joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f57
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x50
mov ecx, dword [esp + 0x54]
mov eax, 0x421118
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6c]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0x70]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x10], eax
test ecx, ecx
js 0x402f93
mov eax, dword [0x42f138]
add eax, ecx
push eax
call fcn.00402f40
push 4
lea eax, [esp + 0x70]
push eax
push dword [0x40a010]
call fcn.004065d6
test eax, eax
je 0x403173
mov eax, dword [esp + 0x6c]
test eax, eax
jns 0x40311b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [0x40ba84], esi
and dword [0x40ba80], esi
mov dword [esp + 0x70], eax
mov eax, 0x40d108
mov dword [0x415110], eax
mov dword [0x41510c], eax
mov eax, dword [esp + 0x6c]
and eax, 0x7fffffff
mov dword [0x40b568], 8
mov ecx, eax
mov dword [0x415108], 0x415108
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], ecx
jbe 0x403113
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x41d118
call fcn.00402f2a
test eax, eax
je 0x403173
sub dword [esp + 0x6c], ebp
mov dword [0x40b55c], ebp
mov ebp, dword [esp + 0x10]
mov dword [0x40b558], 0x41d118
push 0x40b558
mov dword [0x40b560], ebp
mov dword [0x40b564], ebx
call fcn.00406eab
mov dword [esp + 0x1c], eax
test eax, eax
js 0x403117
mov eax, dword [0x40b560]
sub eax, ebp
mov dword [esp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x42f1d4], 1
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
je 0x4030cf
sub eax, dword [esp + 0x70]
cmp eax, 0xc8
ja 0x403093
test ecx, ecx
jne 0x4030cf
mov eax, dword [esp + 0x14]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x24]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00405a12
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x64]
test eax, eax
je 0x40310b
test edi, edi
jne 0x4030f0
push eax
push ebp
push dword [esp + 0x70]
call fcn.00406695
test eax, eax
je 0x40315b
mov eax, dword [esp + 0x64]
jmp 0x4030fc
mov ebp, dword [0x40b560]
sub ebx, eax
mov dword [esp + 0x10], ebp
add esi, eax
cmp dword [esp + 0x1c], 1
jne 0x403040
jmp 0x403113
test ecx, ecx
jg 0x40300b
mov eax, esi
jmp 0x403176
push 0xfffffffffffffffc
jmp 0x403175
test edi, edi
jne 0x40315f
test eax, eax
jle 0x403113
mov ebp, 0x41d118
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00402f2a
test eax, eax
je 0x403173
push edi
push ebp
push dword [esp + 0x70]
call fcn.00406695
test eax, eax
je 0x40315b
mov eax, dword [esp + 0x6c]
add esi, edi
sub eax, edi
mov dword [esp + 0x6c], eax
test eax, eax
jg 0x403128
jmp 0x403113
push 0xfffffffffffffffe
jmp 0x403175
mov esi, dword [esp + 0x70]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00402f2a
test eax, eax
jne 0x403113
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
Function at 0x403180
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x40319f
mov eax, dword [0x40b550]
test eax, eax
je 0x403197
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40b550], 0
ret
cmp dword [0x40b550], 0
je 0x4031b0
push 0
call fcn.00405f46
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x42f0e0]
jbe 0x4031e3
push 0
push 0x403446
push 0
push 0x6f
push dword [0x42e8d4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x40b550], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405b3a
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405b54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x405b5a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x408548
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x408538
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405bc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405bd2
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x405bcc
xor eax, eax
jmp 0x405bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret 4
Function at 0x405ed9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
lea eax, [ebp - 0x120]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
ja 0x405f13
test eax, eax
je 0x405f13
lea eax, [ebp + eax - 0x120]
cmp byte [eax - 1], 0x5c
je 0x405f19
mov ecx, 0x408298
jmp 0x405f1e
lea eax, [ebp - 0x120]
mov ecx, 0x408299
push dword [ebp + 8]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x405f74
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405f97
push dword [esp + 8]
push dword [esp + 8]
call fcn.00406007
pop ecx
pop ecx
inc dword [0x42f1b0]
ret 8

Function at 0x406007
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x42c5a0], 0x4c554e
mov ebp, 0x42c5a0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
je 0x406053
push 1
push 0
push esi
call fcn.004065a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x406133
cmp eax, ebx
jg 0x406133
push ebx
mov esi, 0x42c1a0
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x406133
cmp eax, ebx
jg 0x406133
push esi
push ebp
push str._s_s_r_n
push 0x42bda0
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x42f0f0]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405bd6
push 4
push 0xc0000000
push esi
call fcn.004065a9
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406133
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40612c
push esi
push edi
push ebx
call fcn.004065d6
test eax, eax
je 0x40612c
push str._Rename__r_n
push edi
call fcn.004067b5
test eax, eax
jne 0x406138
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x42bda0
lea eax, [ecx + edi]
push eax
call fcn.00406327
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406695
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x40870c
add eax, 0xa
push eax
call fcn.004067b5
mov ecx, eax
test ecx, ecx
je 0x4060fd
lea edx, [edi + esi]
jmp 0x406157
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x406151
sub ecx, edi
inc ecx
jmp 0x4060ff
Function at 0x406202
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.0040681c
mov edi, eax
cmp edi, 0xffffffff
je 0x406245
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406226
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40622c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x406235
xor eax, eax
inc eax
jmp 0x406247
test byte [ebp + 0xc], 4
jne 0x406245
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4062b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x42b9a0
push ebx
call fcn.00406799
push ebx
call fcn.00406844
mov esi, eax
test esi, esi
je 0x406320
push esi
call fcn.0040697c
test byte [0x42f0ec], 0x80
je 0x4062e6
mov al, byte [esi]
test al, al
je 0x406320
cmp al, 0x5c
je 0x406320
sub esi, ebx
jmp 0x4062fe
call fcn.0040624c
test eax, eax
je 0x4062f8
test byte [eax], 0x10
je 0x406320
push ebx
call fcn.00406951
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
cmp eax, esi
jg 0x4062ea
call fcn.004061d5
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406320
xor eax, eax
inc eax
jmp 0x406322
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x406349
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42b558], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x42b558
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406388
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x40638c
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x150
push ebx
mov ebx, dword [esp + 0x15c]
push esi
mov esi, dword [esp + 0x15c]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.004062b0
mov dword [esp + 0x18], eax
test bl, 8
je 0x4063ce
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f1a8], eax
jmp 0x406568
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x18], ebp
je 0x4063eb
test eax, eax
je 0x406557
test bl, 2
je 0x406521
push esi
push 0x42b5a0
call fcn.00406799
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x40640e
push 0x4086f0
push 0x42b5a0
call ebp
jmp 0x406414
push esi
call fcn.00406951
cmp byte [esi], 0
jne 0x406422
cmp byte [0x42b5a0], 0x5c
jne 0x40642a
push 0x408298
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [esi + eax]
lea eax, [esp + 0x20]
mov dword [esp + 0x10], ebp
push eax
push 0x42b5a0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40650f
lea ebp, [esp + 0x4c]
push 0x3f
mov eax, ebp
push eax
call fcn.00406273
cmp byte [eax], 0
je 0x40647c
cmp byte [esp + 0x150], 0
lea eax, [esp + 0x150]
cmove eax, ebp
mov ebp, eax
cmp byte [ebp], 0x2e
jne 0x406493
mov al, byte [ebp + 1]
test al, al
je 0x4064ea
cmp al, 0x2e
jne 0x406493
cmp byte [ebp + 2], 0
je 0x4064ea
push ebp
mov ebp, dword [esp + 0x14]
push ebp
call fcn.00406799
test byte [esp + 0x20], 0x10
je 0x4064b7
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x4064ee
push ebx
push esi
call fcn.0040638c
jmp 0x4064ee
push edi
push esi
call fcn.00406202
test eax, eax
jne 0x4064e0
test edi, edi
je 0x4064d8
push esi
push 0xfffffffffffffff1
call fcn.00405a12
push 0
push esi
call fcn.00405f74
jmp 0x4064ee
inc dword [0x42f1a8]
jmp 0x4064ee
push esi
push 0xfffffffffffffff2
call fcn.00405a12
jmp 0x4064ee
mov ebp, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406455
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x18], 0
je 0x406567
cmp dword [esp + 0x1c], 0
mov byte [ebp - 1], 0
je 0x406557
push esi
call fcn.0040624c
test eax, eax
je 0x406567
push esi
call fcn.004061d5
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406202
test eax, eax
jne 0x40655f
test edi, edi
je 0x406557
push esi
push 0xfffffffffffffff1
call fcn.00405a12
push 0
push esi
call fcn.00405f74
jmp 0x406567
inc dword [0x42f1a8]
jmp 0x406567
push esi
push 0xffffffffffffffe5
call fcn.00405a12
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x150
ret 8

Function at 0x4065a9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc
Function at 0x406605
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405fd9
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406675
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov byte [edi + 0x3ff], 0
pop esi
jne 0x406675
cmp dword [ebp + 0x18], 1
je 0x406678
cmp dword [ebp + 0x18], 2
je 0x406678
mov byte [edi], 0
pop edi
leave
ret 0x14

Function at 0x40667d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x4066e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add byte [ebp + 0xa], dl
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40671f
test edi, edi
jne 0x4066eb
mov byte [esi], al
jmp 0x406721
mov eax, esi
pop edi
pop esi
pop ebp
ret 8

Function at 0x40681c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40683e
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x406a59
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42cae4], 0
push esi
jne 0x406a93
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406a6a
mov dword [ecx*4 + 0x42cae0], edx
inc ecx
cmp ecx, 0x100
jl 0x406a65
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406abd
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x42cae0]
inc esi
sub edx, 1
jne 0x406aa5
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x402a20
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040448c
test esi, esi
jne 0x402a56
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040457c
jmp 0x402a74
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402934
mov edi, eax
test esi, esi
je 0x402a74
cmp dword [ebx], 0
je 0x402a74
dec esi
jmp 0x402a5d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f78
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x458008], 0x8088405
inc edx
mov dword [ebx + 0x458008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40353c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x458024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4035b4
xor eax, eax
push ebp
push 0x4035ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x458024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x458024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40426c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45c044], 0
je 0x4042cd
cmp word [0x45c218], 0xd7b2
jne 0x404295
cmp dword [0x45c220], 0
jbe 0x404295
mov eax, 0x45c214
call dword [0x45c230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x458074
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042f4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x458034], 0
jne 0x4042e9
push 0
push 0x45806c
push 0x458074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402718
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x45c045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404408
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405b48
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d78
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405bcb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d78
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x405bcb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d94
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x405c54
xor eax, eax
push ebp
push 0x405c4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405990
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405c32
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405db4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x405c32
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c54
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405d6e
cmp byte [ebp - 0xd], 0
jne 0x405c9b
cmp byte [ebp - 0x12], 0
je 0x405d6e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405cb4
dec ebx
cmp byte [ebx], 0x2e
je 0x405cc3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405cb3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405d6e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405d00
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d6e
cmp byte [ebp - 0xd], 0
je 0x405d6e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405d6e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406410
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406476
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040470c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402f94
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406460
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40647d
lea eax, [ebp - 0x10]
call fcn.0040448c
ret

Function at 0x40addc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40ae15
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040457c
jmp 0x40ae1e
mov eax, ebx
mov edx, esi
call fcn.004044e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ae28
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40ae49
mov al, byte [esp]
jmp 0x40ae4b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c2c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c32c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040470c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00408098
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c333
lea eax, [ebp - 0xc]
call fcn.0040448c
ret

Function at 0x418c44
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00418a9c
dec esi
jne 0x418c66
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret