joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf12c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bf296
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d9210]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x4d9210]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0047ecd8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00446d48
xor edx, edx
push ebp
push 0x4bf279
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4bf1e9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00406844
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.004bd294
push eax
mov eax, dword [0x4d8fac]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x4bf1df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004044a8
jmp 0x4bf280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf225
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00446928
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004befbc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x4bf201
push 0
mov edx, 0x4bef54
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004464e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf280
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00446d94
mov eax, dword [0x4d9210]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.0047ecd8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf29d
lea eax, [ebp - 0x10]
call fcn.00406844
ret

Function at 0x4c6144
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x4c6104
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4cc6b8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404f10
xor eax, eax
push ebp
push 0x4cc81e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.00404a60
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.00404f20
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4cc800
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x28], 0x400
mov eax, dword [ebp - 0x28]
call fcn.00402830
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4cc7ef
mov dword [ebp - 0x28], 0x400
cmp byte [ebp + 8], 0
je 0x4cc76d
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 0x18], eax
jmp 0x4cc78d
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegEnumValueA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4cc7e5
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
call fcn.004050ac
lea eax, [ebp - 0x1c]
call fcn.00404f78
mov edx, eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.00402a2c
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x4cc7c8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
call fcn.00404ab4
jmp 0x4cc7e2
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x4cc838
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00404de0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0
je 0x4cc73e
mov eax, dword [ebp - 0x24]
call fcn.00402850
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc825
lea eax, [ebp - 0x1c]
call fcn.00404a60
lea eax, [ebp - 8]
call fcn.00404a60
ret
Function at 0x401600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
mov esi, dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
cmp word [esi], ax
jne 0x401634
xor ecx, ecx
jmp 0x40164f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401640
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.00401720
push ecx
lea edx, [esp + 0x24]
lea ecx, [esp + 0xc]
call fcn.004013c0
add esp, 4
mov ecx, eax
call fcn.00401480
movzx esi, al
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
jb 0x4016ad
mov ecx, dword [esp + 8]
inc eax
cmp eax, 0x1000
jb 0x4016a4
test cl, 0x1f
jne 0x4016df
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4016e4
sub ecx, eax
cmp ecx, 4
jb 0x4016e9
cmp ecx, 0x23
ja 0x4016ee
mov ecx, eax
push ecx
call fcn.004028c0
add esp, 4
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
cmp ecx, 8
jb 0x4016d6
inc ecx
push ecx
push dword [esp + 0x24]
call fcn.00401ad0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00405906
call fcn.00405906
call fcn.00405906
call fcn.00405906
int3
Function at 0x40356a
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x4d99f8], 0x594
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jne 0x4035a4
push 0x402cd4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x429418]
mov edi, dword [0x42941c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x28], 0x9e3779b9
call fcn.00403563
mov eax, dword [0x429420]
add dword [ebp - 8], 0x23f
mov ebx, dword [0x429424]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl ecx, 4
cmp dword [0x4d99f8], 0xc
mov dword [ebp - 4], ecx
jne 0x403648
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc44]
push eax
push esi
push 0x402cf4
push 0x402d20
push 0x402d44
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
add dword [ebp - 4], ecx
mov ecx, dword [0x4d99f8]
cmp ecx, 0xfa9
jne 0x403666
mov dword [0x4d8f94], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x403674
mov dword [0x4d8944], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0x4d8f90], 0xf4ea3dee
add eax, ebx
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x4d99f8], 0x213
mov dword [ebp - 0x18], ecx
jne 0x4036b3
push esi
push 0x402d78
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], 0x64
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x10], 0x64
cmp dword [0x4d99f8], 0xc
jne 0x4036e6
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0x444]
push eax
push 0x402db8
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, edi
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
dec dword [ebp - 0x1c]
jne 0x4035e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x403734
Capabilities:
Create pipe
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4d99f8]
mov ecx, dword [0x4d8948]
sub esp, 0x42c
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x403828
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x4d99f8], 0x959
jne 0x403814
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402dc8
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x402e2c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402e40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.0040356a
add ebx, 8
dec dword [ebp - 4]
jne 0x40375d
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4038fa
Capabilities:
Get common file path

Disassembly:
mov eax, 0x426574
call fcn.00426478
mov eax, 0x1428
call fcn.0040f540
push ebx
push esi
xor esi, esi
cmp dword [0x4d99f8], 0x5b1
push edi
jne 0x4039a6
push esi
lea eax, [ebp - 0x434]
push eax
push esi
push 0x402ed8
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
lea eax, [ebp - 0x34]
call fcn.00403c07
mov dword [ebp - 4], esi
call fcn.004047aa
push 0x402f04
lea ecx, [ebp - 0x18]
call fcn.00403390
lea ecx, [ebp - 0x18]
call fcn.004033ac
lea ecx, [ebp - 0x18]
call fcn.004033f2
lea ecx, [ebp - 0x18]
call fcn.0040340b
push esi
push esi
call fcn.00404d0c
push esi
call fcn.00404cdd
push esi
call fcn.00404cc6
push esi
call fcn.00404ebe
add esp, 0x10
mov dword [esp], esi
call fcn.00403544
fstp st(0)
push esi
call fcn.00404cc6
pop ecx
call fcn.00404dd8
add dword [0x4d99f8], 0x1134b
push dword [0x4d99f8]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4d8948], eax
call fcn.00403845
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x4039ef
inc edi
cmp edi, 0x4f6a4
jl 0x4039cf
mov eax, dword [0x4d99f8]
xor ecx, ecx
cmp eax, esi
jbe 0x403a15
mov edx, dword [0x4d99fc]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x4d8948]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x4039fa
xor edi, edi
lea ecx, [eax + edi]
cmp ecx, 0xe
jne 0x403a64
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [ebp - 0x434]
push eax
push esi
push 0x402f14
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402f2c
push 0x402f48
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
mov eax, dword [0x4d99f8]
inc edi
cmp edi, 0x39621
jl 0x403a17
call fcn.00403734
xor edi, edi
call ebx
cmp edi, 0x26
jne 0x403a80
call fcn.0040382b
inc edi
cmp edi, 0x6753f
jl 0x403a74
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x7b
pop ebx
cmp dword [0x4d99f8], 0x86
jne 0x403adb
push 0x402f50
push 0x402f90
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push esi
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [0x4d99f8], 0xf
jne 0x403afc
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0x402fd8
push 0x40301c
call edi
dec ebx
jne 0x403a92
push 0x403054
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4055bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42855c]
jne 0x4055c5
repz ret
jmp fcn.00409dfc
Function at 0x40d58f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407a6c
and dword [ebp - 4], 0
cmp dword [0x42a56c], 0
mov ebx, eax
jne 0x40d640
push 0x402c3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d6f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c30
push edi
call esi
test eax, eax
je 0x40d6f1
push eax
call fcn.004079fa
mov dword [esp], 0x402c20
push edi
mov dword [0x42a56c], eax
call esi
push eax
call fcn.004079fa
mov dword [esp], 0x402c0c
push edi
mov dword [0x42a570], eax
call esi
push eax
call fcn.004079fa
mov dword [esp], 0x402bf0
push edi
mov dword [0x42a574], eax
call esi
push eax
call fcn.004079fa
pop ecx
mov dword [0x42a57c], eax
test eax, eax
je 0x40d640
push 0x402bd8
push edi
call esi
push eax
call fcn.004079fa
pop ecx
mov dword [0x42a578], eax
mov eax, dword [0x42a578]
cmp eax, ebx
je 0x40d698
cmp dword [0x42a57c], ebx
je 0x40d698
push eax
call fcn.00407a75
push dword [0x42a57c]
mov esi, eax
call fcn.00407a75
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d698
test edi, edi
je 0x40d698
call esi
test eax, eax
je 0x40d68f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d68f
test byte [ebp - 0xc], 1
jne 0x40d698
or dword [ebp + 0x10], 0x200000
jmp 0x40d6d1
mov eax, dword [0x42a570]
cmp eax, ebx
je 0x40d6d1
push eax
call fcn.00407a75
pop ecx
test eax, eax
je 0x40d6d1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d6d1
mov eax, dword [0x42a574]
cmp eax, ebx
je 0x40d6d1
push eax
call fcn.00407a75
pop ecx
test eax, eax
je 0x40d6d1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42a56c]
call fcn.00407a75
pop ecx
test eax, eax
je 0x40d6f1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d6f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a54
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040408c
test esi, esi
jne 0x402a8a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040417c
jmp 0x402aa8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402908
mov edi, eax
test esi, esi
je 0x402aa8
cmp dword [ebx], 0
je 0x402aa8
dec esi
jmp 0x402a91
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45b020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031a8
xor eax, eax
push ebp
push 0x4031a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45b020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45b020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e8c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45d048], 0
je 0x403eed
cmp word [0x45d21c], 0xd7b2
jne 0x403eb5
cmp dword [0x45d224], 0
jbe 0x403eb5
mov eax, 0x45d218
call dword [0x45d234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45b06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f14
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45b030], 0
jne 0x403f09
push 0
push 0x45b064
push 0x45b06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026cc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x45d049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404008
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405348
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405578
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4053cb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405578
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4053cb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405594
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405454
xor eax, eax
push ebp
push 0x40544d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405190
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405432
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4055b4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405432
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405454
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40556e
cmp byte [ebp - 0xd], 0
jne 0x40549b
cmp byte [ebp - 0x12], 0
je 0x40556e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4054b4
dec ebx
cmp byte [ebx], 0x2e
je 0x4054c3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4054b3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40556e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405500
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40556e
cmp byte [ebp - 0xd], 0
je 0x40556e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40556e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405c40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405ca6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042fc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402cf4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405c90
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405cad
lea eax, [ebp - 0x10]
call fcn.0040408c
ret

Function at 0x40af24
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40af5d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040417c
jmp 0x40af66
mov eax, ebx
mov edx, esi
call fcn.004040e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40af70
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40af91
mov al, byte [esp]
jmp 0x40af93
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b618
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b490
mov eax, dword [0x45c128]
cmp byte [eax], 0
je 0x40b694
mov eax, dword [0x45bf18]
call fcn.00402b60
call fcn.00402834
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408798
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b6dc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b6ca
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x45bec8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45d664]
call fcn.00405154
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret