joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100011a7
Capabilities:
Log keystrokes

Disassembly:
push 4
mov eax, 0x1007f5c2
call fcn.1005b0ac
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::constructor_void_]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
movzx edx, cx
mov dword [ebp - 0x10], 1
cmp edx, 0x24
ja 0x10001235
je 0x1000122b
mov eax, edx
sub eax, 0xd
je 0x10001221
sub eax, 0xe
je 0x10001217
sub eax, 6
je 0x1000120d
sub eax, 1
je 0x10001203
sub eax, 1
jne 0x10001264
push 0x10082764
jmp 0x10001363
push str.PageDown
jmp 0x10001363
push str.PageUp
jmp 0x10001363
push 0x10082718
jmp 0x10001363
push str.Enter
jmp 0x10001363
push str.Home
jmp 0x10001363
mov eax, edx
sub eax, 0x25
je 0x1000135e
sub eax, 1
je 0x10001357
sub eax, 1
je 0x10001350
sub eax, 1
je 0x10001349
sub eax, 5
je 0x10001342
cmp cx, 0x30
jb 0x10001270
cmp cx, 0x39
jbe 0x10001279
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x10001287
push ecx
mov ecx, esi
call dword [sym.imp.utilities.dll_public:_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits__const____thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::operator_wchar_t_]
jmp 0x1000136b
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x1000129b
lea eax, [edx - 0x60]
push eax
push str.Num__d
jmp 0x100012dd
cmp cx, 0x6a
jne 0x100012ab
push 0x100827b0
jmp 0x10001363
cmp cx, 0x6b
jne 0x100012bb
push str.Num_
jmp 0x10001363
cmp cx, 0x6e
jne 0x100012cb
push str.Num_Del
jmp 0x10001363
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x100012f6
lea eax, [edx - 0x6f]
push eax
push 0x100827d8
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.utilities.dll_public:_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits____cdecl_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::Format_wchar_t_const__]
add esp, 0x10
lea ecx, [ebp + 0xc]
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::destructor_void_]
jmp 0x1000136b
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, al
movsx eax, cl
cmp eax, 0x3d
jg 0x10001321
je 0x10001330
cmp eax, 0x27
je 0x10001330
cmp eax, 0x2b
jle 0x1000136b
cmp eax, 0x2f
jle 0x10001330
cmp eax, 0x3b
je 0x10001330
jmp 0x1000136b
cmp eax, 0x5b
jl 0x1000136b
cmp eax, 0x5d
jle 0x10001330
cmp eax, 0x60
jne 0x1000136b
movsx ax, cl
mov ecx, esi
movzx eax, ax
push eax
call dword [0x100825e8]
jmp 0x1000136b
push str.Insert
jmp 0x10001363
push str.Down
jmp 0x10001363
push str.Right
jmp 0x10001363
push 0x1008272c
jmp 0x10001363
push str.Left
mov ecx, esi
call dword [sym.imp.utilities.dll_public:_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_____thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::operator_wchar_t_const__]
mov eax, esi
call fcn.1005b086
ret 8
Function at 0x100029a1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
je 0x100029ae
xor eax, eax
jmp 0x100029dc
push dword [ecx + 4]
call sym.soui.dll_public:_static_class_SOUI::SWindow____cdecl_SOUI::SWindowMgr::GetWindow_unsigned_long_int_
pop ecx
test eax, eax
je 0x100029c9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x90]
test al, 2
jne 0x100029aa
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor eax, 0x8000
shr eax, 0xf
pop ebp
ret 4
Function at 0x10002acd
Capabilities:
Log keystrokes via polling

Disassembly:
push 4
mov eax, 0x1007d05c
call fcn.1005b0ac
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
call sym.soui.dll_public:_int___thiscall_SOUI::CFocusManager::IsTabTraversalKey_unsigned_int_
test eax, eax
je 0x10002b08
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call sym.soui.dll_public:_void___thiscall_SOUI::CFocusManager::AdvanceFocus_bool_
xor eax, eax
inc eax
jmp 0x10002c0a
push dword [ebx + 4]
call sym.soui.dll_public:_static_class_SOUI::SWindow____cdecl_SOUI::SWindowMgr::GetWindow_unsigned_long_int_
mov esi, eax
mov dword [ebp - 0x10], esi
pop ecx
test esi, esi
je 0x10002bb4
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x60]
test eax, eax
je 0x10002bb4
cmp edi, 0x25
je 0x10002b41
cmp edi, 0x27
je 0x10002b4f
cmp edi, 0x26
je 0x10002b41
cmp edi, 0x28
jne 0x10002bb4
cmp edi, 0x27
je 0x10002b4f
cmp edi, 0x28
je 0x10002b4f
push 2
jmp 0x10002b51
push 3
pop edi
jmp 0x10002b5f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x60]
test eax, eax
jne 0x10002b9e
push edi
mov ecx, esi
call sym.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::GetWindow_int_
mov esi, eax
test esi, esi
jne 0x10002b54
mov ecx, dword [ebp - 0x10]
cmp edi, 3
setne al
push eax
call sym.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::GetParent_void_const
mov ecx, eax
jmp 0x10002b8e
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x60]
test eax, eax
jne 0x10002b9e
push edi
mov ecx, esi
call sym.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::GetWindow_int_
mov esi, eax
test esi, esi
jne 0x10002b80
jmp 0x10002b00
push 0
mov ecx, esi
call sym.soui.dll_public_virtual:_int___thiscall_SOUI::SSkinImgList::GetStates_void_
push eax
mov ecx, ebx
call sym.soui.dll_public:_void___thiscall_SOUI::CFocusManager::SetFocusedHwndWithReason_unsigned_long_int__enum_SOUI::CFocusManager::FocusChangeReason_
jmp 0x10002b00
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp + 8]
and al, 1
movzx eax, al
push eax
push edi
call sym.soui.dll_public:_void___thiscall_SOUI::CAccelerator::constructor_unsigned_int__bool__bool__bool_
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call sym.soui.dll_public:_bool___thiscall_SOUI::CFocusManager::ProcessAccelerator_class_SOUI::CAccelerator_const__
xor ebx, ebx
lea ecx, [ebp + 8]
test al, al
setne bl
call sym.soui.dll_public:_void___thiscall_SOUI::CAccelerator::destructor_void_
mov eax, ebx
call fcn.1005b086
ret 4
Function at 0x1000f2ef
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100ef4b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.1005cc60
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x1000f34a
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x1000f35e
cmp byte [ebp - 6], 1
jne 0x1000f35e
cmp dword [ebp - 0x11c], 6
jne 0x1000f35e
xor eax, eax
inc eax
jmp 0x1000f360
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005b075
mov esp, ebp
pop ebp
ret

Function at 0x1001101c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x184]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, esi
test eax, eax
jne 0x10011042
call sym.soui.dll_public:_int___thiscall_SOUI::SWindow::ReleaseCapture_void_
jmp 0x10011080
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.soui.dll_protected:_void___thiscall_SOUI::SWindow::OnLButtonUp_unsigned_int__class_SOUI::CPoint_
lea ecx, [esi + 0x194]
call dword [sym.imp.utilities.dll_public:_bool___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::IsEmpty_void_const]
test al, al
jne 0x10011080
push 1
push 0
push 0
lea ecx, [esi + 0x194]
call dword [sym.imp.utilities.dll_public:_wchar_t_const____thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::operator_wchar_t_const__void_const]
push eax
push 0x100862e4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 0xc

Function at 0x1001a577
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 0x12
call esi
push 0x11
mov edi, eax
call esi
and eax, 0x8000
push 0x10
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
and eax, 0x8000
and edi, 0x8000
jne 0x1001a5d8
test ecx, ecx
jne 0x1001a5be
test eax, eax
jne 0x1001a5b7
inc eax
jmp 0x1001a60c
push 2
pop eax
push 4
jmp 0x1001a60b
test eax, eax
jne 0x1001a5c9
push 4
pop eax
push 2
jmp 0x1001a60b
push 6
pop eax
push 0x10
mov word [ebx + 0x184], ax
pop eax
jmp 0x1001a613
test ecx, ecx
jne 0x1001a5ea
test eax, eax
jne 0x1001a5e6
push 8
pop eax
inc ecx
jmp 0x1001a60c
test ecx, ecx
je 0x1001a5f9
test eax, eax
jne 0x1001a5f5
push 0x40
pop eax
push 3
jmp 0x1001a60b
test ecx, ecx
jne 0x1001a604
test eax, eax
je 0x1001a604
push 0x20
pop eax
push 5
jmp 0x1001a60b
mov eax, 0x80
push 7
pop ecx
mov word [ebx + 0x184], cx
test word [ebx + 0x188], ax
je 0x1001a62a
mov ax, word [ebx + 0x18a]
mov word [ebx + 0x184], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029d69
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ax, word [ecx + 0x23c]
add ax, word [ebp + 0xc]
push esi
cwde
push edi
cdq
push 0x78
pop esi
idiv esi
xor esi, esi
mov dword [ebp - 4], ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [ecx + 0x23c], dx
cdq
xor eax, edx
sub eax, edx
movzx edi, ax
xor eax, eax
cmp ax, di
jge 0x10029e09
push ebx
xor ebx, ebx
cmp word [ebp + 0xc], ax
setle bl
xor edx, edx
inc edx
mov eax, dword [ecx]
push 0
push ebx
push edx
call dword [eax + 0xf8]
test eax, eax
je 0x10029dcc
mov ecx, dword [ebp - 4]
inc esi
push 1
pop edx
cmp si, di
jl 0x10029db0
pop ebx
cmp si, di
jge 0x10029e06
push dword [ebp + 0x14]
or eax, 0xffffffff
mov ecx, edi
push dword [ebp + 0x10]
sub ecx, esi
cmp word [ebp + 0xc], 0
push 1
pop edx
cmovg eax, edx
movsx ecx, cx
cwde
imul ecx, eax
movsx eax, cx
mov ecx, dword [ebp - 4]
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call sym.soui.dll_protected:_int___thiscall_SOUI::SWindow::OnMouseWheel_unsigned_int__short_int__class_SOUI::CPoint_
mov ecx, dword [ebp - 4]
test di, di
je 0x10029e46
call sym.soui.dll_public:_struct_SOUI::ISwndContainer____thiscall_SOUI::SWindow::GetContainer_void_
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1002c332
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1008a340
push dword [ebp + 8]
call fcn.1006df30
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1002c38f
push ebx
push edi
push esi
call fcn.1006e03d
push eax
call fcn.1006e3ef
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x1002c36e
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1002c384
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.1006e22f
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.1006dfbd
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x1002c3ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
call fcn.1002cea3
mov ebx, eax
test ebx, ebx
je 0x1002c45b
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x1002c43f
cmp dword [ebp + 0x14], edi
jae 0x1002c424
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1002c43f
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1002c43f
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x1002c443
xor eax, eax
jmp 0x1002c45a
push edi
push eax
push dword [ebp + 0x10]
call fcn.1005f910
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x1002da0f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x1007f830
call fcn.1005b0ac
mov esi, ecx
lea eax, [esi + 0x48]
lea edi, [esi + 0x4c]
mov dword [ebp - 0x10], eax
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
and dword [ebp - 4], 0
mov ecx, esi
call sym.soui.dll_protected:_int___thiscall_SOUI::SResProviderMgr::IsFileType_wchar_t_const__
push dword [ebp + 0xc]
test eax, eax
je 0x1002da52
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jmp 0x1002da64
push dword [ebp + 8]
mov ecx, esi
call sym.soui.dll_public:_struct_SOUI::IResProvider____thiscall_SOUI::SResProviderMgr::GetMatchResProvider_wchar_t_const___wchar_t_const__
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
call fcn.1005b086
ret 8

Function at 0x1002f4fb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov edi, ecx
sub eax, 9
je 0x1002f55c
sub eax, 1
je 0x1002f53e
sub eax, 3
je 0x1002f53e
test dword [edi + 0x3ac], 0x2000
je 0x1002f577
push esi
call fcn.1006e46d
pop ecx
test eax, eax
jne 0x1002f577
cmp esi, 0x2d
je 0x1002f577
cmp esi, 0x2e
je 0x1002f577
cmp esi, 0x2c
je 0x1002f577
jmp 0x1002f592
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1002f577
test dword [edi + 0x3ac], 0x1000
jmp 0x1002f575
test byte [edi + 0x3b0], 0x80
jne 0x1002f577
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1002f592
mov eax, dword [edi + 0x3bc]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1002f800
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xd
push esi
mov esi, ecx
jne 0x1002f830
test dword [esi + 0x3ac], 0x1000
jne 0x1002f830
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1002f830
and dword [esi + 0x10], 0
jmp 0x1002f84b
mov eax, dword [esi + 0x3bc]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop esi
pop ebp
ret 0xc
Function at 0x100533ea
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0x25c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10053452
mov ecx, esi
call sym.soui.dll_protected:_void___thiscall_SOUI::SMenuEx::HideSubMenu_void_
push 0
push dword [esi + 0x25c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x3ec]
test ecx, ecx
je 0x1005342d
push 0
call sym.soui.dll_public:_void___thiscall_SOUI::SWindow::SetCheck_int_
and dword [esi + 0x3ec], 0
mov ecx, dword [0x100f48f8]
lea ecx, [ecx + 8]
call fcn.100385db
mov ecx, dword [esi + 0x3e4]
test ecx, ecx
je 0x10053452
pop esi
mov ecx, dword [ecx + 0x188]
pop ebp
jmp sym.soui.dll_protected:_void___thiscall_SOUI::SMenuEx::OnSubMenuHided_int_
pop esi
pop ebp
ret 4

Function at 0x1005a7a9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop ebp
ret 8

Function at 0x100757ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10075639

Function at 0x10077e5b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10077b1b
Function at 0x4011e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push esi
push eax
lea edx, [esp + 0x10]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x11c]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x110]
lea ecx, [esp + 0xc]
push ecx
push 0x407020
push edx
mov esi, eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov eax, esi
pop esi
add esp, 0x108
ret 8

Function at 0x401250
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi + 4]
inc eax
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8
Function at 0x403660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x405ee7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00401140
mov ebx, 1
push 0x4070e8
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], ebx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0xf003f
push eax
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call fcn.004011a0
mov edx, dword [esp + 0x34]
lea eax, [esp + 8]
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.004011e0
test eax, eax
lea ecx, [esp + 0x10]
jne 0x4036f5
call fcn.00401180
mov esi, dword [esp + 0x28]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0xc], ebx
jmp 0x40370e
call fcn.00401180
mov esi, dword [esp + 0x28]
push 0x4070e8
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.00401170
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x41a34c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41a3bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.004082f4
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x41a3d0
call fcn.00404ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a3c2
lea eax, [ebp - 0x104]
call fcn.004047ac
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x402f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x463020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403018
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ff8
xor eax, eax
push ebp
push 0x402ff1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403034
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ff8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x463020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x463020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cdc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46d048], 0
je 0x403d3d
cmp word [0x46d21c], 0xd7b2
jne 0x403d05
cmp dword [0x46d224], 0
jbe 0x403d05
mov eax, 0x46d218
call dword [0x46d234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46306c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d64
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x463030], 0
jne 0x403d59
push 0
push 0x463064
push 0x46306c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4059e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a46
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040c8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a30
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a4d
lea eax, [ebp - 0x10]
call fcn.00403e58
ret

Function at 0x40ab20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab59
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f48
jmp 0x40ab62
mov eax, ebx
mov edx, esi
call fcn.00403eac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ab6c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab8d
mov al, byte [esp]
jmp 0x40ab8f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b214
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b08c
mov eax, dword [0x46c934]
cmp byte [eax], 0
je 0x40b290
mov eax, dword [0x46c6a4]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408394
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b2d8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b2c6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46c63c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46d664]
call fcn.00404ef4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret