joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414fc0
Capabilities:
Create directory
Get common file path
Write file on windows

Disassembly:
sub esp, 0x424
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 0x420], eax
push 0x208
lea eax, [esp + 0x21c]
push 0
push eax
call fcn.0042f620
push 0x208
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0042f620
add esp, 0x18
lea eax, [esp + 0x10]
push eax
push 0x102
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.WinIoDrv
lea eax, [esp + 0x14]
push eax
push 0x447380
lea eax, [esp + 0x224]
push 0xffffffffffffffff
push eax
call fcn.004013f0
lea eax, [esp + 0x22c]
push eax
call fcn.00407f90
add esp, 0x18
test eax, eax
jne 0x415061
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x21c]
mov dword [esp + 8], 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.00420d10
mov esi, eax
lea eax, [esp + 0x21c]
cmp esi, 1
jne 0x4150d2
push str.IoDrvx64.sys
push 0x447404
push eax
push str._s_s_s
lea eax, [esp + 0x24]
push 0xffffffffffffffff
push eax
call fcn.004013f0
lea eax, [esp + 0x2c]
push eax
call fcn.00407f90
add esp, 0x1c
test eax, eax
jne 0x41513b
push 0x453a98
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00435872
add esp, 0xc
test eax, eax
jne 0x41513b
push dword [esp + 4]
push esi
push 0x38d0
push 0x44c978
jmp 0x41512a
push 0x447408
push 0x447404
push eax
push str._s_s_s
lea eax, [esp + 0x24]
push 0xffffffffffffffff
push eax
call fcn.004013f0
lea eax, [esp + 0x2c]
push eax
call fcn.00407f90
add esp, 0x1c
test eax, eax
jne 0x41513b
push 0x453a98
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00435872
add esp, 0xc
test eax, eax
jne 0x41513b
push dword [esp + 4]
push 1
push 0x3850
push 0x450248
call fcn.0043671b
push dword [esp + 0x14]
call fcn.0043592f
add esp, 0x14
push 0x46a8fc
push esi
call fcn.00407df0
mov ecx, dword [esp + 0x42c]
add esp, 8
mov dword [0x46c128], eax
pop esi
xor ecx, esp
call fcn.0042d960
add esp, 0x424
ret
Function at 0x41c620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf023f
push 0
push 0x5d
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c6c2
push 0x4b
mov ecx, 0x469a38
mov dword [esp + 0x10], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
call fcn.0040df90
mov ecx, eax
call fcn.00409580
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41c6af
push dword [esp]
jmp 0x41c6ca
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0042d960
add esp, 0x14
ret
mov eax, dword [esp]
test eax, eax
je 0x41c6d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
xor ecx, esp
call fcn.0042d960
add esp, 0x14
ret
Function at 0x41c720
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x13c]
sub esp, 0x13c
push 0xffffffffffffffff
push 0x445128
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4629b4]
xor eax, ebp
mov dword [ebp + 0x138], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
lea eax, [ebp + 0x38]
mov dword [ebp], 0
push 0
push eax
mov dword [ebp + 0x34], 0
call fcn.0042f620
add esp, 0xc
lea ecx, [ebp + 0x1c]
push 0x4464a0
call fcn.00405090
push 0x46a8fc
lea ecx, [ebp + 4]
mov dword [ebp - 4], 0
call fcn.00405090
push str.EnumPCI
lea ecx, [ebp + 4]
mov byte [ebp - 4], 1
call fcn.00405200
lea eax, [ebp]
push eax
push 0x20019
push 0
lea ecx, [ebp + 4]
call fcn.00409580
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c837
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor esi, esi
push 0
push 0
push 0
push 0
lea eax, [ebp + 0x34]
mov dword [ebp + 0x34], 0x80
push eax
lea eax, [ebp + 0x38]
push eax
push esi
push dword [ebp]
call edi
test eax, eax
jne 0x41c82e
push 0x469a14
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040ca90
add esp, 0xc
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.004051f0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004050d0
inc esi
cmp esi, 0x3e8
jb 0x41c7d6
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
nop dword [eax]
movsx eax, di
lea ecx, [ebp + 0x1c]
mov esi, dword [eax*4 + 0x4625f8]
call fcn.00409580
push esi
push eax
call fcn.0043008a
add esp, 8
test eax, eax
jne 0x41c8a2
inc edi
cmp di, 4
jl 0x41c840
xor edi, edi
nop dword [eax]
movsx eax, di
lea ecx, [ebp + 0x1c]
mov esi, dword [eax*4 + 0x462608]
call fcn.00409580
push esi
push eax
call fcn.0043008a
add esp, 8
test eax, eax
jne 0x41c899
inc edi
cmp di, 0xb
jl 0x41c870
jmp 0x41c8b6
push 0xffffffffffffffff
push str._Rst_
jmp 0x41c8a9
push 0xffffffffffffffff
push str._Vmd_
push 0x46b8b0
call fcn.0040d820
add esp, 0xc
lea ecx, [ebp + 4]
call fcn.004050d0
lea ecx, [ebp + 0x1c]
call fcn.004050d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x138]
xor ecx, ebp
call fcn.0042d960
lea esp, [ebp + 0x13c]
pop ebp
ret
Function at 0x420370
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x46c154]
push ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 4], ebp
test eax, eax
je 0x4203b3
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042d960
add esp, 0x24
ret
cmp word [0x46f688], 0
jne 0x420443
push 0x65
push dword [0x46c31c]
mov dword [0x46f68c], 0x30
mov dword [0x46f690], 0x40
mov dword [0x46f694], 0x4293b0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push 0
mov dword [0x46f6a4], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0
mov dword [0x46f6a8], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x4f
mov ecx, 0x469a38
mov dword [0x46f6ac], eax
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push 0x46f68c
mov dword [0x46f6b4], eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov word [0x46f688], ax
test ax, ax
je 0x42053f
push ebx
push esi
push edi
push 0
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [0x46c0e0]
mov ecx, 0x46b8a4
add eax, 0xfffffd08
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [0x46c0e4]
push 3
sar ebx, 1
lea eax, [eax - 0x258]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push 0x4f
mov ecx, 0x469a38
mov esi, eax
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push 0
push dword [0x46c31c]
push 0
push ebp
push 0x258
push 0x2fd
push edi
push ebx
push 0x4cf0000
push esi
push eax
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 5
push eax
mov dword [0x46c154], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14]
push 0
push 0
push 0
push eax
call ebp
test eax, eax
je 0x420530
mov ebx, dword [sym.imp.USER32.dll_IsDialogMessageW]
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
nop word [eax + eax]
lea eax, [esp + 0x14]
push eax
push dword [0x46c154]
call ebx
test eax, eax
jne 0x42051f
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x14]
push eax
call edi
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call ebp
test eax, eax
jne 0x420500
push 1
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
pop ebp
xor ecx, esp
call fcn.0042d960
add esp, 0x24
ret
Function at 0x420550
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x228
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [0x46c150]
push ebx
mov ebx, dword [esp + 0x230]
mov dword [esp + 4], ebx
test eax, eax
je 0x4205a2
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0042d960
add esp, 0x228
ret
cmp word [0x470708], 0
jne 0x420625
push 0x65
push dword [0x46c31c]
mov dword [0x47070c], 0x30
mov dword [0x470710], 0x40
mov dword [0x470714], 0x428a40
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push 0
mov dword [0x470724], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0
mov dword [0x470728], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x51
mov ecx, 0x469a38
mov dword [0x47072c], eax
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push 0x47070c
mov dword [0x470734], eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov word [0x470708], ax
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [0x46c0e0]
add eax, 0xfffffd99
cdq
sub eax, edx
mov esi, eax
mov eax, dword [0x46c0e4]
push 0x200
push 0
sar esi, 1
lea eax, [eax - 0x258]
cdq
sub eax, edx
mov edi, eax
lea eax, [esp + 0x38]
push eax
sar edi, 1
call fcn.0042f620
add esp, 0xc
lea eax, [esp + 0x30]
push 0x200
push eax
push 0x2b67
push dword [0x46c138]
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
lea ecx, [esp + 0x30]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420690
sub ecx, edx
sar ecx, 1
jne 0x4206c4
push 0xffffffffffffffff
push 0x50
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0040d840
add esp, 0xc
push 0x51
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push 0
push dword [0x46c31c]
lea ecx, [esp + 0x38]
push 0
push ebx
push 0x258
push 0x267
push edi
push esi
push 0x4ca0000
push ecx
push eax
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 5
push eax
mov dword [0x46c150], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x420775
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop dword [eax]
lea eax, [esp + 0x18]
push eax
push dword [0x46c150]
call ebp
test eax, eax
jne 0x42075f
lea eax, [esp + 0x18]
push eax
call edi
lea eax, [esp + 0x18]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
jne 0x420740
mov ebx, dword [esp + 0x10]
pop ebp
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d960
add esp, 0x228
ret
Function at 0x4207a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x46c158]
push ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
test eax, eax
je 0x4207e3
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042d960
add esp, 0x24
ret
cmp word [0x4707d4], 0
jne 0x420855
push 0x65
push dword [0x46c31c]
mov dword [0x4707d8], 0x30
mov dword [0x4707dc], 0x40
mov dword [0x4707e0], 0x429710
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push 0
mov dword [0x4707f0], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x4707d8
mov dword [0x4707f4], eax
mov dword [0x4707f8], 6
mov dword [0x470800], 0x455fb8
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov word [0x4707d4], ax
push ebp
push esi
push 0
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [0x46c0e0]
add eax, 0xfffffd30
cdq
push 0
push dword [0x46c31c]
sub eax, edx
mov esi, eax
mov eax, dword [0x46c0e4]
push 0
push ebx
push 0x26c
lea eax, [eax - 0x26c]
sar esi, 1
cdq
push 0x2d1
sub eax, edx
sar eax, 1
push eax
push esi
push 0x4cf0000
push str.S.M.A.R.T
push str.Smart_ListView
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 5
push eax
mov dword [0x46c158], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x10]
push 0
push 0
push 0
push eax
call ebp
test eax, eax
je 0x420925
mov ebx, dword [sym.imp.USER32.dll_IsDialogMessageW]
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
push edi
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
nop word [eax + eax]
lea eax, [esp + 0x14]
push eax
push dword [0x46c158]
call ebx
test eax, eax
jne 0x42090f
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x14]
push eax
call edi
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call ebp
test eax, eax
jne 0x4208f0
mov ebx, dword [esp + 0x10]
pop edi
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042d960
add esp, 0x24
ret
Function at 0x420a30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
push 0x200
push 0
push 0x46e1e8
mov dword [esp + 0x14], 0
call fcn.0042f620
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420ac8
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x200
push eax
push 0x46e1e8
push 0
push 0
push edi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x420ab9
cmp esi, 0xea
jne 0x420ac8
push 0xffffffffffffffff
push 0x46e1e8
call fcn.00434cd6
add esp, 8
mov eax, dword [esp + 0x20]
pop edi
pop esi
sub eax, 0
je 0x420b23
sub eax, 1
je 0x420af1
sub eax, 1
je 0x420afb
mov eax, 0x4464a0
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0042d960
add esp, 0xc
ret
cmp word [0x46e1e8], 0
je 0x420b0f
mov eax, 0x46e1e8
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0042d960
add esp, 0xc
ret
mov eax, 0x4548ac
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0042d960
add esp, 0xc
ret
cmp word [0x46e1e8], 0
je 0x420b5e
push str.PCIVEN
push 0x46e1e8
call fcn.0042bf80
add esp, 8
test eax, eax
jne 0x420b5e
push str.USBVID
push 0x46e1e8
call fcn.0042bf80
add esp, 8
test eax, eax
mov eax, 0x4548a8
je 0x420b63
mov eax, 0x454410
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0042d960
add esp, 0xc
ret
Function at 0x420bc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x200
lea eax, [esp + 0xc]
mov dword [esp + 4], 0
push 0
push eax
call fcn.0042f620
add esp, 0xc
mov dword [esp + 4], 0x200
mov ecx, 0x469a38
push 0x1c
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push 0x46a8fc
push 0x447380
lea eax, [esp + 0x14]
push 0xffffffffffffffff
push eax
call fcn.0040d4b0
add esp, 0x14
lea eax, [esp]
push eax
push 0x20019
push 0
lea eax, [esp + 0x14]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420cf3
push 0x41
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp]
test eax, eax
je 0x420c96
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042d960
add esp, 0x20c
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 8]
push 0xffffffffffffffff
push eax
call fcn.00434afd
add esp, 8
mov ecx, 0x469a38
push 0x1d
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0042bf80
add esp, 8
test eax, eax
je 0x420cf3
push 0xffffffffffffffff
push 0x22
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push 0x46b074
call fcn.0040d7c0
add esp, 0xc
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042d960
add esp, 0x20c
ret

Function at 0x420d90
Capabilities:
Terminate process

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x420db8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x424c40
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 8], eax
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push 0x53
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x424cba
push 0x4b
mov ecx, 0x469a38
mov dword [esp + 8], eax
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
test eax, eax
je 0x424cc8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0042d960
add esp, 0xc
ret

Function at 0x424ce0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x4610f8]
mov ecx, dword [0x46c0e0]
add eax, 9
imul eax, dword [0x46c0d0]
push 1
push 0
push 0
mov dword [0x46c76c], 0
sub ecx, eax
mov dword [0x461160], 1
mov eax, dword [0x46c0d4]
push eax
push ecx
push 1
push dword [0x46c138]
mov dword [0x46c114], ecx
mov dword [0x46c118], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp fcn.00426900
Function at 0x427fd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x4629b4]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push 0x44c2ec
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00435872
add esp, 0xc
test eax, eax
jne 0x42802b
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428003
push dword [esp + 4]
sub ecx, edx
sar ecx, 1
push ecx
push 2
push esi
call fcn.0043671b
push dword [esp + 0x14]
call fcn.0043592f
add esp, 0x14
mov ecx, dword [esp + 8]
pop esi
xor ecx, esp
call fcn.0042d960
add esp, 8
ret
Function at 0x43b4e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043b361
Function at 0x403530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x459020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035a8
xor eax, eax
push ebp
push 0x4035a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x459020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x459020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404304
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45b04c], 0
je 0x404365
cmp word [0x45b220], 0xd7b2
jne 0x40432d
cmp dword [0x45b228], 0
jbe 0x40432d
mov eax, 0x45b21c
call dword [0x45b238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x459090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40438c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x459030], 0
jne 0x404381
push 0
push 0x459088
push 0x459090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40625c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4062c2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004046f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030f4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4062ac
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4062c9
lea eax, [ebp - 0x10]
call fcn.00404480
ret

Function at 0x40b300
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b339
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404570
jmp 0x40b342
mov eax, ebx
mov edx, esi
call fcn.004044d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b34c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b36d
mov al, byte [esp]
jmp 0x40b36f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b9f4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b86c
mov eax, dword [0x45a154]
cmp byte [eax], 0
je 0x40ba70
mov eax, dword [0x459f68]
call fcn.00402cb8
call fcn.00402884
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408b2c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bab8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40baa6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x459f14]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45b668]
call fcn.00405770
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret