joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425eee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x425f2e
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x425ed8
call fcn.00424ad8
lodsd eax, dword [esi]
aaa
loop 0x425f80
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
invalid
test ebx, esp
clc
invalid
invalid
clc
invalid
Function at 0x401ee0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ebx, 0x463038
mov edi, 0x4630e0
lea eax, [edi + 8]
mov ebp, esi
mov dword [esp + 0x10], eax
mov eax, dword [eax]
test eax, eax
je 0x401f0c
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, eax
mov ecx, ebp
call fcn.00423220
cmp word [edi + 4], 0
je 0x401f96
mov eax, dword [edi + 0xc]
test eax, eax
je 0x401f6e
mov ecx, dword [0x475378]
mov eax, dword [ecx + eax*4]
cmp byte [eax], 0x2b
jne 0x401f66
inc eax
push eax
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
xor eax, eax
mov ax, word [edi + 6]
add eax, 8
push eax
xor eax, eax
mov ax, word [edi + 4]
push eax
xor eax, eax
mov ax, word [edi + 2]
sub eax, 8
push eax
xor eax, eax
mov ax, word [edi]
push eax
push ebp
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
jmp 0x401f98
push eax
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
xor eax, eax
mov ax, word [edi + 6]
push eax
xor eax, eax
mov ax, word [edi + 4]
push eax
xor eax, eax
mov ax, word [edi + 2]
push eax
xor eax, eax
mov ax, word [edi]
push eax
push ebp
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
jmp 0x401f98
push 0
push ebp
add edi, 0x10
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x10]
cmp dword [eax], 0
jne 0x401ef3
xor edi, edi
mov ebp, dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, dword [ebx]
push 0
push 3
add ebx, 0x18
push 0xc5
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov eax, dword [ebx - 8]
push eax
mov ecx, dword [ebx - 0x18]
push ecx
push esi
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov eax, 0x64
mov ecx, dword [ebx - 8]
sub eax, ecx
mov edx, dword [ebx - 0x14]
push eax
push edx
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, edi
mov ecx, eax
inc edi
call fcn.00402040
xor eax, eax
mov ecx, dword [ebx - 0x10]
mov al, byte [ebx - 4]
push eax
push ecx
push esi
call ebp
cmp edi, 7
jl 0x401fb7
xor eax, eax
mov al, byte [0x463030]
push eax
push 0xbdc
push esi
call ebp
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 4
Function at 0x402370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
lea eax, [esp]
push ebx
lea edx, [esp + 8]
push esi
mov dword [esp + 8], 0x40
push eax
push edx
push 0
push 0
push str.Mixer
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4023d3
mov esi, 0x463038
mov al, byte [esp + 0xc]
mov byte [0x463034], al
mov eax, 7
mov cl, byte [esp + 0x10]
mov byte [0x463030], cl
lea ecx, [esp + 0x14]
mov edx, dword [ecx]
add ecx, 4
mov dword [esi + 0x10], edx
add ecx, 4
add esi, 0x18
dec eax
mov dl, byte [ecx - 4]
mov byte [esi - 4], dl
jne 0x4023bc
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x402c40
Capabilities:
Create thread

Disassembly:
test cl, 0x20
push ebx
jne 0x402ce4
test cl, 2
je 0x402c6e
mov ecx, dword [0x4753dc]
call fcn.00413b90
test eax, eax
jne 0x402ce4
mov dword [0x4c8078], 1
pop ebx
ret
test cl, 1
je 0x402c8c
push 0
mov eax, dword [0x4c8024]
push 0
mov ecx, dword [0x4753f4]
push eax
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop ebx
ret
mov ecx, dword [0x4753dc]
call fcn.00413b90
test eax, eax
jne 0x402ce4
mov dword [0x4c8078], 1
mov ecx, dword [0x4753dc]
call fcn.00413d10
test eax, eax
jne 0x402ce4
push 0x4753f4
mov eax, dword [0x4753dc]
push 0
push eax
push 0x403040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
mov ecx, dword [0x4b8890]
push ecx
mov dword [0x4c807c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebx
ret
Function at 0x40e5c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
mov dword [esp + 4], 0x16
push eax
push 0x465fb8
push 0
push 0
push str.Controls
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ebx
add esp, 4
ret

Function at 0x40e5f0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea ecx, [esp + 0xc]
push 0x10
push 0
push ecx
call fcn.004562e0
add esp, 0xc
and eax, 0x3ff
sub eax, 7
cmp eax, 9
ja case.0x40e627.12
xor ecx, ecx
mov cl, byte [eax + 0x40e684]
jmp dword [ecx*4 + 0x40e66c]
mov esi, 0x465fe8
jmp 0x40e656
mov esi, 0x4660f0
jmp 0x40e656
mov esi, 0x466408
jmp 0x40e656
mov esi, 0x466510
jmp 0x40e656
mov esi, 0x4661f8
jmp 0x40e656
mov esi, 0x466300
mov edi, 0x4c5d90
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x40e690
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 8]
sub eax, 0xa0
cmp eax, 2
nop
lea ecx, [eax*2 + 0x465fb8]
jl 0x40e6aa
cmp eax, 3
jle 0x40e6b9
call fcn.0040e760
call fcn.0040e6d0
jmp fcn.0040e710
call fcn.0040fc70
call fcn.0040e6d0
jmp fcn.0040e710

Function at 0x40e710
Capabilities:
Set registry value

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e75a
mov eax, dword [esp + 4]
push 0x16
push 0x465fb8
push 3
push 0
push str.Controls
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 4
ret
Function at 0x40fb50
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4753dc]
push ebx
push esi
push edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0x105
push 0x100
push eax
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
mov eax, dword [0x4753dc]
jne 0x40fb64
lea edi, [esp + 0x28]
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x40fbc8
xor ecx, ecx
mov edx, pe_nt_image_headers32
xor ebx, ebx
mov al, byte [esp + ecx + 0x28]
test dl, al
je 0x40fbbf
mov byte [0x4c5ba2], 1
mov al, byte [ecx + 0x4c5d90]
test al, al
jne 0x40fbd4
inc ecx
cmp ecx, 0x100
jb 0x40fba6
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x11c
ret
xor eax, eax
pop edi
mov al, byte [ecx + 0x4c5d90]
pop esi
pop ebx
add esp, 0x11c
ret

Function at 0x410780
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4666cc]
test eax, eax
nop
push ebx
push esi
push edi
mov ebx, 1
push ebp
je 0x4107a0
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov eax, dword [0x4666e0]
test eax, eax
je 0x4107b3
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4666e0], 1
push 0x4666d0
mov eax, dword [0x482018]
push str.TapiComm
push 0x411150
push eax
push 0x4666cc
call sub.TAPI32.dll_lineInitialize
cmp eax, 0x80000052
mov ebp, eax
jne 0x410840
test ebx, ebx
je 0x410896
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, 0x1388
jae 0x41083c
lea eax, [esp + 0x10]
push 1
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x410831
lea eax, [esp + 0x10]
push eax
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
call edi
sub eax, ebx
cmp eax, 0x1388
jb 0x410808
xor ebx, ebx
jmp 0x410870
cmp ebp, 0x80000042
jne 0x410865
call fcn.00411ad0
test eax, eax
jne 0x410870
xor eax, eax
pop ebp
mov dword [0x4666e0], 0
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov ecx, ebp
call fcn.00411920
test eax, eax
je 0x4108c0
test ebp, ebp
jne 0x4107c9
xor eax, eax
pop ebp
pop edi
mov dword [0x4666e8], eax
pop esi
mov dword [0x4666ec], eax
pop ebx
mov dword [0x4666e0], eax
mov eax, 1
add esp, 0x1c
ret
mov eax, dword [0x475378]
mov ecx, dword [eax + 0x724]
push ecx
push 0
call fcn.00443120
add esp, 8
xor eax, eax
mov dword [0x4666e0], 0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
xor eax, eax
pop ebp
mov dword [0x4666e0], 0
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x411070
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push ebp
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x482124], ebx
call ebp
mov edi, eax
mov dword [0x482308], ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
test esi, esi
je 0x4110a4
mov eax, dword [0x4666f8]
cmp eax, esi
je 0x411121
lea eax, [esp + 0x10]
push 1
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, dword [0x482124]
mov edx, dword [0x4666e4]
test eax, eax
mov eax, dword [0x482308]
je 0x4110ef
lea eax, [esp + 0x10]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x482308]
mov ecx, dword [0x482124]
mov edx, dword [0x4666e4]
test esi, esi
jne 0x4110f7
test eax, eax
jne 0x411121
test edx, edx
je 0x411135
test ecx, ecx
jne 0x411135
call ebp
sub eax, edi
cmp eax, 0x7530
jbe 0x411097
mov eax, 2
pop ebp
mov dword [0x482124], 1
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
xor eax, eax
pop ebp
mov dword [0x482124], 1
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov eax, 1
pop ebp
mov dword [0x482124], 1
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x411b10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor ecx, ecx
mov dword [esp + 0x14], ecx
push ebx
push esi
mov eax, 1
mov word [esp + 0x48], ax
mov dword [esp + 0x20], ecx
mov word [esp + 0x4a], cx
mov dword [esp + 0x24], ecx
lea edx, [esp + 8]
lea ebx, [esp + 0x18]
mov dword [esp + 0x44], eax
push edx
mov dword [esp + 0x50], ecx
push ebx
mov dword [esp + 0x20], 0x44
push ecx
push ecx
push 0x20
push ecx
push ecx
push ecx
push str.CONTROL.EXE_MODEM.CPL__ADD
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x411b7f
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
xor eax, eax
pop esi
pop ebx
add esp, 0x54
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x475378]
mov ecx, dword [eax + 0x790]
push ecx
push 0
call fcn.00443120
add esp, 8
xor eax, eax
pop esi
pop ebx
add esp, 0x54
ret
Function at 0x412e00
Capabilities:
Set registry value

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov ebx, ecx
push ebp
mov ebp, edx
test ebp, ebp
je 0x412e4f
cmp ebp, 0x482130
je 0x412e25
mov edi, 0x482130
mov esi, ebp
mov ecx, 0x74
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x50]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push eax
push 0xfa4
push ebx
call esi
lea ecx, [ebp + 0xd0]
add ebp, 0x150
push ecx
push 0xfa2
push ebx
call esi
push ebp
jmp 0x412e82
mov edi, 0x482130
xor eax, eax
mov ecx, 0x74
push 0x467614
rep stosd dword es:[edi], eax
push 0xfa4
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push ebx
call esi
push 0x467614
push 0xfa2
push ebx
call esi
push 0x467614
push 0xfa3
push ebx
call esi
lea eax, [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call ebp
test eax, eax
jne 0x412ee3
mov edi, 0x482130
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x10]
push ecx
push 0x482130
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push str.Redial
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call fcn.00412b00
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x412f00
Capabilities:
Get geographical location
Set registry value

Disassembly:
sub esp, 0x14
mov dword [esp + 0x10], ecx
push ebx
push esi
mov ebx, edx
push edi
mov esi, 0xffffffff
push ebp
push 0x1d4
call fcn.00455db0
mov dword [esp + 0x18], eax
add esp, 4
test eax, eax
je 0x4130e8
mov ecx, dword [0x482120]
mov dword [eax + 0x1d0], ecx
mov cl, byte [esp + 0x28]
mov dword [0x482120], eax
test cl, cl
je 0x4130a7
lea eax, [esp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call edi
test eax, eax
jne 0x4130a7
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.Phonebook
push ecx
call edi
test eax, eax
jne 0x41309a
xor ebp, ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
mov eax, ebp
inc ebp
push str.Entry_04d
push ebx
call fcn.00455e30
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 0x24]
add esp, 0xc
push ecx
push 0xf003f
push 0
push ebx
push eax
call edi
test eax, eax
jne 0x412fc9
mov eax, dword [esp + 0x10]
push eax
call esi
jmp 0x412f96
lea eax, [esp + 0x10]
push 0
push eax
push 0
mov ecx, dword [esp + 0x24]
push 0xf003f
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str.RoadRash
push 0
push ebx
push ecx
call ebp
test eax, eax
jne 0x413091
lea edx, [ebx + 0x10]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x10]
push ecx
push edx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push str.Name
push eax
call ebp
lea edx, [ebx + 0xd0]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x10]
push ecx
push edx
push 1
push 0
push str.AreaCode
push eax
call ebp
lea edx, [ebx + 0x150]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov ecx, dword [esp + 0x18]
push 1
push 0
push str.Number
push ecx
call ebp
lea edx, [ebx + 0x50]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov ecx, dword [esp + 0x18]
push 1
push 0
push str.Country
push ecx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
jmp 0x4130a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
push eax
call esi
mov edi, dword [esp + 0x14]
mov esi, ebx
mov ecx, 0x74
mov edx, 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x20]
add ebx, 0x10
call fcn.00413100
mov eax, dword [esp + 0x20]
push ebx
push 0
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x143
push 0xfa1
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x413190
Capabilities:
Get geographical location
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call fcn.00413140
mov ebx, eax
test ebx, ebx
je 0x4132de
mov esi, 0x482130
mov edi, ebx
mov ecx, 0x74
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x4132de
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push 0xf003f
push 0
push str.Phonebook
push ecx
call esi
test eax, eax
jne 0x4132d1
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ecx
call esi
test eax, eax
jne 0x4132c2
mov edi, 0x482140
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0xc]
push ecx
push 0x482140
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov edi, 0x482200
push 0
push str.Name
push eax
call esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x482200
mov ecx, dword [esp + 0x14]
push 1
push 0
mov edi, 0x482280
push str.AreaCode
push ecx
call esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0xc]
push ecx
push 0x482280
mov edi, 0x482180
push 1
push 0
push str.Number
push eax
call esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0xc]
push ecx
push 0x482180
push 1
push 0
push str.Country
push eax
call esi
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
jmp 0x4132c8
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call esi
jmp 0x4132d7
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4132f0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x48
mov dword [esp], ecx
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, edx
push 0xfa1
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
mov esi, dword [0x482120]
cmp esi, edi
je 0x41347b
mov ecx, ebp
lea edx, [esi + 0x10]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x413340
or al, al
je 0x41333c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x413340
add ecx, 2
add edx, 2
or al, al
jne 0x413320
xor eax, eax
jmp 0x413345
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41335d
mov edi, esi
mov esi, dword [esi + 0x1d0]
test esi, esi
jne 0x41331b
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
push ebp
push 0xffffffffffffffff
push 0x14c
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
test edi, edi
mov eax, dword [esi + 0x1d0]
je 0x413380
mov dword [edi + 0x1d0], eax
jmp 0x413385
mov dword [0x482120], eax
cmp ebp, 0xffffffff
je 0x413472
push 0
push ebp
push 0x144
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebp
jle 0x4133b2
push 0
push ebp
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4133e1
push 0
test ebp, ebp
je 0x4133c8
dec ebp
push ebp
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4133e1
push 0
push 0x14b
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
xor edx, edx
mov ecx, dword [esp + 0x10]
call fcn.00413100
lea eax, [esp + 0x18]
push 0x3f
mov ecx, dword [esp + 0x14]
push eax
push 0xfa1
push ecx
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea ecx, [esp + 0x18]
call fcn.00413140
mov edx, eax
mov ecx, dword [esp + 0x10]
call fcn.00412e00
lea ecx, [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ecx
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call edi
test eax, eax
jne 0x413472
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push 0xf003f
push 0
push str.Phonebook
push ecx
call edi
test eax, eax
jne 0x413465
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
jmp 0x41346b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
call edi
push esi
call fcn.00455d90
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x4139e0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x104
mov dword [esp], edx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x18
push ebp
mov edi, ecx
push str.FillCountryCodeList
mov edx, esi
mov ecx, ebx
call fcn.00411670
mov ebx, eax
test ebx, ebx
je 0x413ab5
push ebx
push 0x10004
push 0
call sub.TAPI32.dll_lineGetCountry
mov ecx, eax
mov ebp, eax
call fcn.00411920
test eax, eax
je 0x413ac0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
cmp ecx, eax
jae 0x413a3d
mov esi, eax
mov ebp, 0xffffffff
test ebp, ebp
jne 0x4139f7
mov esi, dword [ebx + 0x14]
xor ebp, ebp
add esi, ebx
mov ecx, dword [ebx + 0xc]
cmp ecx, ebp
je 0x413aae
add esi, 4
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esi + 0xc]
add eax, ebx
push eax
push str._s___lu_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x24]
add esp, 0x10
push ecx
push 0
push 0x143
push 0xfa4
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi - 4]
cmp edx, ecx
jne 0x413aa5
push 0
push eax
push 0x14e
push 0xfa4
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
add esi, 0x2c
inc ebp
cmp dword [ebx + 0xc], ebp
ja 0x413a52
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4159a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, edx
push 0
push 0x10000000
push 3
push 0
push 1
push connect
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x415a16
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push 0
push edi
mov eax, dword [esi]
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [esp + 0x10]
test eax, eax
mov dword [ebx], eax
je 0x415a0b
push edi
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x415a18
mov eax, dword [ebx]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
jmp 0x415a11
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
push eax
call edi
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x416120
Capabilities:
Set registry value

Disassembly:
sub esp, 4
mov ecx, 1
push ebx
push esi
call fcn.004361f0
call fcn.00442c00
xor edx, edx
mov ecx, dword [0x4753dc]
call fcn.0041f430
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4161b7
mov eax, dword [esp + 8]
push 1
push 0x474f48
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 3
push 0
push str.ChatState
push eax
call esi
mov ecx, dword [esp + 8]
push 1
push 0x467a98
push 3
push 0
push str.MiniDash
push ecx
call esi
mov eax, dword [esp + 8]
push 1
push 0x4753a8
push 3
push 0
push str.OpponentList
push eax
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x4c5d70]
test al, al
je 0x4161e0
mov byte [0x4b8a15], 0
xor ecx, ecx
call fcn.00431600
mov eax, 0xb
pop esi
mov byte [0x4c5d70], 0
pop ebx
add esp, 4
ret
mov cl, byte [0x4c5b00]
mov dl, byte [0x4c5af9]
mov al, cl
or al, dl
je 0x41622d
mov byte [0x4b8a15], 0
mov eax, dword [0x46c4cc]
cmp eax, 0x184
je 0x416209
test cl, cl
je 0x416237
xor ecx, ecx
mov cl, dl
call fcn.0043b320
mov dl, byte [0x4c5af9]
mov cl, byte [0x4c5b00]
test eax, eax
je 0x416237
mov eax, 0xb
pop esi
pop ebx
add esp, 4
ret
mov al, byte [0x4c5d78]
mov byte [0x4b8a16], al
mov eax, dword [0x4753b0]
test eax, eax
jne 0x41624b
mov eax, 9
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x4c5d7c]
cmp eax, 2
je 0x416283
cmp eax, 3
je 0x41628e
cmp eax, 4
je 0x416299
or cl, dl
je 0x416278
push 1
xor ecx, ecx
push 0xffffffffffffffff
mov cl, byte [0x4b8a10]
push 1
xor edx, edx
call fcn.004210a0
mov eax, 0x1c
pop esi
pop ebx
add esp, 4
ret
mov eax, 0x1e
pop esi
pop ebx
add esp, 4
ret
mov eax, 0x1f
pop esi
pop ebx
add esp, 4
ret
or cl, dl
je 0x4162b2
push 1
xor ecx, ecx
push 0xffffffffffffffff
mov cl, byte [0x4b8a10]
push 2
xor edx, edx
call fcn.004210a0
mov eax, 0x1d
pop esi
pop ebx
add esp, 4
ret