joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ad5e
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4faca5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.0045a790
mov ecx, dword [ebp - 0x40]
cmp dword [ecx], 0
je 0x45adb5
push 0x14
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x10
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040f300
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::Draw3dRect
jmp 0x45ade1
mov edx, dword [ebp - 0x40]
cmp dword [edx + 4], 0
je 0x45ade1
push 0x10
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040f300
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::Draw3dRect
mov ecx, dword [ebp + 8]
call fcn.0045b000
mov dword [ebp - 0x34], eax
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x38]
push 1
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::SetBkMode
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.00449af0
mov dword [ebp - 4], 0
push 0x58
mov ecx, dword [ebp + 8]
call fcn.0045a6e0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0x60
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x24], eax
push 0
push str.Marlett
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x30]
call sub.MFC42u.DLL_CFont::CreatePointFont
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
mov dword [ebp - 0x38], eax
push 0x53afc4
lea ecx, [ebp - 0x3c]
call sub.MFC42u.DLL_CString::CString_1
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 0xc]
add eax, 2
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + 8]
add edx, 2
push edx
mov ecx, dword [ebp + 8]
call fcn.0045b020
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.004f5766
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42u.DLL_CDC::SetBkMode
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax + 0x38]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00449b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6357
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fff30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x1f8
call fcn.00448760
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x4a651b
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x60]
jge 0x4a651b
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
add eax, 2
push eax
lea ecx, [ebp - 0x14]
call sub.MFC42u.DLL_CString::CString_1
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
lea eax, [edx + ecx*4 + 0x64]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0046c110
and eax, 0xff
test eax, eax
je 0x4a650a
push 0xff
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + edx*4 + 0x64]
call fcn.0040e380
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x1f4]
add edx, 2
push edx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString_2
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0x3e8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx + eax*4 + 0x64]
call fcn.0040e380
push eax
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push str.NULL
push str.LANGUAGE
push 0x542598
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::ReleaseBuffer
push 0x5425a4
push 0x5425a8
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::Replace
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0x28]
and ecx, 0xffff
and ecx, 0x3ff
mov byte [ebp - 0x24], cl
mov edx, dword [ebp - 0x28]
and edx, 0xffff
sar edx, 0xa
mov byte [ebp - 0x1c], dl
push str.CHINESE_SIMPLIFIED
lea eax, [ebp - 0x18]
push eax
call fcn.004a6610
and eax, 0xff
test eax, eax
je 0x4a64b8
mov byte [ebp - 0x24], 4
mov byte [ebp - 0x1c], 2
jmp 0x4a64e1
push str.CHINESE_TRADITIONAL
lea ecx, [ebp - 0x18]
push ecx
call fcn.004a6610
and eax, 0xff
test eax, eax
je 0x4a64d9
mov byte [ebp - 0x24], 4
mov byte [ebp - 0x1c], 1
jmp 0x4a64e1
mov byte [ebp - 0x24], 9
mov byte [ebp - 0x1c], 1
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
mov cl, byte [ebp - 0x24]
mov byte [eax], cl
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
mov cl, byte [ebp - 0x1c]
mov byte [eax + 1], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004f5766
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004f5766
jmp 0x4a655a
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 0x60]
jl 0x4a655a
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x1f4]
mov byte [edx], 9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x1f4]
mov byte [ecx + 1], 1
push str.DEFENGLISH
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1f4]
add eax, 2
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4ba70c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501d44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1ac
push esi
push edi
mov dword [ebp - 0xb0], ecx
call dword [sym.imp.DataMgr.dll_class_CDataMgr____cdecl_gf_GetDataMgr_void_]
mov ecx, eax
call dword [sym.imp.DataMgr.dll_public:_class_CPenBox____thiscall_CDataMgr::GetPenBox_void_]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call dword [sym.imp.DataMgr.dll_public:_class_CMarkPen____thiscall_CPenBox::GetPen_int_const__const]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4ba75e
jmp 0x4bb91d
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x2e0], edx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xc], 0
je 0x4ba98c
push 0
push 0xbda
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x50c
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x50a
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x3f1
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x43a
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x598
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x44a
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x42d
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x5ae
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
push 0x5af
mov ecx, dword [ebp - 0xb0]
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::EnableWindow
push 0
invalid
invalid
Function at 0x4f3580
Capabilities:
Print debug messages

Disassembly:
mov ax, word [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov word [edi + 0x46], ax
xor eax, eax
mov ax, word [edi + 0x5a]
cmp eax, 5
je 0x4f35d1
cmp eax, 9
je 0x4f35b0
push edi
push edi
call fcn.004f3bd0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edi + 0x52]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x60
push edi
push 0x60
push edi
push 0x9c406404
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, 0x12b
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..LPT1
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4f3613
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4f3640
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebp
dec ebp
test eax, eax
jne 0x4f35dc
mov edx, dword [edi + 0x52]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x60
push edi
push 0x60
push edi
push 0x22000f
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp esi, 0xffffffff
je 0x4f363b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x4f364c
push str.Not_Find_file_LPT1
jmp 0x4f3651
push str.unknow_error_in_createfile_LPT1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test ebp, ebp
jne 0x4f3613
mov word [edi], 0x81
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4f3b90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
test bx, bx
mov esi, edi
mov eax, edi
jbe 0x4f3bc7
push ebp
and ebx, 0xffff
movzx dx, byte [ecx]
mov ebp, edx
sub ebp, eax
xor ebp, edi
add ebp, esi
dec ecx
mov eax, ebp
dec ebx
mov byte [ecx + 1], al
mov esi, edx
jne 0x4f3baf
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f4b90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x567744]
sub esp, 0xc
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
jne 0x4f4c15
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebp, ebp
mov byte [esp + 0x10], bl
lea eax, [esp + 0x20]
push ebx
push eax
lea ecx, [esp + 0x18]
push 8
push ecx
push ebx
push ebx
push 0x220020
push esi
call edi
test eax, eax
je 0x4f4be7
cmp byte [esp + 0x10], 0xff
je 0x4f4bf7
inc ebp
cmp ebp, 0x1f4
jl 0x4f4bb2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax], edx
pop esi
mov dword [eax + 4], ecx
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [esp + 0x10], bl
xor ebp, ebp
lea edx, [esp + 0x20]
push ebx
push edx
lea eax, [esp + 0x18]
push 9
push eax
push esi
call edi
test eax, eax
je 0x4f4c5e
mov eax, dword [0x567748]
cmp eax, ebx
mov al, byte [esp + 0x18]
je 0x4f4c4e
cmp al, byte [0x567734]
je 0x4f4c55
cmp byte [esp + 0x11], 0xff
je 0x4f4c6e
inc ebp
cmp ebp, 0x1f4
jl 0x4f4c25
pop edi
pop esi
mov dword [0x567748], ebx
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x11]
mov edx, dword [esp + 0x15]
mov byte [0x567734], al
mov eax, dword [esp + 0x24]
mov dword [0x567748], ebx
pop edi
mov dword [eax], ecx
pop esi
mov dword [eax + 4], edx
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x4f4d30
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esp + 8]
mov ecx, dword [esp + 4]
push ebx
xor eax, eax
mov bl, byte [eax + ecx]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, 0xa
jl 0x4f4d3b
pop ebx
ret
Function at 0x4f5210
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
xor ebp, ebp
call fcn.004f53d0
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4f5238
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx]
lea eax, [edx*4 + 4]
push eax
call sub.MSVCRT.dll_malloc
mov esi, dword [esp + 0x20]
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi], edi
jne 0x4f5262
pop edi
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [ebx]
xor eax, eax
push 0x8000
lea ecx, [ecx*4 + 4]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call sub.MSVCRT.dll_malloc
add esp, 4
mov edi, eax
mov dword [esp + 0x18], edi
push 4
push edi
push 0
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x4f52b6
push edi
mov dword [ebx], eax
call sub.MSVCRT.dll_free
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [edi + 4]
mov ebx, edi
cmp edi, eax
jae 0x4f53b5
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4f53b1
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push edx
call fcn.004f6720
add esp, 0xc
test eax, eax
jne 0x4f5392
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 8
push ecx
call sub.MSVCRT.dll_malloc
mov ecx, dword [esi]
mov edi, ebx
add esp, 4
mov dword [ecx + ebp*4], eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi]
repne scasb al, byte es:[edi]
mov edi, dword [edx + ebp*4]
not ecx
add ecx, 3
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
mov edi, ebx
not ecx
mov edx, dword [eax + ebp*4]
add ecx, 3
mov dword [edx], ecx
mov eax, dword [esi]
mov edx, dword [0x54efd0]
mov ecx, dword [eax + ebp*4]
add ecx, 4
mov dword [ecx], edx
mov al, byte [0x54efd4]
mov byte [ecx + 4], al
mov ecx, dword [esi]
xor eax, eax
mov edx, dword [ecx + ebp*4]
or ecx, 0xffffffff
add edx, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
add eax, 4
lea ebx, [ebx + ecx + 1]
cmp ebx, eax
jb 0x4f52c3
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push edi
mov dword [ecx], ebp
call sub.MSVCRT.dll_free
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401ef9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401f34
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401f30
lea ebx, [ebx]
cmp esi, eax
jae 0x401f34
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401f20
cmp esi, eax
jb 0x401f3a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401fa0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1804]
mov eax, 0x1804
call fcn.00421240
push 0xffffffffffffffff
push 0x433900
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4435f0]
xor eax, ebp
mov dword [ebp + 0x1800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp + 0x800]
push eax
call fcn.00420160
push 0x800
push ebx
lea ecx, [ebp + 0x1000]
push ecx
call fcn.00420160
push 0x800
push ebx
lea edx, [ebp]
push edx
call fcn.00420160
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [esi], ebx
je 0x402028
mov al, 1
jmp 0x402100
push 0x400
lea eax, [ebp + 0x800]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x402050
mov byte [ebp - 0x12], bl
push 0x43f0f8
lea ecx, [ebp - 0x12]
push ecx
call fcn.00420e78
push 0x5c
lea edx, [ebp + 0x800]
push edx
call fcn.0041e7f3
add esp, 8
mov edi, eax
cmp edi, ebx
je 0x40206c
add edi, 2
jmp 0x402071
mov edi, str.SSLog
lea eax, [ebp + 0x1000]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea ecx, [ebp + 0x1000]
push ecx
push str._s_s.log
lea edx, [ebp]
call fcn.00401840
add esp, 0xc
push ebx
push 0x80
push 4
push ebx
mov ebx, 1
push ebx
push 0xc0000000
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
setne al
mov byte [ebp - 0x11], al
mov byte [esi + 0x208], bl
push str.Wireless_Settint_Program_Exe
push 0x100
lea ecx, [esi + 8]
push ecx
call fcn.0041e787
add esp, 0xc
mov ecx, esi
call fcn.00402320
lea edx, [ebp]
push edx
call fcn.004028e0
add esp, 4
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1800]
xor ecx, ebp
call fcn.0041e0b3
add ebp, 0x1804
mov esp, ebp
pop ebp
ret
Function at 0x4025e0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.00421240
push 0xffffffffffffffff
push 0x4337e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4435f0]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ebx, edx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, dword [edi]
cmp esi, eax
jne 0x402644
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi], eax
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x4026ab
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x1000
push 0
lea eax, [ebp]
push eax
call fcn.00420160
add esp, 0xc
push 0
push 0
push 0x1000
lea ecx, [ebp]
push ecx
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402681
sub eax, edx
push 0
lea edx, [ebp - 0x18]
push edx
push eax
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0041e0b3
add ebp, 0x1004
mov esp, ebp
pop ebp
ret
Function at 0x402720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4337c0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4435f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x402863
mov eax, ebx
lea edx, [eax + 2]
jmp 0x402770
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402770
sub eax, edx
sar eax, 1
je 0x402863
cmp dword [ebp + 0xc], edi
je 0x402863
cmp dword [ebp + 0x10], edi
je 0x402863
mov eax, str.InstalledWSP
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4027a0
sub eax, edx
sar eax, 1
je 0x4027e2
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push str.InstalledWSP
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x4027e8
mov dword [ebp - 0x24], eax
push 0x43f12c
lea edx, [ebp - 0x24]
push edx
call fcn.00420e78
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00402bbf
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, edi
jne 0x402812
mov dword [ebp - 0x28], 0xe
push 0x43f12c
lea edx, [ebp - 0x28]
push edx
call fcn.00420e78
lea eax, [ebp + 0x10]
push eax
push esi
lea ecx, [ebp - 0x1c]
push ecx
push edi
push ebx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 1
je 0x402845
mov dword [ebp - 0x2c], 0x57
push 0x43f12c
lea eax, [ebp - 0x2c]
push eax
call fcn.00420e78
mov eax, dword [ebp + 0x10]
push eax
push esi
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041e70c
add esp, 0x10
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
jmp 0x4028a1
mov dword [ebp - 0x30], 0x57
push 0x43f12c
lea edx, [ebp - 0x30]
push edx
call fcn.00420e78
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, 0x40289f
ret
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x4028b4
cmp eax, dword [ebp + 8]
je 0x4028b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
cmp eax, edi
je 0x4028c4
push eax
call fcn.00402bc4
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403840
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4435f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x40387d
push 0x434ac8
push 4
push eax
call fcn.0041e787
push eax
call fcn.00401890
add esp, 0x10
jmp 0x40388f
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4038fa
push edi
call fcn.00420ac0
mov edi, dword [eax]
call fcn.00420ac0
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00420a66
add esp, 0x18
mov ebx, eax
call fcn.00420ac0
cmp dword [eax], 0
je 0x4038da
call fcn.00420ac0
push dword [eax]
call fcn.0040379d
pop ecx
jmp 0x4038e1
call fcn.00420ac0
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x4038fa
cmp ebx, esi
jae 0x4038fa
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x4038fc
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e0b3
leave
ret