joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d10
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_malloc]
push 0x280
call edi
add esp, 4
mov esi, eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x280
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x404d4f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 8]
push ecx
call edi
add esp, 4
mov esi, eax
lea edx, [esp + 8]
push edx
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x404de6
test esi, esi
je 0x404ddd
mov edi, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esi + 0x10c]
push 0x4084f4
push eax
call ebx
mov eax, dword [esi + 0x1a0]
add esp, 8
cmp eax, 6
jne 0x404dd5
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 0x199]
mov dl, byte [esi + 0x198]
xor eax, eax
push ecx
mov al, byte [esi + 0x197]
push edx
xor ecx, ecx
push eax
mov cl, byte [esi + 0x196]
xor edx, edx
mov dl, byte [esi + 0x195]
xor eax, eax
mov al, byte [esi + 0x194]
push ecx
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
push edi
call ebp
add esp, 0x20
mov esi, dword [esi]
test esi, esi
jne 0x404d78
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401ea0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
xor dword [edx - 0x74c1acec], 0x75
or byte [edi - 0x75], dl
inc esi
adc al, 0x59
inc ebp
or byte [ebp + 0x49], al
dec ebx
add byte [0x410ba0a3], al
add byte [ecx + 0x410ba4f7], cl
add byte [ebx + 0x14508b09], cl
test dword [ebx + ecx*4], ebp
jge 0x401f41
inc eax
leave
dec esi
add al, 0x6a
cmp al, 0x6a
push 0x51
call 0xf48c13
mov dword [esi - 0x63fff7c8], ebx
mov dword [esi + 0x83c], edi
mov dword [esi + 0x18], 0
mov edx, dword [0x4197ec]
ficom dword [esi + 0x14]
mov eax, dword [0x530260]
inc eax
add byte [ebp + 0x46], ch
invalid
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x412e87
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x5f
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x58
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x63
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x1f
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4a
push 0
push 0
push 0
call esi
add byte [edi + ebp], 4
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x7e
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x21
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xe5
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xa
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x60
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x83
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb0
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xcc
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xe6
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x9d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x38
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x28
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x10
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x83
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x55
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x49
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xfe
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x95
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xf4
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xd9
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x4f
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x61
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xce
inc edi
cmp edi, ebx
jb 0x412d20
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451c59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451c6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405902
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b112
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b123
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aff9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b14b
push ebx
push esi
push edi
call fcn.004056f5
add esp, 0xc
push 0
call fcn.0040623f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
mov ecx, 0x43005ffd
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x12ec2e87
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401010
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
mov edi, 8
sub edx, ebx
mov esi, edi
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edi, 1
jne 0x401024
lea edi, [ebx + 0x1c]
mov ebx, dword [edi]
mov ecx, esi
and ecx, 7
jne 0x401096
ror ebx, 8
mov eax, esi
mov ecx, ebx
shr eax, 3
shr ecx, 0x18
mov eax, dword [eax*4 + 0x439d0c]
movzx edx, byte [ecx + str.cw]
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
shl edx, 8
bswap eax
movzx ecx, byte [ecx + str.cw]
or edx, ecx
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
shl edx, 8
movzx ecx, byte [ecx + str.cw]
or edx, ecx
movzx ecx, bl
shl edx, 8
movzx ecx, byte [ecx + str.cw]
or edx, ecx
xor eax, edx
jmp 0x4010e0
mov eax, ebx
cmp ecx, 4
jne 0x4010e0
mov edx, eax
shr eax, 0x18
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
movzx eax, byte [eax + str.cw]
shl eax, 8
movzx ecx, byte [ecx + str.cw]
or eax, ecx
mov ecx, edx
shr ecx, 8
movzx ecx, cl
shl eax, 8
movzx ecx, byte [ecx + str.cw]
or eax, ecx
movzx ecx, dl
shl eax, 8
movzx ecx, byte [ecx + str.cw]
or eax, ecx
mov ecx, dword [edi - 0x1c]
inc esi
xor ecx, eax
mov dword [edi + 4], ecx
add edi, 4
cmp esi, 0x3c
jl 0x401035
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401100
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea eax, [edx + 2]
mov edx, 4
nop dword [eax + eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 6], cl
movzx ecx, byte [eax - 5]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 5], cl
movzx ecx, byte [eax - 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 4], cl
movzx ecx, byte [eax - 3]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 3], cl
sub edx, 1
jne 0x401110
ret

Function at 0x401310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
lea ecx, [edx + 2]
mov dword [ebp - 0x2c], 0x1010302
push esi
mov dword [ebp - 0x28], 0x1030201
mov dword [ebp - 0x24], 0x3020101
mov dword [ebp - 0x20], 0x2010103
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], ecx
push edi
xor ebx, ebx
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x10], ebx
cmp ebx, 4
jae 0x4013d2
lea eax, [ebp - 8]
mov byte [ebp - 1], 0
add eax, ebx
mov ebx, 4
mov dword [ebp - 0x18], eax
lea eax, [ecx - 2]
mov dword [ebp - 0x1c], eax
mov edi, eax
nop dword [eax]
mov dl, byte [esi]
mov cl, byte [edi]
call fcn.004011c0
xor al, byte [ebp - 1]
lea edi, [edi + 1]
inc esi
mov byte [ebp - 1], al
sub ebx, 1
jne 0x401370
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
inc ebx
mov dword [ebp - 0x10], ebx
mov byte [ecx], al
mov ecx, dword [ebp - 0xc]
cmp ebx, 4
jl 0x40134d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov byte [ecx], al
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 6]
mov byte [ecx], al
mov al, byte [ebp - 5]
mov byte [ecx - 1], ah
mov byte [ecx + 1], al
add ecx, 4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], eax
cmp eax, 4
jl 0x401342
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00427b12
int3
Function at 0x406240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, edx
mov edx, ecx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov eax, dword [edx + 0x3c]
mov dword [ebp - 8], edx
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
add ecx, edx
mov dword [ebp - 0x10], eax
mov eax, ebx
shr eax, 0x10
mov dword [ebp - 4], ecx
test eax, eax
je 0x4062b7
mov esi, dword [ecx + 0x20]
xor edi, edi
mov ebx, dword [ecx + 0x24]
add esi, edx
add ebx, edx
cmp dword [ecx + 0x18], edi
jbe 0x4062b7
mov ecx, dword [esi]
add ecx, edx
xor edx, edx
cmp byte [ecx], dl
je 0x406297
nop word [eax + eax]
inc edx
cmp byte [edx + ecx], 0
jne 0x406290
push ecx
call fcn.004084d0
add esp, 4
cmp eax, dword [ebp - 0xc]
je 0x4062c9
mov eax, dword [ebp - 4]
inc edi
mov edx, dword [ebp - 8]
add esi, 4
add ebx, 2
cmp edi, dword [eax + 0x18]
jb 0x406280
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
movzx eax, word [ebx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push eax
call fcn.00405e20
push dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov esi, eax
mov ecx, esi
call fcn.00405b20
add esp, 8
test eax, eax
je 0x4062f7
mov ecx, esi
call fcn.00404b00
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4084d0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x43c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
lea eax, [ebp - 0x44]
push edi
mov edx, 0x40
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub edx, 1
jne 0x4084f0
push ebx
mov ebx, esi
lea edx, [ebp - 0x44]
shr ebx, 2
mov edi, ebx
test edi, edi
je 0x40851f
nop word [eax + eax]
mov eax, dword [ecx]
add ecx, 4
mov dword [edx], eax
add edx, 4
sub edi, 1
jne 0x408510
mov edi, esi
and edi, 3
je 0x40853e
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
sub edi, 1
jne 0x408530
xor edx, edx
test esi, esi
jle 0x40855b
mov cl, byte [ebp + edx - 0x44]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x408556
add cl, 0x20
mov byte [ebp + edx - 0x44], cl
inc edx
cmp edx, esi
jl 0x408544
mov dword [ebp - 0x48], esi
lea edx, [ebp - 0x44]
mov edi, 0xb801fcda
cmp esi, 4
jl 0x4085a3
mov eax, ebx
neg eax
lea esi, [esi + eax*4]
nop dword [eax]
nop word [eax + eax]
imul ecx, dword [edx], 0x5bd1e995
add edx, 4
imul edi, edi, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor edi, ecx
sub ebx, 1
jne 0x408580
xor ecx, ecx
pop ebx
sub esi, 1
je 0x4085c5
sub esi, 1
je 0x4085bc
sub esi, 1
jne 0x4085ca
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor ecx, eax
imul edx, dword [ebp - 0x48], 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, edi, 0x5bd1e995
pop edi
pop esi
xor ecx, eax
mov eax, edx
shr eax, 0x18
xor eax, edx
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor ecx, eax
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004279e2
mov esp, ebp
pop ebp
ret
Function at 0x42845c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42849b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42849b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42849b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42849b
cmp dword [ecx + 0x74], 0xe
jbe 0x42849b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42c52d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4364f0
push 0x4364e8
push str.FlsAlloc
push 0x1e
call fcn.0042c44b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c561
push dword [ebp + 8]
mov ecx, esi
call dword [0x43511c]
call esi
jmp 0x42c567
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42c5ab
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x436500
push 0x4364f8
push str.FlsGetValue
push 0x20
call fcn.0042c44b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42c5e2
push dword [ebp + 8]
mov ecx, esi
call dword [0x43511c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42e3d2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42e46f
push ebx
push esi
call fcn.0042e39b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042e2e4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42e41c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42e46e
push edi
push eax
call fcn.0042cd78
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42e43c
call fcn.0042cdc6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42e46d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042e2e4
add esp, 0x20
test eax, eax
jne 0x42e45b
push edi
call fcn.0042cdc6
jmp 0x42e463
push ebx
call fcn.0042cdc6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x433d10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x433d3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x433d3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4073ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407403
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x409034
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4073f6
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x407405
xor eax, eax
pop esi
leave
ret 4
Function at 0x17f330ec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.17f3491c
test esi, esi
jne 0x17f33122
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.17f34a0c
jmp 0x17f33140
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.17f32f90
mov edi, eax
test esi, esi
je 0x17f33140
cmp dword [ebx], 0
je 0x17f33140
dec esi
jmp 0x17f33129
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x17f33844
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x17f9d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x17f338dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x17f338bc
xor eax, eax
push ebp
push 0x17f338b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x17f338f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17f338bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x17f9d020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x17f9d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x17f346e8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x17fa8048], 0
je 0x17f34749
cmp word [0x17fa821c], 0xd7b2
jne 0x17f34711
cmp dword [0x17fa8224], 0
jbe 0x17f34711
mov eax, 0x17fa8218
call dword [0x17fa8234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x17f34770
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x17f9d02c], 0
jne 0x17f34765
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x17f348a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x17f9d030], 0
je 0x17f348c6
mov edx, esi
mov eax, ebx
call dword [0x17f9d030]
jmp 0x17f348d5
mov eax, 8
call fcn.17f32ca0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x17fa8049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x17f34868
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x17f35e38
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x17f36068
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x17f35ebb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x17f36068
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x17f35ebb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x17f36084
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x17f35f44
xor eax, eax
push ebp
push 0x17f35f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.17f35c74
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x17f35f22
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x17f360a4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x17f35f22
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17f35f44
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x17f3605e
cmp byte [ebp - 0xd], 0
jne 0x17f35f8b
cmp byte [ebp - 0x12], 0
je 0x17f3605e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x17f35fa4
dec ebx
cmp byte [ebx], 0x2e
je 0x17f35fb3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x17f35fa3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x17f3605e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x17f35ff0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x17f3605e
cmp byte [ebp - 0xd], 0
je 0x17f3605e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x17f3605e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret