joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc7a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.00405212
or dword [ebp - 4], 0xffffffff
push 5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x41d408]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40cd9f
push 0xf0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x41d408]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x14], 0
and dword [ebp - 0xc], 0
cmp dword [ebp - 0x1c], 0
je 0x40cce1
push dword [ebp - 0x1c]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
and dword [ebp - 0x18], 0
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40cd87
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40cd7c
push dword [ebp - 0xc]
push dword [ebp - 0x20]
call fcn.0040cda4
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x24]
push dword [ebp + 8]
call dword [0x41d45c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cd4d
cmp dword [ebp - 4], 0xffffffff
je 0x40cd4d
mov dword [ebp - 0x28], 1
jmp 0x40cd51
and dword [ebp - 0x28], 0
movzx eax, byte [ebp - 0x28]
test eax, eax
jne 0x40cd62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x40cd7a
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40cd85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x40cd90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40cd9f
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x410d49
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0
push 0
push 0
call dword [0x41d3f8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x30], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x410d73
xor eax, eax
jmp 0x410d91
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 0xc]
push 0x410e22
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4154cb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x41551c
push dword [ebp + 8]
lea ecx, [ebp - 0x84]
call fcn.00415301
mov eax, dword [eax]
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x84], eax
je 0x415533
push dword [ebp - 0x84]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
jmp 0x415533
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [esi]
call dword [0x41d3f0]
mov esi, eax
mov eax, esi
pop esi
leave
ret 8

Function at 0x41553a
Capabilities:
Set registry value

Disassembly:
mov eax, 0x41812f
call fcn.004174a4
sub esp, 0x10c
push esi
mov esi, ecx
cmp byte [esi + 4], 0
mov dword [ebp - 0x10], esi
je 0x415629
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x4155d9
push dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
call fcn.00415301
push dword [eax]
mov dword [ebp - 4], ebx
call esi
inc eax
push eax
call sub.MSVCR71.dll_void____cdecl_operator_new___unsigned_int_
or dword [ebp - 4], 0xffffffff
mov ebx, eax
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
pop ecx
je 0x4155a6
push dword [ebp - 0x94]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
call fcn.00415301
push dword [eax]
push ebx
call sub.MSVCR71.dll_strcpy
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
pop ecx
pop ecx
je 0x4155d9
push dword [ebp - 0x94]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x118]
call fcn.00415301
mov edi, dword [eax]
push ebx
call esi
inc eax
push eax
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp + 0x10]
push 0
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
pop edi
je 0x41561f
push dword [ebp - 0x118]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
push ebx
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
pop ecx
pop ebx
jmp 0x41564c
push dword [ebp + 0xc]
call dword [0x41d43c]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [0x41d3f0]
mov esi, eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x41565d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
mov esi, ecx
cmp byte [esi + 4], 0
mov dword [ebp - 4], 4
je 0x4156bb
push dword [ebp + 8]
lea ecx, [ebp - 0x88]
call fcn.00415301
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
lea eax, [ebp - 0x84]
cmp dword [ebp - 0x88], eax
je 0x4156d5
push dword [ebp - 0x88]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
jmp 0x4156d5
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [0x41d3ec]
mov esi, eax
test esi, esi
je 0x4156dd
mov eax, esi
jmp 0x4156ea
mov eax, dword [ebp + 8]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop esi
leave
ret 8

Function at 0x4156ef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov esi, ecx
call dword [0x41d040]
or dword [ebp - 8], 0xffffffff
and dword [ebp - 0xc], 0
cmp byte [esi + 4], 0
mov dword [ebp - 0x10], eax
je 0x4157cc
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x415802
mov eax, dword [ebx]
xor edi, edi
test eax, eax
mov dword [ebp - 4], eax
jbe 0x415738
inc eax
push eax
call sub.MSVCR71.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov edi, eax
push dword [ebp + 8]
lea ecx, [ebp - 0x94]
call fcn.00415301
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp - 0xc]
push ecx
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
je 0x41577a
push dword [ebp - 0x94]
call dword [sym.imp.MSVCR71.dll_free]
pop ecx
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x4157be
cmp dword [ebp - 8], eax
jne 0x4157be
cmp edi, eax
je 0x4157af
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.004175a0
mov eax, esp
push dword [ebp - 0x10]
push esi
push edi
push eax
call fcn.004151ad
push dword [ebx]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebx], eax
jmp 0x4157fc
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x415802
mov eax, dword [edi]
shl eax, 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [0x41d3ec]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [edi], eax
cmp dword [ebp - 8], 0
je 0x415807
mov eax, dword [ebp - 8]
jmp 0x415812
mov eax, dword [ebp - 0xc]
dec eax
neg eax
sbb eax, eax
and eax, 0xd
lea esp, [ebp - 0xa0]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x417652
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x41abb8
call fcn.0041785c
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x417692
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x417692
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4176aa
cmp eax, 0x20b
je 0x417697
mov dword [ebp - 0x1c], edi
jmp 0x4176be
cmp dword [ecx + 0x84], 0xe
jbe 0x417692
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4176b8
cmp dword [ecx + 0x74], 0xe
jbe 0x417692
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x41d6f8], 0xffffffff
or dword [0x41d6fc], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x41d610]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x41d60c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x41d6f4], eax
call fcn.00417938
call fcn.004179d8
cmp dword [0x41d3d0], edi
jne 0x41771e
push fcn.004179d8
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.004179c6
push 0x41d028
push 0x41d024
call sub.MSVCR71.dll__initterm
push 0x41797c
call fcn.00417472
mov eax, dword [0x41d608]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x41d604]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x417772
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x41d020
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x41779c
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x417856
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x41780b
cmp ax, di
je 0x4177b2
cmp dword [ebp - 0x20], edi
jne 0x41780b
mov ax, word [esi]
cmp ax, di
je 0x4177c7
cmp ax, 0x20
ja 0x4177c7
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x4177b2
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [0x41d41c]
test byte [ebp - 0x58], 1
je 0x4177e3
movzx eax, word [ebp - 0x54]
jmp 0x4177e6
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.0040d6c9
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x417803
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x417850
cmp ax, 0x22
jne 0x41781c
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x41779c
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00417897
ret
Function at 0x3bee4
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x44]
je 0x3f212
push 0xc7ce3e23
call fcn.00040463

Function at 0x3e438
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 8], 0x98
lea esp, [esp + 0xc]
je 0x3f212
pushfd
call fcn.00041a95

Function at 0x66994
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub si, di
test bp, cx
bswap dx
neg dx
mov esi, dword [eax + 0x3c]
sal dl, 1
bt cx, dx
shld dx, sp, 7
add esi, eax
pushfd
push ebx
stc
mov edi, dword [edx + 0x24]
neg bl
xor bh, dh
add edi, eax
sbb bh, bh
and ebx, 0x570e2a05
rcl bl, 6
call fcn.000384fc
clc
cmc
test eax, eax
pushal
push edx
mov word [esp], 0xcbc4
lea esp, [esp + 0x24]
je 0x39592
sar dl, 6
adc si, cx
sal si, 8
jg 0x39b4f
mov esi, dword [eax + 0x3c]
clc
add esi, eax
shld dx, cx, cl
neg dx
btc dx, 0xa
xor dh, 0x95
mov edx, dword [esi + 0x78]
pushfd
test edx, edx
pushfd
pushal
push dword [esp + 4]
lea esp, [esp + 0x2c]
je 0x39592
sar cl, 3
shld cx, sp, cl
bsf cx, dx
sub cx, 0x3373
add edx, eax
adc cl, al
sar ch, 6
cmp ch, bh
btr cx, dx
mov ecx, dword [esi + 0x7c]
pushal
pushal
clc
add ecx, edx
test cl, cl
stc
test cl, bl
test dx, 0xe6f9
mov dword [ebp - 0x10], ecx
cmp bp, 0x7dfa
sar cl, 1
adc ch, al
add ch, 0x4f
mov ecx, dword [ebp + 0xc]
bt si, 0xa
cmp ecx, 0xffff
pushfd
push dword [esp]
lea esp, [esp + 0x48]
jbe 0x38dc3
bsr bx, dx
jmp 0x3b450
cmp dh, 0xb9
das
shl ah, cl
push ebp
btr ax, dx
cwde
bts bp, 0xb
das
mov ebp, esp
sar al, cl
sub esp, 0x18
sub eax, 0x83f91c05
rcr ah, 6
movsx eax, bl
push esi
lahf
setg al
sub ax, bp
bt cx, 1
push edi
cmp bh, dh
movsx ax, cl
rol eax, 0x10
push ebx
setbe ah
clc
push 0xfec35652
movzx eax, cl
mov dword [esp], edx
rol eax, 0xc
setg al
sal al, cl
mov eax, dword [ebp + 8]
jmp 0x65c35
Function at 0x66b7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stc
add ebx, esp
sar di, 0xa
bts di, 9
mov edi, ebx
mov al, 0xe7
mov al, 0x2e
clc
repne scasb al, byte es:[edi]
push 0x7698bfec
mov word [esp], 0xdc4
lea esp, [esp + 4]
jne 0x67174
lea eax, [eax + 0x3ff0cb5a]
setle ah
pushal
mov byte [edi - 1], 0
movzx ax, dl
mov al, 0x6d
lahf
mov dword [esp + 0x1c], ebx
pop eax
lea esp, [esp + 0x18]
js 0x67179
movsx eax, bl
lea eax, [0x3f085]
call fcn.000660af
not ch
pop ebx
bswap ecx
pop ecx
call fcn.0006697c
bound ecx, qword [edx]
arpl bp, bp
popal
aad 0xb7
wait
dec esi
in eax, 0x62
xchg esi, eax
mov ch, 0x95
cmp eax, 0x9af2cab8
and dword [ebx + 0x71], 0xffffffeb
mov edi, 0x6c58ce5a
push edx
sub ch, byte [eax + 0x46]
jb 0x3a5af
adc byte [esi + 0x6e], 0x5e
dec ebx
or eax, 0x44fe9479
int1
cmpsb byte gs:[esi], byte es:[edi]
xchg byte [edx + 0x71d14d4a], dl
int3
salc
sub eax, ecx
int1
cmpsd dword [esi], dword es:[edi]
arpl word [eax - 0x22174c02], di
mov byte [0x26dbb94b], al
mov eax, 0xeebfc8ee
jmp 0x7e391499
lea esp, [esp + 0x34]
ja 0x66b55
stc
not al
sub ebx, edi
bsf di, ax
cmp bh, ah
jmp 0x3a4dc
lea esp, [esp + 0x44]
jne 0x6615d
pushal
jmp 0x67512
push 0x6d4722a7
cmc
mov dword [esp], esi
or si, 0x98ac
and si, 0x4e84
btr si, 0xf
mov esi, edi
pushal
push dword [esp]
sub esi, eax
mov byte [esp], 0xe4
pushfd
pushfd
rep movsb byte es:[edi], byte [esi]
bswap si
pushfd
mov esi, dword [esp + 0x30]
push 0x3977909d
mov byte [esp + 8], cl
pushfd
lea esp, [esp + 0x3c]
jmp fcn.00040f7d
push 0xc537a1ab
push esp
lea esp, [esp + 8]
call fcn.00039e4c
push esp
push dword [esp]
adc al, al
pushal
push dword [esp]
call 0x66b7f
cmp cx, 0x387b
stc
push eax
sub edi, 4
pushfd
stc
clc
push dword [edi]
pop dword [esp + 4]
pushfd
call fcn.00065baf
push esp
sbb bx, si
pop ebx
mov ebx, eax
pushal
cmp byte [edi], 0x23
pushal
call fcn.0003f788
lea esp, [esp + 0x30]
jae 0x66ae4
pushal
pushal
pushfd
jmp 0x3e824
jmp 0x679bf
cwde
movsx ax, bl
movzx ax, dl
movsx ax, cl
lea eax, [0x3f085]
pushfd
mov dword [esp], edx
pushal
mov dword [esp + 0x20], 0x407e2
mov byte [esp + 8], 0x58
mov dword [esp + 0x1c], eax
pushal
push dword [esp + 0x3c]
ret 0x40
pushal
stosb byte es:[edi], al
mov byte [esp], 0x37
lea esp, [esp + 0x40]
jmp fcn.00040f7d
pushfd
pushfd
pushal
mov esp, esi
pushfd
lea esp, [esp + 4]
jmp 0x39592

Function at 0x67e63
Capabilities:
Encode data using xor

Disassembly:
cmc
cmp al, 9
pushfd
lea esp, [esp + 4]
ja 0x67174
jmp 0x396a6
pushfd
cmc
imul edx, edx, 0xa
clc
pushfd
mov byte [esp + 4], cl
cmc
add edx, eax
pushfd
pushal
pushfd
push dword [esp + 0x14]
lea esp, [esp + 0x34]
jmp 0x3e5a9
lea esp, [esp + 0x24]
jne 0x387e0
inc ax
btc ax, ax
xor edx, edx
bsr ax, ax
cmp cl, 0xca
rol eax, 6
mov eax, edx
sbb al, cl
rol al, 3
add edi, 1
pushal
not al
mov al, byte [edi]
stc
test al, al
mov word [esp], bp
mov dword [esp + 4], edi
pushfd
mov byte [esp], 0x8e
lea esp, [esp + 0x24]
je 0x387d9
cmc
sub al, 0x30
jmp 0x38c9a
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x402808
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403ea0
test esi, esi
jne 0x40283e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403f90
jmp 0x40285c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004026bc
mov edi, eax
test esi, esi
je 0x40285c
cmp dword [ebx], 0
je 0x40285c
dec esi
jmp 0x402845
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40323c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40d014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4032d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032b4
xor eax, eax
push ebp
push 0x4032ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4032f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40d014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40d014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d24
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40e044], 0
je 0x403d85
cmp word [0x40e218], 0xd7b2
jne 0x403d4d
cmp dword [0x40e220], 0
jbe 0x403d4d
mov eax, 0x40e214
call dword [0x40e230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40d060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403dac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40d020], 0
jne 0x403da1
push 0
push 0x40d058
push 0x40d060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404800
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404a30
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404883
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404a30
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404883
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404a4c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40490c
xor eax, eax
push ebp
push 0x404905
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404648
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4048ea
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404a6c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4048ea
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40490c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404a26
cmp byte [ebp - 0xd], 0
jne 0x404953
cmp byte [ebp - 0x12], 0
je 0x404a26
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40496c
dec ebx
cmp byte [ebx], 0x2e
je 0x40497b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40496b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404a26
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4049b8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404a26
cmp byte [ebp - 0xd], 0
je 0x404a26
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404a26
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404bbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404c22
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c6c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404c0c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c29
lea eax, [ebp - 0x10]
call fcn.00403ea0
ret

Function at 0x406b30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406b69
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f90
jmp 0x406b72
mov eax, ebx
mov edx, esi
call fcn.00403ef4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406b7c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406b9d
mov al, byte [esp]
jmp 0x406b9f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407224
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40709c
mov eax, dword [0x40d3b4]
cmp byte [eax], 0
je 0x4072a0
mov eax, dword [0x40d308]
call fcn.00402b6c
call fcn.0040262c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406024
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4072e8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4072d6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x40d2e8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40e660]
call fcn.0040460c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret