joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401722
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x411b2a
call fcn.0040a93d
push 0x415794
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], 1
call fcn.00403120
sub esp, 0x20
lea ebx, [ebp + 0x28]
mov esi, esp
mov dword [ebp - 0x10], esp
call fcn.004029b0
lea ebx, [ebp + 8]
call fcn.00402f10
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.0040df80
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x68], esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401793
mov bl, 1
lea esi, [ebp + 8]
call fcn.00402ad0
lea esi, [ebp + 0x28]
call fcn.00402ad0
mov al, bl
call fcn.0040a9dc
ret

Function at 0x4017ab
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x41197e
call fcn.0040a93d
and dword [ebp - 4], 0
lea esi, [ebp + 8]
call fcn.00403460
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x10]
push ecx
mov ebx, 0xf003f
push ebx
push 0
push eax
mov edi, 0x80000001
push edi
mov dword [ebp - 0x14], eax
call esi
test eax, eax
jne 0x40180c
mov eax, dword [ebp + 0x2c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4017eb
sub eax, edx
sar eax, 1
add eax, eax
push eax
push dword [ebp + 0x2c]
push 1
push 0
push dword [ebp + 0x28]
push dword [ebp - 0x10]
jmp 0x401854
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x415798
push edi
call esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x401867
mov eax, dword [ebp + 0x2c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401835
sub eax, edx
sar eax, 1
add eax, eax
push eax
push dword [ebp + 0x2c]
push 1
push 0
push dword [ebp + 0x28]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401867
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp + 8]
call fcn.00402ad0
call fcn.0040a9dc
ret
Function at 0x40187e
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x41195b
call fcn.0040a93d
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x30]
lea esi, [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.00403460
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp + 0x30]
push ecx
mov edi, 0xf003f
push edi
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call esi
test eax, eax
jne 0x4018cc
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push dword [ebp + 0x2c]
push dword [ebp + 0x30]
jmp 0x4018ff
lea eax, [ebp + 0x30]
push eax
push edi
push ebx
push 0x415798
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x401912
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push dword [ebp + 0x2c]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401912
push dword [ebp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp + 0xc]
call fcn.00402ad0
call fcn.0040a9dc
ret

Function at 0x401998
Capabilities:
Get user security identifier

Disassembly:
push 0x1c
mov eax, 0x4118ee
call fcn.0040a970
xor esi, esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push esi
xor ebx, ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
jne 0x401a2d
push dword [ebp - 0x18]
call fcn.00409a90
mov ebx, eax
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
mov dword [ebp - 0x28], ebx
call fcn.00409a90
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
cmp ebx, esi
je 0x401a12
cmp eax, esi
je 0x401a12
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
push esi
call edi
test eax, eax
jne 0x401a19
push esi
push esi
call fcn.0040b15b
mov dword [ebp - 0x20], 1
jmp 0x401a2d
cmp dword [ebp - 0x1c], esi
je 0x401a3b
push dword [ebp - 0x1c]
call fcn.00409781
pop ecx
cmp dword [ebp - 0x20], esi
jne 0x401a4d
cmp ebx, esi
je 0x401a52
push ebx
call fcn.00409781
pop ecx
jmp 0x401a52
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
cmp dword [ebp - 0x20], esi
setne al
call fcn.0040a9dc
ret
Function at 0x401a5e
Capabilities:
Check os version
Get session user name

Disassembly:
push 0x23c
mov eax, 0x411c01
call fcn.0040a9a6
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x118], 2
jne 0x401bc2
cmp dword [ebp - 0x124], 5
jne 0x401ab4
cmp dword [ebp - 0x120], 1
je 0x401bc2
cmp dword [ebp - 0x120], 2
je 0x401bc2
push 3
push str.2500
sub esp, 0x20
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
mov esi, esp
mov dword [ebp - 0x220], esp
call fcn.00402910
push 0x80000001
call fcn.0040187e
add esp, 0x2c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0040df80
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x224], 0x7d0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00401998
pop ecx
pop ecx
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
sub esp, 0x20
mov ebx, str.SoftwareMicrosoftInternet_ExplorerMain
mov esi, esp
mov dword [ebp - 0x21c], esp
call fcn.00402a40
and dword [ebp - 4], 0
mov ebx, dword [ebp - 0x220]
sub esp, 0x20
mov esi, esp
mov dword [ebp - 0x228], esp
call fcn.00402a40
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x248]
push eax
call fcn.00401929
add esp, 0x44
push 1
push str.NoProtectedModeBanner
sub esp, 0x20
lea ebx, [ebp - 0x248]
mov esi, esp
mov dword [ebp - 4], 1
mov dword [ebp - 0x228], esp
call fcn.004029b0
push 0x80000003
call fcn.0040187e
add esp, 0x2c
mov esi, ebx
call fcn.00402ad0
call fcn.0040a9f0
ret

Function at 0x40229b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4191e4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.0040df80
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x210], 0x7d0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ebx, [ebp - 0x20c]
call fcn.00402910
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004092b4
leave
ret

Function at 0x402310
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0x320
mov eax, 0x41192b
call fcn.0040a9a6
and dword [ebp - 0x324], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x31c], ax
lea eax, [ebp - 0x31a]
mov esi, ecx
push eax
mov dword [ebp - 0x32c], esi
call fcn.0040df80
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x31c]
push eax
mov dword [ebp - 0x328], 0x7d0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, esi
call fcn.004027b0
and dword [ebp - 4], 0
mov al, byte [ebp - 0x114]
mov byte [ebp - 0x320], al
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x324], 1
mov byte [ebp - 0x31f], 0
call fcn.00402b20
mov eax, esi
call fcn.0040a9f0
ret
Function at 0x402432
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x411c63
call fcn.0040a93d
sub esp, 0x20
lea ebx, [ebp + 8]
mov esi, esp
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], esp
call fcn.004029b0
call fcn.00403a20
add esp, 0x20
lea esi, [ebp + 0x28]
call fcn.004033c0
mov esi, ebx
mov edi, eax
call fcn.004033c0
push edi
mov ecx, eax
call fcn.004040de
pop ecx
call fcn.00403460
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00402ad0
lea esi, [ebp + 0x28]
call fcn.00402ad0
call fcn.0040a9dc
ret

Function at 0x4036e0
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4191e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push esi
call fcn.00403630
add esp, 4
cmp al, 1
jne 0x40371b
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004092b4
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x210]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403725
lea eax, [ebp - 0x210]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403738
sub eax, edx
mov cl, byte [ebp + eax - 0x211]
lea eax, [ebp + eax - 0x211]
cmp cl, 0x5c
je 0x403759
cmp cl, 0x2f
jne 0x40375c
mov byte [eax], 0
lea eax, [ebp - 0x210]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403765
sub eax, edx
mov esi, eax
push 0x100
lea eax, [ebp - 0x108]
push 0
push eax
mov dword [ebp - 0x218], esi
call fcn.0040df80
add esp, 0xc
xor ebx, ebx
test esi, esi
jle 0x403868
mov byte [ebp - 0x213], bl
mov al, byte [ebp + ebx - 0x210]
cmp al, 0x5c
je 0x4037cf
mov byte [ebp - 0x214], al
lea eax, [ebp - 0x214]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4037b5
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4037c5
jmp 0x40381b
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4037f4
push 0x80
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x214]
mov byte [ebp - 0x214], 0x5c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403803
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403813
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x218]
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
cmp ebx, eax
jne 0x40385b
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40385b
push 0x80
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
inc ebx
cmp ebx, dword [ebp - 0x218]
jl 0x40379c
lea edx, [ebp - 0x108]
push edx
call fcn.00403630
xor ecx, ecx
add esp, 4
test al, al
setne cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004092b4
mov esp, ebp
pop ebp
ret
Function at 0x404682
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x4046ca
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x40469b
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x4046cf
test ecx, ecx
je 0x4046ca
test edi, edi
jne 0x404690
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4046cc

Function at 0x406596
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x40659e
mov dword [ecx*4 + 0x842040], eax
inc ecx
cmp ecx, 0x100
jb 0x406599
mov edx, 0x800
jmp 0x4065eb
mov eax, dword [ecx*4 + 0x841c40]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x842040]
inc ecx
mov dword [ecx*4 + 0x84203c], eax
cmp ecx, edx
jb 0x4065ca
mov dword [0x840e58], 0x406ebe
call fcn.00407020
test eax, eax
jne 0x40660c
mov dword [0x840e58], 0x406f5a
pop esi
ret
Function at 0x407429
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x407440
leave
ret
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x40745f
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x407464
inc edi
cmp edi, dword [ebp - 8]
jb 0x407456
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x407553
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x4074e6
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x407490
cmp cl, 0xff
jne 0x407515
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
lea ebx, [esi - 5]
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x407526
movzx esi, byte [edx + 0x4170c8]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
mov cl, bl
test cl, cl
je 0x4074d6
cmp cl, 0xff
jne 0x407523
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x4074ae
dec ecx
shl edx, cl
and edx, 7
je 0x40747d
movzx ecx, byte [edx + 0x4170c8]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x4170c0], 0
mov cl, byte [ebx + 4]
je 0x407512
test cl, cl
je 0x407512
cmp cl, 0xff
jne 0x40747d
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x407451
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x407451
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x4092b4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4191e4]
jne 0x4092be
repz ret
jmp fcn.0040b28d

Function at 0x4099c6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4099ed
call fcn.0040b4fb
mov dword [eax], esi
call fcn.0040b4e8
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040bd19
mov eax, esi
jmp 0x409a42
test dword [ebp + 0xc], 0xfffffff9
jne 0x4099d3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x409a1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b50e
pop ecx
call fcn.0040b4e8
mov eax, dword [eax]
jmp 0x409a42
test al, 0x10
jne 0x409a40
test al, 1
je 0x409a40
test byte [ebp + 0xc], 2
je 0x409a40
call fcn.0040b4fb
mov dword [eax], 5
call fcn.0040b4e8
mov dword [eax], 0xd
jmp 0x409a11
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4102dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4191e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ca39
and dword [ebp - 0x14], 0
cmp dword [0x440648], 0
mov dword [ebp - 0x18], eax
jne 0x41038f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410437
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4156dc
push ebx
call edi
test eax, eax
je 0x410437
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x440648], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44064c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x440650], eax
call edi
push eax
call esi
mov dword [0x440658], eax
test eax, eax
je 0x41038f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x440654], eax
mov eax, dword [0x440654]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4103e8
cmp dword [0x440658], ecx
je 0x4103e8
push eax
call esi
push dword [0x440658]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4103e8
test ebx, ebx
je 0x4103e8
call edi
test eax, eax
je 0x4103df
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4103df
test byte [ebp - 8], 1
jne 0x4103e8
or dword [ebp + 0x10], 0x200000
jmp 0x41041b
mov eax, dword [0x44064c]
cmp eax, dword [ebp - 0x18]
je 0x41041b
push eax
call esi
test eax, eax
je 0x41041b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41041b
mov eax, dword [0x440650]
cmp eax, dword [ebp - 0x18]
je 0x41041b
push eax
call esi
test eax, eax
je 0x41041b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x440648]
call esi
test eax, eax
je 0x410437
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410439
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004092b4
leave
ret
Function at 0x402bf4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004042ec
test esi, esi
jne 0x402c2a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004043dc
jmp 0x402c48
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402b08
mov edi, eax
test esi, esi
je 0x402c48
cmp dword [ebx], 0
je 0x402c48
dec esi
jmp 0x402c31
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40333c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4cc020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033b4
xor eax, eax
push ebp
push 0x4033ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4cc020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4cc020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404170
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ce04c], 0
je 0x4041d1
cmp word [0x4ce220], 0xd7b2
jne 0x404199
cmp dword [0x4ce228], 0
jbe 0x404199
mov eax, 0x4ce21c
call dword [0x4ce238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4cc06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041f8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4cc030], 0
jne 0x4041ed
push 0
push 0x4cc064
push 0x4cc06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4065cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406632
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040455c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402edc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40661c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406639
lea eax, [ebp - 0x10]
call fcn.004042ec
ret

Function at 0x40bd30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bd69
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004043dc
jmp 0x40bd72
mov eax, ebx
mov edx, esi
call fcn.00404340
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bd7c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bd9d
mov al, byte [esp]
jmp 0x40bd9f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c424
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c29c
mov eax, dword [0x4cde04]
cmp byte [eax], 0
je 0x40c4a0
mov eax, dword [0x4cdb98]
call fcn.00402d0c
call fcn.00402a34
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004093e4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c4e8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c4d6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4cdb2c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4ce668]
call fcn.00405ac4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret