call fcn.00406664
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40685f
cmp eax, edi
jg 0x40685f
mov esi, 0x4226c0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40685f
cmp eax, edi
jg 0x40685f
push esi
push ebp
push str._s_s_r_n
push 0x4222c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406859
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x406841
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x406835
push str._Rename__r_n
push edi
call fcn.004065ec
test eax, eax
jne 0x406866
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x4222c0
push eax
call fcn.00406640
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409310
push eax
call fcn.004065ec
test eax, eax
je 0x40681c
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x40688f
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x406882
sub eax, edi
jmp 0x40681e
Function at 0x406893
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4068f7
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4068e6
cmp dword [ebp + 0x14], 1
je 0x4068e8
cmp dword [ebp + 0x14], 2
je 0x4068e8
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x402f08
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x429008], 0x8088405
inc edx
mov dword [ebx + 0x429008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403568
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x429024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403600
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035e0
xor eax, eax
push ebp
push 0x4035d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40361c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x429024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x429024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40432c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x43b04c], 0
je 0x40438d
cmp word [0x43b220], 0xd7b2
jne 0x404355
cmp dword [0x43b228], 0
jbe 0x404355
mov eax, 0x43b21c
call dword [0x43b238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42975c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043b4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x429030], 0
jne 0x4043a9
push 0
push 0x429754
push 0x42975c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405a78
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ca8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405afb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ca8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405afb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cc4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405b84
xor eax, eax
push ebp
push 0x405b7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004058b4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b62
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ce4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b62
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b84
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405c9e
cmp byte [ebp - 0xd], 0
jne 0x405bcb
cmp byte [ebp - 0x12], 0
je 0x405c9e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405be4
dec ebx
cmp byte [ebx], 0x2e
je 0x405bf3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405be3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405c9e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c30
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c9e
cmp byte [ebp - 0xd], 0
je 0x405c9e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c9e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405b84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ca8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405afb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ca8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405afb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cc4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405b84
xor eax, eax
push ebp
push 0x405b7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004058b4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b62
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ce4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405b62
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b84
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405c9e
cmp byte [ebp - 0xd], 0
jne 0x405bcb
cmp byte [ebp - 0x12], 0
je 0x405c9e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405be4
dec ebx
cmp byte [ebx], 0x2e
je 0x405bf3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405be3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405c9e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c30
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c9e
cmp byte [ebp - 0xd], 0
je 0x405c9e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405c9e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret