joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b660
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b3d4]
jne 0x40b66a
repz ret
jmp fcn.004127ec

Function at 0x41849c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b3d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040fe21
and dword [ebp - 0x14], 0
cmp dword [0x462f74], 0
mov dword [ebp - 0x18], eax
jne 0x41854f
push 0x403854
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4185f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403848
push ebx
call edi
test eax, eax
je 0x4185f7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403838
push ebx
mov dword [0x462f74], eax
call edi
push eax
call esi
push 0x403824
push ebx
mov dword [0x462f78], eax
call edi
push eax
call esi
push 0x403808
push ebx
mov dword [0x462f7c], eax
call edi
push eax
call esi
mov dword [0x462f84], eax
test eax, eax
je 0x41854f
push 0x4037f0
push ebx
call edi
push eax
call esi
mov dword [0x462f80], eax
mov eax, dword [0x462f80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4185a8
cmp dword [0x462f84], ecx
je 0x4185a8
push eax
call esi
push dword [0x462f84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4185a8
test ebx, ebx
je 0x4185a8
call edi
test eax, eax
je 0x41859f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41859f
test byte [ebp - 8], 1
jne 0x4185a8
or dword [ebp + 0x10], 0x200000
jmp 0x4185db
mov eax, dword [0x462f78]
cmp eax, dword [ebp - 0x18]
je 0x4185db
push eax
call esi
test eax, eax
je 0x4185db
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4185db
mov eax, dword [0x462f7c]
cmp eax, dword [ebp - 0x18]
je 0x4185db
push eax
call esi
test eax, eax
je 0x4185db
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x462f74]
call esi
test eax, eax
je 0x4185f7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4185f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b660
leave
ret
Function at 0x422bb0
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00421f00
cmp dword [0x803cf8], 0x37
jne 0x422c65
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x4044d0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4044f0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x404]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov ecx, dword [0x803cfc]
mov eax, dword [0x800168]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1004
ret
Function at 0x40252d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
pushal
call 0x40252d
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x402572
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x402593
jb 0x402588
outsb dx, byte [esi]
je 0x40257c
jb 0x40259c
imul ebp, dword [edi + 0x6e], 0x85c75e00
invalid
mov dword [ebp - 4], 0x186a0
add dword [eax], eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
mov ch, 0xf8
invalid
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
cmp eax, 0x103
add byte [eax], al
je 0x402604
lea edx, [ebp - 0x104]
push edx
call fcn.00402489
cmp eax, 1
je 0x4025b9
inc dword [ebp - 0x108]
jmp 0x40256d
cmp dword [ebp + 8], 0
je 0x4025fa
lea edx, [ebp - 0x104]
push edx
push esi
call fcn.004017de
push dword [ebp + 8]
push eax
call fcn.004015ee
cmp dword [ebp + 0xc], 0
je 0x4025fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 8
push 0
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegGetValueA]
cmp eax, 0
jne 0x402604
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
popal
mov eax, dword [ebp - 0x110]
leave
ret 0xc

Function at 0x402f9d
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
pushal
lea edx, [ebp - 0x30c]
push edx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
push 0x40601c
lea edx, [ebp - 0x30c]
push edx
call fcn.00401702
lea edx, [ebp - 0x208]
push edx
call fcn.00402190
push 0x406214
lea edx, [ebp - 0x208]
push edx
call fcn.00401702
push 0
push 0x1db
push 0x406039
lea edx, [ebp - 0x30c]
push edx
call fcn.0040226e
push 0
push 0x182
push 0x40622d
lea edx, [ebp - 0x208]
push edx
call fcn.0040226e
push 0x406219
lea edx, [ebp - 0x208]
push edx
call fcn.00401702
cmp eax, 0
je 0x403063
lea edx, [ebp - 0x208]
push edx
push 0x406010
call fcn.004020f6
push 0x5dc
call dword [sym.imp.kernel32.dll_Sleep]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
popal
leave
ret
Function at 0x4030b6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov edi, 0x415108
push 0
push 0xa
push edi
call fcn.004018eb
push edi
call fcn.0040176e
add edi, eax
lea edx, [eax + 1]
inc edi
push edi
mov esi, 0x40a3bd
mov ecx, 0x14
rep movsb byte es:[edi], byte [esi]
mov esi, 0x40a359
mov ecx, 0x64
rep movsb byte es:[edi], byte [esi]
mov esi, 0x40a3d1
mov ecx, 0x4388
rep movsb byte es:[edi], byte [esi]
pop edi
lea eax, [edx + 0x4400]
push eax
push 0x415108
call fcn.0040183e
mov edi, eax
push section..bss
call fcn.00403066
push 0
push section..bss
push 0x40ea0c
call fcn.00402691
push 1
push 0
push 0
push 0
call fcn.00403184
push section..bss
push 0x40e7ef
call fcn.004017de
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
cmp eax, 0
jne 0x403181
push edi
push 0x415108
push 3
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegSetValueExA]
popal
leave
ret

Function at 0x403556
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 0x24], 1
pushal
mov dword [ebp - 0x28], 0
mov edi, 0x40ec15
cld
mov eax, 0x402d64
stosd dword es:[edi], eax
mov eax, 0x402bc6
stosd dword es:[edi], eax
mov eax, 0x402ca9
stosd dword es:[edi], eax
mov eax, 0x402d07
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00403439
cmp eax, 1
je 0x40360f
push 0x3e8
push 0x42dbd0
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov al, byte [0x42dbd0]
mov byte [0x42dcd4], al
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
push dword [ebp - 0x24]
pop dword [0x42d938]
push 0x42d93c
push 0x40ea96
call fcn.004022da
mov dword [0x42d954], eax
test eax, eax
jne 0x4035f4
push 0x42d93c
push 0x40eada
call fcn.004022da
test eax, eax
je 0x40360f
mov dword [0x42d954], eax
push 0x42d95c
push 0x40eb1b
call fcn.004022da
mov dword [0x42d958], eax
test eax, eax
je 0x40360f
mov dword [ebp - 0x28], eax
popal
mov eax, dword [ebp - 0x28]
leave
ret

Function at 0x404271
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405692
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x2c
lea edx, [ebp - 0x38]
push edx
call fcn.00401721
mov ecx, esi
lea edx, [ebp - 0x38]
call fcn.004026fd
test eax, eax
je 0x404306
cmp byte [ebp - 0x25], 0xcc
jne 0x4042c7
inc dword [ebp - 0xc]
jmp 0x4042f6
mov ecx, dword [ebp - 0xc]
jecxz 0x4042f6
cmp ecx, dword [ebp + 0x14]
jb 0x4042ef
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.004041fe
cmp eax, 1
jne 0x404306
add dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x28]
jae 0x404306
mov dword [ebp - 0xc], 0
xor eax, eax
mov al, byte [ebp - 0x38]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x4042ae
popal
mov eax, dword [ebp - 8]
leave
ret 0x24
Function at 0x40430e
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
mov dword [ebp - 7], 0
mov dword [ebp - 0xf], 0
mov dword [ebp - 0xb], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405692
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x39
lea edx, [ebp - 0x48]
push edx
call fcn.00401721
mov ecx, esi
lea edx, [ebp - 0x48]
call fcn.00401985
test eax, eax
je 0x4043a3
cmp byte [ebp - 0x30], 0xcc
jne 0x404364
inc dword [ebp - 0xf]
jmp 0x404393
mov ecx, dword [ebp - 0xf]
jecxz 0x404393
cmp ecx, dword [ebp + 0x14]
jb 0x40438c
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.004041fe
cmp eax, 1
jne 0x4043a3
add dword [ebp - 0xb], ecx
mov eax, dword [ebp - 0xb]
cmp eax, dword [ebp + 0x28]
jae 0x4043a3
mov dword [ebp - 0xf], 0
xor eax, eax
mov al, byte [ebp - 0x48]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x40434b
popal
mov eax, dword [ebp - 0xb]
leave
ret 0x24

Function at 0x4043ab
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
mov dword [ebp - 7], 0
mov dword [ebp - 0xf], 0
mov dword [ebp - 0xb], 0
xor ebx, ebx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405692
mov esi, eax
mov edi, dword [ebp + 0xc]
push 0
push 0x39
lea edx, [ebp - 0x48]
push edx
call fcn.00401721
mov ecx, esi
lea edx, [ebp - 0x48]
call fcn.00401985
test eax, eax
jne 0x40441b
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [ebp + 8]
call fcn.004055ce
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 0x10]
cmp ecx, eax
jbe 0x404465
sub eax, edx
jmp 0x40445a
cmp byte [ebp - 0x30], 0xcc
jne 0x404426
inc dword [ebp - 0xf]
jmp 0x404455
mov ecx, dword [ebp - 0xf]
jecxz 0x404455
cmp ecx, dword [ebp + 0x14]
jb 0x40444e
mov eax, edi
sub eax, ecx
push ecx
push eax
push dword [ebp + 0x18]
call fcn.004041fe
cmp eax, 1
jne 0x404465
add dword [ebp - 0xb], ecx
mov eax, dword [ebp - 0xb]
cmp eax, dword [ebp + 0x28]
jae 0x404465
mov dword [ebp - 0xf], 0
xor eax, eax
mov al, byte [ebp - 0x48]
add esi, eax
add edi, eax
add ebx, eax
cmp ebx, dword [ebp + 0x10]
jb 0x4043e8
popal
mov eax, dword [ebp - 0xb]
leave
ret 0x24
Function at 0x404722
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
pushal
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
push 0x41123a
push 0x41112c
push dword [ebp + 8]
call fcn.004038b6
cmp eax, 0
je 0x40497a
push dword [ebp + 8]
call fcn.00404680
mov dword [ebp - 4], eax
push eax
call fcn.004046fb
push 0
push 0x41112c
push 0x406624
call fcn.00402691
push 0
push 0x41123a
push 0x40661a
call fcn.00402691
lea edx, [ebp - 0x88]
push edx
push 0
push 0
push dword [ebp + 8]
call fcn.0040233c
test eax, eax
je 0x40497a
mov dword [ebp - 0x8c], eax
push 0x10000
call fcn.00402071
test eax, eax
je 0x40497a
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0x7c]
push edx
lea edx, [ebp - 0x80]
push edx
lea edx, [ebp - 0x84]
push edx
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x78]
push edx
push dword [ebp - 0x8c]
call fcn.0040383d
cmp dword [ebp - 0x84], 0
je 0x40497a
push dword [ebp - 4]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
push 0xa6
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x6c]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.00403fa0
push dword [ebp - 0xc]
push 0x40ea15
call fcn.0040446d
push dword [ebp - 0x10]
push 0x40ea33
call fcn.0040446d
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.00404491
push eax
push 0x40ea47
call fcn.0040446d
cmp eax, dword [ebp - 0xc]
jae 0x40487f
jmp 0x40497a
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x8c]
call fcn.0040453f
test eax, eax
je 0x40497a
mov byte [0x42efe1], 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0xa6
push 0x40eec9
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x8c]
call fcn.00403d78
push eax
push 0x40ea59
call fcn.0040446d
cmp eax, 0
je 0x40497a
push dword [ebp + 8]
push 0x40e767
call fcn.0040202e
push 0x41112c
push 0x40e777
call fcn.0040202e
push dword [ebp - 0x14]
call fcn.0040208e
push dword [ebp - 0x18]
call fcn.0040208e
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0x41112c
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
push 0
push dword [ebp + 8]
push 0x41112c
call dword [sym.imp.kernel32.dll_CopyFileA]
push 0
push 0x42efe1
push dword [ebp + 8]
push 0x41112c
call fcn.00403184
push 0
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push dword [ebp + 8]
call fcn.0040226e
test eax, eax
je 0x40497a
push dword [ebp - 0x84]
push 0x41123a
call fcn.00405029
mov dword [ebp - 0xa0], 1
cmp dword [ebp - 0x14], 0
je 0x404988
push dword [ebp - 0x14]
call fcn.0040208e
cmp dword [ebp - 0x18], 0
je 0x404996
push dword [ebp - 0x18]
call fcn.0040208e
popal
mov eax, dword [ebp - 0xa0]
leave
ret 4
Function at 0x4049e5
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
push 1
push 6
call dword [sym.imp.kernel32.dll_OpenFileMappingA]
test eax, eax
jne 0x404a21
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jb 0x4049fa
jmp 0x404a94
mov ebx, eax
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push 0
push 0
push 6
push ebx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
test eax, eax
jne 0x404a54
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jb 0x404a2a
jmp 0x404a8d
mov esi, eax
mov edi, dword [ebp + 8]
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
push dword [ebp + 0xc]
push esi
push edi
call fcn.00401736
mov dword [esi], 0x21444e45
push 0xc8
call dword [sym.imp.kernel32.dll_Sleep]
push esi
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov dword [ebp - 8], 1
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
popal
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x404f65
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x14], 1
pushal
mov dword [ebp - 4], 0
lea esi, [ebp - 0x58]
lea edi, [ebp - 0x14]
push 0
push 0x44
push esi
call fcn.00401721
push 0
push 0x10
push edi
call fcn.00401721
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 0
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x404fff
push dword [ebp + 8]
lea edx, [ebp - 0x260]
push edx
call fcn.004015ee
lea edx, [ebp - 0x260]
push edx
call fcn.0040176e
lea ecx, [ebp - 0x260]
mov dword [eax + ecx], 0x20
push dword [ebp + 0xc]
lea edx, [ebp - 0x260]
push edx
call fcn.00401702
lea eax, [ebp - 0x260]
push edi
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x405021
mov dword [ebp - 4], 1
popal
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x405071
Capabilities:
Get file attributes
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
inc eax
je 0x4050b2
dec eax
mov dword [ebp - 0x18], eax
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push 0
push pe_nt_image_headers32
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
inc eax
je 0x4051e2
push 0
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp + 0x14]
jae 0x4050f6
mov dword [ebp + 0x14], eax
mov dword [ebp - 8], 1
test eax, eax
je 0x405164
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
test eax, eax
je 0x4051d0
mov edi, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_ReadFile]
dec eax
jne 0x4051c1
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x405110
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_SetFilePointer]
inc eax
je 0x4051c1
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WriteFile]
dec eax
jne 0x4051c1
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x405148
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WriteFile]
dec eax
jne 0x4051c1
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x40516a
cmp dword [ebp - 8], 1
je 0x4051c1
cmp dword [ebp - 0xc], 0
je 0x4051d0
mov edi, dword [ebp - 0xc]
add edi, dword [ebp + 0x14]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_WriteFile]
dec eax
jne 0x4051c1
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
jne 0x40519e
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0xc], 0
je 0x4051d0
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_LocalFree]
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x4051e2
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
popal
mov eax, dword [ebp - 0x1c]
leave
ret 0x10
Function at 0x403900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x473020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403998
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403978
xor eax, eax
push ebp
push 0x403971
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4039b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403978
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x473020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x473020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4047b4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47604c], 0
je 0x404815
cmp word [0x476220], 0xd7b2
jne 0x4047dd
cmp dword [0x476228], 0
jbe 0x4047dd
mov eax, 0x47621c
call dword [0x476238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40483c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47302c], 0
jne 0x404831
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406114
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406344
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406197
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406344
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406197
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406360
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406220
xor eax, eax
push ebp
push 0x406219
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405f50
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4061fe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406380
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4061fe
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406220
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40633a
cmp byte [ebp - 0xd], 0
jne 0x406267
cmp byte [ebp - 0x12], 0
je 0x40633a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406280
dec ebx
cmp byte [ebx], 0x2e
je 0x40628f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40627f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40633a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4062cc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40633a
cmp byte [ebp - 0xd], 0
je 0x40633a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40633a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret