joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001740
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1001ca64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 4]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_1
lea ebp, [esi + 8]
mov dword [esp + 0x20], 0
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_1
lea ebx, [esi + 0xc]
mov byte [esp + 0x20], 1
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x14]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x18]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x1c]
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x20]
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x24]
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esi + 0x2c]
mov byte [esp + 0x20], 9
call sub.MFC42.DLL_CString::CString_1
push 0xe0
mov byte [esp + 0x24], 0xa
mov dword [esi], sym.EoRss.dll_const_CCfgRss::vftable
mov dword [esi + 0x30], 0
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov byte [esp + 0x20], 0xb
je 0x1000182a
mov ecx, eax
call fcn.10018de0
jmp 0x1000182c
xor eax, eax
push 0x1002d5d0
mov ecx, edi
mov byte [esp + 0x24], 0xa
mov dword [esi + 0x40], eax
mov dword [esi + 0x34], 0
call sub.MFC42.DLL_CString::operator_1
push 0x1002d5d0
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
push 0x1002d5d0
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_1
push 0x1002d5d0
lea ecx, [esi + 0x10]
call sub.MFC42.DLL_CString::operator_1
push 0x1002d5d0
lea ecx, [esi + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0x1002d5d0
lea ecx, [esi + 0x18]
call sub.MFC42.DLL_CString::operator_1
push str.Chaque_2_heures
lea ecx, [esi + 0x1c]
call sub.MFC42.DLL_CString::operator_1
push 0x1002d5d0
lea ecx, [esi + 0x20]
call sub.MFC42.DLL_CString::operator_1
push 0x1002d5d0
lea ecx, [esi + 0x24]
call sub.MFC42.DLL_CString::operator_1
push str.enable
lea ecx, [esi + 0x28]
call sub.MFC42.DLL_CString::operator_1
push str.proposed
lea ecx, [esi + 0x2c]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x3c], 2
mov dword [esi + 0x38], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10003250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1001d019
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [sym.imp.EoRezoImg_17.dll_protected:_void___thiscall_CDlgAlphaLayer::ModifyAspect_unsigned_char_]
mov esi, ecx
push 0
call edi
mov ecx, esi
call sym.EoRss.dll_public:_void___thiscall_CDlgAppEoRss::LoadData_void_
mov ecx, esi
call sym.EoRss.dll_public:_void___thiscall_CDlgAppEoRss::BuildPNGEmpty_void_
push 0
mov ecx, esi
call edi
mov ecx, esi
call sym.EoRss.dll_public:_void___thiscall_CDlgAppEoRss::LoadData_void_
mov ecx, esi
call sym.EoRss.dll_public:_void___thiscall_CDlgAppEoRss::SetTimerAppear_void_
lea ecx, [esp + 0x10]
call dword [sym.imp.EoRezoTools_17.dll_public:_void___thiscall_CRegistry::constructor_void_]
push str.EoRezo
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.1001be24
push 0x1002c1f8
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.1001be24
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
push str.Software_
push ecx
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_operator_2
push 0x1002c7c8
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x38], 4
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push str.View
push eax
lea eax, [esp + 0x1c]
push SysReAllocString
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 5
call dword [sym.imp.EoRezoTools_17.dll_public:_class_CString___thiscall_CRegistry::ReadStringKey_struct_HKEY_____char_const___char_const__]
push eax
lea ecx, [esi + 0x13c]
mov byte [esp + 0x30], 6
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
mov ecx, esi
call sym.EoRss.dll_public:_void___thiscall_CDlgAppEoRss::PrepareListNews_void_
mov ecx, esi
call dword [sym.imp.EoRezoImg_17.dll_public_virtual:_int___thiscall_CDlgAlphaLayer::OnInitDialog_void_]
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.EoRezoTools_17.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x10004a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001d210
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [ecx + 0x20]
push ebx
push esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
sub edx, str.Bold
xor ebx, ebx
neg ecx
neg edx
sbb edx, edx
mov esi, eax
mov eax, dword [esp + 0x68]
and edx, 0xfffffed4
add edx, 0x2bc
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x20], edx
cmp eax, ebx
lea edx, [esp + 0x2c]
setne al
push ecx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x100219b4
lea eax, [esp + 0x10]
mov dword [esp + 0x54], ebx
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::Attach
mov edx, dword [esi]
lea eax, [esp + 8]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov dword [esp + 8], 0x100218ec
lea ecx, [esp + 8]
mov dword [esp + 0x54], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x4c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0x10
Function at 0x10008400
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get program files directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001d68c
push eax
mov dword fs:[0], esp
sub esp, 0x168
push esi
mov esi, ecx
mov eax, dword [esi + 0x158]
mov dword [esi + 0x100], 0
test eax, eax
mov dword [esi + 0x14c], 1
je 0x1000854d
push edi
push str.true
lea ecx, [eax + 0x40]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esi + 0x158]
lea eax, [esp + 0x10]
push eax
call sym.EoRss.dll_public:_class_CString___thiscall_CCfgRss::GetState_void_
push eax
lea ecx, [esp + 0x18]
push 0x1002ca4c
push ecx
mov dword [esp + 0x184], 0
call sub.MFC42.DLL_operator_2
push sym.EoRss.dll____C__01HMO___CC__AA_
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x184], 1
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x178], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x178], 3
call sub.MFC42.DLL_CString::CString
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
push 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x70]
push 0x26
push eax
push 0
mov dword [esp + 0x38], 0x44
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x6c]
lea edx, [esp + 8]
push ecx
push str._sInternet_Exploreriexplore.exe
push edx
mov byte [esp + 0x184], 5
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x18]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 8]
mov byte [esp + 0x178], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x178], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov ecx, dword [esp + 0x16c]
pop esi
mov dword fs:[0], ecx
add esp, 0x174
ret
Function at 0x1000de00
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, ecx
push ebp
xor ebp, ebp
mov eax, dword [ebx + 0x128]
push edi
mov edi, dword [ebx + 0x120]
test eax, eax
jle 0x1000de5d
push esi
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 8]
test esi, esi
je 0x1000de4b
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x1000de3b
push esi
mov ecx, ebx
call fcn.1000f000
mov ecx, esi
call fcn.10015840
jmp 0x1000de4b
mov esi, dword [esi + 0x2c]
test esi, esi
je 0x1000de4b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebx + 0x128]
inc ebp
cmp ebp, eax
jl 0x1000de18
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x1000f890
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001e67a
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0xb0]
test ebx, ebx
je 0x1000f98b
push ebp
push edi
lea ecx, [esp + 0x20]
call dword [sym.imp.EoRezoTools_17.dll_public:_void___thiscall_CTools::constructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString_1
mov edi, dword [ebx + 8]
mov byte [esp + 0x38], 1
test edi, edi
je 0x1000f95f
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call sym.EoRss.dll_public:_class_CString___thiscall_CCfgRss::GetId_void_
mov ebp, eax
lea ecx, [esp + 0x18]
push 0
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 2
call dword [sym.imp.EoRezoTools_17.dll_public:_class_CString___thiscall_CTools::GetAppDataDir_int_]
mov edx, dword [ebp]
mov ecx, dword [esi + 0x144]
push edx
mov edx, ecx
push ecx
mov ecx, dword [esi + 0x140]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x24]
push str._s_s_s_s__s.cfg
push eax
mov byte [esp + 0x54], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x1c
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0x40]
push edx
call fcn.1001a190
mov ebx, dword [ebx]
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.EoRezoTools_17.dll_public_virtual:_void___thiscall_CTools::destructor_void_]
test ebx, ebx
jne 0x1000f8bc
pop edi
pop ebp
lea ecx, [esp + 0x20]
call dword [sym.imp.EoRezoTools_17.dll_public:_void___thiscall_CTools::constructor_void_]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x14]
mov bl, 5
push 0
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x38], bl
call dword [sym.imp.EoRezoTools_17.dll_public:_class_CString___thiscall_CTools::GetAppDataDir_int_]
mov ecx, dword [esi + 0x144]
mov byte [esp + 0x30], 6
mov edx, ecx
push ecx
mov ecx, dword [esi + 0x140]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._s_s_s_s.cfg
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
push ecx
lea ecx, [esi + 0x40]
call sym.EoRss.dll_public:_int___thiscall_CXmlEoRss::Build_char_const__
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.EoRezoTools_17.dll_public_virtual:_void___thiscall_CTools::destructor_void_]
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x100115b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1001eb48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebp
mov ebp, ecx
push edi
push 0xa
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CStringList::CStringList
mov eax, dword [ebp + 0xe8]
xor edi, edi
mov dword [esp + 0x70], edi
mov eax, dword [eax + 0x70]
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x10011702
push ebx
push esi
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx + 8]
cmp esi, edi
je 0x100116ee
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call sym.EoRss.dll_public:_class_CString___thiscall_CCfgRss::GetCategory_void_
mov eax, dword [esp + 0x10]
mov byte [esp + 0x78], 1
cmp dword [eax - 8], edi
je 0x100116e0
cmp dword [esi + 0x34], edi
je 0x100116e0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call sym.EoRss.dll_public:_class_CString___thiscall_CCfgRss::GetMode_void_
mov eax, dword [eax]
push str.personal
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x100116e0
mov edx, dword [esp + 0x10]
push edi
push edx
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CStringList::Find
cmp eax, edi
jne 0x100116e0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call sub.MFC42.DLL_CString::CString_2
push edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x7c], 2
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], 0x23
call sub.MFC42.DLL_CString::GetBuffer
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x58], eax
call sub.MFC42.DLL_CString::ReleaseBuffer
mov edx, dword [ebp + 0xb0]
lea ecx, [esp + 0x3c]
push ecx
push edi
push 0x1100
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
call sub.MFC42.DLL_CStringList::AddTail
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x78], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x100115f4
pop esi
pop ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x70], 0xffffffff
call fcn.1001c094
mov ecx, dword [esp + 0x68]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x1001b180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10020208
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
test ebp, ebp
push edi
mov esi, ecx
je 0x1001b305
mov edi, dword [esi + 0x6c]
mov dword [esp + 0x3c], 0
test edi, edi
je 0x1001b305
mov ebx, dword [edi + 8]
mov dword [esp + 0x14], 0
test ebx, ebx
je 0x1001b2fb
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.100061f0
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call fcn.1001ac90
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x1c], ecx
call sub.MFC42.DLL_CTime::GetTickCount
mov eax, dword [eax]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ecx
mov dword [ecx], eax
lea eax, [ebp + ebp*2]
mov ecx, esp
mov dword [esp + 0x24], esp
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
push eax
call fcn.1001b320
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x24]
call fcn.1001b330
mov ecx, eax
call fcn.1001b350
test eax, eax
je 0x1001b2d1
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
cmp edi, dword [esi + 0x6c]
jne 0x1001b266
mov eax, dword [edi]
mov dword [esi + 0x6c], eax
jmp 0x1001b26d
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov dword [ecx], edx
cmp edi, dword [esi + 0x70]
jne 0x1001b27a
mov eax, dword [edi + 4]
mov dword [esi + 0x70], eax
jmp 0x1001b282
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [ecx + 4], edx
mov eax, dword [esi + 0x78]
mov dword [edi], eax
mov eax, dword [esi + 0x74]
dec eax
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], eax
jne 0x1001b2bb
mov eax, dword [esi + 0x6c]
xor ebx, ebx
cmp eax, ebx
je 0x1001b2a2
mov eax, dword [eax]
cmp eax, ebx
jne 0x1001b29c
mov ecx, dword [esi + 0x7c]
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
call sub.MFC42.DLL_CPlex::FreeDataChain
mov dword [esi + 0x7c], ebx
jmp 0x1001b2bd
xor ebx, ebx
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x1001b2c9
mov edi, eax
jmp 0x1001b2d1
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001b2fb
mov edi, dword [esi + 0x6c]
mov dword [esp + 0x3c], 0
jmp 0x1001b2fd
mov edi, dword [edi]
test edi, edi
jne 0x1001b1bd
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 4
Function at 0x40361c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x469020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403694
xor eax, eax
push ebp
push 0x40368d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403694
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x469020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x469020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404378
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46b048], 0
je 0x4043d9
cmp word [0x46b21c], 0xd7b2
jne 0x4043a1
cmp dword [0x46b224], 0
jbe 0x4043a1
mov eax, 0x46b218
call dword [0x46b234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x469070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404400
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x469030], 0
jne 0x4043f5
push 0
push 0x469068
push 0x469070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4060a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40610a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404764
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403084
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4060f4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406111
lea eax, [ebp - 0x10]
call fcn.004044f4
ret

Function at 0x40b23c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b275
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004045e4
jmp 0x40b27e
mov eax, ebx
mov edx, esi
call fcn.00404548
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b288
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b2a9
mov al, byte [esp]
jmp 0x40b2ab
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b930
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b7a8
mov eax, dword [0x46a98c]
cmp byte [eax], 0
je 0x40b9ac
mov eax, dword [0x46a7a0]
call fcn.00402d14
call fcn.00402864
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408a84
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b9f4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b9e2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46a74c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46b664]
call fcn.004055b8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret