joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589a71
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5a206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x48], 0
test ebx, ebx
je 0x539dcd
cmp dword [ebp + 8], 0
jle 0x539dcd
lea eax, [ebp - 0x44]
push eax
call fcn.0053ffa0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x48], 1
call fcn.0053f9e0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x599954
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0056bb6f
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov esi, eax
cmp edx, 0x10
jb 0x539d85
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x539d7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x539ded
push edx
push ecx
call fcn.005623bc
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test esi, esi
jne 0x539daa
lea ecx, [ebp - 0x44]
or esi, 0xffffffff
call fcn.0053f970
mov eax, esi
jmp 0x539dd2
push esi
push 1
push dword [ebp + 8]
push ebx
call fcn.0056c6a2
push esi
call fcn.0056bde3
add esp, 0x14
lea ecx, [ebp - 0x44]
xor esi, esi
call fcn.0053f970
mov eax, esi
jmp 0x539dd2
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562376
mov esp, ebp
pop ebp
ret
call fcn.005681a6
int3
Function at 0x53b1f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589b78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5a206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x53b329
cmp byte [ebx + 0x3d], 0
je 0x53b329
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x53b244
xor al, al
jmp 0x53b32b
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00539e20
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x53b29f
sub eax, 1
je 0x53b2a3
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x53b2f9
xor bl, bl
jmp 0x53b2fb
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x53b2db
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.0056c6a2
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x53b29b
cmp byte [ebx + 0x3d], 0
je 0x53b2f9
test esi, esi
jne 0x53b260
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00534000
jmp 0x53b257
mov bl, 1
cmp edx, 0x10
jb 0x53b325
inc edx
mov ecx, eax
cmp edx, 0x1000
jb 0x53b31b
mov eax, dword [eax - 4]
add edx, 0x23
sub ecx, eax
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x53b347
push edx
push eax
call fcn.005623bc
add esp, 8
mov al, bl
jmp 0x53b32b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562376
mov esp, ebp
pop ebp
ret
call fcn.005681a6
int3
Function at 0x53b5e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589bd0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], 0x599974
call fcn.0056238c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.005601b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push 0
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], 0x5999b4
call fcn.0053b350
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5444f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x5a206c]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 8]
push edi
mov edx, dword [eax]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi]
mov dword [esi], 0
mov dword [eax], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [edi], 0
cmp ecx, 5
jae 0x54455f
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.00562376
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov al, byte [edx]
mov dword [esp + 0x2c], ecx
cmp al, 0xe1
jae 0x5446a2
xor edx, edx
movzx eax, al
mov ecx, 9
div ecx
mov ecx, 5
mov dword [esp + 0x20], edx
xor edx, edx
movzx eax, al
div ecx
push ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], eax
call fcn.00544490
add esp, 4
test eax, eax
jne 0x5446a7
mov ecx, dword [esp + 0x10]
mov edx, ecx
movups xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0xc]
push edi
push ecx
push esi
push dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x48]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x94], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x98], 1
mov dword [esi], eax
call fcn.005441f0
mov ecx, dword [esp + 0x6c]
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov dword [eax], ecx
test esi, esi
jne 0x54467a
cmp dword [edi], 3
mov eax, 6
cmove esi, eax
push dword [esp + 0x48]
push 0x5a2acc
call dword [str.GetUserNameW]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.00562376
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [esp + 0xac]
pop edi
pop esi
xor ecx, esp
call fcn.00562376
mov esp, ebp
pop ebp
ret
Function at 0x544fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589910
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5a206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x58e104
call fcn.0056238c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.005601b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5565f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x158
mov ecx, dword [ebp + 8]
mov dword [esp + 0x14], edx
push esi
push edi
test ecx, ecx
je 0x5567bb
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5567bb
cmp esi, 0x40
jb 0x5567bb
movups xmm0, xmmword [ecx + 0x10]
mov edx, 0x5a4d
movups xmm1, xmmword [ecx]
movups xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [ecx + 0x20]
movd eax, xmm1
movups xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm1
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [esp + 0x50], xmm0
cmp ax, dx
jne 0x5567bb
mov edx, dword [esp + 0x5c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x5567bb
lea eax, [edx + ecx]
mov ecx, 0x3e
mov esi, eax
mov dword [esp + 0x18], eax
lea edi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x68], 0x4550
jne 0x5567bb
mov eax, 0xe0
cmp word [esp + 0x7c], ax
jne 0x5567bb
mov eax, dword [esp + 0x6c]
shr eax, 0x10
lea ecx, [eax + eax*4]
shl ecx, 3
lea eax, [edx + 0xf8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x5567bb
push ecx
call fcn.00574309
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x5567bb
movzx edi, word [esp + 0x6e]
mov dword [esp + 0x14], edi
lea esi, [edi + edi*4]
shl esi, 3
push esi
push 0
push eax
call fcn.005648b0
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, 0xf8
push esi
push eax
push dword [esp + 0x18]
call fcn.00563db0
mov esi, dword [esp + 0xc8]
xor edx, edx
mov ecx, dword [esp + 0xac]
mov eax, esi
div ecx
add esp, 0xc
test edx, edx
je 0x55671d
lea esi, [eax + 1]
imul esi, ecx
test edi, edi
je 0x556752
mov edi, dword [esp + 0x10]
add edi, 8
mov ecx, dword [edi]
test ecx, ecx
je 0x556748
xor edx, edx
mov eax, ecx
div dword [esp + 0xa0]
test edx, edx
je 0x556746
sub ecx, edx
add ecx, dword [esp + 0xa0]
add esi, ecx
add edi, 0x28
sub dword [esp + 0x14], 1
jne 0x556728
push 0x40
push 0x1000
push esi
push 0
call dword [0x58d110]
mov edi, eax
test edi, edi
jne 0x556771
lea eax, [edi + 0xb]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x68]
push edi
push dword [esp + 0x14]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00556080
add esp, 0x10
test eax, eax
jne 0x556799
mov eax, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x6c]
push esi
push edi
push ecx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00556240
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55d450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
mov ebx, ecx
xor cl, cl
mov dword [ebp - 0x14], eax
mov byte [ebp - 1], cl
test eax, eax
je 0x55d62c
test ebx, ebx
je 0x55d62c
push esi
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x55d480
sub esi, ecx
sar esi, 1
push edi
lea eax, [esi*2 + 2]
push eax
call fcn.005623ca
mov edi, eax
add esp, 4
test edi, edi
je 0x55d622
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.005648b0
add esp, 0xc
lea eax, [esi*2 + 1]
push 0
push 0
push eax
push edi
push esi
push ebx
push 0
push 0
call dword [0x58d098]
mov ebx, edi
lea ecx, [ebx + 1]
nop dword [eax + eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x55d4e0
sub ebx, ecx
mov ecx, 0
je 0x55d55f
cmp ebx, 0x40
jb 0x55d553
movsx eax, bl
mov edx, ebx
and edx, 0xffffffc0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [edi + ecx]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + ecx], xmm1
movups xmm0, xmmword [edi + ecx + 0x10]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x10], xmm0
movups xmm0, xmmword [edi + ecx + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x20], xmm0
movups xmm0, xmmword [edi + ecx + 0x30]
pxor xmm1, xmm0
movups xmmword [edi + ecx + 0x30], xmm1
add ecx, 0x40
cmp ecx, edx
jb 0x55d510
cmp ecx, ebx
jae 0x55d55f
xor byte [ecx + edi], bl
inc ecx
cmp ecx, ebx
jb 0x55d557
lea eax, [ebx + ebx]
mov dword [ebp - 0x10], eax
inc eax
push eax
mov dword [ebp - 0xc], eax
call fcn.005623ca
mov esi, eax
add esp, 4
test esi, esi
je 0x55d60e
push dword [ebp - 0xc]
push 0
push esi
call fcn.005648b0
lea eax, [ebx + ebx]
push eax
push 0
push esi
call fcn.005648b0
xor ecx, ecx
add esp, 0x18
mov dword [ebp - 0xc], ecx
test ebx, ebx
je 0x55d5f2
nop
movzx ecx, byte [ecx + edi]
xor eax, eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
mov eax, ecx
and eax, 0xf
shr ecx, 4
movsx eax, byte [eax + 0x59971c]
push eax
movsx eax, byte [ecx + 0x59971c]
push eax
push 0x59a2c4
lea eax, [ebp - 8]
push 3
push eax
call fcn.0053ec50
mov ecx, dword [ebp - 0xc]
add esp, 0x14
movzx eax, byte [ebp - 8]
mov byte [esi + ecx*2], al
movzx eax, byte [ebp - 7]
mov byte [esi + ecx*2 + 1], al
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
jb 0x55d5a0
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push eax
push esi
push 0
push 0
call dword [0x58d08c]
push esi
call fcn.00562387
add esp, 4
push edi
mov bl, 1
call fcn.00562387
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x560c35
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x58c6ce
call fcn.00562c50
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x560d6a
cmp byte [edi + 0x3e], bl
je 0x560d6a
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x58d2d4]
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x560c82
xor al, al
jmp 0x560d6c
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0053b090
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x560cb7
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x560cc1
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [0x58d2d4]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x560cf1
sub eax, 1
jne 0x560d4f
mov edi, dword [ebp - 0x30]
jmp 0x560cf7
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x560d07
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x560d31
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x560d18
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.0056c6a2
add esp, 0x10
cmp esi, eax
jne 0x560d5a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x560d58
test esi, esi
jne 0x560ca9
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00534000
jmp 0x560ca3
dec eax
sub eax, 1
jne 0x560d5e
inc eax
jmp 0x560d5c
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00533bc0
mov al, bl
jmp 0x560d6c
mov al, 1
call fcn.00562c0b
ret

Function at 0x57c850
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c513

Function at 0x57c85b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c694
Function at 0x402e8c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402ee5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402d28
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402d28
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402ecf
inc ebx
jmp 0x402eb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402eec
lea eax, [ebp - 8]
call fcn.00404668
ret

Function at 0x402ef4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404668
test esi, esi
jne 0x402f2b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404758
jmp 0x402f4c
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d28
mov dword [esp], eax
test esi, esi
je 0x402f4c
cmp dword [ebx], 0
je 0x402f4c
dec esi
jmp 0x402f33
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403724
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x49e020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037bc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40379c
xor eax, eax
push ebp
push 0x403795
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40379c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x49e020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x49e020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044e4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4a304c], 0
je 0x404545
cmp word [0x4a3220], 0xd7b2
jne 0x40450d
cmp dword [0x4a3228], 0
jbe 0x40450d
mov eax, 0x4a321c
call dword [0x4a3238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49e074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40456c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49e030], 0
jne 0x404561
push 0
push 0x49e06c
push 0x49e074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4069d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406a3a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004048d8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004031e4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406a24
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a41
lea eax, [ebp - 0x10]
call fcn.00404668
ret

Function at 0x409474
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b28
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40948d
test al, 0x10
jne 0x409491
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40c004
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c03d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404758
jmp 0x40c046
mov eax, ebx
mov edx, esi
call fcn.004046bc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c050
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c071
mov al, byte [esp]
jmp 0x40c073
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c708
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c570
mov eax, dword [0x4a2594]
cmp byte [eax], 0
je 0x40c784
mov eax, dword [0x4a2204]
call fcn.00403014
call fcn.00402c54
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004096c4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c7cc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c7ba
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4a2174]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4a3668]
call fcn.00405df0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret