joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40abb0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a6a8]
jne 0x40abba
repz ret
jmp fcn.00411c3c

Function at 0x417d2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f6c5
and dword [ebp - 0x14], 0
cmp dword [0x461bdc], 0
mov dword [ebp - 0x18], eax
jne 0x417ddf
push 0x403824
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417e87
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403818
push ebx
call edi
test eax, eax
je 0x417e87
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403808
push ebx
mov dword [0x461bdc], eax
call edi
push eax
call esi
push 0x4037f4
push ebx
mov dword [0x461be0], eax
call edi
push eax
call esi
push 0x4037d8
push ebx
mov dword [0x461be4], eax
call edi
push eax
call esi
mov dword [0x461bec], eax
test eax, eax
je 0x417ddf
push 0x4037c0
push ebx
call edi
push eax
call esi
mov dword [0x461be8], eax
mov eax, dword [0x461be8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417e38
cmp dword [0x461bec], ecx
je 0x417e38
push eax
call esi
push dword [0x461bec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417e38
test ebx, ebx
je 0x417e38
call edi
test eax, eax
je 0x417e2f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x417e2f
test byte [ebp - 8], 1
jne 0x417e38
or dword [ebp + 0x10], 0x200000
jmp 0x417e6b
mov eax, dword [0x461be0]
cmp eax, dword [ebp - 0x18]
je 0x417e6b
push eax
call esi
test eax, eax
je 0x417e6b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417e6b
mov eax, dword [0x461be4]
cmp eax, dword [ebp - 0x18]
je 0x417e6b
push eax
call esi
test eax, eax
je 0x417e6b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x461bdc]
call esi
test eax, eax
je 0x417e87
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417e89
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040abb0
leave
ret
Function at 0x422630
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00421970
cmp dword [0x802960], 0x37
jne 0x4226e5
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404480
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4044b0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov ecx, dword [0x802964]
mov eax, dword [0x7fedd0]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1004
ret
Function at 0x4027b8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027c6
call dword [0x48901c]
or eax, eax
je 0x4027c7
ret
mov al, 1
jmp fcn.00402844

Function at 0x4027d0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027de
call dword [0x489020]
or eax, eax
jne 0x4027df
ret
mov al, 2
jmp fcn.00402844

Function at 0x4027e8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402820
test edx, edx
je 0x40280a
push eax
mov eax, ecx
call dword [0x489024]
pop ecx
or eax, eax
je 0x402819
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402844
mov dword [eax], edx
mov eax, ecx
call dword [0x489020]
or eax, eax
jne 0x402803
ret
mov al, 1
jmp fcn.00402844
test edx, edx
je 0x402834
push eax
mov eax, edx
call dword [0x48901c]
pop ecx
or eax, eax
je 0x402819
mov dword [ecx], eax
ret

Function at 0x402844
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x48b004]
test ecx, ecx
je 0x402854
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40286d]
jns 0x402868
call fcn.0040731c
mov eax, dword [eax + 4]
jmp fcn.00403be0

Function at 0x4029cc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029fb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cd0
jmp 0x402a19
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402954
mov edi, eax
test ebx, ebx
je 0x402a19
cmp dword [esi], 0
je 0x402a19
dec ebx
jmp 0x402a02
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402dd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e6c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e4c
xor eax, eax
push ebp
push 0x402e45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4030ec
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x403106
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x403106
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4030f2
mov al, 0xa
jmp fcn.00402844
ret

Function at 0x403138
Capabilities:
Terminate process

Disassembly:
cmp dword [0x48b01c], 0
je 0x402a8b
call dword [0x48b01c]
mov eax, 0xd2
jmp fcn.00403be0
push eax
push ecx
mov eax, dword [eax]
call fcn.00403108
pop ecx
pop eax
je 0x403147
jmp ebx
pop ecx
jmp 0x402a7c
Function at 0x403150
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00403108
mov eax, ebx
pop ebx
jne 0x403165
pop ecx
jmp 0x402a7c
ret

Function at 0x403abc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x48b4a4
mov esi, 0x48b038
mov edi, 0x48b03c
cmp byte [ebx + 0x24], 0
jne 0x403aeb
cmp dword [edi], 0
je 0x403aeb
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403ada
cmp dword [0x48b040], 0
je 0x403b32
call fcn.00403a38
cmp byte [0x48b048], 0
je 0x403b18
mov edx, 0x48902c
mov eax, 0x48b21c
call fcn.00406bb8
call fcn.00406b3b
jmp 0x403b2b
push 0
push 0x48904c
push 0x48902c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x48b040], eax
cmp byte [ebx + 0x24], 2
jne 0x403b42
cmp dword [esi], 0
jne 0x403b42
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004038f0
cmp byte [ebx + 0x24], 1
jbe 0x403b52
cmp dword [esi], 0
je 0x403b6f
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403b6f
call fcn.00406574
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403b6f
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.004038c8
cmp byte [ebx + 0x24], 1
jne 0x403b7d
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403b88
call fcn.00403a88
cmp dword [ebx], 0
jne 0x403b95
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403b32

Function at 0x404250
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402844
test edx, edx
je fcn.00404214
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404214
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x4041fc
ret

Function at 0x4042f8
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
je fcn.00404214
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4041fc
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x40434c
Capabilities:
Terminate process

Disassembly:
xor ecx, ecx
test edx, edx
je 0x40437f
push edx
cmp cx, word [edx]
je 0x404378
cmp cx, word [edx + 2]
je 0x404375
cmp cx, word [edx + 4]
je 0x404372
cmp cx, word [edx + 6]
je 0x40436f
add edx, 8
jmp 0x404353
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp fcn.004042f8

Function at 0x404480
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x404494
push eax
push 0
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4041fc
ret

Function at 0x40452c
Capabilities:
Terminate process

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x40454a
push eax
mov ecx, dword [edx - 4]
shr ecx, 1
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
pop edx
test eax, eax
je 0x4041fc
mov dword [edx], eax
ret
Function at 0x404578
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4045b7
cmp al, 0xb
je 0x4045b7
cmp al, 0xc
je 0x4045c1
cmp al, 0xd
je 0x4045d4
cmp al, 0xe
je 0x4045f2
cmp al, 0xf
je 0x4045b7
cmp al, 0x11
je 0x4045b7
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402844
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4045b7
jmp 0x404606
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4045c1
jmp 0x404606
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404578
dec edi
jg 0x4045d7
pop ebp
jmp 0x404606
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.0040454c
dec edi
jg 0x4045f5
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40460c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404578

Function at 0x404644
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x40468b
cmp al, 0xb
je 0x4046a5
cmp al, 0xc
je 0x4046bc
cmp al, 0xd
je 0x4046cb
cmp al, 0xe
je 0x4046e9
cmp al, 0xf
je 0x4046ff
cmp al, 0x11
je 0x40470e
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402844
cmp ecx, 1
mov eax, ebx
jg 0x40469c
call fcn.00403bec
jmp 0x40471d
mov edx, ecx
call fcn.00403c10
jmp 0x40471d
cmp ecx, 1
mov eax, ebx
jg 0x4046b3
call fcn.00404214
jmp 0x40471d
mov edx, ecx
call fcn.0040422c
jmp 0x40471d
mov eax, ebx
add ebx, 0x10
call fcn.00405888
dec edi
jg 0x4046bc
jmp 0x40471d
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404644
dec edi
jg 0x4046ce
pop ebp
jmp 0x40471d
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404618
dec edi
jg 0x4046ec
pop ebp
jmp 0x40471d
mov eax, ebx
add ebx, 4
call fcn.0040663c
dec edi
jg 0x4046ff
jmp 0x40471d
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.004061d8
dec edi
jg 0x40470e
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404724
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404644
Function at 0x404730
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x40475c
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402914
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40479b
cmp cl, 0xb
je 0x4047ac
cmp cl, 0xc
je 0x4047bd
cmp cl, 0xd
je 0x4047ce
cmp cl, 0xe
je 0x4047ee
cmp cl, 0xf
je 0x404807
cmp cl, 0x11
je 0x404818
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402844
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403c40
mov eax, 4
jmp 0x404829
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404250
mov eax, 4
jmp 0x404829
lea edx, [esi + eax]
add eax, ebx
call fcn.00404afc
mov eax, 0x10
jmp 0x404829
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.0040484c
pop eax
jmp 0x404829
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404730
pop eax
jmp 0x404829
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00406654
mov eax, 4
jmp 0x404829
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00406214
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x40474a
pop ecx
sub ecx, eax
jle 0x404845
lea edx, [ebx + eax]
add eax, esi
call fcn.00402914
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40484c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404892
cmp cl, 0xb
je 0x4048a9
cmp cl, 0xc
je 0x4048bd
cmp cl, 0xd
je 0x4048d1
cmp cl, 0xe
je 0x4048f2
cmp cl, 0xf
je 0x40490f
cmp cl, 0x11
je 0x404923
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402844
mov eax, ebx
mov edx, dword [esi]
call fcn.00403c40
add ebx, 4
add esi, 4
dec ebp
jne 0x404892
jmp 0x404937
mov eax, ebx
mov edx, dword [esi]
call fcn.00404250
add ebx, 4
add esi, 4
dec ebp
jne 0x4048a9
jmp 0x404937
mov eax, ebx
mov edx, esi
call fcn.00404afc
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4048bd
jmp 0x404937
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.0040484c
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x4048da
jmp 0x404937
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404730
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4048f2
jmp 0x404937
mov eax, ebx
mov edx, dword [esi]
call fcn.00406654
add ebx, 4
add esi, 4
dec ebp
jne 0x40490f
jmp 0x404937
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00406214
add ebx, 4
add esi, 4
dec ebp
jne 0x404923
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x404afc
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402844
cmp eax, edx
je 0x404b93
cmp word [eax], 8
jb 0x404b34
push eax
push edx
cmp word [eax], 0x100
je 0x404b2a
cmp word [eax], 0x101
je 0x404b22
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x404b32
call dword [0x48b3e8]
jmp 0x404b32
add eax, 8
call fcn.00403bec
pop edx
pop eax
cmp word [edx], 8
jae 0x404b4b
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x404b66
cmp word [edx], 0x101
jne 0x404b7f
push eax
call 0x404b3a
pop eax
jmp dword [0x48b3f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x404b76
mov ecx, dword [edx - 8]
inc ecx
jle 0x404b76
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404ab0
ret

Function at 0x404f94
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x404fa2
mov edx, dword [edx + 8]
jmp fcn.00404250
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00404d0c
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.00404204
add esp, 0x10
pop ebx
ret

Function at 0x40503c
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.0040663c
cmp word [edx], 0xd
je 0x405087
cmp word [edx], 9
je 0x405087
cmp word [edx], 0x400d
je 0x40507d
cmp word [edx], 0x4009
je 0x40507d
cmp word [edx], 0x101
jne fcn.00404aa8
jmp fcn.00404fcc
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.00406654
mov edx, dword [edx + 8]
jmp fcn.00406654

Function at 0x405090
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.0040663c
cmp word [edx], 9
je 0x4050b5
cmp word [edx], 0x4009
jne fcn.00404aa8
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.00406654
mov edx, dword [edx + 8]
jmp fcn.00406654

Function at 0x4051d0
Capabilities:
Terminate process

Disassembly:
push eax
cmp word [eax], 8
jb 0x4051de
push edx
call fcn.00404ab8
pop edx
xor eax, eax
test edx, edx
je 0x4051fa
mov eax, dword [edx - 4]
shr eax, 1
je 0x4051fa
push eax
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4041fc
pop edx
mov word [edx], 8
mov dword [edx + 8], eax
ret

Function at 0x4052b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00405890
xor eax, eax
push ebp
push 0x4052a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x48b3ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.004052b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052a9
lea eax, [ebp - 0x10]
call fcn.00405888
ret
cmp word [edx], 0x101
je 0x40524c
cmp word [edx], 0x100
jne fcn.00404afc
cmp word [eax], 8
jb 0x4052d5
push eax
push edx
call fcn.00404ab8
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.00404388
Function at 0x4053e0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x405409
cmp eax, 0x100
jne 0x40543c
mov eax, 8
cmp edx, 0x11
jbe 0x40541b
cmp edx, 0x100
jne 0x40543a
mov edx, 8
mov al, byte [eax + 0x489064]
mov dl, byte [edx + 0x489064]
movzx ecx, byte [edx + eax*8 + 0x489078]
call dword [ecx*4 + 0x40544b]
pop edi
pop esi
pop ebx
ret
mov eax, edx
cmp eax, 0x101
jne 0x40546c
pop edi
pop esi
pop ebx
jmp fcn.0040535c
pop edi
pop esi
pop ebx
jmp 0x404ab0

Function at 0x405640
Capabilities:
Terminate process

Disassembly:
mov ecx, 0
jmp fcn.004053e0

Function at 0x405778
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x40579e
cmp eax, 0x100
jne 0x4057cd
mov eax, 8
cmp edx, 0x11
jbe 0x4057b0
cmp edx, 0x100
jne case.default.0x4057c4
mov edx, 8
mov al, byte [eax + 0x489064]
mov dl, byte [edx + 0x489064]
movzx ecx, byte [edx + eax*8 + 0x489078]
jmp dword [ecx*4 + 0x4057df]
mov eax, edx
cmp eax, 0x101
jne case.0x4057c4.0
pop edi
pop esi
call fcn.004056e4
push eax
popf
ret
pop edi
pop esi
jmp 0x404ab0
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404e00
xchg edi, eax
call fcn.00404e00
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00404ea0
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404ea0
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00404efc
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404efc
fld xword [esp]
add esp, 0xc
jmp 0x405837
mov eax, edi
mov edx, esi
call fcn.0040567c
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00404e6c
xchg edi, eax
call fcn.00404e6c
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x406290
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406448
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4062f1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406464
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40635e
xor eax, eax
push ebp
push 0x406357
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406340
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406484
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40635e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40643f
cmp byte [ebp - 0xd], 0
jne 0x4063a0
cmp byte [ebp - 0x12], 0
je 0x40643f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4063b9
dec ebx
cmp byte [ebx], 0x2e
je 0x4063c8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4063b8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40643f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4063f5
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40643f
cmp byte [ebp - 0xd], 0
je 0x40643f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40643f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406670
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.0040663c
push eax
push ecx
push edx
mov ecx, dword [eax]
test ecx, ecx
je 0x40668a
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp]
mov eax, dword [edx]
call dword [eax]
test eax, eax
je 0x406699
mov al, 0x17
jmp fcn.00402844
ret

Function at 0x40671c
Capabilities:
Terminate process

Disassembly:
test eax, eax
jns 0x406736
mov ecx, dword [0x48b014]
test ecx, ecx
je 0x40672f
mov edx, dword [esp]
call ecx
mov al, 0x18
jmp fcn.00402844
ret