joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409920
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0xac
push ebx
push esi
mov esi, dword [esp + 0xb8]
push edi
push ebp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push eax
push str.NetworkLogon
push reloc.WINMM.dll_Ordinal_2
call edi
test eax, eax
jne 0x409a3d
xor ebx, ebx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
mov edx, dword [esp + 0x14]
push ecx
push ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x24], ebx
push ebx
mov dword [esp + 0x24], 4
push str.UserProfiles
push edx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], ebx
je 0x409a3d
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], bl
push eax
mov dword [esp + 0x18], 0x50
push ecx
push ebx
call sub.MPR.dll_WNetGetUserA
cmp byte [esp + 0x1c], bl
je 0x409a3d
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x6c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionProfileList_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x78]
add esp, 0xc
push ecx
push edx
push reloc.WINMM.dll_Ordinal_2
call edi
test eax, eax
jne 0x409a3d
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], bl
push eax
mov edx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x1c], 0x50
push ebx
push ebx
push str.ProfileImagePath
push edx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x1c], bl
je 0x409a3d
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409a3d
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Plus_.bmp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xac
ret
Function at 0x409a60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
push ebp
mov ebp, dword [esp + 0x120]
mov ebx, 1
push ebp
call fcn.004098e0
mov dword [esp + 0x14], eax
add esp, 4
push 0
push str.TileWallpaper
push str.Control_PanelDesktop
push Ordinal_2
call fcn.00401850
add esp, 0x10
mov esi, eax
push 0
push str.WallpaperStyle
push str.Control_PanelDesktop
push Ordinal_2
call fcn.00401850
add esp, 0x10
and eax, 2
mov edi, eax
test ebp, ebp
je 0x409b22
cmp byte [ebp], 0
je 0x409b22
cmp dword [0x40e41c], 0
je 0x409b22
push ebp
push esi
push str.TileWallpaper
push str.Control_PanelDesktop
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
push ebp
push edi
push str.WallpaperStyle
push str.Control_PanelDesktop
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
push ebp
and edi, 2
push ebx
push str.Dither
push str.MasterThemeSelector
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
push ebp
push edi
push str.Stretch
push str.MasterThemeSelector
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
push str.ThemeImageBPP
push str.SoftwareMicrosoftPlus_Themes
push Ordinal_2
call fcn.00401850
mov dword [esp + 0x20], eax
add esp, 0x10
push ebx
push str.Dither
push str.SoftwareMicrosoftPlus_Themes
push Ordinal_2
call fcn.00401850
add esp, 0x10
mov ebp, eax
push edi
push str.Stretch
push str.SoftwareMicrosoftPlus_Themes
push Ordinal_2
call fcn.00401850
add esp, 0x10
test esi, esi
jne 0x409bb5
test eax, eax
je 0x409bb5
mov esi, dword [esp + 0x124]
test esi, esi
je 0x409b95
mov edi, dword [0x40e1cc]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x409ba1
push 0
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
call ebx
mov edi, eax
test esi, esi
je 0x409bad
mov ebx, dword [0x40ddb0]
jmp 0x409bde
push 1
call ebx
mov ebx, eax
jmp 0x409bde
mov esi, dword [esp + 0x124]
mov edi, 0
test esi, esi
je 0x409bcd
mov edi, dword [0x40e1cc]
neg edi
mov ebx, 0
test esi, esi
je 0x409bde
mov ebx, dword [0x40ddb0]
neg ebx
lea eax, [esp + 0x98]
push eax
call fcn.00409920
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1c], 0
add esp, 4
push pe_nt_image_headers32
push eax
push ecx
call fcn.0040b700
mov esi, dword [esp + 0x128]
mov dword [esp + 0x20], eax
add esp, 0xc
cmp byte [esp + 0x18], 0
je 0x409c4b
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409c4b
test edi, edi
je 0x409c44
movzx eax, bx
movzx ecx, di
shl eax, 0x10
or eax, ecx
cmp eax, dword [esp + 0x14]
jne 0x409c4b
lea esi, [esp + 0x98]
mov eax, dword [esp + 0x10]
push ebp
push eax
push ebx
push edi
push esi
call fcn.0040b820
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x40a410
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
je 0x40a420
cmp eax, 8
je 0x40a43b
jmp 0x40a45f
mov eax, dword [esp + 4]
push eax
push 0x400
push 0x40ddc0
push 0x410328
push str.Background
jmp 0x40a454
mov eax, dword [esp + 4]
push eax
push 0x400
push 0x40ddc0
push 0x410328
push str.WindowText
push 0x410330
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [0x40ddc0], 0
je 0x40a476
push 0x40ddc0
call fcn.00402c50
add esp, 4
ret
xor eax, eax
ret
Function at 0x40a9d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x58
lea eax, [esp + 4]
push esi
push edi
xor esi, esi
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x40a930
push reloc.WINMM.dll_Ordinal_2
call edi
test eax, eax
jne 0x40aab4
lea eax, [esp + 0x10]
push 0x50
mov ecx, dword [esp + 0x68]
push eax
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x40aaa9
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x40aaa9
mov eax, dword [esp + 0x68]
cmp eax, esi
je 0x40aa51
lea ecx, [esp + 0x6c]
mov byte [eax], 0
push ecx
push eax
mov eax, dword [esp + 0x10]
push esi
push esi
push 0x40a968
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
jmp 0x40aa57
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x70]
test eax, eax
je 0x40aa78
lea ecx, [esp + 0x74]
mov byte [eax], 0
push ecx
push eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0x40a978
push eax
call esi
mov eax, dword [esp + 0x78]
test eax, eax
je 0x40aa99
lea ecx, [esp + 0x7c]
mov byte [eax], 0
push ecx
push eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0x40a970
push eax
call esi
mov eax, dword [esp + 8]
mov esi, 1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x58
ret

Function at 0x40aac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x30
push ebx
push esi
mov esi, dword [esp + 0x40]
push edi
push ebp
xor edi, edi
mov eax, dword [esp + 0x44]
mov byte [esi], 0
cmp eax, edi
jne 0x40aae2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push eax
xor ebp, ebp
call fcn.0040a990
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
add esp, 4
push ebx
push esi
push 0x28
push eax
push ebp
push ebp
push ebp
call fcn.0040a9d0
add esp, 0x1c
test eax, eax
je 0x40ab48
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40ab48
inc ebp
push ebx
lea eax, [esp + 0x1c]
push esi
push 0x28
mov byte [esi], 0
push eax
push 0
push 0
push ebp
call fcn.0040a9d0
add esp, 0x1c
test eax, eax
jne 0x40ab16
cmp byte [esi], 0
je 0x40ab5e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ab5e
mov edi, 1
test edi, edi
jne 0x40abb0
mov eax, dword [esp + 0x14]
push str..jpg
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40ab87
push str.JPEGIM32.FLT
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test edi, edi
jne 0x40abb0
mov eax, dword [esp + 0x14]
push str..pcx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40abb0
push str.PCXIMP32.FLT
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x40b500
Capabilities:
Delete file

Disassembly:
sub esp, 0x4f0
lea eax, [esp + 0x14]
push ebx
push esi
push edi
mov edi, dword [esp + 0x500]
push ebp
push eax
push 0x54
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x40b530
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4f0
ret
cmp dword [esp + 0x38], 0
jne 0x40b544
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4f0
ret
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp word [esp + 0x4a], 8
ja 0x40b57a
lea eax, [esp + 0x100]
push eax
push 0x100
push 0
push esi
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov dword [esp + 0x5c], eax
jmp 0x40b5aa
cmp dword [esp + 0x4c], 3
jne 0x40b5aa
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], ecx
mov dword [esp + 0x108], edx
mov dword [esp + 0x5c], 3
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
lea eax, [esp + 0x78]
push 0x1002
mov esi, dword [esp + 0x50c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
mov edi, eax
jne 0x40b5dd
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4f0
ret
mov word [esp + 0x14], 0x4d42
mov eax, dword [esp + 0x5c]
mov word [esp + 0x1a], 0
mov word [esp + 0x1c], 0
shl eax, 2
add eax, dword [esp + 0x3c]
push 0xe
add eax, dword [esp + 0x54]
lea ecx, [esp + 0x18]
add eax, 0xe
push ecx
push edi
mov ebx, dword [sym.imp.KERNEL32.dll__lwrite]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x22], eax
sub eax, dword [esp + 0x5c]
mov dword [esp + 0x2a], eax
call ebx
cmp eax, 0xe
jne 0x40b6d7
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push ecx
push edi
call ebx
cmp eax, dword [esp + 0x3c]
jne 0x40b6d7
mov ebp, dword [esp + 0x5c]
lea ecx, [esp + 0x100]
shl ebp, 2
push ebp
push ecx
push edi
call ebx
cmp eax, ebp
jne 0x40b6d7
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x38]
push eax
push ecx
push edi
call ebx
cmp eax, dword [esp + 0x50]
jne 0x40b6d7
mov ebp, dword [esp + 0x50c]
test ebp, ebp
je 0x40b6c0
cmp byte [ebp], 0
je 0x40b6c0
lea eax, [esp + 0x10]
push 4
mov dword [esp + 0x14], 0x47414d53
push eax
push edi
call ebx
cmp eax, 4
jne 0x40b6d7
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push edi
call ebx
cmp eax, 4
jne 0x40b6d7
mov eax, dword [esp + 0x10]
push eax
push ebp
push edi
call ebx
cmp eax, dword [esp + 0x10]
jne 0x40b6d7
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4f0
ret
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4f0
ret
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7e7a5be3
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x73322142
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40c3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40c3df
pop dword [ebp - 0x50]
mov eax, 0xea0519ae
add eax, 0x163baa31
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x79bad66f
add dword [ebp - 0x60], 0xd4976edc
mov dword [ebp - 0x5c], 0x8551f3ff
sub dword [ebp - 0x5c], 0x531ea7ba
mov dword [ebp - 0x58], 0xfd65483
sub dword [ebp - 0x58], 0xc38a1055
mov dword [ebp - 0x54], 0x1ab4e18c
add dword [ebp - 0x54], 0xe54b1e74
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xba975a71
add dword [ebp - 0x60], 0xb9db0ee5
mov dword [ebp - 0x5c], 0x264e3442
sub dword [ebp - 0x5c], 0xe4e1d2cd
mov dword [ebp - 0x58], 0x3db1a67f
add dword [ebp - 0x58], 0x25bdc5ed
mov dword [ebp - 0x54], 0x2558a0fc
add dword [ebp - 0x54], 0xdaa75f04
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x72c925cf
sub eax, 0x7287e593
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a801
push 0
call eax
mov ecx, 0x559514e
add ecx, 0xfaa6f52a
mov edx, eax
mov edi, 0x1b74d767
sub edi, 0x1b331767
add edi, dword [ebp - 0x50]
mov esi, 0xdd6cd2bd
add esi, 0x4386d408
xor dword [ebp - 0x30], 0x4924082a
mov ebx, dword [edi]
xor dword [ebp - 0x48], 0xeb29fb1d
xor ebx, esi
mov dword [edx], ebx
mov dword [ebp - 0x48], 0x46b020dd
add edx, 0xedd1f498
sub edx, 0xedd1f494
add edi, 0x9d7390cf
add edi, 0x628c6f35
loop 0x40c4fc
add eax, 0x4226f2a8
add eax, 0xbdda1a0b
xor ebx, ebx
add ebx, eax
add eax, 0x942c7adc
add eax, 0x6bd38529
mov ecx, 0xc238c41e
sub ecx, 0xc1f8c41e
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x4029cc
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402a09
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402a29
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004047bc
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402c8c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040454c
test esi, esi
jne 0x402cc2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040463c
jmp 0x402ce0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402b40
mov edi, eax
test esi, esi
je 0x402ce0
cmp dword [ebx], 0
je 0x402ce0
dec esi
jmp 0x402cc9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4035a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x55d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40363c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40361c
xor eax, eax
push ebp
push 0x403615
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403658
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40361c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x55d020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x55d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40432c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x56704c], 0
je 0x40438d
cmp word [0x567220], 0xd7b2
jne 0x404355
cmp dword [0x567228], 0
jbe 0x404355
mov eax, 0x56721c
call dword [0x567238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x55d06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043b4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x55d030], 0
jne 0x4043a9
push 0
push 0x55d064
push 0x55d06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027b8
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x56704d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4044c8
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405dc4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ee8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405d3b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405ee8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405d3b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f04
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405dc4
xor eax, eax
push ebp
push 0x405dbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405b00
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405da2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405f24
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405da2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405dc4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405ede
cmp byte [ebp - 0xd], 0
jne 0x405e0b
cmp byte [ebp - 0x12], 0
je 0x405ede
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405e24
dec ebx
cmp byte [ebx], 0x2e
je 0x405e33
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405e23
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405ede
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405e70
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405ede
cmp byte [ebp - 0xd], 0
je 0x405ede
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405ede
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret