joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4245a2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c3d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov dword [ebp - 0x124], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 0xc]
call fcn.00402c80
cmp eax, 0xfe
jle 0x424613
mov dword [ebp - 0x118], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x118]
jmp 0x42471b
lea ecx, [ebp + 0xc]
call fcn.004081e0
push eax
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x114]
push ecx
push 0x20006
push 0
mov ecx, dword [ebp - 0x124]
add ecx, 0xc
call fcn.004081e0
push eax
mov edx, dword [ebp - 0x124]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42468c
mov dword [ebp - 0x11c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x11c]
jmp 0x42471b
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004081e0
push eax
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4246cb
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x124]
cmp dword [ecx + 8], 0
jne 0x4246e4
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x120], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x424a59
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x424aa6
push 0x104
push str.C:Temp
lea ecx, [ebp - 0x104]
push ecx
call fcn.00424f20
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0
push 0x448d80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x424af3
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
jmp 0x424b11
push 0x44d218
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp - 0x214]
or al, 1
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x424b15
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c443
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov dword [ebp - 0x118], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x114]
push eax
push 0
push 0x448d84
lea ecx, [ebp + 0xc]
call fcn.004081e0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x424b99
lea ecx, [ebp - 0x114]
push ecx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x118]
or edx, 1
mov dword [ebp - 0x118], edx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
jmp 0x424bc3
push 0x44d21c
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp - 0x118]
or al, 1
mov dword [ebp - 0x118], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x424c57
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x424c91
cmp dword [ebp - 0x210], 0x104
jb 0x424c98
xor al, al
jmp 0x424d85
push 0x104
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x214], 0
je 0x424cd5
cmp dword [ebp - 0x214], 0x104
jb 0x424cdc
xor al, al
jmp 0x424d85
call fcn.00417c99
and eax, 0xff
test eax, eax
je 0x424d0e
push 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x218], eax
xor eax, eax
cmp dword [ebp - 0x218], 0
setne al
jmp 0x424d85
push 0x104
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x424d83
cmp dword [ebp - 0x21c], 0x104
jae 0x424d83
push 0x448d88
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x424d7f
lea edx, [ebp - 0x320]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x448d98
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x324], eax
xor eax, eax
cmp dword [ebp - 0x324], 0
setne al
jmp 0x424d85
xor al, al
jmp 0x424d85
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x424d89
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x104
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x424dc3
cmp dword [ebp - 0x108], 0x104
jb 0x424dca
xor al, al
jmp 0x424e73
call fcn.00417c99
and eax, 0xff
test eax, eax
je 0x424dfc
push 5
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10c], eax
xor eax, eax
cmp dword [ebp - 0x10c], 0
setne al
jmp 0x424e73
push 0x104
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x424e71
cmp dword [ebp - 0x110], 0x104
jae 0x424e71
push str.WinInit.ini
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x424e6d
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x218], eax
xor eax, eax
cmp dword [ebp - 0x218], 0
setne al
jmp 0x424e73
xor al, al
jmp 0x424e73
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x424ef6
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
test eax, eax
jne 0x424f12
mov al, 1
jmp 0x424f14
xor al, al
pop ebp
ret

Function at 0x427225
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.00417260
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x427261
xor eax, eax
jmp 0x4272a0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.00417260
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x427291
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4272a0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4272a4
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.00417260
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4272e0
xor eax, eax
jmp 0x427330
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.00417260
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x427308
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x427330
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.00417260
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x432010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
mov edi, ecx
jne 0x43203f
mov eax, dword [esp + 0x10]
push eax
push 2
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
pop edi
pop esi
pop ebx
ret 8
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x43205f
pop edi
pop esi
pop ebx
ret 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, edi
call fcn.00431f40
pop edi
pop esi
pop ebx
ret 8
Function at 0x4352f0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x44d340]
sub esp, 0x104
test eax, eax
jne 0x4354d1
mov eax, dword [0x44d344]
test eax, eax
jne 0x435508
mov eax, dword [0x44a73c]
test eax, eax
je 0x43532e
push 0x44d328
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x44a73c], 0
push 0x44d328
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44d340]
test eax, eax
jne 0x4354c6
mov al, byte [0x44de14]
test al, al
je 0x435369
push 0x44de14
lea eax, [esp + 4]
push str._sGLJPG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x43537c
lea ecx, [esp]
push str.GLJPG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x44d340], eax
jne 0x4353ae
push 0x44d328
mov dword [0x44d344], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadJpgFileImageData
push eax
call esi
mov dword [0x44d348], eax
mov eax, dword [0x44d340]
push str.LoadJpgImageDataFromMem
push eax
call esi
mov ecx, dword [0x44d340]
push str.LoadJpgFile
push ecx
mov dword [0x44d34c], eax
call esi
mov edx, dword [0x44d340]
push str.LoadJpgFromMem
push edx
mov dword [0x44d350], eax
call esi
mov dword [0x44d354], eax
mov eax, dword [0x44d340]
push str.WriteBitmapToJpeg
push eax
call esi
mov ecx, dword [0x44d340]
push str.WriteDibToJpeg
push ecx
mov dword [0x44d358], eax
call esi
mov edx, dword [0x44d340]
push str.WriteDibToJpegMEM
push edx
mov dword [0x44d35c], eax
call esi
mov dword [0x44d360], eax
mov eax, dword [0x44d340]
push str.GetPointerFromHandleLock
push eax
call esi
mov ecx, dword [0x44d340]
push str.UnLockDataHandle
push ecx
mov dword [0x44d364], eax
call esi
mov edx, dword [0x44d340]
push str.FreeDataHandle
push edx
mov dword [0x44d368], eax
call esi
mov ecx, dword [0x44d348]
mov dword [0x44d36c], eax
test ecx, ecx
pop esi
je 0x4354dd
mov ecx, dword [0x44d34c]
test ecx, ecx
je 0x4354dd
mov ecx, dword [0x44d350]
test ecx, ecx
je 0x4354dd
mov ecx, dword [0x44d354]
test ecx, ecx
je 0x4354dd
mov ecx, dword [0x44d358]
test ecx, ecx
je 0x4354dd
mov ecx, dword [0x44d35c]
test ecx, ecx
je 0x4354dd
test eax, eax
je 0x4354dd
mov eax, dword [0x44d360]
test eax, eax
je 0x4354dd
mov eax, dword [0x44d364]
test eax, eax
je 0x4354dd
mov eax, dword [0x44d368]
test eax, eax
je 0x4354dd
push 0x44d328
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov eax, dword [0x44d340]
mov dword [0x44d344], 1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44d328
mov dword [0x44d340], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x435560
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x44d39c]
sub esp, 0x104
test eax, eax
jne 0x4356b4
mov eax, dword [0x44d3a0]
test eax, eax
jne 0x4356ec
mov eax, dword [0x44a820]
test eax, eax
je 0x43559e
push 0x44d370
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x44a820], 0
push 0x44d370
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44d39c]
test eax, eax
jne 0x4356a9
mov al, byte [0x44de14]
test al, al
je 0x4355d9
push 0x44de14
lea eax, [esp + 4]
push str._sGLPNG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4355ec
lea ecx, [esp]
push str.GLPNG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x44d39c], eax
jne 0x43561e
push 0x44d370
mov dword [0x44d3a0], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadPNGFile
push eax
call esi
mov dword [0x44d388], eax
mov eax, dword [0x44d39c]
push str.LoadPNGFromMem
push eax
call esi
mov ecx, dword [0x44d39c]
push str.WriteBmpToPNGMem
push ecx
mov dword [0x44d38c], eax
call esi
mov edx, dword [0x44d39c]
push str.WriteBmpToPNGFile
push edx
mov dword [0x44d390], eax
call esi
mov dword [0x44d394], eax
mov eax, dword [0x44d39c]
push str.WriteImageDataToPNGMem
push eax
call esi
mov ecx, dword [0x44d388]
mov dword [0x44d398], eax
test ecx, ecx
pop esi
je 0x4356c0
mov ecx, dword [0x44d38c]
test ecx, ecx
je 0x4356c0
mov ecx, dword [0x44d390]
test ecx, ecx
je 0x4356c0
mov ecx, dword [0x44d394]
test ecx, ecx
je 0x4356c0
test eax, eax
je 0x4356c0
push 0x44d370
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov ecx, dword [0x44d39c]
mov dword [0x44d3a0], 1
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44d370
mov dword [0x44d39c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x435760
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43ca58
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
mov edx, dword [esp + 0x14]
sub esp, 0x40
lea ecx, [esp]
push ebp
push esi
push eax
mov eax, dword [esp + 0x5c]
push 0x40
push ecx
push 0x44d290
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 8]
test al, al
jne 0x4357b8
mov eax, dword [esp + 0x60]
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
xor ebp, ebp
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], ebp
call fcn.00430ab0
mov eax, dword [esp + 0x64]
cmp dword [eax - 8], 2
jge 0x43580f
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x64]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
push 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x435869
mov edx, dword [esp + 0x64]
push edx
call fcn.00434e90
mov esi, eax
mov ecx, eax
and esi, 0xff
and eax, 0xff00
shl esi, 0x10
sar ecx, 0x10
add esi, ecx
add esp, 4
lea ecx, [esp + 0x64]
add esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
mov esi, dword [esp + 0x64]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
push edi
push esi
call ebx
mov dword [esp + 0x68], eax
mov al, byte [esi]
add esp, 4
xor edi, edi
test al, al
je 0x435893
cmp al, 0x2c
je 0x435893
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x435887
cmp byte [esi], 0x2c
jne 0x4358c1
inc esi
push esi
call ebx
mov ebp, eax
mov al, byte [esi]
add esp, 4
test al, al
je 0x4358b3
cmp al, 0x2c
je 0x4358b3
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4358a7
cmp byte [esi], 0x2c
jne 0x4358c1
inc esi
push esi
call ebx
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x6c]
shl edi, 8
add edi, ebp
mov dword [esp + 0x58], 0xffffffff
shl edi, 8
add edi, eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x50]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x435900
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43ca78
push eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x40
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x54]
push 0x40
push ecx
push 0x44d290
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp]
test al, al
je 0x4359ae
push ebx
push esi
push edi
lea ecx, [esp + 0x68]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0
push ecx
lea ecx, [esp + 0x6c]
call fcn.00430ab0
mov esi, dword [esp + 0x68]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push esi
call edi
mov ebx, dword [esp + 0x68]
add esp, 4
mov dword [ebx], eax
mov al, byte [esi]
test al, al
je 0x43598b
cmp al, 0x2c
je 0x43598b
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x43597f
cmp byte [esi], 0x2c
jne 0x43599a
inc esi
push esi
call edi
add esp, 4
mov dword [ebx + 4], eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x4034c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x49f00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40355c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40353c
xor eax, eax
push ebp
push 0x403535
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403578
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40353c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x49f00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x49f00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40423c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4a104c], 0
je 0x40429d
cmp word [0x4a1220], 0xd7b2
jne 0x404265
cmp dword [0x4a1228], 0
jbe 0x404265
mov eax, 0x4a121c
call dword [0x4a1238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49f054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042c4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49f01c], 0
jne 0x4042b9
push 0
push 0x49f074
push 0x49f054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405d38
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f68
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405dbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405dbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f84
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405e44
xor eax, eax
push ebp
push 0x405e3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405b80
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e22
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405fa4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405e22
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e44
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405f5e
cmp byte [ebp - 0xd], 0
jne 0x405e8b
cmp byte [ebp - 0x12], 0
je 0x405f5e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405ea4
dec ebx
cmp byte [ebx], 0x2e
je 0x405eb3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405ea3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405f5e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405ef0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f5e
cmp byte [ebp - 0xd], 0
je 0x405f5e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f5e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret