joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bd50
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x478838]
sub esp, 0x310
test eax, eax
push esi
je 0x40bd7d
push eax
lea eax, [esp + 8]
push 0x47113c
push eax
push 0xe6
call fcn.0040a210
add esp, 0x10
jmp 0x40be03
call fcn.0040b020
test eax, eax
je 0x40bdbc
lea ecx, [esp + 0x10c]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea edx, [esp + 0x10c]
push edx
call fcn.0040aa40
mov esi, eax
add esp, 4
test esi, esi
jne 0x40bde5
mov eax, 7
pop esi
add esp, 0x310
ret
lea ecx, [esp + 0x10c]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea edx, [esp + 0x10c]
push edx
call fcn.0040aa10
mov esi, eax
add esp, 4
test esi, esi
je 0x40bdaf
push esi
lea eax, [esp + 8]
push 0x47113c
push eax
push 0xe6
call fcn.0040a210
push esi
call fcn.00454214
add esp, 0x14
push str.etilqs_
call fcn.0040a490
lea ecx, [esp + 8]
mov esi, eax
push ecx
call fcn.0040a490
lea edx, [esi + eax + 0x11]
mov esi, dword [esp + 0x320]
add esp, 8
cmp edx, esi
jl 0x40be38
mov eax, 1
pop esi
add esp, 0x310
ret
lea eax, [esp + 4]
push eax
call fcn.0040a490
add esp, 4
test eax, eax
jbe 0x40be57
lea ecx, [esp + 4]
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x40be57
dec eax
jne 0x40be4e
push ebx
lea ecx, [esp + 8]
push edi
mov edi, dword [esp + 0x324]
push ecx
push str._setilqs_
add esi, 0xffffffef
push edi
push esi
mov byte [esp + eax + 0x1c], 0
call fcn.0040a210
push edi
call fcn.0040a490
mov esi, eax
lea edx, [esi + edi]
push edx
push 0xf
call fcn.0040a2d0
add esp, 0x1c
mov ecx, 0xf
xor eax, eax
xor edx, edx
mov al, byte [esi + edi]
mov ebx, 0x3e
div ebx
inc esi
dec ecx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi + edi - 1], al
jne 0x40be94
mov byte [esi + edi], 0
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x310
ret

Function at 0x40c190
Capabilities:
Get disk size

Disassembly:
sub esp, 0x110
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
lea eax, [esp + 8]
push esi
push eax
push 0x104
push ecx
push edx
mov dword [esp + 0x18], 0x200
call fcn.0040c0c0
add esp, 0x10
test eax, eax
jne 0x40c279
lea eax, [esp + 0xc]
push eax
call fcn.0040bc20
mov esi, eax
add esp, 4
test esi, esi
je 0x40c26c
push edi
call fcn.0040b020
test eax, eax
mov ecx, esi
je 0x40c22a
mov ax, word [esi]
test ax, ax
je 0x40c20d
cmp ax, 0x5c
je 0x40c208
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x40c1f4
jmp 0x40c20d
mov word [ecx], 0
lea ecx, [esp + 8]
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceW]
jmp 0x40c25c
mov al, byte [esi]
test al, al
je 0x40c241
cmp al, 0x5c
je 0x40c23e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40c230
jmp 0x40c241
mov byte [ecx], 0
lea edx, [esp + 8]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.00454214
add esp, 4
test edi, edi
pop edi
jne 0x40c279
mov eax, 0x200
pop esi
add esp, 0x110
ret
mov eax, dword [esp + 8]
pop esi
add esp, 0x110
ret
Function at 0x40f530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebx, ebx
push edi
mov eax, dword [esi + 0x3c]
cmp dword [eax], 0
jne 0x40f561
mov ecx, dword [esi + 0x78]
push ecx
push eax
push esi
call fcn.0040f670
add esp, 0xc
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40f663
mov ebx, eax
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x24]
cmp ecx, eax
jbe 0x40f59d
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.00453dd0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x3c]
push edx
push 5
push eax
call fcn.0040e950
mov ecx, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], ecx
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x40f659
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x18]
cmp edi, eax
ja 0x40f64e
test byte [ebp + 0x14], 0x20
jne 0x40f64e
mov eax, dword [esi + 0x80]
lea ecx, [edi - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.00453dd0
cmp edi, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jne 0x40f5eb
push ebp
call fcn.0040f160
add esp, 4
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x80]
mov ebx, dword [ebp]
push edx
mov edx, dword [esi + 0x3c]
push eax
push ecx
push ebx
push edx
call fcn.0040dcb0
add esp, 0x14
cmp edi, 1
mov dword [esp + 0x1c], eax
jne 0x40f631
add ebx, 0x18
lea eax, [esi + 0x64]
mov ecx, dword [ebx]
mov dword [eax], ecx
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ebx + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0xc], edx
cmp edi, dword [esi + 0x20]
jbe 0x40f639
mov dword [esi + 0x20], edi
mov eax, dword [ebp]
mov ecx, dword [esi + 0x58]
push eax
push edi
push ecx
call fcn.00415ea0
mov ebx, dword [esp + 0x28]
add esp, 0xc
mov ebp, dword [ebp + 8]
test ebx, ebx
je 0x40f5a1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x412810
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebp, dword [esi + 0x60]
cmp ebx, ebp
jle 0x412911
mov al, byte [esi + 6]
test al, al
je 0x412911
mov ecx, dword [esi + 0x5c]
lea eax, [ebx + ebx*2]
shl eax, 4
push eax
push ecx
call fcn.00408f50
mov edx, eax
add esp, 8
test edx, edx
jne 0x412855
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
ret
lea eax, [ebp + ebp*2]
shl eax, 4
lea edi, [eax + edx]
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x14], edi
lea ecx, [eax + eax*2]
xor eax, eax
shl ecx, 4
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
mov ebx, dword [esp + 0x18]
and ecx, 3
cmp ebp, ebx
rep stosb byte es:[edi], al
mov dword [esi + 0x5c], edx
jge 0x412911
mov ecx, dword [esp + 0x14]
lea edi, [ecx + 0x18]
mov edx, dword [esi + 0x18]
mov dword [edi - 4], edx
mov eax, dword [esi + 0x40]
cmp dword [eax], 0
je 0x4128b9
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
test eax, eax
jl 0x4128b9
jg 0x4128b1
test ecx, ecx
jbe 0x4128b9
mov dword [edi - 0x18], ecx
mov dword [edi - 0x14], eax
jmp 0x4128c6
mov ecx, dword [esi + 0x7c]
mov dword [edi - 0x18], ecx
mov dword [edi - 0x14], 0
mov edx, dword [esi + 0x34]
mov dword [edi], edx
mov eax, dword [esi + 0x18]
push eax
call fcn.0040dfb0
add esp, 4
mov dword [edi - 8], eax
test eax, eax
je 0x41284b
push esi
call fcn.0040e320
add esp, 4
test eax, eax
je 0x412902
mov edx, dword [esi + 0xac]
lea ecx, [edi + 4]
push ecx
push edx
call fcn.00412990
add esp, 8
lea eax, [ebp + 1]
add edi, 0x30
mov ebp, eax
mov dword [esi + 0x60], eax
cmp ebp, ebx
jl 0x412893
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x422e20
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
test ecx, ecx
jne 0x422eee
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov ebx, dword [esi + 0x40]
mov cx, word [esi + 0xc]
mov edx, ebx
add edx, ecx
xor ecx, ecx
mov cl, byte [esi + 5]
lea edi, [edx + eax*2]
mov ebp, ecx
xor eax, eax
xor edx, edx
mov ah, byte [edi]
mov dh, byte [ebx + ebp + 5]
mov al, byte [edi + 1]
mov dl, byte [ebx + ebp + 6]
cmp eax, edx
jb 0x422edb
mov edx, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3c]
add edx, eax
cmp edx, dword [ecx + 0x28]
ja 0x422edb
mov ecx, dword [esp + 0x1c]
push ecx
push eax
push esi
call fcn.00422f00
add esp, 0xc
test eax, eax
je 0x422e92
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
pop ebx
ret
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov cx, word [esi + 0x10]
inc eax
cmp eax, ecx
jge 0x422eba
mov dl, byte [edi + 2]
mov cl, byte [edi + 3]
mov byte [edi], dl
xor edx, edx
mov byte [edi + 1], cl
mov dx, word [esi + 0x10]
inc eax
add edi, 2
cmp eax, edx
jl 0x422ea1
dec word [esi + 0x10]
mov ax, word [esi + 0x10]
xor ecx, ecx
pop edi
mov cl, ah
mov byte [ebx + ebp + 3], cl
mov dl, byte [esi + 0x10]
mov byte [ebx + ebp + 4], dl
add word [esi + 0xe], 2
pop esi
pop ebp
pop ebx
ret
push 0xccb1
call fcn.00451020
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword [ecx], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4234b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
push ecx
call fcn.00423670
mov ebp, dword [esi + 0x40]
xor ecx, ecx
mov cx, word [esi + 0x10]
mov ebx, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x3c]
xor edx, edx
xor eax, eax
mov dl, byte [esi + 5]
mov ax, word [esi + 0xc]
mov esi, dword [ecx + 0x28]
xor ecx, ecx
mov ch, byte [edx + ebp + 5]
mov dword [esp + 0x14], esi
mov cl, byte [edx + ebp + 6]
mov dword [esp + 0x28], ebx
mov edi, ecx
mov ecx, esi
sub ecx, edi
add esp, 4
lea esi, [edi + ebp]
add edi, ebx
mov ebx, ecx
mov dword [esp + 0x2c], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x10]
and ecx, 3
mov dword [esp + 0x18], 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
lea edi, [eax + ecx*2]
mov dword [esp + 0x20], edi
jle 0x4235e5
add eax, ebp
mov dword [esp + 0x14], eax
jmp 0x423547
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
xor edx, edx
mov dh, byte [eax]
mov dl, byte [eax + 1]
mov esi, edx
cmp esi, edi
mov dword [esp + 0x28], esi
jl 0x42364f
mov eax, dword [esp + 0x10]
add eax, 0xfffffffc
cmp esi, eax
jg 0x42364f
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
add esi, ecx
push esi
push edx
call fcn.00422560
and eax, 0xffff
add esp, 8
sub ebx, eax
cmp ebx, edi
jl 0x42363a
mov ecx, dword [esp + 0x28]
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
jg 0x42363a
mov ecx, eax
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
add eax, 2
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
mov byte [eax - 1], bl
sar ecx, 8
mov byte [eax - 2], cl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x42353f
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
mov eax, ebx
sar eax, 8
mov byte [edx + ebp + 5], al
mov byte [edx + ebp + 6], bl
sub ebx, edi
mov byte [edx + ebp + 1], 0
mov byte [edx + ebp + 2], 0
mov ecx, ebx
mov byte [edx + ebp + 7], 0
mov edx, ecx
xor eax, eax
add edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x34]
xor eax, eax
mov ax, word [ecx + 0xe]
cmp ebx, eax
je 0x423664
push 0xbbf9
call fcn.00451020
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push 0xbbe8
call fcn.00451020
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push 0xbbdc
call fcn.00451020
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret

Function at 0x429190
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x4291bc
mov ecx, dword [esp + 8]
push ebx
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx]
mov bl, byte [edx + 0x466438]
lea edx, [eax*8]
xor ebx, edx
xor eax, ebx
inc ecx
dec esi
jne 0x4291a0
pop ebx
pop esi
ret
Function at 0x437830
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x437841
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ebx, dword [esp + 0x10]
push 0x50
push ebx
call fcn.004090b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x43785a
pop edi
pop esi
pop ebx
ret
mov eax, dword [edi]
push ebp
mov ebp, dword [esp + 0x1c]
push ebp
push eax
push ebx
call fcn.00437740
mov dword [esi], eax
mov ecx, dword [edi + 8]
push ebp
push ecx
push ebx
call fcn.00437920
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
push ebp
push edx
push ebx
call fcn.004373a0
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
push ebp
push eax
push ebx
call fcn.00437740
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
push ebp
push ecx
push ebx
call fcn.004373a0
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x18]
push ebp
push edx
push ebx
call fcn.00437740
mov dword [esi + 0x18], eax
mov al, byte [edi + 4]
add esp, 0x48
mov byte [esi + 4], al
mov ecx, dword [edi + 0x1c]
push ebp
push ecx
push ebx
call fcn.00437830
mov dword [esi + 0x1c], eax
mov edx, dword [edi + 0x28]
push ebp
push edx
push ebx
call fcn.004373a0
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
push ebp
push eax
push ebx
call fcn.004373a0
mov dword [esi + 0x2c], eax
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov cx, word [edi + 6]
add esp, 0x24
mov dword [esi + 0x24], eax
or eax, 0xffffffff
and ecx, 0xfff7
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
pop ebp
mov word [esi + 6], cx
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x44f0a0
Capabilities:
Get system information on windows

Disassembly:
push edi
mov ecx, 9
xor eax, eax
mov edi, 0x47abe0
rep stosd dword es:[edi], eax
push 0x47abe0
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
push 1
push 0x46ffb8
call fcn.00408660
add esp, 8
xor eax, eax
pop edi
ret
push 0xa
call fcn.00408bf0
add esp, 4
test eax, eax
jne 0x44f0b4
mov eax, 7
ret
push eax
call fcn.00408df0
add esp, 4
jmp 0x40c5b0
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40a873
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40a882
pop dword [ebp - 0x24]
mov eax, 0xcc55de35
add eax, 0x33eaca4d
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x39cbf
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x2a9a08b4
sub ecx, 0x2a99be5f
xor edx, edx
add edx, eax
mov edi, 0x579ffad5
add edi, 0xa8a140ef
add edi, dword [ebp - 0x24]
mov esi, 0x7226037d
add esi, 0x67faf1db
sub dword [ebp - 0x10], 0xbc3d597a
mov ebx, dword [edi]
xor dword [ebp - 0x20], ebx
xor ebx, esi
add dword [ebp - 0x10], 0x6a157f81
mov dword [edx], ebx
add dword [ebp - 0x10], 0xc70682b1
add edx, 0x482b060a
add edx, 0xb7d4f9fa
add edi, 0xdf7c9fd1
add edi, 0x20836033
loop 0x40a8de
add eax, 0x11c27
xor ebx, ebx
add ebx, eax
add eax, 0x6ba39dbc
add eax, 0x945c6249
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4036ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x466020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403744
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403724
xor eax, eax
push ebp
push 0x40371d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403760
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403724
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x466020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x466020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404550
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x469048], 0
je 0x4045b1
cmp word [0x46921c], 0xd7b2
jne 0x404579
cmp dword [0x469224], 0
jbe 0x404579
mov eax, 0x469218
call dword [0x469234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045d8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46602c], 0
jne 0x4045cd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405ad8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d08
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405b5b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d08
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405b5b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d24
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405be4
xor eax, eax
push ebp
push 0x405bdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405914
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405bc2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405d44
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405bc2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405be4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405cfe
cmp byte [ebp - 0xd], 0
jne 0x405c2b
cmp byte [ebp - 0x12], 0
je 0x405cfe
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405c44
dec ebx
cmp byte [ebx], 0x2e
je 0x405c53
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c43
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405cfe
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c90
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cfe
cmp byte [ebp - 0xd], 0
je 0x405cfe
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cfe
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4081b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408244
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408244
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4081f7
test edx, 3
jne 0x4081e6
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4081f1
jmp 0x4081f7
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4081f7
cmp dword [ecx - 8], 1
je 0x408201
mov edx, ebx
or edx, 3
call fcn.00404e3c
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408213
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004046f0

Function at 0x408250
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4082e0
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4082e0
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408293
test edx, 3
jne 0x408282
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40828d
jmp 0x408293
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408293
cmp dword [ecx - 8], 1
je 0x40829d
mov edx, ebx
or edx, 3
call fcn.00404e3c
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4082af
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004046f0

Function at 0x40b77c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b7b5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004047e0
jmp 0x40b7be
mov eax, ebx
mov edx, esi
call fcn.00404744
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b7c8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b7ea
movzx eax, byte [esp]
jmp 0x40b7ec
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40be7c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bcf4
mov eax, dword [0x468968]
cmp byte [eax], 0
je 0x40bef8
mov eax, dword [0x468788]
call fcn.00403038
call fcn.00402df8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408e54
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bf40
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bf2e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46872c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46b7f4]
call fcn.004058bc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
and al, 8

Function at 0x40c78c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c862
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404788
lea eax, [ebp - 4]
call fcn.00404c04
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404bb4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c84c
mov eax, ebx
call fcn.00402c9c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c845
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404bb4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c82f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c874
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c82f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c84c
mov eax, dword [ebp - 0x10]
call fcn.00402cb8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c869
lea eax, [ebp - 4]
call fcn.004046f0
ret