joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d3f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45d48f
cmp dword [ebx + 0x94], 0
jne 0x45d489
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45d378
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45d489
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45d44f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45d489
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00415738
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45d45e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d6a8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x475ccc]
cmp dword [eax + 0x30], 0
je 0x45d805
test bl, bl
jne 0x45d756
cmp dword [esi + 0x9c], 0
jne 0x45d74b
mov eax, esi
call fcn.0045ffe8
push eax
push 0x45d5d4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45d71c
mov eax, dword [0x475ccc]
call fcn.004606c8
test al, al
je 0x45d71c
mov eax, dword [0x475cf0]
call fcn.00405e4c
mov edi, eax
cmp edi, 0
jl 0x45d71c
push 0
mov eax, dword [0x475cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45d706
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45d74b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00415738
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45d72b
inc dword [esi + 0x9c]
jmp 0x45d805
cmp dword [esi + 0x9c], 0
jle 0x45d805
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45d805
cmp dword [esi + 0x44], 0
je 0x45d7b1
mov eax, dword [0x475ccc]
call fcn.004606c8
test al, al
je 0x45d7b1
mov eax, dword [0x475cf0]
call fcn.00405e4c
mov edi, eax
cmp edi, 0
jl 0x45d7b1
push 5
mov eax, dword [0x475cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45d79b
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45d7e0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00415738
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45d7c0
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x475cf0
mov ecx, 1
mov edx, dword [0x45d5b4]
call fcn.00406000
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x45e2ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45e356
mov eax, ebx
call fcn.004606c8
test al, al
jne 0x45e356
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405034
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45e343
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45e363
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f98
jmp 0x45e363
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f98
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45f7ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45f85a
mov eax, esi
call fcn.00448424
test al, al
je 0x45f85a
mov eax, dword [ebx + 0x84]
call fcn.00448084
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45f85a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45f84e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00448084
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043fef4
jmp 0x45f85a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045f628
pop esi
pop ebx
ret

Function at 0x464c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004053d4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x464c29
test al, 0x10
jne 0x464c2d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x46a56c
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004053c4
mov eax, dword [ebp + 0x10]
call fcn.004053c4
mov eax, dword [ebp + 0xc]
call fcn.004053c4
xor eax, eax
push ebp
push 0x46a717
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov edx, 0x102
mov eax, dword [ebx + 0x68]
call fcn.00462c4c
mov edx, dword [0x4737f4]
mov eax, dword [ebx + 0x68]
call fcn.00462c08
mov dl, 1
mov eax, dword [ebx + 0x68]
call fcn.00462994
cmp byte [ebx + 0x11a], 0
je 0x46a5e0
mov esi, 0x8000000
jmp 0x46a5e2
xor esi, esi
mov eax, dword [0x470c2c]
mov eax, dword [eax]
call fcn.0045e748
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004052d8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x160]
call fcn.0040536c
jne 0x46a61c
mov eax, dword [ebx + 0x15c]
jmp 0x46a689
lea eax, [ebx + 0x164]
call fcn.00404f44
cmp dword [ebp - 4], 0
je 0x46a633
cmp dword [ebp + 0x10], 0
jne 0x46a658
push 0
push esi
push 1
push 0
push 0
movzx eax, word [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004053d4
push eax
mov eax, dword [ebx + 0xa4]
push eax
call sub.wininet.dll_InternetConnectA
jmp 0x46a689
push 0
push esi
push 1
mov eax, dword [ebp + 0x10]
call fcn.004053d4
push eax
mov eax, dword [ebp - 4]
call fcn.004053d4
push eax
movzx eax, word [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004053d4
push eax
mov eax, dword [ebx + 0xa4]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
jne 0x46a6dd
cmp word [ebx + 0xaa], 0
je 0x46a6aa
mov ecx, 6
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
cmp word [ebx + 0xb2], 0
je 0x46a6e7
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, 0x46a734
call fcn.0040525c
mov eax, dword [ebp - 0x10]
push eax
mov ecx, 6
mov edx, ebx
mov eax, dword [ebx + 0xb4]
call dword [ebx + 0xb0]
jmp 0x46a6e7
mov byte [ebp - 5], 1
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a71e
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404f68
lea eax, [ebp - 4]
call fcn.00404f44
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404f68
ret
Function at 0x46c0f0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004051b4
add esp, 0x10c
pop ebx
ret

Function at 0x46c1c8
Capabilities:
Copy file

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x1e
call fcn.0040391c
call sub.user32.dll_GetDesktopWindow
mov dword [esp], eax
mov dword [esp + 4], 2
mov eax, ebx
call fcn.004053d4
mov dword [esp + 8], eax
mov eax, esi
call fcn.004053d4
mov dword [esp + 0xc], eax
mov word [esp + 0x10], 0x210
push esp
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete al
add esp, 0x20
pop esi
pop ebx
ret

Function at 0x46c444
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004053c4
mov eax, dword [ebp - 8]
call fcn.004053c4
xor eax, eax
push ebp
push 0x46c4b5
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004053d4
push eax
mov eax, dword [ebp - 4]
call fcn.004053d4
push eax
push 0x46c4c4
push ebx
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c4bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f68
ret
Function at 0x46c4cc
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
cmp dword [0x475d5c], 0
jle 0x46c4ee
cmp dword [0x475d5c], 1
sete byte [ebp - 1]
jmp 0x46c618
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x46c611
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x46c538
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x46c538
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x46c5e7
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0xc]
push eax
call fcn.004067f4
pop ecx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x46c5e0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x470950
call sub.advapi32.dll_AllocateAndInitializeSid
mov edi, dword [esi]
dec edi
test edi, edi
jl 0x46c5d7
inc edi
xor ebx, ebx
mov eax, dword [esi + ebx*8 + 8]
and eax, 4
cmp eax, 4
jne 0x46c5d3
mov eax, dword [esi + ebx*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x46c5d3
mov byte [ebp - 1], 1
jmp 0x46c5d7
inc ebx
dec edi
jne 0x46c5af
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c618
cmp byte [ebp - 1], 0
je 0x46c606
mov dword [0x475d5c], 1
jmp 0x46c610
mov dword [0x475d5c], 2
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c658
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c83c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x46c814
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
je 0x46c6ca
mov eax, 1
dec eax
test ebx, ebx
je 0x46c6a3
cmp eax, dword [ebx - 4]
jb 0x46c6a8
call fcn.00403fe0
inc eax
cmp byte [ebx + eax - 1], 0x22
je 0x46c6ca
push 0x46c858
push ebx
push 0x46c858
lea eax, [ebp - 4]
mov edx, 3
call fcn.004052d8
jmp 0x46c6d4
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404fdc
test esi, esi
je 0x46c72c
mov eax, 1
dec eax
test esi, esi
je 0x46c6e7
cmp eax, dword [esi - 4]
jb 0x46c6ec
call fcn.00403fe0
inc eax
cmp byte [esi + eax - 1], 0x22
je 0x46c716
push dword [ebp - 4]
push 0x46c864
push 0x46c858
push esi
push 0x46c858
lea eax, [ebp - 4]
mov edx, 5
call fcn.004052d8
jmp 0x46c72c
push dword [ebp - 4]
push 0x46c864
push esi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004052d8
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 4]
call fcn.00408e5c
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 4]
call fcn.00404fdc
test edi, edi
jne 0x46c74a
xor ebx, ebx
jmp 0x46c753
mov eax, edi
call fcn.004053d4
mov ebx, eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040391c
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.0040391c
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
movzx eax, word [ebp + 0xc]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004053d4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x46c7be
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c81e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46c803
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x46c7e3
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c80a
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c843
lea eax, [ebp - 0x60]
call fcn.00404f44
lea eax, [ebp - 4]
call fcn.00404f44
ret
Function at 0x46cff0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor eax, eax
push ebp
push 0x46d127
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x46d102
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
mov byte [eax + 0x108], 1
mov eax, dword [eax + 0xa0]
call fcn.004163e0
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0xa0]
call fcn.0046bde8
mov ebx, eax
lea eax, [ebx + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x394]
call fcn.00404f98
lea edx, [ebp - 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x390]
call fcn.00409a10
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x10]
call fcn.00404f98
lea edx, [ebp - 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x390]
call fcn.00409a98
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x14]
call fcn.00404f98
mov eax, dword [esi]
mov eax, dword [eax + 0x390]
call fcn.00409664
test al, al
je 0x46d0cc
mov eax, dword [esi]
mov ebx, dword [eax + 0x390]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
call fcn.004053d4
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [esi]
mov eax, dword [eax + 0x370]
call fcn.0046bc2c
mov eax, dword [esi]
mov eax, dword [eax + 0x390]
call fcn.00409664
test al, al
jne 0x46d0f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d10c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d10c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d12e
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404f68
ret

Function at 0x46d284
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x46d338
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.0040391c
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x540
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x390]
call fcn.004053d4
mov dword [ebp - 0x2c], eax
mov eax, 0x46d348
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x390]
call fcn.00409a44
mov eax, dword [ebp - 0x40]
call fcn.004053d4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x46d322
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x388], edx
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d33f
lea eax, [ebp - 0x40]
call fcn.00404f44
ret
Function at 0x46d350
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
mov eax, dword [ebx]
mov eax, dword [eax + 0x38c]
call fcn.00409664
test al, al
jne 0x46d387
push 0x10
push 0x46d3ec
push 0x46d3f4
mov eax, dword [ebx]
call fcn.00448084
push eax
call sub.user32.dll_MessageBoxA_1
pop ebx
pop ebp
ret
mov eax, dword [ebx]
mov eax, dword [eax + 0x398]
call fcn.00409664
test al, al
jne 0x46d3b4
push 0x10
push 0x46d3ec
push 0x46d420
mov eax, dword [ebx]
call fcn.00448084
push eax
call sub.user32.dll_MessageBoxA_1
pop ebx
pop ebp
ret
push 1
push 0
mov eax, dword [ebx]
mov eax, dword [eax + 0x398]
call fcn.004053d4
push eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x38c]
call fcn.004053d4
push eax
push 0x46d438
mov eax, dword [ebx]
call fcn.00448084
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
pop ebp
ret
Function at 0x402ed8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402f31
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402d74
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402d74
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402f1b
inc ebx
jmp 0x402f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f38
lea eax, [ebp - 8]
call fcn.004045e0
ret

Function at 0x402f40
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045e0
test esi, esi
jne 0x402f77
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004046d0
jmp 0x402f98
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d74
mov dword [esp], eax
test esi, esi
je 0x402f98
cmp dword [ebx], 0
je 0x402f98
dec esi
jmp 0x402f7f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4036d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48b020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403770
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403750
xor eax, eax
push ebp
push 0x403749
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40378c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403750
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48b020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48b020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40445c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48e04c], 0
je 0x4044bd
cmp word [0x48e220], 0xd7b2
jne 0x404485
cmp dword [0x48e228], 0
jbe 0x404485
mov eax, 0x48e21c
call dword [0x48e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48b06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4044e4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48b030], 0
jne 0x4044d9
push 0
push 0x48b064
push 0x48b06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4067d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40683e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404850
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040329c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406828
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406845
lea eax, [ebp - 0x10]
call fcn.004045e0
ret

Function at 0x40c240
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c279
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004046d0
jmp 0x40c282
mov eax, ebx
mov edx, esi
call fcn.00404634
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c28c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c2ad
mov al, byte [esp]
jmp 0x40c2af
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c944
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c7ac
mov eax, dword [0x48d4c0]
cmp byte [eax], 0
je 0x40c9c0
mov eax, dword [0x48d1c4]
call fcn.00403060
call fcn.00402c70
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040937c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ca08
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c9f6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x48d160]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48e668]
call fcn.00405c44
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret