joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60012f46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, dword [0x357665c]
push edi
mov edi, dword [esi]
lea eax, [esp + 0x10]
push eax
push 0x10
lea ebx, [edi + esi]
push ebx
call fcn.600116b8
lea eax, [esp + 0x20]
push eax
push 8
add ebx, 0x10
push ebx
call fcn.600116b8
xor eax, eax
mov cl, byte [esp + eax + 0x20]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x10
jl 0x60012f7c
mov eax, dword [esi + 0x10]
test eax, eax
jbe 0x60012fb4
lea ecx, [esp + 0x10]
sub edi, ecx
lea ecx, [edi + esi + 0x18]
mov edx, eax
xor edi, edi
lea eax, [esp + edi + 0x10]
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc edi
cmp edi, 0x10
jl 0x60012f9f
add ecx, 0x10
dec edx
jne 0x60012f9d
lea eax, [esp + 0x20]
push eax
push dword [esi + 0x18]
mov eax, dword [esi + 0x14]
add eax, esi
push eax
call fcn.600116b8
xor eax, eax
mov cl, byte [esp + eax + 0x20]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x10
jl 0x60012fc9
mov eax, dword [esi + 8]
test eax, eax
je 0x60012ffe
lea ecx, [esp + 0x20]
push ecx
push dword [esi + 0xc]
add eax, esi
push eax
call fcn.600116b8
xor eax, eax
mov cl, byte [esp + eax + 0x20]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x10
jl 0x60012ff0
lea eax, [esp + 0x20]
push eax
push 0x1c
push esi
call fcn.600116b8
xor eax, eax
mov cl, byte [esp + eax + 0x20]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x10
jl 0x6001300d
mov edi, dword [ebp + 8]
lea esi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x600145ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov cl, byte [eax]
and dword [esp + 0x14], 0
push esi
xor esi, esi
and dword [esp + 8], esi
mov byte [ebx], cl
lea ecx, [ebx + 1]
inc eax
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
call fcn.600145a6
test eax, eax
je 0x6001474a
call fcn.600145a6
test eax, eax
je 0x600146b4
call fcn.600145a6
test eax, eax
je 0x60014670
push 4
xor esi, esi
pop edi
lea ecx, [esp + 0x10]
call fcn.600145a6
dec edi
lea esi, [eax + esi*2]
jne 0x60014641
mov eax, dword [esp + 0x14]
test esi, esi
je 0x60014664
mov ecx, dword [esp + 0x14]
sub eax, esi
mov al, byte [eax]
mov byte [ecx], al
jmp 0x60014667
mov byte [eax], 0
inc dword [esp + 0x14]
jmp 0x6001475e
mov eax, dword [esp + 0x10]
movzx esi, byte [eax]
inc dword [esp + 0x10]
xor ecx, ecx
inc ecx
mov eax, esi
and eax, ecx
inc eax
inc eax
shr esi, 1
je 0x600146ab
test eax, eax
je 0x60014741
mov ecx, dword [esp + 0x14]
sub ecx, esi
mov edi, dword [esp + 0x14]
mov dl, byte [ecx]
inc dword [esp + 0x14]
inc ecx
dec eax
mov byte [edi], dl
jne 0x60014696
jmp 0x60014741
mov dword [esp + 0xc], ecx
jmp 0x60014741
call fcn.600145d6
test esi, esi
jne 0x600146ee
cmp eax, 2
jne 0x600146e9
lea ecx, [esp + 0x10]
call fcn.600145d6
test eax, eax
je 0x60014745
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 8]
mov esi, dword [esp + 0x14]
mov dl, byte [ecx]
inc dword [esp + 0x14]
inc ecx
dec eax
mov byte [esi], dl
jne 0x600146d7
jmp 0x60014745
sub eax, 3
jmp 0x600146f0
dec eax
dec eax
mov ecx, dword [esp + 0x10]
movzx ecx, byte [ecx]
shl eax, 8
add eax, ecx
inc dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.600145d6
cmp esi, 0x7d00
jb 0x60014714
inc eax
cmp esi, 0x500
jb 0x6001471d
inc eax
cmp esi, 0x80
jae 0x60014727
inc eax
inc eax
test eax, eax
je 0x60014741
mov ecx, dword [esp + 0x14]
sub ecx, esi
mov edi, dword [esp + 0x14]
mov dl, byte [ecx]
inc dword [esp + 0x14]
inc ecx
dec eax
mov byte [edi], dl
jne 0x60014731
mov dword [esp + 8], esi
xor esi, esi
inc esi
jmp 0x60014760
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov al, byte [eax]
inc dword [esp + 0x14]
inc dword [esp + 0x10]
mov byte [ecx], al
xor esi, esi
cmp dword [esp + 0xc], 0
je 0x60014615
mov eax, dword [esp + 0x14]
pop edi
sub eax, ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x14f26ed7
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x513d136e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40d2d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425e00
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x431024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp + 8]
movzx eax, word [ecx]
xor edi, edi
cmp ax, dx
je 0x40d31b
inc edi
cmp word [ecx + edi*2], dx
jne 0x40d314
cmp edi, 1
movzx eax, ax
mov dword [ebp - 0x10], eax
jl 0x40d462
cmp ax, 0x5c
je 0x40d462
cmp ax, 0x2e
jne 0x40d352
cmp edi, 1
je 0x40d462
cmp edi, 2
jne 0x40d352
cmp word [ecx + 2], ax
je 0x40d462
mov ebx, 4
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
call fcn.00403070
cmp edi, 3
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
jle 0x40d39d
cmp word [edi + 2], 0x3a
jne 0x40d39d
cmp word [edi + 4], 0x5c
jne 0x40d39d
mov eax, dword [ebp - 0x10]
cmp ax, 0x61
jb 0x40d394
cmp ax, 0x7a
jbe 0x40d3ff
add eax, 0xffffffbf
cmp ax, 0x19
jbe 0x40d3ff
mov eax, dword [ebp - 0x14]
cmp eax, 0x105
jg 0x40d3bb
cmp eax, 0x106
je 0x40d3bb
mov ebx, 0x106
lea esi, [ebp - 0x1c]
call fcn.00403070
mov edx, dword [ebp - 0x1c]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [ebp - 0x1c]
mov ebx, eax
call fcn.0040d880
test ebx, ebx
je 0x40d478
cmp ebx, 0x104
ja 0x40d478
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x40d3ff
push 0x5c
mov eax, esi
call fcn.0040bd00
push 0x42a040
lea eax, [ebp - 0x40]
call fcn.00402c50
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea edx, [ebp - 0x34]
push edx
mov byte [ebp - 4], 1
call fcn.0040d8b0
push edi
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.0040d950
mov edi, eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0040bcb0
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0040c4b0
mov edx, dword [ebp - 0x34]
push edx
call fcn.0040c4b0
mov eax, dword [ebp - 0x40]
push eax
call fcn.0040c4b0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0040c4b0
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0040c4b0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40d5d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ecx]
push esi
lea eax, [ebp - 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d5fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d5fa
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push 1
push 0
push 0
push eax
call fcn.004229d0
xor ecx, ecx
add eax, esi
adc edx, ecx
mov dword [edi], eax
mov dword [edi + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d4c2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431024]
jne 0x41d4cc
repz ret
jmp fcn.0041e29a

Function at 0x42197c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041ea4f
and dword [ebp - 4], 0
cmp dword [0x4338d4], 0
mov ebx, eax
jne 0x421a2d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421ade
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421ade
push eax
call fcn.0041e9dd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4338d4], eax
call esi
push eax
call fcn.0041e9dd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4338d8], eax
call esi
push eax
call fcn.0041e9dd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4338dc], eax
call esi
push eax
call fcn.0041e9dd
pop ecx
mov dword [0x4338e4], eax
test eax, eax
je 0x421a2d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e9dd
pop ecx
mov dword [0x4338e0], eax
mov eax, dword [0x4338e0]
cmp eax, ebx
je 0x421a85
cmp dword [0x4338e4], ebx
je 0x421a85
push eax
call fcn.0041ea58
push dword [0x4338e4]
mov esi, eax
call fcn.0041ea58
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421a85
test edi, edi
je 0x421a85
call esi
test eax, eax
je 0x421a7c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x421a7c
test byte [ebp - 0xc], 1
jne 0x421a85
or dword [ebp + 0x10], 0x200000
jmp 0x421abe
mov eax, dword [0x4338d8]
cmp eax, ebx
je 0x421abe
push eax
call fcn.0041ea58
pop ecx
test eax, eax
je 0x421abe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421abe
mov eax, dword [0x4338dc]
cmp eax, ebx
je 0x421abe
push eax
call fcn.0041ea58
pop ecx
test eax, eax
je 0x421abe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4338d4]
call fcn.0041ea58
pop ecx
test eax, eax
je 0x421ade
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421ae0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x20be254b
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x450a635d
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4b4d3c21
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x5a65005c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4521d7]
shl eax, 2
mov dword [0x4521db], eax
push edi
push ecx
xor eax, eax
mov edi, 0x45b168
mov ecx, 0x45f5f4
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00445624
pop ecx
push 0x4521a0
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4521df], eax
push 0
jmp fcn.00450944
Function at 0x403c8c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
mov dword [ebx + 0x14], esi
cmp esi, 0xffffffff
jne 0x403cbd
xor eax, eax
jmp 0x403ccd
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
mov dword [ebx + 0x10], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x403d94
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push 0
push edx
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [eax + 0xc]
push edx
mov eax, dword [eax + 0x14]
push eax
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x404294
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x4536c4
call fcn.0044938c
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 8]
mov dword [edx], fcn.00404334
mov eax, dword [ebp + 8]
add eax, 0xc
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x10
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x14
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x18
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0x1c
xor edx, edx
mov dword [eax], edx
inc dword [ebp - 8]
call sub.KERNEL32.dll_GetOEMCP
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
call sub.KERNEL32.dll_GetUserDefaultLangID
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004043dc
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004046a4
pop ecx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x405508
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
lea ecx, [ebp - 4]
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
push eax
push edx
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebx + 0xc]
push edx
call sub.ADVAPI32.dll_RegQueryValueExA
mov esi, eax
mov dword [ebx + 0x10], esi
test esi, esi
jne 0x40554a
mov eax, dword [ebp - 0xc]
jmp 0x40554c
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405554
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
mov eax, 0x453eb8
push ebx
push esi
push edi
lea edi, [ebp - 0x30]
mov ebx, dword [ebp + 0xc]
call fcn.0044938c
mov word [edi + 0x10], 8
xor edx, edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], edx
lea eax, [ebp - 0x13c]
inc dword [edi + 0x1c]
lea edx, [ebp - 0x34]
mov word [edi + 0x10], 0x14
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], 0x104
push ecx
push eax
push edx
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebx + 0xc]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
mov esi, eax
mov dword [ebx + 0x10], esi
test esi, esi
jne 0x4055ed
mov word [edi + 0x10], 0x20
lea edx, [ebp - 0x13c]
lea eax, [ebp - 8]
call fcn.00424cc4
inc dword [edi + 0x1c]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00424f53
dec dword [edi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00424f24
jmp 0x40561e
mov word [edi + 0x10], 0x2c
mov edx, 0x45425f
lea eax, [ebp - 0xc]
call fcn.00424cc4
inc dword [edi + 0x1c]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00424f53
dec dword [edi + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00424f24
mov word [edi + 0x10], 0x38
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00424f53
mov eax, dword [ebp + 8]
mov edx, 2
mov word [edi + 0x10], 0x44
push eax
lea eax, [ebp - 4]
dec dword [edi + 0x1c]
call fcn.00424f24
pop eax
mov word [edi + 0x10], 0x38
inc dword [edi + 0x1c]
mov edx, dword [edi]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405664
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.ADVAPI32.dll_RegQueryValueExA
mov dword [ebx + 0x10], eax
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4056a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, 0x453f18
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0044938c
mov dword [ebp - 8], 1
lea edx, [ebp + 0x10]
lea eax, [ebp + 0x10]
call fcn.00424cfb
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
cmp dword [ebp + 0x10], 0
je 0x4056df
mov edx, dword [ebp + 0x10]
jmp 0x4056e4
mov edx, 0x454260
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
lea esi, [ebp - 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0042517e
push eax
lea edx, [ebp - 0x124]
push edx
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebx + 0xc]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
mov dword [ebx + 0x10], eax
dec dword [ebp - 8]
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00424f24
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405980
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
call sub.KERNEL32.dll_GetVersion
mov dword [ebx + 0x38], eax
xor eax, eax
mov al, byte [ebx + 0x38]
mov dword [ebx + 4], eax
movzx edx, word [ebx + 0x38]
sar edx, 8
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov dword [ebx + 8], ecx
mov eax, dword [ebx + 0x38]
cmp eax, 0x80000000
jae 0x4059c1
shr eax, 0x10
and ax, 0xffff
movzx edx, ax
mov dword [ebx + 0xc], edx
jmp 0x4059e4
cmp dword [ebx + 4], 4
jae 0x4059df
mov ecx, dword [ebx + 0x38]
shr ecx, 0x10
and cx, 0xffff
movzx eax, cx
and eax, 0xffff7fff
mov dword [ebx + 0xc], eax
jmp 0x4059e4
xor edx, edx
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0xc], 0
jne 0x405a1f
xor ecx, ecx
mov dword [ebx + 0x14], ecx
cmp dword [ebx + 4], 4
jne 0x405a67
cmp dword [ebx + 8], 0x5a
jb 0x405a05
mov dword [ebx + 0x10], 4
pop ebx
pop ebp
ret
cmp dword [ebx + 8], 0xa
jb 0x405a15
mov dword [ebx + 0x10], 3
pop ebx
pop ebp
ret
mov dword [ebx + 0x10], 2
pop ebx
pop ebp
ret
mov dword [ebx + 0x14], 1
cmp dword [ebx + 4], 4
jne 0x405a36
mov dword [ebx + 0x10], 5
pop ebx
pop ebp
ret
cmp dword [ebx + 4], 5
jne 0x405a4c
cmp dword [ebx + 8], 0
jne 0x405a4c
mov dword [ebx + 0x10], 6
pop ebx
pop ebp
ret
cmp dword [ebx + 4], 5
jne 0x405a62
cmp dword [ebx + 8], 1
jne 0x405a62
mov dword [ebx + 0x10], 7
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx + 0x10], eax
pop ebx
pop ebp
ret