joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414135
Capabilities:
Get disk information

Disassembly:
mov eax, 0x41f3cf
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
inc esi
push 0x42416c
lea ecx, [ebp + 0x70]
mov dword [ebp - 4], esi
call fcn.0040e85b
push eax
call sub.msvcrt.dll_strtok_s
add esp, 0xc
xor ebx, ebx
push ebx
push 0x424170
lea ecx, [ebp + 0x64]
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0x14], ebx
call fcn.0040e85b
push eax
call dword [0x63d090]
test eax, eax
je 0x41418d
mov edi, esi
push ebx
push 0x424180
lea ecx, [ebp + 0x64]
call fcn.0040e85b
push eax
call dword [0x63d090]
test eax, eax
je 0x4141ab
mov edi, esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
jmp 0x41432a
cmp edi, ebx
je 0x4142bd
lea eax, [ebp - 0x80]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esi, [ebp - 0x80]
cmp byte [ebp - 0x80], bl
je 0x414315
push 0x3e8
lea eax, [ebp - 0x468]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [ebp - 0x14], ebx
je 0x414217
cmp eax, 2
jne 0x414217
lea ecx, [ebp + 0x64]
call fcn.0040e85b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a0]
push esi
push str._DRIVE_REMOVABLE_
jmp 0x414233
lea ecx, [ebp + 0x64]
call fcn.0040e85b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a0]
push esi
push str._DRIVE_FIXED_
lea eax, [ebp - 0x468]
push eax
call fcn.0040fc70
add esp, 0xc
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63d1a0]
push ebx
push dword [ebp + 0x88]
lea eax, [ebp - 0x468]
push edi
push dword [ebp + 0x84]
lea ecx, [ebp + 0x58]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push dword [ebp - 0x10]
push eax
call fcn.0040e85b
push eax
push 0x423f13
lea ecx, [ebp + 0x8c]
call fcn.0040e85b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413d63
add esp, 0x80
push esi
call dword [0x63d018]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x4141d3
jmp 0x414315
push ebx
push dword [ebp + 0x88]
lea ecx, [ebp + 0x64]
push ebx
push dword [ebp + 0x84]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push eax
call fcn.0040e85b
push eax
lea ecx, [ebp + 0x58]
call fcn.0040e85b
push eax
push 0x423f16
lea ecx, [ebp + 0x8c]
call fcn.0040e85b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413d63
add esp, 0x80
lea eax, [ebp - 0x18]
push eax
push 0x4241b8
push ebx
call sub.msvcrt.dll_strtok_s
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4141b3
push 4
lea eax, [ebp - 0x10]
push eax
call fcn.0040f84b
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0040113a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x58]
call fcn.00411682
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x418e89
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b1b0]
jne 0x418e93
repz ret
jmp fcn.0041bb7f
Function at 0x41c356
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004187ac
and dword [ebp - 0x14], 0
cmp dword [0x63dd74], 0
mov dword [ebp - 0x18], eax
jne 0x41c409
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41c4b1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41c4b1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x63dd74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x63dd78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x63dd7c], eax
call edi
push eax
call esi
mov dword [0x63dd84], eax
test eax, eax
je 0x41c409
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x63dd80], eax
mov eax, dword [0x63dd80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41c462
cmp dword [0x63dd84], ecx
je 0x41c462
push eax
call esi
push dword [0x63dd84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41c462
test ebx, ebx
je 0x41c462
call edi
test eax, eax
je 0x41c459
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41c459
test byte [ebp - 8], 1
jne 0x41c462
or dword [ebp + 0x10], 0x200000
jmp 0x41c495
mov eax, dword [0x63dd78]
cmp eax, dword [ebp - 0x18]
je 0x41c495
push eax
call esi
test eax, eax
je 0x41c495
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41c495
mov eax, dword [0x63dd7c]
cmp eax, dword [ebp - 0x18]
je 0x41c495
push eax
call esi
test eax, eax
je 0x41c495
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x63dd74]
call esi
test eax, eax
je 0x41c4b1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41c4b3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418e89
leave
ret
Function at 0x64e01ba0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov edx, 8
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x10
mov ebx, dword [ecx]
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
test eax, eax
mov dword [esp + 8], ecx
cmovne eax, edx
mov dword [esp + 4], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
setne al
lea esp, [ebp - 8]
movzx eax, al
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x64e01c00
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, dword fs:[0x18]
push ebp
mov ebp, esp
push ecx
sub esp, 0x14
mov edx, dword [ecx]
mov edx, dword [edx]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, 1
sub esp, 0xc
leave
lea esp, [ecx - 4]
ret

Function at 0x64e01d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x64e01da0
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x64e01d98
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x64e06084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x64e01d5d
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x64e02470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x64e02648
mov edx, dword [0x64e06084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x64e02638
test byte [0x64e03040], 8
jne 0x64e025e0
lea edi, [esp + 0x28]
mov esi, edi
test byte [0x64e03050], 8
jne 0x64e025a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x64e024fb
cmp dword [ebp + 8], 3
jbe 0x64e02560
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x64e0250a
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x64e05278]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x64e024fb
mov dword [esp], 0x64e03050
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x64e024d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x64e024d0
mov dword [esp], 0x64e03040
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x64e024bd
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [esp + 0x28]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x64e024c3
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x64e02558

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xe124a4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe124ae
pushal
call 0xe124b4
pop ebp
sub ebp, 0x10
sub ebp, 0xa124a4
jmp 0xe124ca
mov eax, 0xa124a4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x1909dcbc
xor byte [eax], dl
inc eax
dec ecx
jne 0xe124e1
jmp 0xe124f4
aaa
jno 0xe1252e
xor eax, 0xbcbcbc80
cmp eax, 0xbcbc447d
mov esp, 0xb80471bf
mov esp, 0x9406bcbc
mov esp, 0x5e4bbcbc
mov edi, 0xb03d3774
mov esp, 0x79bfbcbc
xor eax, ebx
cwde
inc eax
xor eax, 0xd4ec98b8
xor al, 0x4a
mov dword [0x92a5d4bc], eax
cmp eax, 0x9890bdbc
cwde
aam 0x10
mov byte [0xb954ea87], al
mov esp, 0x8855bcbc
mov esp, 0xd831bcbc
cwde
inc eax
xor eax, 0xe1e89890
aaa
cmp dword [esp + edi*4 + 0x2937bcbc], esi
call 0xb51a5d2b
mov esp, 0x2937bcbc
mov al, 0xbc
mov esp, 0xac3137bc
mov esp, 0x557dbcbc
mov esi, 0x7e3fbe8d
mov eax, 0x4839b3f5
inc ebx
inc ebx
inc ebx
aaa
nop
cwde
xor eax, ebx
cwde
mov eax, 0x37bcb07e
xor byte [eax - 0x43434348], bl
aam 0x34
dec edx
mov dword [0x92a5d4bc], eax
cmp eax, 0x9890bdbc
in eax, dx
push esp
mov ecx, 0x55bcbcbc
std
mov esi, 0x31e9bcbc
rcr byte [eax - 0x4f36bc44], 1
inc ebx
leave
mov ah, 0x54
into
mov esp, 0x137bcbc
mov ah, 0xbc
mov esp, 0x3d758fbc
dec esi
mov bl, 0xb1
cmpsb byte [esi], byte es:[edi]
je 0xe125ed
dec esi
mov bl, 0xb1
cmpsb byte [esi], byte es:[edi]
je 0xe12545
outsb dx, byte [esi]
aas
push esp
mov ecx, 0xf238b3f4
mov esp, 0x34b3bcbc
hlt
inc ebx
xchg ebp, eax
invalid
Function at 0x4304c25f
Capabilities:
Hide graphical window

Disassembly:
cmp byte [edi + 0x30], 0
push esi
sete al
mov byte [edi + 0x30], al
lea esi, [edi + 4]
test al, al
je 0x4304c28c
push 5
push 0x1f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x2c]
jmp 0x4304c2a5
push 0
push 0x1f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x28]
call fcn.4305fe5f
xor eax, eax
pop esi
ret

Function at 0x4304eb37
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4306c86c], 0
jne 0x4304eb50
push 0x4304eb78
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x4306c86c], eax
cmp dword [0x4306c868], 0
jne 0x4304eb74
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4304eb9e
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4306c868], eax
ret

Function at 0x4305fc32
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4306c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x214], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jl 0x4305fcf8
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4305fc90
push esi
sub eax, edx
sar eax, 1
push ebx
mov esi, eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCommonPrefixW]
lea eax, [ebp - 0x210]
push eax
call edi
cmp eax, esi
jae 0x4305fcf0
lea esi, [ebp - 0x210]
call fcn.4305fe5f
test eax, eax
jne 0x4305fcf4
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4305fccb
sub eax, edx
sar eax, 1
push ebx
push dword [ebp - 0x214]
mov esi, eax
lea eax, [ebp - 0x210]
push eax
call edi
cmp eax, esi
jb 0x4305fcf4
xor eax, eax
jmp 0x4305fcf7
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.430364bf
leave
ret

Function at 0x4305fe5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4305fe6e
pop dword [ebp - 0x1c]
mov eax, 0x4305fe6e
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x38ec9
push 0
mov eax, 0xebefffb8
add eax, 0x57131170
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xf95074b1
sub ecx, 0xf95032ae
xor edx, edx
add edx, eax
mov ebx, 0xab64aa9a
sub ebx, 0x685d849a
add ebx, dword [ebp - 0x1c]
mov esi, 0x303ce3cf
xor dword [ebp - 0x14], 0x4bebc356
mov edi, dword [ebx]
xor dword [ebp - 4], esi
add edi, esi
sub dword [ebp - 8], 0x6ecab3b8
mov dword [edx], edi
sub dword [ebp - 0xc], edx
add edx, 4
add ebx, 0x6bdb06f3
add ebx, 0x9424f911
loop 0x4305fec4
add eax, 0xfadf
mov ebx, eax
add eax, 0x64be3306
add eax, 0x9b41ccff
mov ecx, 0x4cd9d631
sub ecx, 0x9d6d631
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x43060d56
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x43068466
call fcn.43065fef
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x224], edi
push 0x43061020
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x220], eax
cmp eax, edi
jne 0x43060d98
push 0x8007000e
call fcn.4305fe5f
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebx]
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 0xd
push 0x43061004
push edi
push 0x43043bac
push ebx
mov dword [ebp - 0x238], 0x104
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
call dword [eax + 0x38]
mov esi, eax
cmp esi, edi
jl 0x43060f86
mov ecx, dword [ebp - 0x228]
cmp word [ecx], 0x2e
mov eax, ecx
je 0x43060e23
xor edx, edx
mov esi, edx
sar esi, 1
cmp esi, dword [ebp - 0x21c]
jge 0x43060e23
add eax, 2
add edx, 2
cmp word [eax], 0x2e
jne 0x43060e0b
sub eax, ecx
sar eax, 1
push eax
push ecx
lea edi, [ebp - 0x220]
mov dword [ebp - 0x21c], eax
call fcn.4305fe5f
mov esi, eax
test esi, esi
js 0x43060f86
mov esi, 0x43044320
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
push eax
push esi
call fcn.4305fe5f
mov esi, eax
test esi, esi
js 0x43060f86
mov eax, dword [ebx]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 7
push 0x43060fe4
push 0
push 0x43043bac
push ebx
call dword [eax + 0x38]
mov esi, eax
test esi, esi
js 0x43060f86
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
call fcn.4305fe5f
mov esi, eax
test esi, esi
js 0x43060f86
mov eax, dword [ebx]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 0x10
push 0x43060fc0
push 0
push 0x43043bac
push ebx
call dword [eax + 0x38]
mov esi, eax
test esi, esi
js 0x43060f86
push dword [ebp - 0x21c]
lea edi, [ebp - 0x224]
push dword [ebp - 0x228]
call fcn.4305fe5f
mov esi, eax
test esi, esi
js 0x43060f86
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push dword [ebp - 0x220]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43060f84
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0x43060ff4
push dword [ebp - 0x22c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x43060f84
cmp dword [ebp - 0x230], 1
jne 0x43060f84
push dword [ebp - 0x224]
lea eax, [ebp - 0x218]
call fcn.4305fe5f
mov esi, eax
test esi, esi
js 0x43060f86
cmp esi, 1
je 0x43060f84
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x224]
mov ecx, dword [ecx + 8]
and dword [ebp - 0x224], 0
mov dword [ecx + 0x14], eax
jmp 0x43060f86
xor esi, esi
cmp dword [ebp - 0x22c], 0
je 0x43060f9b
push dword [ebp - 0x22c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push dword [ebp - 0x220]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [ebp - 0x224]
call edi
mov eax, esi
call fcn.43066025
ret 4
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402c00
pop dword [ebp - 0x40]
mov eax, 0xed8040
add eax, 0xff52abc0
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xc895f2f4
sub dword [ebp - 0x50], 0x7a43ada9
mov dword [ebp - 0x4c], 0x666849e
add dword [ebp - 0x4c], 0x2bccc7a7
mov dword [ebp - 0x48], 0xe9a0d686
sub dword [ebp - 0x48], 0x9d549258
mov dword [ebp - 0x44], 0xe4395ac8
sub dword [ebp - 0x44], 0xe4395ac8
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf54c8d7e
sub dword [ebp - 0x50], 0x80da2428
mov dword [ebp - 0x4c], 0x831cae8d
sub dword [ebp - 0x4c], 0x41b04d18
mov dword [ebp - 0x48], 0xd9a1b54f
sub dword [ebp - 0x48], 0x763248e3
mov dword [ebp - 0x44], 0x2ed6e0fc
add dword [ebp - 0x44], 0xd1291f04
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38942
push 0
call eax
mov ecx, 0x4f8f
mov edx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x40]
mov ebx, 0xd92e3a44
mov edi, dword [esi]
sub dword [ebp - 0x3c], esi
xor edi, ebx
add dword [ebp - 0xc], 0x2eac765f
mov dword [edx], edi
add dword [ebp - 0x38], eax
add edx, 4
add esi, 0x39eaec9e
add esi, 0xc6151366
loop 0x402d06
add eax, 0x1310f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x653c00e5
sub ecx, 0x64fc00e5
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x402880
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0
push ebx
push eax
call dword [0x40d044]
test eax, eax
je 0x4028da
push 0x40b111
push ebx
call fcn.004040f0
add esp, 8
mov esi, eax
test eax, eax
je 0x4028da
push esi
mov edx, 0x40e2c8
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4028bc
push eax
push 1
push 0x40e2c8
call fcn.00404500
add esp, 0x10
push esi
call fcn.004042c0
pop ecx
lea ecx, [ebp - 0x800]
mov edx, ebx
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4028e5
pop eax
lea edx, [ebp - 0x800]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4028f9
jmp 0x402903
dec eax
cmp byte [ebp + eax - 0x801], 0x5c
jne 0x402902
lea ecx, [ebp + eax - 0x800]
mov edx, 0x40b10e
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x40291c
pop eax
push 0x32
lea eax, [ebp - 0x400]
push eax
push 0x1002
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x40b10c
lea eax, [ebp - 0x800]
push eax
call fcn.004040f0
add esp, 8
mov esi, eax
test eax, eax
je 0x402976
lea eax, [ebp - 0x400]
push eax
push 0x40b109
push esi
call fcn.00404660
add esp, 0xc
push esi
call fcn.004042c0
pop ecx
push 0x40d093
push ebx
call fcn.00401d60
test eax, eax
je 0x402999
push 0x40d09f
push ebx
call fcn.00401740
test eax, eax
je 0x402999
call fcn.004020b0
cmp byte [0x40d0be], 0
jne 0x4029a8
push ebx
call fcn.00401cc0
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404780
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b5e4
push 0x405948
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x2000000
call fcn.00407c70
pop ecx
mov dword [0x40d27c], eax
call fcn.00404940
test eax, eax
jne 0x4047c7
push 1
call fcn.00405930
pop ecx
mov dword [ebp - 4], 0
call fcn.00405be0
call fcn.00405c50
call fcn.00405ca0
call fcn.00406080
call fcn.00406120
mov ebx, 0x40c4f8
jmp 0x4047f3
call dword [ebx]
add ebx, 4
cmp ebx, 0x40c4f8
jb 0x4047ee
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
call fcn.004061e0
test byte [ebp - 0x34], 1
je 0x404827
movzx edx, word [ebp - 0x30]
jmp 0x40482c
mov edx, 0xa
push edx
push eax
push 0
push ebx
call fcn.00402aa0
mov ebx, eax
mov esi, 0x40c4f8
jmp 0x404844
call dword [esi]
add esi, 4
cmp esi, 0x40c4f8
jb 0x40483f
push ebx
call fcn.00404720
pop ecx
jmp 0x40487d
or dword [ebp - 4], 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret