joyce8/EMBER2024-capa huggingface dataset:
Function at 0x600170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8e25d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x600318
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x60019c
movzx ecx, byte [esp + 0x80]
jmp 0x6001a9
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x6001e1
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x6002ff
cmp cl, 0xe4
je 0x6001c0
cmp ax, 0x303
jmp 0x6001e5
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x600273
cmp cl, 0xe3
jne 0x60023d
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.00468fae
call sym.crypto_tls.finishedHash.Sum
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call sym.crypto.Hash.New
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x686720]
mov dword [esp], eax
lea eax, [0x738d30]
mov dword [esp + 4], eax
call sym.runtime.gopanic
nop
call sym.runtime.morestack_noctxt
jmp sym.crypto_tls.finishedHash.hashForClientCertificate
Function at 0x60dc20
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [0x8e25d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x60dc9e
sub esp, 8
lea eax, [0x689fe0]
mov dword [esp], eax
call sym.runtime.newobject
nop
mov eax, dword [esp + 4]
xor ecx, ecx
jmp 0x60dc50
mov dword [eax + edx*4], ecx
lea ecx, [edx + 1]
cmp ecx, 0x100
jge 0x60dc5e
mov edx, ecx
xor ebx, ebx
jmp 0x60dc83
mov ecx, dword [0x8e2900]
test ecx, ecx
je 0x60dc78
call sym.runtime.gcWriteBarrier2
mov dword [edi], eax
mov ecx, dword [0x8bc2a0]
mov dword [edi + 4], ecx
mov dword [0x8bc2a0], eax
add esp, 8
ret
inc ebx
cmp ebx, 8
jge 0x60dc4a
test ecx, 1
je 0x60dc9a
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x60dc82
shr ecx, 1
jmp 0x60dc82
call sym.runtime.morestack_noctxt
jmp sym.hash_crc32.init
Function at 0x63d040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x8e25d4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x63d1d8
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x63d067
mov eax, dword [eax + 0x7c]
jmp 0x63d073
lea ecx, [0x73a5b4]
lea eax, [0x8e2480]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], eax
lea eax, [0x68b0e0]
mov dword [esp + 4], eax
lea eax, [0x8e2480]
mov dword [esp + 8], eax
call ecx
lea eax, [0x6952c0]
cmp dword [esp + 0xc], eax
jne 0x63d0a1
mov ecx, dword [esp + 0x10]
jmp 0x63d0a3
xor ecx, ecx
test ecx, ecx
je 0x63d1d4
mov edx, dword [ecx + 4]
test edx, edx
je 0x63d1d4
mov dword [esp + 0x1c], ecx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.00468b1b
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
movzx edx, byte [esp + 0x70]
mov byte [esp + 0x44], dl
lea ebx, [ecx + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp], ebx
call sym.sync._Mutex_.Lock
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x64]
test edx, edx
je 0x63d0fe
mov eax, dword [edx]
jmp 0x63d100
xor eax, eax
test eax, eax
sete al
movzx edx, byte [esp + 0x70]
and edx, eax
mov byte [esp + 0x45], dl
test dl, dl
je 0x63d1ad
lea esi, [ecx + 0x7c]
mov dword [esp + 0x20], esi
lea edi, [esp + 0x28]
call fcn.00468ffe
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test eax, 0x80000000
je 0x63d15b
mov edx, ecx
shl ecx, 1
shl eax, 1
mov ebx, edx
shr edx, 0x1f
or eax, edx
mov edx, eax
shl eax, 1
shr ecx, 0x1f
or ecx, eax
shr edx, 0x1f
add ecx, 0xd7b17f80
adc edx, 0xd
jmp 0x63d167
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ebx, ecx
mov ecx, eax
test ecx, ecx
sete al
test edx, edx
sete cl
and ecx, eax
test cl, cl
je 0x63d17f
test ebx, 0x3fffffff
je 0x63d1ad
lea edi, [esp + 0x50]
mov esi, dword [esp + 0x20]
call fcn.00468ffe
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.00468ffe
call sym.time.Since
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym.sync._Mutex_.Unlock
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx]
lea edi, [esp]
lea esi, [esp + 0x3c]
call fcn.00468ffe
call eax
add esp, 0x64
ret
add esp, 0x64
ret
call sym.runtime.morestack_noctxt
jmp sym.net_http.http2traceGotConn
Function at 0x1000a7c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002a134
call fcn.100162ec
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000a844
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000a844
call fcn.10004432
mov esi, eax
jmp 0x1000a91b
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000a867
call fcn.10004432
jmp 0x1000a90e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1000a85d
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000a897
mov esi, 0x8007000e
jmp 0x1000a910
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10021135
jmp 0x1000a8bd
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000a890
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000a85d
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10021135
mov esi, eax
test edi, edi
je 0x1000a91b
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000a934
lea ecx, [ebp - 0x418]
call fcn.10009f30
mov eax, esi
call fcn.1001623e
ret 0x10
Function at 0x1000f7c9
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002a5ef
call fcn.1001624d
mov ebx, ecx
mov eax, dword [ebx]
xor esi, esi
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.10021135
and dword [ebp - 4], esi
cmp dword [ebx + 0x44], esi
je 0x1000f873
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10021135
test al, al
je 0x1000f849
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push dword [ebx + 0x44]
movsd dword es:[edi], dword [esi]
push eax
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10021135
add esp, 0x28
mov byte [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1000f862
push 0
push str.Close
push dword [ebx + 0x44]
push 0
push 1
push ebx
call fcn.10021135
add esp, 0x18
mov esi, eax
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x1000f873
and dword [ebx + 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebx + 0x24], 0
je 0x1000f893
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10021135
test al, al
je 0x1000f893
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.1001621b
ret
Function at 0x100106e6
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x210
mov eax, 0x1002a68f
call fcn.10016280
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [ebp + 0xc]
cmp dword [esi + 8], edi
je 0x1001070c
mov eax, reloc.OLEAUT32.dll_VariantCopyInd
jmp 0x1001087d
lea ecx, [esi - 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x10010725
mov eax, 0x80004005
jmp 0x1001087d
mov edx, dword [ebp + 0x10]
mov eax, edx
and eax, reloc.OLEAUT32.dll_SysReAllocString
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
push ebx
sete al
mov byte [ecx + 0x31], al
mov ecx, reloc.OLEAUT32.dll_SysReAllocStringLen
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x32], cl
mov eax, reloc.OLEAUT32.dll_VariantClear
and edx, eax
cmp edx, eax
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [esi + 0x14]
add ecx, 0x28
call fcn.10021135
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x21c]
call fcn.10021135
push str.Excel.Application
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.10021135
test al, al
je 0x1001085a
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.10016100
push 0x5c
push ebx
call fcn.10021135
add esp, 0x14
test eax, eax
jne 0x100107d3
push 0x2f
push ebx
call fcn.10021135
pop ecx
pop ecx
test eax, eax
je 0x100107f3
add eax, 2
push 0x2e
push eax
call fcn.10021135
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10021135
add esp, 0x14
cmp word [ebp - 0x218], 0
je 0x10010853
push edi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.10021135
pop ecx
pop ecx
mov ecx, dword [esi + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10010845
lea eax, [ebp - 0x218]
push eax
call fcn.10021135
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001084b
push ebx
call fcn.10021135
mov eax, dword [esi + 0x14]
add eax, 0x24
jmp 0x10010866
mov edi, 0x80004005
jmp 0x1001086f
mov ecx, dword [esi + 0x14]
push ebx
add ecx, 0x24
call fcn.10021135
push eax
lea ecx, [esi + 0x10]
call fcn.10021135
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.1001622f
ret 0xc
Function at 0x10010e0f
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002a74e
call fcn.10016280
mov esi, ecx
xor edi, edi
xor ebx, ebx
and dword [ebp - 0x814], edi
cmp dword [esi + 0x40], ebx
je 0x10010f3b
push 0x10
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.10016100
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
push str.Caption
push dword [esi + 0x40]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
push 2
push esi
call fcn.10021135
add esp, 0x18
test eax, eax
jne 0x10010ea5
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.10021135
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x814]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
mov edi, eax
test edi, edi
js 0x10010edb
cmp dword [ebp - 0x814], 0
jne 0x10010edb
push 0
push str.Quit
push dword [esi + 0x40]
push 0
push 1
push esi
call fcn.10021135
add esp, 0x18
mov edi, eax
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10010eec
and dword [esi + 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
je 0x10010f3b
cmp dword [ebp - 0x814], 0
jne 0x10010f3b
test edi, edi
jns 0x10010f3b
and dword [ebp - 0x818], 0
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x818]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, edi
call fcn.1001622f
ret
Function at 0x10012866
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002aa12
call fcn.10016280
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012883
xor eax, eax
jmp 0x10012959
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012957
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x1001292d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.1001249d
push ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], edi
call fcn.1001249d
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.100129db
lea ecx, [ebp - 0x244]
call fcn.100129db
push dword [ebp - 0x240]
lea ecx, [ebp - 0x244]
call fcn.10021135
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012937
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012ac9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100128b0
jmp 0x10012950
mov edi, dword [ebp - 0x234]
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.10012ac9
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.1001622f
ret

Function at 0x10021135
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10021144
pop dword [ebp - 0x4c]
mov eax, 0xe8d46d9c
sub eax, 0xd8d25c58
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3e92d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4672
mov edi, eax
mov ebx, 0x6486d11b
add ebx, 0xab7db8e5
add ebx, dword [ebp - 0x4c]
mov edx, 0x594defcd
sub dword [ebp - 0x30], edx
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
xor dword [ebp - 0x40], 0xc55c1ec6
add edi, 4
add ebx, 0x1da08534
add ebx, 0xe25f7ad0
loop 0x10021192
add eax, 0x10c9b
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
push edx
pop eax
pop ebx
ret

Function at 0x402838
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4028d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4028b0
xor eax, eax
push ebp
push 0x4028a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4028ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4028b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409018], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402f79
cmp word [0x40a208], 0xd7b2
jne 0x402f41
cmp dword [0x40a210], 0
jbe 0x402f41
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409024], 0
jne 0x402f95
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403cb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403d1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004031f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040269c
push eax
pop ebx
cmp dword [ebp - 4], 0
je 0x403d04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d21
lea eax, [ebp - 0x10]
call fcn.00403094
ret
Function at 0x4049d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
push eax
pop esi
xor eax, eax
push ebp
push 0x404ada
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x404a23
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push eax
pop ecx
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403184
jmp 0x404ac1
call sub.kernel32.dll_GetCommandLineA_1
push eax
pop ebx
push ebx
pop eax
call fcn.00404984
push eax
pop ebx
push ebx
pop edi
push ebx
pop eax
call fcn.004049a4
push eax
pop ebx
test esi, esi
je 0x404a4b
dec esi
test esi, esi
jl 0x404a4b
cmp edi, ebx
jne 0x404a2a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
push edi
pop edx
call fcn.004031c4
mov eax, dword [ebp - 0x110]
push ebx
pop ecx
sub ecx, edi
mov edx, 1
call fcn.00403464
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
cmp eax, 2
jl 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
push eax
pop ecx
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ae1
lea eax, [ebp - 0x110]
call fcn.00403094
ret

Function at 0x404b9c
Capabilities:
Get file attributes

Disassembly:
call fcn.00404490
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x404bb0
dec eax
and al, 0x10
sete al
ret

Function at 0x404cf8
Capabilities:
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x404d07
dec eax
and al, 0x10
setne al
ret

Function at 0x404f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
push eax
pop ebx
xor eax, eax
push ebp
push 0x404ffa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
push ebx
pop edx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405001
lea eax, [ebp - 0x10c]
call fcn.00403094
ret

Function at 0x405008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
push eax
pop ebx
xor eax, eax
push ebp
push 0x405072
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
push ebx
pop edx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405079
lea eax, [ebp - 0x10c]
call fcn.00403094
ret
Function at 0x405080
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
push ecx
pop ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
mov eax, dword [ebp - 8]
call fcn.004033fc
xor eax, eax
push ebp
push 0x4051db
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
pop eax
call fcn.00403094
cmp dword [ebp - 4], 0
je 0x4050ee
mov eax, dword [ebp - 4]
call fcn.0040320c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4050ee
lea eax, [ebp - 4]
mov edx, 0x4051f0
call fcn.00403214
cmp dword [ebp - 8], 0
je 0x40511d
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x40511d
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404728
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.0040312c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403258
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040340c
push eax
call sub.kernel32.dll_FindFirstFileA
push eax
pop esi
test esi, esi
setne al
jmp 0x4051a6
test dword [ebp - 0x14c], 0x10
ja 0x405193
cmp dword [ebx], 0
je 0x405166
push ebx
pop eax
mov edx, 0x4051fc
call fcn.00403214
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004031f4
push dword [ebp - 0x154]
push ebx
pop eax
mov edx, 3
call fcn.004032cc
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405149
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051e2
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.004030b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004030b8
ret