joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b9e0
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x47b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x50
mov edi, edx
mov esi, ecx
call fcn.00430ebc
add esp, 4
mov dword [ebp - 8], eax
mov ecx, eax
call fcn.0041b840
push 0x50
mov ebx, eax
push 0
push ebx
call fcn.00435ae0
add esp, 0xc
lea ecx, [ebx + 0x30]
push esi
call fcn.0040ac70
push edi
lea ecx, [ebx + 0x28]
mov dword [ebx + 0x1c], 3
call fcn.0040ac70
push str.http:__www.carifred.com
lea ecx, [ebx + 0x38]
call fcn.0040ac70
lea ecx, [ebx + 0x40]
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_44.0.2403.125_Safari_537.36
call fcn.0040ac70
push 0
lea ecx, [ebx + 0x28]
call fcn.0040ace0
movzx eax, word [eax]
cmp eax, 0x22
je 0x41ba8f
cmp eax, 0x5c
je 0x41ba8f
push 2
push 2
push 1
push 1
push 0x46e4f8
lea ecx, [ebx + 0x28]
call fcn.0040b7a0
test eax, eax
je 0x41ba8f
sub esp, 0x28
lea ecx, [ebx + 0x28]
push 0
push 0x46e4e8
call fcn.0040bd60
push 0
push 0
push ebx
push 0x41bb50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x48], eax
test eax, eax
jne 0x41baf2
lea ecx, [ebx + 0x40]
call fcn.0040acf0
lea ecx, [ebx + 0x38]
call fcn.0040acf0
lea ecx, [ebx + 0x30]
call fcn.0040acf0
lea ecx, [ebx + 0x28]
call fcn.0040acf0
lea ecx, [ebx + 0x20]
call fcn.0040acf0
push 0x50
push ebx
call fcn.0043177f
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430eab
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [ebp - 8]
push ecx
push eax
call esi
test eax, eax
je 0x41bb2f
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp dword [ebp - 8], 0x103
jne 0x41bb2f
call fcn.0040c890
push 0xa
call edi
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x48]
call esi
test eax, eax
jne 0x41bb10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430eab
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c0c0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e8b8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x47b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x3c
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.00435ae0
add esp, 0xc
mov ecx, esi
push 0
push 0x400
call fcn.0040b080
push 0
push 0x400
mov ecx, ebx
call fcn.0040b080
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
movq qword [ebp - 0x18], xmm0
call fcn.0040abc0
push 0
push 0x400
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.0040b080
mov ecx, esi
mov dword [ebp - 0x54], 0x3c
call fcn.0040ae10
mov ecx, ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x400
call fcn.0040ae10
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x400
call fcn.0040ae10
mov dword [ebp - 0x20], eax
mov ecx, edi
lea eax, [ebp - 0x54]
mov dword [ebp - 0x1c], 0x400
push eax
push 0
call fcn.0040c920
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov byte [ebp - 0x55], al
test al, al
je 0x41c1c6
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.0040ae10
push eax
mov ecx, ebx
call fcn.0040ba50
mov ecx, dword [ebp - 0x5c]
mov ax, word [ebp - 0x3c]
mov word [ecx], ax
lea ecx, [ebp - 0x18]
call fcn.0040acf0
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430eab
mov esp, ebp
pop ebp
ret 8
Function at 0x41c7e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x46c480]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x41c890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x47b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x41c91c
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x41c8cd
cmp dword [esi + 0x40], edi
jae 0x41c8cd
push eax
call fcn.00430eef
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x41c8e5
lea eax, [edi + edi]
push eax
call fcn.00430ef4
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push dword [esi + 0x3c]
call fcn.00435c80
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x41c919
lea ecx, [esi + 0x30]
nop dword [eax + eax]
mov eax, dword [esi + 0x3c]
mov dl, byte [ebx + eax]
call fcn.0041c850
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
lea ecx, [esi + 0x30]
cmp ebx, edi
jb 0x41c900
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41c95c
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x41c937
mov dword [esi + 0x14], 0x30000
jmp 0x41c98f
push edi
add ecx, edx
push ebx
push ecx
call fcn.00435c80
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430eab
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x41c988
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430eab
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430eab
mov esp, ebp
pop ebp
ret 8
Function at 0x41e540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41e54b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x41e607
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
sub edi, 1
jne 0x41e560
pop edi
test esi, esi
je 0x41e62a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46c480]
sub esi, 1
jne 0x41e610
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x41ee70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x47b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x41eeb6
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41eeb1
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x41eede
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x41eec7
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.00435c80
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00430eab
mov esp, ebp
pop ebp
ret
Function at 0x41fe90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x41ff34
cmp dword [esi + 4], 0xffffffff
jne 0x41ff34
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fec2
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x41fef6
cmp eax, 0x2f
je 0x41fef6
push 0x46dcd0
push 0x104
push edi
call fcn.0043dc75
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041ecc0
add esp, 8
test eax, eax
jne 0x41ff15
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.0041f220
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4205d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x47b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x420602
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x420602
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4206c3
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x42061f
cmp ax, 0x5c
jne 0x420621
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x420613
cmp esi, ebx
je 0x42066a
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.00435c80
add esp, 0xc
cmp esi, 0x208
jae 0x4206d3
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.004205d0
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x42068d
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0043dd44
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0043dc75
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4206c3
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00430eab
mov esp, ebp
pop ebp
ret
call fcn.004315e8
int3
Function at 0x422170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ea58
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x47b00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040c920
mov esi, eax
test esi, esi
jne 0x4221b0
xor edx, edx
jmp 0x422336
mov eax, 0xff
mov dword [ebp - 0x244], 0x64
cmp esi, 0x100
mov dword [ebp - 0x240], 0xc
xorps xmm0, xmm0
cmovge esi, eax
movlpd qword [ebp - 0x23c], xmm0
lea eax, [esi + 1]
push eax
push ecx
lea eax, [ebp - 0x234]
push 0x100
push eax
call fcn.00437eb7
xor eax, eax
mov dword [ebp - 0x20], 0
add esp, 0x10
mov word [ebp + esi*2 - 0x234], ax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x244]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x24c], eax
xorps xmm0, xmm0
push 0xffffffffffffffff
lea eax, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
push str.HKLM64SoftwareMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x18], 0
call fcn.0040d5b0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push str.SystemRestorePointCreationFrequency
lea ecx, [ebp - 0x18]
call fcn.0040d8a0
push 0
mov byte [ebp - 0x24d], al
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x24]
push eax
push 4
push str.SystemRestorePointCreationFrequency
call fcn.0040daa0
push 0
push 0
lea eax, [ebp - 0x24c]
push eax
push 0x422360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x422313
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [ebp - 0x1c]
push eax
push esi
mov dword [ebp - 0x1c], 0
call edi
test eax, eax
je 0x4222d4
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
cmp dword [ebp - 0x1c], 0x103
jne 0x4222d4
call fcn.0040c890
push 1
push 0x14
call ebx
lea eax, [ebp - 0x1c]
push eax
push esi
call edi
test eax, eax
jne 0x4222b5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x24d], 0
lea ecx, [ebp - 0x18]
je 0x4222fb
push 0
lea eax, [ebp - 0x20]
push eax
push 4
push str.SystemRestorePointCreationFrequency
call fcn.0040daa0
jmp 0x422305
push str.SystemRestorePointCreationFrequency
call fcn.0040dc20
cmp dword [ebp - 0x1c], 0
je 0x422313
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
jmp 0x42232a
xorps xmm0, xmm0
movlpd qword [ebp - 0x25c], xmm0
mov edi, dword [ebp - 0x258]
mov esi, dword [ebp - 0x25c]
lea ecx, [ebp - 0x18]
call fcn.0040d630
mov eax, esi
mov edx, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00430eab
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ba90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x42bac1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x42bab0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x42c280
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x42c451
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x42c451
cmp eax, 0x29
jne 0x42c2b9
cmp dword [esi + 0x10], 0
jne 0x42c451
test dword [esi + 0x50], 0x10000000
je 0x42c457
cmp eax, 0x2e
jne 0x42c316
push 5
lea ecx, [esi + 0x24]
call fcn.0042c640
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x42c30a
cmp word [eax], 0x5c
jne 0x42c307
add eax, 2
cmp eax, ecx
je 0x42c307
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x42c2f3
movzx edx, word [eax]
cmp edx, 0x28
je 0x42c305
cmp edx, 0x29
je 0x42c305
test cl, 0x10
jne 0x42c307
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x42c305
cmp ecx, 0x7d
jne 0x42c307
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.0042a910
jmp 0x42c43e
cmp eax, 0x5c
jne 0x42c37d
mov ecx, esi
call fcn.0042c230
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x42c349
cmp word [esi + 0x48], 0x62
jne 0x42c349
push 4
lea ecx, [esi + 0x24]
call fcn.0042c640
mov ecx, esi
call fcn.0042c230
jmp 0x42c445
test eax, eax
je 0x42c371
cmp word [esi + 0x48], 0x42
jne 0x42c371
push 4
lea ecx, [esi + 0x24]
call fcn.0042c640
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0042c230
jmp 0x42c445
mov ecx, esi
call fcn.0042d690
jmp 0x42c43e
cmp eax, 0x5b
jne 0x42c3a0
mov ecx, esi
call fcn.0042c230
mov ecx, esi
call fcn.0042d5e0
push 4
push 0x5d
mov ecx, esi
call fcn.0042d570
jmp 0x42c43e
cmp eax, 0x28
jne 0x42c3ca
mov ecx, esi
call fcn.0042c230
mov ecx, esi
call fcn.0042d760
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.0042d570
test bl, bl
je 0x42c445
jmp 0x42c43e
cmp eax, 0x5e
jne 0x42c3e2
push 2
lea ecx, [esi + 0x24]
call fcn.0042c640
mov ecx, esi
call fcn.0042c230
jmp 0x42c445
cmp eax, 0x24
jne 0x42c3fa
push 3
lea ecx, [esi + 0x24]
call fcn.0042c640
mov ecx, esi
call fcn.0042c230
jmp 0x42c445
cmp eax, 0x2a
je 0x42c46c
cmp eax, 0x2b
je 0x42c46c
cmp eax, 0x3f
je 0x42c46c
cmp eax, 0x7b
je 0x42c46c
cmp eax, 0x7d
jne 0x42c41c
test dword [esi + 0x50], 0x10000000
je 0x42c45e
cmp eax, 0x5d
jne 0x42c42a
test dword [esi + 0x50], 0x10000000
je 0x42c465
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0042d990
mov ecx, esi
call fcn.0042c230
mov ecx, esi
call fcn.0042d860
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x42c291
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.00432a90
push 6
call fcn.00432a90
push 4
call fcn.00432a90
push 0xa
call fcn.00432a90
int3
Function at 0x4029f4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403fb8
test esi, esi
jne 0x402a2a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004040a8
jmp 0x402a48
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402908
mov edi, eax
test esi, esi
je 0x402a48
cmp dword [ebx], 0
je 0x402a48
dec esi
jmp 0x402a31
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x49e020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403178
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403158
xor eax, eax
push ebp
push 0x403151
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403194
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403158
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x49e020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x49e020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e3c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4a0048], 0
je 0x403e9d
cmp word [0x4a021c], 0xd7b2
jne 0x403e65
cmp dword [0x4a0224], 0
jbe 0x403e65
mov eax, 0x4a0218
call dword [0x4a0234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x49e06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ec4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49e030], 0
jne 0x403eb9
push 0
push 0x49e064
push 0x49e06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4053ac
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055dc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40542f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40542f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4055f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4054b8
xor eax, eax
push ebp
push 0x4054b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004051f4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405496
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405618
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405496
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4054b8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4055d2
cmp byte [ebp - 0xd], 0
jne 0x4054ff
cmp byte [ebp - 0x12], 0
je 0x4055d2
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405518
dec ebx
cmp byte [ebx], 0x2e
je 0x405527
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405517
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4055d2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405564
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4055d2
cmp byte [ebp - 0xd], 0
je 0x4055d2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4055d2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ca4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405d0a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404228
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c94
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405cf4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d11
lea eax, [ebp - 0x10]
call fcn.00403fb8
ret

Function at 0x40b35c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b395
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004040a8
jmp 0x40b39e
mov eax, ebx
mov edx, esi
call fcn.0040400c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b3a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b3c9
mov al, byte [esp]
jmp 0x40b3cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ba50
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b8c8
mov eax, dword [0x49fb5c]
cmp byte [eax], 0
je 0x40bacc
mov eax, dword [0x49f8b4]
call fcn.00402b00
call fcn.00402834
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408ac0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bb14
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bb02
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x49f848]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4a0664]
call fcn.004051b8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret