joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408280
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x111c
call fcn.00405340
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..new
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0xffffffff
jne 0x4082ec
xor eax, eax
jmp 0x408404
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1114], eax
cmp dword [ebp - 0x1114], 0xffffffff
jne 0x408321
xor eax, eax
jmp 0x408404
cmp dword [ebp + 0xc], 0
je 0x408342
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0x14], 0
je 0x408363
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x1114]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0x1c], 0
je 0x408384
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x1114]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x111c]
push edx
push 0x1000
lea eax, [ebp - 0x1110]
push eax
mov ecx, dword [ebp - 0x1118]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4083cb
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x111c]
push eax
lea ecx, [ebp - 0x1110]
push ecx
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x111c], 0x1000
je 0x408384
mov eax, dword [ebp - 0x1114]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1118]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x40a090
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2e
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401020
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x40a0d3
xor eax, eax
jmp 0x40a23f
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xc
jle 0x40a0eb
mov ecx, dword [ebp + 0xc]
add ecx, 8
mov dword [ebp - 0x2c], ecx
movzx edx, byte [0x4272c4]
test edx, edx
je 0x40a107
push str._XPCL.sys
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40a116
push str..sys
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x426fa8
push 0x1c
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.VersionS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
je 0x40a23a
push 0x416224
call fcn.004076c0
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004076c0
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x10]
cmp edx, dword [0x4272d8]
jne 0x40a166
mov eax, 3
jmp 0x40a23f
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4272dc]
jne 0x40a188
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x30]
jne 0x40a188
mov eax, 2
jmp 0x40a23f
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x10
jne 0x40a19e
xor eax, eax
jmp 0x40a23f
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0
jg 0x40a1e1
jl 0x40a1b9
cmp dword [ebp - 0x40], 8
jae 0x40a1e1
push 0x10
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00401409
add esp, 0xc
push eax
call fcn.004016d7
add esp, 4
push eax
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40a20a
push 0x10
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00401409
add esp, 0xc
push eax
call fcn.004016d7
add esp, 4
push eax
mov edx, dword [ebp - 0x2c]
sub edx, 1
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx eax, byte [0x4272c4]
test eax, eax
je 0x40a226
push str._XPCL.sys
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40a235
push str..sys
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40a116
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 8
Function at 0x40a7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x40a81d
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d540
test eax, eax
jne 0x40a81b
push 4
push str.WARNING__nDestination_directory_does_not_exist_or_not_found__nUSING_CURRENT_DIRECTORY._n_n
call fcn.00406110
lea edx, [ebp - 0x110]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x40a82f
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x110]
push ecx
push 0x426c78
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x426c78
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.Z_MSST_
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x110]
push eax
push 0x416238
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Drivers_
push 0x416238
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, dword [str.TXTSETUP]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0x4271b8
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov eax, dword [str.DOSNET]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x416548
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edx, dword [str.HIVE]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x416018
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov ecx, dword [str.setupreg.reg]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0x416a70
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov eax, dword [str.critical.inf]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x416860
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edx, dword [str.FINISH]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x416968
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov ecx, dword [str.START]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0x416340
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov eax, dword [str.msst.ini]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x416120
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edx, dword [str.msst.inf]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x426ea0
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov ecx, dword [str.msst.script]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0x426d98
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov eax, dword [str.infscan.log]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x415f10
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edx, dword [str.tmpdb.ini]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x426fa8
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x110]
push ecx
call fcn.0040d340
test eax, eax
je 0x40a9d0
push 6
push str.WARNING__nA_working_directory_already_exists__nAll_existent_files_will_be_removed__n_n
call fcn.00406110
lea edx, [ebp - 0x110]
push edx
call fcn.0040d1d0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x416238
call fcn.0040d3a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 4
Function at 0x40c820
Capabilities:
Enumerate files on windows
Get common file path
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x258]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x40c986
lea edx, [ebp - 0x148]
push edx
push str..inf
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x40c96c
mov dword [0x4272e0], 0
mov eax, dword [ebp - 0x148]
and eax, 0x10
jne 0x40c8d7
push 0x104
push 0
push 0x4270b0
call fcn.00401050
add esp, 0xc
mov ecx, dword [ebp - 0x25c]
push ecx
push 0x4270b0
push 0x104
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0x4270b0
call fcn.0040c480
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c890
cmp dword [0x4272e0], 0
je 0x40c96c
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push str.UnDo.cmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0xffffffff
je 0x40c96c
push 2
push 0
push 0
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0x4272d4
mov eax, dword [str.DEL__F__Q__0_r_n]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [str.DEL__F__Q__0_r_n]
push ecx
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 4
Function at 0x40c9a0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x364], 0
mov eax, dword [0x4272dc]
add eax, 1
mov dword [0x4272dc], eax
lea ecx, [ebp - 0x360]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x40cab8
lea eax, [ebp - 0x250]
push eax
push 0x41010c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x40ca9e
mov ecx, dword [ebp - 0x250]
and ecx, 0x10
je 0x40ca82
lea edx, [ebp - 0x224]
push edx
push 0x410110
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40ca82
lea eax, [ebp - 0x224]
push eax
push 0x410114
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40ca82
mov ecx, dword [ebp - 0x364]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [ebp - 0x110]
push ecx
call fcn.0040c820
lea edx, [ebp - 0x110]
push edx
call fcn.0040c9a0
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ca13
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 4
Function at 0x40d1d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x258]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x40d322
lea edx, [ebp - 0x148]
push edx
push 0x41010c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x40d308
mov eax, dword [ebp - 0x148]
and eax, 0x10
jne 0x40d282
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x368]
push edx
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0x80
lea ecx, [ebp - 0x368]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x368]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40d2ec
lea eax, [ebp - 0x11c]
push eax
push 0x410110
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40d2ec
lea ecx, [ebp - 0x11c]
push ecx
push 0x410114
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40d2ec
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x368]
push eax
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0x80
lea edx, [ebp - 0x368]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x368]
push eax
call fcn.0040d1d0
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d236
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 4

Function at 0x40d340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40d35f
mov eax, dword [ebp - 4]
and eax, 0x10
jmp 0x40d361
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40d370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40d396
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
add eax, 1
jmp 0x40d398
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40d3a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
test eax, eax
je 0x40d3dd
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xa1
jmp 0x40d521
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40d51e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x50
je 0x40d428
cmp dword [ebp - 0x120], 0xb7
je 0x40d428
cmp dword [ebp - 0x120], 0xce
je 0x40d428
jmp 0x40d430
mov eax, dword [ebp - 4]
jmp 0x40d521
push 0x104
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x115]
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0x11c]
movsx eax, byte [edx]
test eax, eax
je 0x40d51e
mov ecx, dword [ebp - 0x11c]
movsx edx, byte [ecx]
test edx, edx
je 0x40d4a3
mov eax, dword [ebp - 0x11c]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x40d4a3
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x11c], eax
jmp 0x40d473
mov eax, dword [ebp - 0x11c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40d501
mov edx, dword [ebp - 0x11c]
mov byte [edx], 0
mov eax, dword [ebp - 0x11c]
add eax, 1
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40d4ec
mov dword [ebp - 0x124], 0
jmp 0x40d4f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x124]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x11c]
mov byte [eax], 0x5c
mov ecx, dword [ebp - 0x11c]
add ecx, 1
mov dword [ebp - 0x11c], ecx
jmp 0x40d462
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 8
Function at 0x40342c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x429014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4034c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034a4
xor eax, eax
push ebp
push 0x40349d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4034e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x429014]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x429014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e5c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42b044], 0
je 0x403ebd
cmp word [0x42b218], 0xd7b2
jne 0x403e85
cmp dword [0x42b220], 0
jbe 0x403e85
mov eax, 0x42b214
call dword [0x42b230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ee4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x429020], 0
jne 0x403ed9
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406914
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40694d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004040cc
jmp 0x406956
mov eax, ebx
mov edx, esi
call fcn.00404030
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406960
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406982
movzx eax, byte [esp]
jmp 0x406984
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407014
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406e8c
mov eax, dword [0x42a344]
cmp byte [eax], 0
je 0x407090
mov eax, dword [0x42a2a0]
call fcn.00402f34
call fcn.00402d9c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405dd4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4070d8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4070c6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x42a280]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42d7f0]
call fcn.00404644
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x7c603d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7cf398
cmp edx, dword [eax]
je 0x7c605f
add eax, 8
inc ecx
cmp eax, 0x7cf428
jl 0x7c6050
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x7cf398]
jne 0x7c618d
mov eax, dword [0xbd2cf4]
cmp eax, 1
je 0x7c6167
test eax, eax
jne 0x7c6090
cmp dword [0x7cf2c4], 1
je 0x7c6167
cmp edx, 0xfc
je 0x7c618d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c60c7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.007c6a20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.007c6eb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x7c610a
lea eax, [ebp - 0x1a4]
push eax
call fcn.007c6eb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7cbaac
push edi
call fcn.007c8d80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.007c6a20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.007c6a30
lea eax, [ebp - 0xa0]
push 0x7cba8c
push eax
call fcn.007c6a30
push dword [esi + 0x7cf39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.007c6a30
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.007c8cf4
add esp, 0x2c
pop edi
jmp 0x7c618d
lea eax, [ebp + 8]
lea esi, [esi + 0x7cf39c]
push 0
push eax
push dword [esi]
call fcn.007c6eb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1388370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x138838e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x13b1074
push ecx
mov edi, eax
call fcn.0139c198
mov esi, eax
add esp, 8
test esi, esi
jne 0x13883cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0139c02e
push esi
call fcn.0139bfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret