joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b880
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
push esi
mov esi, ecx
cmp dword [esi], 0x3f
jne 0x40b8e6
xor eax, eax
cmp dword [esi + 4], eax
jbe 0x40b8a0
mov cl, byte [esi + eax + 8]
mov byte [esi + eax + 0x20], cl
inc eax
cmp eax, dword [esi + 4]
jb 0x40b892
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x40b8c1
cmp eax, 0x20
jae 0x40b9e9
mov edx, dword [esi + 0x18]
mov dl, byte [ecx + edx]
mov byte [eax + esi + 0x20], dl
inc ecx
inc eax
cmp ecx, dword [esi + 0x1c]
jb 0x40b8a7
cmp eax, 0x20
jae 0x40b9e9
mov edx, 0x20
sub edx, eax
push edx
lea ecx, [eax + esi + 0x20]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
pop esi
add esp, 0x74
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
push ebx
push ebp
lea eax, [eax + ecx + 8]
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x40b90a
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, eax
mov edx, dword [esi + 4]
push edx
lea eax, [esi + 8]
push eax
push ebx
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push edx
add eax, ebx
push eax
call sub.MSVCRT.dll_memcpy
mov edi, dword [esi + 4]
add edi, ebx
add edi, dword [esi + 0x1c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [esi]
add esp, 0x18
mov eax, 1
xor edx, edx
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call fcn.00418700
mov ebp, eax
mov dword [esp + 0x18], edx
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push ecx
mov edx, ebx
lea ecx, [esp + 0x20]
call fcn.0040b3c0
xor eax, eax
inc byte [eax + edi]
jne 0x40b9bd
inc eax
cmp eax, 8
jb 0x40b9b2
mov eax, dword [esp + 0x18]
add ebp, 0xffffffff
adc eax, 0xffffffff
mov edx, ebp
or edx, eax
mov dword [esp + 0x18], eax
jne 0x40b9a0
lea edx, [esi + 0x20]
lea ecx, [esp + 0x1c]
call fcn.0040b670
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x74
ret
Function at 0x4104bb
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4104e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4104e1
xor al, al
jmp 0x4104f6
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x418110
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420b80], ecx
inc edx
cmp edx, 0x100
jb 0x418112
cmp edx, 0x800
jae 0x4181e9
lea esp, [esp]
mov eax, dword [edx*4 + 0x420780]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420b80]
inc edx
mov dword [edx*4 + 0x420b7c], eax
cmp edx, 0x800
jb 0x4181c0
mov eax, 0x4189f0
mov dword [0x420b74], eax
mov dword [0x422b80], eax
mov dword [0x420b70], 0x418910
call fcn.00418420
test eax, eax
jne 0x418215
mov dword [0x422b80], 0x418910
ret

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x97209cb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, str.j3E
mov ebx, 0x42cd70
nop
mov ecx, 0x332a04dd
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4011f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x178
mov dword [esp + 4], 1
mov dword [esp], str.Usage:_ascii_xfr__s_r___dvn____l_linedelay____c_character_delay__filename_n________s:__send_n________r:__receive_n________e:__send_the_End_Of_File_character__default_is_not_to__n________d:__set_End_Of_File_character_to_Control_D__instead_of_Control_Z__n________v:__verbose__statistics_on_stderr_output__n________n:__do_not_translate_CRLF______LF_n_______Delays_are_in_milliseconds._n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]

Function at 0x401320
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x14]
sub esp, 0x42c
mov ebx, esi
lea eax, [ebp - 0xc]
mov byte [ebx], 0
add ebx, 1
cmp ebx, eax
jne 0x401334
or dword [ebp - 0x14], 1
lea edi, [ebp - 0x41c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 1
call sub.cygwin1.dll_select
test eax, eax
jle 0x4013d2
mov dword [esp + 8], 0x400
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.cygwin1.dll_read
mov dword [esp + 4], edi
mov dword [esp], 2
mov dword [esp + 8], eax
call sub.cygwin1.dll_write
add eax, 1
je 0x4013d2
mov eax, esi
mov byte [eax], 0
add eax, 1
cmp ebx, eax
jne 0x4013b4
or dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
jmp 0x401356
add esp, 0x42c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], esi
mov esi, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edx
jne 0x402167
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40222c
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
je 0x402200
cmp eax, 4
je 0x402200
mov eax, dword [ebp - 0x20]
lea edi, [ebp - 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 0x30]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.cygwin1.dll_memcpy
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
je 0x40215a
cmp eax, 4
je 0x40215a
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x40215a
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.cygwin1.dll_memcpy
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
je 0x40215a
cmp eax, 4
lea edi, [ebp - 0x10]
jne 0x4021da
jmp 0x40215a
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401db0
lea esi, [esi]
lea edi, [edi]
Function at 0x4020d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409060
call sym._EnterCriticalSection_4
mov ebx, dword [0x409058]
sub esp, 4
test ebx, ebx
je 0x40211b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402114
test esi, esi
je 0x402114
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020f0
mov dword [esp], 0x409060
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402300
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402350
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402428
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40238e
cmp eax, 4
jne 0x4023b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40239e
cmp edx, 4
je 0x40239e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402300
Function at 0x402b64
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404818
test esi, esi
jne 0x402b9a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404908
jmp 0x402bb8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a78
mov edi, eax
test esi, esi
je 0x402bb8
cmp dword [ebx], 0
je 0x402bb8
dec esi
jmp 0x402ba1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4031ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4ba008], 0x8088405
inc edx
mov dword [ebx + 0x4ba008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4ba024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40386c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40384c
xor eax, eax
push ebp
push 0x403845
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403888
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40384c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4ba024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4ba024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404618
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c104c], 0
je 0x404679
cmp word [0x4c1220], 0xd7b2
jne 0x404641
cmp dword [0x4c1228], 0
jbe 0x404641
mov eax, 0x4c121c
call dword [0x4c1238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4ba094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4046a0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4ba034], 0
jne 0x404695
push 0
push 0x4ba08c
push 0x4ba094
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4047cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402830
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4c104d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404794
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4061c8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4063f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40624b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4063f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40624b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406414
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4062d4
xor eax, eax
push ebp
push 0x4062cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406010
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4062b2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406434
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4062b2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4063ee
cmp byte [ebp - 0xd], 0
jne 0x40631b
cmp byte [ebp - 0x12], 0
je 0x4063ee
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406334
dec ebx
cmp byte [ebx], 0x2e
je 0x406343
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406333
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4063ee
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406380
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4063ee
cmp byte [ebp - 0xd], 0
je 0x4063ee
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4063ee
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4062d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4063f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40624b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4063f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40624b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406414
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4062d4
xor eax, eax
push ebp
push 0x4062cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406010
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4062b2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406434
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4062b2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4063ee
cmp byte [ebp - 0xd], 0
jne 0x40631b
cmp byte [ebp - 0x12], 0
je 0x4063ee
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406334
dec ebx
cmp byte [ebx], 0x2e
je 0x406343
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406333
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4063ee
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406380
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4063ee
cmp byte [ebp - 0xd], 0
je 0x4063ee
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4063ee
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406adc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406b42
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404a88
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403398
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406b2c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b49
lea eax, [ebp - 0x10]
call fcn.00404818
ret

Function at 0x409794
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404cd8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4097ad
test al, 0x10
jne 0x4097b1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4098a0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404cd8
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x4098c2
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40cbd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cc11
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404908
jmp 0x40cc1a
mov eax, ebx
mov edx, esi
call fcn.0040486c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cc24
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40cc45
mov al, byte [esp]
jmp 0x40cc47
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret