joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401070
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4010f4
mov dword [esp + 4], 0x50
lea eax, [esp + 4]
mov ecx, dword [esp]
push eax
push 0x406fc8
push 0
push 0
push str.Path
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4010e9
mov eax, dword [esp + 4]
add eax, 0x406fc6
mov cl, byte [eax]
cmp cl, 0x5c
je 0x4010d2
cmp cl, 0x2f
jne 0x4010d5
mov byte [eax], 0
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x406fc8
add esp, 8
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret

Function at 0x401100
Capabilities:
Get disk information

Disassembly:
sub esp, 0x14
mov eax, dword [0x40608c]
mov dword [esp], eax
push ebx
push esi
mov ebx, 0x5a
lea esi, [esp + 0xc]
push edi
mov byte [esp + 0xc], 0x41
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea eax, [esp + 0xc]
push eax
call edi
cmp eax, 5
jne 0x40115c
mov al, byte [esp + 0xc]
push 0
push str.x:_RoadRash_Text_enu.dll
mov byte [str.x:_RoadRash_Text_enu.dll], al
call fcn.00403fc0
add esp, 8
test eax, eax
je 0x40116f
mov al, byte [esp + 0xc]
inc esi
inc esi
mov byte [esi - 2], al
mov byte [esi - 1], 0x3a
mov byte [esi], 0x2c
inc esi
inc byte [esp + 0xc]
cmp byte [esp + 0xc], bl
jle 0x401123
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov eax, str.x:_RoadRash_Text_enu.dll
pop edi
mov byte [0x40603b], 0
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x401190
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x15c
push esi
push edi
call entry0
mov edi, eax
test edi, edi
je 0x40125f
call fcn.00401310
test eax, eax
je 0x4011c6
push eax
push edi
lea eax, [esp + 0x68]
push str._s__s__s
push eax
call fcn.00401340
add esp, 0x10
jmp 0x4011e7
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
lea eax, [esp + 8]
mov word [esp + 0x4e], cx
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x1c]
push eax
mov dword [esp + 0x4c], ecx
push edx
mov dword [esp + 0x58], ecx
push ecx
lea esi, [esp + 0x6c]
push ecx
mov dword [esp + 0x2c], 0x44
push 0x20
push ecx
push ecx
push ecx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4012d5
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x401256
lea eax, [esp + 0x18]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 8]
push eax
call esi
jmp 0x4012d5
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
and ax, 0x3ff
movzx eax, ax
sub eax, 7
cmp eax, 9
ja case.0x40127c.12
xor ecx, ecx
mov cl, byte [eax + 0x4012fc]
jmp dword [ecx*4 + 0x4012e4]
mov ecx, str.Error
mov eax, str.Can_not_locate_Road_Rash._nPlease_insert_the_Road_Rash_CD_and_try_again.
jmp 0x4012c9
mov ecx, str.Fehler
mov eax, str.Kann_Road_Rash_nicht_finden._nBitte_legen_Sie_die_Road_Rash_CD_ein_und_versuchen_Sie_es_nochmal.
jmp 0x4012c9
mov ecx, str.Error
mov eax, str.No_encuentro_Road_Rash._nInserta_el_CD_de_Road_Rash_e_int
jmp 0x4012c9
mov ecx, str.Error
mov eax, str.Can_not_locate_Road_Rash._nPlease_insert_the_Road_Rash_CD_and_try_again.
jmp 0x4012c9
mov ecx, str.Erreur
mov eax, str.Impossible_de_trouver_Road_Rash._nIns
jmp 0x4012c9
mov ecx, str.Errore
mov eax, str.Impossibile_trovare_Road_Rash._nInserisci_il_CD_di_Road_Rash_e_riprova.
push 0
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
add esp, 0x15c
ret 0x10

Function at 0x401420
Capabilities:
Terminate process

Disassembly:
mov dword [0x406284], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x406280], bl
jne 0x40147c
cmp dword [0x40834c], 0
je 0x40146a
mov esi, dword [0x408344]
sub esi, 4
cmp esi, dword [0x40834c]
jb 0x40146a
mov eax, dword [esi]
test eax, eax
je 0x40145f
call eax
sub esi, 4
cmp esi, dword [0x40834c]
jae 0x401457
push 0x40601c
push 0x406014
call fcn.004014a0
add esp, 8
push 0x406024
push 0x406020
call fcn.004014a0
add esp, 8
test ebx, ebx
jne 0x40149d
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret
Function at 0x402900
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x406360], 0
push ebx
push esi
push edi
push ebp
jne 0x402950
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call esi
mov edi, eax
test edi, edi
je 0x40292e
mov dword [0x406360], 1
mov ebx, dword [esp + 0x10]
jmp 0x40295e
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x402946
mov dword [0x406360], 2
jmp 0x40295e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x406360], 1
jne 0x402a0d
test edi, edi
jne 0x402981
call esi
mov edi, eax
test edi, edi
jne 0x402981
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x40299b
add esi, 2
cmp word [esi], 0
jne 0x402989
add esi, 2
cmp word [esi], 0
jne 0x402989
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x4029fc
push ebp
call fcn.00403890
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4029fc
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4029eb
push ebx
call fcn.00403870
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x406360], 2
jne 0x402a91
test ebx, ebx
jne 0x402a30
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x402a30
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x402a45
inc ebp
cmp byte [ebp], 0
jne 0x402a37
inc ebp
cmp byte [ebp], 0
jne 0x402a37
sub ebp, ebx
inc ebp
push ebp
call fcn.00403890
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x402a6a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x403090
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor eax, eax
mov ecx, 0x4067f0
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [ecx], edx
je 0x4030b8
add ecx, 8
inc eax
cmp ecx, 0x406878
jb 0x4030a8
cmp dword [eax*8 + 0x4067f0], edx
lea ebx, [eax*8]
jne 0x403273
cmp dword [0x406294], 1
je 0x403238
cmp dword [0x406294], 0
jne 0x4030ef
cmp dword [0x406298], 1
je 0x403238
cmp edx, 0xfc
je 0x403273
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x40312c
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x403170
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4068c4
push ebp
call fcn.004039b0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4068a4
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x4067f4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00403910
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x408240]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x40324f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x4067f4]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x403280
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x408234], edx
push ebx
push esi
push edi
push ebp
jbe 0x403487
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x408240
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x403487
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x4032e9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x4032fa
push 2
push 0
push edx
call fcn.004034b0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x403396
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x430]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x4033cf
lea ebx, [esp + 0x24]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x40335d
mov al, byte [edi]
inc edi
cmp al, 0xa
jne 0x40334b
mov byte [ebx], 0xd
inc esi
inc ebx
mov byte [ebx], al
inc ebx
mov eax, ebx
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x403332
lea eax, [esp + 0x24]
push 0
sub ebx, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push ebx
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4033c5
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, ebx
jge 0x40331d
jmp 0x4033cf
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4033c5
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x4033cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x403476
cmp dword [esp + 0x10], 0
je 0x403428
cmp dword [esp + 0x10], 5
jne 0x40340b
mov dword [0x406240], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x406244], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.004039e0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x403452
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x403452
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x406240], 0x1c
mov dword [0x406244], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x406240], 9
mov dword [0x406244], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x403fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x403fe5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004039e0
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x40400a
test byte [esp + 8], 2
je 0x40400a
mov dword [0x406240], 0xd
mov dword [0x406244], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402760
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4027ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4027a4
test esi, esi
je 0x4027a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402780
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402990
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4029e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402ab8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402a1e
cmp eax, 4
jne 0x402a40
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402a2e
cmp edx, 4
je 0x402a2e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402990
Function at 0x40287c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4028ab
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403a28
jmp 0x4028c9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402810
mov edi, eax
test ebx, ebx
je 0x4028c9
cmp dword [esi], 0
je 0x4028c9
dec ebx
jmp 0x4028b2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ccc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402cac
xor eax, eax
push ebp
push 0x402ca5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ce8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402cac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404d28
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404ee0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404d89
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404efc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404df6
xor eax, eax
push ebp
push 0x404def
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404dd8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404f1c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404df6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404ed7
cmp byte [ebp - 0xd], 0
jne 0x404e38
cmp byte [ebp - 0x12], 0
je 0x404ed7
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404e51
dec ebx
cmp byte [ebx], 0x2e
je 0x404e60
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404e50
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404ed7
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404e8d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ed7
cmp byte [ebp - 0xd], 0
je 0x404ed7
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ed7
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4054a4
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x4054d4
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x4054ca
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.004027ac
or eax, 0xffffffff
jmp 0x4054c8
mov eax, 0x67
call fcn.0040279c
or eax, 0xffffffff
jmp 0x4054c8
Function at 0x409a08
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409a41
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403a28
jmp 0x409a4a
mov eax, ebx
mov edx, esi
call fcn.004039dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409a54
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409a75
mov al, byte [esp]
jmp 0x409a77
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4156d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4156d6
ret

Function at 0x417d7c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x417dcd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x417db4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x417da4
jmp 0x417dcd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x417db5
pop ebx
mov esp, ebp
pop ebp
ret