joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097176
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x85c90
jmp 0x100971ea
lea esp, [esp + 1]
mov dword [esp + 0x28], ebx
jmp 0x10097125
push dx
mov byte [esp], bl
lea esp, [esp + 2]
mov dword [esp + 0x24], esp
call 0x10097176
pop eax
mov ebx, 0x648d0d92
lea esp, [esp + 7]
call fcn.100970ff
sbb dword [esi], 0xffffff8c
jmp 0x1009716f
ja 0x10097183
loope 0x1009719f
lcall 0xffff, 0xe5e8e4f5
invalid
mov dword [esp + 0x28], esi
call 0x100971a7
pushfd
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
add byte [eax], al
add byte [ecx + ecx*4 - 0x72cfdb84], bl
and al, 0x30
jmp 0x10097222
inc esp
and al, 4
call 0x100970f1
call 0x10097186
mov eax, dword [reloc.WS2_32.dll_WSAGetLastError]
xchg edi, eax
fstp dword [ebp - 0x33]
xchg esp, eax
shr byte [si], 1
aas
push es
mov cl, 0xb0
lea esp, [esp + 1]
pushfd
mov byte [esp + 5], bh
mov byte [esp + 4], ch
pop word [esp]
lea esp, [esp + 1]
jmp 0x1009717d
mov esi, dword [esp + 0x2c]
mov eax, 0x17b70a0e
mov eax, 0x230b7d94
jmp 0x100971ff
xchg edi, ebp
lea ebx, [ecx + edx]
setnp ch
neg cx
jmp 0x100971fb
jl 0x100971d4
jge 0x100971d4
lea ebp, [esp]
lea edi, [esi + edi]
sub esp, 0x12
js 0x10097228
jns 0x1009722f
lea esp, [esp + 2]
jmp 0x1009723a
pushfd
jmp 0x1009678d
pop ebx
jmp 0x1009720c
pop ebx
lea esp, [esp + 2]
jmp 0x1009723a
sub esp, 0xb4
jmp 0x1009727c
mov ecx, esi
rdtsc
lea ebx, reloc.WS2_32.dll_WSAGetLastError
xor dl, 0x87
jno 0x10097291
jo 0x10097299
pop edx
xlatb
inc edi
and dl, cl
imul eax, eax, 0x48b9de48
cli
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0xba66fc8b
mov cl, 0x16
mov edi, esp
mov dx, 0x16b1
lea ecx, reloc.WS2_32.dll_WSAGetLastError
mov bl, byte [esp]
mov dx, 0x3d0c
jmp 0x1009725a
neg ebx
jmp 0x100976ce
neg ebx
rol dh, 7
jmp 0x100976d1
rol dh, 7
call fcn.100976b8
mov byte [esp + 0xf], ah
jmp 0x100976e0
mov word [esp + 0x11], bp
lea esp, [esp + 3]
lea esp, [esp + 0x14]
sub esi, 0x61212ae8
stc
je 0x10097739
dec ebx
xchg bx, dx
jmp 0x10097719
dec ebx
xchg bx, dx
pushfd
jmp 0x10097785
pushfd
mov ebx, 0xc1103d45
pop edx
jmp 0x1009778b
cmp dh, 0xaf
jmp 0x1009773b
jmp 0x1009770e
xor esi, 0x351193c4
rcl al, 3
jge 0x1009776e
mov edx, edi
jmp 0x100977a5
jo 0x10097722
cmp dh, 0xaf
jmp 0x1009773b
mov ax, word [esp]
not bh
xchg bx, dx
xchg bx, dx
jmp 0x10098503
mov edx, edi
jmp 0x10097758
mov ebx, 0xc1103d45
pop edx
inc ebx
cmc
jmp 0x10097751
xchg bx, dx
jmp 0x10098503
mov ax, word [esp]
not bh
xchg bx, dx
jmp 0x1009778f
lea edx, [esi + 0x83]
mov ebx, dword [esp]
jmp 0x10097804
jmp 0x100977c8
mov eax, dword [esp]
jmp 0x1009789d
add esi, dword [ebp]
mov ax, 0xca94
bsr ax, di
je 0x100977e6
jne 0x1009781b
iretd
mov eax, dword [esp]
jmp 0x1009789d
rdtsc
ror esi, 0
rdtsc
rol ah, cl
jb 0x100977e4
lea edx, [esi + 0x83]
mov ebx, dword [esp]
jmp 0x10097804
xchg bx, ax
mov ebx, esi
setg dh
lea ebx, [ebx*4]
mov bx, 0x7a8d
lea ebx, reloc.WS2_32.dll_WSAGetLastError
jmp 0x10097838
mov edx, 0xe05f4603
or ebx, 0x9238d8f0
xor esi, 0x6de76f8b
jmp 0x10097982
mov dx, ax
jmp 0x10097ada
add esi, 0x369b9486
bsr bx, sp
js 0x10097b9f
mov dx, ax
mov edx, 0xe05f4603
or ebx, 0x9238d8f0
jmp 0x10097ae5
Function at 0x10097186
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x85c90
jmp 0x100971ea
lea esp, [esp + 1]
mov dword [esp + 0x28], ebx
jmp 0x10097125
push dx
mov byte [esp], bl
lea esp, [esp + 2]
mov dword [esp + 0x24], esp
call 0x10097176
pop eax
mov ebx, 0x648d0d92
lea esp, [esp + 7]
call fcn.100970ff
sbb dword [esi], 0xffffff8c
jmp 0x1009716f
ja 0x10097183
loope 0x1009719f
lcall 0xffff, 0xe5e8e4f5
invalid
mov dword [esp + 0x28], esi
call 0x100971a7
pushfd
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
add byte [eax], al
add byte [ecx + ecx*4 - 0x72cfdb84], bl
and al, 0x30
jmp 0x10097222
inc esp
and al, 4
call 0x100970f1
call 0x10097186
mov eax, dword [reloc.WS2_32.dll_WSAGetLastError]
xchg edi, eax
fstp dword [ebp - 0x33]
xchg esp, eax
shr byte [si], 1
aas
push es
mov cl, 0xb0
lea esp, [esp + 1]
pushfd
mov byte [esp + 5], bh
mov byte [esp + 4], ch
pop word [esp]
lea esp, [esp + 1]
jmp 0x1009717d
mov esi, dword [esp + 0x2c]
mov eax, 0x17b70a0e
mov eax, 0x230b7d94
jmp 0x100971ff
xchg edi, ebp
lea ebx, [ecx + edx]
setnp ch
neg cx
jmp 0x100971fb
jl 0x100971d4
jge 0x100971d4
lea ebp, [esp]
lea edi, [esi + edi]
sub esp, 0x12
js 0x10097228
jns 0x1009722f
lea esp, [esp + 2]
jmp 0x1009723a
pushfd
jmp 0x1009678d
pop ebx
jmp 0x1009720c
pop ebx
lea esp, [esp + 2]
jmp 0x1009723a
sub esp, 0xb4
jmp 0x1009727c
mov ecx, esi
rdtsc
lea ebx, reloc.WS2_32.dll_WSAGetLastError
xor dl, 0x87
jno 0x10097291
jo 0x10097299
pop edx
xlatb
inc edi
and dl, cl
imul eax, eax, 0x48b9de48
cli
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0xba66fc8b
mov cl, 0x16
mov edi, esp
mov dx, 0x16b1
lea ecx, reloc.WS2_32.dll_WSAGetLastError
mov bl, byte [esp]
mov dx, 0x3d0c
jmp 0x1009725a
neg ebx
jmp 0x100976ce
neg ebx
rol dh, 7
jmp 0x100976d1
rol dh, 7
call fcn.100976b8
mov byte [esp + 0xf], ah
jmp 0x100976e0
mov word [esp + 0x11], bp
lea esp, [esp + 3]
lea esp, [esp + 0x14]
sub esi, 0x61212ae8
stc
je 0x10097739
dec ebx
xchg bx, dx
jmp 0x10097719
dec ebx
xchg bx, dx
pushfd
jmp 0x10097785
pushfd
mov ebx, 0xc1103d45
pop edx
jmp 0x1009778b
cmp dh, 0xaf
jmp 0x1009773b
jmp 0x1009770e
xor esi, 0x351193c4
rcl al, 3
jge 0x1009776e
mov edx, edi
jmp 0x100977a5
jo 0x10097722
cmp dh, 0xaf
jmp 0x1009773b
mov ax, word [esp]
not bh
xchg bx, dx
xchg bx, dx
jmp 0x10098503
mov edx, edi
jmp 0x10097758
mov ebx, 0xc1103d45
pop edx
inc ebx
cmc
jmp 0x10097751
xchg bx, dx
jmp 0x10098503
mov ax, word [esp]
not bh
xchg bx, dx
jmp 0x1009778f
lea edx, [esi + 0x83]
mov ebx, dword [esp]
jmp 0x10097804
jmp 0x100977c8
mov eax, dword [esp]
jmp 0x1009789d
add esi, dword [ebp]
mov ax, 0xca94
bsr ax, di
je 0x100977e6
jne 0x1009781b
iretd
mov eax, dword [esp]
jmp 0x1009789d
rdtsc
ror esi, 0
rdtsc
rol ah, cl
jb 0x100977e4
lea edx, [esi + 0x83]
mov ebx, dword [esp]
jmp 0x10097804
xchg bx, ax
mov ebx, esi
setg dh
lea ebx, [ebx*4]
mov bx, 0x7a8d
lea ebx, reloc.WS2_32.dll_WSAGetLastError
jmp 0x10097838
mov edx, 0xe05f4603
or ebx, 0x9238d8f0
xor esi, 0x6de76f8b
jmp 0x10097982
mov dx, ax
jmp 0x10097ada
add esi, 0x369b9486
bsr bx, sp
js 0x10097b9f
mov dx, ax
mov edx, 0xe05f4603
or ebx, 0x9238d8f0
jmp 0x10097ae5
Function at 0x100971a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x85c90
jmp 0x100971ea
lea esp, [esp + 1]
mov dword [esp + 0x28], ebx
jmp 0x10097125
push dx
mov byte [esp], bl
lea esp, [esp + 2]
mov dword [esp + 0x24], esp
call 0x10097176
pop eax
mov ebx, 0x648d0d92
lea esp, [esp + 7]
call fcn.100970ff
sbb dword [esi], 0xffffff8c
jmp 0x1009716f
ja 0x10097183
loope 0x1009719f
lcall 0xffff, 0xe5e8e4f5
invalid
mov dword [esp + 0x28], esi
call 0x100971a7
pushfd
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
add byte [eax], al
add byte [ecx + ecx*4 - 0x72cfdb84], bl
and al, 0x30
jmp 0x10097222
inc esp
and al, 4
call 0x100970f1
call 0x10097186
mov eax, dword [reloc.WS2_32.dll_WSAGetLastError]
xchg edi, eax
fstp dword [ebp - 0x33]
xchg esp, eax
shr byte [si], 1
aas
push es
mov cl, 0xb0
lea esp, [esp + 1]
pushfd
mov byte [esp + 5], bh
mov byte [esp + 4], ch
pop word [esp]
lea esp, [esp + 1]
jmp 0x1009717d
mov esi, dword [esp + 0x2c]
mov eax, 0x17b70a0e
mov eax, 0x230b7d94
jmp 0x100971ff
xchg edi, ebp
lea ebx, [ecx + edx]
setnp ch
neg cx
jmp 0x100971fb
jl 0x100971d4
jge 0x100971d4
lea ebp, [esp]
lea edi, [esi + edi]
sub esp, 0x12
js 0x10097228
jns 0x1009722f
lea esp, [esp + 2]
jmp 0x1009723a
pushfd
jmp 0x1009678d
pop ebx
jmp 0x1009720c
pop ebx
lea esp, [esp + 2]
jmp 0x1009723a
sub esp, 0xb4
jmp 0x1009727c
mov ecx, esi
rdtsc
lea ebx, reloc.WS2_32.dll_WSAGetLastError
xor dl, 0x87
jno 0x10097291
jo 0x10097299
pop edx
xlatb
inc edi
and dl, cl
imul eax, eax, 0x48b9de48
cli
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0xba66fc8b
mov cl, 0x16
mov edi, esp
mov dx, 0x16b1
lea ecx, reloc.WS2_32.dll_WSAGetLastError
mov bl, byte [esp]
mov dx, 0x3d0c
jmp 0x1009725a
neg ebx
jmp 0x100976ce
neg ebx
rol dh, 7
jmp 0x100976d1
rol dh, 7
call fcn.100976b8
mov byte [esp + 0xf], ah
jmp 0x100976e0
mov word [esp + 0x11], bp
lea esp, [esp + 3]
lea esp, [esp + 0x14]
sub esi, 0x61212ae8
stc
je 0x10097739
dec ebx
xchg bx, dx
jmp 0x10097719
dec ebx
xchg bx, dx
pushfd
jmp 0x10097785
pushfd
mov ebx, 0xc1103d45
pop edx
jmp 0x1009778b
cmp dh, 0xaf
jmp 0x1009773b
jmp 0x1009770e
xor esi, 0x351193c4
rcl al, 3
jge 0x1009776e
mov edx, edi
jmp 0x100977a5
jo 0x10097722
cmp dh, 0xaf
jmp 0x1009773b
mov ax, word [esp]
not bh
xchg bx, dx
xchg bx, dx
jmp 0x10098503
mov edx, edi
jmp 0x10097758
mov ebx, 0xc1103d45
pop edx
inc ebx
cmc
jmp 0x10097751
xchg bx, dx
jmp 0x10098503
mov ax, word [esp]
not bh
xchg bx, dx
jmp 0x1009778f
lea edx, [esi + 0x83]
mov ebx, dword [esp]
jmp 0x10097804
jmp 0x100977c8
mov eax, dword [esp]
jmp 0x1009789d
add esi, dword [ebp]
mov ax, 0xca94
bsr ax, di
je 0x100977e6
jne 0x1009781b
iretd
mov eax, dword [esp]
jmp 0x1009789d
rdtsc
ror esi, 0
rdtsc
rol ah, cl
jb 0x100977e4
lea edx, [esi + 0x83]
mov ebx, dword [esp]
jmp 0x10097804
xchg bx, ax
mov ebx, esi
setg dh
lea ebx, [ebx*4]
mov bx, 0x7a8d
lea ebx, reloc.WS2_32.dll_WSAGetLastError
jmp 0x10097838
mov edx, 0xe05f4603
or ebx, 0x9238d8f0
xor esi, 0x6de76f8b
jmp 0x10097982
mov dx, ax
jmp 0x10097ada
add esi, 0x369b9486
bsr bx, sp
js 0x10097b9f
mov dx, ax
mov edx, 0xe05f4603
or ebx, 0x9238d8f0
jmp 0x10097ae5
Function at 0x100976b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x13
jp 0x100976d6
mov byte [esp + 0xf], ah
mov word [esp + 0x11], bp
jmp 0x100977bf
lea esp, [esp + 3]
jmp 0x100976e9

Function at 0x100b65c3
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
add dword [edi + 4], eax
call fcn.100b6583

Function at 0x10143d32
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, byte [esp + 1]
push word [esp + 9]
lea esp, [esp + 7]
stc
jmp 0x10143ba9
sete bl
mov dx, 0x1760
xchg word [esp + 4], si
push dword [esp + 9]
mov edx, dword [esp + 3]
lea edi, reloc.WS2_32.dll_WSAGetLastError
jmp 0x10143b61
push word [esp + 7]
xchg word [esp + 0xa], bp
setnp al
lea ebp, reloc.WS2_32.dll_WSAGetLastError
pop di
ror eax, 0xa
lea esp, [esp + 5]
jmp 0x10143b77
mov esi, edx
lea eax, reloc.WS2_32.dll_WSAGetLastError
sbb ah, bl
jmp 0x10143bc5

Function at 0x1014426c
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edi
mov dh, byte [esp + 0x28]
mov byte [esp], al
mov ch, byte [esp + 0xd]
mov dh, 0x7e
jmp 0x10144287
sete al
jmp 0x10144256
neg cl
mov eax, dword [esp + 0xd]
sub esp, 4
pop esi
xchg ebp, esi
jmp 0x10144416
mov ebx, 0x71b5f0e6
popal
neg ebx
xchg bp, dx
sub esp, 0x15
add esp, 0x11
jmp 0x10144271
lea eax, reloc.WS2_32.dll_WSAGetLastError
xchg dword [esp + 1], esi
cld
not edi
rcr ch, 2
mov eax, edi
jmp 0x10144339
mov ebx, 0x2f5537f9
setl ch
neg si
lea esp, [esp + 0xb]
rdtsc
mov dl, byte [esp + 1]
jmp 0x101443b7
Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402940
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40297d
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x40299d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404918
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b30
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004046a8
test esi, esi
jne 0x402b66
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404798
jmp 0x402b84
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a44
mov edi, eax
test esi, esi
je 0x402b84
cmp dword [ebx], 0
je 0x402b84
dec esi
jmp 0x402b6d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403204
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x480008], 0x8088405
inc edx
mov dword [ebx + 0x480008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x480024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403858
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403838
xor eax, eax
push ebp
push 0x403831
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403874
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403838
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x480024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x480024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40452c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48304c], 0
je 0x40458d
cmp word [0x483220], 0xd7b2
jne 0x404555
cmp dword [0x483228], 0
jbe 0x404555
mov eax, 0x48321c
call dword [0x483238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x480094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045b4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x480034], 0
jne 0x4045a9
push 0
push 0x48008c
push 0x480094
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f68
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405dbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405dbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f84
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405e44
xor eax, eax
push ebp
push 0x405e3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405b80
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e22
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405fa4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e22
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e44
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405f5e
cmp byte [ebp - 0xd], 0
jne 0x405e8b
cmp byte [ebp - 0x12], 0
je 0x405f5e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ea4
dec ebx
cmp byte [ebx], 0x2e
je 0x405eb3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405ea3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405f5e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405ef0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f5e
cmp byte [ebp - 0xd], 0
je 0x405f5e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f5e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406630
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406696
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404918
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403384
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406680
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40669d
lea eax, [ebp - 0x10]
call fcn.004046a8
ret

Function at 0x408f18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b84
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408f31
test al, 0x10
jne 0x408f35
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4090cc
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b84
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x4090e0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404b84
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409102
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c080
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c0b9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404798
jmp 0x40c0c2
mov eax, ebx
mov edx, esi
call fcn.004046fc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c0cc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c0ed
mov al, byte [esp]
jmp 0x40c0ef
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret