joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008e9b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1008e9e1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10029cc0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1008eaec
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x1008ea71
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1008eae2
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1008eaab
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1008eaa3
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x1008eadf
cmp edi, edx
je 0x1008eabc
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1008eaf5
cmp edi, edx
jne 0x1008eab0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x1008ea20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1008eadf

Function at 0x100901b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100901db
push 0
push 0
push 0
push 0x100273c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100901db
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x10099c40
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be63b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100ce040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100f66dc]
mov dword [ebp - 0x38], ecx
test al, 1
jne 0x10099d9e
or eax, 1
mov dword [0x100f66dc], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100c4370]
xorps xmm0, xmmword [0x100c4070]
mov dword [ebp - 0x24], 0xc4d4a7c4
mov dword [ebp - 0x20], 0xd5c4a2d4
mov dword [ebp - 0x1c], 0xd2dcc4d5
mov byte [ebp - 0x18], 0xe4
movups xmmword [ebp - 0x34], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x34], 0xe4
inc eax
cmp eax, 0x1d
jb 0x10099cd0
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x50], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10099cf6
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.1001fc10
mov byte [ebp - 4], 1
mov edx, dword [0x100f13cc]
test edx, edx
je 0x10099d1f
mov edx, dword [edx + 0x50]
jmp 0x10099d21
xor edx, edx
mov eax, dword [0x100f13c4]
test eax, eax
je 0x10099d2f
mov eax, dword [eax + 0x18]
jmp 0x10099d31
xor eax, eax
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10019b20
mov eax, dword [ebp - 0x14]
add esp, 8
test eax, eax
je 0x10099d58
mov ecx, dword [eax + 1]
test ecx, ecx
jne 0x10099d53
xor eax, eax
jmp 0x10099d58
add eax, 5
add eax, ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
mov dword [0x100f66e0], eax
cmp ecx, 0xf
jbe 0x10099d97
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10099d8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10099d8d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100b5731
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [0x100f66e0], 0
je 0x10099dbc
push 0
mov ecx, dword [ebp - 0x38]
movss xmm1, dword [ebx + 0xc]
movss xmm2, dword [ebx + 8]
call dword [0x100f66e0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100a3770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100a3901
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x100a3901
mov eax, dword [0x100f1478]
cmp dword [eax + 0x174], 0xffffffff
je 0x100a3901
mov eax, dword [0x100f1708]
add eax, 0xffffff91
xor eax, 0x7de79156
cmp dword [eax + ebx], 0
mov eax, dword [0x100f16d0]
setle cl
add eax, 0xffffff9f
xor eax, 0x7de79148
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x100f16c4]
add eax, 0xffffffa2
xor eax, 0x7de79145
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x100f16c8]
add eax, 0xffffffa1
xor eax, 0x7de79146
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x100f16cc]
lea eax, [ecx - 0x60]
xor eax, 0x7de79147
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x100a385e
lea eax, [ecx - 0x60]
xor eax, 0x7de79147
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x100a3856
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100a384a
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100a3847
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x100f16cc]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x100a3813
lea eax, [ecx - 0x60]
xor eax, 0x7de79147
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x100f148c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100a38f2
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x100a38b6
xor edx, edx
test ecx, ecx
je 0x100a38dc
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100a38c3
cmp edi, 0x79705c5e
je 0x100a38e7
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100a38f2
mov ecx, dword [ebp - 4]
jmp 0x100a38a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x100a38f4
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x100f1560]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a9440
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100beebd
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100ce040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x100f1478]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x100ce148], 4
jne 0x100a94a9
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x100f1420]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x100f66f4], 0
jne 0x100a95df
movaps xmm0, xmmword [0x100c4090]
xor eax, eax
movaps xmm2, xmmword [0x100c4370]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x1c], 0xa7a2
movaps xmm0, xmmword [0x100c3ed0]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0xe4
nop
movups xmm0, xmmword [ebp + eax - 0x3c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100a94e0
cmp eax, 0x23
jae 0x100a950b
nop dword [eax]
xor byte [ebp + eax - 0x3c], 0xe4
inc eax
cmp eax, 0x23
jb 0x100a9500
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a9526
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.1001fc10
mov dword [ebp - 4], 0
mov edx, dword [0x100f13d8]
test edx, edx
je 0x100a9552
mov edx, dword [edx + 0x50]
jmp 0x100a9554
xor edx, edx
mov eax, dword [0x100f13d0]
test eax, eax
je 0x100a9562
mov eax, dword [eax + 0x18]
jmp 0x100a9564
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1003ef30
mov edi, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 0x40]
inc edi
cmp ecx, 0xf
jbe 0x100a95ae
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100a95a4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100a95a4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100b5731
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x100f66f4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b52b6
mov esp, ebp
pop ebp
ret
Function at 0x13429058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.134291a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1342907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1342906a
add dl, dl
jne 0x13429089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x134290dc
xor eax, eax
add dl, dl
jne 0x13429096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1342917d
add dl, dl
jne 0x134290a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134290b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134290bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134290c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x134290d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x13429075
mov eax, 1
add dl, dl
jne 0x134290ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x134290f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x134290e1
sub eax, ebx
mov ebx, 1
jne 0x13429128
mov ecx, 1
add dl, dl
jne 0x1342910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x13429119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13429105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13429075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1342913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1342914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13429136
cmp eax, 0x7d00
jae 0x1342916d
cmp eax, 0x500
jb 0x13429168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13429075
cmp eax, 0x7f
ja 0x13429170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x13429075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1342919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x13429075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40673a
pop dword [ebp - 0x4c]
mov eax, 0x8de4b23b
add eax, 0x725bb4ff
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x1a19a9f
sub dword [ebp - 0x5c], 0xb34f5554
mov dword [ebp - 0x58], 0x714d2678
add dword [ebp - 0x58], 0xc0e625cd
mov dword [ebp - 0x54], 0x73f585e3
sub dword [ebp - 0x54], 0x27a941b5
mov dword [ebp - 0x50], 0x8f90e97d
sub dword [ebp - 0x50], 0x8f90e97d
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x25fc294e
sub eax, 0x25bba84a
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x46372c80
sub dword [ebp - 0x5c], 0xd1c4c32a
mov dword [ebp - 0x58], 0x1aed38b5
add dword [ebp - 0x58], 0x267f28c0
mov dword [ebp - 0x54], 0x6a091e4e
sub dword [ebp - 0x54], 0x699b1e2
mov dword [ebp - 0x50], 0x91585b18
sub dword [ebp - 0x50], 0x91585b18
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x964e73e3
sub eax, 0x960df2e3
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3f215
push 0
call eax
mov ecx, 0x6675
mov edi, eax
mov edx, 0x2fdb1c53
sub edx, 0x2f943853
add edx, dword [ebp - 0x4c]
mov esi, 0x984b337b
add dword [ebp - 0x44], esi
mov ebx, dword [edx]
sub ebx, esi
xor dword [ebp - 0x10], 0x2b5e8e20
mov dword [edi], ebx
xor dword [ebp - 0x14], 0x31a53540
add edi, 0xc72f0b75
add edi, 0x38d0f48f
add edx, 4
loop 0x406850
add eax, 0x18ca7
xor ebx, ebx
add ebx, eax
add eax, 0xb85a95b4
add eax, 0x47a56a51
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x402b38
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040418c
test esi, esi
jne 0x402b6e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040427c
jmp 0x402b8c
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a4c
mov edi, eax
test esi, esi
je 0x402b8c
cmp dword [ebx], 0
je 0x402b8c
dec esi
jmp 0x402b75
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e48
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x494008], 0x8088405
inc edx
mov dword [ebx + 0x494008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x494024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403344
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x403324
xor eax, eax
push ebp
push 0x40331d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403360
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403324
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x494024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x494024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404010
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49704c], 0
je 0x404071
cmp word [0x497220], 0xd7b2
jne 0x404039
cmp dword [0x497228], 0
jbe 0x404039
mov eax, 0x49721c
call dword [0x497238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x494070
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404098
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x494034], 0
jne 0x40408d
push 0
push 0x494068
push 0x494070
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x4057e0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a10
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405863
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a10
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405863
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a2c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4058ec
xor eax, eax
push ebp
push 0x4058e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405628
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4058ca
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405a4c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4058ca
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405a06
cmp byte [ebp - 0xd], 0
jne 0x405933
cmp byte [ebp - 0x12], 0
je 0x405a06
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40594c
dec ebx
cmp byte [ebx], 0x2e
je 0x40595b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40594b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405a06
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405998
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a06
cmp byte [ebp - 0xd], 0
je 0x405a06
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a06
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4060f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40615a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004043fc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e64
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406144
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406161
lea eax, [ebp - 0x10]
call fcn.0040418c
ret

Function at 0x40b704
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40b73d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040427c
jmp 0x40b746
mov eax, ebx
mov edx, esi
call fcn.004041e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b750
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40b771
mov al, byte [esp]
jmp 0x40b773
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c764
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c83a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404224
lea eax, [ebp - 8]
call fcn.0040469c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040464c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c824
mov eax, ebx
call fcn.00402810
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c81d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040464c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c807
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c84c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c807
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c824
mov eax, dword [ebp - 0x10]
call fcn.00402830
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c841
lea eax, [ebp - 8]
call fcn.0040418c
ret