joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47acd3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x47acec
call fcn.00438657
mov esi, dword [eax + 0xc]
push 0x5a9d58
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x47ad42
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47ad41
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x47ad22
xor esi, esi
jmp 0x47ad38
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0047ad4a
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x50d383
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x59aae2
call fcn.00569959
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0042837a
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x5d3568
call fcn.0042861d
cmp eax, 0xffffffff
jne 0x50d44e
push 0
push 0x5d691c
lea ecx, [ebp - 0x278]
call fcn.0042861d
cmp eax, 0xffffffff
jne 0x50d44e
push 0
push 0x5d5d54
lea ecx, [ebp - 0x278]
call fcn.0042861d
cmp eax, 0xffffffff
jne 0x50d44e
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0042837a
mov edi, eax
pop ecx
mov dword [ebp - 0x27c], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x280], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x114]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x50d42b
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005698e8
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.004183d0
jmp 0x50d486
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.004290e7
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004183d0
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x50d474
mov edi, dword [ebp - 0x274]
jmp 0x50d486
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005698e8
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.004183d0
mov eax, edi
call fcn.00569903
ret
Function at 0x56aa50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.0056ac00
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x56ab1d
mov edx, dword [ebp - 4]
cmp edx, dword [0x5f9efc]
jb 0x56aa9a
mov eax, dword [ebp - 4]
cmp eax, dword [0x5f9f00]
ja 0x56aa9a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x56aa6a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.0056ecf0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x56aac0
jmp 0x56ab1d
cmp dword [ebp - 0x14], 0x10000
jne 0x56ab03
cmp dword [ebp - 0x18], 0x10000
jb 0x56ab03
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x56aaf6
mov eax, dword [ebp - 8]
jmp 0x56ab1f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x56ab18
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.0056ac00
add esp, 4
mov dword [ebp - 4], eax
jmp 0x56aa6a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x56ab30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.0056ac30
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x56abf5
mov edx, dword [ebp - 4]
cmp edx, dword [0x5f9efc]
jb 0x56ab75
mov eax, dword [ebp - 4]
cmp eax, dword [0x5f9f00]
ja 0x56ab75
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x56ab45
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.0056ecf0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x56ab9b
jmp 0x56abf5
cmp dword [ebp - 0x14], 0x10000
jne 0x56abde
cmp dword [ebp - 0x18], 0x10000
jb 0x56abde
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x56abd1
mov eax, dword [ebp - 8]
jmp 0x56abf7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x56abf0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.0056ac30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x56ab45
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x58406d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00583eec

Function at 0x58a3be
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058a07e
Function at 0x401294
Capabilities:
Check os version

Disassembly:
jmp 0x407a30
sub esp, 0x98
mov eax, dword [0x4420a0]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [0x443ac8]
test eax, eax
jne 0x407aaf
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x407aa5
cmp dword [esp + 0x10], 2
jne 0x407aa5
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x407a7a
mov eax, 2
jmp 0x407aaa
cmp eax, 5
jne 0x407a86
mov eax, 3
jmp 0x407aaa
cmp eax, 6
jne 0x407a92
mov eax, 4
jmp 0x407aaa
xor ecx, ecx
cmp eax, 0xa
sete cl
lea ecx, [ecx*4 + 1]
mov eax, ecx
jmp 0x407aaa
mov eax, 1
mov dword [0x443ac8], eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040a8b5
add esp, 0x98
ret
Function at 0x4047f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x432cc8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4420a0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
or ebp, 0xffffffff
push eax
mov dword [esp + 0x3c], ebp
call esi
mov ecx, dword [esp + 0x44]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ecx
mov ebx, eax
call esi
cmp ebx, ebp
mov edi, eax
mov dword [esp + 0x18], edi
je 0x4049b0
cmp edi, ebp
je 0x4049b0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push ebx
call esi
push 0
push edi
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jne 0x404982
test ecx, ecx
jbe 0x40496c
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [esp + 0x20]
push edx
push 0x80
push 0x443850
push ebx
call esi
test eax, eax
je 0x404970
push 0
lea eax, [esp + 0x28]
push eax
push 0x80
push 0x4437b0
push edi
call esi
test eax, eax
je 0x404970
mov edi, dword [esp + 0x1c]
cmp edi, 4
mov eax, edi
mov ecx, 0x4437b0
mov edx, 0x443850
jb 0x4048f7
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x4048fb
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x4048e3
test eax, eax
je 0x404958
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x40494a
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x404958
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x40494a
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x404958
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x40494a
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x404958
movzx esi, byte [edx]
movzx ecx, byte [ecx]
sub esi, ecx
je 0x404958
test esi, esi
mov eax, 1
jg 0x40495a
or eax, 0xffffffff
jmp 0x40495a
xor eax, eax
test eax, eax
jne 0x40497a
sub dword [esp + 0x14], edi
mov edi, dword [esp + 0x18]
jne 0x404890
xor ebp, ebp
jmp 0x404982
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x404982
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
test ebp, ebp
je 0x404997
cmp ebp, 0x26
jne 0x4049f7
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
lea edx, [esp + 0x28]
push edx
call fcn.00401087
add esp, 4
mov ecx, eax
mov dword [esp + 0x3c], 0
call fcn.00401136
push eax
mov ecx, 0x443684
call fcn.00401136
push eax
push str._sINF_error_opening_file:__s_n
push 0x443684
call fcn.00401055
add esp, 0x10
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], ebp
call fcn.004010a0
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x407a30
Capabilities:
Check os version

Disassembly:
jmp 0x407a30
sub esp, 0x98
mov eax, dword [0x4420a0]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [0x443ac8]
test eax, eax
jne 0x407aaf
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x407aa5
cmp dword [esp + 0x10], 2
jne 0x407aa5
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x407a7a
mov eax, 2
jmp 0x407aaa
cmp eax, 5
jne 0x407a86
mov eax, 3
jmp 0x407aaa
cmp eax, 6
jne 0x407a92
mov eax, 4
jmp 0x407aaa
xor ecx, ecx
cmp eax, 0xa
sete cl
lea ecx, [ecx*4 + 1]
mov eax, ecx
jmp 0x407aaa
mov eax, 1
mov dword [0x443ac8], eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040a8b5
add esp, 0x98
ret

Function at 0x40a8b5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4420a0]
jne 0x40a8bf
repz ret
jmp fcn.0040a8c4

Function at 0x40a8c4
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
push edi
mov dword [0x443bf8], eax
mov dword [0x443bf4], ecx
mov dword [0x443bf0], edx
mov dword [0x443bec], ebx
mov dword [0x443be8], esi
mov dword [0x443be4], edi
mov word [0x443c10], ss
mov word [0x443c04], cs
mov word [0x443be0], ds
mov word [0x443bdc], es
mov word [0x443bd8], fs
mov word [0x443bd4], gs
pushfd
pop dword [0x443c08]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 4]
add ecx, 4
mov dword [0x443c0c], ecx
mov dword [0x443c00], eax
mov dword [0x443b48], 0x10001
lea ecx, [ebp + 4]
mov ecx, dword [ecx - 4]
mov dword [0x443b04], eax
mov eax, dword [0x4420a0]
xor edi, edi
mov dword [0x443bfc], ecx
mov dword [0x443af8], 0xc0000409
inc edi
mov dword [0x443afc], edi
mov dword [ebp - 4], eax
mov eax, dword [0x4420a4]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x43bf30
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0xc0000409
mov dword [ebp - 0x320], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
leave
ret
Function at 0x40c10f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
jne 0x40c140
call fcn.0040cf35
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0040f449
add esp, 0x14
or eax, 0xffffffff
jmp 0x40c1bc
push esi
call fcn.00411674
push 0x214
push 1
call fcn.004143d1
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40c1a4
call fcn.00411828
push dword [eax + 0x6c]
push esi
call fcn.004116f8
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
pop ecx
pop ecx
mov dword [esi + 0x54], edi
jne 0x40c181
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x40c098
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x40c1bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
call fcn.0040a9d8
cmp dword [ebp - 4], ebx
pop ecx
je 0x40c1b9
push dword [ebp - 4]
call fcn.0040cf5b
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x410138
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x4425e8]
je 0x41015e
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x41014c
cmp esi, 0x17
jae 0x4102b8
push 3
call fcn.0041b55d
cmp eax, 1
pop ecx
je 0x410282
push 3
call fcn.0041b55d
test eax, eax
pop ecx
jne 0x410191
cmp dword [0x442330], 1
je 0x410282
cmp edi, 0xfc
je 0x4102b8
push str.Runtime_Error__n_nProgram:
mov edi, 0x314
push edi
mov esi, 0x443fe8
push esi
call fcn.0041b4f5
add esp, 0xc
test eax, eax
je 0x4101c7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040f3a3
add esp, 0x14
mov byte [0x444105], bl
push 0x104
mov ebx, 0x444001
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41020a
push str._program_name_unknown_
push 0x2fb
push ebx
call fcn.0041b4f5
add esp, 0xc
test eax, eax
je 0x41020a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040f3a3
add esp, 0x14
push ebx
push edi
push esi
call fcn.0041b481
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x410228
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040f3a3
add esp, 0x14
push 0x43c598
push edi
push esi
call fcn.0041b481
add esp, 0xc
test eax, eax
je 0x410248
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040f3a3
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x4425ec]
push edi
push esi
call fcn.0041b481
add esp, 0xc
test eax, eax
je 0x41026d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040f3a3
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push esi
call fcn.0041b2e1
add esp, 0xc
jmp 0x4102b8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x4102b8
cmp edi, 0xffffffff
je 0x4102b8
mov edx, dword [esi*8 + 0x4425ec]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4102a1
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4149f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x414a03
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4149ff
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x414a20
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x414a5f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x414a55
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x414a61
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x414a45
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41b2e1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004115dc
xor ebx, ebx
cmp dword [0x444548], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x41b3b8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x41b323
xor eax, eax
jmp 0x41b47c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x41b31c
push eax
call fcn.00411576
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x444548], eax
call esi
push eax
call fcn.00411576
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44454c], eax
call esi
push eax
call fcn.00411576
mov dword [0x444550], eax
lea eax, [ebp - 8]
push eax
call fcn.0040fea7
test eax, eax
pop ecx
pop ecx
je 0x41b386
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040f3a3
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x41b3b8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00411576
cmp eax, ebx
pop ecx
mov dword [0x444558], eax
je 0x41b3b8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411576
pop ecx
mov dword [0x444554], eax
mov eax, dword [0x444554]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x41b431
cmp dword [0x444558], esi
je 0x41b431
push eax
call fcn.004115e5
pop ecx
call eax
cmp eax, ebx
je 0x41b3fe
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x444558]
call fcn.004115e5
pop ecx
call eax
test eax, eax
je 0x41b3fe
test byte [ebp - 0x18], 1
jne 0x41b431
lea eax, [ebp - 0xc]
push eax
call fcn.0040ff24
test eax, eax
pop ecx
je 0x41b419
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040f3a3
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x41b428
or dword [ebp + 0x10], 0x200000
jmp 0x41b462
or dword [ebp + 0x10], 0x40000
jmp 0x41b462
mov eax, dword [0x44454c]
cmp eax, esi
je 0x41b462
push eax
call fcn.004115e5
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41b462
mov eax, dword [0x444550]
cmp eax, esi
je 0x41b462
push dword [ebp - 4]
push eax
call fcn.004115e5
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x444548]
call fcn.004115e5
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e9d3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.00411828
mov ebx, dword [ebp + 8]
mov esi, eax
add esi, 0x9c
test ebx, ebx
jne 0x41e9fb
or dword [esi + 8], 0x104
jmp 0x41eabf
lea eax, [ebx + 0x40]
test eax, eax
lea edi, [esi + 4]
mov dword [esi], ebx
mov dword [edi], eax
je 0x41ea1e
cmp byte [eax], 0
je 0x41ea1e
push edi
push 0x16
push 0x43d9c8
call fcn.0041e3ab
add esp, 0xc
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x41ea7b
cmp byte [eax], 0
je 0x41ea7b
mov eax, dword [edi]
test eax, eax
je 0x41ea3f
cmp byte [eax], 0
je 0x41ea3f
call fcn.0041e918
jmp 0x41ea44
call fcn.0041e98b
cmp dword [esi + 8], 0
jne 0x41ead5
push esi
push 0x41
push 0x43d7b8
call fcn.0041e3ab
add esp, 0xc
test eax, eax
je 0x41eacb
mov edi, dword [edi]
test edi, edi
je 0x41ea74
cmp byte [edi], 0
je 0x41ea74
call fcn.0041e918
jmp 0x41eacb
call fcn.0041e98b
jmp 0x41eacb
mov edi, dword [edi]
test edi, edi
je 0x41eab8
cmp byte [edi], 0
je 0x41eab8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ea8b
xor ecx, ecx
sub eax, edx
cmp eax, 3
sete cl
push 1
push 0x41e510
mov dword [esi + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x41eacb
and dword [esi + 8], 0
jmp 0x41eacb
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], 0
je 0x41ebc9
mov eax, ebx
add ebx, 0x80
neg eax
sbb eax, eax
and eax, ebx
push eax
mov edx, esi
call fcn.0041e421
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp + 8], edi
je 0x41ebc9
cmp edi, 0xfde8
je 0x41ebc9
cmp edi, 0xfde9
je 0x41ebc9
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41ebc9
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41ebc9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41eb50
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], di
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x41ebc4
cmp word [eax], 0x814
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jne 0x41eb89
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0041b4f5
add esp, 0xc
test eax, eax
je 0x41eb9a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040f3a3
add esp, 0x14
jmp 0x41eb9a
push 0x40
push ebx
push 0x1001
push dword [esi + 0x18]
call edi
test eax, eax
je 0x41ebc9
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call edi
test eax, eax
je 0x41ebc9
push 0xa
push 0x10
add ebx, 0x80
push ebx
push dword [ebp + 8]
call fcn.004270e1
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41ebcb
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41eefa
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.0040fea7
test eax, eax
pop ecx
je 0x41ef2f
push edi
push edi
push edi
push edi
push edi
call fcn.0040f3a3
add esp, 0x14
push 4
pop eax
call fcn.004272b0
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41f03d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x41efb6
push str.kernel32.dll
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x41efb6
push str.SetThreadStackGuarantee
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x41efb6
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x41efb6
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x41efb6
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.0041eed3
add esp, 0xc
test eax, eax
jl 0x41f03d
not edi
and dword [ebp - 8], edi
je 0x41efe8
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.0041eed3
add esp, 0xc
test eax, eax
jl 0x41f03d
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x41eff3
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x41f007
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x41f03d
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x41f03d
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x41f03d
xor eax, eax
inc eax
jmp 0x41f03f
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a8b5
leave
ret