joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407d83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x42a6cc
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x42a6d0], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x42a6d0], eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d8a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret

Function at 0x407d94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407e58
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x42a6cc
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x42a6d0], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00404638
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
jne 0x407e2b
mov eax, dword [ebx]
call fcn.00404508
mov edx, eax
mov eax, ebx
call fcn.00404264
jmp 0x407e32
mov eax, ebx
call fcn.0040406c
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e5f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret

Function at 0x407e68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
mov eax, dword [ebp + 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407f3c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x42a6cc
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x42a6d0], eax
cmp dword [ebp + 8], 0
jne 0x407ed5
lea eax, [ebp + 8]
mov edx, 0x407f54
call fcn.00404104
mov eax, dword [ebp + 8]
call fcn.00404308
push eax
lea eax, [ebp + 8]
call fcn.00404560
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegSetValueExA
invalid
invalid
cmpsb byte [esi], byte es:[edi]
Function at 0x407f58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407ffd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x42a6cc
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x42a6d0], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
sete bl
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408004
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret

Function at 0x408010
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
xor eax, eax
push ebp
push 0x408092
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x4080a8
call fcn.00406e00
test al, al
jne 0x40807c
mov eax, dword [ebp - 4]
call fcn.00404508
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x42a6cc
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408099
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x40813c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x4081cb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x40817c
lea eax, [ebp - 8]
mov edx, 0x4081e4
call fcn.00404104
mov eax, dword [ebp - 8]
call fcn.00404308
push eax
lea eax, [ebp - 8]
call fcn.00404560
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4081d2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret
Function at 0x4081e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
xor eax, eax
push ebp
push 0x40824b
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408252
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x40825c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x4082f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x42a6cc
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x42a6d0], eax
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
sete bl
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4082f9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret
Function at 0x408e38
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4090e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x4090f4
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x409108
mov edx, 0x409118
mov eax, 0x80000002
call fcn.00407e68
mov eax, 0x42ab30
mov edx, 0x409150
call fcn.004040c0
lea eax, [ebp - 8]
mov ecx, 0x4090f4
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x409108
mov edx, 0x409208
mov eax, 0x80000001
call fcn.00407e68
lea eax, [ebp - 0xc]
mov ecx, 0x4090f4
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x409108
mov edx, 0x409250
mov eax, 0x80000002
call fcn.00407e68
mov eax, 0x42ab30
mov edx, 0x409290
call fcn.004040c0
lea eax, [ebp - 0x10]
mov ecx, 0x4092bc
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x409118
mov ecx, 0x4092d0
mov eax, 0x80000001
call fcn.00407e68
lea eax, [ebp - 0x14]
mov ecx, 0x4092e0
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x409208
mov ecx, 0x4092f4
mov eax, 0x80000002
call fcn.00407e68
cmp byte [0x42ab78], 0
jne 0x4090c6
mov eax, 0x42ab30
mov edx, 0x409304
call fcn.004040c0
push 0
mov ecx, 0x40936c
mov edx, 0x409384
mov eax, 0x80000002
call fcn.00407e68
push 0x4093b8
mov edx, 0x409384
mov ecx, 0x4093c8
mov eax, 0x80000002
call fcn.00407e68
push 0x4093e0
mov edx, 0x409384
mov ecx, 0x409418
mov eax, 0x80000002
call fcn.00407e68
mov eax, 0x42ab30
mov edx, 0x40942c
call fcn.004040c0
push 0x4094d0
mov edx, 0x409384
mov ecx, 0x4094ec
mov eax, 0x80000002
call fcn.00407e68
push 0x409500
mov edx, 0x409384
mov ecx, 0x409514
mov eax, 0x80000002
call fcn.00407e68
push 0x409524
mov edx, 0x409384
mov ecx, 0x409538
mov eax, 0x80000002
call fcn.00407e68
lea eax, [ebp - 0x18]
mov ecx, 0x4090f4
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x409384
mov ecx, 0x40954c
mov eax, 0x80000002
call fcn.00407e68
push 1
mov edx, 0x409384
mov ecx, 0x409560
mov eax, 0x80000002
call fcn.00407f58
mov eax, 0x42ab30
mov edx, 0x409578
call fcn.004040c0
push 3
mov edx, 0x409384
mov ecx, 0x409618
mov eax, 0x80000002
call fcn.00407f58
mov eax, 0x42ab30
mov edx, 0x409634
call fcn.004040c0
push 2
mov edx, 0x409384
mov ecx, 0x409660
mov eax, 0x80000002
call fcn.00407f58
mov eax, 0x42ab30
mov edx, 0x409670
call fcn.004040c0
push 0x120
mov edx, 0x409384
mov ecx, 0x409704
mov eax, 0x80000002
call fcn.00407f58
mov eax, 0x42ab30
mov edx, 0x409670
call fcn.004040c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4090e8
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404090
ret
Function at 0x40fc84
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40fc8c
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40ff2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x42ab30
mov edx, 0x40ff44
invalid
invalid
inc esp
Function at 0x411a44
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x42ab30
mov edx, 0x411ac8
call fcn.004040c0
push 0
push 0
push 0x411b04
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x42ab30
mov edx, 0x411b18
call fcn.004040c0
push 0
push 0
push 0x411b94
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x42ab30
mov edx, 0x411bbc
call fcn.004040c0
push 0
push 0
push 0x411c00
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x42ab30
mov edx, 0x411c18
call fcn.004040c0
ret

Function at 0x413094
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413148
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.004042dc
mov eax, 0x42ab30
mov edx, 0x413160
call fcn.004040c0
mov edx, dword [ebp - 4]
mov eax, 0x4131e0
call fcn.004045f0
test eax, eax
jne 0x413121
mov edx, dword [ebp - 4]
mov eax, 0x4131f0
call fcn.004045f0
test eax, eax
jne 0x413121
mov edx, dword [ebp - 4]
mov eax, 0x413204
call fcn.004045f0
test eax, eax
jne 0x413121
xor ebx, ebx
jmp 0x413123
mov bl, 1
mov eax, 0x42ab30
mov edx, 0x41321c
call fcn.004040c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41314f
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x413238
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x413240
push ecx
push ebx
push esi
push edi
mov edi, 0x42ab30
xor eax, eax
push ebp
push 0x41357b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x413594
call fcn.004040c0
mov byte [ebp - 1], 0
push 1
push 0
push 0
lea eax, [ebp - 0x14]
mov ecx, dword [0x42ab0c]
mov edx, 0x413668
call fcn.00404354
mov eax, dword [ebp - 0x14]
call fcn.00404508
push eax
push 0x413670
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x20
jae fcn.004132e0
push 0x413680
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00406940
push dword [ebp - 0x1c]
push 0x413694
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.0040780c
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004043c8
mov eax, dword [ebp - 0x18]
call fcn.0041b548
Function at 0x414e4c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x414e54
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov ebx, 0x42ab30
mov esi, 0x42ab04
mov edi, 0x42ab7b
xor eax, eax
push ebp
push 0x415a0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x415a24
mov edx, dword [ebp - 4]
call fcn.00404354
mov eax, dword [ebp - 0xc]
call fcn.00404508
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x414eb5
sub eax, 1
jne 0x4159f0
push dword [ebp - 4]
push 0x415a30
push 0x415a44
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004043c8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.004069a4
mov eax, dword [ebp - 8]
call fcn.00406e00
test al, al
jne 0x414f1b
push 1
push 0x96
push 0x222e1
push dword [ebp - 4]
push 0x415a30
push 0x415a58
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004043c8
mov eax, dword [ebp - 0x14]
mov cl, 1
mov edx, dword [ebp - 8]
Function at 0x417a8c
Capabilities:
Find taskbar
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, 0x42ab30
xor eax, eax
push ebp
push 0x417ca0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402954
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004069a4
mov edx, dword [ebp - 4]
mov eax, 0x42ab04
call fcn.004040c0
mov eax, edi
mov edx, 0x417cb8
call fcn.004040c0
cmp byte [0x42ab79], 0
jne 0x417afa
mov eax, dword [0x42ab04]
push eax
mov ecx, 0x417cf0
mov edx, 0x417d00
mov eax, 0x80000002
call fcn.00407e68
mov eax, edi
mov edx, 0x417d48
call fcn.004040c0
cmp byte [0x42ab79], 0
je 0x417b19
call fcn.00418298
jmp 0x417c85
mov eax, edi
mov edx, 0x417d8c
call fcn.004040c0
xor ebx, ebx
push 0
push 0x417ddc
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x417b45
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x417b27
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x417dec
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0x417df4
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x417b7c
push 0x417e00
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x417c3f
push 0x417e0c
push esi
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov eax, edi
mov edx, 0x417e24
call fcn.004040c0
test esi, esi
je 0x417c3f
mov eax, edi
mov edx, 0x417e80
call fcn.004040c0
call esi
mov eax, edi
mov edx, 0x417ea4
call fcn.004040c0
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
mov eax, edi
mov edx, 0x417f18
call fcn.004040c0
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
push ebx
call sub.user32.dll_SendMessageA
mov eax, edi
mov edx, fcn.00417f6c
call fcn.004040c0
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x418038
call fcn.0040840c
mov eax, edi
mov edx, 0x418048
call fcn.004040c0
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, edi
mov edx, 0x41808c
call fcn.004040c0
mov edx, 0x418114
mov eax, 0x42ab8c
mov ecx, 0xbb8
call fcn.00407bdc
test al, al
je 0x417c85
mov eax, edi
mov edx, 0x418144
call fcn.004040c0
call fcn.00418298
mov eax, edi
mov edx, 0x4181c8
call fcn.004040c0
call fcn.0041b130
mov eax, edi
mov edx, 0x418280
call fcn.004040c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417ca7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret
Function at 0x41b548
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
xor eax, eax
push ebp
push 0x41b65d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x42ab30
mov edx, 0x41b674
call fcn.004040c0
cmp dword [0x42ab80], 0
jne 0x41b589
call fcn.0041b37c
push 2
push 0
push 0
mov eax, dword [0x42ab80]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x41b5a4
call fcn.0041b37c
mov eax, 0x42ab30
mov edx, 0x41b6d0
call fcn.004040c0
lea edx, [ebp - 0xc]
mov al, byte [0x42ab7a]
call fcn.004069e0
push dword [ebp - 0xc]
push 0x41b6f4
push dword [ebp - 4]
push 0x41b700
lea eax, [ebp - 4]
mov edx, 4
call fcn.004043c8
mov eax, 0x42ab30
mov edx, 0x41b70c
call fcn.004040c0
mov byte [0x42ab7a], 0
mov eax, 0x42ab30
mov edx, 0x41b770
call fcn.004040c0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404308
push eax
lea eax, [ebp - 4]
call fcn.00404560
push eax
mov eax, dword [0x42ab80]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x41b630
mov dword [ebp - 8], 0xffffffff
mov eax, 0x42ab30
mov edx, 0x41b7cc
call fcn.004040c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b664
lea eax, [ebp - 0xc]
call fcn.0040406c
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x41f734
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x41f76d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040415c
jmp 0x41f776
mov eax, ebx
mov edx, esi
call fcn.004040c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41f780
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x41f7a1
mov al, byte [esp]
jmp 0x41f7a3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41fe28
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x41fca0
mov eax, dword [0x4296c8]
cmp byte [eax], 0
je 0x41fea4
mov eax, dword [0x4295dc]
call fcn.00402d0c
call fcn.00402788
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0041d0e8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x41feec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41feda
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4295b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42a660]
call fcn.00405008
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x420b88
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x420bec
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004042dc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0041cca8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420bf3
lea eax, [ebp - 0xc]
call fcn.0040406c
ret
Function at 0x4030b0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
je 0x4030fc
call fcn.004323b0
lea eax, [0x4a5b18]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00432c90
call fcn.00432420
mov dword [esp], 2
call fcn.0042c960
mov eax, dword [esp + 0x2c]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
nop
inc dword [ecx + 0x148]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
mov ebx, ecx
mov dword [edx + 0xc0], ecx
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x98], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x30], ecx
test byte [ecx], al
lea esi, [ecx + 0x19c]
lea edi, [esp + 0x10]
call fcn.004573e4
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0xc], edx
call fcn.00453f50
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 0
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0x1d8
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00402560
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.00403210
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x88], 1
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jne 0x4031f6
mov dword [esp], ecx
call fcn.0042e160
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043a200
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x19c]
lea esi, [esp + 0x10]
call fcn.004573e4
add esp, 0x34
ret
lea eax, [0x4a6e31]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.00430cf0
nop
int3