joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014bb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc8
mov eax, dword [0x10086004]
xor eax, esp
mov dword [esp + 0xbc4], eax
mov eax, dword [0x10086944]
push esi
push edi
mov edi, dword [esp + 0x10]
imul eax, edi
sub eax, dword [0x10086940]
mov dword [0x10086944], eax
lea eax, [esp + 0x18]
push eax
push 0x5d6
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], eax
cmp dword [0x10086940], esi
jb 0x10014c1d
add dword [0x100868c8], eax
mov edx, eax
adc dword [0x100868cc], 0
imul ecx, esi, 0x61
sub edx, ecx
mov dword [0x10086940], edx
mov eax, dword [0x10086944]
add eax, 0x30
add esi, eax
mov eax, dword [0x100868d8]
or eax, dword [0x100868dc]
je 0x10014c3f
lea eax, [esi - 0x1353]
mov dword [0x10086944], eax
push 8
push 0
push 0x10088098
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov edx, dword [0x1008697c]
cmp edx, esi
ja 0x10014c7c
mov eax, dword [0x10086944]
mov edi, esi
mov dword [0x1008698c], eax
add eax, 0x4e4e
add eax, esi
sub edi, eax
mov dword [0x10086944], eax
sub edi, 0xf835
xor ecx, ecx
jmp 0x10014c80
mov ecx, dword [esp + 0x14]
mov dword [esp + 8], ecx
cmp edx, 0x7b3
jne 0x10014ca2
add esi, dword [0x10086974]
lea eax, [esi*2 - 0x42]
sub edi, eax
sbb ecx, 0
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0xc]
call fcn.10014f10
mov edx, dword [0x10086944]
xor ecx, ecx
mov dword [0x10086940], eax
mov dword [esp + 0x10], edx
cmp ecx, dword [esp + 8]
jb 0x10014ce5
ja 0x10014cc8
cmp edx, edi
jb 0x10014ce5
sub edx, edi
add edx, 0xffff07cb
add dword [0x100868c8], edx
adc dword [0x100868cc], ecx
imul ecx, edi, 0x61
sub edx, ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add ecx, 0x4e4e
add ecx, edx
mov dword [0x10086944], ecx
cmp esi, ecx
jb 0x10014d13
add dword [0x100868c8], eax
mov esi, eax
adc dword [0x100868cc], 0
imul ecx, ecx, 0x61
sub esi, ecx
mov edi, dword [0x10086950]
mov ecx, 0x10086950
nop
cmp eax, edi
je 0x10014d3e
add eax, dword [ecx]
lea esi, [edx - 0x5d]
add esi, eax
cmp eax, dword [0x10086960]
je 0x10014d3e
add ecx, 4
cmp ecx, 0x100869ac
jl 0x10014d20
mov dword [0x10086940], eax
mov ecx, 0x10086950
cmp eax, edi
je 0x10014d66
add eax, dword [ecx]
lea esi, [edx - 0x5d]
add esi, eax
cmp eax, dword [0x10086960]
je 0x10014d66
add ecx, 4
cmp ecx, 0x100869ac
jl 0x10014d48
mov ecx, esi
mov dword [0x10086940], eax
call fcn.10015030
cmp dword [0x10086918], 0x7b3
jne 0x10014d92
cmp dword [0x1008691c], 0
jne 0x10014d92
mov eax, dword [0x10086908]
add dword [0x10086944], eax
mov ecx, dword [esp + 0xbcc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1000179e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49447d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4944b8
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x49449f
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4944b0
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4944ba
inc edi
add eax, 0x28
cmp edi, esi
jb 0x494495
xor eax, eax
pop edi
pop esi
ret
Function at 0x4ece10
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4106c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x40ff00
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov dword [ebp - 0x70], 0x420e98
mov dword [ebp - 0x78], 8
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
push 0x41823c
push 0x4470f0
lea eax, [ebp - 0x68]
push eax
call fcn.004c7510
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 4
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x68], 0xb
xor edx, edx
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x447110
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0
push 0x77359400
lea eax, [ebp - 0x58]
push eax
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.004975f0
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x54]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 5
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x68], 0xb
xor edx, edx
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x4471d0
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0
push 0x77359400
lea eax, [ebp - 0x58]
push eax
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.004975f0
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x54]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004c8940
jmp 0x4ecfc6
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x4ed015
jmp 0x4ecff0
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
Function at 0x4ed030
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4106c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x40ff60
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov dword [ebp - 0x70], 0x420e98
mov dword [ebp - 0x78], 8
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
push 0x41823c
push 0x447238
lea eax, [ebp - 0x68]
push eax
call fcn.004c7510
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 4
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x68], 0xb
xor edx, edx
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x447258
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0
push 0x77359400
lea eax, [ebp - 0x58]
push eax
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.004975f0
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x54]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 5
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x68], 0xb
xor edx, edx
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x4472c4
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0
push 0x77359400
lea eax, [ebp - 0x58]
push eax
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.004975f0
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x54]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004c8940
jmp 0x4ed1e6
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x4ed235
jmp 0x4ed210
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
Function at 0x4ee6d0
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4106c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x7c
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x410270
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov dword [ebp - 0x70], 0x420e98
mov dword [ebp - 0x78], 8
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
push 0x41823c
push 0x445d34
lea eax, [ebp - 0x68]
push eax
call fcn.004c7510
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 4
call fcn.004ed250
mov dword [ebp - 4], 5
push 0
call fcn.004eee00
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [0x4f3108]
mov eax, dword [edx]
mov ecx, dword [0x4f3108]
push ecx
call dword [eax + 0x444]
fnclex
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jge 0x4ee7d5
push 0x444
push 0x421090
mov edx, dword [0x4f3108]
push edx
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x9c], eax
jmp 0x4ee7df
mov dword [ebp - 0x9c], 0
movsx ecx, word [ebp - 0x7c]
test ecx, ecx
jne 0x4ee7fa
mov dword [ebp - 4], 7
push 1
call fcn.004ef510
jmp 0x4ee8a9
mov dword [ebp - 4], 9
cmp word [ebp + 0xc], 0xffff
jne 0x4ee814
mov dword [ebp - 4], 0xa
call fcn.004ebd90
mov dword [ebp - 4], 0xc
call fcn.004ef200
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x68], 0xb
xor edx, edx
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov edx, 0x447b04
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x68]
push eax
push 0
push 0x77359400
lea ecx, [ebp - 0x58]
push ecx
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.004975f0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0xe
cmp word [ebp + 8], 0xffff
jne 0x4ee8a9
mov dword [ebp - 4], 0xf
call fcn.004ece10
mov dword [ebp - 4], 0x12
mov edx, dword [ebp - 0x34]
push edx
call fcn.004c8940
jmp 0x4ee8ed
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x4ee93c
jmp 0x4ee917
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40b48a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40b499
pop dword [ebp - 0x50]
mov eax, 0x40b499
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd6e2640c
add dword [ebp - 0x60], 0x776fe13f
mov dword [ebp - 0x5c], 0xcf4ac345
add dword [ebp - 0x5c], 0x62e88900
mov dword [ebp - 0x58], 0xdb76a143
sub dword [ebp - 0x58], 0x8f2a5d15
mov dword [ebp - 0x54], 0x6ab818f
add dword [ebp - 0x54], 0xf9547e71
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb6e590d6
add dword [ebp - 0x60], 0xbd8cd880
mov dword [ebp - 0x5c], 0x93a7e123
sub dword [ebp - 0x5c], 0x523b7fae
mov dword [ebp - 0x58], 0x948362b7
add dword [ebp - 0x58], 0xceec09b5
mov dword [ebp - 0x54], 0x889178bf
sub dword [ebp - 0x54], 0x889178bf
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xde3c7b2
sub eax, 0xda2f76a
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ce5e
push 0
call eax
mov ecx, 0xda48cbe6
sub ecx, 0xda48761d
mov edx, eax
mov edi, 0x4dce8b7b
sub edi, 0x4d8cdb7b
add edi, dword [ebp - 0x50]
mov esi, 0x7b499683
add esi, 0xcf87e8a9
add dword [ebp - 0x30], eax
mov ebx, dword [edi]
add dword [ebp - 0x30], esi
xor ebx, esi
xor dword [ebp - 0x34], esi
mov dword [edx], ebx
add edx, 0x32976040
sub edx, 0x3297603c
add edi, 4
loop 0x40b5b1
add eax, 0xb244a017
sub eax, 0xb2435620
mov ebx, eax
add eax, 0x58882aee
sub eax, 0x58882ae9
mov ecx, 0xee8a7286
add ecx, 0x11b58d7a
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10004b90
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.10004b90
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10004b90
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x403328
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x454020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033a0
xor eax, eax
push ebp
push 0x403399
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x454020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x454020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040a4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x456048], 0
je 0x404105
cmp word [0x45621c], 0xd7b2
jne 0x4040cd
cmp dword [0x456224], 0
jbe 0x4040cd
mov eax, 0x456218
call dword [0x456234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45406c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40412c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x454030], 0
jne 0x404121
push 0
push 0x454064
push 0x45406c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405eb2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404498
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402eec
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405e9c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405eb9
lea eax, [ebp - 0x10]
call fcn.00404228
ret

Function at 0x40b13c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b175
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404318
jmp 0x40b17e
mov eax, ebx
mov edx, esi
call fcn.0040427c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b188
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b1a9
mov al, byte [esp]
jmp 0x40b1ab
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b840
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b6a8
mov eax, dword [0x45503c]
cmp byte [eax], 0
je 0x40b8bc
mov eax, dword [0x454e64]
call fcn.00402d58
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408858
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b904
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b8f2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x454e18]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x456664]
call fcn.004052b8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c160
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c236
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042c0
lea eax, [ebp - 8]
call fcn.00404738
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046e8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c220
mov eax, ebx
call fcn.00402a28
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c219
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046e8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c203
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c248
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c203
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c220
mov eax, dword [ebp - 0x10]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c23d
lea eax, [ebp - 8]
call fcn.00404228
ret

Function at 0x40c710
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c774
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404498
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004083d4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c77b
lea eax, [ebp - 0xc]
call fcn.00404228
ret