joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6621f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66acf0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x759454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
mov dword [esi], vtable.WorkerThread.0
test eax, eax
je 0x662264
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x662254
call fcn.006545b0
push edi
push dword [esi + 0x38]
mov ecx, dword [eax]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push eax
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
lea ecx, [esi + 8]
call fcn.00659890
lea ecx, [esi + 8]
call fcn.00447d90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x662460
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
je 0x66248a
call fcn.006545b0
push dword [esi + 0x38]
push str.thread___d__is_already_running._Closing_it_first
mov edx, dword [eax]
push eax
call dword [edx + 4]
add esp, 0xc
mov ecx, esi
call fcn.006626b0
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x662290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x6624c6
call fcn.006545b0
push str.failed_to_create_a_new_thread._Fatal_Error
push 0x70c2fc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x662501
call fcn.006545b0
push str.thread_failed_to_resumed._fatal_error
push 0x70c2fc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [esi + 0x38], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6626b0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x6627b1
push edi
lea ecx, [esi + 8]
mov dword [esi + 0x34], 2
call fcn.00659880
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x662756
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [esi + 0x28]
xor edi, edi
cmp dword [eax + 8], 3
je 0x662756
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [esi + 0x28]
cmp dword [eax + 8], 5
je 0x662755
inc edi
cmp edi, 0x12c
jne 0x662725
call fcn.006545b0
mov ecx, dword [esi + 0x28]
mov edx, dword [eax]
push dword [ecx + 4]
push str.forcing_the_job___d__to_terminate.
push eax
call dword [edx + 0x14]
mov ecx, dword [esi + 0x28]
add esp, 0xc
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x66272d
cmp edi, 0x3e8
je 0x66273c
push 0xa
call ebx
mov eax, dword [esi + 0x28]
cmp dword [eax + 8], 3
jne 0x6626f0
jmp 0x662755
call fcn.006545b0
mov edx, dword [esi + 0x28]
mov edi, dword [eax]
push dword [edx + 4]
push str.job___d__is_still_not_terminated._Closing_the_thread_handle_now
push eax
call dword [edi + 0x14]
add esp, 0xc
pop ebx
lea ecx, [esi + 8]
call fcn.006598a0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x6627a9
push 0x61a8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x662799
call fcn.006545b0
push edi
push dword [esi + 0x38]
mov ecx, dword [eax]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push eax
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
mov dword [esi + 0x34], 3
pop edi
mov al, 1
pop esi
ret
Function at 0x664a80
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
jne 0x664ab2
sub esp, 0x18
mov ecx, esp
push 0x70c2fc
call fcn.004424d0
push 0
push 0x13
mov ecx, esi
call fcn.00665e10
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x664acd
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [esi + 0xb0], 0
mov eax, dword [esi + 0x24]
mov edi, 0x100
mov ecx, 0x800100
lea edx, [eax + 0x138]
cmp dword [eax + 0x154], 1
cmove edi, ecx
cmp dword [edx + 0x14], 8
jb 0x664af2
mov edx, dword [edx]
cmp dword [esi + 0x90], 8
lea eax, [esi + 0x7c]
jb 0x664b00
mov eax, dword [eax]
cmp dword [esi + 0xa8], 8
lea ecx, [esi + 0x94]
jb 0x664b11
mov ecx, dword [ecx]
push edi
push 0
push edx
push 0
push eax
push ecx
push dword [esi + 0xac]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0xb0], eax
test eax, eax
jne 0x664b5a
call fcn.006545b0
push str.createRequest_:_failed_to_open_the_request_handle
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.006655d0
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x664b70
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
je 0x664ccd
cmp byte [esi + 0x28], 0
je 0x664ccd
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
mov dword [ebx], 0
push dword [esi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x664be9
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
mov ecx, esi
call fcn.006655d0
call fcn.006545b0
mov esi, eax
mov edi, dword [esi]
call ebx
push eax
push str.Error__d_in_WinHttpQueryDataAvailable._n
push 0x70c2fc
push esi
call dword [edi + 0x24]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x14]
cmova ecx, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x664c06
lea eax, [ecx + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
je 0x664c66
push 0x70b48c
push ecx
call fcn.0066971b
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x664c63
call fcn.006545b0
push dword [ebp - 4]
push str.failed_to_allote_mmeory_of_size__d
mov ecx, dword [eax]
push 0x70c2fc
push eax
call dword [ecx + 0x24]
sub esp, 8
mov ecx, esp
push 0x70c2fc
call fcn.004424d0
push 0
push 0x14
mov ecx, esi
call fcn.00665e10
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
push ecx
push 0
push dword [edi]
call fcn.005ff380
add esp, 0xc
push ebx
push dword [ebp - 4]
push dword [edi]
push dword [esi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x664cba
call fcn.006545b0
push str.Error__u_in_WinHttpReadData._n
push 0x70c2fc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.006655d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.006545b0
push str.downloader_is_not_initialized
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x70c2fc
mov word [ecx], ax
call fcn.004426a0
push 0
push 0x13
mov ecx, esi
call fcn.00665e10
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x665130
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push edi
push 0
push eax
push 0
mov edi, ecx
mov dword [ebp - 4], 0
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x24
jne 0x66516c
cmp eax, 0x2f76
je 0x665179
cmp eax, 0x7a
je 0x665184
push eax
mov ecx, edi
call fcn.006655d0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
test eax, eax
jne 0x6651ae
call fcn.006545b0
push str.retrieveHeaderFromHttpRequest:_Zero_buffer_required....
push 0x70c2fc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push 0x70b48c
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0066971b
mov esi, eax
add esp, 8
test esi, esi
jne 0x66520d
call fcn.006545b0
push str.failed_to_allocate_memory
push 0x70c2fc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
sub esp, 0xc
mov ecx, esp
push str.Memory_Allocation_Failed
call fcn.004424d0
push esi
push 0x14
mov ecx, edi
call fcn.00665e10
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 4]
push eax
push esi
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x665249
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.006655d0
push esi
call fcn.005e9806
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00442420
push esi
call fcn.005e9806
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x665350
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push 0
push 0
push 0x16
push dword [edi]
mov dword [ebp - 4], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x6653d8
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005e97fd
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
push 0
push 0x16
push dword [edi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x6653ca
call fcn.006545b0
push esi
push str.Header_contents:__n_s
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
add esp, 0xc
test esi, esi
je 0x6653d7
push esi
call fcn.005e9806
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
call fcn.004ae000
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call fcn.004023aa
movzx esi, ax
push 2
call fcn.004050e3
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call fcn.004022c5
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call fcn.004022c5
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call fcn.004022c5
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call fcn.0040520c
mov dword [0x414430], eax
call fcn.00404bb8
test eax, eax
jns 0x40223b
push 8
call fcn.00404638
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call fcn.00404638
pop ecx
push 1
call fcn.00404672
pop ecx
test eax, eax
je 0x40225f
push eax
call fcn.00404638
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call fcn.004048db
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret
Function at 0x10001390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10005959
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
mov eax, dword [0x1000b024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0x10], 1
push eax
call dword [sym.imp.Framework.dll_public:_static_class_AkProductInfo____cdecl_AkProductInfo::instance_void_]
mov ecx, eax
call dword [sym.imp.Framework.dll_public:_class_QString___thiscall_AkProductInfo::GUID_void_]
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____thiscall_QString::utf16_void_const]
push eax
push str.SoftwareClassesCLSID_ls
push 0x1000b138
call fcn.100025b0
add esp, 0xc
lea eax, [ebp - 0x1c]
push 0
push eax
push 0
push 0x2011f
push 0
push 0
push 0
push 0x1000b138
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
sete bl
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
test bl, bl
je 0x1000147f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 1
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], 4
push eax
push 0
push str.CEIP
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001476
cmp dword [ebp - 0x14], 4
jne 0x10001476
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp dword [ebp - 0x18], ecx
movzx eax, al
cmove eax, ecx
mov dword [ebp - 0x10], eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], esi
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10002fa7
pop ebp
out dx, eax
invalid

Function at 0x10003ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
call fcn.10002f85
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10002fb7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10002f6c
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10002fa7
add byte [eax + 0xe], cl
pop ecx
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.10002fa7
insb byte es:[edi], dx
mov ebp, 0x6580efbb
loopne 0x10003fc5
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov dh, 0xc6
inc ebp
call 0xf946066f
pop esi
inc ebp
ljmp 0xc6b2
inc ebp
in al, dx
add esi, 0x45
in eax, dx
xchg esi, eax
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.10002fb7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10002f6c
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x10004053
mov eax, dword [ebp - 0x28]
dec eax

Function at 0x10004af4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x77c]
push eax
call fcn.10002fb7
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.10002f18
add esp, 0xc
lea eax, [ebp - 0x504]
mov dword [ebp - 0x3a0], eax
jmp 0x10004f1f
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.10002fa7
invalid
Function at 0x403714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41201c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037ac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40378c
xor eax, eax
push ebp
push 0x403785
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40378c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x41201c]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41201c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41304c], 0
je 0x404551
cmp word [0x413328], 0xd7b2
jne 0x404519
cmp dword [0x413330], 0
jbe 0x404519
mov eax, 0x413324
call dword [0x413340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40457c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x412028], 0
jne 0x40456d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40699c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00406988
add esp, 0x208
pop ebx
ret

Function at 0x408eb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408eed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408ef6
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408f00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
jmp loc.0042f468

Function at 0x4096ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4097d1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004094c0
mov esi, eax
mov eax, dword [0x412c2c]
cmp byte [eax], 0
je 0x409779
mov eax, dword [0x412b68]
call fcn.0040317c
call fcn.00402f6c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x409688]
call fcn.00405ad8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4097ec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4097b5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x412b48]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415b48]
call fcn.00405b90
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4097d8
lea eax, [ebp - 4]
mov edx, dword [0x409688]
call fcn.00405ae4
ret
Function at 0x40aa03
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40aa26
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40aa28
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40aa61
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40aa4b
mov eax, esp
cmp esi, eax
je 0x40aa6e
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40aaa8
cmp bl, 0
je 0x40aaa4
cmp bl, 0x41
jl 0x40aa9f
cmp bl, 0x5a
jg 0x40aa9f
or bl, 0x20
xor al, bl
inc esi
jmp 0x40aa83
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a9e8

Function at 0x40b698
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b6de
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b62c
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b6e5
jmp loc.0042f2d8

Function at 0x40b89c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x40b8ed
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW_1
lea edx, [ebp - 4]
jmp loc.00428e10

Function at 0x40b8fc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b993
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40b947
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00404dd4
jmp 0x40b97d
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40b960
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404cec
jmp 0x40b973
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b7bc
mov ebx, eax
test esi, esi
je 0x40b973
dec esi
jmp 0x40b94e
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b99a
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b9a4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
jmp loc.0042e338