joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14bf0c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov word [esp + 4], bx
mov bh, byte [esp + 2]
jmp 0x14bf104
not bl
cld
push word [esp + 7]
xchg word [esp + 4], di
mov cx, 0x1b4b
add esp, 1
jmp 0x14bf15f
mov edx, 0xdc01ab97
mov edi, ecx
not bx
xchg byte [esp + 3], dl
lea esp, [esp + 4]
inc ax
jmp 0x14bf222
bsf eax, esi
pop edx
xchg dword [esp], edx
mov dword [esp], edi
lea edi, [esp + edi]
neg ah
jmp 0x14bf13f
shr bl, 6
push bp
mov word [esp], dx
stc
pop cx
neg ch
jmp 0x14bf1ce
mov eax, 0xc4bdb755
stc
mov edi, ebp
mov edi, dword [esp]
lea esp, [esp]
mov ah, 0xd8
jmp 0x14bf170
neg ebx
lea esp, [esp]
bsr edx, esp
shr ax, cl
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
mov ax, word [esp]
jmp 0x14bf186
rdtsc
bsr dx, ax
clc
mov bl, 0xc3
bsr bp, di
lea esi, [edx + edi]
jmp 0x14bf1f7
lea eax, [eax + 0x74]
bsf dx, cx
bswap esi
xchg bh, dl
xchg edi, eax
mov si, 0x2891
jmp 0x14bf1b8
rdtsc
shl ecx, 0x1b
mov ch, 0xad
setnp bh
mov ax, di
sbb dh, cl
jmp 0x14bf2a4
mov ebx, dword [esp]
mov esi, dword [esp]
cpuid
lea edx, [edi*4]
xchg byte [esp], ch
add esp, 0
jmp 0x14bf1e1
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
mov bp, 0x8e0e
mov si, word [esp]
mov cl, al
mov dl, dh
lea esi, [ebx + esi]
jmp 0x14bf1a1
cpuid
mov bx, bp
not di
xchg edi, eax
clc
cld
jmp 0x14bf283
add esp, 0
bsf bp, si
xchg byte [esp], al
mov edi, 0x645e0a56
mov dl, 1
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x14bf23c
lea esi, [ebx*4]
bswap edx
sub edx, 0x663bba11
jmp 0x14bf2b6
cld
xchg ch, dh
mov bx, 0x6b4a
sub bh, dl
not esi
mov byte [esp], ch
jmp 0x14bf26d
rdtsc
stc
mov eax, dword [esp]
mov ebx, edx
sub edx, 0xd8f9c0c1
xchg bp, ax
jmp 0x14bf253
mov edx, 0xb1e92cbb
lea esp, [esp]
cld
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
xchg esi, ebp
bsf eax, esp
jmp 0x14bf389
and al, bl
mov eax, edi
rdtsc
rdtsc
add esp, 0
mov byte [esp], al
jmp 0x14bf34b
mov cl, byte [esp]
bsf di, si
cpuid
add esp, 0
sete ch
bsf dx, bx
jmp 0x14bf2f5
pushal
btc esi, ecx
lea ebp, [ebp*4]
mov word [esp + 6], ax
pop word [esp + 6]
xchg ah, al
call fcn.014bf35e
aas
push es
mov cl, 0xb0
mov bl, 0x66
not esi
not si
xchg byte [esp], bl
lea esp, [esp]
setns al
mov ebx, esp
mov ch, byte [esp]
jmp 0x14bf32a
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
cmp al, dh
not cx
bswap edi
xchg ebx, ebp
mov byte [esp], dl
jmp 0x14bf315
Function at 0x64eb38
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x64eb7f
cmp edx, 0x10
jl 0x64eb6b
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x64eb58
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x64eb7f
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x64eb77
and edx, 3
cmp edx, 3
jne 0x64eb93
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x64eb98
cmp edx, 2
jne 0x64eba4
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x64eba9
cmp edx, 1
jne 0x64ebaf
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x722a2833
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1e1531d4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x402d8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40600c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e24
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e04
xor eax, eax
push ebp
push 0x402dfd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e40
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e04
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40600c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40600c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403514
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x407034], 0
je 0x403575
cmp word [0x407208], 0xd7b2
jne 0x40353d
cmp dword [0x407210], 0
jbe 0x40353d
mov eax, 0x407204
call dword [0x407220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x406054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40359c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x406018], 0
jne 0x403591
push 0
push 0x40604c
push 0x406054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403828
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40388e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403718
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c80
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403878
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403895
lea eax, [ebp - 0x10]
call fcn.00403698
ret
Function at 0x404cb0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x409890], 0
jne 0x404f13
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
shl ecx, 2
mov edx, ebx
shr edx, cl
and edx, 0xf
mov dl, byte [edx + 0x4060b0]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + 0x4067b0], dl
mov ecx, 8
sub ecx, eax
mov byte [ecx + 0x4067cb], dl
mov byte [ecx + 0x4067df], dl
inc eax
cmp eax, 8
jne 0x404cca
push 0x4067cc
push 0x404f18
call sub.user32.dll_FindWindowA
mov dword [0x409884], eax
push 0x4067e0
push 0x404f18
call sub.user32.dll_FindWindowA
mov dword [0x409888], eax
push 0x4067b0
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x40988c], eax
mov eax, dword [0x409884]
or eax, dword [0x409888]
or eax, dword [0x40988c]
jne 0x404e46
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x407650]
push eax
push 0
mov edx, 0x4067cc
mov eax, 0x404f18
mov ecx, 0x80000000
call fcn.00403c40
mov dword [0x409884], eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x407650]
push eax
push 0
mov edx, 0x4067e0
mov eax, 0x404f18
mov ecx, 0x80000000
call fcn.00403c40
mov dword [0x409888], eax
cmp dword [0x409884], 0
je 0x404dc9
push 0x409878
push 0xffffffffffffffeb
mov eax, dword [0x409884]
push eax
call sub.user32.dll_SetWindowLongA
cmp dword [0x409888], 0
je 0x404de4
push 0x409878
push 0xffffffffffffffeb
mov eax, dword [0x409888]
push eax
call sub.user32.dll_SetWindowLongA
push 0x4067b0
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x40988c], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x40988c]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x409878
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x409878], 0x404348
mov dword [0x40987c], 0x404644
mov dword [0x409880], 0x4047e0
mov byte [0x409891], 1
jmp 0x404ef8
cmp dword [0x40988c], 0
je 0x404e86
push 0
push 0
push 0
push 4
mov eax, dword [0x40988c]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [0x409878], ecx
mov ecx, dword [edx + 4]
mov dword [0x40987c], ecx
mov ecx, dword [edx + 8]
mov dword [0x409880], ecx
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x404edf
cmp dword [0x409884], 0
je 0x404eb8
push 0xffffffffffffffeb
mov eax, dword [0x409884]
push eax
call sub.user32.dll_GetWindowLongA
mov edx, dword [eax]
mov dword [0x409878], edx
mov edx, dword [eax + 4]
mov dword [0x40987c], edx
mov edx, dword [eax + 8]
mov dword [0x409880], edx
jmp 0x404edf
push 0xffffffffffffffeb
mov eax, dword [0x409888]
push eax
call sub.user32.dll_GetWindowLongA
mov edx, dword [eax]
mov dword [0x409878], edx
mov edx, dword [eax + 4]
mov dword [0x40987c], edx
mov edx, dword [eax + 8]
mov dword [0x409880], edx
mov eax, dword [0x40988c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [0x40988c], eax
mov byte [0x409891], 0
mov eax, 0x40986c
call fcn.00402af4
mov eax, 0x409878
call fcn.00402b10
mov byte [0x409890], 1
pop ebx
pop ebp
ret
Function at 0x4029fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x46f008], 0x8088405
inc edx
mov dword [ebx + 0x46f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402e24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ebc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e9c
xor eax, eax
push ebp
push 0x402e95
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ed8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e9c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46f024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46f024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x478044], 0
je 0x403b91
cmp word [0x478218], 0xd7b2
jne 0x403b59
cmp dword [0x478220], 0
jbe 0x403b59
mov eax, 0x478214
call dword [0x478230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46f070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403bb8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46f034], 0
jne 0x403bad
push 0
push 0x46f068
push 0x46f070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404fe8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405218
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40506b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405218
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40506b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405234
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4050f4
xor eax, eax
push ebp
push 0x4050ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404e30
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4050d2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405254
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4050d2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050f4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40520e
cmp byte [ebp - 0xd], 0
jne 0x40513b
cmp byte [ebp - 0x12], 0
je 0x40520e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405154
dec ebx
cmp byte [ebx], 0x2e
je 0x405163
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405153
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40520e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4051a0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40520e
cmp byte [ebp - 0xd], 0
je 0x40520e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40520e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4050f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405218
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40506b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405218
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40506b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405234
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4050f4
xor eax, eax
push ebp
push 0x4050ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404e30
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4050d2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405254
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4050d2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050f4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40520e
cmp byte [ebp - 0xd], 0
jne 0x40513b
cmp byte [ebp - 0x12], 0
je 0x40520e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405154
dec ebx
cmp byte [ebx], 0x2e
je 0x405163
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405153
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40520e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4051a0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40520e
cmp byte [ebp - 0xd], 0
je 0x40520e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40520e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4058b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405916
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403f1c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a18
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405900
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40591d
lea eax, [ebp - 0x10]
call fcn.00403cac
ret

Function at 0x4075ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040416c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407605
test al, 0x10
jne 0x407609
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409eec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409f25
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d9c
jmp 0x409f2e
mov eax, ebx
mov edx, esi
call fcn.00403d00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409f38
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409f59
mov al, byte [esp]
jmp 0x409f5b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a5e0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a458
mov eax, dword [0x477ab8]
cmp byte [eax], 0
je 0x40a65c
mov eax, dword [0x47790c]
call fcn.00402908
call fcn.00402744
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407764
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a6a4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a692
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4778b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x478660]
call fcn.00404df4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b340
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b3a4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403f1c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040726c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b3ab
lea eax, [ebp - 0xc]
call fcn.00403cac
ret
Function at 0x413e28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, eax
lea eax, [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebx + 4]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_ScreenToClient
mov eax, 1
call fcn.00413e14
mov byte [ebx + 0x12c], al
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], eax
lea edx, [ebx + 4]
mov eax, ebx
call fcn.0041419c
mov esi, eax
mov dword [ebx + 0x14], esi
mov edi, dword [ebx + 0x10]
cmp esi, edi
je 0x413e90
test edi, edi
je 0x413e82
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x18]
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x413e90
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
cmp byte [ebx + 0x12c], 0
je 0x413ee0
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x413eb1
cmp byte [esi + 0x2a], 0
jne 0x413eb1
mov byte [esi + 0x2a], 1
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x413f03
lea ecx, [esp + 0x100]
mov edx, dword [ebx + 8]
sub edx, dword [ebx + 0x20]
mov eax, dword [ebx + 4]
sub eax, dword [ebx + 0x1c]
call fcn.00405c34
lea edx, [esp + 0x100]
mov eax, esi
call fcn.00413cac
jmp 0x413f03
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x413ef8
cmp byte [esi + 0x2a], 0
je 0x413ef8
mov byte [esi + 0x2a], 0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
cmp dword [ebx + 0x18], 0
je 0x413f03
xor eax, eax
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x413f11
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x413f59
cmp byte [ebx + 0x12c], 0
je 0x413f59
lea edx, [ebx + 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
jne 0x413f59
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x413f56
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 4]
sub edx, dword [eax + 0x14]
mov dword [ebx + 0x1c], edx
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 8]
sub edx, dword [eax + 0x10]
mov dword [ebx + 0x20], edx
jmp 0x413f59
cmp eax, dword [ebx + 0x14]
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x413fa9
cmp byte [eax + 0x2a], 0
jne 0x413fa9
lea esi, [ebx + 0x2c]
mov edi, esp
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x2c]
push eax
call sub.user32.dll_GetKeyboardState
xor esi, esi
mov eax, esp
test byte [eax], 0x80
jne 0x413f9f
test byte [ebx + esi + 0x2c], 0x80
je 0x413f9f
mov edx, esi
mov eax, dword [ebx + 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x20]
jmp 0x413fa9
inc esi
inc eax
cmp esi, 0x100
jne 0x413f87
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x416a48
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
pushal
mov eax, dword [ebp + 0xc]
mov edx, eax
add edx, 0x5c
push edx
mov edx, dword [ebp + 8]
push edx
add eax, dword [ebp + 0x10]
mov ecx, eax
call dword [0x46f538]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret 0xc