joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056f4
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405cbf
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405720
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405866
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422ed0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422ed0
je 0x405764
push 1
push 0
push esi
call fcn.0040567d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40586c
cmp eax, edi
jg 0x40586c
mov esi, 0x422948
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40586c
cmp eax, edi
jg 0x40586c
push esi
push ebp
push str._s_s_r_n
push 0x422548
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.dll_lstrcatA
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405866
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40585f
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40585f
cmp edi, dword [esp + 0x18]
jne 0x40585f
push str._Rename__r_n
push esi
call fcn.00405611
test eax, eax
jne 0x405873
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004059ac
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x422548
push eax
call fcn.0040565d
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4247d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409308
push eax
call fcn.00405611
test eax, eax
je 0x40582a
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x40589c
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x40588f
sub eax, esi
jmp 0x40582c
Function at 0x4058a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405904
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4058f3
cmp dword [ebp + 0x14], 1
je 0x4058f5
cmp dword [ebp + 0x14], 2
je 0x4058f5
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4059ce
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x4059ef
mov ecx, dword [0x423f1c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x424778]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x4236e0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405bc2
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405bc2
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405bcf
inc ebx
cmp cl, 0xfc
jbe 0x405bb5
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
or ecx, edx
or eax, edx
inc ebx
mov dword [ebp - 0x14], ecx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0xc], eax
jne 0x405b60
and dword [ebp + 0xc], 0
and byte [edi], 0
push 4
pop esi
cmp dword [ebp - 0x10], esi
jne 0x405a83
mov dword [ebp + 0xc], str.MicrosoftInternet_ExplorerQuick_Launch
jmp 0x405afb
mov eax, dword [ebp - 0x18]
cmp eax, 0x2b
jne 0x405aa2
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058a0
jmp 0x405af6
cmp eax, 0x26
jne 0x405ad2
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058a0
cmp byte [edi], 0
jne 0x405b58
push str.C:Program_Files
push edi
call fcn.004059ac
jmp 0x405af6
cmp eax, 0x25
jne 0x405ae5
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405af6
cmp eax, 0x24
jne 0x405afb
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x405b58
cmp dword [0x4247c4], 0
jne 0x405b07
push 2
pop esi
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x424744]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405b3d
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.00405209
cmp dword [ebp - 8], 0
jne 0x405b44
jmp 0x405b40
and byte [edi], 0
test esi, esi
jne 0x405b07
cmp byte [edi], 0
je 0x405b58
cmp dword [ebp + 0xc], 0
je 0x405b58
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405be8
jmp 0x405ba6
cmp byte [ebp + 0xf], 0xfd
jne 0x405b94
cmp esi, 0x1b
jne 0x405b79
push dword [0x424744]
push edi
call fcn.0040590a
jmp 0x405b8a
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004059ac
add esi, 0xffffffeb
cmp esi, 6
jae 0x405ba6
jmp 0x405b58
cmp byte [ebp + 0xf], 0xff
jne 0x405ba6
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004059ce
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x4236e0
jmp 0x405bc2
jne 0x405bbf
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405bc2
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a1a
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405be4
push eax
push dword [ebp + 8]
call fcn.004059ac
leave
ret 8
Function at 0x405d1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232d4], 0
push esi
jne 0x405d53
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d2d
mov dword [ecx*4 + 0x4232d0], eax
inc ecx
cmp ecx, 0x100
jl 0x405d28
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d84
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232d0]
xor eax, esi
inc ecx
dec edx
jne 0x405d66
pop edi
not eax
pop esi
ret 0xc
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4197a0]
sub esp, 0x904
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x401036
cmp word [0x4197a2], bx
je 0x401027
call eax
mov dword [0x4197a0], eax
push eax
call fcn.00402187
push eax
call fcn.00408cdb
pop ecx
jmp 0x4010a4
push 0x27
call fcn.00402187
mov esi, dword [ebp + 8]
push dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push dword [esi]
push eax
lea eax, [ebp - 0x904]
push eax
call edi
add esp, 0x14
cmp dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
jbe 0x401098
lea ebx, [esi + 0x14]
push dword [ebx]
lea eax, [ebp - 0x104]
push str._t0x_p_n
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add ebx, 4
cmp eax, dword [esi + 0x10]
jb 0x401063
lea eax, [ebp - 0x904]
push eax
call fcn.00408cdb
pop ecx
call fcn.004044b0
push 0xa
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x401b75
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x401bb6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x401ba0
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401bb6
test al, 0x10
jne 0x401bb6
push esi
jmp 0x401b96
xor eax, eax
inc eax
pop esi
ret

Function at 0x401dc9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.DLL_FindResourceExA]
mov ebx, eax
movzx eax, word [0x4197b0]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x401e0d
push 0x409
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
je 0x401e33
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x401e1e
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [esi], eax
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x401e33
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
jmp 0x401ead
cmp dword [0x4197c0], 0
jne 0x401eab
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push str.SetProcessPreferredUILanguages
mov ebx, str.kernel32
push ebx
mov dword [0x4197c0], 1
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
push 0
mov dword [ebp - 4], eax
movzx eax, word [0x4197b0]
push 0x409
push 0
push eax
lea eax, [ebp - 0x44]
push str._04X_c_04X_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp dword [ebp - 4], 0
jne 0x401ea0
push str.SetThreadPreferredUILanguages
push ebx
call esi
push eax
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x401eab
push 0
lea eax, [ebp - 0x44]
push eax
push 4
call dword [ebp - 4]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8263ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf081935c
jmp 0x82640a
mov dword [esp], esp
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x826427
and edx, ebp
jp 0x826443
rdtsc
jmp 0x826445
pushfd
jmp 0x8262b6
rdtsc
call 0x82642d
mov dh, 0xaf
mov ebp, dword [esp + 0x30]
xchg edi, eax
mov ebx, edi
dec edx
jmp 0x826475
btr di, dx
jmp 0x82655a
jg 0x82648b
jle 0x82648b
in al, dx
cmc
pushfd
outsd dx, dword [esi]
rcr byte [esi], cl
xchg esi, eax
add al, 0x63
sahf
sbb dword [edi + reloc.kernel32.dll_InterlockedIncrement], eax
push edx
lea esi, [esp + 4]
ror di, cl
jl 0x826456
jge 0x8265ec
int 0x4d
frstor dword [edi + edx*2 + reloc.MSVCRT.dll___dllonexit]
sub esp, esi
add ebp, dword [edi - reloc.MSVCRT.dll___dllonexit]
invalid
inc ebx
invalid
invalid
mov bl, byte [esp + 3]
sub esp, 0xbc
mov edi, esp
pushal
lea edx, [eax + esi]
jmp 0x826513
btr di, dx
jmp 0x82655a

Function at 0x82a16e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jge 0x82a181
mov dword [esp + 0x10], esi
push edx
jmp 0x82a20f
mov byte [esp + 4], cl
mov dword [esp + 0x14], esp
mov dword [esp + 0x10], ebp
push ebx
pop word [esp]
jmp 0x82a154
mov dword [esp + 0x10], esi
push edx
call fcn.0082a1c0
push 0x324648d
mov byte [esp], ch
lea esp, [esp + 1]
Function at 0x82a299
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf081935c
jmp 0x82a24e
mov dword [esp + 0xc], edi
jmp 0x82a264
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x82a207
lea ecx, [ecx + 1]
call 0x82a1f1
lea esp, [esp + 3]
and al, 3
mov byte [esp], ch
lea esp, [esp + 1]
jmp 0x82a197
mov bp, word [esp]
rdtsc
clc
jmp 0x82a26e
lea esp, [esp + 0xc]
pushfd
jmp 0x8284c0
jne 0x82a28e
je 0x82a28e
mov bh, 0xe3
call 0x82a299
and byte [eax], al
add byte [eax], al
das
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0x56c04700
push esi
xor eax, eax
jbe 0x82a281
jge 0x82a275
je 0x82a211
int3
mov edi, dword [esp + 0x2c]
bts edx, esp
jns 0x82a272
js 0x82a2bd
lea ebp, [esp + 4]
bsf si, ax
jmp 0x82a2f8
lea ebx, [ebp*4]
rdtsc
sete al
jmp 0x82a2c1
mov bh, 0xe3
jmp 0x82a274
sub esp, 0xbc
jmp 0x82a2dc
sete al
jmp 0x82a2c1
mov esi, esp
mov dh, byte [esp]
not cx
sub esp, 0x1b
jo 0x82a31b
cpuid
lea esp, [esp + 3]
jmp 0x82a30b
je 0x82a2a7
lea ebx, [ebp*4]
rdtsc
jmp 0x82a2d7
cpuid
lea esp, [esp + 3]
mov edx, edi
neg eax
jmp 0x82a360
jmp 0x82a305
setb ch
mov ax, di
mov ax, word [esp]
setg ch
lea ebx, reloc.MSVCRT.dll___dllonexit
neg cl
jmp 0x82a380
mov ax, word [esp]
setg ch
lea ebx, reloc.MSVCRT.dll___dllonexit
jmp 0x82a330
ja 0x82a31d
setb ch
mov ax, di
jmp 0x82a346
push esi
jmp 0x82a38f
rol edi, 0
sub esp, 0x17
ja 0x82a36a
push esi
jmp 0x82a777
stc
pop dword [esp + 9]
mov ax, word [esp + 8]
lea esp, [esp + 3]
jmp 0x82a452
lea ebx, [edx*4]
mov cl, byte [esp]
jmp 0x82a3e4
lea eax, reloc.MSVCRT.dll___dllonexit
bsf ax, ax
jbe 0x82a3b9
lea ebx, [edx*4]
jmp 0x82a3fe
neg edi
lea ecx, [esi + edi]
shr cx, 3
ja 0x82a426
jbe 0x82a403
ficomp word [ecx - 0x37]
test al, 0x5b
out 0x30, al
mov edx, 0x5ba4f28
sbb ecx, dword [edx - 0x1e14dbf4]
mov cl, byte [esp]
jmp 0x82a3e4
mov eax, 0xfaca88c8
lea ecx, [edi*4]
call fcn.0082a601
jnp 0x82a406
retf 0x8dfa
add ax, si
dec edi
in eax, dx
jge 0x82a422
div dword [edx + 0x7c]
dec edi
salc
inc ecx
ret
mov eax, 0xfaca88c8
lea ecx, [edi*4]
call 0x82a438
push ebp
xchg dword [esp], ecx
pop ebx
jmp 0x82a4e1
lea esp, [esp + 0x14]
neg edi
mov ecx, edx
lea eax, reloc.MSVCRT.dll___dllonexit
mov bl, ah
jmp 0x82a3cf
xor edi, 0x62b7b4b6
call 0x82a4ad
movzx eax, byte [edi - 1]
lea ecx, [ecx*4]
lea esp, [esp + 3]
jmp 0x82a452
stc
pop dword [esp + 9]
mov ax, word [esp + 8]
jmp 0x82a63a

Function at 0x82a33c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
jmp 0x82a249
jo 0x82a240
lea esp, [esp + 2]
mov dword [esp + 0x10], ebx
jmp 0x82a1a4
lea esp, [esp + 2]
mov dword [esp + 0x10], ebx
push ebp
call fcn.0082a16e
push word [esp + 1]
jmp 0x82a1e5
Function at 0x94a394
Capabilities:
Access peb ldr_data

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x10], esi
jmp 0x94a4b8
pushal
mov dword [esp + 0x18], eax
push cx
call fcn.0094a426
cmp edi, dword [ecx + reloc.MSVCRT.dll___dllonexit]
sbb ebx, dword [edx + 0x2f9a6f08]
jg 0x94a490
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
mov al, 0x57
rol byte [esi + 0x21], 1
shl byte [esi - 0x35], 1
dec ebp
frstor dword [edi + edx*2 + reloc.MSVCRT.dll___dllonexit]
sub esp, esi
pop ecx
cmpsd dword [esi], dword es:[edi]
xor esp, dword [ebx - reloc.MSVCRT.dll___dllonexit]
xor al, 0xaa
int 0x3c
and dword [ecx - reloc.MSVCRT.dll___dllonexit], 0xffffff89
jl 0x94a4df
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
or al, 0x8d
and al, 0xc
mov eax, dword fs:[0x30]
push ecx
jmp 0x94a477
mov ebp, dword [edx + ebp*4 + 0x2a]
mov eax, 0xc8c02adf

Function at 0x94a426
Capabilities:
Parse pe header

Disassembly:
call fcn.0094a03d
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
push esi
jmp 0x94a403
push eax
jmp 0x94a038
lea esp, [esp + 4]
popal
lea ecx, [ecx + 0xc]
mov eax, dword [ecx]
pop ecx
jmp 0x94a3d5
mov esi, eax
lea esi, [esi + 8]
mov eax, dword [esi]
pop esi
jmp 0x94a3dd
mov dword [esp], ebp
lea esp, [esp + 2]
jmp 0x94a3f6
Function at 0x402f24
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41c008], 0x8088405
inc edx
mov dword [ebx + 0x41c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41c018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403518
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034f8
xor eax, eax
push ebp
push 0x4034f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403534
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x41c018]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41c018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403eb0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41e044], 0
je 0x403f11
cmp word [0x41e218], 0xd7b2
jne 0x403ed9
cmp dword [0x41e220], 0
jbe 0x403ed9
mov eax, 0x41e214
call dword [0x41e230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f38
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41c024], 0
jne 0x403f2d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4048b4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404ae4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404937
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404ae4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404937
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404b00
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4049c0
xor eax, eax
push ebp
push 0x4049b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004046f0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40499e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404b20
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40499e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4049c0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404ada
cmp byte [ebp - 0xd], 0
jne 0x404a07
cmp byte [ebp - 0x12], 0
je 0x404ada
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404a20
dec ebx
cmp byte [ebx], 0x2e
je 0x404a2f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404a1f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404ada
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404a6c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ada
cmp byte [ebp - 0xd], 0
je 0x404ada
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ada
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4049c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404ae4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404937
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404ae4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404937
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404b00
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4049c0
xor eax, eax
push ebp
push 0x4049b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004046f0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40499e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404b20
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40499e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4049c0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404ada
cmp byte [ebp - 0xd], 0
jne 0x404a07
cmp byte [ebp - 0x12], 0
je 0x404ada
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404a20
dec ebx
cmp byte [ebx], 0x2e
je 0x404a2f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404a1f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404ada
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404a6c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ada
cmp byte [ebp - 0xd], 0
je 0x404ada
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ada
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret