joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570630
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
push esi
test eax, eax
je 0x57064d
test byte [eax + 0x5c], 2
mov ebx, 0x652de0
jne 0x570652
mov ebx, 0x652d98
mov esi, dword [ebp + 0x14]
test esi, esi
jle 0x570725
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
inc edi
cmp esi, 3
jl 0x5706b6
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + ebx]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + ebx]
mov byte [edx], al
jmp 0x570701
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x5706ca
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x5706ee
lea eax, [esi + 0x3c]
jmp 0x5706f8
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
mov ecx, dword [ebp - 4]
sub esi, 3
add ecx, 4
add edi, 3
inc edx
mov dword [ebp - 4], ecx
test esi, esi
jg 0x570665
pop edi
pop esi
mov byte [edx], 0
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov byte [eax], cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x5748b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
cmp esi, 2
je 0x574933
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5748ff
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
call fcn.0055e2f0
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x5748ff
push 0x3b
push 0x65373c
push 0x66
push 0x10a
push 0x10
call fcn.005288a0
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 0
je 0x57492f
cmp edi, 0x40a
je 0x574925
cmp edi, 0x43f
je 0x574925
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x57492a
mov eax, 0x20
cmp dword [ebp + 0x18], eax
je 0x574933
push 0x41
jmp 0x5748e1
push ebx
push 0x46
push 0x65373c
push 0x40
call fcn.0051a0a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x57496c
push 0x48
push 0x65373c
push 0x41
push 0x10a
push 0x10
call fcn.005288a0
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x574985
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push eax
push ebx
call fcn.005e0280
add esp, 0xc
jmp case.0x574ab7.1036
cmp edi, 0x40a
je 0x5749a5
cmp edi, 0x43f
je 0x5749a5
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x5749aa
mov eax, 0x20
push 0x50
push 0x65373c
push eax
call fcn.00530940
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x5749dd
push 0x52
push 0x65373c
push 0x41
push 0x10a
push 0x10
call fcn.005288a0
add esp, 0x14
jmp 0x574a31
cmp dword [ebp + 0x1c], 2
jne 0x574a72
cmp edi, 0x40a
je 0x574a07
cmp edi, 0x43f
je 0x574a07
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x574a0c
mov eax, 0x20
push eax
push esi
call fcn.00525d80
add esp, 8
test eax, eax
jg 0x574a4a
push 0x57
push 0x65373c
push esi
call fcn.00530930
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push 0x65373c
push ebx
call fcn.00519f90
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp edi, 0x40a
jne 0x574a61
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
jmp 0x574aa5
cmp edi, 0x40b
jne 0x574aa5
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x574aa5
cmp edi, 0x40a
je 0x574a92
cmp edi, 0x43f
je 0x574a92
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x574a97
mov eax, 0x20
push eax
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.005e0280
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x574ab7.1036
movzx eax, byte [eax + 0x574b10]
jmp dword [eax*4 + 0x574afc]
push esi
push ebx
call fcn.005a44c0
jmp 0x574ae0
push esi
push ebx
call fcn.005a40d0
jmp 0x574ae0
push esi
push ebx
call fcn.005ac010
jmp 0x574ae0
push esi
push ebx
call fcn.005adcd0
add esp, 8
push ebx
push edi
push dword [ebp + 8]
call fcn.00520f60
add esp, 0xc
mov eax, 1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x581610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00581810
add esp, 0xc
test eax, eax
js 0x581803
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x581690
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
nop word [eax + eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x581650
mov ebx, dword [ebp + 0x10]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x5817fe
lea esi, [ebx + 2]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x655b00]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x656700]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656f00]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656b00]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x657300]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x655b00]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x656700]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656f00]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656b00]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x657300]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x655b00]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x656700]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656f00]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656b00]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x657300]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x655b00]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x656700]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656f00]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x656b00]
movzx eax, dl
movzx eax, byte [eax*4 + 0x655b00]
xor ecx, dword [eax*4 + 0x657300]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x5816a7
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x592b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004311e0
add esp, 4
cmp eax, 0x72
jne 0x592d13
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
mov ecx, eax
push edi
mov edi, dword [ebp + 0x20]
and eax, 1
push edi
push esi
push dword [ebp + 0x18]
shr ecx, 1
push dword [ebp + 0x14]
add eax, ecx
mov dword [ebp - 8], ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.00540050
push eax
call fcn.00592970
add esp, 0x1c
test eax, eax
jne 0x592be9
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x104
push 0x65af1c
push edi
call fcn.0051a000
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x592c24
push 0x105
push 0x65af1c
push 0x41
push 0x6f
push 0x34
call fcn.005288a0
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0xc]
push edi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call fcn.00520ef0
push eax
call fcn.00592970
add esp, 0x1c
test eax, eax
jne 0x592c65
push 0x10a
push 0x65af1c
push edi
push ebx
call fcn.00519ed0
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
test edi, edi
je 0x592cf3
cmp edi, 0x20
jb 0x592cce
lea eax, [edi - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp esi, eax
ja 0x592c86
cmp ecx, ebx
jae 0x592cce
mov ecx, edi
mov eax, esi
mov edi, ebx
and ecx, 0xffffffe0
sub edi, esi
mov dword [ebp - 8], edi
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp - 8]
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edx + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x592ca0
mov esi, dword [ebp + 0x1c]
cmp edx, edi
jae 0x592cf3
mov eax, ebx
lea ecx, [edx + esi]
sub eax, esi
mov esi, edi
mov dword [ebp - 8], eax
sub esi, edx
mov edi, eax
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x592ce2
mov edi, dword [ebp + 0x20]
push 0x10f
push 0x65af1c
push edi
push ebx
call fcn.00519ed0
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00592970
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x598420
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x5984a4
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x598439
cmp al, 0x6b
jne 0x5984a4
inc ecx
cmp al, 0x6b
jne 0x59847b
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x598459
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x598459
cmp dl, 0xbb
jne 0x59846d
inc eax
cmp eax, esi
jl 0x598447
sub esi, eax
test eax, eax
jne 0x59847e
push 0x50
push 0x65c30c
push 0x8a
jmp 0x5984b0
push 0x48
push 0x65c30c
push 0x8a
jmp 0x5984b0
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x598492
push 0x59
push 0x65c30c
push 0x8b
jmp 0x5984b0
push esi
push ecx
push dword [ebp + 8]
call fcn.005e0280
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x3d
push 0x65c30c
push 0x89
push 0x80
push 4
call fcn.005288a0
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x59e2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 4], 0x10
test esi, esi
jle 0x59e390
push edi
mov edi, dword [ebp + 0x10]
cmp esi, 0x20
jb 0x59e374
lea eax, [edi - 1]
lea edx, [ebx - 1]
add eax, esi
add edx, esi
cmp ebx, eax
ja 0x59e31a
cmp edx, edi
jae 0x59e374
mov eax, esi
and eax, 0x8000001f
jns 0x59e328
dec eax
or eax, 0xffffffe0
inc eax
mov edx, esi
mov esi, edi
sub edx, eax
sub esi, ebx
mov dword [ebp - 8], esi
mov eax, ebx
lea esi, [edi + 0x10]
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0xc]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + ecx]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edx
jl 0x59e344
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
cmp ecx, esi
jge 0x59e38f
mov edx, esi
lea eax, [ecx + ebx]
sub edi, ebx
sub edx, ecx
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x59e381
pop edi
push esi
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax + 8]
call fcn.00533e20
add esp, 0x14
test eax, eax
je 0x59e3b9
cmp dword [ebp - 4], esi
jne 0x59e3b9
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c5150
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1048
push 0x67e8e0
push esi
call fcn.005e0280
mov ebx, dword [ebp + 0x10]
mov edi, 0x48
add esp, 0xc
mov dword [ebp + 8], 0
cmp dword [ebp + 0xc], edi
mov eax, ebx
cmovle edi, dword [ebp + 0xc]
add edi, ebx
nop dword [eax]
movzx edx, byte [eax]
inc eax
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
mov ecx, dword [ebp + 8]
cmp eax, edi
cmovae eax, ebx
xor dword [esi + ecx*4], edx
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x12
jl 0x5c5190
mov dword [ebp - 8], 0
xor edi, edi
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push esi
push eax
call fcn.005c5b90
mov eax, dword [ebp - 8]
add esp, 8
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 4]
mov dword [esi + edi*4 + 4], eax
add edi, 2
cmp edi, 0x12
jl 0x5c51e2
xor edi, edi
lea eax, [ebp - 8]
push esi
push eax
call fcn.005c5b90
mov eax, dword [ebp - 8]
add esp, 8
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [ebp - 4]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
cmp edi, 0x400
jl 0x5c5206
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40c6b3
pop dword [ebp - 0x48]
mov eax, 0x40c6b3
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x407de
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x505c8ae7
sub ecx, 0x505c3822
xor ebx, ebx
add ebx, eax
mov edx, 0x5c8153ca
add edx, 0xa3c20036
add edx, dword [ebp - 0x48]
mov edi, 0xe22afc7e
sub dword [ebp - 8], edx
mov esi, dword [edx]
mov dword [ebp - 4], 0xb964a743
xor esi, edi
mov dword [ebx], esi
mov dword [ebp - 0x14], 0xdbe10776
add ebx, 4
add edx, 0xcf7bf18f
add edx, 0x30840e75
loop 0x40c704
add eax, 0xccb173ee
sub eax, 0xccb03607
mov ebx, eax
add eax, 0xc81013a
add eax, 0xf37efecb
mov ecx, 0xe8332c24
add ecx, 0x180cd3dc
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x402de8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040490c
test esi, esi
jne 0x402e1e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004049fc
jmp 0x402e3c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402cfc
mov edi, eax
test esi, esi
je 0x402e3c
cmp dword [ebx], 0
je 0x402e3c
dec esi
jmp 0x402e25
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4039a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d5020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a40
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a20
xor eax, eax
push ebp
push 0x403a19
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a5c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a20
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4d5020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d5020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40470c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d904c], 0
je 0x40476d
cmp word [0x4d9220], 0xd7b2
jne 0x404735
cmp dword [0x4d9228], 0
jbe 0x404735
mov eax, 0x4d921c
call dword [0x4d9238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d5090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404794
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d5030], 0
jne 0x404789
push 0
push 0x4d5088
push 0x4d5090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4048c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a40
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4d904d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404888
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406098
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4062c8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40611b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4062c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40611b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4062e4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4061a4
xor eax, eax
push ebp
push 0x40619d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405ee0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406182
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406304
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406182
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061a4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4062be
cmp byte [ebp - 0xd], 0
jne 0x4061eb
cmp byte [ebp - 0x12], 0
je 0x4062be
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406204
dec ebx
cmp byte [ebx], 0x2e
je 0x406213
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406203
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4062be
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406250
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4062be
cmp byte [ebp - 0xd], 0
je 0x4062be
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4062be
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4061a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4062c8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40611b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4062c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40611b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4062e4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4061a4
xor eax, eax
push ebp
push 0x40619d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405ee0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406182
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406304
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406182
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061a4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4062be
cmp byte [ebp - 0xd], 0
jne 0x4061eb
cmp byte [ebp - 0x12], 0
je 0x4062be
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406204
dec ebx
cmp byte [ebx], 0x2e
je 0x406213
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406203
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4062be
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406250
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4062be
cmp byte [ebp - 0xd], 0
je 0x4062be
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4062be
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret