joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407550
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422beb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42b6d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040aee9
push 4
mov dword [ebp - 4], 0
call fcn.0040bd4d
mov edi, eax
add esp, 4
test edi, edi
je 0x4075cc
call fcn.0040adc1
mov dword [edi], eax
call fcn.0040ab80
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0040aeaa
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4075c2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0040aed2
jmp 0x4075ce
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409190
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422f88
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x42b6d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x4091f5
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.00408f50
mov ecx, esi
call fcn.00409000
mov eax, esi
push eax
call fcn.004090e0
cmp dword [ebp + 0x1c], 0x10
jb 0x409222
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040bcf1
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040b37d
mov esp, ebp
pop ebp
ret

Function at 0x40b37d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b6d0]
jne 0x40b387
repz ret
jmp fcn.00410fdc
Function at 0x415bfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x415c23
call fcn.0040e1ac
mov dword [eax], esi
call fcn.0040e199
push 0x16
pop esi
mov dword [eax], esi
call fcn.004133bc
mov eax, esi
jmp 0x415c78
test dword [ebp + 0xc], 0xfffffff9
jne 0x415c09
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x415c50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e1bf
pop ecx
call fcn.0040e199
mov eax, dword [eax]
jmp 0x415c78
test al, 0x10
jne 0x415c76
test al, 1
je 0x415c76
test byte [ebp + 0xc], 2
je 0x415c76
call fcn.0040e1ac
mov dword [eax], 5
call fcn.0040e199
mov dword [eax], 0xd
jmp 0x415c47
xor eax, eax
pop esi
pop ebp
ret

Function at 0x416e58
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b6d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411c71
and dword [ebp - 0x14], 0
cmp dword [0x42d9b0], 0
mov dword [ebp - 0x18], eax
jne 0x416f0b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416fb3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x416fb3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42d9b0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42d9b4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42d9b8], eax
call edi
push eax
call esi
mov dword [0x42d9c0], eax
test eax, eax
je 0x416f0b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42d9bc], eax
mov eax, dword [0x42d9bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416f64
cmp dword [0x42d9c0], ecx
je 0x416f64
push eax
call esi
push dword [0x42d9c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416f64
test ebx, ebx
je 0x416f64
call edi
test eax, eax
je 0x416f5b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416f5b
test byte [ebp - 8], 1
jne 0x416f64
or dword [ebp + 0x10], 0x200000
jmp 0x416f97
mov eax, dword [0x42d9b4]
cmp eax, dword [ebp - 0x18]
je 0x416f97
push eax
call esi
test eax, eax
je 0x416f97
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416f97
mov eax, dword [0x42d9b8]
cmp eax, dword [ebp - 0x18]
je 0x416f97
push eax
call esi
test eax, eax
je 0x416f97
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42d9b0]
call esi
test eax, eax
je 0x416fb3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416fb5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b37d
leave
ret
Function at 0x4011d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg edx
add eax, 0xe
rcl eax, 0x7d
rol edx, 0x52
bswap ebx
sub edx, 0xfe
sbb eax, 0x27
sub eax, 0xfe
not edx
dec edi
bswap eax
sub ebx, 0xbe
rcl edx, 0xfd
dec eax
ror edx, 0xf0
add edx, 0x54
bswap esi
add eax, 0x95
bswap eax
bswap eax
dec esi
imul eax
neg ebx
mov edi, 0xd9
not eax
neg ebx
rol edx, 0xa2
add eax, 2
imul edi
dec edx
inc edx
neg eax
sbb ebx, 0xf2
rcr esi, 0x4d
ror esi, 0x8f
rol eax, 0x8e
not ebx
add ebx, 0x27
dec edx
and esi, 0x41
imul ebx
bswap eax
neg edx
bswap edi
rol ebx, 0x96
imul ebx
mov eax, 0x79
inc edi
neg ebx
bswap esi
xor ecx, ecx
xor edi, edi
sbb esi, 0x82
dec edx
ror ebx, 4
add ebx, 0x98
dec eax
imul edi
neg edi
ror ebx, 0xf4
sbb edx, 0x6d
imul edi
ror edi, 0x6b
and edx, 0x1d
or edx, 0x65
inc ebx
dec eax
dec edx
bswap eax
mov eax, 3
sbb eax, 0xb7
not eax
mov edi, 0xf6
not eax
rcr edi, 0x35
not edi
not ebx
neg edi
sub edi, 0x11
sbb edi, 0x1c
or eax, 0x43
or ebx, 0x72
or edx, 0x42
and ebx, 0xa7
dec esi
and edi, 0xc0
dec ebx
inc esi
imul edx
imul ebx
bswap edx
bswap edx
neg eax
or ebx, 0x51
inc ebx
dec edx
and edi, 0x78
dec edi
rcr esi, 0x4b
sub eax, 0x81
neg edx
imul edx
mov ecx, dword [ebp + 0xc]
dec ebx
sbb edx, 0xc1
bswap ebx
dec ebx
dec edx
dec ebx
and eax, 0xa3
or ebx, 0x66
not ebx
ror edi, 0x2d
mov edi, 0xea
inc edi
not edx
inc esi
neg esi
sbb edi, 0x5c
mov edi, 0xa
dec edx
inc edx
bswap ebx
neg ebx
inc eax
or ebx, 0xe6
mov edi, 0x15
ror esi, 0x4e
imul ebx
inc ebx
sub edx, 0x75
sbb ebx, 0x55
rcr edi, 0xbd
rcl esi, 0xfc
inc edx
rcr edi, 0xd4
ror edi, 0xd8
rcr eax, 0x5b
not esi
and esi, 0xbb
and ebx, 0xa2
and edx, 0xe4
mov ebx, 0x49
not eax
mov edx, 0x4f
and edx, 0xd8
rcr esi, 0xb8
rol edx, 0xd6
and ebx, 0x65
add ebx, 0x97
rcr esi, 0x4c
bswap esi
mov ebx, 0x72
mov edi, dword [ebp + 8]
xor ebx, ebx
not byte [edi]
xor byte [edi], 0x56
inc edi
loop 0x401381
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4055a4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f1d0]
jne 0x4055ae
repz ret
jmp fcn.00408125
Function at 0x40971c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405625
and dword [ebp - 4], 0
cmp dword [0x410678], 0
mov ebx, eax
jne 0x4097cd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40987e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40987e
push eax
call fcn.004055b3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x410678], eax
call esi
push eax
call fcn.004055b3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41067c], eax
call esi
push eax
call fcn.004055b3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x410680], eax
call esi
push eax
call fcn.004055b3
pop ecx
mov dword [0x410688], eax
test eax, eax
je 0x4097cd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004055b3
pop ecx
mov dword [0x410684], eax
mov eax, dword [0x410684]
cmp eax, ebx
je 0x409825
cmp dword [0x410688], ebx
je 0x409825
push eax
call fcn.0040562e
push dword [0x410688]
mov esi, eax
call fcn.0040562e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409825
test edi, edi
je 0x409825
call esi
test eax, eax
je 0x40981c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40981c
test byte [ebp - 0xc], 1
jne 0x409825
or dword [ebp + 0x10], 0x200000
jmp 0x40985e
mov eax, dword [0x41067c]
cmp eax, ebx
je 0x40985e
push eax
call fcn.0040562e
pop ecx
test eax, eax
je 0x40985e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40985e
mov eax, dword [0x410680]
cmp eax, ebx
je 0x40985e
push eax
call fcn.0040562e
pop ecx
test eax, eax
je 0x40985e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x410678]
call fcn.0040562e
pop ecx
test eax, eax
je 0x40987e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409880
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
ja 0x404abe
pop es
and edx, 0xfffffff8
cmp edx, eax
mov eax, dword [ebp + 0x7d]
mov esi, esi
clc
jae 0x404a99
mov eax, dword [eax + 0x20]
test eax, eax
je 0x404ccd
push 0xc
call eax
invalid
mov ebx, dword [ebp + 0x104ef72c]
mov edi, dword [esi + 0x14]
sub edi, ecx
cmp edx, edi
ja 0x404ab8
add ecx, dword [ecx + 0x5f]
mov dword [esi], edx
jle 0x404b0d
mov esp, dword [eax]
pop ebx
jne 0x404a99
push esp
ret 8
mov ecx, dword [esi]
add al, 0x79
adc al, 0x8b
pop ecx
adc byte [ebx], ch
sti
cmp edx, edi
mov ecx, 0x4418b14
or al, 0x39
mov dword [eax], edi
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [eax + 4], edi
jmp 0x404c4a
mov cl, 0xff
pop ds
push ebp
cld
ja 0x404cbf
push cs
pop ss
ja 0x404ba5
cli
inc edi
or al, 0x85
sal byte [ecx + 0x50], 0xe8
mov dword [0x8b4b0057], eax
imul edi, esp, 0xffffff8b
pop esp
cmp ebp, edi
mov esp, dword [esp + edx*2 + 0x44]
xchg edi, eax
adc al, 0x85
invalid
mov eax, ebx
adc al, 0x85
and al, 0x74
mov word [esi + 0x47], cs
xor byte [ebp + 0x5006c5c0], al
call 0xc640a2d0
mov ebp, dword [ebx]
push 0x1814508d
invalid
pop esi
inc ecx
adc bh, al
inc ecx
or al, 0x80
add byte [eax], al
push es
hlt
jnp 0x404d01
and cl, bl
je 0x404ccd
push 0xc
call eax
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
mov eax, 0x900008c2
nop
nop
nop
nop
nop
nop
ficom word [ebp - 0x75]
pop ss
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi - 0x22]
push esi
stosb byte es:[edi], al
sti
or dword [edi - 0x5d], ebx
mov eax, dword [edi + 4]
xor ebx, ebx
add esp, 0x78
cmp edi, dword [0x5f891e89]
cmp al, 0x74
or eax, 0xf4e850
add byte [eax], al
push ds
mov dword [edi + 0x3c], ebx
je 0x404d13
push eax
call fcn.00404e00
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x404d06
lea esi, [edi + 0x10]
jne 0x404d00
aam 9
add byte [esi - 0x76e3b875], ah
rcl byte [eax - 0x77]
pop edi
adc al, 0xe6
push es
or al, byte [ebx + 0x70478b00]
mov ecx, dword [edi + 0x34]
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x78], ebx
push ebx
inc edi
sub al, 0x89
dec eax
adc byte [ebx + 0x8c48362], cl
cmp ecx, eax
mov dword [ebp - 0xc], eax
je 0x4e4df5
mov edx, dword [eax + 4]
mov dword [ebp - 0x75], ebx
inc ecx
sbb byte [ebx + 0xc478b30], cl
test eax, eax
je 0x404d63
push eax
call 0xac06a2d0
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [ebp - 0x79], eax
invalid

Function at 0x40751c
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x40751f
mov eax, 0x50402b3
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x50
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x61
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x79
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xfa
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbe
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x88
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1a
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x60
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x93
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa2
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9a
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4055f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405656
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004043dc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402dc8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405640
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40565d
lea eax, [ebp - 0x10]
call fcn.00404188
ret

Function at 0x406ef8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040462c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x406f11
test al, 0x10
jne 0x406f15
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40915c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409195
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404278
jmp 0x40919e
mov eax, ebx
mov edx, esi
call fcn.004041dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4091a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4091c9
mov al, byte [esp]
jmp 0x4091cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409850
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4096c8
mov eax, dword [0x425e3c]
cmp byte [eax], 0
je 0x4098cc
mov eax, dword [0x425d6c]
call fcn.00402c64
call fcn.00402644
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004074dc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409914
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409902
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x425d44]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x426660]
call fcn.00405040
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40a588
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a5ec
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004043dc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406d34
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a5f3
lea eax, [ebp - 0xc]
call fcn.00404188
ret

Function at 0x40b398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
mov eax, dword [ebp - 8]
call fcn.0040461c
xor eax, eax
push ebp
push 0x40b40a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
push 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b411
lea eax, [ebp - 8]
mov edx, 2
call fcn.004041ac
ret

Function at 0x40cc9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x104], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cd10
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x100
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.004043dc
mov eax, dword [ebp - 0x104]
mov ecx, esi
mov edx, ebx
call fcn.0040cb7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd17
lea eax, [ebp - 0x104]
call fcn.00404188
ret

Function at 0x40cd20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x104], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cd94
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x100
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.004043dc
mov eax, dword [ebp - 0x104]
mov ecx, esi
mov edx, ebx
call fcn.0040cb7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd9b
lea eax, [ebp - 0x104]
call fcn.00404188
ret
Function at 0x40cda4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x104], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ce18
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0x100
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.004043dc
mov eax, dword [ebp - 0x104]
mov ecx, esi
mov edx, ebx
call fcn.0040cb7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ce1f
lea eax, [ebp - 0x104]
call fcn.00404188
ret

Function at 0x40d888
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40d891
mov eax, dword [ebp - 4]
add esp, 0xfffff7dc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2828], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040461c
mov eax, dword [ebp - 8]
call fcn.0040461c
mov eax, dword [ebp - 0xc]
call fcn.0040461c
xor eax, eax
push ebp
push 0x40da44
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.004041dc
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040d7a0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40da1e
xor edx, edx
push ebp
push 0x40da17
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x20], 0x2801
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2821]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40da00
cmp dword [ebp - 0x1c], 4
jne 0x40d98b
cmp dword [ebp - 0x20], 4
jne 0x40d98b
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x2821]
mov ecx, 4
call fcn.00402694
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00406d0c
jmp 0x40da00
cmp dword [ebp - 0x1c], 7
jne 0x40d9f3
cmp dword [ebp - 0x20], 2
jle 0x40d9f3
jmp 0x40d99c
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0
jle 0x40d9bc
mov eax, dword [ebp - 0x20]
dec eax
cmp eax, 0x2800
jbe 0x40d9b2
call fcn.00403770
cmp byte [ebp + eax - 0x2821], 0
je 0x40d999
lea edx, [ebp - 0x2821]
mov eax, ebx
mov ecx, dword [ebp - 0x20]
call fcn.00404278
lea eax, [ebp - 0x2828]
push eax
mov eax, dword [ebx]
mov ecx, 0x40da5c
mov edx, 0x40da68
call fcn.0040ca24
mov edx, dword [ebp - 0x2828]
mov eax, ebx
call fcn.004041dc
jmp 0x40da00
mov edx, ebx
lea eax, [ebp - 0x2821]
call fcn.004075e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40da1e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40da4b
lea eax, [ebp - 0x2828]
call fcn.00404188
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041ac
ret