joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419500
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x419f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4424f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x41a097
cmp byte [edi + 0x49], 0
je 0x41a097
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x41a08b
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x419fe6
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea ebx, [edi + 0x4c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x41a006
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x41a02b
dec eax
je 0x41a02f
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x41a086
jmp 0x41a092
mov byte [edi + 0x49], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x41a03f
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x41a069
cmp edx, 0x10
jae 0x41a04e
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x41a083
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x41a08f
test esi, esi
jne 0x419ffa
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00419ec0
jmp 0x419ff4
lea ecx, [ebp - 0x2c]
call fcn.00406d30
xor al, al
jmp 0x41a099
lea ecx, [ebp - 0x2c]
call fcn.00406d30
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f12c
mov esp, ebp
pop ebp
ret
Function at 0x41adc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
imul eax, edx
push edi
mov dword [esi + 8], eax
test ebx, ebx
jne 0x41ade0
mov ebx, ecx
mov eax, dword [esi + 4]
push eax
xor edi, edi
call fcn.0041a680
add esp, 4
test al, al
je 0x41ae53
test ecx, ecx
jne 0x41ae22
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc100u.dll_new__
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebx
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0x10
mov ecx, edi
mov ebx, edi
mov edx, dword [esi + 0x1c]
push edx
push ecx
call fcn.0041a690
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
lea eax, [esi + 0x20]
push eax
call fcn.0041ee40
add esp, 0x18
mov ecx, dword [esi]
mov edx, dword [esi + 8]
push ecx
push 1
push edx
push ebx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x41ae79
push edi
call sub.mfc100u.dll_delete__
add esp, 4
test bl, bl
je 0x41aeb1
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
add dword [esi + 0x14], eax
mov edx, dword [esi + 0x24]
push 0xffffffffffffffff
push ecx
push 0x18
push ecx
mov eax, esp
push ecx
mov dword [eax], edx
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.0041ee40
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, esi
call fcn.0041ac50
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x41f340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call dword [sym.imp.MSVCR100.dll_fread]
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [ebp - 1], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x41f4a5
mov edx, dword [esi + 0x24]
add dword [esi + 0x14], ecx
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov eax, esp
mov dword [eax], edx
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 0xc], eax
call fcn.0041ee40
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov dword [ebp - 8], eax
add esp, 0x18
xor ebx, ebx
xor eax, eax
cmp ecx, 1
sete byte [ebp - 2]
cmp dword [ebp - 8], eax
je 0x41f44f
dec dword [ebp - 8]
xor edx, edx
cmp byte [ebp - 2], dl
je 0x41f3d1
cmp byte [edi], dl
jmp 0x41f3d4
cmp word [edi], dx
sete dl
test edx, edx
je 0x41f3ff
test eax, eax
je 0x41f3f8
cmp edi, eax
je 0x41f3f8
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebx
add edi, ecx
cmp dword [ebp - 8], 0
jne 0x41f3c3
test eax, eax
je 0x41f425
cmp edi, eax
je 0x41f425
mov ecx, dword [esi + 0x18]
imul ecx, ebx
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
test ebx, ebx
je 0x41f44f
mov edx, dword [ebp - 0xc]
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.0041ee40
add esp, 0x18
sub dword [esi + 0x1c], ebx
cmp dword [esi + 0x18], 1
jle 0x41f499
mov eax, dword [esi + 4]
push eax
call fcn.0041a680
add esp, 4
test al, al
je 0x41f499
mov ecx, dword [esi + 0x1c]
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.0041a690
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041ee40
add esp, 0x18
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.0041ac50
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x424990
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42daeb
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4424f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
lea eax, [ebp - 0x10]
xor esi, esi
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Right]
push 0x42fafc
mov ecx, eax
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Compare]
test eax, eax
lea ecx, [ebp - 0x10]
sete bl
mov byte [ebp - 4], 0
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
test bl, bl
je 0x4249fa
push 0x42fafc
jmp 0x424a35
push 1
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Right]
push 0x4313cc
mov ecx, eax
mov byte [ebp - 4], 2
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Compare]
test eax, eax
lea ecx, [ebp - 0x10]
sete bl
mov byte [ebp - 4], 0
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
test bl, bl
je 0x424a3e
push 0x4313cc
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::TrimRight]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov edx, 0x14
mov word [ebp - 0x20], dx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 3
mov esi, dword [eax - 0xc]
xor ecx, ecx
lea eax, [esi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc100u.dll_new__
mov edi, eax
lea eax, [esi + esi + 4]
push eax
push 0
push edi
call sub.MSVCR100.dll_memset
add esp, 0x10
push 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x28], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
push edi
sbb esi, esi
call sub.mfc100u.dll_delete
add esp, 4
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4258a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4258ae
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x42598d
mov esi, edx
shr esi, 3
push edi
jmp 0x4258d0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438870]
add ecx, 8
sub edx, 8
dec esi
jne 0x4258d0
pop edi
test edx, edx
je 0x4259aa
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x438870]
inc ecx
dec edx
jne 0x425991
not eax
pop esi
pop ebp
ret

Function at 0x425f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x425f60
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x425f54
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x425f71
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call sub.MSVCR100.dll_memcpy
add dword [edi + 0x18], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
Function at 0x426d40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4424f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x426e2c
movzx eax, word [edi]
test ax, ax
je 0x426e2c
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x426d80
cmp ax, 0x5c
jne 0x426d82
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x426d74
cmp esi, edi
je 0x426dbf
sub esi, edi
sar esi, 1
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy]
lea edx, [ebp - 0x20c]
push edx
xor ecx, ecx
push ebx
mov word [ebp + esi*2 - 0x20c], cx
call fcn.00426d40
add esp, 0x14
lea edx, [ebp - 0x414]
mov eax, ebx
sub edx, ebx
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x426dd0
mov eax, edi
mov edx, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426de3
lea edi, [ebp - 0x414]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x426e00
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x414]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040f12c
mov esp, ebp
pop ebp
ret

Function at 0x4287c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp dword [ebx], 0
jne 0x42885e
cmp dword [ebx + 4], 0xffffffff
jne 0x42885e
push edi
lea edi, [ebx + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4287f0
mov eax, dword [0x42fafc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [edi], eax
mov edi, dword [ebp + 8]
cmp esi, 1
jne 0x428827
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x428827
pop esi
pop edi
mov eax, 0x2000000
pop ebx
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push esi
push edx
push edi
call fcn.00425cc0
add esp, 0x10
test eax, eax
jne 0x428847
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push eax
call fcn.00428330
add esp, 4
pop esi
mov dword [ebx], eax
mov eax, dword [0x4769d0]
pop edi
pop ebx
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
pop ebp
ret 0xc
Function at 0x428d80
Capabilities:
Get common file path
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42db22
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x4424f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push eax
mov dword [ebp - 4], 1
call dword [sym.imp.MSVCR100.dll__waccess]
add esp, 8
cmp eax, 0xffffffff
jne 0x428de2
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
xor eax, eax
jmp 0x428ef2
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x428dc9
mov edx, dword [ebp + 8]
push 2
push 0
push edx
call fcn.00428c60
mov edi, eax
lea eax, [ebp - 0x448]
push eax
push 0xffffffffffffffff
push edi
call fcn.00426e40
mov eax, dword [ebp - 0x448]
add esp, 0x18
xor esi, esi
mov dword [ebp - 0x44c], eax
test eax, eax
jle 0x428eaa
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea esp, [esp]
lea ecx, [ebp - 0x448]
push ecx
push esi
push edi
call fcn.00426e40
push 2
push 0
lea edx, [ebp - 0x444]
push edx
push esi
push edi
call fcn.00428cd0
add esp, 0x20
lea eax, [ebp - 0x444]
push eax
call ebx
test al, 1
je 0x428ea1
and eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, dword [ebp - 0x44c]
jl 0x428e60
push edi
call fcn.00428d20
add esp, 4
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x44c]
call dword [0x42f908]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x44c]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f12c
mov esp, ebp
pop ebp
ret
Function at 0x42a0d0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4424f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebx], edx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov edx, dword [eax]
mov dword [ebx + 8], edx
mov eax, dword [eax + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 1
jae 0x42a11d
push 0x43e980
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 0x40], str.Incorrect_key_length
call sub.MSVCR100.dll__CxxThrowException
cmp eax, 0x38
jbe 0x42a12c
mov dword [ebp + 0xc], 0x38
mov eax, dword [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x3c]
push edx
call sub.MSVCR100.dll_memcpy
push 0x1000
lea eax, [ebx + 0x58]
push 0x438f30
lea edi, [ebx + 0x10]
mov ecx, 0x12
mov esi, 0x438ee8
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll_memcpy
lea edx, [ebx + 0x10]
add esp, 0x18
lea ecx, [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], 0x12
mov edi, edi
xor edx, edx
mov esi, 4
movzx edi, byte [ecx]
shl edx, 8
inc eax
dec esi
or edx, edi
inc ecx
cmp eax, dword [ebp + 0xc]
jne 0x42a18c
xor eax, eax
lea ecx, [ebp - 0x3c]
test esi, esi
jne 0x42a177
mov esi, dword [ebp - 0x44]
xor dword [esi], edx
add esi, 4
dec dword [ebp - 0x40]
mov dword [ebp - 0x44], esi
jne 0x42a170
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
xor edi, edi
lea esi, [ebx + 0x10]
lea eax, [ebp - 0x4c]
push eax
mov ecx, ebx
call fcn.004292d0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov dword [esi], ecx
mov dword [esi + 4], edx
add edi, 2
add esi, 8
cmp edi, 0x12
jb 0x42a1b3
lea eax, [ebx + 0x58]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 4
mov esi, dword [ebp - 0x44]
xor edi, edi
lea eax, [ebp - 0x4c]
push eax
mov ecx, ebx
call fcn.004292d0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov dword [esi], ecx
mov dword [esi + 4], edx
add edi, 2
add esi, 8
cmp edi, 0x100
jl 0x42a1e6
add dword [ebp - 0x44], 0x400
dec dword [ebp - 0x40]
jne 0x42a1e1
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040f12c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403808
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40c014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403880
xor eax, eax
push ebp
push 0x403879
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403880
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40c014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40c014], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040c8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40d038], 0
je 0x404129
cmp word [0x40d20c], 0xd7b2
jne 0x4040f1
cmp dword [0x40d214], 0
jbe 0x4040f1
mov eax, 0x40d208
call dword [0x40d224]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40c0ac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404150
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40c020], 0
jne 0x404145
push 0
push 0x40c0a4
push 0x40c0ac
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405428
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40548e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404480
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403034
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405478
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405495
lea eax, [ebp - 0x10]
call fcn.0040424c
ret