joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000289a
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100028e6
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100028d5
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100028ce
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100028ab
pop ebx
push dword [esi]
push 0
push dword [0x100276c4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x100028e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
imul esi, ecx, 0x2c
push edi
mov edi, edx
mov dword [ebp - 0x10], edi
add esi, dword [0x10027750]
mov dword [ebp - 8], esi
mov al, byte [esi + 0x14]
mov ebx, dword [esi]
and al, 1
je 0x1000290e
sub ebx, 5
movzx eax, al
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10002935
push 0xa
pop eax
jmp 0x100029b5
test edi, edi
je 0x10002956
mov byte [ebx], 0xe9
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [esi + 0x14], 1
je 0x10002975
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10002975
test byte [esi + 0x14], 1
je 0x1000296a
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
jmp 0x10002975
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [ebp - 0x10]
mov cl, dl
add cl, cl
shl dl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor dl, cl
and dl, 4
xor dl, cl
xor eax, eax
mov byte [esi + 0x14], dl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10002eb1
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x1002774c]
push esi
xor esi, esi
jmp 0x10002ec3
cmp dword [edx + 4], esi
jne 0x10002f17
mov edx, dword [edx]
test edx, edx
jne 0x10002ebc
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x10002f13
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x10002eea
mov eax, dword [0x1002774c]
mov dword [edx], eax
mov dword [0x1002774c], edx
pop edi
test edx, edx
jne 0x10002f17
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
Function at 0x10009329
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10009368
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10009368
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10009368
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10009368
cmp dword [ecx + 0x74], 0xe
jbe 0x10009368
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000a336
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001d670
push 0x1001d668
push str.FlsAlloc
push 0x1f
call fcn.1000a252
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a36a
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c160]
call esi
jmp 0x1000a370
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000a3b4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001d680
push 0x1001d678
push str.FlsGetValue
push 0x21
call fcn.1000a252
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a3eb
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000a3f3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001d688
push 0x1001d680
push str.FlsSetValue
push 0x22
call fcn.1000a252
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000a42d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001c160]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000e0e4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000e181
push ebx
push esi
call fcn.1000e0ad
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000e041
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000e12e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000e180
push edi
push eax
call fcn.1000b46d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000e14e
call fcn.1000a0ff
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000e17f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000e041
add esp, 0x20
test eax, eax
jne 0x1000e16d
push edi
call fcn.1000a0ff
jmp 0x1000e175
push ebx
call fcn.1000a0ff
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10013a6f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100271d8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10013aaf
cmp byte [ebx], 0xa
jne 0x10013aaf
or byte [edi + eax + 0x28], 4
jmp 0x10013ab4
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10013bb3
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10013b96
inc eax
cmp dl, 0xd
je 0x10013ae0
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10013b06
cmp eax, ecx
jae 0x10013b14
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10013ac8
jmp 0x10013bb3
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10013b91
cmp dword [ebp - 0x10], 0
je 0x10013b91
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100271d8]
test byte [eax + edi + 0x28], 0x48
je 0x10013b6b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10013b56
mov byte [esi], dl
jmp 0x10013b67
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100271d8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10013bb3
cmp byte [ebp - 1], 0xa
jne 0x10013b7a
cmp esi, ebx
jne 0x10013b7a
mov byte [esi], 0xa
jmp 0x10013bb2
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100139df
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10013bb3
mov byte [esi], 0xd
jmp 0x10013bb2
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100271d8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10013bb0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10013bb3
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10013bbc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100271d8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10013c02
cmp word [ebx], dx
jne 0x10013c02
or byte [eax + edi + 0x28], 4
jmp 0x10013c07
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10013d6a
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10013d4a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10013c48
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10013c7e
cmp eax, edx
jae 0x10013c8c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10013c23
jmp 0x10013d6a
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10013d45
cmp dword [ebp - 0x18], 0
je 0x10013d45
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100271d8]
test byte [eax + edi + 0x28], 0x48
je 0x10013d1b
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10013cdf
mov word [esi], cx
jmp 0x10013d16
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100271d8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100271d8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100271d8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10013d6a
pop eax
cmp word [ebp - 4], ax
jne 0x10013d2b
cmp esi, ebx
jne 0x10013d2b
mov word [esi], ax
jmp 0x10013d67
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100139df
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10013d6a
push 0xd
pop eax
jmp 0x10013d26
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100271d8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10013d64
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10013d6a
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10014fd1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10014f4d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10015140
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10015140
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100150f5
jg 0x1001502d
test eax, eax
je 0x100150eb
push 1
push 0x1000
call fcn.10009ff2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10015050
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100150e2
push 0x8000
push ebx
call fcn.10014e7e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10015079
jg 0x10015074
cmp ecx, 0x1000
jb 0x10015079
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1000f09c
add esp, 0x10
cmp eax, 0xffffffff
je 0x100150be
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10015074
jl 0x100150a5
test ecx, ecx
jne 0x10015066
push dword [ebp - 0xc]
push ebx
call fcn.10014e7e
push esi
call fcn.1000a0ff
add esp, 0xc
xor ebx, ebx
jmp 0x1001514e
cmp byte [edi + 0x24], 0
je 0x100150d5
cmp dword [edi + 0x20], 5
jne 0x100150d5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100150e0
mov ebx, dword [edi + 0x18]
jmp 0x100150e2
xor ebx, ebx
push esi
call fcn.1000a0ff
pop ecx
jmp 0x1001514e
test ecx, ecx
jg 0x100150b7
jl 0x100150f5
test eax, eax
jae 0x100150b7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100139df
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10015115
cmp byte [edi + 0x1c], 0
je 0x100150b7
jmp 0x10015146
push ebx
call fcn.1000f682
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100150b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001514e
cmp byte [edi + 0x1c], 0
je 0x1001514b
mov ebx, dword [edi + 0x18]
jmp 0x1001514e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100139df
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10017180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100171ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100171ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402af8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004041cc
test esi, esi
jne 0x402b2e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004042bc
jmp 0x402b4c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a0c
mov edi, eax
test esi, esi
je 0x402b4c
cmp dword [ebx], 0
je 0x402b4c
dec esi
jmp 0x402b35
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402de0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x493008], 0x8088405
inc edx
mov dword [ebx + 0x493008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403268
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x493024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403300
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032e0
xor eax, eax
push ebp
push 0x4032d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40331c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x493024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x493024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403fcc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49604c], 0
je 0x40402d
cmp word [0x496220], 0xd7b2
jne 0x403ff5
cmp dword [0x496228], 0
jbe 0x403ff5
mov eax, 0x49621c
call dword [0x496238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x493070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x493034], 0
jne 0x404049
push 0
push 0x493068
push 0x493070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027d0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x49604d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404148
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405820
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a50
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4058a3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a50
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4058a3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a6c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40592c
xor eax, eax
push ebp
push 0x405925
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405668
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40590a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405a8c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40590a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40592c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405a46
cmp byte [ebp - 0xd], 0
jne 0x405973
cmp byte [ebp - 0x12], 0
je 0x405a46
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40598c
dec ebx
cmp byte [ebx], 0x2e
je 0x40599b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40598b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405a46
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4059d8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a46
cmp byte [ebp - 0xd], 0
je 0x405a46
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a46
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406134
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40619a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040443c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402dfc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406184
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4061a1
lea eax, [ebp - 0x10]
call fcn.004041cc
ret

Function at 0x40ba44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ba7d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004042bc
jmp 0x40ba86
mov eax, ebx
mov edx, esi
call fcn.00404220
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ba90
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bab1
mov al, byte [esp]
jmp 0x40bab3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c138
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bfb0
mov eax, dword [0x494f7c]
cmp byte [eax], 0
je 0x40c1b4
mov eax, dword [0x494cec]
call fcn.00402c10
call fcn.00402938
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004090bc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c1fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c1ea
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x494c84]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x496668]
call fcn.0040562c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret