joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423eb7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x423ee7
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4760f0]
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x423ec3
pop esi
not eax
ret

Function at 0x423eea
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0043f460
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
or dword [edi], 0xffffffff
mov dword [ebp - 0x2008], eax
mov esi, dword [ebp + 0x14]
mov eax, 0x2000
cmp esi, eax
jbe 0x423f23
mov esi, eax
jmp 0x423f27
test esi, esi
je 0x423f7f
mov ecx, dword [ebp - 0x2008]
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041b257
test eax, eax
je 0x423f86
xor ecx, ecx
test esi, esi
jbe 0x423f6f
mov eax, dword [edi]
movzx edx, byte [ebp + ecx - 0x2004]
mov ebx, eax
and ebx, 0xff
xor edx, ebx
shr eax, 8
xor eax, dword [edx*4 + 0x4760f0]
inc ecx
mov dword [edi], eax
cmp ecx, esi
jb 0x423f4a
xor eax, eax
sub dword [ebp + 0x14], esi
sbb dword [ebp + 0x18], eax
add dword [ebp + 0xc], esi
adc dword [ebp + 0x10], eax
jmp 0x423f13
not dword [edi]
xor eax, eax
inc eax
jmp 0x423fb5
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x423fb3
test byte [eax + 0x1c], 1
je 0x423fb3
cmp byte [eax + 0x19], 2
jb 0x423fb3
push 0x4760e0
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e999
leave
ret
Function at 0x4249d5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, ecx
cmp ebx, eax
je 0x424a26
cmp dword [esi], eax
jne 0x424a26
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x424a1a
test byte [eax + 0x1c], 1
je 0x424a1a
cmp byte [eax + 0x19], 2
jb 0x424a1a
push 0x476bd4
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
mov dword [edi + 8], 0x57
jmp 0x424ac0
push esi
push ebx
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 8], eax
test eax, eax
jne 0x424ac0
inc eax
cmp dword [ebp + 0xc], eax
je 0x424a77
cmp dword [ebp + 0xc], 2
je 0x424a77
cmp dword [ebp + 0xc], 7
je 0x424a77
mov ecx, dword [0x485d60]
cmp ecx, 0x485d60
je 0x424ab9
test byte [ecx + 0x1c], al
je 0x424ab9
cmp byte [ecx + 0x19], 2
jb 0x424ab9
push 0x476bd4
push 0x17
jmp 0x424aab
mov ecx, dword [esi]
test al, cl
jne 0x424a8b
test ebx, ebx
je 0x424ac2
shr ecx, 1
cmp word [ebx + ecx*2 - 2], 0
je 0x424ac2
mov ecx, dword [0x485d60]
cmp ecx, 0x485d60
je 0x424ab9
test byte [ecx + 0x1c], al
je 0x424ab9
cmp byte [ecx + 0x19], 2
jb 0x424ab9
push 0x476bd4
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0041646b
add esp, 0x10
mov dword [edi + 8], 0xd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x424ac9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 8], eax
test eax, eax
je 0x424b00
xor eax, eax
jmp 0x424b3f
cmp dword [ebp - 4], 4
je 0x424b3c
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x424b33
test byte [eax + 0x1c], 1
je 0x424b33
cmp byte [eax + 0x19], 2
jb 0x424b33
push 0x476bd4
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x424afc
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x425031
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x464cca
call fcn.0043ea47
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, ecx
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x3c]
push ecx
push eax
push ebx
push dword [esi + 4]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x425077
xor eax, eax
jmp 0x425268
cmp dword [ebp - 0x3c], 1
je 0x4250b9
cmp dword [ebp - 0x3c], 2
je 0x4250b9
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x4250b0
test byte [eax + 0x1c], 1
je 0x4250b0
cmp byte [eax + 0x19], 2
jb 0x4250b0
push 0x476bd4
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x425070
test byte [ebp - 0x38], 1
je 0x4250e0
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x4250b0
test byte [eax + 0x1c], 1
je 0x4250b0
cmp byte [eax + 0x19], 2
jb 0x4250b0
push 0x476bd4
push 0x1a
jmp 0x4250a2
lea ecx, [ebp - 0x68]
call fcn.00424050
mov eax, dword [ebp - 0x38]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
inc eax
inc eax
mov dword [ebp - 0x38], eax
shr eax, 1
push eax
mov byte [ebp - 4], 1
call fcn.00402aac
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
push dword [esi + 4]
call edi
mov ecx, dword [ebp - 0x40]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call fcn.00401bd9
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x425241
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x42515a
test byte [eax + 0x1c], 1
je 0x42515a
cmp byte [eax + 0x19], 2
jb 0x42515a
push ecx
push 0x476bd4
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00431cff
add esp, 0x14
mov ecx, dword [ebp - 0x40]
call fcn.00401ba4
jmp 0x425241
lea ecx, [ebp - 0x68]
call fcn.004249cc
test al, al
je 0x425254
mov dword [esi + 8], 0xe
xor eax, eax
cmp dword [esi + 8], eax
lea ecx, [ebp - 0x68]
sete al
mov esi, eax
call fcn.00424030
mov eax, esi
call fcn.0043eaa3
ret 8

Function at 0x42538e
Capabilities:
Get common file path

Disassembly:
push 0x58
mov eax, 0x464cf7
call fcn.0043ea47
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
call fcn.00424050
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
mov byte [ebp - 0x35], 1
mov byte [ebp - 4], 1
call fcn.00402209
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
mov ecx, edi
mov ebx, eax
call fcn.00401bd9
test ebx, ebx
je 0x4253d9
cmp ebx, esi
jbe 0x425416
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x425412
test byte [eax + 0x1c], 1
je 0x425412
cmp byte [eax + 0x19], 2
jb 0x425412
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x485d60]
push str._J
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00431cff
add esp, 0x14
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.004249cc
test al, al
je 0x425426
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.00424030
mov al, byte [ebp - 0x35]
call fcn.0043eaa3
ret
Function at 0x43e999
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x485df0]
jne 0x43e9a3
repz ret
jmp fcn.00445b0c

Function at 0x43fb65
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x43fb96
call fcn.0044316b
mov dword [eax], esi
call fcn.00443158
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0043ebe9
add esp, 0x14
push 0x16
pop eax
jmp 0x43fbeb
test dword [ebp + 0xc], 0xfffffff9
jne 0x43fb72
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43fbc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044317e
pop ecx
call fcn.00443158
mov eax, dword [eax]
jmp 0x43fbeb
test al, 0x10
jne 0x43fbe9
test al, 1
je 0x43fbe9
test byte [ebp + 0xc], 2
je 0x43fbe9
call fcn.0044316b
mov dword [eax], 5
call fcn.00443158
mov dword [eax], 0xd
jmp 0x43fbba
xor eax, eax
pop esi
pop ebp
ret

Function at 0x44d7c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00442beb
and dword [ebp - 4], 0
cmp dword [0x488158], 0
mov ebx, eax
jne 0x44d875
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44d926
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x44d926
push eax
call fcn.00442b79
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x488158], eax
call esi
push eax
call fcn.00442b79
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48815c], eax
call esi
push eax
call fcn.00442b79
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x488160], eax
call esi
push eax
call fcn.00442b79
pop ecx
mov dword [0x488168], eax
test eax, eax
je 0x44d875
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00442b79
pop ecx
mov dword [0x488164], eax
mov eax, dword [0x488164]
cmp eax, ebx
je 0x44d8cd
cmp dword [0x488168], ebx
je 0x44d8cd
push eax
call fcn.00442bf4
push dword [0x488168]
mov esi, eax
call fcn.00442bf4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44d8cd
test edi, edi
je 0x44d8cd
call esi
test eax, eax
je 0x44d8c4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44d8c4
test byte [ebp - 0xc], 1
jne 0x44d8cd
or dword [ebp + 0x10], 0x200000
jmp 0x44d906
mov eax, dword [0x48815c]
cmp eax, ebx
je 0x44d906
push eax
call fcn.00442bf4
pop ecx
test eax, eax
je 0x44d906
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44d906
mov eax, dword [0x488160]
cmp eax, ebx
je 0x44d906
push eax
call fcn.00442bf4
pop ecx
test eax, eax
je 0x44d906
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x488158]
call fcn.00442bf4
pop ecx
test eax, eax
je 0x44d926
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44d928
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453906
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x68
mov eax, 0x465b2d
call fcn.0043ea47
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x38], ebx
call fcn.00424050
and dword [ebp - 4], 0
push 0
push 0xffffffffffffffff
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x68]
call fcn.00425550
mov byte [ebp - 4], 2
test ebx, ebx
je 0x453c2c
cmp word [ebx], 0
je 0x453c2c
mov ecx, esi
call fcn.00452e29
mov ecx, esi
call fcn.00452e85
test edi, edi
je 0x4539a1
push edi
lea ecx, [esi + 0x28]
call fcn.0045c0ab
test al, al
jne 0x4539a1
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x453c59
test byte [eax + 0x1c], 1
je 0x453c59
cmp byte [eax + 0x19], 2
jb 0x453c59
push 0x47a754
push 0xb
jmp 0x453c4b
cmp byte [ebp + 0xc], 0
jne 0x453a06
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4539f2
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x453c59
test byte [eax + 0x1c], 1
je 0x453c59
cmp byte [eax + 0x19], 2
jb 0x453c59
push ebx
push 0x47a754
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004183ee
add esp, 0x14
jmp 0x453c59
lea ecx, [esi + 0x19b]
cmp byte [ecx], 0
jne 0x453a06
xor ebx, ebx
inc ebx
and al, bl
mov byte [ecx], al
jmp 0x453a09
xor ebx, ebx
inc ebx
cmp byte [esi + 0x19b], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
je 0x453a75
call fcn.00452425
lea eax, [ebp - 0x30]
push eax
push esi
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 3
call fcn.0045c412
push 0
push ebx
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.00451ef3
test edi, edi
jne 0x453af9
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x453c59
test byte [eax + 0x1c], bl
je 0x453c59
cmp byte [eax + 0x19], 2
jb 0x453c59
push dword [ebp - 0x38]
push 0x47a754
push 0xd
jmp 0x4539df
call fcn.00452425
xor eax, eax
cmp byte [esi + 0x19a], al
lea ecx, [esi + 0x28]
sete al
mov byte [ebp - 4], 4
push eax
xor eax, eax
cmp byte [ebp + 0xc], al
setne al
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.0045c438
push 0
push ebx
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.00451ef3
test edi, edi
jne 0x453af9
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x453ae0
test byte [eax + 0x1c], bl
je 0x453ae0
cmp byte [eax + 0x19], 2
jb 0x453ae0
push dword [ebp - 0x38]
push 0x47a754
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004183ee
add esp, 0x14
lea ecx, [ebp - 0x68]
call fcn.0042275f
xor ebx, ebx
lea ecx, [ebp - 0x5c]
call fcn.00424030
mov eax, ebx
jmp 0x453c6b
mov ecx, dword [esi + 0xf0]
push ebx
call fcn.00459f1c
lea ecx, [ebp - 0x68]
call fcn.0042275f
jmp 0x453aea
mov eax, dword [0x485d60]
cmp eax, 0x485d60
je 0x453c59
test byte [eax + 0x1c], 1
je 0x453c59
cmp byte [eax + 0x19], 2
jb 0x453c59
push 0x47a754
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0041646b
add esp, 0x10
lea ecx, [ebp - 0x68]
call fcn.0042275f
lea ecx, [ebp - 0x5c]
call fcn.00424030
xor eax, eax
call fcn.0043eaa3
ret 0xc
Function at 0x459fc0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
movzx eax, word [edi]
xor esi, esi
test ax, ax
je 0x459ff9
movzx eax, ax
movzx eax, ax
inc edi
push eax
inc edi
call fcn.004433ed
movzx eax, ax
add eax, esi
imul eax, eax, 0x401
mov esi, eax
shr eax, 6
xor esi, eax
movzx eax, word [edi]
pop ecx
test ax, ax
jne 0x459fd3
imul esi, esi, 9
mov eax, esi
shr eax, 0xb
xor eax, esi
pop edi
imul eax, eax, 0x8001
pop esi
ret

Function at 0x45d9f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
push esi
mov esi, dword [edi]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x10
mov edx, dword [ebp - 4]
xor eax, dword [edx]
mov dword [ebp - 0xc], eax
call fcn.0045d9b9
add dword [ebp - 4], 4
xor eax, esi
dec dword [ebp - 8]
mov esi, dword [ebp - 0xc]
jne 0x45da0e
mov edx, eax
mov eax, dword [ecx + 0x40]
mov ecx, dword [ecx + 0x44]
xor eax, edx
xor ecx, esi
mov dword [ebx], ecx
mov dword [edi], eax
pop esi
leave
ret

Function at 0x45da3c
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1048
push 0
push esi
call fcn.0043f490
add esp, 0xc
mov eax, 0x47aac8
lea ecx, [esi + 0x48]
mov edx, 0x100
mov edi, dword [eax]
mov dword [ecx], edi
add eax, 4
add ecx, 4
dec edx
jne 0x45da65
cmp eax, 0x47bac8
jl 0x45da60
mov edx, 0x47aa80
xor ecx, ecx
mov eax, esi
sub edx, esi
mov dword [ebp - 8], 0x12
xor edi, edi
mov dword [ebp - 0xc], 4
mov ebx, dword [ebp + 0xc]
movzx ebx, byte [ecx + ebx]
shl edi, 8
or edi, ebx
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x45daa8
xor ecx, ecx
dec dword [ebp - 0xc]
jne 0x45da94
mov ebx, dword [edx + eax]
xor ebx, edi
mov dword [eax], ebx
add eax, 4
dec dword [ebp - 8]
jne 0x45da8b
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0xc]
lea ebx, [ebp - 8]
mov ecx, esi
call fcn.0045d9f9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add dword [ebp - 4], 2
shl eax, 2
cmp dword [ebp - 4], 0x12
mov dword [eax + esi], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + esi + 4], ecx
jl 0x45dac7
lea eax, [esi + 0x4c]
mov dword [ebp - 0x14], 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x80
lea edi, [ebp - 0xc]
lea ebx, [ebp - 8]
mov ecx, esi
call fcn.0045d9f9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax - 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
add eax, 8
dec dword [ebp - 0x10]
mov dword [ebp - 4], eax
jne 0x45db05
dec dword [ebp - 0x14]
jne 0x45dafb
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
Function at 0x45db63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jbe 0x45dbc7
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
add esi, 4
dec edi
shr edi, 3
inc edi
mov eax, dword [esi - 4]
mov ebx, dword [esi]
lea edx, [ecx + 0x44]
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], 0x10
mov edx, dword [ebp + 0x10]
xor eax, dword [edx]
mov dword [ebp - 4], eax
call fcn.0045d9b9
sub dword [ebp + 0x10], 4
xor eax, ebx
dec dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
jne 0x45db91
mov edx, eax
mov eax, dword [ecx + 4]
xor eax, edx
mov edx, dword [ecx]
xor edx, ebx
mov dword [esi - 4], edx
mov dword [esi], eax
add esi, 8
dec edi
mov dword [ebp + 0x10], ebx
jne 0x45db7f
pop esi
pop ebx
pop edi
leave
ret
Function at 0x402940
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40297d
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x40299d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004047d4
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b74
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040456c
test esi, esi
jne 0x402baa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040465c
jmp 0x402bc8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a88
mov edi, eax
test esi, esi
je 0x402bc8
cmp dword [ebx], 0
je 0x402bc8
dec esi
jmp 0x402bb1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46c00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403708
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036e8
xor eax, eax
push ebp
push 0x4036e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403724
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46c00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46c00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4043f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46e048], 0
je 0x404451
cmp word [0x46e21c], 0xd7b2
jne 0x404419
cmp dword [0x46e224], 0
jbe 0x404419
mov eax, 0x46e218
call dword [0x46e234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46c054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404478
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46c01c], 0
jne 0x40446d
push 0
push 0x46c074
push 0x46c054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405fe4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406108
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405f5b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406108
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405f5b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406124
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405fe4
xor eax, eax
push ebp
push 0x405fdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405d20
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405fc2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406144
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405fc2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405fe4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4060fe
cmp byte [ebp - 0xd], 0
jne 0x40602b
cmp byte [ebp - 0x12], 0
je 0x4060fe
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406044
dec ebx
cmp byte [ebx], 0x2e
je 0x406053
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406043
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4060fe
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406090
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4060fe
cmp byte [ebp - 0xd], 0
je 0x4060fe
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4060fe
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret