joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100030b4
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x1001d9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1002a034]
xor eax, ebp
mov dword [ebp + 0x104], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1001ec0c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10019c0b
add esp, 0xc
test eax, eax
jne 0x100031a9
push dword [ebp - 0x18]
call fcn.10019c0b
cmp dword [0x1002aa80], 0
pop ecx
je 0x10003122
xor eax, eax
inc eax
jmp 0x100031ab
lea eax, [ebp]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.kernel32.dll_GetTempPathA]
cmp eax, esi
ja 0x100031a9
test eax, eax
je 0x100031a9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000330b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push str.JavaDeployReg.log
call fcn.1000330b
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.100033d2
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10003177
call fcn.100037d1
push 0x1001ec38
lea ecx, [ebp - 0x10]
call fcn.100033b4
push eax
push 0x1002aa80
call fcn.10019c0b
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
test ecx, ecx
je 0x100031a4
call fcn.100037d1
lea eax, [esi + 1]
jmp 0x100031ab
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.10004926
add ebp, 0x108
leave
ret

Function at 0x10003656
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.10019c0b
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036e0
lea eax, [esp + 0x28]
push eax
call fcn.10003656
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x100036bb
call fcn.1000342b
push ebx
mov ecx, edi
call fcn.10003445
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.1000342b
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x11c
ret 4
Function at 0x10003bc2
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10005d80
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.10019c0b
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.10019c0b
push 0x10021be8
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10019c0b
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10005d80
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003c67
sub ecx, edx
cmp ecx, 6
jbe 0x10003c8e
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.10019c0b
pop ecx
pop ecx
test eax, eax
jne 0x10003c8e
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003c95
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10020533
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.10019c0b
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.10005800
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003d0f
mov ax, word [0x10021c14]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x824
ret
Function at 0x10019c0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10019c1a
pop dword [ebp - 0x48]
mov eax, 0x10019c1a
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xbfff23c1
add dword [ebp - 0x58], 0x8e53218a
mov dword [ebp - 0x54], 0x68e6ff6b
sub dword [ebp - 0x54], 0x36b3b326
mov dword [ebp - 0x50], 0x1975f289
add dword [ebp - 0x50], 0x32d651a5
mov dword [ebp - 0x4c], 0x7b6463b4
sub dword [ebp - 0x4c], 0x7b6463b4
lea eax, [ebp - 0x58]
push eax
mov eax, 0xf56b8393
sub eax, 0xe569a313
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf214ae02
sub dword [ebp - 0x58], 0x7da244ac
mov dword [ebp - 0x54], 0xf06fa5c0
sub dword [ebp - 0x54], 0xaf03444b
mov dword [ebp - 0x50], 0xa1d2d48d
add dword [ebp - 0x50], 0xc19c97df
mov dword [ebp - 0x4c], 0x4d5fb833
add dword [ebp - 0x4c], 0xb2a047cd
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d2c0
push 0
call eax
mov ecx, 0xdb652fb6
sub ecx, 0xdb64e834
xor edx, edx
add edx, eax
mov ebx, 0x10035800
add ebx, dword [ebp - 0x48]
mov esi, 0xa983a653
sub esi, 0x48993781
mov edi, dword [ebx]
xor dword [ebp - 0x10], esi
xor edi, esi
add dword [ebp - 0x18], ebx
mov dword [edx], edi
add edx, 0xde9cacd0
add edx, 0x21635334
add ebx, 0xcc55294e
sub ebx, 0xcc55294a
loop 0x10019d2e
add eax, 0x110db
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4148c6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041473c

Function at 0x418e62
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004189b5

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7c826e7c
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1bc0074e
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x449c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xb4
lea eax, [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea ecx, [esp + 4]
xor esi, esi
push ecx
push 0x20019
push esi
push str.CLSIDE4BCAC13_7F99_4908_9A8E_74E3BF24B6E1InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x449c4f
xor eax, eax
pop esi
add esp, 0xb4
ret 4
push 0xf
mov dword [esp + 0xc], 0x104
call dword [sym.imp.USER32.dll_GetSysColor]
lea edx, [esp + 8]
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 4]
push edx
push eax
push 0
push 0
push str.ThreadingModel
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x449c89
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xb4
ret 4

Function at 0x49280a
Capabilities:
Packed with generic packer

Disassembly:
movsb byte es:[edi], byte [esi]
pushal
mov ch, 0xf4
dec edi
mov bh, 1
hlt
add eax, 0xff5fa093
ja 0x49279f
in eax, 0x35
dec ebx
popal
add byte [edi + eax*2 - 0x38], dl
xor eax, 0xc2542dd6
and bh, byte [ecx - 0x2c]
jne 0x4927f3
xchg esi, eax
imul ebx, dword [eax + 0x52], 0x53
pop eax
push edx
push ebx
je 0x49280f
sub dword [edx + 0x43], ebx
in al, 0xeb
xor cl, dl
and edi, dword [esi]
dec esp
jg 0x49287a
sub ah, byte [edx + 0x1860fdbd]
pop edx
add eax, 0x90005603
call dword [edi + 0x1577654e]
ret 0x56e6
jbe 0x4928d1
dec edi
jg 0x4928f2
shl dword [edi], 0x57
mov byte [0x4eb93b86], al
and al, 0x46
mov ah, 0xe0
in al, 0xd
adc byte [edi + 0x5755b359], ch
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov edi, dword [ebx + 0x10]
mov eax, dword [esi + 0x10]
sub edi, eax
jne 0x492a11
lea edx, [eax*4]
lea ecx, [ebx + 0x14]
lea eax, [ecx + edx]
lea edx, [esi + edx + 0x14]
jmp 0x4928c9
cmp ecx, eax
jae 0x492a31
sub edx, 4
sub eax, 4
mov ebp, dword [edx]
cmp dword [eax], ebp
je 0x4928c1
jb 0x492a1c
lea esi, [esi]
int3
dec dword [ebp + 0xff00c42]
ror dword [eax], 0x49
test ecx, ecx
jg 0x492907
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
ret
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call 0x6ed6c1
mov esp, ebp
pop ebp
ret
push es
sti
invalid

Function at 0x4b993a
Capabilities:
Encode data using xor

Disassembly:
invalid
cmp byte [edi + edx*4], cl
idiv byte [edi]
les ebx, [esi + 0x6f23a74e]
inc ebp
dec ebp
jg 0x4b991d
pop es
or al, 0xb5
adc ebx, eax
add dword [esi - 0xf], ebx
rcl edx, cl
jne 0x4b9999
mov edx, eax
popal
xchg byte [esi - 0x26], dh
mov al, 7
sbb dl, 0xcd
cmc
inc edx
xchg dword [ecx + edi*2 + 0x1e], edx
xor byte [esi], al
or dword [ebx], esp
and eax, 0xd4abe6d7
inc eax
push ebp
ret
test dword [edi - 0x5e307f9e], ebx
sub byte [eax], 0x43
xchg ebx, eax
jb 0x4b9a23
invalid
push ds
hlt
and dword [ecx + 0x38], esi
mov ecx, 0x606ed725
stosd dword es:[edi], eax
insb byte es:[edi], dx
xchg dword [ebp + 0xe], esp
loopne 0x4b99d3
int3
Function at 0x4c95be
Capabilities:
Encode data using xor

Disassembly:
and dword [ebp + 0x1e], esp
hlt
or byte [ebp - 0x7f], al
and edi, 0x52a56f4a
push es
or eax, 0x1b9472a1
mov dh, 0xc3
add dword [edx], esi
jle 0x4c95c2
and al, 0x54
and al, 0x83
push edx
out 0xf5, al
faddp st(6)
retf 0xfdf4
mov edx, 0xc77169be
and dh, byte [esi - 0x5e]
je 0x4c9645
invalid
fdiv dword [ebx + 0x57081d1d]
cmp eax, 0xd441d233
sal bl, 0xc3
mov cl, 0xea
mov dl, byte [edi + 0xb]
xor al, 0x8a
out dx, al
fnstenv [ebx + ebx*2 + 0x47]
push ebx
push es
popal
jbe 0x4c958b
in eax, 0xb2
jbe 0x4c9619
sbb al, 0x13
adc al, 0xfd
clc
jecxz 0x4c9597
invalid
in eax, dx
rcr dword [edx + ebx*8 - 0x4f68cc4c], 0xac
adc edi, dword [ebp + 0x66414d7d]
jo 0x4c966c
mov edi, 0x637e5a95
shl dword [edx + 0x47371106], 1
nop
ljmp 0x47e3
stosb byte es:[edi], al
mov ah, byte [ebp + 0x1bb4c5c6]
jl 0x4c968c
je 0x4c95f4
outsd dx, dword [esi]
shl byte [ebx - 0x3e], 0x66
lds edx, [ebx + eax]
salc
in eax, dx
adc al, 0x6e
ret
inc edx
call 0xcb4fa365
out 0x17, eax
movsd dword es:[edi], dword [esi]
int1
push 0xffffffffffffffc6
jecxz 0x4c965c
aaa
ficomp dword gs:[edx + 0x45]
movsd dword es:[edi], dword [esi]
std
mov cl, 0xa3
push esi
jg 0x4c96bb
xchg edi, eax
or edi, dword [edx - 0x76]
jecxz 0x4c96ac
adc byte [esi], bl
mov dl, 0xf6
int 0x3a
out dx, eax
cmp ch, bh
jp 0x4c968a
in al, 0x99
xor esi, dword [eax]
invalid
sbb eax, 0xb40361dd
pop es
push ebp
xor dword [esi], 0xf083f5ed
inc ebx
popal
add esi, dword [edi + eax - 0x12c97eab]
cmc
xor eax, 0x43
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x438e0f8b
test al, 3
dec ebp
imul ecx, dword [ebx + 0x23], 0xd2350d48
xor eax, 0x20936ccd
jno 0x4c965c
and byte [ecx - 0x53], dh
in eax, dx
sub ah, byte [esi]
inc esp
xor ch, cl
loopne 0x4c96b3
pop esp
test byte [edx], bl
pushfd
pop ebp
mov ch, 0x58
aaa
invalid

Function at 0x5123ae
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esp
or ebp, ebx
mov dh, 0x62
fisttp dword [ebx + 0x6b25546b]
cwde
les ecx, [ebx + 0xb55cb1b]
mov ebp, dword [0xcad76bdb]
sub edx, ecx
mov ah, 0x4a
sub al, 0xf7
scasd eax, dword es:[edi]
mov ebp, edx
cmp bl, byte [eax - 0x43]
fist word [edx - 0x64]
stosd dword es:[edi], eax
cmp al, 0xd8
imul edi, dword [ebx + 0x39], 0x302a39e4
cld
and al, 5
dec eax
adc eax, 0x4df43fea
in al, 0x44
xor al, 0x58
in al, 0x61
push esp
in al, 0xc7
sbb eax, 0x55a8ca87
invalid
Function at 0x52462a
Capabilities:
Encode data using xor

Disassembly:
cmc
mov al, byte [esi + 0x12]
jno 0x5246af
pop esi
xor ecx, dword [ebx - 0x64]
test cl, cl
lahf
ror al, 0x2f
je 0x524650
mov ah, 0x95
jl 0x5246be
sbb eax, 0xeef51aec
arpl word [eax + 0x4b], bp
test dword [esi - 3], ecx
push edi
dec ebx
xchg edi, eax
div byte [eax]
and eax, 0x62699ee0
mov ebp, 0x6b4d282d
or eax, 0x89c4b48b
neg byte [ebx - 0x5961ef83]
xor bl, byte [ebx + 0x39]
inc ecx
dec dword [ecx + edx*4 - 0x7d7d7443]
pop ebx
cmp dword [ecx - 1], eax
mov word [ecx - 0x7d7d7443], ss
sub dh, ch
fcomp qword [edi + 0x6d]
mov ebp, 0xa2cdcc2a
sbb bl, byte [esi + 0x7dbc183f]
mov bh, 0x65
push edi
xchg esp, eax
and byte [esi + 0x2bd882eb], bh
xor eax, 0x69d3b412
js 0x524666
pop es
push edi
sbb eax, 0xa260f7e4
enter 0xfffffffffffff3a2, 0xffffffffffffffc4
pop ss
adc byte [eax], bh
in eax, dx
pop esi
daa
dec edi
xchg esp, eax
sub byte [edx - 0x582b7515], ah
aam 0xa7
js 0x5246a8
aas
cdq
cld
mov esp, 0x1d5707d5
in al, dx
jae 0x5246af
dec ebx
mov al, byte [edx + 0x12a3d3f1]
aaa
pop ecx
pop esi
aaa
push ebx
sbb byte [ebp + 0x54], ah
pushal
ror byte [ecx + 0x63], 0x78
js 0x5246c8

Function at 0x5a1994
Capabilities:
Encode data using xor

Disassembly:
in al, 0xf4
or esp, dword [ecx - 0x2c]
mov ah, 0x27
xchg esp, eax
nop
pushfd
pushal
sal dword [eax], 1
mov cs, word [eax - 0x44]
sbb dh, byte [eax - 0x17b7b4d1]
jp 0x5a19f9
test al, 0x6d
mov dl, 0xc7
invalid
insb byte es:[edi], dx
add esp, dword [ecx + 0x72]
mov dword [0x51042d03], eax
sub bh, ah
dec edi
and bl, cl
scasb al, byte es:[edi]
and eax, 0xb984849a
mov ebx, 0x4d963e2a
invalid
push 0x4e
call 0x2fb611af
jne 0x5a1a37
xor eax, 0xfdecaa26
std
xchg ebp, eax
jle 0x5a1a4e
jecxz 0x5a1a61
mov edx, 0x3f50f240
nop
scasb al, byte es:[edi]
test ch, ah
mov bh, 0x2c
daa
int 0xe2
sal edx, 1
xor byte [edx - 2], bh
mov ah, 0x8c
push 0xe58d1d7c
mov gs, word [ebp + 0x11]
invalid
mov ah, 0xde
in al, 0x91
pop ss
jle 0x5a19d8
cdq
nop
mov bl, 0xe6
out dx, al
sbb cl, byte [ebp - 0x7e7997eb]
mov dh, 0
out dx, al
mov dl, 0xfe
add eax, 0xe00eecd5
inc byte [0xe00eecd5]
cmp eax, 0x492e5fb5
lds eax, [esi - 0x43]
rol edi, 1
mov esp, 0x55144c0c
adc al, 0x55
les ebx, [eax + 0x3d]
cmp bl, dl
cmp bl, dl
jne 0x5a1ac8
xor edx, dword [esi + 0xedbec64]
cwde
pop ds
mov ah, 0xec
pushfd
std
xchg ecx, eax
dec ebp
loope 0x5a1a67
clc
das
jle 0x5a1a06
inc ecx
mov ebp, 0xf392ef11
ret
or al, 0x3f
push ds
mov bl, 0x23
inc esi
aam 0xb4
enter 0xea6, 0x52
fiadd dword [esi - 0xa211fe3]
rcr esp, 1
push ebx
push edi
in al, 0xe4
pushal
mov ch, 0x32
mov bh, 0x70
sal ebp, 1
xor byte [ebp - 0x32], dl
xor al, 0xc0
loop 0x5a1b60
xchg edi, eax
mov esi, 0x8926e047
inc eax
daa
into
pop edi
test eax, 0x28c45a4a
mov es, word [esi - 0x57]
adc eax, 0xba92f5bf
jmp 0x5a1b77
lahf
int1
mov dh, 0x12
invalid
scasb al, byte es:[edi]
sbb ah, dl
push ebx
sbb al, 0x71
or ebx, dword [ebp - 0x3b]
mov al, byte [0x7d096d85]
xor dword [ebx], ebx
sbb ch, bh
mov byte [ebx], dl
push 0x85363f97
ret
Function at 0x641e51
Capabilities:
Encode data using xor

Disassembly:
xor ah, byte [eax - 0x4f]
insb byte es:[edi], dx
mov cl, 0x6c
mov bl, 0x1c
salc
mov byte ss:[0xff07c484], al
aam 0x20
and al, 0x18
pop ebp
xor byte [ecx - 0x1b55180c], 0x4e
mov dl, dh
imul esi, dword [eax - 0x63891bac], 0x2e
loop 0x641e53
inc ecx
jle 0x641eea
add dh, byte [edi - 0x4f0e0eec]
invalid
xchg edi, eax
and edx, dword [edx - 0x7b151c8e]
mov byte [edi], 0xe6
in eax, dx
or bh, byte [ebp - 0x59]
pop ss
fcom qword [edi]
invalid
Function at 0x40304c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x485020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030e4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030c4
xor eax, eax
push ebp
push 0x4030bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403100
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x485020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x485020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403db0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48704c], 0
je 0x403e11
cmp word [0x487220], 0xd7b2
jne 0x403dd9
cmp dword [0x487228], 0
jbe 0x403dd9
mov eax, 0x48721c
call dword [0x487238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48506c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e38
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x485030], 0
jne 0x403e2d
push 0
push 0x485064
push 0x48506c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405580
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4057b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405603
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4057b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405603
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4057cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40568c
xor eax, eax
push ebp
push 0x405685
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004053c8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40566a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4057ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40566a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40568c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4057a6
cmp byte [ebp - 0xd], 0
jne 0x4056d3
cmp byte [ebp - 0x12], 0
je 0x4057a6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4056ec
dec ebx
cmp byte [ebx], 0x2e
je 0x4056fb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4056eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4057a6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405738
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4057a6
cmp byte [ebp - 0xd], 0
je 0x4057a6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4057a6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405e78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405ede
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040419c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c10
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405ec8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ee5
lea eax, [ebp - 0x10]
call fcn.00403f2c
ret

Function at 0x40b280
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b2b9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040401c
jmp 0x40b2c2
mov eax, ebx
mov edx, esi
call fcn.00403f80
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b2cc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b2ed
mov al, byte [esp]
jmp 0x40b2ef
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b974
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b7ec
mov eax, dword [0x486e40]
cmp byte [eax], 0
je 0x40b9f0
mov eax, dword [0x486be4]
call fcn.00402a40
call fcn.004028b4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408a14
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ba38
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ba26
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x486b80]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x487668]
call fcn.0040538c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret