joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42901e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c
mov eax, 0x49e3bf
call fcn.0047bb83
mov edi, edx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], eax
cmp dword [ecx + 0x10], ebx
je 0x42907c
cmp dword [esi + 0x10], ebx
je 0x42907c
cmp eax, ebx
je 0x42907c
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00428e4d
pop ecx
cmp al, bl
jne 0x429084
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00404dda
xor al, al
call fcn.0047bbdf
ret
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x429090
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x40]
push ecx
or edi, 1
push edi
push ebx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x429070
cmp dword [esi + 0x14], 8
mov eax, dword [ebp - 0x40]
push 4
pop edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], ebx
jb 0x4290be
mov esi, dword [esi]
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
je 0x4290f4
cmp dword [ebp - 0x34], ebx
je 0x4290e4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00404dda
mov al, bl
jmp 0x42907e
cmp dword [ebp - 0x3c], edi
sete byte [ebp - 0x35]
cmp dword [ebp - 0x34], ebx
je 0x429109
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov bl, byte [ebp - 0x35]
jmp 0x4290e4
Function at 0x429114
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x50
mov eax, 0x49e392
call fcn.0047bb83
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0x5c], eax
cmp dword [ecx + 0x10], ebx
je 0x42916b
cmp dword [edi + 0x10], ebx
je 0x42916b
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00428e4d
pop ecx
cmp al, bl
jne 0x429173
push 1
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00404dda
xor al, al
call fcn.0047bbdf
ret
cmp dword [ebp - 0x20], 8
mov eax, dword [ebp - 0x34]
jae 0x42917f
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x54]
push ecx
push 0x201
push ebx
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x42915f
mov esi, dword [ebp - 0x54]
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
jb 0x4291b1
mov eax, dword [edi]
jmp 0x4291b3
mov eax, edi
lea ecx, [ebp - 0x3c]
push ecx
push ebx
lea ecx, [ebp - 0x40]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
je 0x4291d6
cmp esi, ebx
je 0x42915f
push esi
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
jmp 0x42915f
cmp dword [ebp - 0x40], 1
jne 0x4291c9
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x58]
shr eax, 1
push ecx
lea esi, [ebp - 0x50]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call fcn.0040cec1
mov byte [ebp - 4], 3
cmp dword [edi + 0x14], 8
jb 0x429205
mov edi, dword [edi]
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x40]
push eax
push ebx
push edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
je 0x429235
lea esi, [ebp - 0x50]
call fcn.00419335
cmp dword [ebp - 0x38], ebx
je 0x42915f
push dword [ebp - 0x38]
jmp 0x4291ce
cmp dword [ebp - 0x40], 1
je 0x429264
lea esi, [ebp - 0x50]
call fcn.00419335
cmp dword [ebp - 0x38], ebx
je 0x429251
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00404dda
mov al, bl
jmp 0x42916d
mov eax, dword [ebp - 0x3c]
shr eax, 1
lea ecx, [ebp - 0x50]
call fcn.00407163
mov eax, dword [ebp - 0x4c]
cmp word [eax - 2], bx
jne 0x429285
cmp dword [ebp - 0x50], eax
je 0x429285
add eax, 0xfffffffe
mov dword [ebp - 0x4c], eax
sub eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x5c]
mov esi, eax
sar esi, 1
mov eax, esi
mov ecx, edi
call fcn.0040bf03
cmp dword [edi + 0x14], 8
jb 0x4292a0
mov edi, dword [edi]
lea eax, [esi + esi]
push eax
push dword [ebp - 0x50]
push edi
call fcn.00477a90
add esp, 0xc
lea esi, [ebp - 0x50]
call fcn.00419335
cmp dword [ebp - 0x38], ebx
je 0x4292c6
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov bl, 1
jmp 0x429251

Function at 0x475a38
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3204]
jne 0x475a42
repz ret
jmp fcn.0047dd7f
Function at 0x48b1e0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c3204]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00480154
and dword [ebp - 0x14], 0
cmp dword [0x4c7f24], 0
mov dword [ebp - 0x18], eax
jne 0x48b293
push 0x4a6364
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48b33b
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4a6358
push ebx
call edi
test eax, eax
je 0x48b33b
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push 0x4a6348
push ebx
mov dword [0x4c7f24], eax
call edi
push eax
call esi
push 0x4a6334
push ebx
mov dword [0x4c7f28], eax
call edi
push eax
call esi
push 0x4a6318
push ebx
mov dword [0x4c7f2c], eax
call edi
push eax
call esi
mov dword [0x4c7f34], eax
test eax, eax
je 0x48b293
push 0x4a6300
push ebx
call edi
push eax
call esi
mov dword [0x4c7f30], eax
mov eax, dword [0x4c7f30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x48b2ec
cmp dword [0x4c7f34], ecx
je 0x48b2ec
push eax
call esi
push dword [0x4c7f34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48b2ec
test ebx, ebx
je 0x48b2ec
call edi
test eax, eax
je 0x48b2e3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48b2e3
test byte [ebp - 8], 1
jne 0x48b2ec
or dword [ebp + 0x10], 0x200000
jmp 0x48b31f
mov eax, dword [0x4c7f28]
cmp eax, dword [ebp - 0x18]
je 0x48b31f
push eax
call esi
test eax, eax
je 0x48b31f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48b31f
mov eax, dword [0x4c7f2c]
cmp eax, dword [ebp - 0x18]
je 0x48b31f
push eax
call esi
test eax, eax
je 0x48b31f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c7f24]
call esi
test eax, eax
je 0x48b33b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48b33d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475a38
leave
ret

Function at 0x4ee608
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004ee687
jae 0x4ee614
xor ecx, ecx
call fcn.004ee687
jae 0x4ee63e
xor eax, eax
call fcn.004ee687
jae 0x4ee64f
mov al, 0x10
call fcn.004ee687
adc al, al
jae 0x4ee630
jne 0x4ee67c
stosb byte es:[edi], al
jmp 0x4ee615
call fcn.004ee693
dec ecx
loop 0x4ee65b
mov eax, ebp
call fcn.004ee691
jmp 0x4ee67d
lodsb al, byte [esi]
shr eax, 1
je 0x4ee6a3
adc ecx, 2
mov ebp, eax
jmp 0x4ee67d
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004ee691
cmp eax, 0x7d00
jae 0x4ee67b
cmp eax, 0x500
jae 0x4ee67c
cmp eax, 0x7f
ja 0x4ee67d
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4ee615
pop ebp
ret 8
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401110
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401122
mov eax, dword [0x41f08b]
shl eax, 2
mov dword [0x41f08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00413f90
pop edx
call fcn.00413280
call fcn.00413f94
push 0
call fcn.00414e88
pop ecx
push 0x41f034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x41f093], eax
push 0
jmp fcn.0041c8f4

Function at 0x4012d8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe08
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x40130c
xor eax, eax
jmp 0x40138f
push esi
lea edx, [ebp - 0x1f8]
push edx
call fcn.00401398
add esp, 8
push 0x41f0a4
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.004140f4
add esp, 8
lea eax, [ebp - 0x1f8]
push eax
call fcn.00414184
pop ecx
mov ebx, eax
jmp 0x401352
lea eax, [ebp - 0x1f8]
push eax
call fcn.004012d8
pop ecx
test al, al
je 0x401373
mov edx, 0x1f4
lea ecx, [ebp - 0x1f8]
sub edx, ebx
dec edx
add ecx, ebx
push edx
push ecx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x401341
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
sete al
and eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4013c8
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
push ebx
call fcn.00401440
pop ecx
jmp 0x40141d
push 7
push str.sxFile
lea eax, [ebp - 0x110]
push eax
call fcn.004143a0
add esp, 0xc
test eax, eax
jne 0x40141d
lea edx, [ebp - 0x109]
push edx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x40141d
lea ecx, [ebp - 0x109]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40141d
inc esi
push 0x10e
lea eax, [ebp - 0x110]
push eax
push ebx
call fcn.00401260
add esp, 0xc
test eax, eax
jne 0x4013e1
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4014b8
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
push ebx
call fcn.00401440
pop ecx
jmp 0x40150d
push 9
push str.sxFolder
lea eax, [ebp - 0x110]
push eax
call fcn.004143a0
add esp, 0xc
test eax, eax
jne 0x40150d
lea edx, [ebp - 0x107]
push edx
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
jne 0x40150d
lea ecx, [ebp - 0x107]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40150d
inc esi
push 0x10e
lea eax, [ebp - 0x110]
push eax
push ebx
call fcn.00401260
add esp, 0xc
test eax, eax
jne 0x4014d1
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413c4c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x415114
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x415130
call fcn.004167dc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x41514f
test bl, 1
je 0x41514f
call fcn.0041b8ac
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x415330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00416358
test byte [ebp + 0xd], 0xc0
jne 0x415354
mov eax, dword [0x4227a4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x415361
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x41538e
je 0x4153a0
sub ecx, 0x100
je 0x4153ae
sub ecx, 0x100
je 0x4153b5
sub ecx, 0x100
je 0x4153a7
jmp 0x4153bc
sub ecx, 0x600
je 0x4153b5
sub ecx, 0x100
je 0x4153a0
jmp 0x4153bc
mov edi, 1
jmp 0x4153c1
mov edi, 2
jmp 0x4153c1
mov edi, 4
jmp 0x4153c1
mov edi, 5
jmp 0x4153c1
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4153e8
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x42221c]
test al, 0x80
je 0x4153e1
mov ebx, 0x80
jmp 0x4153fa
mov ebx, 1
jmp 0x4153fa
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4153fa
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x41540c
je 0x415415
dec eax
je 0x41541e
jmp 0x415427
mov dword [ebp - 4], 0x80000000
jmp 0x415436
mov dword [ebp - 4], 0x40000000
jmp 0x415436
mov dword [ebp - 4], 0xc0000000
jmp 0x415436
push 1
call fcn.00416770
pop ecx
mov ebx, eax
jmp 0x415526
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x415452
sub eax, 0x10
je 0x415459
sub eax, 0x10
je 0x415462
sub eax, 0x10
je 0x41546b
jmp 0x41546b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x415472
mov dword [ebp - 8], 1
jmp 0x415472
mov dword [ebp - 8], 2
jmp 0x415472
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4154df
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4154d4
test byte [ebp + 0xd], 1
je 0x4154cf
mov ebx, 0x50
jmp 0x4154d4
mov ebx, 2
push ebx
call fcn.00416770
pop ecx
mov ebx, eax
jmp 0x415526
mov edi, esi
push edi
call fcn.00415294
pop ecx
test eax, eax
je 0x4154f3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4154ff
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00416498
add esp, 8
mov ebx, eax
inc eax
jne 0x415526
push 4
call fcn.00416770
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0041638c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41895c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004140f4
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00414184
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.00414184
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4233e1
lea ecx, [ebp - 0x200]
push ecx
call fcn.004140f4
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.00414184
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004199c4
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x418a6d
push esi
call fcn.00414184
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00414184
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00413190
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x418a44
xor eax, eax
jmp 0x418af4
push esi
call fcn.00414184
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00414184
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0041404c
add esp, 0xc
jmp 0x418aad
mov edi, dword [ebx + 0x24]
push edi
call fcn.00414184
pop ecx
push eax
push esi
call fcn.00414184
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00414184
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004131b0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x418aad
xor eax, eax
jmp 0x418af4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004140f4
add esp, 8
push 0x4233e3
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004140f4
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004140f4
add esp, 8
push 0x4233e5
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004140f4
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x41b86d
jmp 0x41b8a4
call fcn.0041b7f0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00414184
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00414184
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41b924
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x423a14], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x41b9fe
cmp dword [0x423a10], 0
jne 0x41b9fe
cmp dword [0x423c1c], 0
je 0x41b9b8
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0041b6f0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41b99e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0041b6f0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41b99e
lea ebx, [ebp - 0x84]
jmp 0x41b99f
inc ebx
call fcn.0041b8e0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x41ba39
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x423a18
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00414184
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x423a1b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x41ba39
cmp dword [0x423a10], 0
je 0x41ba18
cmp dword [0x423a10], 0xffffffff
je 0x41ba39
push esi
call dword [0x423a10]
pop ecx
mov eax, dword [0x423a14]
test eax, eax
je 0x41ba39
cmp dword [0x423a14], 0xffffffff
je 0x41ba39
cmp byte [eax], 0
je 0x41ba39
push esi
push eax
call fcn.0041b840
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c25c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x425224], 0
jne 0x41c2dd
cmp dword [0x425244], 0
jne 0x41c28c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x425244], eax
test eax, eax
jne 0x41c28c
push str.GetEnvironmentStrings_failed
call fcn.0041ba50
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x425244]
jmp 0x41c2a0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00414184
pop ecx
mov edi, eax
test eax, eax
jne 0x41c298
lea edi, [ebp + 1]
push edi
call fcn.00413190
pop ecx
mov ebx, eax
mov dword [0x425228], ebx
test ebx, ebx
jne 0x41c2ca
xor eax, eax
jmp 0x41c3a0
push edi
mov edx, dword [0x425244]
push edx
push ebx
call fcn.00413fb8
add esp, 0xc
jmp 0x41c2fd
xor esi, esi
mov ebx, dword [0x425224]
jmp 0x41c2f7
push eax
call fcn.00414184
pop ecx
test eax, eax
jne 0x41c2f3
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c2e7
lea ebx, [esi + 4]
push 4
mov dword [0x42522c], ebx
inc ebx
push ebx
call fcn.00412f04
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c320
xor eax, eax
jmp 0x41c3a0
cmp dword [0x425224], 0
jne 0x41c351
xor esi, esi
mov ebx, dword [0x425228]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c342
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00414184
pop ecx
mov edi, eax
test eax, eax
jne 0x41c338
jmp 0x41c382
xor esi, esi
mov ebx, dword [0x425224]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c37c
push eax
call fcn.00414184
pop ecx
test eax, eax
je 0x41c371
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c375
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c360
mov eax, dword [0x425224]
test eax, eax
je 0x41c392
push eax
call fcn.004131a0
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x425224], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret