joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14ad4fd
Capabilities:
Authenticate hmac
Encode data using xor
Encrypt data using chaskey

Disassembly:
inc ecx
mov edi, dword [ecx + edx]
mov dword [ebx + edx*4 - 8], edi
inc esp
adc dword [esp + edx*2 + 2], edi
dec eax
lea ebx, [edx + ebx - 8]
inc esp
movzx ecx, al
ja 0x1560c59
dec ecx
xadd edi, edx
dec esp
mov esi, dword [esp + edx - 0x3e]
dec eax
arpl bp, bp
sete dl
dec eax
adc esi, ebp
dec eax
inc dword [esp + edx*2 + 8]
inc ebp
movzx ecx, word [esp + edx*4 - 8]
div eax
dec esi
lea ebp, [edi*2 + 0x1c003014]
dec eax
mov dword [esp + edx + 0x10], eax
dec ebp
lea esp, [esp + edx*4 - 8]
inc bp
xor ecx, esi
pop edi
inc cx
add ecx, 0x4166cf81
ror ecx, 1
inc sp
sub ecx, eax
inc ecx
push edi
inc cx
ror ecx, 1
inc ecx
shr dl, 0xa5
inc bp
xor esi, ecx
inc cx
xchg ebp, eax
dec ebp
add edi, edx
dec esi
lea ecx, [esp + ecx + 0x18]
jge 0x145359d
inc ecx
pop ebx
pop edi
inc ecx
pop edi
jne fcn.014429a1
jmp ebx
jecxz 0x1560cc1
xor esi, edx
sub dword [0x30e7e7ba], edx
adc dword [ecx - 0x46], ecx
out 0xe7, eax
xor al, 0xa9
push ecx
mov edx, 0x1594e7e7
jae 0x1560c63
inc ebx
dec eax
xor byte [edi - 0x2e96d4f6], dh
push esi
jg 0x1560ca2
sub byte [edx + 0x1d], 0x45
pop ebp
imul edx, dword [eax + 0x74f29a10], 0xffffffae
fdivrp st(7)
add eax, 0xbaf7f070
jecxz 0x1560c73
jmp dword [edx - 0x23]
push edi
wait
test al, 0xda
salc
cmc
cld
fidiv word [eax]
pop ebp
lea dx, [ebx - 0x7b8824fd]
pop ss
sahf
invalid
wait
sbb ebp, dword [ecx + 0x7fa6535]
inc ecx
out 0x1d, al
call 0x218c3a85
mov ch, dh
dec eax
dec edx
sti
idiv byte [ecx + eax*4 + 0x37]
pop esp
cmc
mov ah, 0xf3
push es
jg 0x1560d43
scasd eax, dword es:[edi]
xchg esi, eax
invalid
lcall 0x4ee2, 0xcb74984
leave
ljmp 0x88e9
cmp ebp, ecx
mov dh, dh
sub byte [edx + 0x17], ah
fidivr dword [ebx]
or byte [edx + 0x49752909], ah
dec ecx
lea ebx, [esi - 0x17b9d6d7]
dec ebx
je 0x1560dae
aas
jnp 0x1560d37
xchg edx, eax
or dword [esi + 0x5a], edx
pop edx
shr byte [ebx + 0x62ce4f89], cl
push edi
cmpsd dword [esi], dword es:[edi]
mov dword [eax + 0x5b69aeb1], esp
mov al, byte [0x5b69aeb1]
fisttp dword [ecx - 0xe12a9bb]
jnp 0x1560ddd
lodsd eax, dword [esi]
loope 0x1560dce
dec edi
mov bl, 0xe0
js 0x1560d6c
pop esp
xchg ebp, eax
dec eax
jbe 0x1560d62
adc ebp, dword [ecx + 0x77]
xchg byte [edi + 0x53], cl
adc dword [ebx - 0xd0c9dd7], ebp
xchg edi, eax
xlatb
push eax
enter 0xffffffffffffb1f2, 0xffffffffffffffd3
in eax, dx
outsb dx, byte [esi]
mov al, 0xae
popal
jae 0x1560d94
pop eax
sete byte [edx + 0x5f]
jno 0x1560e19
fst dword [eax - 0x4a]
mov dword [0xb1a0baa5], eax
int1
mov cl, 0xf1
add byte [edx + esi*8], cl
or eax, 0x847ffbd3
sub ah, dl
in eax, 0x67
and eax, 0x518af6de
and byte [edx], bh
mov byte [0xd1cbf6ed], al
out dx, eax
mov edi, 0xf5a93072
push ebx
push 0x5f
wait
mov ah, 0x77
daa
in eax, 0xd2
fcmovnbe st(0), st(7)
pop ecx
invalid
pop ebx
xchg ecx, eax
std
xor cl, byte [edi + 0x1d8a51a0]
inc ebp
adc edi, edx
fistp qword [esi - 8]
push cs
stc
nop
arpl word [edx], di
sub ebx, dword [esi]
and dword [edi + 0x7bcf2306], ecx
invalid
out 0xdb, al
invalid
Function at 0x14b008b
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov dword [esp + edx - 0x70c1bc24], esi
ror cl, 0x25
dec ecx
dec eax
xor dword [esp + ebp - 0x70c1bc0c], edi
dec eax
xor eax, ebp
jp 0x15701e3
dec ebp
xor eax, ebx
inc ecx
pop esi
call fcn.0148ad19

Function at 0x14b90ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop edx
inc ecx
pop ebp
inc ecx
pop edi
jb fcn.014429a1
inc ecx
mov ebx, 0xa08e0309
dec esp
mov ebp, dword [ebx]
dec ebx
lea edi, [ebx + ebx + 0x6820493c]
dec ebp
lea edi, [ebx + edi*4 + 0x3fbf4d81]
inc ebp
mov edx, dword [ebp]
inc eax
movzx ecx, bh
mov edx, 0x660970b7
inc esp
mov dword [ebx + ecx*4 - 0x134], edx
movzx eax, dx
dec esp
lea eax, [ebx + ecx - 0x4a]
cwde
cwd
dec esp
mov dword [ecx + ebx - 0x52], eax
sub edx, 0xda92099b
inc esp
movzx edx, dx
dec ecx
ror edx, cl
dec eax
lea ebx, [ebx + ecx - 0x52]
cbw
inc cx
adc ebx, 0x8b417c2b
lodsb al, byte [esi]
dec esp
pushal
invalid

Function at 0x151ee30
Capabilities:
Encode data using xor

Disassembly:
rol ecx, 3
dec word [esp + 0x10]
mov dword [esp], 0x438eaca2
xor ebx, ecx
call fcn.0145e591

Function at 0x15218a6
Capabilities:
Encrypt data using chaskey

Disassembly:
inc dword [esp + 8]
xor edx, 0xd41f2818
dec eax
jmp 0x155a729
sar byte [esp + 7], 0xe5
inc ecx
push 0xc6a53095
jmp 0xcf1d91

Function at 0x153ae6e
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [esp + ebx*4 - 0x60], 0x94a65435
not al
inc dx
mov dword [ebx + ebx - 0x16], eax
inc edx
and dword [esp + ebx*4 - 0x5e], 0x7f392219
inc ebx
mov edi, dword [esp + ebx*8 - 0xc4]
inc esi
mov edi, dword [esp + ebx*4 - 0x5d]
inc edx
dec dword [esp + ebx - 0xc]
inc ecx
push ebx
dec edi
lea esp, [esp + ebx*8 - 0xc4]
inc ecx
xor edi, esi
dec edi
lea eax, [ebx + ebx*8 - 0x3a46d06d]
xor edi, 0xca9845a6
dec edi
rol edi, 3
inc edi
call fcn.01593a8b
inc esi
stc
xor al, 0xd6
test byte [eax + ebx + 0x58c1e7e2], dh
mov byte [eax], bl
loop 0x153aeb7
retf 0x58b
int 0x14
mov al, 0x18
loop 0x153aebd
in eax, dx
mov ah, bl
push esp
dec esi
mov byte [0x19f1972e], al
jae 0x153af16
xor ebx, dword [edi - 0x3a]
add dword [ecx], 0x32d0669f
jo 0x153af15
sub ebx, dword [esi - 0x793e6c17]
invalid
pop eax
adc byte [ebx], ah
or eax, 0x148c459d
and ecx, dword [0x78e0119d]
or eax, 0x78e0119d
popfd
adc eax, esp
js 0x153af3e
and ecx, dword [0x90d8dd9d]
or eax, 0x90d8dd9d
xor al, 0x4d
popfd
jno 0x153af8d
push ss
notrack jmp 0xfa0180c9
out 0x76, eax
dec ebx
pop ebp
inc ebp
inc esi
dec eax
mov esi, 0x6c8818b8
shl dword [eax - 0x24], 1
mov dl, 0x1d
xor ebx, edx
wait
sub dh, byte [ebx + 0x2af5c9b7]
push ebx
ja 0x153af0c
das
push eax
cdq
sub al, 0xe
inc ebp
mov eax, 0xf51ac11a
jo 0x153af8b
xchg ebx, eax
mov eax, dword [ebp - 0x48427b7]
test dword [ecx - 0x28], ecx
jnp 0x153af6c
adc eax, 0xd551480c
push ebx
dec ecx
out dx, eax
xchg byte [edi - 0x51], cl
fdivr qword [edi + 0x28316da0]
invalid
invalid
loope 0x153af96
adc al, 0xdc
adc esi, dword [edi]
pop edi
pop ecx
sahf
add al, 0x4c
jp 0x153af6c
invalid
Function at 0x153f9bc
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [ebx + edx*8 + 8], eax
inc ecx
mov edi, dword [esp + edx - 4]
dec ebp
lea esp, [esp + edx*4 - 4]
not byte [esp + edx + 0xf]
inc ecx
xor edi, esi
xor dx, dx
bswap edi
xor dl, dh
ror dx, 8
push edx
not edi
jne 0x147169a
dec edi
imul dx, dx
and dl, dh
rol word [esp + edx*8 + 0x14], 0x29
ror edi, 3
dec esp
mov dword [esp + edx*2 + 0x10], esi
xor dword [esp + edx + 0x10], edi
dec eax
xchg dword [esp + edx*2], edx
dec esp
mov esi, dword [esp + edx*2 + 0x10]
xchg dword [esp + edx*4 + 4], edx
dec eax
dec edx
dec eax
mov dword [esp + edx + 0x11], edx
dec eax
arpl di, di
sal byte [esp + edx + 0x14], 0x82
pop edx
not dx
dec eax
add esi, edi
dec eax
lea edi, [edx*4 + 0xaa771a3]
dec eax
mov dword [esp + edx - 0xffff], edx
dec eax
mov edx, dword [ebx + edx - 0xfff7]
call fcn.00ccec76
mov ecx, dword [esi]
mov edx, 0x6ba96e84
lea esi, [esi + edx - 0x6ba96e80]
movsx eax, dx
dec dl
xor ecx, ebx
and dx, ax
adc dl, 0x9b
neg ecx
cwde
bt edx, edx
shr eax, 0x2a
inc ecx
shl al, 0x21
not ecx
add dl, 0x15
and edx, 0x46bb919a
and dl, al
lea ecx, [ecx + eax*2 - 0x12bba902]
setb al
imul dl
neg ecx
and edx, eax
not dl
inc ecx
div dl
lea eax, [eax + eax*8 - 0x42f446c6]
xor ebx, ecx
add edi, ecx
xor edx, 0xb68e4511
sbb ax, 0x4e86
mov eax, ebp
movsx ecx, dx
btc edx, edx
or edx, ecx
lea ebp, [ebp + ecx*8 - 0x22f74]
adc edx, 0x6933601a
mov dword [ebp + ecx - 0x45ee], eax
jns fcn.014a9a0a

Function at 0x1540b5f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec ecx
or ebp, 0x3b1de704
inc cx
btc eax, 0xb4
inc bp
movzx edx, byte [ebp + edi - 0x3b1def74]
inc ecx
movzx edi, ax
dec eax
lea ebx, [ebx + edx*2 - 2]
inc word [esp + edx + 0xb]
inc sp
mov dword [ebx + edx*4], edx
inc ecx
shl ch, cl
pop eax
pop ebp
pop edx
jp fcn.014429a1
push 0x180a7629
inc esp
mov ebx, dword [esp + 3]
inc dx
movzx eax, byte [ebx + ebx - 0x18]
inc ebp
mov al, byte [ebx + ebx - 0x16]
inc ecx
and al, al
call fcn.0153ae6e
xor al, 0x5c
xor edx, esi
push es
into
mov ebp, 0x4a3be7e5
xchg byte [ebp - 0x61f4181b], bh
cmpsb byte [esi], byte es:[edi]
mov ebp, 0x68be7e5
mov byte [0x16eafbd9], al
or dword [eax + 0x75ed73fc], eax
inc edi
add bl, 0xb9
add al, 0x17
ret 0x1dec

Function at 0x15550d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc dx
mov dword [ebx + edi - 0xe53], eax
inc cx
sar eax, 6
inc ecx
pop edx
inc ecx
pop ebp
inc ecx
pop edi
jbe fcn.014429a1
inc esp
mov eax, eax
inc ecx
btr eax, 0x8c
dec eax
mov dword [esp + edx], esi
ret
dec esi
mov esi, dword [esp + ebp - 0x430b008d]
movzx eax, dl
dec esi
lea ecx, [ebp + ebx + 0x1b293629]
dec ebp
arpl dx, dx
inc ebp
movsx eax, bl
movsx edi, word [esp + eax*4 - 0x94]
dec ecx
add esi, edx
dec eax
mov eax, ebx
sar di, 0xc2
not ecx
dec eax
mov dword [esp + edi*2 + 0x10], 0xd7177010
dec ecx
lea ebx, [ebp + ebx - 0x430b009f]
dec ecx
sar edi, 0x14
jae 0x1471691
inc ecx
pop ebp
dec ecx
add ebp, 0xff808a4a
inc ecx
jmp ebp
Function at 0x156bb10
Capabilities:
Authenticate hmac
Encrypt data using chaskey

Disassembly:
xor eax, 0xe92f0132
dec edx
call fcn.00cba2f8
inc ecx
shl dword [esp + 4], 2
jne 0x149b96d
pop ecx
pop eax
push cs
mov dword [0x77e8a897], eax
insd dword es:[edi], dx
inc esi
sub bl, dh
or al, 0xa0
xchg ebp, eax
lodsb al, byte [esi]
in al, dx
xor esi, edx
scasb al, byte es:[edi]
jle 0x156bb3f
out 0xe7, eax
retf
out 0x17, eax
shl byte [esi], cl
imul edi, ecx, 0x30f15aea
invalid

Function at 0x1570465
Capabilities:
Encode data using xor

Disassembly:
inc ebp
movzx ebp, word [esp]
push 0xe95dfb8
inc ecx
mov eax, 0xdf14fb36
inc bp
xor ebp, esi
inc cx
rol ebp, 1
inc cx
sub ebp, 0x8d4eeb04
cmp al, 0xc5
cmp byte [ecx + 0x13], cl
inc edx
inc cx
rol ebp, 1
inc ecx
push edi
inc ecx
movzx edi, bh
inc cx
add ebp, 0xc10f1b84
mov esp, 0xffff203c
dec dword [eax - 0x73]
xchg edi, eax
xchg edi, eax
pop esi
sbb eax, 0x334566d5
cmc
inc ecx
bts eax, edi
inc esp
movsx ebx, dl
movzx ecx, word [esp + edi - 0xe95dfb8]
dec eax
lea ebx, [ebx + edi - 0xe95dfba]
jb 0x159ebdd
mov edx, dword [esi]
jns 0x1551403
dec ecx
sub esp, 2
jmp 0x1490613
sal word [esp + 9], 0x43
mov ecx, dword [esp]
lea esi, [esi + ecx - 0x69b9609]
xor edx, ebx
mov eax, 0x5a31af27
sal dword [esp + ecx*4 - 0x1a6e582c], cl
bswap edx
add cx, cx
sbb edx, 0x9b192c9b
add cl, al
or byte [esp + eax - 0x5a31af22], al
adc ebp, 4
not word [esp + 6]
mov dword [esp], 0xcb0b4c12
push 0x69b960d
div ecx
sar byte [esp + 5], 0xe5
mov dword [ebp], edx
mov dword [ebp + 4], eax
jae 0x14a40d7
push ss
push ebx
xor dh, dl
sub al, 0xe8
mov dl, 0xe6
out 0x3d, eax
pop esp
invalid
neg dword [esp + edi - 0xe95dfad]
inc sp
mov dword [ebx + edi*2 - 0x1d2bbf70], ebp
inc ecx
mov edx, 0xb9a852b1
dec ebp
lea esp, [esp + edi - 0xe95dfbc]
setge byte [esp + edi*2 - 0x1d2bbf6f]
inc ecx
neg bl
inc ebp
mov edx, dword [esp + edi*2 - 0x1d2bbf70]
adc dword [esp + edi - 0xe95dfb3], 0xf717d5a8
sal word [esp + edi - 0xe95dfb0], 0xae
dec ebp
add eax, edi
inc ebp
xor edx, esi
inc ebp
xor bh, al
inc eax
neg bh
inc ecx
inc edx
jmp fcn.015402cf

Function at 0x1577b5f
Capabilities:
Authenticate hmac
Encode data using xor
Encrypt data using chaskey

Disassembly:
mov edx, dword [ebp + ecx - 0x5abb5ba5]
push ecx
mov ecx, dword [ebp + ecx - 0x5abb5ba1]
call fcn.00cdf249
inc bp
add ebp, ebp
dec esi
lea ebx, [esp + ebx + 0x10]
pop eax
dec edx
mov dword [esp + eax*2 - 0x1b0], ecx
dec edi
mov dword [ebx + eax - 0xd8], edi
inc edx
xchg byte [esp + eax - 0xd2], ch
dec edi
lea esp, [esp + eax*2 - 0x1b4]
inc edi
mov edi, dword [esp + eax*2 - 0x1b0]
inc edx
add byte [esp + eax - 0xd5], 2
inc esi
movzx ecx, byte [esp + eax*4 - 0x35f]
call fcn.00cee9b6
mov ecx, 0x5abb5ba5
jmp 0x1449f6f

Function at 0x1589c93
Capabilities:
Encode data using xor

Disassembly:
pop eax
mov eax, dword [ebp]
call int.0143a274
Function at 0x1599834
Capabilities:
Encode data using xor

Disassembly:
push 0xff161a35
lea esp, [esp + 4]
jmp 0x15abb47
add ax, ax
rol edx, 1
jmp 0x14468e6
adc edi, edx
lea esp, [esp + 0x1c]
jmp 0x151844f
push ebx
mov ebx, 0x90a93f
mov ebx, dword [esp + ebx*4 - 0x242a4fc]
mov dword [esp], 0xfe85dff0
call fcn.01481a3a
mov edx, 0xd33ca4aa
mov edx, dword [esi]
mov ecx, 0x389252a9
sub ecx, 0x66383005
inc cl
xor edx, ebx
mov eax, 0x7820a795
shr cl, 0x43
neg edx
dec ecx
sal ecx, cl
not edx
xor eax, ecx
shr al, 0x62
xchg cx, ax
dec edx
sar al, cl
jbe 0x1539a18
push 0xe48cdcb0
push 0x6424de3e
lea esp, [esp + 0xc]
jne 0x14b2aa6
Function at 0x402a54
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404874
test esi, esi
jne 0x402a8a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404964
jmp 0x402aa8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402908
mov edi, eax
test esi, esi
je 0x402aa8
cmp dword [ebx], 0
je 0x402aa8
dec esi
jmp 0x402a91
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403058
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45a008], 0x8088405
inc edx
mov dword [ebx + 0x45a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403998
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45a010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a30
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a10
xor eax, eax
push ebp
push 0x403a09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45a010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45a010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4046f8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45b044], 0
je 0x404759
cmp word [0x45b218], 0xd7b2
jne 0x404721
cmp dword [0x45b220], 0
jbe 0x404721
mov eax, 0x45b214
call dword [0x45b230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45a084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404780
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45a020], 0
jne 0x404775
push 0
push 0x45a0a4
push 0x45a084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406424
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406548
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40639b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406548
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40639b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406564
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406424
xor eax, eax
push ebp
push 0x40641d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406160
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406402
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406584
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406402
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406424
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40653e
cmp byte [ebp - 0xd], 0
jne 0x40646b
cmp byte [ebp - 0x12], 0
je 0x40653e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406484
dec ebx
cmp byte [ebx], 0x2e
je 0x406493
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406483
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40653e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4064d0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40653e
cmp byte [ebp - 0xd], 0
je 0x40653e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40653e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a404
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a43d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404964
jmp 0x40a446
mov eax, ebx
mov edx, esi
call fcn.004048c8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a450
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a471
mov al, byte [esp]
jmp 0x40a473
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40aaf8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a970
mov eax, dword [0x45aee0]
cmp byte [eax], 0
je 0x40ab65
mov eax, dword [0x45ad30]
call fcn.00402e7c
call fcn.00402878
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040963c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40abac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ab9b
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x45acec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45b710]
call fcn.00406124
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40b604
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b668
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404adc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040937c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b66f
lea eax, [ebp - 0xc]
call fcn.00404874
ret
Function at 0x41cff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45ba34
cmp dword [edi], 0
jne 0x41d06c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45ba30]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45a4f4
mov ecx, 2
call fcn.004028c8
mov edx, 0x41cfc8
lea eax, [esi + 5]
call fcn.0041cfe8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041cfe8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41d041
mov dword [0x45ba30], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41e1f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e1fe
ret

Function at 0x420600
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x420651
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x420638
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x420628
jmp 0x420651
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x420639
pop ebx
mov esp, ebp
pop ebp
ret