joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45149c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451647
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x451628
mov dl, 1
mov eax, dword [0x41164c]
call fcn.004030a8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e10
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x451617
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043eff4
test al, al
je 0x45160a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x451658
lea eax, [ebp - 0x254]
call fcn.00408798
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45160a
xor eax, eax
push ebp
push 0x451603
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x451690
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4515ec
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4515ec
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45160a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45150d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415140
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45164e
lea eax, [ebp - 0x260]
call fcn.00403e10
ret

Function at 0x451f7c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x458bb0]
cmp byte [eax + 0xa5], 0
jne 0x451fed
cmp dword [0x458bc8], 0
jne 0x451fae
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x451f38
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x458bc8], eax
cmp dword [0x458bc4], 0
jne 0x451fc9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x458bc4], eax
cmp dword [0x458bcc], 0
jne 0x451fed
push esp
push 0
push 0
push 0x451edc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x458bcc], eax
pop edx
ret
Function at 0x4520e4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4520fb
add esp, 0xfffffff0
call fcn.004033e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00418f50
mov eax, dword [0x45700c]
cmp word [eax + 2], 0
jne 0x452123
mov eax, dword [0x45700c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004537bc
mov eax, dword [0x4570b8]
cmp word [eax + 2], 0
jne 0x45213d
mov eax, dword [0x4570b8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004539b4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411230]
call fcn.004030a8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411230]
call fcn.004030a8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b134]
call fcn.00420f68
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4522c4
mov eax, dword [0x456f30]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421338
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x453f54
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x456f30]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bdd4
test eax, eax
je 0x452232
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040818c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bdfc
test eax, eax
je 0x452246
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, dword [0x456e2c]
cmp byte [eax], 0
jne 0x45227a
mov eax, ebx
call fcn.004523ec
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00454130
mov eax, ebx
call fcn.00454af4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4522ba
call fcn.0040343c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45266c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x458bb0]
cmp dword [eax + 0x30], 0
je 0x452716
cmp dword [ebx + 0x94], 0
jne 0x452710
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4525fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452710
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4526d6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452710
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413598
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4526e5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453278
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4532ad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f00
jmp 0x4532ba
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403e64
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45430c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45434d
mov eax, esi
call fcn.0043a5dc
test al, al
je 0x45434d
mov eax, dword [ebx + 0x84]
call fcn.0043a2d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45434d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a2d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4026b0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026be
call dword [0x483014]
or eax, eax
je 0x4026bf
ret
mov al, 1
jmp fcn.0040273c

Function at 0x4026c8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026d6
call dword [0x483018]
or eax, eax
jne 0x4026d7
ret
mov al, 2
jmp fcn.0040273c

Function at 0x4026e0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402718
test edx, edx
je 0x402702
push eax
mov eax, ecx
call dword [0x48301c]
pop ecx
or eax, eax
je 0x402711
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040273c
mov dword [eax], edx
mov eax, ecx
call dword [0x483018]
or eax, eax
jne 0x4026fb
ret
mov al, 1
jmp fcn.0040273c
test edx, edx
je 0x40272c
push eax
mov eax, edx
call dword [0x483014]
pop ecx
or eax, eax
je 0x402711
mov dword [ecx], eax
ret

Function at 0x40273c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x485004]
test ecx, ecx
je 0x40274c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402765]
jns 0x402760
call fcn.00405f9c
mov eax, dword [eax + 4]
jmp fcn.00403950

Function at 0x402780
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00405f9c
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x402795
ret
xor eax, eax
jmp fcn.0040273c

Function at 0x40288c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4028bb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403ac4
jmp 0x4028d9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402814
mov edi, eax
test ebx, ebx
je 0x4028d9
cmp dword [esi], 0
je 0x4028d9
dec ebx
jmp 0x4028c2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ca8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c88
xor eax, eax
push ebp
push 0x402c81
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402cc4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f38
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402f52
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402f52
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402f3e
mov al, 0xa
jmp fcn.0040273c
ret
Function at 0x402f84
Capabilities:
Terminate process

Disassembly:
cmp dword [0x485018], 0
je 0x402967
call dword [0x485018]
mov eax, 0xd2
jmp fcn.00403950
push eax
push ecx
mov eax, dword [eax]
call fcn.00402f54
pop ecx
pop eax
je 0x402f93
jmp ebx
pop ecx
jmp 0x402958

Function at 0x402f9c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402f54
mov eax, ebx
pop ebx
jne 0x402fb1
pop ecx
jmp 0x402958
ret

Function at 0x40382c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4854a0
mov esi, 0x485034
mov edi, 0x485038
cmp byte [ebx + 0x24], 0
jne 0x40385b
cmp dword [edi], 0
je 0x40385b
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x40384a
cmp dword [0x48503c], 0
je 0x4038a2
call fcn.004037a8
cmp byte [0x485044], 0
je 0x403888
mov edx, 0x483024
mov eax, 0x485218
call fcn.00405838
call fcn.004057bb
jmp 0x40389b
push 0
push 0x483044
push 0x483024
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x48503c], eax
cmp byte [ebx + 0x24], 2
jne 0x4038b2
cmp dword [esi], 0
jne 0x4038b2
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040367c
cmp byte [ebx + 0x24], 1
jbe 0x4038c2
cmp dword [esi], 0
je 0x4038df
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4038df
call fcn.004050a0
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x4038df
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403654
cmp byte [ebx + 0x24], 1
jne 0x4038ed
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x4038f8
call fcn.004037f8
cmp dword [ebx], 0
jne 0x403905
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4038a2

Function at 0x403994
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026b0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x485045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40395c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x404044
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404008
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404008
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403ff0
ret

Function at 0x4040ec
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.0040273c
test ecx, ecx
je fcn.00404008
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403ff0
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret
Function at 0x4041b4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4041f3
cmp al, 0xb
je 0x4041f3
cmp al, 0xc
je 0x4041fd
cmp al, 0xd
je 0x404210
cmp al, 0xe
je 0x40422e
cmp al, 0xf
je 0x4041f3
cmp al, 0x11
je 0x4041f3
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040273c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4041f3
jmp 0x404242
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4041fd
jmp 0x404242
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4041b4
dec edi
jg 0x404213
pop ebp
jmp 0x404242
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404188
dec edi
jg 0x404231
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4041b4

Function at 0x404248
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4041f3
cmp al, 0xb
je 0x4041f3
cmp al, 0xc
je 0x4041fd
cmp al, 0xd
je 0x404210
cmp al, 0xe
je 0x40422e
cmp al, 0xf
je 0x4041f3
cmp al, 0x11
je 0x4041f3
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040273c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4041f3
jmp 0x404242
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4041fd
jmp 0x404242
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4041b4
dec edi
jg 0x404213
pop ebp
jmp 0x404242
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404188
dec edi
jg 0x404231
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4041b4
Function at 0x404280
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4042c7
cmp al, 0xb
je 0x4042e1
cmp al, 0xc
je 0x4042f8
cmp al, 0xd
je 0x404307
cmp al, 0xe
je 0x404325
cmp al, 0xf
je 0x40433b
cmp al, 0x11
je 0x40434a
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.0040273c
cmp ecx, 1
mov eax, ebx
jg 0x4042d8
call fcn.004039e0
jmp 0x404359
mov edx, ecx
call fcn.00403a04
jmp 0x404359
cmp ecx, 1
mov eax, ebx
jg 0x4042ef
call fcn.00404008
jmp 0x404359
mov edx, ecx
call fcn.00404020
jmp 0x404359
mov eax, ebx
add ebx, 0x10
call fcn.00404b10
dec edi
jg 0x4042f8
jmp 0x404359
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404280
dec edi
jg 0x40430a
pop ebp
jmp 0x404359
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404254
dec edi
jg 0x404328
pop ebp
jmp 0x404359
mov eax, ebx
add ebx, 4
call fcn.00405168
dec edi
jg 0x40433b
jmp 0x404359
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404d04
dec edi
jg 0x40434a
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404360
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404280

Function at 0x40436c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404398
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004027d4
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x4043d7
cmp cl, 0xb
je 0x4043e8
cmp cl, 0xc
je 0x4043f9
cmp cl, 0xd
je 0x40440a
cmp cl, 0xe
je 0x40442a
cmp cl, 0xf
je 0x404443
cmp cl, 0x11
je 0x404454
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040273c
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403a34
mov eax, 4
jmp 0x404465
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404044
mov eax, 4
jmp 0x404465
lea edx, [esi + eax]
add eax, ebx
call fcn.0040475c
mov eax, 0x10
jmp 0x404465
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404488
pop eax
jmp 0x404465
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.0040436c
pop eax
jmp 0x404465
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405180
mov eax, 4
jmp 0x404465
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404d40
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x404386
pop ecx
sub ecx, eax
jle 0x404481
lea edx, [ebx + eax]
add eax, esi
call fcn.004027d4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404488
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x4044ce
cmp cl, 0xb
je 0x4044e5
cmp cl, 0xc
je 0x4044f9
cmp cl, 0xd
je 0x40450d
cmp cl, 0xe
je 0x40452e
cmp cl, 0xf
je 0x40454b
cmp cl, 0x11
je 0x40455f
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040273c
mov eax, ebx
mov edx, dword [esi]
call fcn.00403a34
add ebx, 4
add esi, 4
dec ebp
jne 0x4044ce
jmp 0x404573
mov eax, ebx
mov edx, dword [esi]
call fcn.00404044
add ebx, 4
add esi, 4
dec ebp
jne 0x4044e5
jmp 0x404573
mov eax, ebx
mov edx, esi
call fcn.0040475c
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4044f9
jmp 0x404573
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404488
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404516
jmp 0x404573
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.0040436c
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x40452e
jmp 0x404573
mov eax, ebx
mov edx, dword [esi]
call fcn.00405180
add ebx, 4
add esi, 4
dec ebp
jne 0x40454b
jmp 0x404573
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00404d40
add ebx, 4
add esi, 4
dec ebp
jne 0x40455f
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x40475c
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.0040273c
cmp eax, edx
je 0x4047f3
cmp word [eax], 8
jb 0x404794
push eax
push edx
cmp word [eax], 0x100
je 0x40478a
cmp word [eax], 0x101
je 0x404782
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x404792
call dword [0x4853e4]
jmp 0x404792
add eax, 8
call fcn.004039e0
pop edx
pop eax
cmp word [edx], 8
jae 0x4047ab
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x4047c6
cmp word [edx], 0x101
jne 0x4047df
push eax
call 0x40479a
pop eax
jmp dword [0x4853ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x4047d6
mov ecx, dword [edx - 8]
inc ecx
jle 0x4047d6
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404710
ret
Function at 0x404dbc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404f74
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404e1d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404f90
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404e8a
xor eax, eax
push ebp
push 0x404e83
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404e6c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404fb0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404e8a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404f6b
cmp byte [ebp - 0xd], 0
jne 0x404ecc
cmp byte [ebp - 0x12], 0
je 0x404f6b
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404ee5
dec ebx
cmp byte [ebx], 0x2e
je 0x404ef4
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404ee4
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404f6b
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404f21
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f6b
cmp byte [ebp - 0xd], 0
je 0x404f6b
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404f6b
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4054c8
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x405523
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x405515
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x40550a
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x405505
mov eax, 0x65
jmp 0x40551a
call sub.kernel32.dll_GetLastError
call fcn.004027a0
xor eax, eax
jmp 0x405505
mov eax, 0x67
jmp 0x40551a