joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg esi
add eax, 0x67
sub ebx, 0x3c
or edx, 0x91
ror eax, 0x7f
inc edx
ror ebx, 0x1b
sub edi, 0x51
ror esi, 0xfe
not ebx
dec edx
rol eax, 0xc
and edx, 0xb
add ebx, 7
bswap ebx
bswap edi
dec ebx
and eax, 0xe3
inc esi
and edx, 0x16
dec esi
add ebx, 1
neg esi
neg edi
not edi
rcl ebx, 0xcf
add esi, 0x12
imul edx
not ebx
rol ebx, 0xee
rcr esi, 0x3e
not esi
inc ebx
not edx
inc edi
bswap esi
inc ebx
bswap ebx
sbb ebx, 0xbd
rcr esi, 0x46
inc edi
rcr ebx, 0xe
not esi
or ebx, 0x56
rcr edi, 0x59
not eax
inc eax
dec esi
rcl edi, 0x4f
rol esi, 0x91
xor ecx, ecx
xor edi, edi
inc ebx
bswap esi
sbb eax, 0xe6
dec eax
dec eax
imul eax
rcl ebx, 0xab
rcr ebx, 0xff
add edi, 0xf6
sub ebx, 0x71
mov ebx, 0x3f
inc ebx
imul ebx
rol ebx, 0x58
bswap ebx
and esi, 0x46
rol ebx, 0xa5
dec edx
not eax
rcl esi, 0xe7
sub esi, 0x4f
neg ebx
inc esi
imul ebx
bswap esi
or edx, 0xcf
and eax, 0xc4
mov edi, 0x21
rcr esi, 0x7b
inc edi
sub edi, 0x56
inc edi
or edi, 0xbc
not edx
add edx, 0x76
sbb edx, 0x3c
imul eax
rol edi, 0xa9
ror esi, 0x62
and edx, 0x56
dec eax
rcl edi, 0x5e
dec ebx
neg edx
imul eax
and edx, 0x80
rcr edx, 0x5b
sub edx, 0x7b
sbb edi, 0xf0
not eax
mov ecx, dword [ebp + 0xc]
mov ebx, 0xb6
add esi, 0x2b
dec ebx
or eax, 0x47
bswap edi
bswap ebx
inc edi
and esi, 0xa8
inc eax
imul edi
inc esi
imul esi
neg eax
dec esi
dec edi
mov esi, 0xdc
mov edx, 0x64
mov edx, 0x8a
inc eax
neg esi
mov ebx, 0xe
bswap eax
sub ebx, 0x2e
mov edi, 0x80
inc eax
sub edi, 0xdf
or edx, 0xad
inc eax
not edi
sub eax, 0xce
rcr eax, 0x43
and edx, 0xfd
sbb edx, 0x97
sub edi, 0x40
neg edi
inc eax
dec ebx
sub eax, 0x98
imul eax
bswap esi
or eax, 0xd9
imul edx
dec ebx
inc edi
dec ebx
rcr esi, 0xc0
add edi, 0x2a
and edx, 0x7c
neg ebx
rol esi, 0xed
mov edi, dword [ebp + 8]
xor eax, ebx
mov eax, esi
mov esi, eax
not byte [edi]
mov eax, ebx
mov eax, esi
xor esi, ebx
mov esi, ebx
xor ebx, esi
xor ebx, esi
mov ebx, eax
mov eax, eax
mov ebx, eax
add byte [edi], 0x34
mov eax, eax
xor eax, eax
mov ebx, esi
mov ebx, esi
xor esi, esi
mov ebx, eax
mov eax, eax
xor ebx, esi
mov esi, ebx
sub byte [edi], 0x75
xor esi, esi
xor eax, ebx
xor eax, esi
mov esi, esi
mov esi, ebx
mov esi, ebx
mov eax, eax
mov ebx, eax
xor eax, esi
imul byte [edi]
inc edi
loop 0x4013a9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407654
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4108f0]
jne 0x40765e
repz ret
jmp fcn.0040bb55
Function at 0x407fc3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058ea
and dword [ebp - 4], 0
cmp dword [0x4115cc], 0
mov ebx, eax
jne 0x408074
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408125
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408125
push eax
call fcn.00405878
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4115cc], eax
call esi
push eax
call fcn.00405878
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4115d0], eax
call esi
push eax
call fcn.00405878
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4115d4], eax
call esi
push eax
call fcn.00405878
pop ecx
mov dword [0x4115dc], eax
test eax, eax
je 0x408074
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405878
pop ecx
mov dword [0x4115d8], eax
mov eax, dword [0x4115d8]
cmp eax, ebx
je 0x4080cc
cmp dword [0x4115dc], ebx
je 0x4080cc
push eax
call fcn.004058f3
push dword [0x4115dc]
mov esi, eax
call fcn.004058f3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4080cc
test edi, edi
je 0x4080cc
call esi
test eax, eax
je 0x4080c3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4080c3
test byte [ebp - 0xc], 1
jne 0x4080cc
or dword [ebp + 0x10], 0x200000
jmp 0x408105
mov eax, dword [0x4115d0]
cmp eax, ebx
je 0x408105
push eax
call fcn.004058f3
pop ecx
test eax, eax
je 0x408105
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408105
mov eax, dword [0x4115d4]
cmp eax, ebx
je 0x408105
push eax
call fcn.004058f3
pop ecx
test eax, eax
je 0x408105
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4115cc]
call fcn.004058f3
pop ecx
test eax, eax
je 0x408125
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408127
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4c7fa3
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x4eb51f44
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40940a
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xc8a90cf6
or dword [esi - 0x62da9707], ebp
mov word [edi - 0x564e342d], cs
std
xchg esp, eax
push dword [edx - 0x3ed3be9e]
sbb ah, al
xchg edi, eax
and al, 0x86
and dword [edx - 0x233bb8f1], ebx
xor eax, 0x2454d192
fdiv qword [0x2454d192]
sbb al, 0x5f
wait
arpl word [ecx + 0x3247f900], ax
cmp dword [ecx + 4], ecx
push edi
jae 0x409415
mov bl, 0x6c
push eax
mov esi, 0x19241a75
jecxz 0x409486
loope 0x40948e
or dword [edi + 0x55fd9c68], ecx
mov byte [ebp - 0x60], cl
sbb eax, 0x35aa960f
int 0xe8
dec ecx
cmp al, 0x8a
clc
sub byte [eax], al
xchg ecx, eax
jne 0x409499
xor eax, 0x50719fc1
into
stosb byte es:[edi], al
or eax, 0x9511bdec
rol byte [edi + 0x51], cl
jns 0x40942e
stosb byte es:[edi], al
fist dword [ecx]
cmp al, 0x80
fsub qword [eax - 0x56]
adc edx, dword [ebx + ecx*4]
invalid
wait
mov esi, 0xf351dc23
xchg edi, eax
ret
invalid

Function at 0x40af5e
Capabilities:
Encode data using xor

Disassembly:
sti
xchg ecx, eax
mov word [ebp + 0x65], fs
xor byte [ebx + 0x6981e31b], 0xc1
insb byte es:[edi], dx
cmp ebp, esp
popfd
jl 0x40afa5
pop esi
out dx, eax
test dword [bx + si - 0x47ff], 0x3b95a68f
mov byte [0x91d7b445], al
bound ebp, qword [ecx - 0x2a]
jle 0x40afd5
inc ecx
sbb al, 0x96
pop esi
daa
adc dword [esi + 0xe], esi
cmc
or al, 0x1e
push esp
jmp 0x40afef
fist word [esi]
push eax
sbb eax, 0x97458b0
xor dword [edx + esi + 0x7c], 0xa7a1f861
adc byte [ebp + 0x1516055], dh
das
je 0x40afe2
xor bh, byte [ecx - 8]
jl 0x40b013
clc
mov eax, dword [0x55b510a7]
pushal
push ecx
add dword [edi], ebp
adc dword [ecx - 0x1b], esi
adc esp, dword [ebx + 0xc]
adc dword [ecx + 0x6d], ebx
mov byte [0x489b5118], al
jae 0x40b002
mov ah, 0xa1
sqrtps xmm6, xmmword [edi + ecx*8 + 0xc]
sub dword [ebx - 0x2777726f], esp
test dh, bh
das
xchg ecx, eax
lea ecx, [eax + 0x66fe84d8]
das
jno 0x40afaf
popfd
dec esp
jo 0x40b000
sbb eax, 0x18decae1
loope 0x40afaf
ficomp word [eax]
push ebx
test al, 0xde
sahf
cmp esp, edx
inc esi
in al, dx
sar dword [ebx + 0x54], cl
leave
pop es
invalid
sub al, 0xd3
pop esp
lcall 0x4a3e, 0x16ece9f4
dec edx
sti
jg 0x40afae
or edi, esp
sbb ebx, 0x40
and byte [0x86450251], ah
mov dh, 0x1f
popfd
rcr dword [ebx + edx*8], 1
jle 0x40aff8
cmpsb byte [esi], byte es:[edi]
loop 0x40b097
cmp al, ch
je 0x40b066
xchg ecx, eax
shr dword ss:[ebx], cl
dec ecx
jp 0x40b086
and edx, dword [esi + 0x39]
or byte [esi - 0x1e], bl
pop eax
push cs
pop edi
and ebx, edx
push edx
sti
pop edx
mov ch, ah
xor ebp, ebx
nop
mov esp, 0xc1a0d8ab
int3
iretd
pop edi
aas
adc esp, edx
stosb byte es:[edi], al
loop 0x40b07a
test ebp, ebx
nop
fadd qword [eax - 0x22]
fstp qword [eax + edx*8 - 0x1b01ec9d]
jns 0x40b05c
sal esi, cl
popfd
mov dl, 0xf
mov word [ebx], 0x3585
xor dword [ebp + 0x6f], edx
sbb dword [edx + 0x944a420], eax
sbb al, 0xdd
mov cl, 0x8a
jg 0x40b0ef
jecxz 0x40b0a5
add dword [esi - 0x7e4e2052], esp
adc dl, byte [edi]
xor eax, 0x6388bfee
salc
add dl, ch
push ebp
invalid
pop ss
sub ch, bl
mov edx, 0x9ea7da97
push cs
wait
xchg esp, eax
insb byte es:[edi], dx
xlatb
invalid
Function at 0x448f60
Capabilities:
Encode data using xor

Disassembly:
les edi, [0x84a2a4f0]
mov ebp, dword [ebp - 0x5b]
movsb byte es:[edi], byte [esi]
in al, dx
mov esi, 0x27030e1b
push cs
add esp, dword [edi]
push cs
add esp, dword [edi]
mov eax, dword [0x7af1e93e]
sbb al, 0x76
dec ecx
xor dl, bl
mov ebx, dword [si]
jle 0x448f53
mov ecx, 0x2e831217
xchg byte [edi - 0x310656ae], al
jg 0x448fbb
mov eax, dword [0xffbc6f19]
xor al, 0xe0
invalid
or ebx, 0xacc11afc
jp 0x448fdd
dec ecx
mov edi, 0x85f18f7c
mov dword [ebp - 0x5331f1ff], ebx
add ch, byte [ebp + 0x7f5fd4ce]
dec ecx
and dl, ch
outsd dx, dword [esi]
leave
xchg esi, eax
scasd eax, dword es:[edi]
ja 0x448fc9
invalid

Function at 0x44a810
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x208]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x210]
push ecx
call edi
push str.system.ini
lea edx, [esp + 0xc]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea edx, [esp + 8]
push edx
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x44a8ad
push str.install.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44a8ad
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret

Function at 0x51d02c
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x28fdb5c
add al, 0xa5
push edx
dec esi
xchg ebp, eax
mov edx, 0x348869d3
pop edi
imul ecx, eax, 0x6e6f297f
invalid

Function at 0x5c5e0e
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor dl, ch
xchg ebx, eax
salc
sub byte [ebx], ch
loopne fcn.005c5e0e
pop esi
adc byte [edx + 0x28603047], 0x57
inc ecx
mov eax, dword [ecx + 0x11]
inc eax
push esp
in eax, 0x7c
in al, 0xcb
xchg edi, eax
xchg cx, ax
inc esp
xchg edx, eax
and esi, dword [edi + eax*4]
mov al, 0xde
adc dword [edi*8 - 0x6ca99f1a], eax
call 0x27e412be
scasd eax, dword es:[edi]
test al, 0xb8
xor bh, byte [edi]
sbb cl, dh
hlt
Function at 0x605378
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
les edx, [eax + 0x34]
imul dword [esi + 0x37]
out dx, eax
int1
add al, 0x25
push esp
aas
mov bh, 0x44
xchg ecx, eax
jno 0x6053bc
dec edi
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
pop ecx
mov eax, dword [0x374f74eb]
aaa
mov cl, 0x7f
inc esp
inc ecx
les edi, [edi - 0x6b]
push edi
sal edi, cl
add al, byte [ecx + 0x36]
xor dword [ecx + 0x2125ba43], ecx
pop ecx
mov ah, 0xd
salc
and dword [eax], edi
cmp byte [esi + 0x72], cl
invalid
cmp byte [esi + 0x72], cl
and dword [eax], ebp
shl dword [ebx - 0x13a271e2], cl
sub bl, dl
mov dword [0xec5d8e1e], eax
inc edi
xchg esi, eax
cmp esp, dword [esi + 0x72]
pop ss
jnp 0x60535f
popal
clc
sti
cmp esp, dword [eax*4 - 0x1b630dff]
and edx, eax
out 0x54, al
out dx, eax
mov ah, 0x51
push ecx
adc eax, 0x4f655006
shr dword [edx - 0x53129c93], 0x17
and dword [edx + ebp*2 - 0x1a6fd9d0], ebp
jns 0x605345
invalid
jno 0x60537b
movsd dword es:[edi], dword [esi]
popal
cmp dl, byte [0x31f44c3f]
or dword [ebx], 0x1e012eab
aas
xor eax, 0x515477c1
mov bl, ah
enter 0x69f1, 0x21
lcall 0xc4f5, 0x6cef9699
mov eax, dword [0x3d13e2a0]
adc eax, 0x12518e31
scasd eax, dword es:[edi]
dec edi
inc eax
int1
pushal
in eax, dx
iretd

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x408f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x4a1fb8
call fcn.00495828
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.00494ec0
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x408fe5
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x408fe5
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.00494ee0
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x408fe5
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x409002
cmp dword [ebp - 0x34], 0
je 0x409002
mov edx, dword [ebp - 0x34]
jmp 0x409007
mov edx, 0x4a1c2c
lea eax, [ebp - 4]
call fcn.0049f868
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.00494ed0
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0049f9f8
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0049f9c8
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x409085
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4103a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
call fcn.004103f8
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4103c6
lea eax, [ebp - 1]
xor edx, edx
call fcn.0041042c
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4103dc
lea eax, [ebp - 1]
mov dl, 2
call fcn.0041042c
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4103f2
lea eax, [ebp - 1]
mov dl, 1
call fcn.0041042c
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x410a28
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [0x4a7f64]
mov eax, dword [eax]
call fcn.0046aa44
push 0
mov edx, dword [0x4a7f64]
mov ecx, dword [edx]
push dword [ecx + 0x30]
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp - 4]
cmp word [eax + 0x24a], 0
je 0x410a70
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24c]
call dword [ebx + 0x248]
pop ebx
pop ecx
pop ebp
ret

Function at 0x410a74
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [0x4a7f64]
mov eax, dword [eax]
call fcn.0046aaf4
push 9
mov edx, dword [0x4a7f64]
mov ecx, dword [edx]
push dword [ecx + 0x30]
call sub.USER32.DLL_ShowWindow
mov eax, dword [0x4a7f64]
mov edx, dword [eax]
push dword [edx + 0x30]
call sub.USER32.DLL_SetForegroundWindow
mov ecx, dword [ebp - 4]
cmp word [ecx + 0x252], 0
je 0x410acb
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x254]
call dword [ebx + 0x250]
pop ebx
pop ecx
pop ebp
ret

Function at 0x420378
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4a82cc
cmp dword [edi], 0
jne 0x4203f4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4a82c8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4a35d0
mov ecx, 2
call fcn.0043423c
mov edx, 0x420350
lea eax, [esi + 5]
call fcn.00420370
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00420370
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4203c9
mov dword [0x4a82c8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42605c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x426095
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00435b14
jmp 0x42609e
mov eax, ebx
mov edx, esi
call fcn.00435a78
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4260a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4260c9
mov al, byte [esp]
jmp 0x4260cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4275e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x42764c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00435c8c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00423104
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427653
lea eax, [ebp - 0xc]
call fcn.00435a24
ret

Function at 0x434d48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a3b10]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x434de0
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x434dc0
xor eax, eax
push ebp
push 0x434db9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x434dfc
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434dc0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4a3b10]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a3b10], ax
mov esp, ebp
pop ebp
ret

Function at 0x4358a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4a8648], 0
je 0x435909
cmp word [0x4a881c], 0xd7b2
jne 0x4358d1
cmp dword [0x4a8824], 0
jbe 0x4358d1
mov eax, 0x4a8818
call dword [0x4a8834]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x435930
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4a3b20], 0
jne 0x435925
push 0
push 0x4a3b78
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x437390
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4375c0
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x437413
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4375c0
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x437413
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4375dc
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x43749c
xor eax, eax
push ebp
push 0x437495
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004371d8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x43747a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4375fc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x43747a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43749c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4375b6
cmp byte [ebp - 0xd], 0
jne 0x4374e3
cmp byte [ebp - 0x12], 0
je 0x4375b6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4374fc
dec ebx
cmp byte [ebx], 0x2e
je 0x43750b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4374fb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4375b6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x437548
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4375b6
cmp byte [ebp - 0xd], 0
je 0x4375b6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4375b6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret