joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x413020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030d8
xor eax, eax
push ebp
push 0x4030d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403114
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x413020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x413020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403bb0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x414044], 0
je 0x403c11
cmp word [0x414218], 0xd7b2
jne 0x403bd9
cmp dword [0x414220], 0
jbe 0x403bd9
mov eax, 0x414214
call dword [0x414230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x413068
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403c38
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41302c], 0
jne 0x403c2d
push 0
push 0x413060
push 0x413068
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405770
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4057d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403fa4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c54
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4057c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4057dd
lea eax, [ebp - 0x10]
call fcn.00403d34
ret

Function at 0x409a7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409ab5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403e24
jmp 0x409abe
mov eax, ebx
mov edx, esi
call fcn.00403d88
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409ac8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409ae9
mov al, byte [esp]
jmp 0x409aeb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a180
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409fe8
mov eax, dword [0x413508]
cmp byte [eax], 0
je 0x40a1fc
mov eax, dword [0x41342c]
call fcn.00402bd0
call fcn.00402a98
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407394
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a244
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a232
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x413408]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.00404c18
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40af44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40afa8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403fa4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406f48
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40afaf
lea eax, [ebp - 0xc]
call fcn.00403d34
ret

Function at 0x4127a8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
xor eax, eax
push ebp
push 0x41283f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0xff]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0xff]
mov ecx, 0xff
call fcn.00403fa4
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.00406d70
cmp dword [ebp - 0x104], 0
jne 0x412821
push 0
push 0
push 0x10
mov eax, dword [ebp + 0xc]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412846
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00403d58
ret
Function at 0x4013e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x308
cmp byte [0x406460], 0
push esi
mov esi, dword [esp + 0x310]
jne 0x401400
push esi
call fcn.00401180
add esp, 4
push 0x4050fc
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401455
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push 0x40510c
call fcn.00401d60
add esp, 8
test eax, eax
jne 0x401500
push str.Could_not_load_python_dll
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
add esp, 8
xor eax, eax
pop esi
add esp, 0x308
ret
lea eax, [esp + 4]
push eax
mov eax, 0x405e20
call fcn.00401350
mov esi, eax
add esp, 4
test esi, esi
je 0x4014a4
push edi
push 0xb
push 0x405138
push esi
xor edi, edi
call dword [sym.imp.MSVCR90.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x401498
lea ecx, [esi + 0xf]
push ecx
push 0x405144
call fcn.00401d60
add esp, 8
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
pop edi
jne 0x401500
push str.PYTHON26.DLL
push 0x406460
push 0x405164
lea edx, [esp + 0x14]
push 0x304
push edx
call dword [sym.imp.MSVCR90.dll__snprintf]
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401d60
add esp, 0x1c
test eax, eax
jne 0x401500
push str.LoadLibrary_pythondll__failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call section..text
lea ecx, [esp + 0x10]
push ecx
push 0
call section..text
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x308
ret
mov eax, 1
pop esi
add esp, 0x308
ret

Function at 0x401540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x304
push esi
mov esi, dword [esp + 0x30c]
push str.ZLIB.PYD
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4015ac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401654
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push 0x40518c
call fcn.00402520
add esp, 8
test eax, eax
je 0x401654
push 0x405198
push eax
call fcn.00402230
add esp, 8
test eax, eax
je 0x401654
pop esi
add esp, 0x304
jmp eax
push str.zlib.pyd
push 0x406460
push 0x4051bc
lea eax, [esp + 0x10]
push 0x304
push eax
call dword [sym.imp.MSVCR90.dll__snprintf]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4015f7
push str.initzlib
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4015f7
call eax
pop esi
add esp, 0x304
ret
push edi
push 0
mov eax, 0x405e20
call fcn.00401350
mov esi, eax
add esp, 4
mov edi, esi
test esi, esi
je 0x401653
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_strncmp]
push 0xb
push str._pythondll_
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x40162e
mov edx, dword [esi + 0xb]
lea edi, [esi + edx + 0xf]
push 0xa
push str._zlib.pyd_
push edi
call ebx
add esp, 0xc
pop ebx
test eax, eax
jne 0x40164c
add edi, 0xe
push edi
call fcn.00401510
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
add esp, 0x304
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x457a6d81
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x11ac7792
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4030ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x420020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403184
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403164
xor eax, eax
push ebp
push 0x40315d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403164
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x420020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x420020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403bbc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42104c], 0
je 0x403c1d
cmp word [0x421220], 0xd7b2
jne 0x403be5
cmp dword [0x421228], 0
jbe 0x403be5
mov eax, 0x42121c
call dword [0x421238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42006c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403c44
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x420030], 0
jne 0x403c39
push 0
push 0x420064
push 0x42006c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405dac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405e12
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403fd8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ce0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405dfc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e19
lea eax, [ebp - 0x10]
call fcn.00403d68
ret

Function at 0x40aa2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aa65
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403e58
jmp 0x40aa6e
mov eax, ebx
mov edx, esi
call fcn.00403dbc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aa78
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aa99
mov al, byte [esp]
jmp 0x40aa9b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b130
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40af98
mov eax, dword [0x420a58]
cmp byte [eax], 0
je 0x40b1ac
mov eax, dword [0x420954]
call fcn.00402c5c
call fcn.00402b0c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407e08
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b1f4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b1e2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x420928]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x421668]
call fcn.00405254
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bf3c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40bfa0
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403fd8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407964
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bfa7
lea eax, [ebp - 0xc]
call fcn.00403d68
ret

Function at 0x41c2c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0041c03c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004041f4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x41c31e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4209d4]
mov dl, 1
mov eax, dword [0x41bf60]
call fcn.0040b2f0
call fcn.00403778
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41d584
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41d5ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x420904]
cmp byte [eax], 0
je 0x41d5b8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
jmp 0x41d5d4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403f90
mov eax, dword [ebp - 0xc]
call fcn.004041f4
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d5f1
lea eax, [ebp - 0xc]
call fcn.00403d68
ret

Function at 0x41d5f8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41d669
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x420904]
cmp byte [eax], 0
je 0x41d633
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov dword [ebp - 0xc], eax
jmp 0x41d653
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00403f90
mov eax, dword [ebp - 0x10]
call fcn.004041f4
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d670
lea eax, [ebp - 0x10]
call fcn.00403d68
ret
Function at 0x41d678
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41d6de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x420904]
cmp byte [eax], 0
je 0x41d6ac
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 8], eax
jmp 0x41d6c8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403f90
mov eax, dword [ebp - 0xc]
call fcn.004041f4
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d6e5
lea eax, [ebp - 0xc]
call fcn.00403d68
ret

Function at 0x41d9cc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41d9ea
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.0041ceb4
jmp 0x41da19
call sub.kernel32.dll_GetCommandLineW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0041d838
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x41da19
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor edx, edx
call fcn.004046fc
je 0x41da19
dec dword [ebp - 4]
jmp 0x41d9f2
mov esp, ebp
pop ebp
ret

Function at 0x41daec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41db56
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.00403fd8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407964
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41db5d
lea eax, [ebp - 0x14]
call fcn.00403d68
ret

Function at 0x41db88
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
je 0x41dbe7
lea eax, [ebp - 4]
push eax
push 0x40
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x41dbbb
call fcn.0040c520
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 6
call fcn.00402ba0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x41dbe7
call fcn.0040c520
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e31c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41e3e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x420904]
cmp byte [eax], 0
jne 0x41e36f
mov eax, dword [ebp + 0xc]
push eax
mov al, byte [ebp + 8]
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00403ff0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0041c2c0
jmp 0x41e3ca
mov al, byte [ebp + 8]
call fcn.0041de18
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004045d0
push eax
mov eax, dword [ebp - 4]
call fcn.0041e3f0
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x41e3ca
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x4209d4]
mov dl, 1
mov eax, dword [0x41bf60]
call fcn.0040b2f0
call fcn.00403778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e3e7
lea eax, [ebp - 0x14]
call fcn.00403d68
ret

Function at 0x41e6f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00402cc0
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004045d0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x41e765
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x41e7bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.0040485c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004045d0
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004045e0
push eax
call sub.kernel32.dll_GetTempPathW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x41e814
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004045d0
call fcn.0041bd74
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040485c
jmp 0x41e81c
mov eax, dword [ebp - 8]
call fcn.004043b8
mov esp, ebp
pop ebp
ret
Function at 0x401258
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xe8
push ebx
push esi
mov esi, dword [ebp + 0x78]
push edi
push dword [ebp + 0x7c]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [esi + 0x18]
call edi
push 9
push dword [esi + 0x18]
mov dword [ebp + 0x6c], eax
call edi
mov dword [ebp + 0x78], eax
push 0x64
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x6c]
xor ebx, ebx
mov word [ebp - 0x78], bx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp + 0x64]
push eax
push dword [esi + 0x18]
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x68], ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
xor eax, eax
lea edi, [ebp + 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp + 0x58]
mov eax, dword [ebp + 0x54]
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x5c]
push 4
sub edi, ecx
sub ecx, dword [ebp + 0x68]
push edi
sub esi, eax
sub eax, dword [ebp + 0x64]
push esi
push ecx
push eax
push ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push edi
push esi
push dword [ebp + 0x58]
push dword [ebp + 0x54]
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_MoveWindow]
push ebx
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret

Function at 0x402b36
Capabilities:
Acquire debug privileges

Disassembly:
cmp byte [esp + 4], 0
push esi
mov esi, ecx
mov byte [esi], 0
je 0x402b64
test byte [0x49b1c8], 4
jne 0x402b64
push 2
mov byte [esi], 1
or byte [0x49b1c8], 4
push str.SeDebugPrivilege
call fcn.0040e27e
pop ecx
pop ecx
mov eax, esi
pop esi
ret 4