joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e833
Capabilities:
Encode data using xor

Disassembly:
push 0x18
mov eax, 0x46c96c
call fcn.0044e560
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 0x10
jb 0x43e851
mov eax, dword [edi]
jmp 0x43e853
mov eax, edi
mov ecx, dword [edi + 0x10]
add ecx, eax
cmp dword [edi + 0x14], 0x10
jb 0x43e862
mov eax, dword [edi]
jmp 0x43e864
mov eax, edi
xor ebx, ebx
cmp eax, ecx
je 0x43e88b
mov esi, ebx
mov edx, ebx
shr edx, 2
shl esi, 6
add esi, edx
movsx edx, byte [eax]
add edx, 0x9e3779b9
add edx, esi
xor ebx, edx
inc eax
cmp eax, ecx
jne 0x43e86a
mov esi, dword [ebp - 0x10]
push ecx
push edi
push ebx
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0043ec46
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43e8ae
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x43e93b
lea eax, [esi + 3]
test eax, eax
je 0x43e8b8
inc eax
jmp 0x43e8ba
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x18], ax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], eax
call fcn.0043ef4b
mov edi, dword [ebp - 0x1c]
mov dword [ebp + 0xc], edi
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x43e902
mov eax, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [eax]
push esi
call fcn.00407d75
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00407d75
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 0
mov eax, dword [esi + 8]
inc eax
push eax
mov ecx, esi
mov byte [ebp - 0x17], 1
call fcn.0043ebb1
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0043e943
mov ecx, dword [eax]
mov esi, dword [ebp + 8]
mov dword [esi], ecx
lea ecx, [ebp - 0x20]
mov byte [esi + 4], 1
call fcn.0043ec1a
mov eax, esi
call fcn.0044e52e
ret 0xc

Function at 0x43ffa0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4947b8]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0044da10
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43fffa
cmp dword [ebp - 0x108], 2
jne 0x43fffa
cmp dword [ebp - 0x114], 6
jb 0x43fffa
mov al, 1
jmp 0x43fffc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004492e4
leave
ret
Function at 0x440aaa
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46ceb5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x183c
call fcn.0045b5d0
mov eax, dword [0x4947b8]
xor eax, esp
mov dword [esp + 0x1838], eax
push ebx
push esi
push edi
mov eax, dword [0x4947b8]
xor eax, esp
push eax
lea eax, [esp + 0x1850]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x24]
push eax
push 0x1000
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
mov edi, dword [esp + 0x24]
xor ebx, ebx
and dword [esp + 0x20], ebx
xor esi, esi
shr edi, 2
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
and dword [esp + 0x1858], ebx
test edi, edi
je 0x440bf9
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x44]
mov dword [esp + 0x14], eax
push dword [eax]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x28], esi
push 0x400
lea eax, [esp + 0x1048]
push eax
push esi
mov byte [esp + 0x1864], 1
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x440bcc
xor eax, eax
mov word [esp + 0x1842], ax
lea eax, [esp + 0x1044]
push eax
lea ecx, [esp + 0x30]
call fcn.004082fa
lea eax, [ebx + 0x5c]
mov byte [esp + 0x1858], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x440ba0
mov eax, dword [eax]
push ecx
push 0
push eax
lea ecx, [esp + 0x38]
call fcn.00409520
cmp eax, 0xffffffff
je 0x440bbf
push dword [esp + 0x14]
lea ecx, [esp + 0x1c]
call fcn.004357ee
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.004095c3
mov byte [esp + 0x1858], 0
test esi, esi
je 0x440bdf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp + 0x14], eax
dec edi
jne 0x440b3a
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov edi, esi
mov byte [eax + 0x58], 0
cmp esi, ebx
je 0x440c21
mov esi, eax
push dword [edi]
mov ecx, esi
call fcn.004407ec
add edi, 4
cmp edi, ebx
jne 0x440c09
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov bl, byte [eax + 0x58]
test esi, esi
je 0x440c2f
push esi
call fcn.004492df
pop ecx
mov al, bl
mov ecx, dword [esp + 0x1850]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1838]
xor ecx, esp
call fcn.004492e4
mov esp, ebp
pop ebp
ret
Function at 0x4414cc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
test esi, esi
je 0x44152a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x44152a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4414fa
shr eax, 4
and eax, 1
jmp 0x44152c
push esi
call dword [sym.imp.SHLWAPI.dll_StrDupW]
push 0x5c
mov edi, eax
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x441546
xor ecx, ecx
mov word [eax], cx
push edi
mov ecx, ebx
call fcn.004414cc
push edi
test eax, eax
jne 0x441533
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44152a
xor eax, eax
inc eax
jmp 0x44152c
Function at 0x44154b
Capabilities:
Timestomp file

Disassembly:
push 0x4c
mov eax, 0x46d016
call fcn.0044e593
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x48], esi
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_couldnt_open__S
push eax
mov dword [ebp - 4], ebx
call fcn.004299b0
add esp, 0xc
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
jne 0x441598
mov ecx, eax
call fcn.00426e74
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00407e25
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_GetFileTime:__S
push eax
call fcn.004299b0
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x4415d9
mov ecx, ebx
call fcn.00426e74
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00407e25
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_DosDateTimeToFileTime:__S
push eax
call fcn.004299b0
add esp, 0xc
mov ebx, eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
push ecx
shr ecx, 0x10
push ecx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
jne 0x44161a
mov ecx, ebx
call fcn.00426e74
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00407e25
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_LocalFileTimeToFileTime:__S
push eax
call fcn.004299b0
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
jne 0x441657
mov ecx, ebx
call fcn.00426e74
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00407e25
push edi
lea eax, [ebp - 0x2c]
push str.SetFileModTime_failed_SetFileTime:__S
push eax
call fcn.004299b0
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x441699
mov ecx, edi
call fcn.00426e74
lea ecx, [ebp - 0x2c]
call fcn.00407e25
test esi, esi
je 0x4416ac
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0044e542
ret 8
Function at 0x441984
Capabilities:
Connect socket
Initialize winsock library
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1dc
mov eax, dword [0x4947b8]
xor eax, esp
mov dword [esp + 0x1d8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esp + 0x50]
push eax
push 0x202
mov dword [esp + 0x18], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x441b14
push 8
pop ecx
push 6
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
and dword [esp + 0x1c], eax
pop edi
lea ecx, [esp + 0xc]
push ecx
xor ebx, ebx
inc ebx
cmp dword [0x495f68], 0x10
lea ecx, [esp + 0x18]
push ecx
mov eax, 0x495f54
cmovae eax, dword [0x495f54]
push 0
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x441b08
mov eax, dword [esp + 0xc]
test eax, eax
je 0x441b08
push edi
push ebx
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
test ebx, ebx
jns 0x441a46
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp dword [esp + 0xc], 0
je 0x441b14
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x441b14
push 7
xor eax, eax
pop ecx
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
mov ax, word [eax + 4]
mov word [esp + 0x34], ax
movzx eax, word [0x495e30]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x36], ax
mov eax, dword [esp + 0xc]
cmp dword [eax + 4], 2
jne 0x441a87
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 4]
mov dword [esp + 0x38], eax
jmp 0x441a9f
cmp dword [eax + 4], 0x17
jne 0x441af6
mov esi, dword [eax + 0x18]
add esi, 8
lea edi, [esp + 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
push 0x1c
lea eax, [esp + 0x38]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x441ac0
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
jns 0x441ad3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x441b0e
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x441ade
mov esi, dword [esi]
push 0x1c
lea ecx, [esp + 0x38]
push ecx
push 0
push eax
push esi
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x441aca
jmp 0x441ac4
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x441a2c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1e4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004492e4
mov esp, ebp
pop ebp
ret
Function at 0x441bcf
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0xff
mov esi, dword [edi]
mov eax, esi
xor eax, dword [ebp + 8]
mov ecx, dword [edi + 8]
and eax, ebx
shr esi, 8
mov eax, dword [edx + eax*4]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [edi + 8], ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45da55
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4947b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004502cc
mov dword [ebp - 0x14], eax
cmp dword [0x49ef8c], edi
jne 0x45db46
push 0x800
push edi
push 0x47465c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x45dad3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x45dc26
push 0x47465c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x45dc26
push 0x474674
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45dc26
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x49ef8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x49ef90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x49ef94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49ef9c], eax
test eax, eax
je 0x45db43
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49ef98], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45db6b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45db5e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x45db80
push 4
pop eax
jmp 0x45dc28
cmp dword [ebp - 0x14], edi
je 0x45db80
push dword [0x49ef8c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x45db65
mov eax, dword [0x49ef98]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x45dbde
cmp dword [0x49ef9c], esi
je 0x45dbde
push eax
call ebx
push dword [0x49ef9c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x45dbde
test eax, eax
je 0x45dbde
call ecx
test eax, eax
je 0x45dbd3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x45dbd3
test byte [ebp - 8], 1
jne 0x45dbde
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x45dc0e
mov eax, dword [0x49ef90]
cmp eax, esi
je 0x45dc0b
push eax
call ebx
test eax, eax
je 0x45dc0b
call eax
mov edi, eax
test edi, edi
je 0x45dc0b
mov eax, dword [0x49ef94]
cmp eax, esi
je 0x45dc0b
push eax
call ebx
test eax, eax
je 0x45dc0b
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x49ef8c]
call ebx
test eax, eax
je 0x45dc26
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x45dc28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004492e4
leave
ret
Function at 0x4603a3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004527c7
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4603db
xor eax, eax
jmp 0x460407
cmp esi, dword [ebp - 4]
je 0x460404
cmp dword [ebp + 0xc], 0
je 0x460404
push dword [edi + 0x9c]
call fcn.0045ffb1
push dword [edi + 0x9c]
mov esi, eax
call fcn.0045073a
pop ecx
pop ecx
cmp esi, eax
je 0x4603d7
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x402bdc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x473008], 0x8088405
inc edx
mov dword [ebx + 0x473008], edx
fld qword [ebx + 0x473068]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x403040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x473024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030d8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030b8
xor eax, eax
push ebp
push 0x4030b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x473024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x473024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403dac
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x475044], 0
je 0x403e0d
cmp word [0x475218], 0xd7b2
jne 0x403dd5
cmp dword [0x475220], 0
jbe 0x403dd5
mov eax, 0x475214
call dword [0x475230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x473078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e34
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x473034], 0
jne 0x403e29
push 0
push 0x473070
push 0x473078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4051e4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405414
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405267
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405414
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405267
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405430
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4052f0
xor eax, eax
push ebp
push 0x4052e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040502c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4052ce
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405450
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4052ce
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052f0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40540a
cmp byte [ebp - 0xd], 0
jne 0x405337
cmp byte [ebp - 0x12], 0
je 0x40540a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405350
dec ebx
cmp byte [ebx], 0x2e
je 0x40535f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40534f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40540a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40539c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40540a
cmp byte [ebp - 0xd], 0
je 0x40540a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40540a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405adc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b42
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404198
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c04
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b2c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b49
lea eax, [ebp - 0x10]
call fcn.00403f28
ret

Function at 0x40af68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40afa1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404018
jmp 0x40afaa
mov eax, ebx
mov edx, esi
call fcn.00403f7c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40afb4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40afd5
mov al, byte [esp]
jmp 0x40afd7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b65c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b4d4
mov eax, dword [0x474230]
cmp byte [eax], 0
je 0x40b6d8
mov eax, dword [0x473fe8]
call fcn.00402a0c
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408648
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b720
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b70e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x473f90]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x475660]
call fcn.00404ff0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret