joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402269
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x140
mov eax, dword [0x4410a8]
mov dword [ebp - 0x130], 0x22c
test eax, eax
jne 0x4022a5
mov dword [0x4410a8], sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
jmp 0x4022b4
xor esi, esi
mov dword [esp], 2
mov dword [esp + 4], esi
call eax
xor esi, esi
push ebx
push ebx
mov ebx, eax
cmp eax, 0xffffffff
je 0x402369
mov eax, dword [0x441108]
lea esi, [ebp - 0x130]
test eax, eax
jne 0x4022ea
mov dword [0x441108], sub.KERNEL32.dll_Process32First
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32First
jmp 0x4022f3
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
push ecx
push ecx
test eax, eax
jne 0x4022fd
xor esi, esi
jmp 0x40234c
mov eax, dword [0x44110c]
test eax, eax
jne 0x40231e
mov dword [0x44110c], sub.KERNEL32.dll_Process32Next
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
jmp 0x402327
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
push edx
push edx
test eax, eax
je 0x4022f9
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x4022fd
mov esi, dword [ebp - 0x128]
test ebx, ebx
je 0x402369
mov eax, dword [0x441070]
test eax, eax
jne 0x402363
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x441070], eax
mov dword [esp], ebx
call eax
push eax
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret

Function at 0x402bf0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00403960
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00403960
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x402c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x441230]
test esi, esi
jle 0x402d70
mov eax, dword [0x441234]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402c84
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x402d07
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402c70
mov dword [esp], ebx
call fcn.00403640
mov edi, eax
test eax, eax
je 0x402d97
mov eax, dword [0x441234]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00403780
mov edx, dword [0x441234]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402d77
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402d00
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x402d10
add dword [0x441230], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x441234]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402d00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402bf0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x402c8e
mov eax, dword [0x441234]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402bf0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402bf0
lea esi, [esi]
nop

Function at 0x4032b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44124c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x441244]
sub esp, 4
test ebx, ebx
je 0x403305
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4032fe
test esi, esi
je 0x4032fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4032e0
mov dword [esp], 0x44124c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403640
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x403665
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x403670
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x403665
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4036b8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4036ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4036ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4036a0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10002ef6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f2d
push 0x12
push 0x4013697
push 6
call fcn.1001690a
add esp, 0xc
jmp 0x10002f32
mov esp, ebp
pop ebp
ret 4

Function at 0x10004ea1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
test esi, esi
jne 0x10004ec6
xor eax, eax
jmp 0x10004ecb
mov eax, dword [esi + 4]
add eax, eax
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x184
call fcn.1001aa30
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10004f01
push ebx
call fcn.10016904
add esp, 4
pop eax
mov dword [ebp - 4], eax
test esi, esi
je 0x10004f0e
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10004f63
lea edx, [esi + 8]
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x42413938
mov dword [ebp - 8], 0x46454443
test edx, edx
je 0x10004f63
test eax, eax
je 0x10004f63
lea esi, [edx + ecx]
cmp edx, esi
jae 0x10004f63
nop
movzx ecx, byte [edx]
shr ecx, 4
inc edx
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax], cl
movzx ecx, byte [edx - 1]
and ecx, 0xf
lea eax, [eax + 2]
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax - 1], cl
cmp edx, esi
jb 0x10004f3f
pop esi
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x100061c3
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
lea eax, [ebp - 4]
push eax
push 0
xor eax, eax
call dword [sym.imp.iphlpapi.dll_GetNetworkParams]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1000621a
push 0
push 0x4013d20
push 6
call fcn.1001690a
add esp, 0xc
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1000624b
push 0x3c
push 0x4013d20
push 6
call fcn.1001690a
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.iphlpapi.dll_GetNetworkParams]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1000627e
push 0x79
push 0x4013d20
push 6
call fcn.1001690a
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10006307
push 0x80000301
push 0
push 0x84
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0x910
call fcn.1001a9e0
add esp, 0x1c
mov dword [ebp - 0x14], eax
push SysStringLen
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x100062c9
mov eax, 0x1003529d
push eax
push 1
mov ebx, 0x168
call fcn.1001aae0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x100062ef
push ebx
call fcn.10016904
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10006303
push ebx
call fcn.10016904
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10006333
push 0x123
push 0x4013d20
push 6
call fcn.1001690a
add esp, 0xc
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1000634f
push eax
mov ebx, eax
call fcn.10001000
inc eax
push eax
call fcn.100168f8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10006354
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10006365
push ebx
call fcn.10016904
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x10017380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1015bb18]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x108], ecx
lea eax, [ecx - 1]
cmp eax, 0xa
ja 0x100173ad
mov edx, dword [ecx*4 + 0x1015b8dc]
lea eax, [ebp - 0x108]
mov eax, dword [eax - 4]
test eax, eax
je 0x100173eb
push esi
mov esi, 0xc483
cmp si, word [eax]
pop esi
jne 0x100173eb
cmp byte [eax + 2], 0xc
jl 0x100173eb
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push edx
push ecx
push 0x1002d454
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x10017402
push edx
push ecx
lea eax, [ebp - 0x104]
push str.program_internal_error_number_is__d.__r_n_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x1015c400]
test eax, eax
je 0x1001743b
cmp dword [0x1015c414], 0
jne 0x1001743b
lea ecx, [ebp - 0x104]
mov dword [0x1015c414], 1
push ecx
push dword [ebp - 0x108]
call eax
mov dword [0x1015c414], 0
test eax, eax
jne 0x10017451
push 0x10
push str.error
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10016fe0
cmp dword [0x1015c3f8], 0
jne 0x10017467
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0
mov ebp, dword [0x1015c3fc]
mov esp, dword [0x1015c3f8]
sub esp, 4
ret
Function at 0x10017490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.1001b810
mov esi, dword [ebp + 0x18]
mov edi, eax
push esi
mov dword [ebp - 8], edi
xor ebx, ebx
call dword [0x1015bb10]
add esp, 8
test edi, edi
je 0x100175b9
test eax, eax
je 0x100175b9
inc eax
push eax
call fcn.1001c41f
mov edx, eax
mov dword [ebp - 0x10], eax
add esp, 4
sub edx, esi
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [edx + esi - 1], cl
test cl, cl
jne 0x100174d6
push 0x5c
push eax
call fcn.1001d740
mov edi, eax
add esp, 8
test edi, edi
je 0x100174f7
mov byte [edi], bl
inc edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100175aa
push 0x400
mov dword [ebp - 4], 0x400
mov dword [ebp - 8], 1
call fcn.1001c41f
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10017578
cmp eax, 0xea
jne 0x10017598
push esi
call fcn.1001c428
push dword [ebp - 4]
call fcn.1001c41f
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10017545
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x10017585
cmp eax, 2
jne 0x10017598
push esi
call dword [0x1015bb10]
push eax
push esi
call fcn.1001b7d0
add esp, 0xc
mov ebx, eax
push esi
call fcn.1001c428
add esp, 4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call fcn.1001c428
add esp, 4
test ebx, ebx
jne 0x100175de
cmp dword [ebp + 0x2c], 0
je 0x100175de
mov esi, dword [ebp + 0x24]
test esi, esi
je 0x100175de
push esi
call dword [0x1015bb10]
push eax
push esi
call fcn.1001b7d0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100175f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001765c
push esi
push edi
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 8]
push ecx
call fcn.100171f0
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
lea ecx, [edi + 8]
mov dword [edi], 1
push ecx
push ebx
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp ecx, 0xffffffff
je 0x100192ff
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, 1
mov dword [ebp - 8], 1
cmp ebx, esi
jle 0x100192ef
push edi
lea edi, [ebp + 0x18]
mov eax, dword [edi]
lea edx, [ebp - 0xc]
push 0
push edx
push dword [eax + 4]
add eax, 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
test eax, eax
je 0x100192e7
inc esi
add edi, 0xc
cmp esi, ebx
jl 0x100192b1
pop edi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
pop edi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001aed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, 1
lea eax, [ecx - 1]
cmp ecx, edi
jle 0x1001af9b
cmp eax, 8
jb 0x1001af88
and eax, 0x80000007
jns 0x1001af00
dec eax
or eax, 0xfffffff8
inc eax
mov edx, ecx
xorps xmm5, xmm5
sub edx, eax
xorps xmm4, xmm4
lea eax, [ebp + 0x30]
nop dword [eax]
movd xmm2, dword [eax + 0xc]
lea eax, [eax + 0x60]
movd xmm0, dword [eax - 0x60]
add edi, 8
movd xmm1, dword [eax - 0x6c]
movd xmm3, dword [eax - 0x78]
punpckldq xmm3, xmm0
movd xmm0, dword [eax - 0x30]
punpckldq xmm1, xmm2
movd xmm2, dword [eax - 0x24]
punpckldq xmm3, xmm1
movd xmm1, dword [eax - 0x3c]
pxor xmm5, xmm3
movd xmm3, dword [eax - 0x48]
punpckldq xmm3, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
pxor xmm4, xmm3
cmp edi, edx
jl 0x1001af10
pxor xmm4, xmm5
movaps xmm0, xmm4
psrldq xmm0, 8
pxor xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 4
pxor xmm4, xmm0
movd edx, xmm4
xor esi, edx
cmp edi, ecx
jge 0x1001af9b
lea eax, [edi + edi*2]
sub ecx, edi
lea eax, [ebp + eax*4 + 0xc]
xor esi, dword [eax]
lea eax, [eax + 0xc]
sub ecx, 1
jne 0x1001af91
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x402a00
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404400
test esi, esi
jne 0x402a36
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004044f0
jmp 0x402a54
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402914
mov edi, eax
test esi, esi
je 0x402a54
cmp dword [ebx], 0
je 0x402a54
dec esi
jmp 0x402a3d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f98
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x483008], 0x8088405
inc edx
mov dword [ebx + 0x483008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403504
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x483010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40359c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40357c
xor eax, eax
push ebp
push 0x403575
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40357c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x483010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x483010], ax
mov esp, ebp
pop ebp
ret

Function at 0x404284
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x486048], 0
je 0x4042e5
cmp word [0x48621c], 0xd7b2
jne 0x4042ad
cmp dword [0x486224], 0
jbe 0x4042ad
mov eax, 0x486218
call dword [0x486234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x483058
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40430c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x483020], 0
jne 0x404301
push 0
push 0x483078
push 0x483058
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x405d84
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fb4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405e07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fb4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405e07
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fd0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x405e90
xor eax, eax
push ebp
push 0x405e89
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405bcc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405e6e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ff0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405e6e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e90
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405faa
cmp byte [ebp - 0xd], 0
jne 0x405ed7
cmp byte [ebp - 0x12], 0
je 0x405faa
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ef0
dec ebx
cmp byte [ebx], 0x2e
je 0x405eff
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405eef
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405faa
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405f3c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405faa
cmp byte [ebp - 0xd], 0
je 0x405faa
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405faa
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409a20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x409a59
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044f0
jmp 0x409a62
mov eax, ebx
mov edx, esi
call fcn.00404454
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409a6c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x409a8d
mov al, byte [esp]
jmp 0x409a8f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ace4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40ad48
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404668
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00408890
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ad4f
lea eax, [ebp - 0xc]
call fcn.00404400
ret

Function at 0x41ceb4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x486a20
cmp dword [edi], 0
jne 0x41cf30
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x486a1c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4834c0
mov ecx, 2
call fcn.004028d4
mov edx, 0x41ce8c
lea eax, [esi + 5]
call fcn.0041ceac
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041ceac
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41cf05
mov dword [0x486a1c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41e40c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e412
ret