joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100362d1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1004a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1002b19c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1002b19c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10036348
cmp word [ecx], dx
je 0x10036348
mov eax, dword [0x10041774]
push edi
dec eax
push eax
push 0x10041660
call fcn.10036270
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100363bb
cmp word [eax], dx
je 0x100363bb
mov eax, dword [edi]
test eax, eax
je 0x1003636c
cmp word [eax], dx
je 0x1003636c
lea eax, [ebp - 0x10]
push eax
call fcn.10035c53
jmp 0x10036375
lea eax, [ebp - 0x10]
push eax
call fcn.10035cee
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100363e5
mov eax, dword [0x1004165c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10041350
call fcn.10036270
add esp, 0xc
test al, al
je 0x100363e5
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100363b0
cmp word [eax], di
je 0x100363b0
lea eax, [ebp - 0x10]
push eax
call fcn.10035c53
pop ecx
jmp 0x100363e7
lea eax, [ebp - 0x10]
push eax
call fcn.10035cee
jmp 0x100363ad
mov eax, dword [edi]
test eax, eax
je 0x100363d2
cmp word [eax], dx
je 0x100363d2
lea eax, [ebp - 0x10]
push eax
call fcn.10035c08
pop ecx
jmp 0x100363e5
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100364b0
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100360f5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100364b0
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100364b0
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100364b0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1003643d
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1002d1bd
test ebx, ebx
je 0x100364ab
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1002d1bd
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100364b0
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100364b0
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1003951e
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100364b2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001da46
leave
ret
Function at 0x1003ac50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003ac7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003ac7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x1da17ed6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x75640c7d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10008633
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10010
call fcn.100098a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 1
lea eax, [ebp - 0x10010]
mov edi, ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100086b5
push esi
xor esi, esi
mov ecx, 0x10000
push 0
lea eax, [ebp - 0x10008]
push eax
push ecx
lea eax, [ebp - 0x10004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000869d
mov ecx, 0x10000
cmp dword [ebp - 0x10008], ecx
jne 0x1000869d
add esi, ecx
cmp esi, 0xffffffff
jb 0x1000866d
push 0
push 0
push dword [ebp - 0x1000c]
push dword [ebp - 0x10010]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10008b44
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x460004]
jne 0x40100a
repz ret
jmp fcn.00401368

Function at 0x40425b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x460004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403568
and dword [ebp - 0x14], 0
cmp dword [0x462940], 0
mov dword [ebp - 0x18], eax
jne 0x40430e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4043b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4043b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x462940], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x462944], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x462948], eax
call edi
push eax
call esi
mov dword [0x462950], eax
test eax, eax
je 0x40430e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46294c], eax
mov eax, dword [0x46294c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404367
cmp dword [0x462950], ecx
je 0x404367
push eax
call esi
push dword [0x462950]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404367
test ebx, ebx
je 0x404367
call edi
test eax, eax
je 0x40435e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40435e
test byte [ebp - 8], 1
jne 0x404367
or dword [ebp + 0x10], 0x200000
jmp 0x40439a
mov eax, dword [0x462944]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40439a
mov eax, dword [0x462948]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x462940]
call esi
test eax, eax
je 0x4043b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4043b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x45ca40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x1f34de4]
mov eax, dword [0x1f34b08]
xor ecx, ecx
mov word [0x1f34e00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x1f34dec], 0x6e0072
mov dword [0x1f34df0], 0x6c0065
mov dword [0x1f34df4], 0x320033
mov dword [0x1f34df8], 0x64002e
mov dword [0x1f34dfc], 0x6c006c
mov dword [0x1f34de8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x45cc70
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x460dc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1f34b08]
push edi
mov edi, dword [0x1f34de4]
push eax
call fcn.0045cb90
add esp, 4
cmp dword [0x1f34de4], 0x2f
jne 0x45cccd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0045cbe0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x467004]
jne 0x40100a
repz ret
jmp fcn.004014cd

Function at 0x4074fe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x467004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403f44
and dword [ebp - 0x14], 0
cmp dword [0x469e88], 0
mov dword [ebp - 0x18], eax
jne 0x4075b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407659
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407659
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x469e88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x469e8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x469e90], eax
call edi
push eax
call esi
mov dword [0x469e98], eax
test eax, eax
je 0x4075b1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x469e94], eax
mov eax, dword [0x469e94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40760a
cmp dword [0x469e98], ecx
je 0x40760a
push eax
call esi
push dword [0x469e98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40760a
test ebx, ebx
je 0x40760a
call edi
test eax, eax
je 0x407601
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407601
test byte [ebp - 8], 1
jne 0x40760a
or dword [ebp + 0x10], 0x200000
jmp 0x40763d
mov eax, dword [0x469e8c]
cmp eax, dword [ebp - 0x18]
je 0x40763d
push eax
call esi
test eax, eax
je 0x40763d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40763d
mov eax, dword [0x469e90]
cmp eax, dword [ebp - 0x18]
je 0x40763d
push eax
call esi
test eax, eax
je 0x40763d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x469e88]
call esi
test eax, eax
je 0x407659
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40765b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x462e60
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4682f0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1f3c038]
push edi
mov edi, dword [0x1f3c314]
push eax
call fcn.00462d70
add esp, 4
cmp dword [0x1f3c314], 0x2f
jne 0x462ebd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00462dc0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a468
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x41a477
pop dword [ebp - 0x40]
mov eax, 0x91f8a9c2
sub eax, 0x91b7054b
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x192d9965
sub dword [ebp - 0x50], 0xcadb541a
mov dword [ebp - 0x4c], 0xa9467e00
add dword [ebp - 0x4c], 0x88ecce45
mov dword [ebp - 0x48], 0x4548d5c9
sub dword [ebp - 0x48], 0xf8fc919b
mov dword [ebp - 0x44], 0xe1c451cd
sub dword [ebp - 0x44], 0xe1c451cd
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xa4f5c172
sub dword [ebp - 0x50], 0x3083581c
mov dword [ebp - 0x4c], 0xcff9c605
add dword [ebp - 0x4c], 0x71729b70
mov dword [ebp - 0x48], 0xd5bc0155
sub dword [ebp - 0x48], 0x724c94e9
mov dword [ebp - 0x44], 0xbdfae2a5
add dword [ebp - 0x44], 0x42051d5b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x44823
push 0
call eax
mov ecx, 0xa21354d
sub ecx, 0xa20ec34
mov edi, eax
mov esi, 0xffbbe769
add esi, 0x8a6697
add esi, dword [ebp - 0x40]
mov ebx, 0x2f662314
mov edx, dword [esi]
mov dword [ebp - 0x24], 0x3cb88557
xor edx, ebx
mov dword [ebp - 0x2c], 0x62fdebde
mov dword [edi], edx
xor dword [ebp - 0x14], 0xff3ab3de
add edi, 0x5194d8de
sub edi, 0x5194d8da
add esi, 4
loop 0x41a589
add eax, 0x9ae0a660
add eax, 0x652070d7
xor ebx, ebx
add ebx, eax
add eax, 0xa9aef15e
sub eax, 0xa9aef159
mov ecx, 0x55ba6402
sub ecx, 0x557a6402
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x407668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x407672
repz ret
jmp fcn.00407bfa

Function at 0x4081a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40d928
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x408266
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x408288
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063f0
cmp dword [ebp + 0xc], 0
je 0x4082a0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret

Function at 0x40a850
Capabilities:
Access peb ldr_data

Disassembly:
add ebp, 0x24
push esp
call fcn.004086ae
and esi, ebx
or al, 0x6c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40a872
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004086ae
xor al, 0x45
mov eax, 0x8bf88b8a
inc edi
cmp al, 0x8b
push esp
pop es
js 0x40a88c
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.004086ae
insb byte es:[edi], dx
out dx, al
wait
mov dword [0x8b348b49], eax
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40a89b
mov eax, 0x41636f72
invalid
Function at 0x402c64
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404dec
test esi, esi
jne 0x402c9a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404edc
jmp 0x402cb8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402b18
mov edi, eax
test esi, esi
je 0x402cb8
cmp dword [ebx], 0
je 0x402cb8
dec esi
jmp 0x402ca1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4036a0
Capabilities:
Clear file content

Disassembly:
movzx edx, word [eax + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x4036be
push dword [eax]
call sub.kernel32.dll_SetEndOfFile
dec eax
je 0x4036c8
jmp fcn.00402a38
mov eax, 0x67
jmp fcn.00402a28
ret

Function at 0x403d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4fc020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403dd8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403db8
xor eax, eax
push ebp
push 0x403db1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403df4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403db8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4fc020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4fc020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404bcc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50204c], 0
je 0x404c2d
cmp word [0x502220], 0xd7b2
jne 0x404bf5
cmp dword [0x502228], 0
jbe 0x404bf5
mov eax, 0x50221c
call dword [0x502238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4fc090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404c54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4fc030], 0
jne 0x404c49
push 0
push 0x4fc088
push 0x4fc090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404da0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004028a0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x50204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404d68
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40678c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4069bc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40680f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4069bc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40680f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4069d8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406898
xor eax, eax
push ebp
push 0x406891
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004065d4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406876
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4069f8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406876
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406898
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4069b2
cmp byte [ebp - 0xd], 0
jne 0x4068df
cmp byte [ebp - 0x12], 0
je 0x4069b2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4068f8
dec ebx
cmp byte [ebx], 0x2e
je 0x406907
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4068f7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4069b2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406944
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4069b2
cmp byte [ebp - 0xd], 0
je 0x4069b2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4069b2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret