joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e1d9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x1019214]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edi, edi
cmp dword [0x1019098], edi
mov dword [ebp - 0x218], eax
je 0x100e3a0
push ebx
mov dword [ebp - 0x20c], 1
push esi
push dword [ebp - 0x20c]
lea eax, [ebp - 0x204]
push dword [0x10190c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push edi
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x1019098]
call fcn.0100a001
test eax, eax
mov ebx, dword [ebp + 0xc]
push 3
pop esi
jne 0x100e297
inc dword [ebp - 0x20c]
cmp dword [ebp - 0x20c], 0x64
jb 0x100e210
cmp dword [ebp - 0x20c], 0x64
jne 0x100e306
mov eax, 0xaa
push 0x10
movzx eax, ax
push 0xa8
push eax
push dword [ebp - 0x218]
push dword [0x1019530]
call fcn.01009e27
add esp, 0x14
jmp 0x100e39e
cmp ebx, edi
jbe 0x100e2bf
push 2
pop ecx
cmp ebx, ecx
jbe 0x100e2b2
cmp ebx, esi
je 0x100e2fe
push 4
pop eax
cmp ebx, eax
je 0x100e2f0
cmp ebx, 7
jne 0x100e2bf
mov word [ebp - 0x210], di
mov dword [ebp - 0x208], ecx
push dword [ebp - 0x208]
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
lea eax, [ebp - 0x204]
push eax
push dword [0x1019098]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100e261
mov eax, 0xa9
jmp 0x100e273
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x208], eax
jmp 0x100e2bf
mov dword [ebp - 0x208], edi
jmp 0x100e2bf
push edi
push edi
push 0x1004
push dword [0x1019084]
mov dword [ebp - 0x24c], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x204]
mov dword [ebp - 0x238], eax
call esi
cmp ebx, 1
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], edi
je 0x100e352
cmp ebx, 2
je 0x100e352
cmp ebx, 7
mov dword [ebp - 0x230], 5
jne 0x100e35c
mov dword [ebp - 0x230], 4
lea eax, [ebp - 0x24c]
push eax
push edi
push 0x104d
push dword [0x1019084]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x100e39e
push ebx
push dword [ebp - 0x208]
lea eax, [ebp - 0x210]
push eax
push esi
push dword [0x1019084]
call fcn.0100df5e
push esi
push dword [0x1019084]
call fcn.0100db24
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010167d4
leave
ret 8
Function at 0x100e724
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x1019214]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edi, dword [0x1019084]
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1032
push edi
mov dword [ebp - 0x20c], eax
call esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 0x34
push 0x34
movzx eax, ax
push 0x33
push eax
push dword [ebp - 0x20c]
push dword [0x1019530]
call fcn.01009e27
add esp, 0x14
cmp eax, 6
jne 0x100e875
push ebx
push ebx
push 0xb
push edi
call esi
or dword [ebp - 0x208], 0xffffffff
push 2
mov dword [ebp - 0x210], ebx
push 0xffffffffffffffff
jmp 0x100e836
test ebx, ebx
je 0x100e7db
and dword [ebp - 0x23c], 0
lea eax, [ebp - 0x204]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x244]
push eax
push ebx
push 0x1073
push edi
mov dword [ebp - 0x22c], 0x100
call esi
jmp 0x100e7e3
and word [ebp - 0x204], 0
lea eax, [ebp - 0x204]
push eax
push dword [0x1019098]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x100e81e
cmp ebx, eax
je 0x100e80a
push eax
push ebx
push 0x1008
push edi
call esi
jmp 0x100e82e
push 1
push eax
push eax
push eax
push edi
call fcn.0100df5e
and dword [ebp - 0x208], 0
jmp 0x100e82e
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x208], ebx
push 2
push dword [ebp - 0x208]
push 0x100c
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100e7a8
push 0
push 1
push 0xb
push edi
call esi
cmp dword [ebp - 0x210], 0
je 0x100e875
push 0x10
push 0x58
push 0x59
push dword [ebp - 0x20c]
push dword [0x1019530]
call fcn.01009e27
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010167d4
leave
ret 4
Function at 0x10168ec
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x10024d0
call fcn.01016b44
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1016929
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016929
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1016941
cmp eax, 0x20b
je 0x101692e
mov dword [ebp - 0x1c], ebx
jmp 0x1016955
cmp dword [ecx + 0x84], 0xe
jbe 0x1016929
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x101694f
cmp dword [ecx + 0x74], 0xe
jbe 0x1016929
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1059d94], 0xffffffff
or dword [0x1059d98], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10195b8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10195b4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1059d9c], eax
call fcn.01016b3c
cmp dword [0x1019220], ebx
jne 0x10169b0
push fcn.01016b3c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01016b25
push 0x1019010
push 0x101900c
call sub.msvcrt.dll__initterm
mov eax, dword [0x10195b0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10195ac]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1019008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1016a46
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1016a1a
cmp al, 0x22
jne 0x1016a0c
cmp byte [esi], 0x22
jne 0x1016a23
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1016a2d
cmp al, 0x20
jbe 0x1016a1f
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1016a51
movzx eax, word [ebp - 0x50]
jmp 0x1016a54
cmp byte [esi], 0x20
jbe 0x1016a23
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1016a46
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1016a71
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1016aa6
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01016b7f
ret
Function at 0x1016bad
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10024e8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1016c05
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x100213a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1016bf8
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1016c07
xor eax, eax
pop esi
leave
ret 4
Function at 0x40153a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
cmp byte [ebp - 0x104], 0
jne 0x4016a4
sbb al, 0x9c
pop es
add byte [edi + 0x5e], bl
pop ebx
pop ebp
ret 8
cmp byte [ebp - 0x104], 0
jne 0x4017f1
inc ebp
in al, dx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x44498f
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetFileAttributesExA
call sub.KERNEL32.dll_GetLastError
mov edi, eax
cmp dword [0x42406a], 0
je 0x40181c
mov ebx, edi
add ebx, edi
jmp 0x40181e
mov ebx, edi
mov esi, ebx
and esi, 0xffffffa8
or edi, edi
jne 0x40197b
test eax, eax
jne 0x5b334f
push dword [ebp + 0x10]
push edi
push esi
call fcn.004016d9
mov esi, eax
lea ecx, [ebp - 0x18]
call 0x44d3b6
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call 0x4b56f9
leave
ret 0xc
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0xdd73434
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x8d13609
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, edx
push ecx
push esi
push edi
call 0x1840bb20
test esi, eax
jne 0x405e30
cmp dword [0x794108dc], 0xffffffed
jl 0x405d58
movsb byte es:[edi], byte [esi]
test byte [ebx], al
mov ah, 0
test eax, eax
cmp al, byte [ebp + 0x8000036]
mov dword [0x410384], 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
adc eax, sym.imp.KERNEL32.dll_GetCommandLineW
mov esi, eax
test esi, esi
pop ss
mov eax, dword [0x410358]
popal
sal byte [ebp + 0x1d], 0x50
push str.CommandLineToArgvW
push 4
sbb al, al
dec ebx
add byte [edi - 0x5cf33b7d], dl
pop eax
add ebx, edi
add byte [ebp - 0x5091f040], al
add byte [eax], al
add byte [ecx + 0x18], ah
cld
push ecx
xchg ebx, eax
call eax
mov esi, eax
test esi, esi
je 0x405db3
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x6f]
push edx
push esi
push eax
jnp 0x405dcd
dec eax
add al, dl
mov edx, edi
or byte [ebx - 0x76a9f316], al
add dword [ebp + 0x5ffd5815], ecx
add byte [edx - 0x3fabb1db], bh
mov edx, 0xc0544e25
inc eax
add byte [ebx + 0x43ff6ad8], cl
call dword [sym.imp.MSVCRT.dll___p__environ]
push eax
call fcn.00405e87
mov edi, dword [ebp + 0x10]
sti
adc bl, bh
les ecx, [esp + esi]
push dword [ebp + ebp - 0x26]
jmp 0xf16296
pop edi
pop esi
dec edi
in eax, 0x5d
ret 0xc

Function at 0x4070d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jecxz 0x40711b
in al, dx
insd dword es:[edi], dx
in al, dx
push esp
fcomp qword [esi]
sbb ecx, dword [ebx + 0x56530c4d]
or al, 0x53
push esi
xor esi, esi
mov edx, dword [ebx - 0x76fbae5e]
push 0x9c608bf4
call [ecx]
jne 0x4070db
pop dword [eax]
mov dword [ebp - 4], esi
test al, al
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], esi
mov dword [ebp + 0x4f], edx
je 0x407bb2
mov ebx, dword [ebp + 0x14]
cmp al, 0x25
je 0x40714b
mov ecx, dword [edi - 0xc]
test eax, eax
je 0x407143
cmp eax, dword [esi]
fdiv qword [edx + 8]
mov esi, dword [edi + 0x76d570c]
call dword [ebp + 8]
add esp, 0x24
test eax, eax
jne 0xf0407bc3
mov ecx, dword [edi + 4]
mov eax, dword [edi]
xor eax, 0x558b2a4d
adc byte [eax + 0x23], al
inc ebp
mov al, byte gs:[edx - 0x56b778]
dec esi
iretd
dec dword [esi - 0x31]
jmp 0x487b9f
invalid
mov byte [eax + eax*4], dl
in eax, dx
stosd dword es:[edi], eax
leave
mov edi, 0xb09c6e48
stosb byte es:[edi], al
Function at 0x4080f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor edi, edi
sub byte [edi], cl
mov bh, 0x4a
xor edi, edi
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4080fe
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4080f7
push edx
push edi
mov edx, dword [edx + 0x10]
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
jecxz 0x40815b
add ecx, edx
push ecx
mov ebx, dword [ecx + 0x20]
add ebx, edx
mov ecx, dword [ecx + 0x18]
jecxz 0x40815a
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor edi, edi
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x408128
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x40811e
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
and al, 0x24
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop edi
pop edi
pop edx
mov edx, dword [edx]
jmp 0x4080ee
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
ror edx, 0xa4
imul edi
not esi
dec eax
dec edi
bswap esi
rcl esi, 0xf1
dec edx
ror ebx, 0xf7
sbb edx, 0x7d
or esi, 0xbf
rol edi, 0xce
neg esi
add edx, 0x33
neg ebx
and edx, 0xe1
mov esi, 0x1b
rcl esi, 0x81
neg eax
sub ebx, 0x32
not esi
rcl esi, 0x72
dec edi
bswap eax
neg ebx
imul edx
add eax, 0x93
neg ebx
neg ebx
sub esi, 0x8a
dec edi
rcl eax, 0x3a
not edi
inc eax
or esi, 0x13
rcl esi, 0x2d
mov ebx, 0xa
not esi
rol ebx, 0xa9
rcl esi, 0xcb
dec edi
inc ebx
not edx
not edx
rcr esi, 0x21
ror edi, 0xcf
bswap eax
dec ebx
sbb edx, 0x71
dec edi
xor ecx, ecx
xor edi, edi
and eax, 0x2a
dec edx
add esi, 0x26
imul eax
mov esi, 0x9c
imul esi
bswap edi
bswap esi
inc ebx
not eax
inc edi
bswap eax
imul edi
sub eax, 0x96
ror esi, 0xa2
and edi, 0xcd
imul esi
neg edx
add ebx, 0x1c
not ebx
sub esi, 0x40
rol edx, 3
sub esi, 0x47
rol edi, 0x14
ror ebx, 0xd
sbb edi, 0xcb
dec esi
sbb eax, 0x3e
inc edi
rol ebx, 0x48
dec esi
sub edi, 0xc4
dec ebx
inc eax
neg edx
inc ebx
dec esi
rcl eax, 0xa6
neg eax
imul ebx
imul edi
sub esi, 0x49
rcr edi, 0x28
and ebx, 0x17
neg eax
imul ebx
and ebx, 0xdf
imul edi
not eax
or esi, 0x83
mov ecx, dword [ebp + 0xc]
or ebx, 0x4a
sub edx, 0x57
neg esi
neg esi
mov ebx, 0xc3
mov eax, 0x21
sub edx, 0xe8
dec esi
bswap edx
rcl ebx, 0x5d
mov esi, 0x9d
sub edi, 0x84
dec ebx
imul edx
add edx, 0x37
dec esi
ror edx, 0x56
or esi, 0x13
bswap edx
not esi
neg edx
neg ebx
or edx, 0x81
sub edi, 0x3c
ror edx, 0x20
rol esi, 0xd4
not eax
sub eax, 0x5a
not eax
not eax
neg edx
sub ebx, 0xb8
mov esi, 0x48
not ebx
neg edi
rol edi, 0xb1
add edi, 0xb7
add ebx, 0x66
mov edx, 0x23
and esi, 0x9d
neg ebx
sub ebx, 0x65
sub esi, 0xdb
inc edx
imul ebx
rol edi, 0x23
bswap ebx
dec eax
imul edx
or edi, 0x14
mov edi, dword [ebp + 8]
mov eax, eax
xor eax, ebx
xor eax, esi
mov eax, ebx
xor ebx, esi
xor ebx, ebx
xor esi, esi
xor eax, ebx
xor ebx, esi
xor esi, ebx
xor eax, eax
mov eax, esi
not byte [edi]
mov eax, eax
xor eax, esi
xor ebx, esi
mov esi, esi
mov esi, esi
mov esi, esi
xor eax, esi
xor eax, ebx
xor esi, ebx
sub byte [edi], 0x46
mov ebx, eax
xor eax, ebx
xor eax, eax
xor esi, eax
xor ebx, esi
xor ebx, esi
xor eax, ebx
mov ebx, eax
xor ebx, eax
add byte [edi], 0x88
mov esi, esi
xor esi, esi
xor esi, eax
xor esi, ebx
mov ebx, eax
xor esi, ebx
xor esi, esi
xor esi, ebx
xor esi, ebx
imul byte [edi]
inc edi
loop 0x4011b8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40588b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4058ca
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4058ca
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4058ca
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4058ca
cmp dword [ecx + 0x74], 0xe
jbe 0x4058ca
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40b3c6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b463
push ebx
push esi
call fcn.0040b38f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b2d8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b410
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b462
push edi
push eax
call fcn.0040bfc6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b430
call fcn.00409f01
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b461
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b2d8
add esp, 0x20
test eax, eax
jne 0x40b44f
push edi
call fcn.00409f01
jmp 0x40b457
push ebx
call fcn.00409f01
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40c749
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4156a0
push 0x415698
push str.FlsAlloc
push 0x1e
call fcn.0040c60a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c77d
push dword [ebp + 8]
mov ecx, esi
call dword [0x413130]
call esi
jmp 0x40c783
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40c7c7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4156b0
push 0x4156a8
push str.FlsGetValue
push 0x20
call fcn.0040c60a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c7fe
push dword [ebp + 8]
mov ecx, esi
call dword [0x413130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x411c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411cad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411cad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402b9c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402bf5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402a38
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402a38
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402bdf
inc ebx
jmp 0x402bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402bfc
lea eax, [ebp - 8]
call fcn.00404058
ret

Function at 0x402c04
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404058
test esi, esi
jne 0x402c3b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404148
jmp 0x402c5c
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402a38
mov dword [esp], eax
test esi, esi
je 0x402c5c
cmp dword [ebx], 0
je 0x402c5c
dec esi
jmp 0x402c43
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40a014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403608
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035e8
xor eax, eax
push ebp
push 0x4035e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403624
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40a014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40a014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403ed4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40b044], 0
je 0x403f35
cmp word [0x40b218], 0xd7b2
jne 0x403efd
cmp dword [0x40b220], 0
jbe 0x403efd
mov eax, 0x40b214
call dword [0x40b230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40a060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f5c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40a020], 0
jne 0x403f51
push 0
push 0x40a058
push 0x40a060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404f08
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404f6e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042a0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ffc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404f58
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404f75
lea eax, [ebp - 0x10]
call fcn.00404058
ret

Function at 0x406f50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406f89
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404148
jmp 0x406f92
mov eax, ebx
mov edx, esi
call fcn.004040ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406f9c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406fbd
mov al, byte [esp]
jmp 0x406fbf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407654
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4074bc
mov eax, dword [0x40a3a8]
cmp byte [eax], 0
je 0x4076d0
mov eax, dword [0x40a304]
call fcn.00402f6c
call fcn.004029a8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406424
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x407718
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x407706
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x40a2e4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40b660]
call fcn.004048d8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret