joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4350d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x415da0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x415dd0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x415dd0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x415ea8
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x415df9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x415e05
movsx eax, bl
jmp 0x415e3d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x415e67
sub eax, 1
je 0x415e67
sub eax, 2
jne 0x415ea8
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x415e85
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x415ea8
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424160
mov esp, ebp
pop ebp
ret 4
Function at 0x4163f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4350d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4164b8
cmp byte [edi + 0x3d], 0
je 0x4164b8
mov eax, dword [edi]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
cmp eax, 0xffffffff
je 0x4164a6
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x41646d
sub eax, 1
je 0x416471
sub eax, 2
jne 0x4164a6
mov byte [edi + 0x3d], al
mov al, 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x41648f
push dword [edi + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x4164a6
cmp byte [edi + 0x3d], 0
pop esi
sete al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.00424160
mov esp, ebp
pop ebp
ret
Function at 0x416a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
test ecx, ecx
jne 0x416a3c
cmp byte [0x436534], 1
jne 0x416b00
push str.Handle_for_the_named_pipe_is_NULL__returning.
push 0x4363d0
call fcn.0040abd0
add esp, 8
mov ecx, eax
push 0x40b0a0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push 0xa00000
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [0x436534], 1
jne 0x416b00
push str.Inside_readDataFromNamedPipe
push 0x4363d0
call fcn.0040abd0
add esp, 8
mov ecx, eax
push 0x40b0a0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push str.No_of_bytes_read_
push 0x4363d0
call fcn.0040abd0
add esp, 8
mov ecx, eax
push dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push 0x40b0a0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push str.Data_read_is_:
push 0x4363d0
call fcn.0040abd0
add esp, 8
mov ecx, eax
push esi
push 0x40b0a0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push eax
call fcn.0040abd0
add esp, 8
mov ecx, eax
push 0x40b0a0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov ecx, 0x4363d4
call fcn.00409c70
test eax, eax
jne 0x416b00
push eax
mov eax, dword [0x4363d0]
push 2
mov ecx, dword [eax + 4]
add ecx, 0x4363d0
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool_]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a430
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4278ee
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4350d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 1
mov ebx, dword [ebp + 8]
push ebx
call fcn.0041a5b0
add esp, 4
mov eax, dword [ebx]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
cmp dword [eax - 0xc], 0
je 0x41a4d6
push str.crashlogs
mov ecx, ebx
call fcn.0041a180
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.0040a2c0
add esp, 4
lea esi, [eax + 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a4b2
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41a4d6
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a4f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4278ee
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4350d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 1
mov ebx, dword [ebp + 8]
push ebx
call fcn.0041a5b0
add esp, 4
mov eax, dword [ebx]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
cmp dword [eax - 0xc], 0
je 0x41a596
push str.dumps
mov ecx, ebx
call fcn.0041a180
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.0040a2c0
add esp, 4
lea esi, [eax + 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a572
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41a596
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ae20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427ac6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4350d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
call fcn.0041a5b0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
cmp dword [eax - 0xc], 0
je 0x41ae7f
push str.windowsclient
lea ecx, [ebp - 0x10]
call fcn.0041a180
mov eax, dword [ebp - 0x10]
or esi, 0xffffffff
mov dword [ebp - 4], 1
cmp dword [eax - 0xc], 0
je 0x41aee2
push str.generatecrlogornot.txt
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call 0x4090e0
add esp, 0xc
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x18]
mov ebx, eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41aeda
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
or esi, 0xffffffff
test ebx, ebx
je 0x41aee2
mov bl, 1
jmp 0x41aee4
xor bl, bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x41af08
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41af20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push 0
push dword [ebp + 8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41af64
push esi
push edi
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
pop edi
pop esi
pop ebp
ret
Function at 0x421dc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428843
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4350d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
push ecx
mov edi, esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xff
mov dword [ebp - 0x120], edi
call fcn.00401670
mov ebx, eax
test ebx, ebx
je 0x421fe5
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x42948c]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
push str.CRLogProductPreferences
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00409ee0
test al, al
jne 0x421e62
push 0x18
push str.CRLogProductPreferences
mov ecx, edi
call fcn.0040a3b0
lea eax, [ebp - 0x11c]
mov byte [ebp - 4], 0
push eax
call fcn.00422280
add esp, 8
test al, al
jne 0x421e8f
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jmp 0x421fb3
mov esi, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x421f1b
mov eax, dword [ebp - 0x118]
mov ecx, 0xff
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
mov dword [ebp - 0x118], eax
cmovl ecx, eax
cmp ecx, 0x100
jae 0x421fef
lea eax, [ebp - 0x110]
mov byte [ebp + ecx - 0x110], 0
push eax
push 0x42b438
push dword [ebp - 0x114]
call int.0040aa00
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jmp 0x421fb3
or ebx, 0xffffffff
cmp eax, 2
jne 0x421f9e
push str.0_1_100
lea ecx, [ebp - 0x114]
call int.004095f0
mov eax, dword [ebp - 0x114]
mov byte [ebp - 4], 2
cmp dword [eax - 4], 1
mov ecx, dword [eax - 0xc]
lea edi, [ecx*2 + 1]
jle 0x421f5f
push ecx
lea ecx, [ebp - 0x114]
call fcn.0040a5a0
mov eax, dword [ebp - 0x114]
push edi
push eax
push 1
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x114]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x421f9e
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov esi, dword [ebp - 0x11c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x421fc9
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401320
call fcn.00424b53
int3
Function at 0x422000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4288b9
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x4350d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x428], 1
mov dword [ebp - 4], 0
call fcn.00401670
mov edi, eax
test edi, edi
je 0x42226b
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebx], eax
push ecx
mov ecx, esp
mov dword [ebp - 4], 1
push str.CRLog
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x430], 0x400
call fcn.004094f0
lea eax, [ebp - 0x42c]
push eax
call fcn.00422280
add esp, 8
test al, al
jne 0x4220be
mov ecx, ebx
call fcn.00409740
jmp 0x42224d
mov edi, dword [ebp - 0x42c]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push str.GUID
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422126
lea eax, [ebp - 0x410]
push eax
push 0x42b438
push ebx
call int.0040aa00
add esp, 8
mov esi, esp
mov dword [ebp - 0x424], esi
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.0040a2c0
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.00422400
add esp, 4
test al, al
jne 0x422246
push 0x42aca8
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], 2
call fcn.004094f0
lea eax, [ebp - 0x420]
mov dword [ebp - 0x428], 3
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x4221c2
movzx eax, byte [ebp - 0x411]
push eax
movzx eax, byte [ebp - 0x412]
push eax
movzx eax, byte [ebp - 0x413]
push eax
movzx eax, byte [ebp - 0x414]
push eax
movzx eax, byte [ebp - 0x415]
push eax
movzx eax, byte [ebp - 0x416]
push eax
movzx eax, byte [ebp - 0x417]
push eax
movzx eax, byte [ebp - 0x418]
push eax
movzx eax, word [ebp - 0x41a]
push eax
movzx eax, word [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x424]
push str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
push eax
call int.0040aa00
add esp, 0x34
lea eax, [ebp - 0x424]
mov ecx, ebx
push eax
call fcn.00409440
mov ecx, dword [ebp - 0x424]
or eax, 0xffffffff
mov dword [ebp - 0x428], 1
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x42220e
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42948c]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x42c]
mov eax, dword [ebx]
cmp dword [eax - 4], 1
mov ecx, dword [eax - 0xc]
lea esi, [ecx*2 + 1]
jle 0x422228
push ecx
mov ecx, ebx
call fcn.0040a5a0
push esi
push dword [ebx]
push 1
push 0
push str.GUID
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x422246
mov ecx, ebx
call fcn.00409740
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424160
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401320
int3
Function at 0x423daa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00423d86
pop esi
leave
ret 8

Function at 0x424f63
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x424fa2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x424fa2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x424fa2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x424fa2
cmp dword [ecx + 0x74], 0xe
jbe 0x424fa2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402f94
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x46f008], 0x8088405
inc edx
mov dword [ebx + 0x46f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403704
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46f024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40379c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40377c
xor eax, eax
push ebp
push 0x403775
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40377c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x46f024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46f024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4045a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x471048], 0
je 0x404609
cmp word [0x47121c], 0xd7b2
jne 0x4045d1
cmp dword [0x471224], 0
jbe 0x4045d1
mov eax, 0x471218
call dword [0x471234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404630
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46f030], 0
jne 0x404625
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405ae4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d14
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405b67
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d14
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405b67
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d30
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405bf0
xor eax, eax
push ebp
push 0x405be9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405920
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405bce
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405d50
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405bce
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bf0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405d0a
cmp byte [ebp - 0xd], 0
jne 0x405c37
cmp byte [ebp - 0x12], 0
je 0x405d0a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405c50
dec ebx
cmp byte [ebx], 0x2e
je 0x405c5f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c4f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405d0a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c9c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d0a
cmp byte [ebp - 0xd], 0
je 0x405d0a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d0a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret