joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4250d0
Capabilities:
Accept command line arguments
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b33c4]
sub esp, 0x97c
push ebx
push ebp
push esi
shr eax, 3
xor esi, esi
push edi
mov edi, dword [0x434414]
cmp eax, esi
jbe 0x4252da
mov dword [esp + 0x34], 0x9e3779b9
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], eax
jmp 0x425116
mov edi, dword [esp + 0x28]
xor esi, esi
cmp dword [0x7b33c4], 0x1c
jne 0x42512d
lea eax, [esp + 0x40]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [0x42b2b4]
mov edi, dword [0x42b2b0]
mov ebx, dword [str.WZ1_n]
mov ebp, dword [0x42b2bc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0xc6ef3720
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], 0x20
jmp 0x42516e
mov eax, dword [esp + 0x1c]
xor esi, esi
mov ecx, eax
shr ecx, 5
add ecx, ebp
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x14]
mov edx, eax
shl edx, 4
add edx, ebx
add ecx, eax
xor edx, ecx
mov dword [esp + 0x10], edx
mov dword [0x7b3334], esi
mov eax, dword [esp + 0x24]
add dword [0x7b3334], eax
mov edx, dword [0x7b3334]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x3c]
add dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
sub dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, ecx
shl eax, 4
add eax, edi
add esi, ecx
cmp dword [0x7b33c4], 0x1be
mov dword [esp + 0x10], eax
jne 0x425208
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
shr ecx, 5
add ecx, dword [esp + 0x38]
cmp dword [0x7b33c4], 0x979
mov dword [0x7b3338], 0xff6b3619
mov dword [0x7b333c], 0xffffffff
mov dword [esp + 0x24], ecx
jne 0x425249
push 0
lea ecx, [esp + 0x18c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
mov eax, dword [esp + 0x10]
xor eax, esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x34]
add dword [esp + 0x20], eax
sub dword [esp + 0x14], eax
dec dword [esp + 0x2c]
jne 0x425168
cmp dword [0x7b33c4], 0x8d4
jne 0x42528f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esi], edx
mov dword [esi + 4], eax
cmp dword [0x7b33c4], 0x17
jne 0x4252c9
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea ecx, [esp + 0x48]
push ecx
push 0x403f20
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x30]
mov dword [esp + 0x28], esi
jne 0x425110
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x97c
ret
Function at 0x67f83c90
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
mov esi, 0xffffffff
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
lock xadd dword [ebx + 4], esi
dec esi
test byte [0x67f8d018], 8
jne 0x67f83d08
test esi, esi
jne 0x67f83cf2
mov eax, dword [ebx + 8]
sub ebx, 0xc
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x67f8f410
mov dword [esp + 8], str.ddrawex4_Release
mov dword [esp + 4], 0x67f8d018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x67f83cb9
Function at 0x67f85f00
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x67f8d028], 8
jne 0x67f85f40
test ebx, ebx
je 0x67f85f70
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x67f9029c
mov dword [esp + 8], str.ddrawex_factory_Release
mov dword [esp + 4], 0x67f8d028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
test ebx, ebx
jne 0x67f85f2d
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4

Function at 0x67f85fb0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x67f8d028], 8
jne 0x67f85ff0
test ebx, ebx
je 0x67f86020
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x67f9029c
mov dword [esp + 8], str.ddrawex_class_factory_Release
mov dword [esp + 4], 0x67f8d028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
test ebx, ebx
jne 0x67f85fdd
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
Function at 0x67f863f0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x67f8d028], 8
jne 0x67f86478
test edi, edi
jne 0x67f86580
mov dword [esp + 8], 8
mov dword [esp + 4], 8
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x67f8658a
mov dword [eax], sym._ddrawex_factory_QueryInterface_12
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._ddrawex_factory_QueryInterface_12
sub esp, 0xc
mov ebx, eax
test eax, eax
js 0x67f86528
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
je 0x67f86570
mov eax, ebx
shr eax, 0x10
je 0x67f86550
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], 0x67f902d4
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str.outer_unknown__p__riid__s__out__p._n
mov dword [esp + 8], str.ddrawex_factory_create
mov dword [esp + 4], 0x67f8d028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x67f86408
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, bx
mov dword [esp], 0x67f902c3
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_1
jmp 0x67f864ed
mov eax, 0x67f902bc
jmp 0x67f864ed
mov ebx, 0x80040110
jmp 0x67f86469
mov ebx, 0x8007000e
jmp 0x67f86469
Function at 0x67f87540
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
mov esi, 0xffffffff
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
lock xadd dword [ebx + 4], esi
dec esi
test byte [0x67f8d038], 8
jne 0x67f875d0
test esi, esi
jne 0x67f875bb
mov eax, dword [ebx + 8]
sub ebx, 4
mov edx, dword [eax]
mov dword [esp + 4], 0x67f932d0
mov dword [esp], eax
call dword [edx + 0xa8]
mov eax, dword [ebx + 0xc]
sub esp, 8
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str._p_decreasing_refcount_to__lu._n
mov dword [esp + 8], str.ddrawex_surface4_Release
mov dword [esp + 4], 0x67f8d038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x67f87569

Function at 0x67f8ad10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
test ebx, ebx
je 0x67f8ae70
mov eax, dword [ebx]
lea edx, [ebp - 0x1c]
lea edi, [ebp - 0x20]
mov dword [esp + 4], 0x67f932d0
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [eax + 0xa4]
sub esp, 0x10
test eax, eax
js 0x67f8ad70
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x67f8ad70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x67f8d038], 8
jne 0x67f8ae40
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax + 8], 1
mov esi, eax
sub esp, 0xc
mov dword [eax], sym._ddrawex_surface3_QueryInterface_12
add esi, 4
mov dword [eax + 4], 0x67f918c0
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 4]
mov eax, dword [ebx]
mov dword [esi + 8], ebx
sub esp, 4
mov dword [ebp - 0x20], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], edi
mov dword [esp + 4], 0x67f932d0
mov dword [esp], ebx
call dword [eax + 0xa0]
sub esp, 0x14
test eax, eax
js 0x67f8ae10
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x67f8d038], 2
je 0x67f8adfd
mov dword [esp + 0xc], str.IDirectDrawSurface4_SetPrivateData_failed_n
mov dword [esp + 8], str.dds_get_outer
mov dword [esp + 4], 0x67f8d038
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
jmp 0x67f8adfd
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Creating_new_ddrawex_surface_wrapper_for_surface__p_n
mov dword [esp + 8], str.dds_get_outer
mov dword [esp + 4], 0x67f8d038
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x67f8ad7d
xor eax, eax
jmp 0x67f8ad61
Function at 0x67f8b200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x67f8b25b
cmp byte [esi + ebx - 1], 0xa
je 0x67f8b22f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x67fa00a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x67f8bd30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x67fa00c0]
test eax, eax
je 0x67f8bde8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x67f8bd70
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x67f8bd5c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x67f8be1d
mov dword [esp + 4], 0x67f99ccc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x67fa00c0], eax
sub esp, 8
test eax, eax
jne 0x67f8bd4d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x67f8bd5e
Function at 0x67f8be30
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x67f8bfc8
mov eax, dword [esi]
test eax, eax
je 0x67f8bfb0
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x67f8bfd8
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x67f8bfa0
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
not eax
pop ebx
shr eax, 0x1f
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x67f8bf66
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x67f8bea0
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x67f8bfca
Function at 0x402964
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029a1
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029c1
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004044b4
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b88
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404244
test esi, esi
jne 0x402bbe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404334
jmp 0x402bdc
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a3c
mov edi, eax
test esi, esi
je 0x402bdc
cmp dword [ebx], 0
je 0x402bdc
dec esi
jmp 0x402bc5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40333c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x490020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033b4
xor eax, eax
push ebp
push 0x4033ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x490020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x490020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040c8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49304c], 0
je 0x404129
cmp word [0x493220], 0xd7b2
jne 0x4040f1
cmp dword [0x493228], 0
jbe 0x4040f1
mov eax, 0x49321c
call dword [0x493238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49006c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404150
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x490030], 0
jne 0x404145
push 0
push 0x490064
push 0x49006c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406370
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4063d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044b4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ee0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4063c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063dd
lea eax, [ebp - 0x10]
call fcn.00404244
ret

Function at 0x40bce4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bd1d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404334
jmp 0x40bd26
mov eax, ebx
mov edx, esi
call fcn.00404298
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bd30
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bd51
mov al, byte [esp]
jmp 0x40bd53
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c3d8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c250
mov eax, dword [0x4924ec]
cmp byte [eax], 0
je 0x40c454
mov eax, dword [0x4921c4]
call fcn.00402ca4
call fcn.004028f0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408ea8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c49c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c48a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x492160]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x493668]
call fcn.00405884
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret