joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402954
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040406c
test esi, esi
jne 0x40298a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040415c
jmp 0x4029a8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402868
mov edi, eax
test esi, esi
je 0x4029a8
cmp dword [ebx], 0
je 0x4029a8
dec esi
jmp 0x402991
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e90
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x429008], 0x8088405
inc edx
mov dword [ebx + 0x429008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4033dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x429024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403474
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403454
xor eax, eax
push ebp
push 0x40344d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403490
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403454
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x429024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x429024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e74
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42a044], 0
je 0x403ed5
cmp word [0x42a218], 0xd7b2
jne 0x403e9d
cmp dword [0x42a220], 0
jbe 0x403e9d
mov eax, 0x42a214
call dword [0x42a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x429090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403efc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x429030], 0
jne 0x403ef1
push 0
push 0x429088
push 0x429090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404028
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402694
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x42a045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403ff0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4051fc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
Function at 0x405ab8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b1e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042dc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402fd0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b08
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b25
lea eax, [ebp - 0x10]
call fcn.0040406c
ret

Function at 0x4061e8
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x4290e8], 0
jne 0x4062ba
mov byte [0x4290e8], 1
xor eax, eax
mov dword [0x4290e0], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x406230
cmp dword [esp + 0x1c], 3
jne 0x406290
cmp dword [esp + 0x20], 0x33
jbe 0x406290
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x4062c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4062ba
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4062f4
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4062ba
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x4062ba
cmp byte [esp + 9], 0
jne 0x4062ba
jmp 0x4062a5
push 0
push 0x4062f4
push 0x4062fc
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x4062ba
mov eax, dword [0x4290dc]
call fcn.00404508
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4290e0], eax
add esp, 0xac
ret

Function at 0x406ba8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
xor eax, eax
push ebp
push 0x406c6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040406c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x406c59
mov eax, ebx
mov edx, 0x73
call fcn.00404638
push 0
lea eax, [ebp - 8]
push eax
push 0x73
mov eax, ebx
call fcn.00404560
push eax
push esi
call sub.kernel32.dll_ReadFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebx]
mov eax, 0x406c84
call fcn.004045f0
test eax, eax
jne 0x406c3a
mov eax, ebx
call fcn.0040406c
jmp 0x406c59
push ebx
mov edx, dword [ebx]
mov eax, 0x406c90
call fcn.004045f0
dec dword [ebx - 0x167cb638]
push eax
Function at 0x406c94
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
xor eax, eax
push ebp
push 0x406d3c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 4]
call fcn.00404508
fdivr st(7)
call dword [eax - 0x18]
invalid
invalid
invalid
dec dword [ebx - 0x17c10]
je 0x406d21
lea eax, [ebp - 8]
mov edx, 0x186a0
call fcn.00404638
push 0
lea eax, [ebp - 0xc]
push eax
push 0x186a0
lea eax, [ebp - 8]
call fcn.00404560
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x406d21
push esi
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 8]
mov eax, 0x406d54
call fcn.004045f0
test eax, eax
jle 0x406d21
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d43
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret

Function at 0x406d6c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x406dee
push dword fs:[eax]
mov dword fs:[eax], esp
xor bl, 1
neg bl
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test byte [ebp + 0x10], bl
je 0x406dd3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.004072a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406df5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret
Function at 0x407ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407d83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x42a6cc
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x42a6d0], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x42a6d0], eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d8a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret

Function at 0x407d94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407e58
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x42a6cc
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x42a6d0], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00404638
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
jne 0x407e2b
mov eax, dword [ebx]
call fcn.00404508
mov edx, eax
mov eax, ebx
call fcn.00404264
jmp 0x407e32
mov eax, ebx
call fcn.0040406c
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e5f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret
Function at 0x407e68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
mov eax, dword [ebp + 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407f3c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x42a6cc
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x42a6d0], eax
cmp dword [ebp + 8], 0
jne 0x407ed5
lea eax, [ebp + 8]
mov edx, 0x407f54
call fcn.00404104
mov eax, dword [ebp + 8]
call fcn.00404308
push eax
lea eax, [ebp + 8]
call fcn.00404560
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
sete bl
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f43
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
lea eax, [ebp + 8]
call fcn.0040406c
ret

Function at 0x407f58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov eax, dword [ebp - 8]
call fcn.004044f8
xor eax, eax
push ebp
push 0x407ffd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x42a6cc
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x42a6d0], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00404508
push eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x42a6d0], eax
cmp dword [0x42a6d0], 0
sete bl
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408004
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret

Function at 0x408010
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004044f8
xor eax, eax
push ebp
push 0x408092
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x4080a8
call fcn.00406e00
test al, al
jne 0x40807c
mov eax, dword [ebp - 4]
call fcn.00404508
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x42a6cc
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x42a6cc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408099
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x40813c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
Function at 0x408f40
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, 0x42ab30
xor eax, eax
push ebp
push 0x4091e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x4091f8
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x40920c
mov edx, 0x40921c
mov eax, 0x80000002
call fcn.00407e68
lea eax, [ebp - 8]
mov ecx, 0x4091f8
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x40920c
mov edx, 0x409254
mov eax, 0x80000001
call fcn.00407e68
mov eax, ebx
mov edx, 0x40929c
call fcn.004040c0
lea eax, [ebp - 0xc]
mov ecx, 0x4091f8
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x40920c
mov edx, 0x40934c
mov eax, 0x80000002
call fcn.00407e68
mov eax, ebx
mov edx, 0x40938c
call fcn.004040c0
lea eax, [ebp - 0x10]
mov ecx, 0x4093e0
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x40921c
mov ecx, 0x4093f4
mov eax, 0x80000001
call fcn.00407e68
mov eax, ebx
mov edx, 0x409404
call fcn.004040c0
lea eax, [ebp - 0x14]
mov ecx, 0x409454
mov edx, dword [0x42aaf8]
call fcn.00404354
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x409254
mov ecx, 0x409468
mov eax, 0x80000002
call fcn.00407e68
cmp byte [0x42ab78], 0
jne 0x4091c8
push 0
mov ecx, 0x409478
mov edx, 0x409490
mov eax, 0x80000002
call fcn.00407e68
push 0x4094c4
mov edx, 0x409490
mov ecx, 0x4094d4
mov eax, 0x80000002
call fcn.00407e68
push 0x4094ec
mov edx, 0x409490
mov ecx, 0x409524
mov eax, 0x80000002
call fcn.00407e68
mov eax, ebx
mov edx, 0x409538
invalid
invalid
mov al, 0xff
Function at 0x40d868
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x40d870
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov edi, 0x42ac8c
xor eax, eax
push ebp
push 0x40e5af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x42ab30
mov edx, 0x40e5c8
call fcn.004040c0
call fcn.00409d4c
mov eax, dword [ebp - 8]
call fcn.0040406c
xor ebx, ebx
mov eax, 0x42ab30
mov edx, 0x40e5e4
call fcn.004040c0
mov eax, dword [ebp - 4]
call fcn.00404308
cmp eax, 0x7f
jge 0x40d8ff
push 0
push 0x42ac00
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x42abac], eax
cmp dword [0x42abac], 0xffffffff
jne 0x40d932
mov ebx, 1
jmp 0x40d932
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404508
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x42abac], eax
cmp dword [0x42abac], 0xffffffff
jne 0x40d932
mov ebx, 2
test ebx, ebx
jbe 0x40d9a5
mov eax, 0x42ab30
mov edx, 0x40e698
call fcn.004040c0
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
cmp eax, 0xcf
ja 0x40d95c
bt dword [0x40e754], eax
jb 0x40d995
cmp ebx, 0x4cf
je 0x40d995
push 0x40e778
push dword [ebp - 4]
push 0x40e788
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0040780c
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004043c8
mov eax, dword [ebp - 0xc]
call fcn.0041b55c
mov eax, dword [0x42abac]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40e58c
mov eax, 0x42ab30
mov edx, 0x40e794
call fcn.004040c0
mov eax, 0x42abdc
call fcn.0040406c
mov eax, 0x42abe0
call fcn.0040406c
mov eax, 0x42abe4
call fcn.0040406c
xor eax, eax
mov dword [0x42abd0], eax
xor eax, eax
mov dword [0x42abd4], eax
mov eax, 0x42ab30
mov edx, 0x40e7e4
call fcn.004040c0
xor eax, eax
mov dword [0x42abd8], eax
xor eax, eax
mov dword [0x42abcc], eax
mov eax, 0x42abe8
mov edx, 0x12
call fcn.00404638
mov eax, 0x42abec
mov edx, 0x20
call fcn.00404638
mov eax, 0x42abf0
mov edx, 0x1a
call fcn.00404638
mov eax, 0x42abf4
mov edx, 0x2f
call fcn.00404638
mov eax, 0x42abf8
mov edx, 0x12
call fcn.00404638
mov eax, 0x42abfc
mov edx, 0x20
call fcn.00404638
mov eax, dword [edi]
mov byte [eax], 0
jmp 0x40e4bd
Function at 0x40f374
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x30
push 0
push 0
dec ecx
jne 0x40f37c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
Function at 0x40ff38
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40ff40
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x4101a2
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
push eax
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x410187
mov eax, 0x42ab30
mov edx, 0x4101b8
call fcn.004040c0
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.00402694
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402e70
Function at 0x411b6c
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x411bc8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x42ab30
mov edx, 0x411bdc
call fcn.004040c0
push 0
push 0
push 0x411bfc
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x411c1c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x42ab30
mov edx, 0x411c34
call fcn.004040c0
ret

Function at 0x4130ac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41316f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x42ab30
mov edx, 0x413188
call fcn.004040c0
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.004042dc
mov eax, 0x42ab30
mov edx, 0x413224
call fcn.004040c0
mov edx, dword [ebp - 4]
mov eax, 0x4132a0
call fcn.004045f0
test eax, eax
jne 0x413148
mov edx, dword [ebp - 4]
mov eax, 0x4132b0
call fcn.004045f0
test eax, eax
jne 0x413148
mov edx, dword [ebp - 4]
mov eax, 0x4132c4
call fcn.004045f0
test eax, eax
jne 0x413148
xor ebx, ebx
jmp 0x41314a
mov bl, 1
mov eax, 0x42ab30
mov edx, 0x4132dc
call fcn.004040c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413176
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x41337c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x413384
push ecx
push ebx
push esi
push edi
mov edi, 0x42ab30
xor eax, eax
push ebp
push 0x4136be
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [eax], esp

Function at 0x414dcc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x414dd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
mov ebx, 0x42ab30
mov esi, 0x42ab04
mov edi, 0x42ab7b
xor eax, eax
push ebp
push 0x415967
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x415980
mov edx, dword [ebp - 4]
call fcn.00404354
mov eax, dword [ebp - 0xc]
call fcn.00404508
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x414e35
sub eax, 1
jne 0x41594c
push dword [ebp - 4]
push 0x41598c
push 0x4159a0
lea eax, [ebp - 0x10]
invalid
Function at 0x4179d8
Capabilities:
Find taskbar
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, 0x42ab30
xor eax, eax
push ebp
push 0x417bc8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402954
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
Function at 0x41b55c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044f8
xor eax, eax
push ebp
push 0x41b653
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x42ab80], 0
jne 0x41b58e
call fcn.0041b438
push 2
push 0
push 0
mov eax, dword [0x42ab80]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x41b5a9
call fcn.0041b438
mov eax, 0x42ab30
mov edx, 0x41b66c
call fcn.004040c0
lea edx, [ebp - 0xc]
mov al, byte [0x42ab7a]
call fcn.004069e0
push dword [ebp - 0xc]
push 0x41b69c
push dword [ebp - 4]
push 0x41b6a8
lea eax, [ebp - 4]
mov edx, 4
call fcn.004043c8
mov eax, 0x42ab30
mov edx, 0x41b6b4
call fcn.004040c0
mov byte [0x42ab7a], 0
mov eax, 0x42ab30
mov edx, 0x41b700
call fcn.004040c0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404308
push eax
lea eax, [ebp - 4]
call fcn.00404560
push eax
mov eax, dword [0x42ab80]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x41b635
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b65a
lea eax, [ebp - 0xc]
call fcn.0040406c
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x41f638
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x41f671
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040415c
jmp 0x41f67a
mov eax, ebx
mov edx, esi
call fcn.004040c0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41f684
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x41f6a5
mov al, byte [esp]
jmp 0x41f6a7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41fd2c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x41fba4
mov eax, dword [0x4296c8]
cmp byte [eax], 0
je 0x41fda8
mov eax, dword [0x4295dc]
call fcn.00402d0c
call fcn.00402788
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0041cfec
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x41fdf0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41fdde
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4295b4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42a660]
call fcn.00405008
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret