joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x411ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ac8
mov eax, 1
add ebx, ebx
jne 0x411aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ae0
jne 0x411afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ae0
xor ecx, ecx
sub eax, 3
jb 0x411b10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411b82
mov ebp, eax
add ebx, ebx
jne 0x411b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411b28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411b4c
inc ecx
add ebx, ebx
jne 0x411b38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411b2d
jne 0x411b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411b2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411b6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411b5d
jmp 0x411ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411b6c
add edi, ecx
jmp 0x411ace
pop esi
mov edi, esi
mov ecx, 0x203
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411b8a
cmp byte [edi], 0xa
jne 0x411b8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x411b8f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411bfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x113a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411bbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1140c]
or eax, eax
je 0x411bf8
mov dword [ebx], eax
add ebx, 4
jmp 0x411bd9
call dword [esi + 0x11410]
popal
jmp 0x403ae7

Function at 0x7ad2fc
Capabilities:
Parse pe header

Disassembly:
call 0x7ad303
xor al, 0xcc
xchg dword [esp], ebp
lea ebp, [ebp + 0x85b]
xchg dword [esp], ebp
jmp 0x7adb5c
call fcn.007ad3f4
invalid
push esp
jmp 0x7ad3ed
pushal
jmp 0x7ad833

Function at 0x7ad303
Capabilities:
Parse pe header

Disassembly:
call 0x7ad303
xor al, 0xcc
xchg dword [esp], ebp
lea ebp, [ebp + 0x85b]
xchg dword [esp], ebp
jmp 0x7adb5c
call fcn.007ad3f4
invalid
push esp
jmp 0x7ad3ed
pushal
jmp 0x7ad833

Function at 0x7ad3f4
Capabilities:
Parse pe header

Disassembly:
push ebp
jmp 0x7ad7d6
push ebx
jmp 0x7add2e
xchg dword [esp], esi
lea esi, [esi + 0x501]
xchg dword [esp], esi
jmp 0x7ad139
mov dword [0x7b1c6e], 1
jmp 0x7ada6e
cmp dword [0x7b1c6e], 0
jmp 0x7adaa1
push dword [ebp + 8]
js 0x7ad59d
jns 0x7ad59d
pop es
mov ch, 0x69
invalid
call dword [0x7b1c72]
jmp 0x7ad267
call 0x7ad78c
add eax, dword [edi - 0x6472dbe4]
and edi, edi
invalid
mov ebp, esp
jmp 0x7ad9ff
sub esp, 0x20
jmp 0x7ad549
jmp 0x7ad267
jne 0x7ad55e
jmp 0x7ad4ae
push edi
jmp 0x7ad786
push esi
jmp 0x7adb7b
Function at 0x40cd31
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00413e80
call fcn.0040708f
cmp eax, esi
pop esi
jne 0x40cd4d
mov ecx, 0x5771a8
jmp fcn.0041b7da
ret
Function at 0x47ca74
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x48c9dc], 0
jne 0x47cb33
mov dword [ebp - 0x10], 0x80000000
push 0x400
call fcn.004818ad
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x48c9dc], eax
mov dword [ebp - 0xc], 0
jmp 0x47cab8
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x100
jge 0x47cb33
push 8
mov edx, dword [ebp - 0xc]
push edx
call fcn.0047ca1e
add esp, 8
shl eax, 0x18
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
jmp 0x47cae7
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 8
jge 0x47cb14
mov ecx, dword [ebp - 0x18]
and ecx, 0x80000000
test ecx, ecx
je 0x47cb0a
mov edx, dword [ebp - 0x18]
shl edx, 1
xor edx, 0x4c11db7
mov dword [ebp - 0x18], edx
jmp 0x47cb12
mov eax, dword [ebp - 0x18]
shl eax, 1
mov dword [ebp - 0x18], eax
jmp 0x47cade
push 0x20
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0047ca1e
add esp, 8
mov edx, dword [ebp - 0xc]
mov ecx, dword [0x48c9dc]
mov dword [ecx + edx*4], eax
jmp 0x47caaf
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x47cb4d
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jae 0x47cb79
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
xor ecx, dword [ebp + 0x10]
and ecx, 0xff
mov edx, dword [ebp + 0x10]
shr edx, 8
mov eax, dword [0x48c9dc]
mov ecx, dword [eax + ecx*4]
xor ecx, edx
mov dword [ebp + 0x10], ecx
jmp 0x47cb44
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x47d73a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x47d7a6
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x47d7ef
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004877e0
add esp, 8
test eax, eax
jne 0x47d7ed
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x47d7f1
jmp 0x47d79d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4814e1
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.0047f413
add esp, 4
and eax, 0xff
test eax, eax
je 0x48156a
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.00481ff0
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x481568
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x481568
jmp 0x48156a
jmp 0x4814ea
mov esp, ebp
pop ebp
ret

Function at 0x483ef2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x489e38
cmp edx, dword [eax]
je 0x483f14
add eax, 8
inc ecx
cmp eax, 0x489ec8
jl 0x483f05
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x489e38]
jne 0x484042
mov eax, dword [0x48ced0]
cmp eax, 1
je 0x48401c
test eax, eax
jne 0x483f45
cmp dword [0x489b74], 1
je 0x48401c
cmp edx, 0xfc
je 0x484042
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x483f7c
lea eax, [ebp - 0x1a4]
push 0x48c8c8
push eax
call fcn.00482330
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004820e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x483fbf
lea eax, [ebp - 0x1a4]
push eax
call fcn.004820e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x48c8c4
push edi
call fcn.004824e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x48c8a8
push eax
call fcn.00482330
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00482340
lea eax, [ebp - 0xa0]
push 0x48c8a4
push eax
call fcn.00482340
push dword [esi + 0x489e3c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00482340
push 0x12010
lea eax, [ebp - 0xa0]
push 0x48c87c
push eax
call fcn.004865a8
add esp, 0x2c
pop edi
jmp 0x484042
lea eax, [ebp + 8]
lea esi, [esi + 0x489e3c]
push 0
push eax
push dword [esi]
call fcn.004820e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405760
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x240
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x148]
push str.svchost.exe
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x405863
lea edx, [esp + 0x148]
push 0x408dcc
push edx
call sub.MSVCRT.dll_fopen
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x405863
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call fcn.00405110
add esp, 0x14
test al, al
je 0x40584b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00405250
add esp, 0x10
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x405863
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
call fcn.004052e0
mov eax, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00405570
add esp, 0x30
push ebx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x240
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x240
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x404a44
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c74
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404ac7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404ac7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c90
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404b50
xor eax, eax
push ebp
push 0x404b49
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040488c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b2e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404cb0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b2e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b50
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404c6a
cmp byte [ebp - 0xd], 0
jne 0x404b97
cmp byte [ebp - 0x12], 0
je 0x404c6a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404bb0
dec ebx
cmp byte [ebx], 0x2e
je 0x404bbf
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404baf
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404c6a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404bfc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c6a
cmp byte [ebp - 0xd], 0
je 0x404c6a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c6a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404b50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c74
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404ac7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404ac7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404c90
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404b50
xor eax, eax
push ebp
push 0x404b49
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0040488c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b2e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404cb0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b2e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b50
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404c6a
cmp byte [ebp - 0xd], 0
jne 0x404b97
cmp byte [ebp - 0x12], 0
je 0x404c6a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404bb0
dec ebx
cmp byte [ebx], 0x2e
je 0x404bbf
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404baf
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404c6a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404bfc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c6a
cmp byte [ebp - 0xd], 0
je 0x404c6a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404c6a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405300
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405366
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403bf0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004028d8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405350
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40536d
lea eax, [ebp - 0x10]
call fcn.00403980
ret

Function at 0x40950c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409545
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403a70
jmp 0x40954e
mov eax, ebx
mov edx, esi
call fcn.004039d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409558
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409579
mov al, byte [esp]
jmp 0x40957b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409c00
Capabilities:
Write file on windows

Disassembly:
add byte cs:[eax], al
add byte [ecx - 0x4433c], al
add esp, 0xfffffbbc
invalid
invalid

Function at 0x40a960
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a9c4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403bf0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406a80
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a9cb
lea eax, [ebp - 0xc]
call fcn.00403980
ret

Function at 0x412820
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004057ec
ret
Function at 0x412d88
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e0c
xor eax, eax
push ebp
push 0x412e79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403c1c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x3a
jne 0x412dd4
lea eax, [ebp - 4]
mov edx, 0x412e90
call fcn.00403c24
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403e1c
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 8]
mov edx, 4
call fcn.00406a58
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004057e0
movzx eax, ax
lea ecx, [ebp - 0x1c]
mov edx, 4
call fcn.00406a58
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
pop ecx
call fcn.00403c68
mov eax, dword [ebp - 0x14]
mov edx, 0x412e9c
call fcn.00403d68
jne 0x412e4c
mov eax, ebx
call fcn.00403980
jmp 0x412e56
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.004039d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e80
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004039a4
lea eax, [ebp - 4]
call fcn.00403980
ret