joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418864
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [0x4811d0]
test eax, eax
je 0x418905
mov eax, dword [eax]
test eax, eax
js 0x4188fb
mov eax, dword [0x4811d0]
test eax, eax
je 0x418914
mov eax, dword [eax]
test eax, eax
je 0x4188e0
mov eax, dword [0x4811d4]
test eax, eax
je 0x418931
mov edi, dword [eax]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov edi, eax
mov dword [esp], esi
call sym._SetLastError_4
push eax
mov dword [esp + 0x1c], edi
lea esi, [esp + 0x1c]
mov edx, esi
mov eax, ebx
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x4188ed
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x4188f4
call sym._abort
mov eax, dword [0x4811d8]
test eax, eax
je 0x418923
mov edi, dword [eax]
jmp 0x4188be
call dbg._Unwind_ForcedUnwind_Phase2
jmp 0x4188d6
mov eax, esi
call sym._uw_install_context.isra.2
call dbg.fc_key_init_once
jmp 0x418881
call dbg.__shmem_grabber_use_fc_key
mov dword [0x4811d0], eax
jmp 0x41887b
call dbg.__shmem_grabber_use_fc_key
mov dword [0x4811d0], eax
jmp 0x41888e
call dbg.__shmem_grabber_fc_static
mov dword [0x4811d8], eax
mov edi, dword [eax]
jmp 0x4188be
call dbg.__shmem_grabber_fc_key
mov dword [0x4811d4], eax
jmp 0x4188a1

Function at 0x418940
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x418960
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x4811d0]
test eax, eax
je 0x4189f0
mov edi, dword [eax]
test edi, edi
js 0x4189dc
mov eax, dword [0x4811d0]
test eax, eax
je 0x418a00
mov esi, dword [eax]
test esi, esi
je 0x4189cc
mov eax, dword [0x4811d4]
test eax, eax
je 0x418a20
mov edi, dword [eax]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov edi, eax
mov dword [esp], esi
call sym._SetLastError_4
push ecx
mov dword [esp + 0x1c], edi
lea edx, [esp + 0x1c]
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x4189e4
call sym._abort
lea esi, [esi]
mov eax, dword [0x4811d8]
test eax, eax
je 0x418a10
mov edi, dword [eax]
jmp 0x4189b0
call dbg.fc_key_init_once
jmp 0x418973
lea eax, [esp + 0x1c]
call sym._uw_install_context.isra.2
lea esi, [esi]
call dbg.__shmem_grabber_use_fc_key
mov dword [0x4811d0], eax
jmp 0x41896d
call dbg.__shmem_grabber_use_fc_key
mov dword [0x4811d0], eax
jmp 0x418980
call dbg.__shmem_grabber_fc_static
mov dword [0x4811d8], eax
mov edi, dword [eax]
jmp 0x4189b0
call dbg.__shmem_grabber_fc_key
mov dword [0x4811d4], eax
jmp 0x418993

Function at 0x418c34
Capabilities:
Get thread local storage value

Disassembly:
push ebx
sub esp, 0x28
call sym._GetLastError_0
mov ebx, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sym._TlsGetValue_4
push ecx
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
call sym._SetLastError_4
push ebx
mov eax, dword [esp + 0x1c]
add esp, 0x28
pop ebx
ret
Function at 0x418c64
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x418c88
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0

Function at 0x418f70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov dword [ebp - 0x1c], ecx
not dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x4e
and eax, 0xfffffff0
call fcn.00418b50
sub esp, eax
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov esi, str.gcc_shmem_tdm2
mov ecx, 0xe
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0xe], 0x2d
lea eax, [ebx + 0xf]
mov edi, eax
mov esi, edx
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1c]
lea edx, [ebx + eax + 0xf]
mov cl, 0x20
mov al, 0x61
mov edi, edx
rep stosb byte es:[edi], al
mov edi, dword [ebp - 0x1c]
add edi, 0x2f
mov byte [ebx + edi], 0
mov esi, dword [ebp - 0x1c]
mov byte [ebx + esi + 0xe], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov byte [ebx + esi + 0xe], 0x2d
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x419025
int3
mov dword [esp], ebx
call sym._FindAtomA_4
push ecx
test ax, ax
jne 0x4190b8
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call sym._malloc
mov esi, eax
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x20], eax
add eax, ebx
mov ecx, 0x20
mov edx, esi
shr edx, cl
and edx, 1
je 0x419060
mov byte [eax], 0x41
inc eax
dec ecx
jne 0x419054
mov dword [esp], ebx
call sym._AddAtomA_4
push edx
test ax, ax
je 0x4190b4
movzx eax, ax
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call dbg.get_ptr_from_atom
mov ebx, eax
cmp eax, esi
je 0x4190d1
mov dword [esp], esi
call sym._free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._ReleaseMutex_4
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
push edx
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
int3
movzx eax, ax
mov edx, dword [ebp - 0x20]
add edx, 0x10
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call dbg.get_ptr_from_atom
mov ebx, eax
jmp 0x419092
xor eax, eax
mov edi, esi
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419092
mov dword [esp], esi
call dword [ebp + 0x10]
jmp 0x419092
Function at 0x411014
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410cc5

Function at 0x41101f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410e4f
Function at 0x40c4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040c4a7
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408ca3
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040c42d
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040c44d
inc esi
cmp esi, 0xc
jl 0x40c4ff
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x410550]
test byte [eax + 0x28], 2
movzx eax, byte [0x4205bf]
jne 0x40c53a
movzx eax, byte [0x4205c7]
movzx ecx, cx
cmp ecx, eax
je 0x40c546
or eax, 0xffffffff
jmp 0x40c58b
mov ecx, dword [0x420568]
mov eax, ecx
cdq
cmp edx, dword [0x40f924]
push edi
jl 0x40c568
mov edx, dword [0x40f920]
jg 0x40c564
cmp eax, edx
jbe 0x40c568
mov edi, edx
jmp 0x40c56a
mov edi, ecx
mov esi, dword [0x420560]
jmp 0x40c584
dec edi
call fcn.0040c42d
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040c44d
inc esi
test edi, edi
jne 0x40c572
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402eac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x421020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402f44
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402f24
xor eax, eax
push ebp
push 0x402f1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402f60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x421020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x421020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4039dc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42204c], 0
je 0x403a3d
cmp word [0x422220], 0xd7b2
jne 0x403a05
cmp dword [0x422228], 0
jbe 0x403a05
mov eax, 0x42221c
call dword [0x422238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x421068
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403a64
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x42102c], 0
jne 0x403a59
push 0
push 0x421060
push 0x421068
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4050c8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40514b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40514b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405314
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4051d4
xor eax, eax
push ebp
push 0x4051cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404f10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4051b2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405334
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4051b2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4052ee
cmp byte [ebp - 0xd], 0
jne 0x40521b
cmp byte [ebp - 0x12], 0
je 0x4052ee
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405234
dec ebx
cmp byte [ebx], 0x2e
je 0x405243
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405233
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4052ee
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405280
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4052ee
cmp byte [ebp - 0xd], 0
je 0x4052ee
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4052ee
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4051d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40514b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40514b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405314
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4051d4
xor eax, eax
push ebp
push 0x4051cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404f10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4051b2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405334
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4051b2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4052ee
cmp byte [ebp - 0xd], 0
jne 0x40521b
cmp byte [ebp - 0x12], 0
je 0x4052ee
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405234
dec ebx
cmp byte [ebx], 0x2e
je 0x405243
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405233
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4052ee
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405280
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4052ee
cmp byte [ebp - 0xd], 0
je 0x4052ee
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4052ee
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4059b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403dc8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402aa0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a21
lea eax, [ebp - 0x10]
call fcn.00403b58
ret

Function at 0x409ddc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409e15
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403c48
jmp 0x409e1e
mov eax, ebx
mov edx, esi
call fcn.00403bac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409e28
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409e49
mov al, byte [esp]
jmp 0x409e4b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a4d0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a348
mov eax, dword [0x4217ec]
cmp byte [eax], 0
je 0x40a54c
mov eax, dword [0x4216cc]
call fcn.004029e0
call fcn.0040286c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004076b0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a594
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a582
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x42169c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x422668]
call fcn.00404ed4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b278
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b2dc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403dc8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407220
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b2e3
lea eax, [ebp - 0xc]
call fcn.00403b58
ret
Function at 0x4014d2
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x128
mov esi, eax
lea eax, [ebp - 0x10]
mov ebx, edx
push eax
mov eax, dword [0x7a3480]
or eax, 8
mov dword [ebp - 0x120], ecx
push eax
push 0
push edx
push esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x40159d
jmp 0x40153b
cmp dword [ebp - 0x120], 0
je 0x401529
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
add esp, 0xc
jmp 0x40159d
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, edi
call fcn.004014d2
test eax, eax
jne 0x401555
jmp 0x401541
lea edi, [ebp - 0x115]
push 0x105
push edi
push 0
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x40150b
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
push 2
call fcn.004060e3
add esp, 0xc
test eax, eax
je 0x40157c
push 0
push dword [0x7a3480]
push ebx
push esi
call eax
jmp 0x40159d
mov eax, 1
cmp dword [0x7a3480], 0
jne 0x40159d
push edi
push edi
push ebx
push esi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
pop ebx
setne al
pop esi
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40316c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push 0
push eax
push ebx
push dword [ebp + 8]
push dword [0x409010]
call sub.KERNEL32.dll_ReadFile
xor edx, edx
add esp, 0xc
test eax, eax
je 0x40319c
xor edx, edx
cmp dword [ebp - 8], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x4033e7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x403414
mov eax, dword [0x420c60]
test eax, eax
je 0x403408
sub esp, 0xc
push eax
call sub.USER32.dll_DestroyWindow
add esp, 0xc
mov dword [0x420c60], 0
jmp 0x403465
cmp dword [0x420c60], 0
je 0x40342c
sub esp, 0xc
push 0
call fcn.004060a8
add esp, 0xc
jmp 0x403465
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x7a3500]
jbe 0x403465
sub esp, 0xc
push 0
push 0x403716
push 0
push 0x6f
push dword [0x7a3560]
call sub.USER32.dll_CreateDialogParamA
sub esp, 0xc
mov dword [0x420c60], eax
push 5
push eax
call sub.USER32.dll_ShowWindow
add esp, 0x18
leave
ret
Function at 0x4037dd
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x7ad400
call fcn.004061fa
push 0x7ad400
call fcn.00405fb0
xor edx, edx
add esp, 0xc
test eax, eax
je 0x403830
sub esp, 0xc
push 0x7ad400
call fcn.004062f7
sub esp, 0xc
push 0
push 0x7ad400
call sub.KERNEL32.dll_CreateDirectoryA
push 0x7ad400
push 0x7ad000
call fcn.004066a6
mov edx, eax
add esp, 0x18
mov eax, edx
leave
ret
Function at 0x40636b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 8]
mov byte [ebx], 0
push edx
cmp dword [ebp + 0x18], 1
sbb eax, eax
xor al, al
add eax, 0x20119
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x4063e4
push eax
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
test eax, eax
pop ecx
jne 0x4063cc
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
jbe 0x4063cf
mov byte [ebx], 0
mov byte [ebx + 0x3ff], 0
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 0x14