joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439efb
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x45e4c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebx], 0
mov dword [ebp - 0x44], edx
mov dword [eax], 0
mov byte [edx], 0
mov edx, ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.00419eb0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x41a051
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [0x43c188]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x41a084
push dword [ebp - 0x28]
call fcn.00421a46
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x41a0a4
xor al, al
jmp 0x41a1f1
push 0xc
call fcn.00421a96
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 1
mov edi, dword [0x43c1a4]
test eax, eax
je 0x41a0de
mov dword [eax], str.D_pPh_
mov byte [ebp - 4], 2
mov dword [eax], 0x455a08
mov dword [eax + 4], edi
mov dword [eax + 8], esi
mov byte [ebp - 4], 1
jmp 0x41a0e0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 4
push 0
push 0
push 0
push 2
push 0
push esi
call dword [0x43c068]
mov esi, eax
test esi, esi
jne 0x41a10f
xor bl, bl
jmp 0x41a1e0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], edi
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
call fcn.0041bf70
mov byte [ebp - 4], 5
push 0
push 0
push 0
push 4
push esi
call dword [0x43c120]
mov edi, eax
test edi, edi
jne 0x41a141
xor bl, bl
jmp 0x41a1d4
mov eax, dword [0x43c11c]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], edi
call fcn.0041c000
mov byte [ebp - 4], 6
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41a18d
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
je 0x41a17b
mov dword [ebx], 1
jmp 0x41a1c6
movzx eax, word [esi + 4]
cmp eax, 0x14c
je 0x41a199
cmp eax, 0x8664
je 0x41a191
xor bl, bl
jmp 0x41a1c8
mov dword [ebx], 3
jmp 0x41a1bd
mov edx, edi
mov dword [ebx], 2
mov ecx, esi
call fcn.0041a210
test eax, eax
je 0x41a1bd
mov eax, dword [eax + 0x10]
test al, 1
je 0x41a1bd
test al, 2
jne 0x41a1bd
mov eax, dword [ebp - 0x44]
mov byte [eax], 1
mov ecx, dword [ebp - 0x34]
movzx eax, word [esi + 0x5c]
mov dword [ecx], eax
mov bl, 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
call fcn.004154a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x38]
call fcn.004154a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004154a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004210ea
mov esp, ebp
pop ebp
ret
Function at 0x41a210
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
test esi, esi
jne 0x41a225
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xec]
push edi
test eax, eax
je 0x41a289
mov edi, dword [esi + 0xe8]
test edi, edi
je 0x41a289
cmp eax, 0x48
jne 0x41a289
movzx eax, word [esi + 0x14]
lea edx, [esi + 0x18]
push ebx
movzx ebx, word [esi + 6]
add edx, eax
xor ecx, ecx
test ebx, ebx
je 0x41a26b
mov esi, dword [edx + 0xc]
cmp edi, esi
jb 0x41a263
mov eax, dword [edx + 0x10]
add eax, esi
cmp edi, eax
jb 0x41a26b
inc ecx
add edx, 0x28
cmp ecx, ebx
jb 0x41a253
cmp ebx, ecx
pop ebx
je 0x41a289
mov ecx, dword [edx + 0x14]
xor eax, eax
sub ecx, dword [edx + 0xc]
add ecx, edi
add ecx, dword [ebp - 4]
pop edi
pop esi
cmp dword [ecx], 0x48
cmove eax, ecx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401ba3
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, ecx
mov dword [ebp - 4], 0x80004005
cmp edi, eax
je 0x401bcc
cmp dword [edi], eax
je 0x401bcc
cmp dword [ebx], eax
mov dword [ebp + 8], eax
jg 0x403982
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 4

Function at 0x401e8b
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x27
push esi
push 0x401f80
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 8]
je 0x403001
and dword [eax], 0
movzx eax, word [esi]
push 2
pop ecx
cmp ax, 0x22
jne 0x402ff6
nop
nop
nop
nop
nop
nop
add esi, ecx
movzx eax, word [esi]
test ax, ax
je 0x401ee0
cmp ax, 0x22
jne 0x401ed0
cmp word [esi], 0x22
jne 0x401ee8
add esi, ecx
movzx eax, word [esi]
test ax, ax
je 0x401ef6
cmp ax, 0x20
jbe 0x401ee6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x401f4e
push esi
push edi
push ebx
call fcn.004020e3
test eax, eax
jl 0x401f4e
push 0x401f74
push edi
push ebx
call fcn.00401fd5
test eax, eax
jne 0x401f1e
push 0x401f68
push edi
push ebx
call fcn.00401fd5
test eax, eax
jne 0x401f1e
push 0x401f58
push edi
push ebx
call fcn.00401fd5
test eax, eax
jne 0x401f1e
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
cmp ax, 0x20
ja 0x40300f
jmp 0x401ee8
mov dword [eax], 1
add esi, 0x4e
jmp 0x401eba
add esi, ecx
cmp word [esi], 0x20
ja 0x40300f
jmp 0x401ee8

Function at 0x4023a5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4023d3
push eax
call fcn.004023dd
test eax, eax
je 0x4023d3
movzx eax, word [eax + 0x5c]
cmp ax, 2
jne 0x40395f
push 2
pop eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
ret
add byte [eax], al

Function at 0x4023dd
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push 0xc
push 0x402438
call fcn.00402454
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40242c
cmp ecx, 0xffffffff
je 0x40242c
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x402425
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x402425
cmp edx, 0x10000000
jae 0x402425
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x403955
mov dword [ebp - 4], 0xfffffffe
call fcn.0040238c
ret 4
invalid

Function at 0x402695
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
and dword [edi], eax
mov esi, ecx
cmp dword [esi + 8], eax
jne 0x4026b3
call fcn.004026cf
test eax, eax
jl 0x4026c4
mov ecx, dword [esi]
cmp ecx, 1
jne 0x403b3d
mov dword [edi], 0x40279c
pop edi
pop esi
pop ebp
ret 4
Function at 0x4026cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x210], ebx
cmp dword [esi + 0xc], ebx
je 0x403b2e
lea eax, [esi + 0x10]
push eax
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 8], ebx
jne 0x402772
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403b1e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x214], eax
cmp eax, ebx
je 0x403b0f
cmp word [eax], bx
je 0x403b0f
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpICW]
push 0x40279c
push eax
call edi
test eax, eax
jne 0x403a69
mov dword [esi], 1
mov dword [esi + 8], 1
pop edi
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.004016b1
leave
ret
rcr byte [edi + 0x5e], 0x5b
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403234
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
invalid
dec dword [ecx - 0x6737b]
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
Function at 0x4027bb
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
test byte [0x40c074], 1
push esi
push edi
mov esi, 0x40c1fc
jne 0x4027ec
or dword [0x40c074], 1
mov ecx, esi
call fcn.00401c03
push 0x40171b
call fcn.00402324
pop ecx
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.00402695
cmp eax, edi
mov dword [ebp - 0x20], eax
jl 0x40297d
test byte [0x40c074], 2
push ebx
mov ebx, 0x80000002
jne 0x40284f
or dword [0x40c074], 2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x10
push 0x402a24
push 0x402998
push ebx
mov dword [ebp - 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0x403b56
mov byte [0x40c045], 0
cmp byte [0x40c045], 0
jne 0x402986
cmp dword [ebp + 0x14], edi
mov dword [ebp + 0x14], edi
jne 0x402986
cmp byte [0x40c044], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x402ac8
jne 0x402893
lea eax, [ebp - 4]
push eax
push 1
push 0
push edi
push ebx
call esi
test eax, eax
je 0x402897
mov byte [0x40c044], 1
and dword [ebp - 4], 0
cmp byte [0x40c043], 0
jne 0x4028c1
cmp dword [ebp + 0x14], 0
jne 0x4028c1
lea eax, [ebp - 8]
push eax
push 1
push 0
push edi
push 0x80000001
call esi
test eax, eax
je 0x4028c5
mov byte [0x40c043], 1
and dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
mov edi, 0x402a50
push edi
push ebx
call esi
test eax, eax
jne 0x403b6c
cmp byte [0x40c042], 0
jne 0x402908
cmp dword [ebp + 0x14], 0
jne 0x402908
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push edi
push 0x80000001
call esi
test eax, eax
je 0x40290c
mov byte [0x40c042], 1
and dword [ebp - 0xc], 0
and dword [ebp + 0x14], 0
cmp dword [ebp - 4], 0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
jne 0x403b75
cmp dword [ebp - 8], 0
jne 0x403b8f
cmp dword [ebp - 0xc], 0
jne 0x403ba9
cmp dword [ebp - 0x10], 0
je 0x402955
lea eax, [ebp + 0x14]
push eax
push edi
push ebx
push dword [esi]
push dword [ebp - 0x10]
call fcn.00402b51
test al, al
jne 0x403bc1
cmp dword [0x40c1fc], 0xffffffff
je 0x403bc6
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0xc]
call esi
pop ebx
mov eax, dword [ebp - 0x20]
pop edi
pop esi
leave
ret 0x10
mov dword [ebp + 0x14], 1
jmp 0x402868
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
inc dword [eax]
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
call dword [edx]
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
cld
invalid
and dh, al
test dword [edx - 4], ecx
invalid
Function at 0x402e3f
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x402e58
call fcn.00402e5e
test al, al
je 0x407682
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x224]
push eax
call fcn.004074ae
test eax, eax
je 0x40778a
push esi
push edi
push 6
pop ecx
push ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x224]
mov esi, 0x4077a8
lea edi, [ebp - 0x1c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x407788
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0x407798
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.004072e1
add esp, 0x14
test eax, eax
jl 0x407788
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x480]
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x480], edi
xor eax, eax
lea edi, [ebp - 0x43c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x480]
push eax
push esi
push esi
push 0x8000020
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407788
push dword [ebp - 0x43c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x438]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004016b1
leave
ret

Function at 0x406d7c
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40c5e0]
test eax, eax
jne 0x406e39
push 0x11c
push eax
lea eax, [ebp - 0x328]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x406e2b
cmp dword [ebp - 0x318], 2
jne 0x406e21
cmp dword [ebp - 0x324], 6
jae 0x406e21
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x40c058]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x406e2b
push 0
push 8
lea eax, [ebp - 0x20c]
push eax
call fcn.004085fb
mov dword [0x40c5e0], eax
cmp eax, dword [0x40c058]
jne 0x406e2b
push eax
call fcn.0040844e
jmp 0x406e2b
mov eax, dword [0x40c058]
mov dword [0x40c5e0], eax
mov eax, dword [0x40c5e0]
test eax, eax
jne 0x406e39
mov eax, dword [0x40c058]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016b1
leave
ret
Function at 0x4074ae
Capabilities:
Accept command line arguments
Persist via active setup registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x2e
pop ecx
mov esi, 0x4075c8
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc8]
push eax
push 1
movsw word es:[edi], word [esi]
xor edi, edi
push edi
lea eax, [ebp - 0xc0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40759e
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push edi
push ebx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
push ebx
lea eax, [ebp - 0xc4]
push eax
push edi
push 0x4075b4
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407592
cmp dword [ebp - 0xc4], 1
je 0x407554
cmp dword [ebp - 0xc4], 2
jne 0x407592
mov eax, dword [ebp - 0xcc]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
lea eax, [ebp - 0xd0]
push eax
push ebx
mov dword [ebp - 0xd0], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, edi
je 0x407592
push dword [esi]
push dword [ebp + 0xc]
push ebx
call fcn.004020e3
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
inc edi
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004016b1
leave
ret 8

Function at 0x407ec1
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x40c5f8], edi
jne 0x407fdd
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x407f28
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x40c5f8], edi
pop esi
je 0x407fb0
dec eax
jne 0x407fdd
cmp dword [ebp - 0x11c], 5
jne 0x407f9d
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x407f91
dec eax
je 0x407f7e
dec eax
je 0x407f64
mov dword [0x40c5f8], 0x14
jmp 0x407fdd
cmp word [ebp - 0xc], 1
jb 0x407f75
mov dword [0x40c5f8], 0x10
or dword [0x40c5f8], 4
jmp 0x407fdd
cmp word [ebp - 0xc], 2
jb 0x407f75
mov dword [0x40c5f8], 8
jmp 0x407f75
mov dword [0x40c5f8], 4
jmp 0x407fdd
cmp dword [ebp - 0x11c], 4
ja 0x407fef
mov dword [0x40c5f8], 2
cmp dword [ebp - 0x11c], 4
jne 0x407fdd
cmp dword [ebp - 0x118], edi
je 0x407fd3
cmp dword [ebp - 0x118], 0xa
je 0x407fd3
cmp dword [ebp - 0x118], 0x5a
jne 0x407fdd
mov dword [0x40c5f8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x40c5f8]
xor ecx, ebp
pop edi
call fcn.004016b1
leave
ret
mov dword [0x40c5f8], 0x20
jmp 0x407fdd
Function at 0x408000
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x408054
push 3
lea eax, [ebp - 0x44]
push 0x408064
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.004016b1
leave
ret

Function at 0x40806f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x40c5fc]
jne 0x40810a
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x408200
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408109
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x4082b8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x408109
push 3
push dword [esi*8 + 0x408120]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x4080fb
inc esi
cmp esi, 0x1c
jae 0x408109
jmp 0x4080da
mov ax, word [esi*8 + 0x408124]
mov word [0x40c5fc], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x40c5fc]
xor ecx, ebp
call fcn.004016b1
leave
ret
Function at 0x4095e2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x40c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 4
call dword [sym.imp.iertutil.dll_Ordinal_74]
mov dword [ebp - 0x68], eax
test eax, eax
je 0x4096bf
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
lea eax, [ebp - 0x6c]
push eax
mov ebx, 0x20019
push ebx
push 0
mov edi, 0x409710
push edi
push 0x80000001
call esi
test eax, eax
je 0x409640
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0
push edi
push 0x80000002
call esi
test eax, eax
jne 0x4096be
xor esi, esi
xor ebx, ebx
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], 0x27
call sub.SHLWAPI.dll_SHEnumValueW
mov edi, eax
cmp edi, esi
jne 0x4096b0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_SHCLSIDFromString]
test eax, eax
jl 0x4096b0
lea eax, [ebp - 0x70]
push eax
push 0x409778
push esi
push 1
push esi
lea eax, [ebp - 0x64]
push eax
call sub.urlmon.dll_Ordinal_104
test eax, eax
jl 0x4096b0
push dword [ebp - 0x70]
push 0x7fffffff
push dword [ebp - 0x68]
call dword [sym.imp.iertutil.dll_Ordinal_85]
cmp eax, 0xffffffff
jne 0x4096b0
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc ebx
cmp edi, esi
je 0x409644
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esi, 0x40c09c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0x40c604], edi
jne 0x4096e0
mov eax, dword [ebp - 0x68]
mov dword [0x40c604], eax
mov dword [ebp - 0x68], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x68], edi
je 0x4096fb
push edi
push 0x4093f4
push dword [ebp - 0x68]
call dword [sym.imp.iertutil.dll_Ordinal_79]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004016b1
leave
ret
Function at 0x4017d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4018b0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4018b0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40181a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x401821
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x401800
jmp 0x401823
mov esi, 0x1505
jmp 0x401823
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x4018b0
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401854
inc edi
dec ebx
je 0x4018ae
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4018ae
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401850
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.00408750
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401850
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.00408770
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x401850
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4018b0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4018c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4019c1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4019c1
push ebx
call fcn.00408750
add esp, 4
test eax, eax
je 0x40191a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x401921
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x401900
jmp 0x401923
mov esi, 0x1505
jmp 0x401923
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x4019c1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x401954
inc ebp
dec ebx
je 0x4019bf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4019bf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401950
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00408750
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401950
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00408770
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401950
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4019bf
cmp dword [eax + 4], 2
mov edi, 0
jne 0x4019c1
mov edi, dword [eax + 8]
jmp 0x4019c1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret