joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bca
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
mov eax, 8
call sub.shlwapi.dll_PathFileExistsA
cmp dword [ebp - 4], esp
je 0x401c01
push 0x24
push 0x4014102
push 6
call fcn.004020f1
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x401c15
mov esp, ebp
pop ebp
ret 4

Function at 0x401f78
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
mov eax, 0xf
call sub.Kernel32.dll_DeleteFileA
cmp dword [ebp - 4], esp
je 0x401faf
push 0x12
push 0x4014104
push 6
call fcn.004020f1
add esp, 0xc
jmp 0x401fb4
mov esp, ebp
pop ebp
ret 4

Function at 0x401fba
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov eax, 0x10
call sub.Kernel32.dll_MoveFileA
cmp dword [ebp - 4], esp
je 0x401ff6
push 0x12
push 0x4014103
push 6
call fcn.004020f1
add esp, 0xc
jmp 0x401ffb
mov esp, ebp
pop ebp
ret 8

Function at 0x402001
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 1
jne 0x402020
mov dword [ebp + 0x14], 0
jmp 0x40203d
cmp dword [ebp + 0x14], 2
jne 0x402036
mov dword [ebp + 0x14], 7
jmp 0x40203d
mov dword [ebp + 0x14], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0x40623b
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
mov eax, 0x11
call sub.Shell32.dll_ShellExecuteA
cmp dword [ebp - 4], esp
je 0x402082
push 0xff
push 0x4014101
push 6
call fcn.004020f1
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x40209e
mov eax, 0
jmp 0x4020a8
mov eax, 1
jmp 0x4020a8
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.00406487
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406a95
test eax, eax
jne 0x401514
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x403323
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x40334c
mov eax, dword [0x429598]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x40c954], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.004031a4
test eax, eax
js 0x403422
push ebx
push esi
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call fcn.00406af7
test eax, eax
je 0x40341d
push dword [ebp + 8]
add dword [0x40c954], 4
call fcn.004031a4
mov esi, eax
test esi, esi
js 0x403419
cmp dword [ebp + 0x10], edi
jne 0x4033ed
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x403419
mov ebx, 0x4000
mov edi, 0x4149f8
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40a014]
mov dword [ebp - 4], eax
call fcn.00406af7
test eax, eax
je 0x40341d
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.00406bba
test eax, eax
je 0x4033e9
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40c954], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x4033a5
jmp 0x403419
push 0xfffffffffffffffe
jmp 0x40341f
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40341d
mov esi, dword [ebp - 4]
add dword [0x40c954], esi
mov eax, esi
jmp 0x403420
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x403445
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
je 0x40346d
mov eax, dword [0x40c968]
test eax, eax
je 0x403464
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c968], 0
leave
ret
cmp dword [0x40c968], 0
je 0x40347f
push 0
call fcn.004063be
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x429540]
jbe 0x4034e9
cmp dword [0x428538], 0
je 0x4034c4
test byte [0x429634], 1
je 0x4034e9
call fcn.00403427
push eax
lea eax, [ebp - 0x80]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.00405ef8
leave
ret
push 0
push 0x4037a3
push 0
push 0x6f
push dword [0x428534]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c968], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x405fdc
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x40634d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x406387
test eax, eax
je 0x406387
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x406389
mov ecx, 0x4082a8
jmp 0x40638e
xor eax, eax
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4063ec
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40640f
push dword [esp + 8]
push dword [esp + 8]
call fcn.004064b5
pop ecx
pop ecx
inc dword [0x429610]
ret 8

Function at 0x4064b5
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x426680], 0x55004e
mov ebp, 0x426680
mov dword [0x426684], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x40650b
push 1
push 0
push esi
call fcn.00406aca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x4065eb
cmp eax, ebx
jg 0x4065eb
push ebx
mov esi, 0x425e80
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x4065eb
cmp eax, ebx
jg 0x4065eb
push esi
push ebp
push str._ls_ls_r_n
push 0x425a80
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x429550]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00406057
push 4
push 0xc0000000
push esi
call fcn.00406aca
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4065eb
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4065e4
push esi
push edi
push ebx
call fcn.00406af7
test eax, eax
je 0x4065e4
push str._Rename__r_n
push edi
call fcn.00406ce5
test eax, eax
jne 0x4065f0
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x425a80
lea eax, [ecx + edi]
push eax
call fcn.00406863
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406bba
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x40899c
add eax, 0xa
push eax
call fcn.00406ce5
mov ecx, eax
test ecx, ecx
je 0x4065b5
lea edx, [edi + esi]
jmp 0x40660f
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x406609
sub ecx, edi
inc ecx
jmp 0x4065b7
Function at 0x406734
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406d4c
mov edi, eax
cmp edi, 0xffffffff
je 0x406777
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406758
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40675e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406767
xor eax, eax
inc eax
jmp 0x406779
test byte [ebp + 0xc], 4
jne 0x406777
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4067e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x425280
push ebx
call fcn.00406cc9
push ebx
call fcn.00406d74
mov esi, eax
test esi, esi
je 0x40685c
push esi
call fcn.00406eec
test byte [0x42954c], 0x80
je 0x406820
movzx eax, word [esi]
test ax, ax
je 0x40685c
cmp eax, 0x5c
je 0x40685c
sub esi, ebx
sar esi, 1
jmp 0x40683a
call fcn.0040677e
test eax, eax
je 0x406834
test byte [eax], 0x10
je 0x40685c
push ebx
call fcn.00406ebf
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x406826
call fcn.00406705
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40685c
xor eax, eax
inc eax
jmp 0x40685e
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x406885
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x424a38], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x424a38
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4068c4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4068c8
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.004067e7
mov dword [esp + 0x14], eax
test bl, 8
je 0x40690a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429608], eax
jmp 0x406a89
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406927
test eax, eax
je 0x406a78
test bl, 2
je 0x406a41
push esi
push 0x424a80
call fcn.00406cc9
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x40694a
push str..
push 0x424a80
call ebp
jmp 0x406950
push esi
call fcn.00406ebf
xor eax, eax
cmp word [esi], ax
jne 0x406961
cmp word [0x424a80], 0x5c
jne 0x406969
push 0x4082a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x424a80
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406a2a
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4069b3
cmp word [esp + 0x4a], 0
je 0x406a0c
cmp word [esp + 0x4a], ax
jne 0x4069b3
cmp word [esp + 0x4c], 0
je 0x406a0c
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406cc9
test byte [esp + 0x1c], 0x10
je 0x4069da
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406a0c
push ebx
push esi
call fcn.004068c8
jmp 0x406a0c
push edi
push esi
call fcn.00406734
test eax, eax
jne 0x406a04
test edi, edi
je 0x4069fc
push esi
push 0xfffffffffffffff1
call fcn.00405ef8
xor eax, eax
push eax
push esi
call fcn.004063ec
jmp 0x406a0c
inc dword [0x429608]
jmp 0x406a0c
push esi
push 0xfffffffffffffff2
call fcn.00405ef8
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406995
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x406a88
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x406a78
push esi
call fcn.0040677e
test eax, eax
je 0x406a88
push esi
call fcn.00406705
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406734
test eax, eax
jne 0x406a80
test edi, edi
je 0x406a78
push esi
push 0xfffffffffffffff1
call fcn.00405ef8
xor eax, eax
push eax
push esi
call fcn.004063ec
jmp 0x406a88
inc dword [0x429608]
jmp 0x406a88
push esi
push 0xffffffffffffffe5
call fcn.00405ef8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x406aca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x406b26
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406487
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406b98
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x406b98
cmp dword [ebp + 0x18], 1
je 0x406b9d
cmp dword [ebp + 0x18], 2
je 0x406b9d
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406ba2
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406c05
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406c4f
test edi, edi
jne 0x406c12
mov word [esi], ax
jmp 0x406c51
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406d4c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406d6e
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406feb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4270d4], 0
push esi
jne 0x407025
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406ffc
mov dword [ecx*4 + 0x4270d0], edx
inc ecx
cmp ecx, 0x100
jl 0x406ff7
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x40704f
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4270d0]
inc esi
sub edx, 1
jne 0x407037
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x403318
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405224
test esi, esi
jne 0x40334e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405314
jmp 0x40336c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040321c
mov edi, eax
test esi, esi
je 0x40336c
cmp dword [ebx], 0
je 0x40336c
dec esi
jmp 0x403355
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40411c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4db020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4041b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404194
xor eax, eax
push ebp
push 0x40418d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4041d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404194
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4db020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4db020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404fd0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4df04c], 0
je 0x405031
cmp word [0x4df220], 0xd7b2
jne 0x404ff9
cmp dword [0x4df228], 0
jbe 0x404ff9
mov eax, 0x4df21c
call dword [0x4df238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4db02c], 0
jne 0x40504d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4051a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4db034], 0
je 0x4051ce
mov edx, esi
mov eax, ebx
call dword [0x4db034]
jmp 0x4051dd
mov eax, 8
call fcn.00402f2c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4df04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405170
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4097c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x409816
test eax, edx
je 0x409819
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4097d9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4097ff
add ecx, 4
js 0x4097ef
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4097fc
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409825
test edx, edx
jne 0x4097cc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40a400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004056b4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a419
test al, 0x10
je 0x40a41d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a424
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004056b4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a43d
test al, 0x10
jne 0x40a441
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a448
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.004056b4
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40a46a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40d910
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d949
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00405314
jmp 0x40d952
mov eax, ebx
mov edx, esi
call fcn.00405278
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d95c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d97e
movzx eax, byte [esp]
jmp 0x40d980
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret