joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b6233
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x101ccaac]
add edx, 0xffffef19
mov dword [0x101ccab0], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.101b5af9
lea ecx, [0x101b4cd1]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x74], edx
mov dword [esp + 0x28], 0x12a800
mov edx, dword [0x101cca98]
mov dword [esp + 0x6c], edx
mov edx, dword [0x101cca9c]
mov dword [esp + 0x78], edx
mov edx, dword [0x101ccaa0]
mov dword [esp + 0x40], edx
mov edx, dword [0x101ccaa4]
mov dword [esp + 0x7c], edx
mov edx, dword [0x101ccaa8]
mov dword [esp + 0x48], edx
mov dword [0x101ccab0], 0x717
mov dword [0x101ccaac], 0x127a
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x101b6321
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101b62ef
jmp 0x101b6330
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
mov dword [esp + 0x70], eax
mov dword [0x101ccaac], 0x25db
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x30], edx
call fcn.101b4b60
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x101b6344
jmp 0x101b62e7
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x101b62d1
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x101b6321
lea eax, [esp + 0x20]
mov dword [0x101ccaac], 0xf39
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101b554e
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 8], eax
jmp 0x101b62e7
Function at 0x41c9e2
Capabilities:
Change the wallpaper

Disassembly:
push ebx
push esi
push edi
mov edi, edx
sub ecx, 0
je 0x41ca8e
sub ecx, 1
je 0x41ca80
sub ecx, 1
je 0x41ca72
sub ecx, 1
je 0x41ca3f
sub ecx, 1
jne 0x41cad0
push 1
sub esp, 0x18
mov ecx, esp
push 0x46611c
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x466118
jmp 0x41cabc
push 1
sub esp, 0x18
mov ecx, esp
push 0x46c5f0
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x46611c
jmp 0x41cabc
push 1
sub esp, 0x18
mov ecx, esp
push 0x46c9f8
jmp 0x41ca4b
push 1
sub esp, 0x18
mov ecx, esp
push 0x466104
jmp 0x41ca4b
push 1
sub esp, 0x18
mov ebx, 0x46611c
mov ecx, esp
push ebx
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402093
push str.TileWallpaper
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 3
push edi
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
ret

Function at 0x41cd9b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov bl, cl
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [0x474b18]
test bl, bl
mov dword [0x474b34], eax
pop ebx
jne 0x41cdc3
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0043c1b8
push eax
push 0x46ce14
push str.CONOUT_
call fcn.00441c22
add esp, 0x10
push 0x4e4
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call fcn.0041cd58
push 0x64
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00436e90
lea eax, [ebp - 0x64]
push str._n_tRemcos_v
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push str.5.0.0_Pro
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push 0x46cf18
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push eax
call fcn.00407200
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403203
pop dword [ebp - 0x34]
mov eax, 0x403203
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x9e51fb49
sub dword [ebp - 0x44], 0x4fffb5fe
mov dword [ebp - 0x40], 0xf82e0951
add dword [ebp - 0x40], 0x3a0542f4
mov dword [ebp - 0x3c], 0x92cc5415
sub dword [ebp - 0x3c], 0x46800fe7
mov dword [ebp - 0x38], 0x40a4a881
sub dword [ebp - 0x38], 0x40a4a881
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x212bc7a8
sub dword [ebp - 0x44], 0xacb95e52
mov dword [ebp - 0x40], 0x87c179ca
sub dword [ebp - 0x40], 0x46551855
mov dword [ebp - 0x3c], 0x28d7461
add dword [ebp - 0x3c], 0x60e1f80b
mov dword [ebp - 0x38], 0xda6d8461
add dword [ebp - 0x38], 0x25927b9f
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xc7ee14fa
add eax, 0x38525bae
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x344f5
push 0
call eax
mov ecx, 0x3edd
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x34]
mov edx, 0x46a0ce5c
add edx, 0x2cab0146
sub dword [ebp - 0x24], 0xc3a941d5
mov esi, dword [ebx]
add dword [ebp - 0x20], 0x7bdd8d1d
xor esi, edx
xor dword [ebp - 8], 0xa98d90e3
mov dword [edi], esi
sub dword [ebp - 0x1c], ecx
add edi, 0x88c91c5f
add edi, 0x7736e3a5
add ebx, 0xf995e31f
sub ebx, 0xf995e31b
loop 0x40330f
add eax, 0x67409f01
sub eax, 0x673fb0ba
mov ebx, eax
add eax, 0x7134d5cf
add eax, 0x8ecb2a36
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40506b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x405091

Function at 0x40507f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x405091
Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
add al, 0x56
push edi
test al, 1
je 0x40b536
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420ff6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b68a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x40a10a
or eax, 1
mov dword [0x4c7488], 0
push 0x43b83c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422f80
add esp, 4
jmp 0x40a01f
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x40a064
Function at 0x40fe40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415e80
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4

Function at 0x420bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c6283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.00424916
pop ecx
push eax
call fcn.00424744
cmp dword [edi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x456305
lea ecx, [ebp - 0x18]
call fcn.00405c18
mov ecx, edi
call fcn.00409997
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.00405b75
push dword [ebp - 0x18]
push 0x491d28
push esi
call fcn.00424b15
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x456325
lea ecx, [ebp - 0x18]
call fcn.00405a64
mov edi, dword [ebp - 8]
push esi
call fcn.00424cda
pop ecx
cmp ebx, 0xffffffff
je 0x420c6e
push ebx
push esi
call fcn.00424916
pop ecx
push eax
call fcn.00424744
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x420c56
push esi
mov ecx, edi
call fcn.004689e2
push eax
push 1
call fcn.0046899f
push eax
call fcn.00424a93
add esp, 0x10
mov edi, eax
jmp 0x420c49
mov ecx, edi
call fcn.00409997
mov eax, dword [edi + 8]
push dword [eax]
call dword [0x48f248]
jmp 0x420c3e

Function at 0x45fcb1
Capabilities:
Encode data using xor

Disassembly:
jle 0x45fcbc
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fcb3
push 9
push 0x834b110a
mov ax, word [edi + 0xa]
mov ax, 0x2024
add byte [eax], al
call fcn.00431ba4
push esi
push 0x85080fff
mov esi, ecx
lea eax, [ebp - 0x72722020]
invalid

Function at 0x4697e5
Capabilities:
Encode data using xor

Disassembly:
add byte [ebp - 0x681713b3], cl
mov ebx, 0x96af1f9
push 0x110a
push dword [esi]
or al, 0
lock add byte [eax], al
sub esp, 0x83e80688
cli
cli
push edi
mov edi, ecx
xor eax, dword [eax]
bswap ecx
push edx
jge 0x469802
push ecx
xor ebx, ebx
mov dword [ebp - 0x72720478], ecx
push dword [edi + 4]
mov dword [ebp - 0x474], ecx
inc ebx
push dword [edi]
mov dword [ebp - 0x7699ef70], ecx
mov dword [ebp - 0x7699ef6c], ecx
mov dword [ebp - 0x7699ef68], ecx
mov dword [ebp - 0x7699ef64], ecx
mov dword [ebp - 0x7699ef60], ecx
mov dword [ebp - 0x7699ef5c], ecx
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x28], ecx
mov ecx, edi
add dword [esi - 0x7b], edx
lodsb al, byte [esi]
sti
push esi
jmp dword [esi - 0x77]

Function at 0x48e485
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or ecx, dword [ebx]
or al, 0xc
or al, 5
or al, 5
or al, 5
add eax, 0x1050505
add dword [ecx], eax
add dword [ecx], eax
add eax, 0x10d0505
or eax, 0xd010d01
add dword [ebp + 0x10], edi
push eax
add dword [0x517489ff], eax
push ebx
stc
invalid
Function at 0x48e541
Capabilities:
Encrypt data using rc4 prga

Disassembly:
leave
mov eax, dword [ebp + 0xc]
dec ecx
mov dword [ebx], esi
mov dword [eax], ecx
xor eax, eax
jmp 0x48e55d
pop edi
or byte [ebx + ebp*8], dl
inc eax
add al, 0xc3
dec dword [ecx + 0x50ec8374]
add al, 0xaa
adc bh, cl
stc
mov ebx, edx
mov dword [ebp - 8], edi
mov esi, dword [edi]
add esi, 2
movzx eax, word [esi]
mov si, word [esp + esi*2 + 0x36]
xor edx, edx
mov dword [ebx], edx
cmp eax, 0x7b
jne 0x48e5d4
cmp word [esi + 2], 0x5e
jne 0x48e59a
mov dword [ebx], 0x40c2444
add esi, 2
mov eax, edx
add esi, 2
movzx ecx, word [esi]
test cx, cx
je 0x48e5b7
cmp ecx, 0x7d
je 0x48e5cb
mov word [ebp + eax*2 - 0x50], cx
inc eax
cmp eax, 0x1f
jl 0x48e59c
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xab006a2e
sub al, 0x53
mov dword [edi], esi
pop edi
or byte [ebx + ebp*8], dl
inc eax
add al, 0xc3
xor ecx, ecx
mov word [ebp + eax*2 - 0x50], cx
jmp 0x48e5de
mov word [ebp - 0x50], ax
jne 0xb28e6f61
mov eax, 0xf800a9
mov dword [edi], esi
mov dword [ebp - 0xc], eax
lea ecx, [eax + edx]
lea eax, [ebp - 0x50]
sar ecx, 1
mov dword [ebp - 4], eax
imul eax, ecx, 6
movzx ebx, word [eax + 0x4b8f80]
add ebx, 0x54b8a20
add esp, esi
cld
movzx edi, word [eax]
test di, di
jne 0x48e613
cmp byte [ebx], 0x78
je fcn.0048e65f
movzx edi, word [eax]
add eax, 2
mov dword [ebp - 4], eax
movzx eax, byte [ebx]
inc ebx
mov dword [ebp - 0x10], edi
cmp di, ax
mov edi, dword [ebp - 8]
je 0x48e603
cmp ax, word [ebp - 0x10]
sbb eax, eax
neg eax
lea eax, [eax*2 - 1]
pushal
xor dword [ecx + 0x7e], 8
mov eax, dword [ebp - 0xc]
lea edx, [ecx + 1]
jmp 0x48e64d
cmp edx, eax
jl 0x48e5e8
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x1a2ae82f
jmp 0x48e5c0
Function at 0x402a74
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004040b4
test esi, esi
jne 0x402aaa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004041a4
jmp 0x402ac8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402988
mov edi, eax
test esi, esi
je 0x402ac8
cmp dword [ebx], 0
je 0x402ac8
dec esi
jmp 0x402ab1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403198
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x468020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403230
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403210
xor eax, eax
push ebp
push 0x403209
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40324c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403210
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x468020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x468020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46a04c], 0
je 0x403f79
cmp word [0x46a220], 0xd7b2
jne 0x403f41
cmp dword [0x46a228], 0
jbe 0x403f41
mov eax, 0x46a21c
call dword [0x46a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46806c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x468030], 0
jne 0x403f95
push 0
push 0x468064
push 0x46806c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405728
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405958
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4057ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405958
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4057ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405974
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405834
xor eax, eax
push ebp
push 0x40582d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405570
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405812
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405994
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405812
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405834
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40594e
cmp byte [ebp - 0xd], 0
jne 0x40587b
cmp byte [ebp - 0x12], 0
je 0x40594e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405894
dec ebx
cmp byte [ebx], 0x2e
je 0x4058a3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405893
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40594e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4058e0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40594e
cmp byte [ebp - 0xd], 0
je 0x40594e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40594e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406020
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406086
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404324
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d5c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406070
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40608d
lea eax, [ebp - 0x10]
call fcn.004040b4
ret

Function at 0x408ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404574
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408ae9
test al, 0x10
jne 0x408aed
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40b934
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b96d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004041a4
jmp 0x40b976
mov eax, ebx
mov edx, esi
call fcn.00404108
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b980
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b9a1
mov al, byte [esp]
jmp 0x40b9a3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c028
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bea0
mov eax, dword [0x469d00]
cmp byte [eax], 0
je 0x40c0a4
mov eax, dword [0x469a5c]
call fcn.00402b8c
call fcn.004028b4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408fe8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c0ec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c0da
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4699e4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46a668]
call fcn.00405534
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret