joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a460
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43a493
push esi
call fcn.0043d400
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43a48c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43a519
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43a502
mov eax, dword [esi + 8]
test eax, eax
je 0x43a4b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43a4fe
cmp eax, 2
je 0x43a502
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43a4aa
cmp eax, 3
je 0x43a4dd
cmp eax, 1
jne 0x43a4aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43a4aa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43a4aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043a540
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43a528
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043a540
add esp, 4
pop esi
ret

Function at 0x460703
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46073b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046335c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00463334
jmp 0x460747
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x461df5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x461e37
call fcn.004695e0
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x461e37
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x461e2e
xor eax, eax
jmp 0x461e3f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00461e45
pop edi
pop esi
pop ebx
ret 4

Function at 0x469c9e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469ccc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469cea
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00469c04
jmp 0x469cea
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469cea
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00469c04
test edi, edi
mov eax, edi
jne 0x469cd4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4861c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.00498e40
xor eax, eax
nop
mov cl, byte [eax + 0x4921a0]
mov dl, byte [eax + 0x492198]
mov byte [ebp + eax - 0x20], cl
mov byte [ebp + eax - 0x18], dl
inc eax
cmp eax, 8
jl 0x4861d0
lea eax, [ebp - 8]
push 0x488140
push eax
call fcn.0048a250
push 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00487a60
add esp, 0x14
push ebx
push esi
mov dword [ebp - 0xc], 0
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [ebp - 0x10020]
push 1
push edx
call fcn.0048b904
add esp, 0x10
cmp eax, 0x18
jl 0x486291
mov edi, eax
lea esi, [edi - 0x14]
test esi, esi
jle 0x486260
xor edx, edx
xor ecx, ecx
mov bl, byte [ebp + ecx - 0x20]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x10020]
je 0x48627e
cmp ecx, 0x14
je 0x49c91e
inc edx
cmp edx, esi
jl 0x486240
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
lea edx, [ecx + edi - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [ebp - 0xc], edx
call fcn.0048bcd1
add esp, 0xc
jmp 0x486214
mov bl, byte [ebp + ecx - 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001f]
je 0x48629f
inc ecx
jmp 0x486252
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov bl, byte [ebp + ecx - 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001e]
je 0x4862b4
add ecx, 2
jmp 0x486252
mov bl, byte [ebp + ecx - 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001d]
jne 0x49c916
mov bl, byte [ebp + ecx - 0x1c]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001c]
je 0x49c905
add ecx, 4
jmp 0x486252
add ecx, 5
cmp ecx, 0x14
jl 0x486242
jmp 0x486252
add ecx, 3
jmp 0x486252
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
lea ecx, [eax + edx + 0x14]
mov edx, dword [esi]
push 0
push ecx
push edx
call fcn.0048bcd1
mov eax, dword [esi]
push eax
push 4
lea ecx, [ebp - 8]
push 1
push ecx
call fcn.0048b904
lea edx, [ebp - 8]
push 0x488130
push edx
mov byte [ebp - 4], 0
call fcn.0048b930
add esp, 0x24
neg eax
sbb eax, eax
and eax, 4
jmp 0x486296
Function at 0x486360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
or ecx, 0xffffffff
mov ebx, 0x484ea8
call fcn.004862f0
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.0048a250
push esi
call fcn.00487ddc
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.00486420
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.00486450
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x4863b4
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x488120
push eax
call fcn.0048b5c2
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x49e82a
push edi
call fcn.004861c0
cmp eax, ebx
je 0x49e834
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.0048b646
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x486413
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0048b904
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call 0x4c1bef
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x49e860
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.0048bbe2
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x486413

Function at 0x486420
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00489b40
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x4b8fda
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
push edi
push 0x488154
push eax
mov dword [ebp - 4], 0x414a46
call fcn.0048b5c2
mov edi, eax
add esp, 8
mov dword [ebp - 8], edi
test edi, edi
jne 0x4b902e
push eax
push 0xdeadbeef
push 0x1f
push esi
call fcn.004b8ecb
mov bl, al
lea eax, [ebp - 8]
push eax
call fcn.004a8448
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 8], 1
jmp 0x4b903a
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0x400
lea edx, [ebp - 0x408]
push edx
push eax
call dword [fcn.00482748]
test eax, eax
je 0x4b90ac
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b9080
push edi
push 1
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.0048aeb6
mov eax, dword [ebp + 8]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x4b903a
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x4b90d1
push eax
push 0xdeadbeef
push 0x21
push esi
call fcn.004b8ecb
lea ecx, [ebp - 8]
push ecx
mov bl, al
call fcn.004a8448
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.004b8ecb
lea edx, [ebp - 8]
push edx
mov bl, al
call fcn.004a8448
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push 0
push 0
push esi
call fcn.004b8ecb
lea edx, [ebp - 8]
push edx
mov bl, al
call fcn.004a8448
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push str.d:My_Documents2013.4.13
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401131
mov eax, dword [0x409058]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x401127
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00401139
add esp, 8
mov ecx, 0x465820
nop
nop
nop
mov dword [0x409050], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00401601
add esp, 4
push 0x100
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [0x40906c]
push ecx
push str.flax_03d.exe
push 0x5c
lea edx, [ebp - 0x118]
push edx
call fcn.00404960
add esp, 8
add eax, 1
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x409050
lea eax, [ebp - 0x118]
push eax
call fcn.00404880
add esp, 8
push 0x44
push 0
lea ecx, [ebp - 0x15c]
push ecx
call fcn.00404810
add esp, 0xc
mov dword [ebp - 0x15c], 0x44
mov word [ebp - 0x12c], 0
mov dword [ebp - 0x130], 1
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x15c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x118]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401139
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
je 0x4011bd
cmp dword [ebp + 0xc], 0
je 0x4011bd
cmp dword [ebp + 0xc], 0x4000
jle 0x401167
mov dword [ebp - 0x10], 0x4000
jmp 0x40116d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov dword [ebp + 0xc], edx
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x417900
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
mov dword [eax + 0x417900], 0
mov eax, 0
lea ebx, [0x417900]
mov ecx, dword [ebp - 8]
inc ecx
jmp 0x4011b6
xor eax, dword [ebx]
inc ebx
loop 0x4011b3
xor dword [ebp - 4], eax
jmp 0x40114f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401601
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004011d0
cmp dword [ebp + 8], 0xffffffff
je 0x4016b5
mov eax, dword [ebp + 8]
cmp eax, dword [0x416ec0]
jne 0x401637
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x416ec0], 0xffffffff
jmp 0x4016b5
mov edx, dword [ebp + 8]
cmp edx, dword [0x4173e0]
jne 0x4016b5
cmp dword [0x4173e4], 0
je 0x4016a1
mov eax, 0x4178ec
mov ecx, dword [0x4173e4]
imul ecx, ecx, 0x28
sub eax, ecx
mov dword [ebp - 4], eax
mov edx, dword [0x4173e4]
imul edx, edx, 0x28
mov dword [ebp - 0xc], edx
push str.GLUE
call fcn.00402a30
add esp, 4
push 1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402c37
add esp, 0xc
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4173e0], 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x402d93
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x411e38], 0
je 0x402dce
mov dword [0x414680], 0x12345678
mov eax, dword [0x414654]
sub eax, 8
mov ecx, dword [0x414660]
sub ecx, 0x411e40
cmp eax, ecx
jge 0x402dce
mov dword [0x414654], 0
cmp dword [0x414654], 0
jle 0x402de0
cmp dword [0x416e90], 0
jg 0x402dfe
mov dword [0x41465c], 1
mov edx, dword [0x411e30]
add edx, 1
mov dword [0x411e3c], edx
jmp 0x402fc9
mov eax, dword [0x414650]
mov dword [ebp - 4], eax
cmp dword [0x4091c8], 0
je 0x402e2c
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x414680
mov eax, dword [0x4098cc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x402e86
cmp dword [0x41466c], 0
je 0x402e59
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x416e90]
jbe 0x402e4b
mov edx, dword [0x416e90]
mov dword [ebp - 0xc], edx
jmp 0x402e51
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x402e5f
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x4098cc]
push ecx
push 0x414680
call fcn.00404bd0
add esp, 0xc
mov edx, dword [0x4098cc]
add edx, dword [ebp - 8]
mov dword [0x4098cc], edx
movsx eax, word [0x4098dc]
test eax, eax
je 0x402eaa
movsx ecx, word [0x4098dc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x414680
call fcn.004035a0
add esp, 0xc
mov dword [0x411e30], 0x414680
mov eax, dword [ebp - 8]
add eax, 0x414680
mov dword [0x411e3c], eax
cmp dword [0x41466c], 0
je 0x402ef4
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x416e90]
jle 0x402ee7
mov edx, dword [0x416e90]
add edx, 0x414680
mov dword [0x411e3c], edx
mov eax, dword [0x416e90]
sub eax, dword [ebp - 8]
mov dword [0x416e90], eax
cmp dword [0x4098d4], 0
je 0x402f1d
cmp dword [0x4098ec], 0
je 0x402f1d
mov ecx, dword [ebp - 8]
push ecx
push 0x414680
call dword [0x4098ec]
add esp, 8
mov dword [0x4098d4], eax
cmp dword [0x4098e4], 0
je 0x402f33
mov edx, dword [ebp - 8]
push edx
call dword [0x4098e4]
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00402fcd
add esp, 4
test eax, eax
jne 0x402f7e
mov dword [0x411e2c], 1
mov dword [0x416e90], 0
mov ecx, dword [0x416e90]
mov dword [0x414654], ecx
mov edx, dword [0x411e30]
add edx, 1
mov dword [0x411e3c], edx
mov dword [0x411c78], 0
jmp 0x402fb1
cmp dword [ebp - 8], 0
ja 0x402fb1
mov dword [0x416e90], 0
mov eax, dword [0x416e90]
mov dword [0x414654], eax
mov dword [0x41465c], 1
mov ecx, dword [0x411e30]
add ecx, 1
mov dword [0x411e3c], ecx
cmp dword [0x411e38], 0
je 0x402fc9
mov edx, dword [0x411e30]
add edx, 6
mov dword [0x411e30], edx
mov esp, ebp
pop ebp
ret
Function at 0x40315b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00403219
cmp dword [0x4098d8], 0
je 0x403194
cmp dword [0x4098ec], 0
je 0x403194
mov eax, dword [0x414660]
sub eax, 0x411e40
push eax
push 0x411e40
call dword [0x4098ec]
add esp, 8
mov dword [0x4098d8], eax
mov ecx, dword [0x414660]
sub ecx, 0x411e40
mov dword [ebp - 4], ecx
cmp dword [0x4098e0], 0
je 0x4031d4
mov edx, dword [ebp - 4]
push edx
push 0x411e40
mov eax, dword [0x4098e0]
push eax
call fcn.00404bd0
add esp, 0xc
mov ecx, dword [0x4098e0]
add ecx, dword [ebp - 4]
mov dword [0x4098e0], ecx
jmp 0x4031f0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x411e40
mov ecx, dword [0x4098d0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x414668]
add edx, dword [ebp - 4]
mov dword [0x414668], edx
cmp dword [0x4098e8], 0
je 0x403215
mov eax, dword [ebp - 4]
push eax
call dword [0x4098e8]
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x405dcd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409508
cmp edx, dword [eax]
je 0x405def
add eax, 8
inc ecx
cmp eax, 0x409598
jl 0x405de0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409508]
jne 0x405f1d
mov eax, dword [0x411c8c]
cmp eax, 1
je 0x405ef7
test eax, eax
jne 0x405e20
cmp dword [0x409454], 1
je 0x405ef7
cmp edx, 0xfc
je 0x405f1d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405e57
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404870
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404f10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405e9a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404f10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x408398
push edi
call fcn.00404ad0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404870
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404880
lea eax, [ebp - 0xa0]
push 0x408378
push eax
call fcn.00404880
push dword [esi + 0x40950c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404880
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406c2e
add esp, 0x2c
pop edi
jmp 0x405f1d
lea eax, [ebp + 8]
lea esi, [esi + 0x40950c]
push 0
push eax
push dword [esi]
call fcn.00404f10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40333c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46c020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033b4
xor eax, eax
push ebp
push 0x4033ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46c020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46c020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404164
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46e04c], 0
je 0x4041c5
cmp word [0x46e220], 0xd7b2
jne 0x40418d
cmp dword [0x46e228], 0
jbe 0x40418d
mov eax, 0x46e21c
call dword [0x46e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46c06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041ec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46c030], 0
jne 0x4041e1
push 0
push 0x46c064
push 0x46c06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a48
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46e04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404308
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4059ac
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x121]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bf0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405a2e
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405bf0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405a2e
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405ab7
xor eax, eax
push ebp
push 0x405ab0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x121]
mov edx, 0x105
call fcn.004057d4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a95
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405c2c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405a95
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ab7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x121]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor ebx, ebx
cmp byte [ebp - 0x121], 0
je 0x405be7
cmp byte [ebp - 0xd], 0
jne 0x405afe
cmp byte [ebp - 0x12], 0
je 0x405be7
lea eax, [ebp - 0x121]
push eax
call sub.kernel32.dll_lstrlenA
lea edx, [ebp - 0x121]
add eax, edx
mov dword [ebp - 0x1c], eax
jmp 0x405b1a

Function at 0x4062f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40635a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004045fc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ef4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406344
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406361
lea eax, [ebp - 0x10]
call fcn.0040438c
ret