joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004905b
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x112c
call fcn.10017e10
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edi, eax
test edi, edi
je 0x1004912b
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1128]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
xor ebx, ebx
test eax, eax
je 0x10049122
xor esi, esi
test dword [ebp - 4], 0xfffffffc
jbe 0x10049122
push 0x104
lea eax, [ebp - 0x128]
push eax
push dword [ebp + esi*4 - 0x1128]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test eax, eax
je 0x10049102
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.100478b4
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
call fcn.10047813
cmp eax, dword [ebp + 8]
jne 0x100490f6
cmp edx, dword [ebp + 0xc]
je 0x1004910f
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.100022c0
mov eax, dword [ebp - 4]
inc esi
shr eax, 2
cmp esi, eax
jb 0x100490a7
jmp 0x10049122
mov ebx, dword [ebp + esi*4 - 0x1128]
lea ecx, [ebp - 0x1c]
push 0
push 1
call fcn.100022c0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10049187
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov edx, ecx
lea ecx, [ebp - 0x18]
push ebx
push esi
mov esi, dword fs:[0x30]
push edi
call fcn.100478b4
push 0x100603c0
lea ecx, [ebp - 0x48]
call fcn.10001fad
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x18]
call fcn.100476f3
mov bl, al
lea ecx, [ebp - 0x48]
push 0
neg bl
push 1
sbb bl, bl
call fcn.100022c0
inc bl
je 0x100491e5
mov edi, 0x100603c8
push edi
call fcn.10001f90
pop ecx
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.10001d76
mov esi, dword [esi + 0xc]
add esi, 0xc
mov edi, dword [esi]
jmp 0x1004922e
mov ebx, edi
lea ecx, [ebp - 0x30]
mov edi, dword [edi]
push dword [ebx + 0x30]
push dword [ebx + 0x2c]
call fcn.100477bd
cmp dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
pop ecx
cmovae eax, dword [ebp - 0x18]
pop ecx
push dword [ebp - 8]
push eax
push dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x30]
call fcn.10001e66
test eax, eax
je 0x10049249
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.100022c0
cmp edi, esi
jne 0x100491ef
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x18]
call fcn.100022c0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [ebx + 0x2c]
xor ecx, ecx
push eax
push ecx
push dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x44], ecx
call fcn.100171c0
movzx eax, word [ebx + 0x24]
push eax
push 0
push dword [ebx + 0x28]
call fcn.100171c0
add esp, 0x18
mov ecx, ebx
call fcn.10047c91
lea ecx, [ebx + 0x10]
call fcn.10047c91
lea ecx, [ebx + 8]
call fcn.10047c91
lea ecx, [ebx + 0x3c]
call fcn.10047c91
mov eax, dword [ebx + 0x18]
mov edx, 0x14c
mov ecx, dword [eax + 0x3c]
lea edi, [eax + 0x78]
cmp word [ecx + eax + 4], dx
je 0x100492ae
lea edi, [eax + 0x88]
add edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 1
push 0x539
mov esi, eax
call fcn.10010123
mov ebx, eax
mov edx, edi
push 0x539
push ebx
mov ecx, esi
call fcn.10047904
add esp, 0x10
test al, al
jne 0x100492e0
xor bl, bl
jmp 0x100492e9
push ebx
call fcn.100100eb
pop ecx
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.100022c0
jmp 0x10049234
Function at 0x100492fa
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
mov esi, ecx
mov byte [ebp - 1], dl
mov eax, 0x5a4d
push edi
cmp word [esi], ax
jne 0x10049393
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x10049393
mov ecx, 0x14c
lea ebx, [esi + 0x78]
cmp word [eax + esi + 4], cx
je 0x10049336
lea ebx, [esi + 0x88]
add ebx, eax
cmp dword [ebx + 4], 0
je 0x10049393
mov edi, dword [ebx]
add edi, esi
mov edx, dword [edi + 0x18]
test edx, edx
je 0x10049393
cmp dword [edi + 0x14], 0
je 0x10049393
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ecx, esi
and dword [ebp - 0xc], 0
add eax, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
test edx, edx
je 0x10049393
mov ecx, dword [ecx]
add ecx, esi
call fcn.10047813
cmp eax, dword [ebp + 8]
jne 0x1004937a
cmp edx, dword [ebp + 0xc]
je 0x1004939c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc eax
add dword [ebp - 8], 2
add ecx, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, dword [edi + 0x18]
jb 0x10049367
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
cmp ecx, 0xffffffff
je 0x10049393
cmp ecx, dword [edi + 0x14]
ja 0x10049393
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
cmp edi, dword [ebx]
jb 0x1004948e
mov eax, dword [ebx + 4]
add eax, dword [ebx]
cmp edi, eax
jae 0x1004948e
add edi, esi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100493d1
push 0
pop ebx
mov esi, ebx
sub ecx, edx
je 0x10049393
cmp byte [esi + edi], 0x2e
je 0x100493ee
inc esi
cmp esi, ecx
jb 0x100493e1
jmp 0x10049393
push esi
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.10015d20
lea ecx, [ebp - 0x230]
mov byte [ebp + esi - 0x230], bl
add esp, 0xc
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x1004940d
mov eax, dword [str..dll]
inc esi
mov dword [ecx], eax
mov al, byte [0x100603d4]
mov byte [ecx + 4], al
add esi, edi
je 0x10049393
lea edx, [ebp - 0x230]
lea ecx, [ebp - 0x28]
call fcn.100478b4
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.10047813
push edx
push eax
call fcn.1004905b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1004946a
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.100022c0
jmp 0x10049393
mov ecx, esi
call fcn.10047813
push edx
mov dl, byte [ebp - 1]
mov ecx, edi
push eax
call fcn.100492fa
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.100022c0
jmp 0x10049490
add edi, esi
mov eax, edi
jmp 0x10049395
Function at 0x1004ab42
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ecx
push esi
push edi
mov edi, 0x100a1a20
xor esi, esi
push edi
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x1004ab5b
mov esi, str.Steam_
push 0x35f039cf
push 0xf10be340
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10047ca9
push 0x6661feac
push 0xe00d839b
call fcn.10047ca9
add esp, 0x10
call fcn.100463e5
pop edi
pop esi
pop ecx
ret
Function at 0x10052e26
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x334
cmp byte [0x100a01a1], 0
push ebx
push esi
push edi
jne 0x10052e45
mov al, 1
jmp 0x10053000
mov ecx, dword [ebp + 8]
call fcn.100476b5
mov edx, eax
lea esi, [esp + 0x130]
sub esi, edx
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10052e58
lea ecx, [esp + 0x28]
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x10052e68
lea ecx, [esp + 0x28]
call fcn.100476c5
mov dl, 1
mov byte [esp + 0xf], al
lea ecx, [esp + 0x130]
call fcn.10047016
mov edi, dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
test al, al
jne 0x10052ea8
cmp byte [esp + 0xf], 0
je 0x10052f3a
sub esp, 0x18
lea eax, [esp + 0x148]
mov ecx, esp
push eax
call fcn.10001fad
sub esp, 0x18
mov ecx, esp
push 0x10060f50
call fcn.10001fad
mov ecx, dword [0x100a1d34]
lea eax, [esp + 0x58]
push eax
call fcn.1004c5ce
push 0x100a2558
call edi
inc dword [0x100a2554]
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x14]
call fcn.10001fad
lea eax, [esp + 0x10]
mov ecx, 0x100a257c
push eax
call fcn.1000c314
mov esi, eax
lea eax, [esp + 0x28]
push eax
call fcn.10001f90
pop ecx
push eax
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.10001f17
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.100022c0
dec dword [0x100a2554]
push 0x100a2558
call ebx
lea eax, [esp + 0x130]
push eax
push 0x5c
push 0x100a1c30
lea eax, [esp + 0x244]
push 0x10060f58
push eax
call fcn.10011765
add esp, 0x14
mov esi, 0x100a2520
push esi
call edi
inc dword [0x100a251c]
lea eax, [esp + 0x238]
push 0x10060f60
push eax
call fcn.10010417
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10052fcd
lea eax, [esp + 0x238]
push eax
call fcn.100122bb
pop ecx
mov ecx, eax
call fcn.1004774a
test eax, eax
je 0x10052fc0
mov ecx, eax
call fcn.100470c7
lea eax, [esp + 0x238]
push 0x10060f64
push eax
call fcn.10010417
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10052fcd
dec dword [0x100a251c]
push esi
call ebx
xor al, al
jmp 0x10053000
push edi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.100102d1
push edi
mov esi, eax
call fcn.10010c17
add esp, 0x14
mov byte [0x100745d1], 1
dec dword [0x100a251c]
push 0x100a2520
call ebx
cmp esi, dword [ebp + 0x10]
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10053009
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x208
call fcn.100476b5
lea edx, [ebp - 0x104]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10053022
push ebx
push edi
mov dl, 1
lea ecx, [ebp - 0x104]
call fcn.10047016
lea eax, [ebp - 0x104]
push eax
push 0x5c
push 0x100a1c30
lea eax, [ebp - 0x208]
push 0x10060f44
push eax
call fcn.10011765
add esp, 0x14
mov ebx, 0x100a2520
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
inc dword [0x100a251c]
lea eax, [ebp - 0x208]
push 0x10060f4c
push eax
call fcn.10010417
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10053099
dec dword [0x100a251c]
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor eax, eax
jmp 0x100530e9
cmp dword [ebp + 0x10], 0
push esi
jbe 0x100530b3
xor esi, esi
push esi
push dword [ebp + 0x10]
push edi
call fcn.10010b28
add esp, 0xc
test eax, eax
jne 0x100530d2
cmp byte [0x100a01a1], 0
mov eax, dword [ebp + 0x14]
jne 0x100530c1
shr eax, 1
push edi
push eax
push 1
push dword [ebp + 0xc]
call fcn.100105f1
add esp, 0x10
mov esi, eax
push edi
call fcn.10010c17
dec dword [0x100a251c]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10055868
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x100a2214]
push esi
xor esi, esi
jmp 0x10055879
cmp dword [eax + 4], esi
jne 0x100558c8
mov eax, dword [eax]
test eax, eax
jne 0x10055872
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ecx, eax
test ecx, ecx
je 0x100558c6
lea edx, [ecx + 0x20]
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov esi, edx
sub esi, ecx
mov eax, dword [ecx + 4]
add esi, 0x20
mov dword [edx], eax
mov dword [ecx + 4], edx
add edx, 0x20
cmp esi, 0xfe0
jbe 0x100558a3
mov eax, dword [0x100a2214]
mov dword [ecx], eax
mov dword [0x100a2214], ecx
mov eax, ecx
pop esi
ret
Function at 0x10055fc3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
imul ebx, ecx, 0x28
push esi
push edi
push 5
mov esi, edx
add ebx, dword [0x100a2218]
pop eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
test byte [ebx + 0x14], 1
mov edi, dword [ebx]
mov dword [ebp - 8], edi
je 0x10055ff6
sub edi, eax
push 7
pop eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x1005600d
push 0xa
pop eax
jmp 0x1005608c
test esi, esi
je 0x1005602e
mov byte [edi], 0xe9
mov eax, dword [ebx + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [ebx + 0x14], 1
je 0x1005604e
mov eax, dword [ebx]
mov word [eax], 0xf9eb
jmp 0x1005604e
test byte [ebx + 0x14], 1
je 0x10056043
lea esi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
jmp 0x1005604e
mov eax, dword [ebx + 0xc]
mov dword [edi], eax
mov al, byte [ebx + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
and esi, 1
mov ecx, esi
and ecx, 0xfffffffd
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebx + 0x14]
add ecx, ecx
and eax, 0xfffffff9
or ecx, eax
xor eax, eax
mov dword [ebx + 0x14], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10056093
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100560df
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100560ce
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.DLL_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100560c7
push ebx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100560a4
pop ebx
push dword [esi]
push 0
push dword [0x100a2224]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
ret

Function at 0x100560e1
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.10056147
cmp dword [esi], ebx
je 0x10056141
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x10056140
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.DLL_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10056137
push ebx
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1005621d
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x10056107
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10056147
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10056217
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Thread32First]
jmp 0x10056208
cmp dword [ebp - 0x1c], 0x10
jb 0x100561f6
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
cmp dword [ebp - 0x10], eax
jne 0x100561f6
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [ebp - 0x14], eax
je 0x100561f6
cmp dword [esi], 0
jne 0x100561c0
push 0x200
push 0
push dword [0x100a2224]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x10056210
jmp 0x100561e5
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x100561e5
shl eax, 3
push eax
push dword [esi]
push 0
push dword [0x100a2224]
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
test eax, eax
je 0x10056210
shl dword [esi + 4], 1
mov dword [esi], eax
mov edx, dword [esi + 8]
mov ecx, dword [esi]
mov eax, dword [ebp - 0x14]
mov dword [ecx + edx*4], eax
lea eax, [edx + 1]
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Thread32Next]
test eax, eax
jne 0x1005617d
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40272c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040371c
test esi, esi
jne 0x402762
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040380c
jmp 0x402780
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402640
mov edi, eax
test esi, esi
je 0x402780
cmp dword [ebx], 0
je 0x402780
dec esi
jmp 0x402769
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402bf8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x414008], 0x8088405
inc edx
mov dword [ebx + 0x414008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402e44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x414018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402edc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ebc
xor eax, eax
push ebp
push 0x402eb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ef8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ebc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x414018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x414018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403524
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x415034], 0
je 0x403585
cmp word [0x415208], 0xd7b2
jne 0x40354d
cmp dword [0x415210], 0
jbe 0x40354d
mov eax, 0x415204
call dword [0x415220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x414084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4035ac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x414024], 0
jne 0x4035a1
push 0
push 0x41407c
push 0x414084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4036d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004024d0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x415035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4036a0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4043b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404416
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040387c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404400
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40441d
lea eax, [ebp - 0x10]
call fcn.0040371c
ret

Function at 0x404a38
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x4140dc], 0
jne 0x404b0a
mov byte [0x4140dc], 1
xor eax, eax
mov dword [0x4140d4], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x404a80
cmp dword [esp + 0x1c], 3
jne 0x404ae0
cmp dword [esp + 0x20], 0x33
jbe 0x404ae0
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x404b14
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x404b0a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x404b44
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x404b0a
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x404b0a
cmp byte [esp + 9], 0
jne 0x404b0a
jmp 0x404af5
push 0
push 0x404b44
push 0x404b4c
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x404b0a
mov eax, dword [0x4140d0]
call fcn.00403a94
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4140d4], eax
add esp, 0xac
ret

Function at 0x4055f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x4056bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040371c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4056a9
mov eax, ebx
mov edx, 0x73
call fcn.00403bc4
push 0
lea eax, [ebp - 8]
push eax
push 0x73
mov eax, ebx
call fcn.00403aec
push eax
push esi
call sub.kernel32.dll_ReadFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebx]
mov eax, 0x4056d4
call fcn.00403b7c
test eax, eax
jne 0x40568a
mov eax, ebx
call fcn.0040371c
jmp 0x4056a9
push ebx
mov edx, dword [ebx]
mov eax, 0x4056e0
call fcn.00403b7c
mov ecx, eax
dec ecx
sub ecx, 0x50
mov eax, dword [ebx]
mov edx, 0x51
call fcn.00403af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4056c6
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x4056e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40578c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.kernel32.dll_OpenFile
mov esi, eax
cmp esi, 0xffffffff
je 0x405771
lea eax, [ebp - 8]
mov edx, 0x186a0
call fcn.00403bc4
push 0
lea eax, [ebp - 0xc]
push eax
push 0x186a0
lea eax, [ebp - 8]
call fcn.00403aec
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x405771
push esi
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 8]
mov eax, 0x4057a4
call fcn.00403b7c
test eax, eax
jle 0x405771
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405793
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x4057bc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40583e
push dword fs:[eax]
mov dword fs:[eax], esp
xor bl, 1
neg bl
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test byte [ebp + 0x10], bl
je 0x405823
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.00405cf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405845
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret