joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c234
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff7b0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1850], ebx
mov dword [ebp - 0x1848], ebx
mov dword [ebp - 0x184c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404ca0
lea edi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x48c3b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x48c3cc
call fcn.00404df4
mov ebx, eax
test ebx, ebx
jle 0x48c2a4
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d10
mov dword [edi], 0x3c
lea eax, [ebp - 0x1044]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x400
lea eax, [ebp - 0x444]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0x400
lea eax, [ebp - 0x844]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0x400
lea eax, [ebp - 0xc44]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], 0x400
lea eax, [ebp - 0x1444]
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0x400
lea eax, [ebp - 0x1844]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], 0x400
push edi
push 0
mov eax, dword [ebp - 4]
call fcn.00404ab0
push eax
mov eax, dword [ebp - 4]
call fcn.00404cb0
push eax
call sub.wininet.dll_InternetCrackUrlA
test eax, eax
je 0x48c38e
lea eax, [ebp - 0x184c]
mov edx, dword [edi + 4]
call fcn.004049e8
mov eax, dword [ebp - 0x184c]
lea edx, [ebp - 0x1848]
call fcn.00408e18
mov edx, dword [ebp - 0x1848]
mov eax, dword [ebp - 8]
call fcn.00404844
mov eax, dword [ebp + 0x10]
mov edx, dword [edi + 0x10]
call fcn.004049e8
mov eax, esi
mov edx, dword [edi + 0x2c]
call fcn.004049e8
lea eax, [ebp - 0x1850]
mov edx, dword [edi + 0x34]
call fcn.004049e8
mov edx, dword [ebp - 0x1850]
mov eax, esi
call fcn.00404ab8
movzx eax, word [edi + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c3bb
lea eax, [ebp - 0x1850]
mov edx, 3
call fcn.00404814
lea eax, [ebp - 4]
call fcn.004047f0
ret
Function at 0x48cba4
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48cd76
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x16
push ebx
call sub.wininet.dll_HttpQueryInfoA
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00404e3c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404cb0
push eax
push 0x16
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov edx, dword [ebp - 0x18]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov eax, dword [esi + 4]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x38], edx
cmp dword [ebp - 0x14], 0xc8
je 0x48cc65
cmp dword [ebp - 0x14], 0x12e
jne 0x48cd50
mov byte [ebp - 5], 1
cmp dword [ebp - 4], 0
je 0x48cd50
lea eax, [ebp - 0x81d]
xor ecx, ecx
mov edx, 0x800
call fcn.004031fc
cmp dword [ebp - 4], 0xffffffff
jne 0x48cce1
jmp 0x48ccc5
cmp dword [ebp - 0x10], 0
je 0x48cd50
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x81d], 0
lea eax, [ebp - 0x824]
lea edx, [ebp - 0x81d]
mov ecx, 0x801
call fcn.00404a60
mov edx, dword [ebp - 0x824]
mov eax, edi
call fcn.00404ab8
lea eax, [ebp - 0x10]
push eax
push 0x800
lea eax, [ebp - 0x81d]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x48cc8d
jmp 0x48cd50
mov dword [ebp - 0x1c], 0x800
cmp dword [ebp - 4], 0x800
jge 0x48ccf7
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
xor esi, esi
jmp 0x48cd37
cmp dword [ebp - 0x10], 0
je 0x48cd50
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x81d], 0
lea eax, [ebp - 0x828]
lea edx, [ebp - 0x81d]
mov ecx, 0x801
call fcn.00404a60
mov edx, dword [ebp - 0x828]
mov eax, edi
call fcn.00404ab8
add esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 4]
jge 0x48cd50
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x81d]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x48ccfb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cd7d
lea eax, [ebp - 0x828]
mov edx, 2
call fcn.00404814
lea eax, [ebp - 0x18]
call fcn.004047f0
ret
Function at 0x496330
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x496338
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49652a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x496540
mov eax, esi
call fcn.004941bc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404844
lea ecx, [ebp - 0x10]
mov edx, 0x496554
mov eax, esi
call fcn.004941bc
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404844
lea ecx, [ebp - 0x14]
mov edx, 0x49656c
mov eax, esi
call fcn.004941bc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404844
lea ecx, [ebp - 0x18]
mov edx, 0x496588
mov eax, esi
call fcn.004941bc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404844
lea ecx, [ebp - 0x1c]
mov edx, 0x4965a4
mov eax, esi
call fcn.004941bc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404844
lea ecx, [ebp - 0x24]
mov edx, 0x4965bc
mov eax, esi
call fcn.004941bc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004090c8
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409754
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4965d4
mov eax, esi
call fcn.004941bc
mov eax, dword [ebp - 0x28]
call fcn.0048a058
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4965e4
mov eax, esi
call fcn.004941bc
mov eax, dword [ebp - 0x2c]
call fcn.0048a058
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4965fc
mov eax, esi
call fcn.004941bc
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409754
inc eax
je 0x4964cd
lea ecx, [ebp - 0x34]
mov edx, 0x4965fc
mov eax, esi
call fcn.004941bc
mov eax, dword [ebp - 0x34]
call fcn.00409718
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b75c
fstp qword [ebp - 0x3c]
wait
call fcn.0040bb9c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4964e8
lea ecx, [ebp - 0x40]
mov edx, 0x4965fc
mov eax, esi
call fcn.004941bc
mov eax, dword [ebp - 0x40]
call fcn.0048a058
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x49660c
mov eax, esi
call fcn.004941bc
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496531
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404814
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404814
ret
Function at 0x49d2bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49d316
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0049d2ac
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00488cbc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004888bc
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d31d
lea eax, [ebp - 4]
call fcn.004047f0
ret

Function at 0x4a09fc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41711c]
call fcn.00405424
xor eax, eax
push ebp
push 0x4a0b40
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d3d2c], 0
jne 0x4a0a4f
mov ecx, dword [0x4d523c]
mov dl, 1
mov eax, dword [0x408060]
call fcn.0040db0c
call fcn.0040416c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004031fc
mov eax, ebx
call fcn.004050b0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a0b50
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406538
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050c0
test eax, eax
jle 0x4a0ae7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a0ae0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a78
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a60
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408eb8
test eax, eax
jne 0x4a0ae0
mov ebx, 0x15
jmp 0x4a0aec
mov ebx, 0x10
jmp 0x4a0aec
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4d3d2c]
call fcn.004a0954
mov eax, dword [ebp - 8]
call fcn.004a0954
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0b47
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404814
lea eax, [ebp - 0x10]
mov edx, dword [0x41711c]
call fcn.004054f4
ret

Function at 0x4a98bc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push 0
push eax
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404a60
cmp dword [ebx], 0
je 0x4a9903
mov eax, dword [ebx]
call fcn.00404ab0
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4a9903
mov eax, ebx
mov edx, 0x4a9914
call fcn.00404ab8
add esp, 0x108
pop ebx
ret
Function at 0x4a9ca0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff98
mov ebx, eax
push esp
push 0x65
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x65
call fcn.00404a60
add esp, 0x68
pop ebx
ret
Function at 0x4cd860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4cda87
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [0x4d57ec]
mov eax, dword [eax]
call fcn.0046a830
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409d14
lea eax, [ebp - 4]
mov edx, 0x4cdaa0
call fcn.00404ab8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433efc
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x308]
call fcn.00484a28
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x4cdabc
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
lea edx, [ebp - 0x10]
mov eax, dword [esi + 0x30c]
call fcn.00484a28
mov eax, dword [ebp - 0x10]
push eax
mov ecx, 0x4cdae0
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x340]
call fcn.00484a28
mov eax, dword [ebp - 0x14]
push eax
mov ecx, 0x4cdaf4
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [esi + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov ecx, 0x4cdb0c
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [0x4d715c]
push eax
mov ecx, 0x4cdb20
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [esi + 0x3ec]
mov edx, dword [eax]
call dword [edx + 0x18c]
push eax
mov ecx, 0x4cdb34
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x38c]
mov edx, dword [eax]
call dword [edx + 0xc8]
push eax
mov ecx, 0x4cdb48
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi + 0x3cc]
call fcn.00436b54
add esp, 0xfffffff8
fstp qword [esp]
wait
mov ecx, 0x4cdb60
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x30]
mov eax, dword [esi + 0x3d0]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov ecx, 0x4cdb70
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov ecx, 0x4cdb84
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov ecx, 0x4cdb98
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov ecx, 0x4cdbac
mov edx, 0x4cdad0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0x18c]
push eax
mov ecx, 0x4cdbc0
mov edx, 0x4cdad0
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.004039e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cda8e
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404814
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404814
ret
Function at 0x4d0978
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404ca0
mov eax, dword [ebp - 8]
call fcn.00404ca0
xor eax, eax
push ebp
push 0x4d0a06
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d09df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404cb0
push eax
mov eax, dword [ebp - 4]
call fcn.00404cb0
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d09eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0a0d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404814
ret
Function at 0x402b10
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404618
test esi, esi
jne 0x402b46
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404708
jmp 0x402b64
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029c4
mov edi, eax
test esi, esi
je 0x402b64
cmp dword [ebx], 0
je 0x402b64
dec esi
jmp 0x402b4d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4036b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4a9020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40374c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40372c
xor eax, eax
push ebp
push 0x403725
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403768
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40372c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4a9020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4a9020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404418
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ae04c], 0
je 0x404479
cmp word [0x4ae220], 0xd7b2
jne 0x404441
cmp dword [0x4ae228], 0
jbe 0x404441
mov eax, 0x4ae21c
call dword [0x4ae238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4a9090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4044a0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4a9030], 0
jne 0x404495
push 0
push 0x4a9088
push 0x4a9090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4045cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040277c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4ae04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404594
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405cec
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f1c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405d6f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f1c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405d6f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405f38
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405df8
xor eax, eax
push ebp
push 0x405df1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405b34
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405dd6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405f58
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405dd6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405df8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405f12
cmp byte [ebp - 0xd], 0
jne 0x405e3f
cmp byte [ebp - 0x12], 0
je 0x405f12
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405e58
dec ebx
cmp byte [ebx], 0x2e
je 0x405e67
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405e57
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405f12
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405ea4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f12
cmp byte [ebp - 0xd], 0
je 0x405f12
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405f12
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4065e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40664a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404888
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403248
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406634
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406651
lea eax, [ebp - 0x10]
call fcn.00404618
ret

Function at 0x40bf7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bfb5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404708
jmp 0x40bfbe
mov eax, ebx
mov edx, esi
call fcn.0040466c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bfc8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bfe9
mov al, byte [esp]
jmp 0x40bfeb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c670
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c4e8
mov eax, dword [0x4ad600]
cmp byte [eax], 0
je 0x40c6ec
mov eax, dword [0x4ad294]
call fcn.00402f44
call fcn.004028e4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004094d8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c734
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c722
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4ad218]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4ae668]
call fcn.00405af8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret