joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465f76
Capabilities:
Encode data using xor

Disassembly:
inc esi
or bh, byte [esi + 0x26eee264]
shl byte [ebx - 0x46d9f89b], 0x77
movsb byte es:[edi], byte [esi]
mov edi, 0x80eb4731
stosb byte es:[edi], al
div byte [esi]
dec ebx
sahf
or eax, 0xcea684d6
inc esp
adc byte [0x85f6d4b7], 0x3f
mov ebp, dword [esi - 0x59]
out dx, al
ja 0x465f84
push ss
ja 0x465fa7
fld qword [esi + 0x2849bff3]
mov eax, 0x96a0dadd
salc
xchg ebx, eax
je 0x465fb0
test al, 0x34
jmp word [edx - 0x7d]
adc dword [esi], 0x21
xchg edi, eax
invalid
xor bl, byte [eax + 0x48]
dec byte [ebx - 0x5d9f49fe]
or bl, byte [edx - 0x41]
cmpsd dword [esi], dword es:[edi]
xor bh, byte [edi]
add esi, ebx
inc esi
jae 0x465f40
mov edi, 0x13f32a7
fiadd word [esi + 0x73]
test dword [ebx], ebp
mov eax, dword [0x707d586b]
sub esp, dword [ecx + 0x707d586b]
sal byte ss:[esi + 0x7227023d], 1
push ebp
jne 0x466027
daa
and byte [ecx + 0x1f4dcb13], 0x9a
xlatb
arpl word [esi], dx
jb 0x46601f
sbb byte [ebx], dh
add al, byte [ebp + 0x74]
imul ebp, dword [ecx + 0x33e1f189], 0xfffffff8
jae 0x465fb2
sti
std
adc ecx, dword [ebp + 0x7d571312]
sub edx, dword [ebx - 0x67]
out 0xb2, al
lds esi, [esi + 0x6c]
insb byte es:[edi], dx
sub eax, 0x10e564c7
inc ebp
jo 0x466038
cdq
inc ebp
adc eax, 0x201900e1
fidiv dword [ebx + 0x52]
imul esi, edi, 0xffffffa4
push ecx
test byte [0xe5f38423], dl
jmp 0x466085
test bl, dh
in eax, 0xeb
dec eax
xor al, 0xc4
jge 0x466025
outsd dx, dword [esi]
push 0xffffffffffffff9c
into
aaa
popal
push esi
inc edx
dec esp
sbb dword [edx], esi
aaa
test al, 0x26
jb 0x46600c
retf 0x3c47

Function at 0x468b16
Capabilities:
Encode data using xor

Disassembly:
pop ecx
in al, dx
cmp dword [edx + 0x42442e29], esi
mul dword [ecx - 0x31]
stc
push ds
call 0x8cde3f5d
leave
insb byte es:[edi], dx
shr dword [esp + edx*8], 1
stosb byte es:[edi], al
fiadd dword [ebx]
popal
pop esp
lea ecx, [edx + 0x460b1fc6]
stosb byte es:[edi], al
outsb dx, byte [esi]
xchg esp, eax
sal ebx, 0xca
adc al, 0x68
lahf
cmp eax, 0xb885ea7
insb byte es:[edi], dx
invalid
cmp byte [esi + 0x45eda3d4], al
aam 0xa3
in eax, dx
inc ebp
mov byte [eax - 0x44], cl
dec ecx
xor bh, byte [ebp + edx*8 - 0x29]
pop esp
push cs
mov ah, 0x94
ja 0x468b14
dec byte [esi]
aad 0xc0
or edi, ecx
jl 0x468ac1
inc ebx
mov bl, 0x99
test eax, 0xbd761e61
jb 0x468b4a
das
outsb dx, byte [esi]
adc bl, byte [edx]
mov byte [esi - 0xc32270a], dh
add ebx, dword [eax]
mov byte [0xbae68cf6], al
out 0xba, al
inc ecx
shl dword [ecx], 9
sub eax, 0xefb80b0b
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
mov dl, 0xc8
push cs
lds edi, [edx + ebp*2 - 0x691f5062]
cld
invalid
Function at 0x4819b6
Capabilities:
Encode data using xor

Disassembly:
adc byte [edi + 0x7b8921a3], 0xa
cwde
cwde
cwde
lodsd eax, dword [esi]
inc esp
mov dword [0xfc1687b9], eax
sbb edx, dword [edx - 0x22]
clc
cli
fistp word [0x5e8eef0]
dec esp
inc edx
sar byte [esi + 0x55af63e], 0xd1
cmp cl, byte [edx]
jno 0x4819ae
adc esi, eax
inc eax
or ecx, esp
bound edx, qword [ebp - 0x7fe910d3]
mov dh, ch
push ebp
loopne 0x481a52
cmc
cdq
mov al, 0xbb
pop ds
int1
inc ebp
pop eax
xor byte [ecx], ch
dec edx
inc edx
popal
sbb cl, byte [ecx - 0x7abafe57]
mov esp, 0xe074e080
sub eax, 0x9a9e39a0
mov byte [0x5d1ef676], al
ret
invalid
Function at 0x5f5f95
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6003d0
cmp edx, dword [eax]
je 0x5f5fb7
add eax, 8
inc ecx
cmp eax, 0x600460
jl 0x5f5fa8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6003d0]
jne 0x5f60e5
mov eax, dword [0x604d5c]
cmp eax, 1
je 0x5f60bf
test eax, eax
jne 0x5f5fe8
cmp dword [0x6002fc], 1
je 0x5f60bf
cmp edx, 0xfc
je 0x5f60e5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5f601f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.005f6980
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005f6e10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x5f6062
lea eax, [ebp - 0x1a4]
push eax
call fcn.005f6e10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5fbe2c
push edi
call fcn.005f8ce0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.005f6980
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005f6990
lea eax, [ebp - 0xa0]
push 0x5fbe0c
push eax
call fcn.005f6990
push dword [esi + 0x6003d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.005f6990
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.005f8c54
add esp, 0x2c
pop edi
jmp 0x5f60e5
lea eax, [ebp + 8]
lea esi, [esi + 0x6003d4]
push 0
push eax
push dword [esi]
call fcn.005f6e10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x53d52f97
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x3f9472ef
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x8de1fc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de202
pop ebp
sub ebp, 6
sub ebp, 0x4de1fc
jmp 0x8de260
jmp 0x8de269
mov eax, 0x4de1fc
add eax, ebp
add eax, 0x93
mov ecx, 0x641
mov edx, 0xcca621df
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de280
jmp 0x8de293
mov ch, 0x9f
mov bh, 0xdf
iretd
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.00401bc8
jmp 0x406676

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403e59
pop dword [ebp - 0x18]
mov eax, 0x8dbca862
add eax, 0x728395f7
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x45858da
sub dword [ebp - 0x28], 0xb606138f
mov dword [ebp - 0x24], 0x470d6e4d
add dword [ebp - 0x24], 0xeb25ddf8
mov dword [ebp - 0x20], 0x5f5166dd
sub dword [ebp - 0x20], 0x130522af
mov dword [ebp - 0x1c], 0x22106b3c
add dword [ebp - 0x1c], 0xddef94c4
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xda799f50
add dword [ebp - 0x28], 0x99f8ca06
mov dword [ebp - 0x24], 0xe7a2eedf
add dword [ebp - 0x24], 0x59c97296
mov dword [ebp - 0x20], 0x4ce8f88c
sub dword [ebp - 0x20], 0xe9798c20
mov dword [ebp - 0x1c], 0x33cd7c07
add dword [ebp - 0x1c], 0xcc3283f9
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x33319
push 0
call eax
mov ecx, 0x39c9
mov esi, eax
mov edx, 0xd8eeba09
sub edx, 0xd8adaa09
add edx, dword [ebp - 0x18]
mov edi, 0x899355e4
sub edi, 0x59021db0
sub dword [ebp - 0xc], 0x3e17d057
mov ebx, dword [edx]
xor ebx, edi
xor dword [ebp - 4], 0xb2b659af
mov dword [esi], ebx
sub dword [ebp - 0x10], edi
add esi, 4
add edx, 0xd92c3c34
add edx, 0x26d3c3d0
loop 0x403f6b
add eax, 0xbf3a01f1
sub eax, 0xbf3927fa
mov ebx, eax
add eax, 5
mov ecx, 0xe19c623c
add ecx, 0x1ea39dc4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40343c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47600c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4034d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034b4
xor eax, eax
push ebp
push 0x4034ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4034f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47600c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47600c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041e0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47904c], 0
je 0x404241
cmp word [0x479220], 0xd7b2
jne 0x404209
cmp dword [0x479228], 0
jbe 0x404209
mov eax, 0x47921c
call dword [0x479238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x476054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404268
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47601c], 0
jne 0x40425d
push 0
push 0x476074
push 0x476054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404394
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402784
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x47904d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40435c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405d9c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fcc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405e1f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fcc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405e1f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fe8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405ea8
xor eax, eax
push ebp
push 0x405ea1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405be4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e86
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406008
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e86
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ea8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405fc2
cmp byte [ebp - 0xd], 0
jne 0x405eef
cmp byte [ebp - 0x12], 0
je 0x405fc2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405f08
dec ebx
cmp byte [ebx], 0x2e
je 0x405f17
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405f07
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405fc2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405f54
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405fc2
cmp byte [ebp - 0xd], 0
je 0x405fc2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405fc2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b6ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b725
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044d0
jmp 0x40b72e
mov eax, ebx
mov edx, esi
call fcn.00404434
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b738
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b759
mov al, byte [esp]
jmp 0x40b75b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bde0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bc58
mov eax, dword [0x4781f4]
cmp byte [eax], 0
je 0x40be4d
mov eax, dword [0x477ed8]
call fcn.00402d1c
call fcn.004028ec
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408dd4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40be94
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40be83
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x477e58]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x479718]
call fcn.00405ba8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40cc00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cc64
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404648
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408934
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc6b
lea eax, [ebp - 0xc]
call fcn.004043e0
ret

Function at 0x425154
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00424fac
dec esi
jne 0x425176
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x4262a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x479a80
cmp dword [edi], 0
jne 0x42631c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x479a7c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x476604
mov ecx, 2
call fcn.00402980
mov edx, 0x426278
lea eax, [esi + 5]
call fcn.00426298
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00426298
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4262f1
mov dword [0x479a7c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x427808
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42780e
ret

Function at 0x429d4c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x429d9d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x429d84
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x429d74
jmp 0x429d9d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x429d85
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436618
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404880
xor eax, eax
push ebp
push 0x436746
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x436719
xor eax, eax
push ebp
push 0x436712
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404698
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4366e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4366d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404698
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404890
mov edx, ebx
pop ecx
call fcn.00402980
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4366dd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x477d98]
mov dl, 1
mov eax, dword [0x4078b4]
call fcn.0040bf54
call fcn.00403da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43674d
lea eax, [ebp - 4]
call fcn.004043e0
ret