joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75b900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x75b96c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x75b9b3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.007b0b28
add esp, 8
test eax, eax
jne 0x75b9b1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x75b9b5
jmp 0x75b963
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x78b870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f2147
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x80ff3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0078a760
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0078a760
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0078a760
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0078b170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0078b170
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0078b170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x78bb50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f2237
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x80ff3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0078a680
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0078a680
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0078a680
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.0078b190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0078b190
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.0078b190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x7a03a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7f4e80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x80ff3c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x813d14
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x813df8
call fcn.00755850
mov byte [esp + 0x38], 1
call fcn.0079f574
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.00755920
mov dword [esi], 0x813e1c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x7d13b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x7d143d
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.007abfe0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x7d1400
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x7d1422
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x7d1498
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.007d1108
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x7d1484
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x7d1498
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x7d13c1
pop esi
pop ebx
leave
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40645d
pop dword [ebp - 0x34]
mov eax, 0xed8ae920
add eax, 0x12b57b3d
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x99602d38
sub dword [ebp - 0x44], 0x4b0de7ed
mov dword [ebp - 0x40], 0x1e738a5a
sub dword [ebp - 0x40], 0xec403e15
mov dword [ebp - 0x3c], 0x8f8fcc5d
add dword [ebp - 0x3c], 0xbcbc77d1
mov dword [ebp - 0x38], 0xc5008911
add dword [ebp - 0x38], 0x3aff76ef
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x811d5d13
sub dword [ebp - 0x44], 0xcaaf3bd
mov dword [ebp - 0x40], 0xb777839
sub dword [ebp - 0x40], 0xca0b16c4
mov dword [ebp - 0x3c], 0xb8cf4ae6
sub dword [ebp - 0x3c], 0x555fde7a
mov dword [ebp - 0x38], 0x5dbc2224
sub dword [ebp - 0x38], 0x5dbc2224
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3801b
push 0
call eax
mov ecx, 0x4bd1
xor esi, esi
add esi, eax
mov edx, 0x44a4c521
sub edx, 0x445fb121
add edx, dword [ebp - 0x34]
mov ebx, 0xf88ac020
sub ebx, 0xabb150b4
mov dword [ebp - 0xc], 0x7d6b5b33
mov edi, dword [edx]
add dword [ebp - 0x14], 0xb2df7b64
xor edi, ebx
xor dword [ebp - 0x20], ebx
mov dword [esi], edi
sub dword [ebp - 0x30], 0xff551fc1
add esi, 0x8f0f9bc7
sub esi, 0x8f0f9bc3
add edx, 4
loop 0x406571
add eax, 0x12217
xor ebx, ebx
add ebx, eax
add eax, 0x71725af5
add eax, 0x8e8da510
mov ecx, 0xdeea5aa
add ecx, 0xf2515a56
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x401f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x407418], 0
jne 0x401f27
call fcn.0040182c
test al, al
jne 0x401f27
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40207b
xor ecx, ecx
push ebp
push 0x402074
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x407031], 0
je 0x401f48
push 0x407420
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401f58
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401ff7
mov eax, ebx
test eax, eax
jns 0x401f6d
add eax, 3
sar eax, 2
mov edx, dword [0x407478]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401ff7
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401fa8
mov eax, ebx
test eax, eax
jns 0x401f97
add eax, 3
sar eax, 2
mov ecx, dword [0x407478]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401fce
mov ecx, ebx
test ecx, ecx
jns 0x401fb1
add ecx, 3
sar ecx, 2
mov edi, dword [0x407478]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40740c]
sub ebx, 4
add dword [0x407410], ebx
call fcn.00402b10
jmp 0x40207b
cmp ebx, dword [0x407470]
jg 0x402049
sub dword [0x407470], ebx
cmp dword [0x407470], 0xc
jge 0x40201b
add ebx, dword [0x407470]
xor eax, eax
mov dword [0x407470], eax
mov eax, dword [0x407474]
add dword [0x407474], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40740c]
sub ebx, 4
add dword [0x407410], ebx
call fcn.00402b10
jmp 0x40207b
mov eax, ebx
call fcn.00401e0c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40207b
cmp byte [0x407031], 0
je 0x402073
push 0x407420
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402088
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x40741c], eax
cmp byte [0x407418], 0
jne 0x4020c0
call fcn.0040182c
test al, al
jne 0x4020c0
mov dword [0x40741c], 8
mov dword [ebp - 4], 8
jmp 0x402221
xor ecx, ecx
push ebp
push 0x40221a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x407031], 0
je 0x4020e1
push 0x407420
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4020fc
mov dword [0x40741c], 9
jmp 0x4021f1
dec dword [0x40740c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x407410], eax
test bl, 1
je 0x40215c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40212c
test edx, 0x80000003
je 0x40213b
mov dword [0x40741c], 0xa
jmp 0x4021f1
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402153
mov dword [0x40741c], 0xa
jmp 0x4021f1
add ebx, edx
mov esi, eax
call fcn.004019d0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x407474]
jne 0x40219c
sub dword [0x407474], ebx
add dword [0x407470], ebx
cmp dword [0x407470], 0x3c00
jle 0x40218d
call fcn.00401ca8
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00402b10
jmp 0x402221
mov edx, dword [eax]
test dl, 2
je 0x4021bf
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4021ba
mov dword [0x40741c], 0xb
jmp 0x4021f1
or dword [eax], 1
jmp 0x4021e8
mov eax, edi
cmp dword [eax + 4], 0
je 0x4021d2
cmp dword [eax], 0
je 0x4021d2
cmp dword [eax + 8], 0xc
jge 0x4021de
mov dword [0x40741c], 0xb
jmp 0x4021f1
mov edx, dword [eax + 8]
add ebx, edx
call fcn.004019d0
mov edx, ebx
mov eax, esi
call fcn.00401c20
mov eax, dword [0x40741c]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402221
cmp byte [0x407031], 0
je 0x402219
push 0x407420
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4024c0
Capabilities:
Get geographical location

Disassembly:
test eax, eax
je 0x4024ce
call dword [0x406018]
or eax, eax
je 0x4024cf
ret
mov al, 1
jmp fcn.00402540

Function at 0x4024d8
Capabilities:
Get geographical location

Disassembly:
test eax, eax
je 0x4024e6
call dword [0x40601c]
or eax, eax
jne 0x4024e7
ret
mov al, 2
jmp fcn.00402540

Function at 0x4024f0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402528
test edx, edx
je 0x402512
push eax
mov eax, ecx
call dword [0x406020]
pop ecx
or eax, eax
je 0x402521
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402540
mov dword [eax], edx
mov eax, ecx
call dword [0x40601c]
or eax, eax
jne 0x40250b
ret
mov al, 1
jmp fcn.00402540
test edx, edx
je 0x40253c
push eax
mov eax, edx
call dword [0x406018]
pop ecx
or eax, eax
je 0x402521
mov dword [ecx], eax
ret

Function at 0x402540
Capabilities:
Get geographical location

Disassembly:
and eax, 0x7f
mov ecx, dword [0x407004]
test ecx, ecx
je 0x402550
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402569]
jns 0x402564
call fcn.00404664
mov eax, dword [eax + 4]
jmp fcn.00402f58
Function at 0x402764
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027fc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4027dc
xor eax, eax
push ebp
push 0x4027d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402818
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4027dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x40285c
Capabilities:
Clear file content

Disassembly:
cmp byte [0x406004], 0
je 0x40287b
push eax
push eax
push edx
push esp
push 2
push 0
push 0xeedfae4
call sub.KERNEL32.DLL_SetEndOfFile
add esp, 8
pop eax
ret

Function at 0x402890
Capabilities:
Clear file content

Disassembly:
push esp
push 1
push 0
push 0xeedfae0
call sub.KERNEL32.DLL_SetEndOfFile
add esp, 4
pop eax
ret
cmp byte [0x406004], 1
jbe 0x4028a0
push eax
push ebx
jmp 0x40287c
ret

Function at 0x402908
Capabilities:
Clear file content

Disassembly:
push eax
push edx
cmp byte [0x406004], 1
jbe 0x402922
push esp
push 2
push 0
push 0xeedfae3
call sub.KERNEL32.DLL_SetEndOfFile
pop edx
pop eax
ret

Function at 0x402f58
Capabilities:
Get geographical location

Disassembly:
mov dword [0x407020], eax
jmp fcn.00402e2c
pop dword [0x407028]
jmp 0x402f4c

Function at 0x403388
Capabilities:
Get geographical location

Disassembly:
mov al, 1
jmp fcn.00402540
test edx, edx
je fcn.0040334c
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.0040334c
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403344
ret

Function at 0x4033d8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x403417
cmp al, 0xb
je 0x403417
cmp al, 0xc
je 0x403421
cmp al, 0xd
je 0x403434
cmp al, 0xe
je 0x403452
cmp al, 0xf
je 0x403417
cmp al, 0x11
je 0x403417
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402540
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x403417
jmp 0x403466
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x403421
jmp 0x403466
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4033d8
dec edi
jg 0x403437
pop ebp
jmp 0x403466
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004033ac
dec edi
jg 0x403455
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4033d8
Function at 0x40346c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x403417
cmp al, 0xb
je 0x403417
cmp al, 0xc
je 0x403421
cmp al, 0xd
je 0x403434
cmp al, 0xe
je 0x403452
cmp al, 0xf
je 0x403417
cmp al, 0x11
je 0x403417
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402540
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x403417
jmp 0x403466
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x403421
jmp 0x403466
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4033d8
dec edi
jg 0x403437
pop ebp
jmp 0x403466
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004033ac
dec edi
jg 0x403455
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4033d8

Function at 0x4034a4
Capabilities:
Get geographical location

Disassembly:
cmp ecx, 0
je 0x40358a
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4034f4
cmp al, 0xb
je 0x40350e
cmp al, 0xc
je 0x403525
cmp al, 0xd
je 0x403534
cmp al, 0xe
je 0x403552
cmp al, 0xf
je 0x403568
cmp al, 0x11
je 0x403577
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402540
cmp ecx, 1
mov eax, ebx
jg 0x403505
call fcn.00402f64
jmp 0x403586
mov edx, ecx
call fcn.00402f88
jmp 0x403586
cmp ecx, 1
mov eax, ebx
jg 0x40351c
call fcn.0040334c
jmp 0x403586
mov edx, ecx
call fcn.00403364
jmp 0x403586
mov eax, ebx
add ebx, 0x10
call fcn.00403898
dec edi
jg 0x403525
jmp 0x403586
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004034a4
dec edi
jg 0x403537
pop ebp
jmp 0x403586
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403478
dec edi
jg 0x403555
pop ebp
jmp 0x403586
mov eax, ebx
add ebx, 4
call fcn.00403fa8
dec edi
jg 0x403568
jmp 0x403586
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00403a58
dec edi
jg 0x403577
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x40358c
Capabilities:
Get geographical location

Disassembly:
mov ecx, 1
jmp fcn.004034a4