joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a4e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
fld qword [0x420100]
sub esp, 0x38
fcom qword [0x42af10]
push esi
push edi
fnstsw ax
test ah, 0x41
jne 0x40a506
fstp qword [0x42af10]
jmp 0x40a508
fstp st(0)
fld qword [0x429390]
fcom qword [0x42b290]
fnstsw ax
test ah, 0x41
jne 0x40a523
fstp qword [0x42b290]
jmp 0x40a525
fstp st(0)
fld qword [0x42b2f0]
mov edi, 1
fld qword [0x42b2e0]
fsub st(1), st(0)
fld qword [0x41f588]
fmul st(2), st(0)
fld1
fadd st(3), st(0)
fxch st(2)
fst qword [0x42af40]
fxch st(3)
fadd st(2)
fst qword [esp + 0x38]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a6e2
fld qword [0x4200b8]
fld qword [0x4200f8]
fld qword [0x4200f0]
fld qword [0x4200e8]
jmp 0x40a58d
fld qword [0x4200e8]
fld qword [0x42b2e0]
fxch st(5)
fxch st(1)
lea eax, [edi - 1]
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul st(4)
fadd st(6)
fst qword [0x42af40]
fld qword [0x42b2f0]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x40a70a
fstp st(6)
mov esi, 1
fxch st(5)
fadd qword [str.333333]
fld qword [0x41f330]
fadd st(1)
fxch st(1)
fmul st(5)
fadd st(3)
fdiv st(5)
fst qword [esp + 0x28]
fld qword [0x42b290]
fmul st(3)
fadd st(7)
fdiv st(3)
fstp qword [0x42b290]
fld qword [0x42b2c8]
fmul st(3)
faddp st(7)
fxch st(6)
fdiv st(2)
fstp qword [0x42b2c8]
fmul st(4)
fadd st(2)
fdiv st(4)
fsub st(5)
fdiv st(3)
fld1
fadd st(1), st(0)
fxch st(1)
fst qword [esp + 0x30]
fcompp
fnstsw ax
test ah, 0x41
je 0x40a64c
fstp st(4)
jmp 0x40a6c4
fld qword [esp + 0x28]
fld qword [0x41f588]
fld qword [0x4200b8]
fld qword [0x4200f8]
fld qword [0x4200f0]
lea ecx, [esi - 1]
mov dword [esp + 0x24], ecx
fild dword [esp + 0x24]
fmul st(3)
faddp st(5)
fld qword [0x42b2d8]
fadd st(2)
fcomp st(5)
fnstsw ax
test ah, 5
jnp 0x40a61b
fstp st(3)
sub esp, 8
fstp st(2)
fstp st(1)
fstp st(0)
fstp qword [0x42af68]
fld qword [0x42b2a8]
fstp qword [esp]
call fcn.0040a460
add esi, 1
fstp st(0)
mov dword [esp + 0x2c], esi
fild dword [esp + 0x2c]
add esp, 8
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 5
jnp 0x40a630
fld qword [0x41f588]
fld qword [0x4200b8]
fld qword [0x4200f8]
fld qword [0x4200f0]
fxch st(3)
fxch st(2)
fxch st(1)
add edi, 1
mov dword [esp + 0x24], edi
fild dword [esp + 0x24]
fcomp qword [esp + 0x38]
fnstsw ax
test ah, 5
jnp 0x40a57d
fstp st(2)
fstp st(2)
fstp st(0)
fstp st(0)
cmp dword [0x42b300], 0
jne 0x40a71e
push 0x40
push 0x41f3f4
push 0x4200c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
fstp st(5)
fstp st(1)
fstp st(3)
fstp st(0)
fstp st(0)
fstp st(0)
fstp qword [0x42af40]
jmp 0x40a6e6
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a730
Capabilities:
Terminate process

Disassembly:
push ecx
push 0x64
push 0
push 0x42ad10
call fcn.0040c3d0
push 0x42ade0
push 0x64
push 0x42ad10
call fcn.0040bf9a
push str.programT_OptiYs.txt
push 0x64
push 0x42ad10
call fcn.0040bfff
push 0x41f404
lea eax, [esp + 0x28]
push 0x42ad10
push eax
call fcn.0040c37d
add esp, 0x30
test eax, eax
je 0x40a797
push 0x40
push 0x41f638
push 0x420128
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
mov ecx, dword [esp]
push 0x42b2f0
push 0x42b2e0
push str._lf__lf
push ecx
call fcn.0040c29c
mov edx, dword [esp + 0x10]
push 0x42b2d8
push 0x42b2c0
push str._lf__lf
push edx
call fcn.0040c29c
mov eax, dword [esp + 0x20]
push 0x42b2c8
push 0x42b290
push str._lf__lf
push eax
call fcn.0040c29c
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0040c0e3
fld qword [0x42b2e0]
fld qword [0x41f3b8]
push 0x64
fdiv st(1), st(0)
push 0
push 0x42ad10
fxch st(1)
fstp qword [0x42b2e0]
fld qword [0x42b2f0]
fdiv st(1)
fstp qword [0x42b2f0]
fld qword [0x42b2c0]
fdiv st(1)
fstp qword [0x42b2c0]
fld qword [0x42b2d8]
fdiv st(1)
fstp qword [0x42b2d8]
fld qword [0x42b290]
fdiv st(1)
fstp qword [0x42b290]
fdivr qword [0x42b2c8]
fstp qword [0x42b2c8]
call fcn.0040c3d0
add esp, 0x40
push 0x42ade0
push 0x64
push 0x42ad10
call fcn.0040bfff
push str.program_
push 0x64
push 0x42ad10
call fcn.0040bfff
push 0x420108
push 0x64
push 0x42ad10
call fcn.0040bfff
push 0x41fc18
push 0x42ad10
push 0x42b2b8
call fcn.0040c37d
call fcn.0040a4e0
mov edx, dword [0x42b2b8]
push edx
call fcn.0040c0e3
add esp, 0x34
call fcn.0040a190
pop ecx
ret

Function at 0x40ab40
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [0x42b09c]
fld qword [0x429038]
cmp eax, 7
fst qword [esp + 8]
je 0x40abf0
cmp eax, 0x47
je 0x40abf0
mov eax, dword [0x42aed4]
cmp eax, 1
jne 0x40ab79
fmul qword [0x41fc70]
fstp qword [esp]
jmp 0x40ab9b
cmp eax, 2
jne 0x40ab89
fmul qword [0x4202c8]
fstp qword [esp]
jmp 0x40ab9b
cmp eax, 3
jne 0x40ab99
fmul qword [0x41f578]
fstp qword [esp]
jmp 0x40ab9b
fstp st(0)
fld qword [esp]
fstp qword [0x42b388]
call fcn.00408430
fld qword [0x42b0b0]
fmul qword [0x4299f0]
fdiv qword [0x42af88]
fstp qword [0x42b330]
fld qword [0x42afc0]
fst qword [0x42b3c0]
fld qword [str._DT]
fmul qword [esp + 8]
fld qword [0x41f3b8]
fdiv st(1), st(0)
fxch st(1)
fmul qword [esp]
fdivrp st(1)
fmulp st(1)
fstp qword [0x42b348]
jmp 0x40ac27
fld qword [0x428e90]
fld qword [0x41fc70]
fcomp st(2)
fnstsw ax
test ah, 5
jp 0x40ac0d
fld qword [0x4202c0]
jmp 0x40ac0f
fld1
fxch st(1)
fmul qword [0x4202b8]
fdiv qword [0x42a1c0]
fmulp st(2)
fmulp st(1)
fstp qword [0x42b398]
cmp dword [0x42ae44], 0
je 0x40ac3a
push 1
call fcn.0040b170
add esp, 4
fld qword [0x42b348]
fld qword [0x42b330]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40ac7d
cmp dword [0x42af4c], 1
jne 0x40ac77
push 0x40
fstp st(0)
push 0x41f318
fstp st(0)
push 0x420288
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
fsubrp st(1)
add esp, 0x10
ret
fstp st(0)
fstp st(0)
fldz
add esp, 0x10
ret
Function at 0x40ac90
Capabilities:
Terminate process

Disassembly:
cmp dword [0x42b09c], 0x48
fld qword [0x42af78]
fst qword [0x42b368]
jne 0x40ad2e
fld qword [0x429038]
fld st(0)
fadd st(1)
fld qword [0x42b0e8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jnp 0x40ad0d
fxch st(1)
fmul qword [0x41f470]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x40ad0f
fld qword [0x42b0b0]
fmul qword [0x4299f0]
fdiv qword [0x42af88]
fstp qword [0x42b360]
fld qword [0x42b388]
fld qword [0x41f3b8]
fdiv st(1), st(0)
fxch st(1)
fmul qword [str._DT]
fxch st(2)
fdivrp st(1)
fmulp st(1)
fmulp st(1)
jmp 0x40ad85
fstp st(1)
push 0x40
fstp st(0)
push 0x41f318
fstp st(0)
push 0x4202fc
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
fstp st(0)
fld qword [0x42b0b0]
fmul qword [0x4299f0]
fstp qword [0x42b360]
fld qword [0x42af68]
fsub qword [0x42af40]
fmul st(0), st(0)
fmul qword [0x420008]
fld qword [0x42b0d8]
fmul st(0), st(0)
faddp st(1)
call fcn.0040d700
fmul qword [str._DT]
fld qword [0x42af40]
fadd qword [0x42af68]
fmulp st(1)
fmul qword [0x41f348]
fmul qword [0x42af78]
cmp dword [0x42ae44], 0
fst qword [0x42b350]
je 0x40ada6
push 2
fstp st(0)
call fcn.0040b170
fld qword [0x42b350]
add esp, 4
fld qword [0x42b360]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40ade0
cmp dword [0x42af4c], 1
jne 0x40addd
push 0x40
fstp st(1)
push 0x41f318
fstp st(0)
push 0x4202d0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
fsubrp st(1)
ret
fstp st(1)
fstp st(0)
fldz
ret
Function at 0x40adf0
Capabilities:
Terminate process

Disassembly:
fld qword [0x42b0b0]
sub esp, 0x10
cmp dword [0x42b09c], 0x48
fmul qword [0x4299f0]
jne 0x40afa8
fld qword [0x42af88]
sub esp, 8
fdivr st(1)
fstp qword [0x42b340]
fld qword [0x42b388]
fld qword [0x41f3b8]
fdiv st(1), st(0)
fld qword [0x42b0e8]
fdiv st(1)
fst qword [esp + 0x10]
fld qword [str._DT]
fmul st(3)
fld qword [0x42b250]
fmul st(1), st(0)
fld st(2)
fadd st(5)
fmulp st(2)
fxch st(1)
fstp qword [0x42b3b8]
fxch st(4)
fstp qword [0x42b3b0]
fxch st(3)
fstp qword [0x42b3a0]
fdivr qword [0x42aec0]
fmul qword [0x420390]
faddp st(2)
fxch st(1)
fstp qword [esp + 8]
fmul qword [0x41f588]
fstp qword [esp]
call fcn.0040d7c0
fdiv qword [0x41f588]
add esp, 8
xor ecx, ecx
fld qword [0x42b3a0]
fld qword [str._DT]
fld qword [0x42b3b0]
fld qword [0x4200b8]
fld qword [esp]
jmp 0x40aeb3
fstp st(1)
fxch st(5)
fld st(3)
fmul st(6)
fmul st(5)
fld st(1)
fadd st(7)
fmulp st(1)
fst qword [0x42b3c8]
fcom st(3)
fnstsw ax
test ah, 5
jp 0x40af94
fstp st(0)
fxch st(5)
fadd st(1)
fld st(3)
fmul st(1)
fmul st(5)
fld st(6)
fadd st(2)
fmulp st(1)
fst qword [0x42b3c8]
fcom st(3)
fnstsw ax
test ah, 5
jp 0x40af9e
fstp st(0)
fadd st(1)
fld st(3)
fmul st(1)
fmul st(5)
fld st(6)
fadd st(2)
fmulp st(1)
fst qword [0x42b3c8]
fcom st(3)
fnstsw ax
test ah, 5
jp 0x40af9e
fstp st(0)
fadd st(1)
fld st(3)
fmul st(1)
fmul st(5)
fld st(6)
fadd st(2)
fmulp st(1)
fst qword [0x42b3c8]
fcom st(3)
fnstsw ax
test ah, 5
jp 0x40af9e
fstp st(0)
fadd st(1)
fld st(3)
fmul st(1)
fmul st(5)
fld st(6)
fadd st(2)
fmulp st(1)
fst qword [0x42b3c8]
fcom st(3)
fnstsw ax
test ah, 5
jp 0x40af9e
add ecx, 5
fxch st(1)
cmp ecx, 0x32
fadd st(2)
jl 0x40aeaf
fstp st(5)
fstp st(3)
fstp st(4)
fstp st(3)
fxch st(1)
fxch st(2)
fxch st(2)
fstp qword [0x42b390]
fld qword [esp + 8]
fstp qword [0x42b378]
fld qword [0x42b340]
fld qword [0x42b3b8]
jmp 0x40affa
fstp st(5)
fstp st(3)
fstp st(2)
fstp st(1)
jmp 0x40af74
fstp st(5)
fstp st(3)
fstp st(4)
fstp st(3)
jmp 0x40af72
fst qword [0x42b340]
fld qword [0x42b0d8]
fld qword [0x42b250]
fst qword [0x42b3a0]
fld qword [str._DT]
fmul st(2)
fmulp st(1)
fld qword [0x42af68]
faddp st(2)
fmulp st(1)
fld qword [0x429d40]
fmul qword [0x42b370]
faddp st(1)
fst qword [0x42b3b8]
fld qword [0x42b3c8]
fld qword [0x42b3b0]
fxch st(3)
fxch st(1)
fxch st(2)
cmp dword [0x42ae44], 0
je 0x40b033
fstp st(0)
push 3
fstp st(1)
fstp st(0)
fstp st(0)
call fcn.0040b170
fld qword [0x42b340]
add esp, 4
fld qword [0x42b3b8]
fld qword [0x42b3c8]
fld qword [0x42b3b0]
fxch st(3)
fxch st(1)
fxch st(2)
fcom st(1)
fnstsw ax
test ah, 5
jp 0x40b06e
cmp dword [0x42af4c], 1
fstp st(2)
fstp st(2)
jne 0x40b068
push 0x40
fstp st(0)
push 0x41f318
fstp st(0)
push 0x42035c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
fsubp st(1)
add esp, 0x10
ret
fxch st(3)
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40b0a9
cmp dword [0x42af4c], 1
jne 0x40b0a3
push 0x40
fstp st(1)
push 0x41f318
fstp st(0)
push 0x420324
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
fsubrp st(1)
add esp, 0x10
ret
fstp st(1)
fstp st(0)
fldz
add esp, 0x10
ret
Function at 0x40b4f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x100
fld qword [0x420830]
push esi
fstp qword [esp + 4]
push edi
fld qword [0x42b1a8]
call fcn.0040bda0
test eax, eax
jne 0x40b589
mov edi, dword [0x42a4e8]
mov esi, 1
cmp edi, esi
jl 0x40b57f
jmp 0x40b530
fld qword [esi*8 + 0x429d90]
fstp qword [0x42b1a8]
call fcn.0040b5e0
fst qword [esp + esi*8 + 0x18]
fldz
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x40b559
fstp st(0)
fld qword [0x420830]
fld qword [esp + 8]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x40b576
fstp qword [esp + 8]
fld qword [0x42b1a8]
fstp qword [esp + 0x10]
jmp 0x40b578
fstp st(0)
add esi, 1
cmp esi, edi
jle 0x40b530
fld qword [esp + 0x10]
fstp qword [0x42b1a8]
mov dword [0x42b640], 1
call fcn.0040b5e0
fldz
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40b5cb
cmp dword [0x42af4c], 1
fstp st(0)
jne 0x40b5cd
push 0x40
fstp st(0)
push 0x41f638
push 0x420818
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040bc80
fstp st(1)
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bd0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427818]
jne 0x40bd16
repz ret
jmp fcn.0040eed9

Function at 0x414f2b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040db8f
xor ebx, ebx
cmp dword [0x42c098], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x415000
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414f6b
xor eax, eax
jmp 0x4150c4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x421d40
push edi
call esi
cmp eax, ebx
je 0x414f64
push eax
call fcn.0040db2c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42c098], eax
call esi
push eax
call fcn.0040db2c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42c09c], eax
call esi
push eax
call fcn.0040db2c
mov dword [0x42c0a0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040baad
test eax, eax
pop ecx
pop ecx
je 0x414fce
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040e3e9
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x415000
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040db2c
cmp eax, ebx
pop ecx
mov dword [0x42c0a8], eax
je 0x415000
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040db2c
pop ecx
mov dword [0x42c0a4], eax
mov eax, dword [0x42c0a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x415079
cmp dword [0x42c0a8], esi
je 0x415079
push eax
call fcn.0040db98
pop ecx
call eax
cmp eax, ebx
je 0x415046
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x42c0a8]
call fcn.0040db98
pop ecx
call eax
test eax, eax
je 0x415046
test byte [ebp - 0x18], 1
jne 0x415079
lea eax, [ebp - 0xc]
push eax
call fcn.0040bae4
test eax, eax
pop ecx
je 0x415061
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040e3e9
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x415070
or dword [ebp + 0x10], 0x200000
jmp 0x4150aa
or dword [ebp + 0x10], 0x40000
jmp 0x4150aa
mov eax, dword [0x42c09c]
cmp eax, esi
je 0x4150aa
push eax
call fcn.0040db98
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4150aa
mov eax, dword [0x42c0a0]
cmp eax, esi
je 0x4150aa
push dword [ebp - 4]
push eax
call fcn.0040db98
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x42c098]
call fcn.0040db98
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4029dc
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402a19
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402a39
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040501c
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402c10
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404db4
test esi, esi
jne 0x402c46
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404ea4
jmp 0x402c64
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402b24
mov edi, eax
test esi, esi
je 0x402c64
cmp dword [ebx], 0
je 0x402c64
dec esi
jmp 0x402c4d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403420
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x536008], 0x8088405
inc edx
mov dword [ebx + 0x536008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403e34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x536010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ecc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403eac
xor eax, eax
push ebp
push 0x403ea5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403ee8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403eac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x536010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x536010], ax
mov esp, ebp
pop ebp
ret

Function at 0x404bb4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x53a04c], 0
je 0x404c15
cmp word [0x53a220], 0xd7b2
jne 0x404bdd
cmp dword [0x53a228], 0
jbe 0x404bdd
mov eax, 0x53a21c
call dword [0x53a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x536078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404c3c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x536020], 0
jne 0x404c31
push 0
push 0x536098
push 0x536078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404d68
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027c8
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x53a04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404d30
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4069e8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406c18
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406a6b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406c18
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x406a6b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406c34
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406af4
xor eax, eax
push ebp
push 0x406aed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406830
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406ad2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406c54
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406ad2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406af4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406c0e
cmp byte [ebp - 0xd], 0
jne 0x406b3b
cmp byte [ebp - 0x12], 0
je 0x406c0e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406b54
dec ebx
cmp byte [ebx], 0x2e
je 0x406b63
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406b53
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406c0e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406ba0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406c0e
cmp byte [ebp - 0xd], 0
je 0x406c0e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406c0e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409fc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405264
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409fdd
test al, 0x10
jne 0x409fe1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a174
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405264
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x40a188
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405264
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40a1aa
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40d8ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d925
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404ea4
jmp 0x40d92e
mov eax, ebx
mov edx, esi
call fcn.00404e08
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d938
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d959
mov al, byte [esp]
jmp 0x40d95b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40dfe0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40de58
mov eax, dword [0x5394fc]
cmp byte [eax], 0
je 0x40e04d
mov eax, dword [0x5391d4]
call fcn.004030ac
call fcn.00402930
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a818
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40e094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40e083
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x539170]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x53a718]
call fcn.004067f4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret