joyce8/EMBER2024-capa huggingface dataset:
Function at 0x86bb1e
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx], bh
aad 0x33
sal edi, cl
shl byte [esi - 0x7f], cl
invalid
jo 0x9a2dee
call fcn.009bd550
cli
jecxz 0x86bb72
div byte [eax + 2]
mov esp, dword [edx - 0xa]
inc ecx
cdq
sub byte [ebx + 0x4f752709], bl
jg 0x86bb32
jo 0x86baf0
cdq
or dword [ecx], 0xffffff8f
mov edi, 0x59099359
retf
or eax, esi
jb 0x86bbbb
inc edx
mul bl
retf
or eax, ebp
shl byte [edi], cl
inc edx
imul byte [edi + 7]
out 0x52, eax
mul cl
imul esp, edi, 0x5d
not byte [eax + 0x983d3f2]
and esi, dword [ebx - 0x1e]
xchg ecx, eax
or dword [ecx + 0x35], edx
sub dword [ebp - 0x3ddb6646], 0x1a
mov ecx, 0xfcbe2f7b
add bl, dl
je 0x86bb95
push eax
xchg ebp, eax
loopne 0x86bb4a
imul edi, dword [esi + 0x4cc162f9], 0xc7f81ac5
mov byte [0xbef868f7], al
xchg dl, dl
lahf
xchg ebx, eax
iretd
add ch, byte [ebx - 0x102f0991]
mov al, 0xf2
xchg edi, eax
jge 0x86bb8e
invalid
lea ecx, [ecx*4 + 0x5b481c86]
push esi
nop
mov ebp, ecx
call fcn.009ecd11

Function at 0x895671
Capabilities:
Encode data using xor

Disassembly:
jb fcn.00948992
add dword [esp], 0xff71b1aa
call fcn.0099dd2a
fisub word [edx + 0x1cd15864]
lea ebx, [eax - 0xab65b59]
and dword [edi - 0x7e718343], 0xc38e1a7
pop esi
pop eax
push ebx
mov ss, word [ecx]
inc ecx
pop eax
aam 0x2d
xlatb
test al, 0xa7
xchg ecx, eax
shr byte [edi - 0x50105abc], cl
cmpsd dword [esi], dword es:[edi]
cdq
pop esp
mov byte [0x927b5843], al
test eax, 0x31e45877
sub dl, byte [edi - 0x3c21b059]
and eax, 0x7ef9795b
push ebx
popal
inc esp
lds edx, [ebx + 0x6af73aa7]
pop eax
push es
in al, dx
salc
add dword [edx], eax
inc edi
cmp dl, byte [ecx]
je 0x895733
invalid
movsb byte es:[edi], byte [esi]
or dword [ecx], ecx
mov edi, 0x840e0b7c
out 0xc1, al
loop 0x895752
xchg esp, eax
or edi, dword [esi]
inc eax
cdq
mov dword [esi + edi], edx
ret
xchg byte [edi - 6], dh
sar dword [edx + 0x3e163a4f], 0x68
mov ecx, 0xcf3e2231
or dh, byte [edx - 0x56833e3e]
aaa
aaa
add esp, esp
dec edi
sub ch, dh
xor al, 0x2e
pushal
invalid

Function at 0x8a9184
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esp + 8]
mov esi, 0x2f18252d
xor si, 0x12c9
jle 0x68a301
lea esi, [esi*8 + 0x267e4d1e]
and esi, esi
mov esi, dword [esp]
add dword [esp + 0xc], 0xff6cd5d7
call fcn.00957646
dec edx
clc
rol edx, 1
test edi, 0x6c4031ad
clc
xor ebx, edx
clc
cmc
add esi, edx
jmp fcn.008312ed
push ebp
mov ebp, 0x1e09701f
lea ebp, [ebp + 0xc39456a]
pushfd
and ebp, 0x4b1617c6
mov dword [esp + 0xc], 0x13606960
push esi
jno 0x68a2f8
Function at 0x8af9f8
Capabilities:
Encode data using xor

Disassembly:
and al, 0x10
test dword [esp + 0x10], 0x548907dd
and al, 0x10
push esi
mov ebx, esi
mov ebx, dword [esp + 0x18]
mov ebx, dword [ebx]
and dword [esp], 0x76641e5e
call fcn.009a4985
arpl word [0xca8d1d1e], bp
jecxz 0x8af9bd
sal esp, cl
stosb byte es:[edi], al
pop ss
pop ecx
adc dword [eax], ecx
jecxz 0x8afa98
pop ecx
or eax, 0x59077e13
pop es
pop ecx
call 0xa750f2ce
jle 0x8af9b3
sub eax, dword [edx + 0x59]
test dword [ebp + 0x1f], ebp
add dword [ecx + 0x7e], ebx
xchg esi, eax
xchg edx, eax
add byte [ecx - 0x67], bl
push edx
pop edx
or eax, 0x87a9b359
fisub dword [esi + 0x71a444ae]
pop ecx
scasd eax, dword es:[edi]
call 0x35e42780
ljmp 0xe416
xor dword [0xadea3559], ebp
fldenv [esi - 0x491be9f1]
cmpsb byte [esi], byte es:[edi]
out 1, eax
jns 0x8afa25
cmpsb byte [esi], byte es:[edi]
mul byte [eax - 0xba6e2ea]
xor eax, 0x866ce60a
les esp, [edi - 0x3d]
and eax, dword [ebx + 0x2b987c2]
cwde
dec edi
out 0xab, ax
js 0x8afa24
mov cl, 0x5a
inc esp
dec ecx
adc ebp, dword [esi - 0x160e7ab]
shr cl, cl
in al, 0x40
seto ah
push cs
mov edi, 0x71707878
inc edx
sbb ebx, dword [eax]
wait
fdivr dword [eax - 0x6f1ae8e1]
in eax, 0x90
in al, 0xe5
push edx
jbe 0x8afa4b
jno 0x8afa51
out 0x22, eax
mov ebx, ebx
or esp, ebx
push ss
push ss
cmp bl, ch
je 0x8afa76
popfd
aad 0x21
lahf
cld
int3

Function at 0x8c07ff
Capabilities:
Encode data using xor

Disassembly:
pop ebp
push 0x79b25c90
pushfd
test byte [esp + 4], 0x2a
setl byte [esp + 4]
xor dword [esp + 4], 0x315d7699
cmp dword [esp + 4], 0x3bf56ee5
mov dword [esp + 4], 0x3bb1011
xchg dword [esp + 8], ebp
call fcn.0086feb7

Function at 0x8c57c3
Capabilities:
Encode data using xor

Disassembly:
jmp ebp
dec ecx
clc
cmp bx, di
jmp 0x8fabe4
call fcn.0093b6ff
mov bx, 0x2086
ja 0x8c401e
mov ecx, dword [esi]
sub ah, 0x84
movzx ax, dh
sbb ax, sp
mov eax, dword [esi + 4]
test sp, bp
cmc
lea esi, [esi + 8]
jmp 0x9e1faf
xor ecx, 0x11d56e81
stc
test ax, 0x4d56
xor ebx, ecx
test ch, dh
clc
add ebp, ecx
jmp 0x71dd9c
ror ecx, 1
jmp 0x782a12
mov dword fs:[ecx], eax
mov ecx, dword [edi]
stc
lea edi, [edi + 4]
xor ecx, ebx
bswap ecx
stc
jmp 0x9662fb

Function at 0x8d5444
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xe8311e38
aam 0xa4
pop es
add byte [ebx], al
add esi, esi
mov esi, dword [esp + 0x14]
not dword [esp + 8]
call fcn.0085cacb
jecxz 0x8d54c1
inc esp
pop esp
in eax, dx
jge 0x8d541b
invalid

Function at 0x8fd06c
Capabilities:
Encode data using xor

Disassembly:
ja 0x8de266
test ebp, ebp
call fcn.0092e945
Function at 0x99dede
Capabilities:
Encode data using xor

Disassembly:
cmp dx, 0x22e8
push ecx
call fcn.0088661e
mov ecx, dword [esp + ecx - 0x78a63c42]
lea ecx, [ecx + 1]
mov dword [esp + 8], 0x3b510c9b
add dword [esp], 0x383251
or dword [esp + 8], 0x7886c66
or dword [esp + 8], 0x11986062
and word [esp + 8], 0x53d7
add dword [esp + 8], 0x50ee0efe
mov dword [esp + 0x10], ecx
add dword [esp + 8], 0x19be1f48
setg byte [esp + 8]
cmp dword [esp + 8], 0xd5b0595
setb byte [esp + 8]
sub word [esp + 8], 0x6321
nop
add dword [esp + 8], 0x65403f82
mov ecx, 0x6c656b81
add cx, word [esp + 9]
mov ecx, dword [esp]
mov ecx, dword [ecx]
xor dword [esp + 8], 0x113f0fd5
not dword [esp + 8]
call fcn.0089ef15
ja 0x829ef3
test byte [esp + 0x10], bh
lea eax, [eax + ebx*4 - 0x2ebe185a]
mov dword [esp + 4], ebx
push ebx
push 0x4ca2314b
call fcn.00869fed

Function at 0x9cb38f
Capabilities:
Encode data using xor

Disassembly:
push esp
movsb byte es:[edi], byte [esi]
invalid
mov edi, dword [esp + 0x1c]
lea edx, [edx + edx*2 + 0x22e51470]
call fcn.0065464d
mov es, eax
pop eax
mov al, 0x37
or bh, al
mov ebx, 0xfd9a4b4f
mov edi, 0xc092474f
mov esp, 0x8d57a64f
push eax
mov al, 0x70
mov ecx, 0xcfb06486
push edi
lea edx, [eax - 0x50]
jo 0x9cb372
xchg byte [eax + esi*4 - 0x31], ah
sub al, byte [0xad544f84]
xor byte [ecx - 0x50], 0x35
fnstenv [ecx - 0x3b]
and al, 0x79
lodsd eax, dword [esi]
shl dword [ebx + 0x18], 1
pop ecx
jne 0x9cb3b3
cld
adc dword [ebp + 0x7af00567], esi
mov bl, byte [edi - 0x4f]
inc esi
sbb dword [ecx + eax], edx
ret
Function at 0x6c5546
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xf
invalid
lodsb al, byte [esi]
mov ch, 0xf9
call fcn.0078e114
jmp 0x6c54c3
mov cl, 0x49
inc edi
jle 0x6c5511
mov ebp, 0x89fa649b
inc esi
push 3
push 0xe48d405e
call 0x5132e4b9
push eax
push eax
call 0x50bf9c0d
call 0xfb7ad1a8
sti
mov ebx, 0xf9891137
call 0xc3ef93d8
or al, 0x39
je 0x6c55b8
clc
dec edi
stosb byte es:[edi], al
or eax, 0x9bb32a87
jle 0x6c555b
mov dword [0xd5864222], eax
xchg ebp, eax
div dword [ebx]
xor ebx, ecx
pop ebx
sub eax, 0x68246a54
bound esp, qword [ecx + 0x61]
wait
push 0x24
push 0x9b616162
outsb dx, byte [esi]
jbe 0x6c55dd
call 0x20bdb0ec
jmp 0x6c55a7
dec edi
jo 0x6c553b
or bl, ch
inc ecx
ret
ret
mov dr5, eax
xchg dword [esi + 0x515cc35b], edx
add ebx, dword [ebx]
jbe 0x6c5583
ret
Function at 0x9b56f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x66000d
lea edi, [esi - 0x25f00d]
push edi
or ebp, 0xffffffff
jmp 0x9b5712
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9b5719
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9b5708
mov eax, 1
add ebx, ebx
jne 0x9b572b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9b5720
jne 0x9b573c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b5720
xor ecx, ecx
sub eax, 3
jb 0x9b5750
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9b57c2
mov ebp, eax
add ebx, ebx
jne 0x9b575b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9b5768
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9b578c
inc ecx
add ebx, ebx
jne 0x9b5778
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9b576d
jne 0x9b5789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9b576d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9b57ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9b579d
jmp 0x9b570e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9b57ac
add edi, ecx
jmp 0x9b570e
pop esi
mov edi, esi
mov ecx, 0x184b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9b57ca
cmp byte [edi], 0x11
jne 0x9b57ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9b57cf
lea edi, [esi + 0x5b1000]
mov eax, dword [edi]
or eax, eax
je 0x9b583e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5b7fa4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5b7ffc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9b57fc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5b8004]
or eax, eax
je 0x9b5838
mov dword [ebx], eax
add ebx, 4
jmp 0x9b5819
call dword [esi + 0x5b8000]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9b586f
cmp al, 0xef
ja 0x9b5862
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9b5844
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9b5851
mov ebp, dword [esi + 0x5b8008]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9b58a3
sub esp, 0xffffff80
jmp 0x40f16c
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f004]
jne 0x40100a
repz ret
jmp fcn.004016f4

Function at 0x405698
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040305b
and dword [ebp - 4], 0
cmp dword [0x440fd8], 0
mov ebx, eax
jne 0x405749
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057fa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057fa
push eax
call fcn.00402fe9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x440fd8], eax
call esi
push eax
call fcn.00402fe9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x440fdc], eax
call esi
push eax
call fcn.00402fe9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x440fe0], eax
call esi
push eax
call fcn.00402fe9
pop ecx
mov dword [0x440fe8], eax
test eax, eax
je 0x405749
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402fe9
pop ecx
mov dword [0x440fe4], eax
mov eax, dword [0x440fe4]
cmp eax, ebx
je 0x4057a1
cmp dword [0x440fe8], ebx
je 0x4057a1
push eax
call fcn.00403064
push dword [0x440fe8]
mov esi, eax
call fcn.00403064
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4057a1
test edi, edi
je 0x4057a1
call esi
test eax, eax
je 0x405798
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405798
test byte [ebp - 0xc], 1
jne 0x4057a1
or dword [ebp + 0x10], 0x200000
jmp 0x4057da
mov eax, dword [0x440fdc]
cmp eax, ebx
je 0x4057da
push eax
call fcn.00403064
pop ecx
test eax, eax
je 0x4057da
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4057da
mov eax, dword [0x440fe0]
cmp eax, ebx
je 0x4057da
push eax
call fcn.00403064
pop ecx
test eax, eax
je 0x4057da
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x440fd8]
call fcn.00403064
pop ecx
test eax, eax
je 0x4057fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x437ca0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x43f004]
xor eax, esp
mov dword [esp + 0x428], eax
cmp edi, 0x182
jne 0x437cce
lea eax, [esp + 0xc]
push eax
push str.tuzudinuyodawiz_xivizevobikotuletife
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x437d02
cmp edi, 0x19f
jne 0x437d02
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push str.wofoyamev_wexededukocoh
push str.vazew_xajinoguwumofeforupatetonaxoc_vasufadogenanajeyu_wiwarerimefozenodav
push str.besudufawocugiforacir_nawiyay_yirideculaxabafulewasu_seyihet_zazadubavoxuyucawitiwituzunacare
push str.bemoxaxoyuguxejoxipavav_damilagorifoki_meyogupusosojezogayihasawuzerebu_moyeta
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push esi
xor esi, esi
test edi, edi
jle 0x437d72
lea esp, [esp]
lea ecx, [esp + 8]
mov dword [esp + 4], 5
mov dword [esp + 8], 0
call fcn.00437c90
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp + 4], eax
sub dword [esp + 4], 0x46
mov cl, byte [esp + 4]
xor byte [ebx + esi], cl
cmp edi, 0xf
jne 0x437d6d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc esi
cmp esi, edi
jl 0x437d10
pop esi
cmp edi, 0x2d
jne 0x437d8c
mov dword [0x519800], 0xa62e7790
mov dword [0x519804], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0x402a04
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040408c
test esi, esi
jne 0x402a3a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040417c
jmp 0x402a58
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402918
mov edi, eax
test esi, esi
je 0x402a58
cmp dword [ebx], 0
je 0x402a58
dec esi
jmp 0x402a41
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403128
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031a0
xor eax, eax
push ebp
push 0x403199
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45d020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e8c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45f04c], 0
je 0x403eed
cmp word [0x45f220], 0xd7b2
jne 0x403eb5
cmp dword [0x45f228], 0
jbe 0x403eb5
mov eax, 0x45f21c
call dword [0x45f238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45d06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f14
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45d030], 0
jne 0x403f09
push 0
push 0x45d064
push 0x45d06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026dc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x45f04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404008
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4055cc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4057fc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40564f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4057fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40564f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405818
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4056d8
xor eax, eax
push ebp
push 0x4056d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405414
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4056b6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405838
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4056b6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4056d8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4057f2
cmp byte [ebp - 0xd], 0
jne 0x40571f
cmp byte [ebp - 0x12], 0
je 0x4057f2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405738
dec ebx
cmp byte [ebx], 0x2e
je 0x405747
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405737
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4057f2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405784
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4057f2
cmp byte [ebp - 0xd], 0
je 0x4057f2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4057f2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ec4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405f2a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042fc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402cec
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405f14
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f31
lea eax, [ebp - 0x10]
call fcn.0040408c
ret

Function at 0x4088fc
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040454c
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x408910
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0040454c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x408932
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40b528
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b561
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040417c
jmp 0x40b56a
mov eax, ebx
mov edx, esi
call fcn.004040e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b574
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b595
mov al, byte [esp]
jmp 0x40b597
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret