joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e01fee4
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e01fee4
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8
Function at 0x2e01e565
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030a97
call fcn.2e02e6de
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e683
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e67a
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e01fee4
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e66d
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010e6c
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e01fee4
test al, al
jne 0x2e01e620
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e01fee4
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e623
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e65d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e654
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e01fee4
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e01fee4
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e01fee4
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e6bc
ret
Function at 0x2e01fee4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x2e01fef3
pop dword [ebp - 0x28]
mov eax, 0x94083e05
sub eax, 0x66063f12
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5ad4270
sub dword [ebp - 0x38], 0xb75afd25
mov dword [ebp - 0x34], 0xb86eff58
add dword [ebp - 0x34], 0x79c44ced
mov dword [ebp - 0x30], 0xc162a43d
sub dword [ebp - 0x30], 0x7516600f
mov dword [ebp - 0x2c], 0xb3701291
sub dword [ebp - 0x2c], 0xb3701291
lea eax, [ebp - 0x38]
push eax
mov eax, 0x3428bd1f
sub eax, 0x6258c57
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x8c0c6d81
add dword [ebp - 0x38], 0xe865fbd5
mov dword [ebp - 0x34], 0xc03592b2
add dword [ebp - 0x34], 0x8136cec3
mov dword [ebp - 0x30], 0x9873dcf9
sub dword [ebp - 0x30], 0x3504708d
mov dword [ebp - 0x2c], 0x37657bba
add dword [ebp - 0x2c], 0xc89a8446
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x30c64e00
add eax, 0xfd3ce2bc
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3c671
push 0
call eax
mov ecx, 0x3546
xor ebx, ebx
add ebx, eax
mov esi, 0xd545ef46
add esi, 0x58bf8eba
add esi, dword [ebp - 0x28]
mov edi, 0x89a8fc79
sub edi, 0x9c03be76
xor dword [ebp - 8], 0x864c0b77
mov edx, dword [esi]
sub dword [ebp - 0x24], 0x85d139a8
sub edx, edi
add dword [ebp - 0x10], 0x60978b27
mov dword [ebx], edx
mov dword [ebp - 4], 0xc3123d15
add ebx, 4
add esi, 4
loop 0x2e020011
add eax, 0x24ad0c5f
sub eax, 0x24ac4474
mov ebx, eax
add eax, 5
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x100042e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x10004309
mov byte [ebp - 8], 0
jmp 0x10004329
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.1000cbd0
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10004353
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x10004387
xor bl, bl
jmp 0x100043ac
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.1000cbd0
add esp, 0xc
test bl, bl
je 0x100043d5
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100043e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x1000442e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov cl, byte [ebp - 1]
movzx eax, cl
sub eax, 0xe8
je 0x100044ec
sub eax, 1
je 0x100044ec
sub eax, 0x16
jne 0x100044dd
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
inc esi
mov dword [ebp - 0x14], 1
push 1
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x1000448c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov cl, byte [ebp - 1]
cmp cl, 0x15
je 0x10004496
cmp cl, 0x25
jne 0x100044dd
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100044d0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
inc esi
mov dword [eax], esi
call fcn.10005a40
add esp, 4
add eax, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100049e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, 0xc7dda0
mov edi, 0x10
mov ebx, 0x420b10
nop dword [eax + eax]
sub esp, 0xc
lea ecx, [ebp - 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
lea eax, [ebp - 0xc]
push eax
lea ecx, [esi + 0x48]
mov eax, 0x411b50
call eax
sub esp, 0xc
mov dword [esi], 0
mov eax, 0x101
mov byte [esi + 0xa], 0
mov word [esi + 8], ax
lea ecx, [ebp - 0x18]
mov eax, 5
mov dword [esi + 0xc], 0
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0
mov word [esi + 0x10], 0xffff
mov dword [esi + 0x12], 0x400ffff
mov word [esi + 0x16], ax
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0x3e800000
mov dword [esi + 0x20], 0x3f800000
mov dword [esi + 0x24], 0x3f800000
mov dword [esi + 0x28], 0x3f800000
mov dword [esi + 0x2c], 0
mov dword [esp], 0
call ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x30]
mov eax, 0x411b50
call eax
mov dword [esi + 0x44], 0x477fff00
mov eax, 0x7530
mov word [esi + 0x3c], ax
lea esi, [esi + 0x140]
sub edi, 1
jne 0x10004a00
call fcn.10009a90
movzx ecx, byte [0x1002f559]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push ecx
push str.ReplaceEntranceMarkers
push str.MAIN
call esi
test eax, eax
setne byte [0x1002f559]
call fcn.10009a90
movzx ecx, byte [0x1002f558]
push eax
push ecx
push str.MagentaMarkers
push str.MAIN
call esi
test eax, eax
setne byte [0x1002f558]
call fcn.10009a90
movzx ecx, byte [0x1002f55a]
push eax
push ecx
push str.MarkersTransparency
push str.MAIN
call esi
test eax, eax
xorps xmm0, xmm0
mov eax, dword [0x1002b8c4]
setne byte [0x1002f55a]
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], edi
mov eax, dword [0x1002b8c8]
mov dword [eax], edi
mov eax, dword [0x1002b8c0]
mov dword [eax], edi
mov eax, 0x7316a0
call eax
push str.particle
mov eax, 0x731850
call eax
push eax
mov eax, 0x7319c0
call eax
push 0x100272e4
mov eax, 0x538730
call eax
push str.cylinder
mov esi, 0x722810
call esi
mov ecx, dword [0x1002b8c4]
push str.hoop
mov dword [ecx + 4], eax
call esi
mov ecx, dword [0x1002b8c4]
push str.diamond_3
mov dword [ecx + 0x10], eax
call esi
mov ecx, dword [0x1002b8c4]
push str.arrow
mov dword [ecx], eax
mov dword [ecx + 0x18], eax
call esi
mov ecx, dword [0x1002b8c4]
add esp, 0x1c
mov dword [ecx + 0x14], eax
mov eax, 0x7316b0
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005a40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x10005a86
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x10005ad7
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007c20
Capabilities:
Read .ini file

Disassembly:
push esi
call fcn.10009a90
movzx ecx, byte [0x1002f559]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push ecx
push str.ReplaceEntranceMarkers
push str.MAIN
call esi
test eax, eax
setne byte [0x1002f559]
call fcn.10009a90
movzx ecx, byte [0x1002f558]
push eax
push ecx
push str.MagentaMarkers
push str.MAIN
call esi
test eax, eax
setne byte [0x1002f558]
call fcn.10009a90
movzx ecx, byte [0x1002f55a]
push eax
push ecx
push str.MarkersTransparency
push str.MAIN
call esi
test eax, eax
pop esi
setne byte [0x1002f55a]
ret

Function at 0x10009c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.10009940
mov ecx, dword [0x1002f644]
mov esi, eax
test cl, 1
jne 0x10009c95
or ecx, 1
mov dword [0x1002f568], 0x10027270
mov dword [0x1002f644], ecx
mov dword [0x1002f570], 0
mov dword [0x1002f56c], 0
call fcn.100045c0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x10009cd1
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001251f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001255e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001255e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001255e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001255e
cmp dword [ecx + 0x74], 0xe
jbe 0x1001255e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10013937
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100138b9
Function at 0x100174e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10017583
push ebx
push esi
call fcn.100174af
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10017443
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10017530
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017582
push edi
push eax
call fcn.10014a27
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10017550
call fcn.100149ed
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10017581
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10017443
add esp, 0x20
test eax, eax
jne 0x1001756f
push edi
call fcn.100149ed
jmp 0x10017577
push ebx
call fcn.100149ed
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100178a4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023500
push 0x100234f8
push str.FlsAlloc
push 0x1f
call fcn.10017740
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100178d8
push dword [ebp + 8]
mov ecx, esi
call dword [0x10021140]
call esi
jmp 0x100178de
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10017922
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023510
push 0x10023508
push str.FlsGetValue
push 0x21
call fcn.10017740
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017959
push dword [ebp + 8]
mov ecx, esi
call dword [0x10021140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10017961
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023518
push 0x10023510
push str.FlsSetValue
push 0x22
call fcn.10017740
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001799b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10021140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
jmp loc.0042497a

Function at 0x4030dc
Capabilities:
Accept command line arguments

Disassembly:
call fcn.00403094
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40c014], eax
jmp loc.0041f15a

Function at 0x40310c
Capabilities:
Set thread local storage value

Disassembly:
push ebx
cmp dword [0x40c3d0], 0
jge 0x403120
mov eax, 0xe2
call fcn.00403e41
push 8
push 0x40
call sub.kernel32.dll_LocalAlloc
mov ebx, eax
test ebx, ebx
jne 0x40313e
mov eax, 0xe2
call fcn.00403e41
jmp 0x40314a
push ebx
mov eax, dword [0x40c3d0]
push eax
call sub.kernel32.dll_TlsSetValue
jmp 0x41469c

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
jmp 0x42286e

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
jmp loc.0041f6dc
mov eax, ebx
Function at 0x405d3e
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov dword [ebp - 4], eax
mov eax, 0x13
cmp cl, 0
jne 0x405d6b
mov eax, dword [ebp + 0xc]
cmp eax, 2
jge 0x405d61
mov eax, 2
cmp eax, 0x12
jle 0x405d6b
mov eax, 0x12
mov dword [ebp + 0xc], eax
push eax
mov eax, 0x270f
cmp byte [ebp + 0x10], 2
jb 0x405d7d
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
call fcn.004062da
mov edi, dword [ebp - 4]
movzx eax, word [ebp - 0x1c]
sub eax, 0x7fff
cmp eax, 2
jae 0x405da7
lea esi, [eax + eax*2 + 0x405d38]
jmp 0x416af6
in eax, 0x50
mov eax, ecx
push eax
mov eax, edx
sub esp, 4
mov dword [esp], eax
mov eax, ebx
add esp, 0xfffffffc
mov dword [esp], eax
mov eax, 0x4b3fdacb
add eax, 0x5c
push eax
add esp, 0xfffffffc
mov eax, esp
mov dword [eax], ebp
mov eax, esi
push eax
mov esi, edi
add esp, 0xfffffffc
mov dword [esp], esi
mov esi, 0x335ce171
add esi, 0xcce3af0f
mov ecx, 0x5b4e2c7a
add ecx, 0xa4b21486
xor esi, ecx
mov ecx, 0
xor ecx, esi
mov edi, 0xffffff9d
sub ecx, edi
mov eax, dword [ecx - 0x63]
push eax
pop edi
dec edi
mov esi, dword [edi + 1]
mov ecx, esi
mov ebx, ecx
mov edx, 0xffffffff
xor ebx, edx
and ebx, 0x1292176b
and esi, 0xed6de894
or esi, ebx
mov ebx, esi
xchg ebx, edx
add esp, 0xfffffffc
mov edi, esp
mov dword [edi], edx
pop edx
mov ecx, 4
sub esp, ecx
mov esi, esp
mov edi, esi
mov dword [edi], edx
mov edi, 0x683edc11
mov esi, 0x9509b08f
xor esi, edi
xor edx, esi
mov ecx, 0x64f0847e
xor edx, ecx
mov ecx, edx
or ecx, edx
jne 0x405e71
mov edi, 0
mov eax, 0
xor edi, eax
push edi
mov edi, esp
add edi, 0xffffff93
dec edi
mov ecx, dword [edi + 0x6e]
mov edx, 0xfffffffc
sub esp, edx
xor ebx, ebx
add ebx, ecx
mov esi, 0xfffffffc
add esp, esi
mov dword [esp], ebx
mov eax, 0x7d201084
xor eax, 0x6fb22210
xor ecx, eax
and ecx, 0xffff
mov edi, ecx
push edi
mov esi, dword [esp]
add esp, 4
xor esi, 0
jne 0x405ecb
push 0xda4a4f7
mov edx, 0xda4a4f7
pop esi
xor edx, esi
push edx
mov edi, esp
dec edi
mov esi, dword [edi + 1]
mov eax, 0xfffffffc
sub esp, eax
xor eax, eax
add eax, esi
mov ebx, eax
add esp, 0xfffffffc
mov dword [esp], ebx
push esi
pop eax
mov ebx, eax
xor ebx, 0xffffffff
and ebx, 0xffffffff
and eax, 0
or eax, ebx
and eax, 0x917e9c3e
and esi, 0x6e8163c1
or esi, eax
mov ecx, esi
add esp, 0xfffffffc
mov dword [esp], ecx
mov edx, dword [esp]
sub esp, 0xfffffffc
and edx, edx
jne 0x405f2f
push 0x5a47aadf
mov esi, 0x5a47aadf
pop ebx
xor esi, ebx
push esi
jmp 0x414f6c

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
jmp loc.0042462c

Function at 0x406a58
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov eax, ebx
mov edx, 0xff
call fcn.004034f0
mov eax, dword [ebx]
call fcn.004032f4
push eax
mov eax, dword [ebx]
call fcn.00403414
push eax
mov eax, edi
jmp loc.004193b8
Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
jmp loc.0041b5de

Function at 0x406e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e6d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
cmp dword [ebp - 0x10], 0
jne 0x406e82
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x406f32
cmp dword [ebp - 0x10], 0x70000000
jb 0x406e90
call fcn.00405884
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406e36
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406ee0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406eeb
dec esi
test esi, esi
je 0x406ef9
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406eea
cmp dword [ebp - 0xc], 7
jne 0x406f04
test esi, esi
je 0x406f04
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x406f25
test esi, esi
je 0x406f25
lea eax, [ebp - 0x14]
call fcn.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
jmp 0x426cba

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
jmp loc.004200c6