joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x160]
mov bh, 0x60
add dword [eax], eax
add byte [ebx - 0xbba76fa], cl
je 0x402ad2
push dword [ebp + 8]
call fcn.00402b4d
mov ecx, edi
call fcn.004021ae
push dword [ebp + 8]
and dword [edi + 0x474], 0
cmpsd dword [esi], dword es:[edi]
je 0x402ae4
add byte [eax], al
add byte [ebx + 0xfca7], al
cld
add byte [eax], al
add byte [eax], al

Function at 0x402add
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmpsd dword [esi], dword es:[edi]
je 0x402ae4
add byte [eax], al
add byte [ebx + 0xfca7], al
cld
add byte [eax], al
cmpsd dword [esi], dword es:[edi]

Function at 0x405798
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea ecx, [ebp - 0x1c]
push ebx
push esi
push edi
call fcn.0040d7f7
xor edx, edx
inc edx
Function at 0x4077b0
Capabilities:
Authenticate hmac
Encode data using base64
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
mov ebx, dword [ecx]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
mov edi, dword [edi]
mov edx, dword [eax]
mov dword [ebp - 0x118], ecx
xor ecx, ecx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 8], edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 4], edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x40], ecx
test ebx, 0x800
je 0x40875e
mov dword [ebp - 0x24], 1
test ebx, 0x200
jne 0x408766
xor eax, eax
mov dword [ebp - 0xa0], eax
xor eax, 1
mov dword [ebp - 0xe4], eax
movsx eax, bl
and eax, 1
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x68], 0xfffffffe
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x24], ecx
jmp 0x40783f
mov eax, 1
jmp 0x40784d

Function at 0x408922
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, word [ecx]
push ebx
movzx eax, byte [eax + 0x49e560]
push esi
push edi
mov edi, edx
Function at 0x40cc24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0x2000
mov edi, ecx
call fcn.0041f4ea
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.004047b7
mov esi, dword [ebp + 8]
cmp word [esi], 0x23
je 0x40cc60
push 3
pop ebx
lea ecx, [ebp - 8]
call fcn.004047e2
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
push 0xf
push 0x49dcc8
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x40cda9
push 0xb
push 0x49dce8
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x472e61
push 0xd
push 0x49dd00
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x472e6b
push 0x16
push 0x49dd1c
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x472e76
push 0xd
push 0x49dd4c
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x472ef9
push 8
push 0x49dcb4
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x472f3b
push 0xf
push 0x49dd68
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x40cd1c
push 3
push 0x49dd88
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
jne 0x40cda9
xor ebx, ebx
inc ebx
mov dword [ebp + 8], ebx
push ecx
mov ecx, dword [ebp + 0x14]
push esi
call fcn.0040b337
test al, al
je 0x472fa8
mov eax, dword [ebp + 0x10]
push esi
inc dword [eax]
call fcn.0040cb5a
push esi
call fcn.0041c258
push 0xf
push 0x49dd68
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x40cdb1
push 3
push 0x49dd88
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x40cdb1
push 0xd
push 0x49dd90
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
je 0x40cd95
push 3
push 0x49ddac
push esi
call fcn.0042185b
add esp, 0xc
test eax, eax
jne 0x40cd22
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
test eax, eax
jle 0x40cc4f
jmp 0x40cd22
xor ebx, ebx
inc ebx
jmp 0x40cc4f
inc dword [ebp + 8]
jmp 0x40cd22
invalid
push esi
call fcn.0041f5a2
pop ecx
mov eax, esi
jmp 0xc0cc503b
and dword [ebp + 0x1c478bc0], eax
mov eax, dword [edi + 0x1c]
jmp 0x472e80
mov al, 0x30
sbb al, 0xc0
rcr dword [ecx], 1
movsd dword es:[edi], dword [esi]
cli
inc dword [eax - 1]
je 0x472e98
inc esi
cmp esi, dword [edi + 0x20]
jb 0x472e79
jmp 0xc0cc4a0c
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + esi*4]
inc dword [eax]
jmp 0xc0cc4a2f
ret 0xb74
stc
jne 0x472f71
idiv byte [ecx]
ja 0x472f62
jbe 0xc0cccded
mov eax, dword [edi + 0x1c]
std
call [ecx + 0x24]
add dh, byte [ebx]
xor al, 0xb0
call fcn.0041d3a2
inc eax
push dword [ebx + ecx + 0x46]
cmp esi, dword [edi + 0x20]
jb 0x472f48
jmp 0xc0cccded
sbb byte [edi], cl
mov ds, word [ebx]
popfd
stc
jmp [edx + 4]
inc esi
adc bh, bh
xor byte [ebp + 0x489d845], cl
push eax
push 0xcf0c5051
call 0x6b4049e4
call dword [eax + 0x70]
salc
dec eax
add byte [edi + ecx*8], cl
call 0xca40c877
xor byte [eax + ebp*8], bl
mov bl, al
call 0xca40cb7b
Function at 0x4283f5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
xor edx, edx
add eax, ecx
push edi
mov ebx, ebx
je 0x428431
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x428429
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x428433
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x428419
xor eax, eax
pop edi
pop esi
sub dword [ebp - 0x3d], ebx
int3
Function at 0x470a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [ebx]
mov esi, ecx
add esi, 4
movzx ebx, word [esi - 2]
movzx eax, word [esi]
push edi
mov edi, edx
cld
sal byte [eax + ebx*2 + 0x6a], 0x5d
pop edx
cmp ax, 0x5c
jne 0x470a4a
cmp word [esi + 2], dx
jne 0x470a4a
add esi, 2
jmp 0x470a83
cmp ax, dx
je 0x470a8e
cmp ax, bx
jne 0x470a5a
cmp word [esi + 2], dx
je 0x470a94
cmp ax, 0x5b
jne 0x470a83
movzx eax, word [esi + 2]
cmp eax, 0x3a
je 0x470a73
cmp eax, 0x2e
je 0x470a73
cmp eax, 0x3d
popfd
adc byte [ecx], cl
xlatb
or edi, edx
call 0xffeb917b
pushfd
push ss
dec esp
add byte [ebp + 0xe], dh
push 0x5d
pop edx
add esi, 2
movzx eax, word [esi]
cld
sal byte [ebp - 0x55], 0xf6
push esi
not byte [esi + 0xf]
jge 0x470a8b
invalid
pcmpeqw mm1, qword [ecx + ecx*4 + 0x37]
jne 0x470ae2
mov dword [edi], esi
inc eax
jmp 0x470a90
dec esi
cmp al, 0xb8
add byte [eax], ah
add eax, dword [eax]
lea edi, [ecx + ecx]
cmp edi, eax
jle 0x470aef
mov edi, eax
cmp ecx, eax
jge 0x470b4e
mov eax, edi
sub eax, ecx
cmp eax, 0x64
jl 0x470b4e
lea eax, [edi + edi]
push dword [ebx]
je 0x470adf
mov ebp, 0xfffa004b
inc dword [eax]
xor esi, dword [ebp + 4]
push 0x15
jmp 0x470b50
push 0x48
pop eax
invalid
Function at 0x1000103a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x40
push 0x3000
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_VirtualAllocExNuma
mov esi, eax
test esi, esi
je 0x10001065
and dword [0x1000e07c], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10001fe0
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret

Function at 0x100010ed
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
mov cl, byte [eax]
mov dl, byte [eax + 1]
jle 0x100011a3
push ebx
push esi
push edi
movzx esi, cl
movzx ebx, dl
lea eax, [esi + 1]
cdq
push 0x61
pop ecx
idiv ecx
mov edi, dword [0x1000f048]
push 0x61
movzx esi, dl
lea ecx, [esi + edi]
movzx eax, byte [ecx]
add eax, ebx
mov byte [ebp - 2], dl
cdq
pop ebx
idiv ebx
movzx ebx, dl
lea eax, [ebx + edi]
mov byte [ebp - 3], dl
call fcn.1000102f
mov ecx, dword [0x1000f048]
movzx eax, byte [ebx + ecx]
movzx ecx, byte [esi + ecx]
add eax, ecx
push 0x61
pop ecx
cdq
idiv ecx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
mov byte [ebp - 1], dl
call edi
push 0
push 0
call edi
mov edi, dword [ebp - 8]
movzx ecx, byte [ebp - 1]
mov edx, dword [0x1000f048]
mov cl, byte [ecx + edx]
mov eax, edi
sub eax, dword [0x1000e07c]
add eax, dword [ebp + 8]
xor byte [eax], cl
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp + 0xc]
jl 0x10001111
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 2]
mov dl, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov byte [eax], cl
mov byte [eax + 1], dl
leave
ret
Function at 0x10001422
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
and dword [ebp - 8], 0
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
movzx ecx, word [eax + 0x14]
push ebx
xor edx, edx
push esi
push edi
lea ecx, [ecx + eax + 0x18]
cmp dx, word [eax + 6]
jae 0x100014f1
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ecx + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x10001493
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x100014d9
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call ebx
test eax, eax
je 0x100014fb
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.1000131b
jmp 0x100014d6
mov ecx, dword [esi + 4]
add ecx, eax
push ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
call fcn.10001404
test eax, eax
je 0x100014fb
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [esi]
push eax
call ebx
test eax, eax
je 0x100014fb
mov eax, dword [esi + 4]
push dword [esi]
mov edi, dword [esi - 4]
add eax, dword [ebp + 8]
add edi, dword [ebp - 4]
push eax
push edi
call fcn.1000133a
mov dword [esi - 8], edi
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add esi, 0x28
cmp dword [ebp - 8], eax
jl 0x1000145a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x100014f4
Function at 0x10001d25
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000e0b8]
jne 0x10001d2f
repz ret
jmp fcn.100028b8

Function at 0x10006fec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000e0b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000442a
and dword [ebp - 0x14], 0
cmp dword [0x1000fd3c], 0
mov dword [ebp - 0x18], eax
jne 0x1000709f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10007147
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10007147
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000fd3c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000fd40], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000fd44], eax
call edi
push eax
call esi
mov dword [0x1000fd4c], eax
test eax, eax
je 0x1000709f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000fd48], eax
mov eax, dword [0x1000fd48]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100070f8
cmp dword [0x1000fd4c], ecx
je 0x100070f8
push eax
call esi
push dword [0x1000fd4c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100070f8
test ebx, ebx
je 0x100070f8
call edi
test eax, eax
je 0x100070ef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100070ef
test byte [ebp - 8], 1
jne 0x100070f8
or dword [ebp + 0x10], 0x200000
jmp 0x1000712b
mov eax, dword [0x1000fd40]
cmp eax, dword [ebp - 0x18]
je 0x1000712b
push eax
call esi
test eax, eax
je 0x1000712b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000712b
mov eax, dword [0x1000fd44]
cmp eax, dword [ebp - 0x18]
je 0x1000712b
push eax
call esi
test eax, eax
je 0x1000712b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000fd3c]
call esi
test eax, eax
je 0x10007147
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10007149
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001d25
leave
ret
Function at 0x48fc7d
Capabilities:
Parse pe header

Disassembly:
pushal
xor edx, edx
mov esi, dword fs:[edx]
lodsd eax, dword [esi]
cmp eax, 0xffffffff
je 0x48fc8d
mov esi, eax
jmp 0x48fc83
mov edi, dword [esi + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
je 0x48fca5
sub edi, 0x10000
jmp 0x48fc96
mov ebx, edi
add ebx, dword [ebx + 0x3c]
cmp word [ebx], 0x4550
je 0x48fcb3
jmp 0x48fc96
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x48fcb9
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x48fcd8
cmp eax, dword [esp + 0x28]
je 0x48fcef
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x48fccf
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
mov dword [esp + 0x1c], eax
popal
ret 8
Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x207a5ac8
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2f1929b1
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403658
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45e020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036d0
xor eax, eax
push ebp
push 0x4036c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40370c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x45e020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45e020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46904c], 0
je 0x40454d
cmp word [0x469220], 0xd7b2
jne 0x404515
cmp dword [0x469228], 0
jbe 0x404515
mov eax, 0x46921c
call dword [0x469238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404574
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45e02c], 0
jne 0x404569
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405d5c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f8c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ddf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405ddf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405fa8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405e68
xor eax, eax
push ebp
push 0x405e61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405b98
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e46
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405fc8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e46
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e68
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405f82
cmp byte [ebp - 0xd], 0
jne 0x405eaf
cmp byte [ebp - 0x12], 0
je 0x405f82
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ec8
dec ebx
cmp byte [ebx], 0x2e
je 0x405ed7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405ec7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405f82
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405f14
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f82
cmp byte [ebp - 0xd], 0
je 0x405f82
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f82
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40837c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40840c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40840c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4083bf
test edx, 3
jne 0x4083ae
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4083b9
jmp 0x4083bf
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4083bf
cmp dword [ecx - 8], 1
je 0x4083c9
mov edx, ebx
or edx, 3
call fcn.00404db8
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4083db
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.0040466c

Function at 0x408418
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4084a8
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4084a8
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40845b
test edx, 3
jne 0x40844a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408455
jmp 0x40845b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40845b
cmp dword [ecx - 8], 1
je 0x408465
mov edx, ebx
or edx, 3
call fcn.00404db8
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408477
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.0040466c

Function at 0x40b6e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b71d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040475c
jmp 0x40b726
mov eax, ebx
mov edx, esi
call fcn.004046c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b730
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b752
movzx eax, byte [esp]
jmp 0x40b754
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret