joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408de4
Capabilities:
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
mov eax, 0x5104f8
call fcn.004ff484
mov dword [ebp - 0x28], 0xa
mov edx, dword [ebp - 0x28]
add edx, edx
mov dword [ebp - 0x28], edx
and dword [ebp - 0x28], 2
push dword [ebp - 0x28]
push 0x510412
call fcn.00501aec
add esp, 8
mov esi, 0x5100ac
lea edi, reloc.ADVAPI32.DLL_RegCloseKey
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0xc
mov esi, 0x5100cc
lea edi, reloc.ADVAPI32.DLL_RegCloseKey
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0x18
mov eax, dword [0x5102cc]
mov dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey], eax
mov eax, dword [0x5102d0]
mov dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey], eax
mov word [ebp - 0x14], 0x24
xor edx, edx
mov dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey], edx
xor dword [ebp - 0x28], 2
inc dword [ebp - 0x28]
push dword [ebp - 0x28]
push 0x51041b
call fcn.00501aec
add esp, 8
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey], ecx
mov byte [ebp - 0x229], 0
mov byte [ebp - 0x22a], 0
mov word [ebp - 0x236], 0
mov eax, dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
add eax, eax
lea eax, [eax + eax*2]
and eax, 0x80000007
jns 0x408ec0
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, 0xa
sub ecx, eax
mov edx, dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
add edx, edx
lea edx, [edx + edx*2]
test edx, edx
jns 0x408ed9
add edx, 7
sar edx, 3
mov eax, dword [ebp + 8]
movzx edx, byte [eax + edx]
shl edx, 8
mov eax, dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
add eax, eax
lea eax, [eax + eax*2]
test eax, eax
jns 0x408ef8
add eax, 7
sar eax, 3
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx + eax + 1]
add edx, eax
sar edx, cl
mov word [ebp - 0x236], dx
movzx edx, word [ebp - 0x236]
sar edx, 5
and dl, 1
or dl, byte [ebp - 0x229]
add edx, edx
mov byte [ebp - 0x229], dl
movzx ecx, word [ebp - 0x236]
sar ecx, 0
and cl, 1
or cl, byte [ebp - 0x229]
mov byte [ebp - 0x229], cl
movzx eax, word [ebp - 0x236]
sar eax, 1
and al, 0xf
mov byte [ebp - 0x22a], al
mov ecx, dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
inc ecx
and ecx, 0x80000001
jns 0x408f67
dec ecx
or ecx, 0xfffffffe
inc ecx
shl ecx, 2
xor edx, edx
mov dl, byte [ebp - 0x229]
shl edx, 4
mov eax, dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
shl eax, 6
lea eax, reloc.ADVAPI32.DLL_RegCloseKey
lea edx, [eax + edx]
xor eax, eax
mov al, byte [ebp - 0x22a]
mov dl, byte [edx + eax]
shl dl, cl
mov ecx, dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
sar ecx, 1
jns 0x408fa2
adc ecx, 0
or byte [ebp + ecx - 0x234], dl
inc dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey], 7
jle 0x408e92
push 0x20
lea eax, reloc.ADVAPI32.DLL_RegCloseKey
push eax
push dword [ebp + 8]
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
push edx
call fcn.00408ac8
add esp, 0x10
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40de95
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, al
jmp 0x40deec
popal
jmp 0x40e01c
not dx
mov ecx, dword [esp]
mov ch, al
jmp 0x40df02
mov dword [edi], edx
mov bx, word [esp]
mov edx, 0xba91aa76
mov bl, byte [esp]
bswap edx
jmp 0x40ded3
lea esp, [esp + 0x74]
jne 0x40debd
mov ebx, eax
jmp 0x40df32
mov ah, byte [esp]
mov edx, dword [esp]
pushfd
lea edx, [edi*4]
pop word [esp]
mov ax, 0xe178
jmp 0x40e22a
lea esp, [esp + 3]
jmp 0x40e00e
bswap edx
lea esp, [esp + 3]
and ebx, 0xff0
setl al
call fcn.0040df80
lea edx, [edi*4]
dec dx
jns 0x40e042
clc
jmp 0x40e04b
clc
rdtsc
jmp 0x40e1cc
rdtsc
sbb dx, 0xbad3
bswap eax
jmp 0x6b1411
sbb dx, 0xbad3
bswap eax
jmp 0x6b1411
mov eax, dword [esp]
sub esp, 0x1d
jnp 0x40e008
bswap edx
jmp 0x40dfb2

Function at 0x40e2b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x40dd78
mov cx, ax
mov cx, 0x98f0
mov ecx, 0xf463bbbb
call fcn.0040de95
and al, 0x57
jmp 0x40de7d

Function at 0x434250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4342f9
test eax, edx
je 0x4342fc
push 0
push 0
cmp word [eax - 0xa], 2
je 0x434279
push edx
mov edx, eax
mov eax, esp
call fcn.0044ae5c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x43428f
push eax
lea eax, [esp + 8]
call fcn.0044ae5c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x43429e
movzx eax, word [eax]
sub eax, ecx
jmp 0x4342c5
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, reloc.ADVAPI32.DLL_RegCloseKey
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4342df
add ecx, 4
js 0x4342b6
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x4342dc
push eax
mov eax, ecx
mov edx, 2
call fcn.0044a07c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4342c3
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4342c5
xor eax, eax
ret
test eax, eax
je 0x43430c
test edx, edx
jne 0x434260
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x43be7f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0044a35c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.0050cd82
mov edi, eax
cmp edi, 0x104
jbe 0x43bea2
mov eax, edi
add eax, eax
call fcn.004481ec
mov esi, eax
jmp 0x43bea4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.0050cd82
push edi
push esi
call fcn.0050d13c
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x43bedd
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x43bec7
mov eax, esp
cmp esi, eax
je 0x43beea
mov eax, esi
call fcn.00448208
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x43bf24
cmp bl, 0
je 0x43bf20
cmp bl, 0x41
jl 0x43bf1b
cmp bl, 0x5a
jg 0x43bf1b
or bl, 0x20
xor al, bl
inc esi
jmp 0x43beff
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x43be64
Function at 0x46d0c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x46d0c6
ret

Function at 0x5de5ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
push dword [esp + 0x24]
ret 0x28
jmp 0x5de306
mov eax, ebp
clc
mov ah, 0x42
xchg dword [esp + 4], edi
neg eax
mov bx, word [esp]
jmp 0x5de34a
mov bl, 0xfe
mov ax, word [esp + 2]
lea eax, [ebp*4]
lea edi, [edi - 0x31]
xchg ebx, eax
xchg ebx, eax
jmp 0x5de2db
sub bx, 0x887b
call fcn.005de469
push ds
imul ebx, dword [ecx + 0x55], 0xf32d012c
imul edx, edx, 0xffffffd3
push ebx
js 0x5de3d8
cmp eax, 0x66e69f0c
pop dword [esp + 1]
xchg dword [esp + 0x10], eax
sub esp, 0x15
xchg al, ah
xchg dword [esp + 2], eax
xor ah, cl
jmp 0x5de1c5
jmp 0x5de3b4
mov bx, cx
mov ax, 0x4695
jmp 0x5de41a
jmp 0x5de3dd
lea esp, [esp + 0x24]
sub dl, 0x38
mov bx, bp
bt bx, bp
jns 0x5de39e
mov bh, 0x53
neg eax
mov eax, dword [esp]
jmp 0x5de3ea
lea ebx, [edx - 0x1f]
jmp 0x5de395
mov bh, 0x53
neg eax
mov eax, dword [esp]
jmp 0x5de3ea
rol dl, 0
jmp 0x5de43f
push esp
mov al, byte [esp + 1]
sbb bx, 0xb5d6
bswap eax
xchg ebx, eax
jmp 0x5de448
bswap ebx
push word [esp + 1]
je 0x5de37f
jne 0x5de3b4
sbb bx, 0xb5d6
bswap eax
xchg ebx, eax
jmp 0x5de448
jl 0x5de3f3
push esp
mov al, byte [esp + 1]
jmp 0x5de429
rol dl, 0
jmp 0x5de4ee
not ebx
lea ebx, reloc.ADVAPI32.DLL_RegCloseKey
mov al, cl
mov eax, dword [esp]
not bl
dec al
jmp 0x5de475
xchg ah, al
mov ax, word [esp]
lea esp, [esp + 4]
neg dl
xchg ebx, eax
jmp 0x5de488
shr bx, cl
jle 0x5de4c0
bswap eax
mov ebx, 0xb12882bd
mov ax, word [esp]
xchg ebx, eax
clc
jmp 0x5de4c9
mov al, cl
mov eax, dword [esp]
not bl
jmp 0x5de460
mov ax, word [esp]
xchg ebx, eax
clc
jmp 0x5de4c9
bswap eax
mov ebx, 0xb12882bd
jmp 0x5de4aa
mov eax, edx
mov bx, word [esp]
mov ebx, 0x71c09628
not ebx
bswap ebx
jmp 0x5de588
jb 0x5de451
not ebx
lea ebx, reloc.ADVAPI32.DLL_RegCloseKey
jmp 0x5de4a1
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0x5de555
bsr ebx, esp
jge 0x5de4fe
sub esp, 0x1f
lea esp, [esp + 3]
shl eax, 2
lea esp, [esp + 0x38]
pushfd
jmp 0x5de53f
pushal
pop dword [esp + 0xe]
jmp 0x5de514
bswap ebx
xor bx, si
jns 0x5de55f
push word [esp + 2]
jmp 0x5de56d
shl eax, 2
lea esp, [esp + 0x38]
pushfd
jmp 0x5de53f
push word [esp + 2]
lea esp, [esp]
call 0x5de5ee
mov eax, dword [reloc.ADVAPI32.DLL_RegCloseKey]
add byte ss:[eax], al
add bl, ch
invalid
lea esp, [esp]
call 0x5de5ab
jmp 0x5de5d9
mov ebx, 0xfc1c15a6
btr bx, dx
jne 0x5de538
je 0x5de538
lea ebp, [ebp - 0xe]
call fcn.005de5d2
movsb byte es:[edi], byte [esi]
mov ah, 0xd3
rcl edi, 1
or dword ds:[eax + reloc.ADVAPI32.DLL_RegCloseKey], ebp
xchg dword [esp], ebp
mov bx, dx
mov bh, byte [esp]
cmp bx, bp
jmp 0x5de595
and al, 0xf
wait
mov dword [edi - reloc.ADVAPI32.DLL_RegCloseKey], 0x44c7d8eb
fidivr dword [ebp + 0x7071b94c]
jae 0x5de658
mov bh, dh
bswap ebx
mov ebx, 0xc8568d18
lea esp, [esp + 2]
jmp fcn.005de025
Function at 0x5de95e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov bl, byte [esp + 6]
mov bx, 0xfa49
push dword [esp + 7]
jmp 0x5de976
sub esp, 0x1a
xchg dword [esp + 0x21], eax
lea esp, [esp + 2]
jmp 0x5de9f5
jmp 0x5de934
lea esp, [esp + 2]
jmp 0x5de9f5
jle 0x5de947
sub esp, 0x1a
xchg dword [esp + 0x21], eax
jmp 0x5de960
sub esp, 0x1a
not bh
call fcn.005dea09
out 0x6d, eax
std
test byte [edi - 0x40], dh
idiv dword [esi - 0x14]
mov eax, dword [esi - reloc.ADVAPI32.DLL_RegCloseKey]
push dword [esp + 2]
jb 0x5de9ac
sub esp, 0x1a
not bh
jmp 0x5dea97
mov eax, dword [esi]
mov bh, bl
jmp 0x5deaa4
and edx, 0x3c
mov ebx, 0x440cf224
lea eax, reloc.ADVAPI32.DLL_RegCloseKey
setb ah
pushfd
jmp 0x5de9c5
xchg dword [esp + 0x12], ebx
lea esp, [esp + 2]
jmp 0x5de9de
mov ebx, dword [esp]
mov bx, word [esp]
bsr ebx, esp
jg 0x5deacd
mov bh, 0x33
mov bx, word [esp]
jmp 0x5deae2
not ebx
bsf bx, cx
call fcn.005deb0d
iretd

Function at 0x5dea8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
xchg dword [esp + 0x10], ebx
call fcn.005dea5f
Function at 0x601e19
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x5e1e74

Function at 0x687001
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
je 0x5e798d
mov edx, ebp
jmp 0x686feb

Function at 0x72805d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
clc
jmp 0x7280a2
inc ah
btr dx, ax
xor dx, 0x29c4
mov ax, 0x1404
jmp 0x7280ed
inc dx
pop dword [esp + 6]
pushal
mov dl, cl
sub esp, 5
push word [esp + 0x20]
jmp 0x72808c
rdtsc
mov dl, byte [esp + 1]
add esp, 1
rdtsc
mov al, byte [esp]
and al, ch
call fcn.0072811a
dec eax
popal
jo 0x72812f
jb 0x728150
add byte gs:[ecx + 0x600d24fd], al
sti
cmp ebp, 0xfb600d24
sub esp, 9
lea esp, [esp + 0x47]
xchg ah, al
push bx
xchg word [esp], bp
jmp 0x7280cf
add byte [eax], ch
dec ebx
mov edx, esp
mov eax, dword [esp + 6]
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
inc esp
dec esp
dec esp
add dl, ah
add byte [eax], al
add byte [eax], al

Function at 0x7282b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop dword [esp + 0xc]
mov ebp, esp
cld
rcr al, 2
xchg edx, eax
jmp 0x7282c5
stc
cld
xchg word [esp + 1], ax
setb dl
jmp 0x7282a3
rdtsc
mov ax, 0xdc50
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
rdtsc
not dh
xchg word [esp + 0x15], ax
jmp 0x728314
shr ah, cl
call fcn.007282fe

Function at 0x7288a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 4]
adc dh, 0x1c
pop bp
mov ebp, 0x7cec3c6d
jmp 0x7288be
jmp 0x728890
mov bp, 0xf5bd
pop ax
not edx
mov bp, bx
rdtsc
not edx
jmp 0x728912
mov dx, 0x8f4d
not ebp
neg ax
sub esp, 0x12
rdtsc
lea eax, [eax*4]
jmp 0x7288a8
pop word [esp + 0xd]
xchg dl, dh
pushal
mov word [esp + 0x2e], sp
xchg byte [esp + 0x11], dh
mov dl, cl
jmp 0x7288f3

Function at 0x728bfa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, si
xchg dl, al
xchg dword [esp], edx
mov dl, dh
bswap eax
mov dl, 0x3f
jmp 0x728c19
mov word [esp], bx
setge al
jmp 0x728be4
xchg al, ah
std
not edx
mov dl, 0x30
btr bp, si
sub esp, 2
jmp 0x728c2c
mov eax, esp
pop eax
bsf edx, ebp
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
lea eax, [edx + esi]
xchg edx, eax
jmp 0x728c03
xchg byte [esp], dl
btr bp, ax
mov byte [esp], bh
add esp, 0
mov edx, 0x196f79b6
jmp 0x728c6d
push word [esp + 1]
mov eax, dword [esp + 1]
xchg al, ah
xchg edx, ebp
rdtsc
rdtsc
jmp 0x728c57

Function at 0x72d615
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x72d2eb
pop word [esp]
push word [esp]
jmp 0x72d3f3
Function at 0x4111a4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x4146ec
push ebx
push esi
mov esi, ecx
mov ecx, 0x4210fa
push edi
call fcn.0041169a
lea edi, [esi + 0x9c4]
mov ebx, 0xe3
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x414708
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x41474d
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], 0
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebx
ret

Function at 0x411366
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x4147f6
push esi
mov esi, ecx
mov ecx, 0x4210fa
call fcn.0041169a
add esi, 8
mov edx, 0x270
mov ecx, dword [esi - 4]
xor ecx, dword [esi]
lea esi, [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x62c]
xor eax, ecx
mov dword [esi + 0x9b8], eax
sub edx, 1
jne 0x41480b
pop esi
ret
Function at 0x403050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x408910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
push 0xffffffffffffffff
push 0
mov ecx, 0x417c28
call sub.MFC42u.DLL_CStringArray::SetSize
mov eax, dword [0x419564]
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push 0x184
push 0x3fe
push eax
call esi
push 0x410a60
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 4]
mov dword [esp + 0x30], 0
mov eax, dword [ecx - 8]
test eax, eax
jle 0x4030bc
cmp word [ecx + eax*2 - 2], 0x5c
je 0x4030c7
push 0x5c
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::operator_2
push str..sql
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 8]
mov byte [esp + 0x30], 1
push ecx
lea ecx, [esp + 8]
call fcn.00408394
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.00408376
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CFileFind::CFileFind
mov edx, dword [esp + 4]
push 0
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 2
call sub.MFC42u.DLL_CFileFind::FindFile
test eax, eax
je 0x4031b6
push ebp
push edi
mov edi, dword [sym.imp.MSVCRT.dll_swprintf]
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CFileFind::FindNextFileW
mov ebp, eax
mov eax, dword [esp + 0x14]
push 0x10
lea ecx, [esp + 0x18]
call dword [eax + 0x40]
test eax, eax
jne 0x4031ac
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CFileFind::IsDots
test eax, eax
jne 0x4031ac
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CFileFind::GetFileName
mov eax, dword [0x417c30]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x417c28
mov byte [esp + 0x40], 3
call sub.MFC42u.DLL_CStringArray::SetAtGrow
mov eax, dword [esp + 0x10]
push eax
push 0x412b58
call edi
mov ecx, dword [0x419564]
add esp, 8
push 0x412b58
push 0
push 0x180
push 0x3fe
push ecx
call esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call fcn.00408376
test ebp, ebp
jne 0x403124
pop edi
pop ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.004083d0
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
call fcn.00408376
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x4045c0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x408b00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
xor esi, esi
push 0xffffffffffffffff
push esi
mov ecx, 0x412a70
call sub.MFC42u.DLL_CStringArray::SetSize
push 0x410a60
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], esi
mov eax, dword [ecx - 8]
cmp eax, esi
jle 0x40460e
cmp word [ecx + eax*2 - 2], 0x5c
je 0x404619
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator_2
mov edi, dword [0x417c30]
cmp edi, esi
jle 0x4046d6
push ebx
mov bl, 1
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
push esi
push ecx
mov ecx, 0x417c28
mov byte [esp + 0x30], bl
call fcn.00402ee0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call fcn.00408394
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00408376
lea ecx, [esp + 0x10]
call fcn.00408370
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push 0x412a90
push 0x417b5c
push 0x410998
push str.CMD__C_Mysql__u_s__p_s__s____s
push eax
mov byte [esp + 0x40], 3
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x412a78]
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, 0x412a70
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.00408376
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.00408376
inc esi
cmp esi, edi
jl 0x40462a
pop ebx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x406490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [0x419590], eax
test eax, eax
pop esi
jne 0x404710
push eax
mov eax, dword [0x41950c]
push 0x40ec80
push 0x40ec6c
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00408376
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4069e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x408d00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push 0xffffffffffffffff
push 0
mov ecx, 0x412a70
call sub.MFC42u.DLL_CStringArray::SetSize
lea ecx, [esp]
call fcn.00408370
lea eax, [esp + 4]
push 1
push eax
mov dword [esp + 0x1c], 0
call fcn.004054b0
add esp, 8
mov eax, dword [esp + 4]
mov byte [esp + 0x14], 1
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x406a6d
push eax
push 0x412a90
push 0x417b5c
push 0x410998
lea ecx, [esp + 0x10]
push str.CMD__C_Mysql__u_s__p_s__s___execute_DROP_TABLE_IF_EXISTS__s_
push ecx
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x412a78]
add esp, 0x18
lea edx, [esp]
mov ecx, 0x412a70
push edx
push eax
call sub.MFC42u.DLL_CStringArray::SetAtGrow
push 0x412270
push 0x412a90
push 0x417b5c
push 0x410998
lea eax, [esp + 0x10]
push str.CMD__C_Mysql__u_s__p_s__s____s
push eax
call sub.MFC42u.DLL_CString::Format
mov eax, dword [0x412a78]
add esp, 0x18
lea ecx, [esp]
push ecx
push eax
mov ecx, 0x412a70
call sub.MFC42u.DLL_CStringArray::SetAtGrow
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x406490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x419590], eax
jne 0x406ae0
push eax
mov eax, dword [0x41950c]
push 0x40ec80
push 0x40ec6c
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.00408376
lea ecx, [esp]
mov dword [esp + 0x14], 0xffffffff
call fcn.00408376
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x406bb0
Capabilities:
Create directory

Disassembly:
mov eax, 0x1000
call fcn.004084d0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
call edi
add esp, 4
test eax, eax
jbe 0x406c89
push esi
call edi
add esp, 4
cmp eax, 0x400
jae 0x406c89
lea eax, [esp + 0x10]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcschr]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x406c79
mov ebx, dword [sym.imp.MSVCRT.dll_wcsncpy]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, edi
lea edx, [esp + 0x10]
sub esi, edx
lea ecx, [esp + 0x10]
sar esi, 1
lea edx, [esp + 0x810]
lea eax, [esi + 1]
push eax
push ecx
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x810]
mov word [esp + esi*2 + 0x812], 0
push 0
push eax
call ebp
test eax, eax
jne 0x406c64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406c64
cmp eax, 5
jne 0x406c89
add edi, 2
push 0x5c
push edi
call dword [sym.imp.MSVCRT.dll_wcschr]
mov edi, eax
add esp, 8
test edi, edi
jne 0x406c18
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1000
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1000
ret
Function at 0x405b68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405bce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040ec
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b48
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405bb8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bd5
lea eax, [ebp - 0x10]
call fcn.00403e7c
ret

Function at 0x40add0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ae09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f6c
jmp 0x40ae12
mov eax, ebx
mov edx, esi
call fcn.00403ed0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ae1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ae3d
mov al, byte [esp]
jmp 0x40ae3f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b4c4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b33c
mov eax, dword [0x482320]
cmp byte [eax], 0
je 0x40b540
mov eax, dword [0x482134]
call fcn.004029b4
call fcn.00402834
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408630
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b588
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b576
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4820dc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x483664]
call fcn.0040507c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret