joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c71
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], bl
push 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x403cc1
cmp byte [eax], bl
je 0x403cc1
lea ecx, [ebp - 0x12c]
push ecx
push eax
call fcn.004041b8
pop ecx
pop ecx
jmp 0x403cdb
lea eax, [ebp - 0x12c]
push 0x103
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x12c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x403cfb
cmp dword [ebp - 0xc], ebx
jne 0x403d45
mov edi, dword [ebp - 8]
jmp 0x403d4a
push ebx
push 0x80
push 3
push ebx
push 3
lea eax, [ebp - 0x12c]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403d23
xor eax, eax
jmp 0x403d4c
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
jne 0x403d40
xor edi, edi
jmp 0x403d4a
cmp dword [ebp - 4], ebx
je 0x403d4a
mov edi, 0x7ffffffe
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d51
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], bl
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp eax, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
je 0x403e99
cmp byte [eax], bl
je 0x403e99
lea ecx, [ebp - 0x110]
push ecx
push eax
call fcn.004041b8
pop ecx
lea eax, [ebp - 0x110]
pop ecx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
je 0x403e8c
cmp edi, ebx
je 0x403e8c
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x20]
or ecx, eax
je 0x403def
mov ecx, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sar ecx, 0x1f
cmp dword [ebp + 0x1c], ebx
jne 0x403df2
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ebx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x403e0a
push edi
jmp 0x403e93
cmp dword [ebp + 0x14], ebx
je 0x403e14
mov edi, dword [ebp + 0x14]
jmp 0x403e21
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x403e90
cmp dword [ebp - 0xc], ebx
jne 0x403e90
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jne 0x403e47
lea eax, [edi + 0x100]
push 1
push eax
call fcn.0040424c
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x403e90
lea eax, [ebp - 4]
push ebx
push eax
push edi
push esi
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403e69
mov eax, dword [ebp - 4]
cmp edi, eax
jne 0x403e69
mov byte [esi + eax], bl
jmp 0x403e77
cmp dword [ebp + 0x10], ebx
jne 0x403e75
push esi
call fcn.00404294
pop ecx
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x403e8c
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, esi
jmp 0x403e9b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4041b8
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4041f4
cmp dword [esp + 0xc], 0
je 0x4041f4
push 0x25
push esi
call fcn.00404525
pop ecx
test eax, eax
pop ecx
je 0x4041e8
push 0x103
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop esi
ret
push esi
push dword [esp + 0x10]
call fcn.004043f5
pop ecx
pop ecx
pop esi
ret

Function at 0x404680
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4046a9
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4046a1
cmp al, 0x22
jne 0x404695
cmp byte [esi], 0x22
jne 0x4046b3
inc esi
jmp 0x4046b3
cmp al, 0x20
jle 0x4046b3
inc esi
cmp byte [esi], 0x20
jg 0x4046ad
mov al, byte [esi]
test al, al
je 0x4046bd
cmp al, 0x20
jle 0x4046a6
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040472d
push 0x406004
push section..data
call fcn.00404713
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4046ed
movzx eax, word [ebp - 0x14]
jmp 0x4046f0
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00404745
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4013fc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40140e
mov eax, dword [0x47f07f]
shl eax, 2
mov dword [0x47f083], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004703a4
pop edx
call fcn.004702cc
call fcn.004703e4
push 0
call fcn.00471520
pop ecx
push 0x47f028
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x47f087], eax
push 0
jmp fcn.004798a8

Function at 0x40167c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax]
mov ebx, dword [ecx]
movzx ecx, word [edx + 0x14]
add ebx, ecx
add ebx, 0x18
xor edi, edi
jmp 0x40171b
cmp dword [ebx + 0x10], 0
jne 0x4016e7
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x38]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jle 0x401717
push 4
push 0x1000
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 8]
add eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov dword [ebx + 8], esi
mov eax, dword [ebp - 4]
push eax
push 0
push esi
call fcn.004704dc
add esp, 0xc
jmp 0x401717
push 4
push 0x1000
mov edx, dword [ebx + 0x10]
push edx
mov ecx, dword [ebp - 8]
add ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [ebx + 0x10]
push eax
mov edx, dword [ebp + 8]
add edx, dword [ebx + 0x14]
push edx
push esi
call fcn.00470448
add esp, 0xc
mov dword [ebx + 8], esi
inc edi
add ebx, 0x28
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
movzx edx, word [eax + 6]
cmp edi, edx
jl 0x4016a5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x401734
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov eax, dword [esi]
movzx edx, word [eax + 0x14]
add ebx, edx
add ebx, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x401803
mov eax, dword [ebx + 0x24]
test eax, 0x20000000
setne dl
and edx, 1
test eax, 0x40000000
setne cl
and ecx, 1
mov dword [ebp - 0xc], edx
test eax, 0x80000000
mov dword [ebp - 0x10], ecx
setne dl
and edx, 1
test eax, 0x2000000
mov dword [ebp - 0x14], edx
je 0x40179f
push 0x4000
mov eax, dword [ebx + 0x10]
push eax
mov ecx, dword [ebx + 8]
push ecx
call sub.KERNEL32.DLL_VirtualFree
jmp 0x4017fd
mov eax, dword [ebp - 0xc]
shl eax, 4
lea edx, [eax + 0x47f0b8]
mov ecx, dword [ebp - 0x10]
lea eax, [edx + ecx*8]
mov edx, dword [ebp - 0x14]
mov edi, dword [eax + edx*4]
mov edx, dword [ebx + 0x24]
test edx, 0x4000000
je 0x4017c8
or edi, 0x200
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x4017e5
test dl, 0x40
je 0x4017db
mov ecx, dword [esi]
mov eax, dword [ecx + 0x20]
jmp 0x4017e5
test dl, 0x80
je 0x4017e5
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
test eax, eax
jbe 0x4017fd
lea edx, [ebp - 8]
push edx
push edi
mov ecx, dword [ebx + 0x10]
push ecx
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
inc dword [ebp - 4]
add ebx, 0x28
mov edx, dword [esi]
movzx ecx, word [edx + 6]
cmp ecx, dword [ebp - 4]
jg 0x401757
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4019d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
movzx ecx, word [edx]
cmp ecx, 0x5a4d
je 0x4019fc
xor eax, eax
jmp 0x401b35
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0x3c]
add esi, dword [ebp + 8]
cmp dword [esi], 0x4550
je 0x401a14
xor eax, eax
jmp 0x401b35
push 4
push 0x2000
mov edx, dword [esi + 0x50]
push edx
mov ecx, dword [esi + 0x34]
push ecx
call sub.KERNEL32.DLL_VirtualAlloc
mov edi, eax
test edi, edi
jne 0x401a42
push 4
push 0x2000
mov eax, dword [esi + 0x50]
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov edi, eax
test edi, edi
jne 0x401a4d
xor eax, eax
jmp 0x401b35
push 0x14
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapAlloc
mov ebx, eax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], edx
mov dword [ebx + 0x10], ecx
push 4
push 0x1000
mov eax, dword [esi + 0x50]
push eax
push edi
call sub.KERNEL32.DLL_VirtualAlloc
push 4
push 0x1000
mov edx, dword [esi + 0x54]
push edx
push edi
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x3c]
add eax, dword [esi + 0x54]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 8]
push ecx
call fcn.00470448
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 8]
mov dword [ebx], eax
mov dword [eax + 0x34], edi
push ebx
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0040167c
add esp, 0xc
mov eax, edi
sub eax, dword [esi + 0x34]
test eax, eax
je 0x401ade
push eax
push ebx
call fcn.0040181c
add esp, 8
push ebx
call fcn.0040189c
pop ecx
test eax, eax
je 0x401b2c
push ebx
call fcn.00401734
pop ecx
mov edx, dword [ebx]
mov eax, dword [edx + 0x28]
test eax, eax
je 0x401b28
add eax, edi
test eax, eax
jne 0x401b01
jmp 0x401b2c
push 0
push 1
push edi
call eax
test eax, eax
jne 0x401b21
lea edx, [ebp - 0xc]
push edx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_IsWow64Process
cmp dword [ebp - 0xc], 0
je 0x401b2c
mov dword [ebx + 0x10], 1
mov eax, ebx
jmp 0x401b35
push ebx
call fcn.00401be8
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401c64
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004704dc
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x47f0d8
lea ecx, [ebp - 0x108]
push ecx
call fcn.00470584
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x108]
push edx
call fcn.00470584
add esp, 8
lea ecx, [ebp - 0x108]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test ebx, ebx
je 0x401ce7
cmp ebx, 0xffffffff
jne 0x401ceb
xor eax, eax
jmp 0x401d43
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push edi
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401d15
xor eax, eax
jmp 0x401d43
push esi
call fcn.004019d8
pop ecx
mov edi, eax
test edi, edi
jne 0x401d26
xor eax, eax
jmp 0x401d43
mov edx, dword [ebp + 0xc]
push edx
push edi
call fcn.00401b3c
add esp, 8
mov edi, eax
push esi
call sub.KERNEL32.DLL_LocalFree
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401de8
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x401e14
cmp dword [esp + 0x10], 2
jne 0x401e14
cmp dword [esp + 4], 6
jb 0x401e14
mov eax, 1
jmp 0x401e16
xor eax, eax
add esp, 0x94
ret

Function at 0x410fd8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x487bf8
cmp dword [edi], 0
jne 0x411054
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x487bf4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47fe1c
mov ecx, 2
call fcn.0041ea58
mov edx, 0x410fb0
lea eax, [esi + 5]
call fcn.00410fd0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00410fd0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x411029
mov dword [0x487bf4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x412194
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004204c8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4121ec
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4874e0]
mov dl, 1
mov eax, dword [0x411b7c]
call fcn.004174c0
call fcn.0041fc88
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00411c84
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4135e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x413636
test eax, edx
je 0x413639
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4135f9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41361f
add ecx, 4
js 0x41360f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x41361c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x413645
test edx, edx
jne 0x4135ec
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x416c00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x416c39
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00420128
jmp 0x416c42
mov eax, ebx
mov edx, esi
call fcn.0042008c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x416c4c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x416c6e
movzx eax, byte [esp]
jmp 0x416c70
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x417300
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x417178
mov eax, dword [0x4876bc]
cmp byte [eax], 0
je 0x41737c
mov eax, dword [0x4876c0]
call fcn.0041ec04
call fcn.0041e9c4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.USER32.DLL_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00414380
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4173c4
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x4173b2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x48756c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4878d8]
call fcn.004211dc
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret

Function at 0x417c28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x417cfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004200d0
lea eax, [ebp - 4]
call fcn.00420520
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004204c8
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x417ce8
mov eax, ebx
call fcn.0041e7f8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x417ce1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004204c8
push eax
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x417ccb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x417d10
mov eax, dword [ebp - 0x10]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x417ccb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417ce8
mov eax, dword [ebp - 0x10]
call fcn.0041e814
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417d05
lea eax, [ebp - 4]
call fcn.00420038
ret
Function at 0x41f234
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x480178]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x41f2cc
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41f2ac
xor eax, eax
push ebp
push 0x41f2a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x41f2e8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f2ac
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
movzx eax, word [0x480178]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x480178], ax
mov esp, ebp
pop ebp
ret

Function at 0x41feb8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x489e24], 0
je 0x41ff19
cmp word [0x489ff8], 0xd7b2
jne 0x41fee1
cmp dword [0x48a000], 0
jbe 0x41fee1
mov eax, 0x489ff4
call dword [0x48a010]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x41ff40
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x480184], 0
jne 0x41ff35
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x4213f8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x421628
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x42147b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x421628
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x42147b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x421644
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x421504
xor eax, eax
push ebp
push 0x4214fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00421234
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4214e2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x421664
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4214e2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421504
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x42161e
cmp byte [ebp - 0xd], 0
jne 0x42154b
cmp byte [ebp - 0x12], 0
je 0x42161e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x421564
dec ebx
cmp byte [ebx], 0x2e
je 0x421573
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x421563
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x42161e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4215b0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x42161e
cmp byte [ebp - 0xd], 0
je 0x42161e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x42161e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret