joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401310
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0c
mov eax, dword [0x44f044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xab0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp eax, 0x104
ja 0x401376
test eax, eax
je 0x401376
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cd1b
add esp, 0xc
lea eax, [ebp - 0x20c]
push str._selfdel.dll
push eax
call esi
jmp 0x40138f
push str.C:_selfdel.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cd1b
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x69
push edi
call fcn.004014f0
add esp, 0xc
lea eax, [ebp - 0x824]
push 0x618
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str._rundll32.exe
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4013f3
push 0x618
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._rundll32.exe
lea eax, [ebp - 0x824]
push eax
call esi
push 0x445c14
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push 0x445c18
lea eax, [ebp - 0x824]
push eax
call esi
push 0x208
lea eax, [ebp - 0xcb8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x445c2c
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0xcb8]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push 0x445c2c
lea eax, [ebp - 0x824]
push eax
call esi
push 0x445c14
lea eax, [ebp - 0x824]
push eax
call esi
push 0xa
lea eax, [ebp - 0x8a8]
push eax
push dword [0x44fc70]
call fcn.0040d551
add esp, 0xc
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push 0x44
lea eax, [ebp - 0xd0c]
push 0
push eax
call fcn.00403ba0
add esp, 0xc
mov dword [ebp - 0xce0], 0x80
lea eax, [ebp - 0xcc8]
push eax
lea eax, [ebp - 0xd0c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x824]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402bcd
mov esp, ebp
pop ebp
ret
Function at 0x4014f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x100
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401560
Capabilities:
Delete directory
Delete file
Get session user name
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x44f044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x44f008
mov dword [ebp - 0x418], 0x104
push dword [esi]
call edi
test eax, eax
jne 0x4015b1
call ebx
cmp eax, 5
jne 0x4015b1
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi]
call edi
add esi, 4
cmp esi, 0x44f02c
jl 0x401591
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x44591c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cd1b
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cc46
push str.userData.xml.gz
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x401646
call ebx
cmp eax, 5
jne 0x401646
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x44591c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cd1b
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040cc46
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x20c]
add esp, 0x18
push eax
call ebx
mov edi, 0x44f02c
nop dword [eax + eax]
mov esi, dword [edi]
mov ecx, 0x4453cc
mov eax, esi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016c6
test dx, dx
je 0x4016c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4016a0
xor eax, eax
jmp 0x4016cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x401744
mov ecx, str..LOGS
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016fc
test dx, dx
je 0x4016f8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016fc
add eax, 4
add ecx, 4
test dx, dx
jne 0x4016d6
xor eax, eax
jmp 0x401701
sbb eax, eax
or eax, 1
test eax, eax
je 0x401744
mov eax, 0x4453d8
mov ecx, esi
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x401736
test dx, dx
je 0x401732
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x401736
add ecx, 4
add eax, 4
test dx, dx
jne 0x401710
xor eax, eax
jmp 0x40173b
sbb eax, eax
or eax, 1
test eax, eax
je 0x401744
push esi
call ebx
jmp 0x40174d
push esi
call fcn.00401000
add esp, 4
add edi, 4
cmp edi, 0x44f03c
jl 0x401690
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402bcd
mov esp, ebp
pop ebp
ret
Function at 0x401a80
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.00402be0
mov eax, dword [0x44f044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.SHGetFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push 2
push 0
call eax
test eax, eax
js 0x401c6e
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_Install.lnk
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cc46
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsBatch_Tool.lnk
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Products.lnk
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Install.lnk
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_UnInstall.lnk
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0xc34]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xe3c]
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_Uninstall
lea eax, [ebp - 0xe3c]
push 0x104
push eax
call fcn.0040cc46
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0xe3c]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_Graphics
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x1044]
push eax
call esi
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00402bcd
mov esp, ebp
pop ebp
ret
Function at 0x401c90
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124c
call fcn.00402be0
mov eax, dword [0x44f044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.SHGetFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push dword [ebp + 8]
push 0
call eax
test eax, eax
js 0x401ec4
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_Install.lnk
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cc46
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsBatch_Tool.lnk
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Products.lnk
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_UninstallUninstall_Mentor_Install.lnk
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_Graphics_LicensingConfigure_Licensing.lnk
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0xc34]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xe3c]
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_UnInstall.lnk
lea eax, [ebp - 0xe3c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0xe3c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_GraphicsMentor_Uninstall
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cc46
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x1044]
add esp, 0x18
push eax
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_Graphics
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x124c]
push eax
call esi
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00402bcd
mov esp, ebp
pop ebp
ret
Function at 0x401ee0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124c
call fcn.00402be0
mov eax, dword [0x44f044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.shfolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.SHGetFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push dword [ebp + 8]
push 0
call eax
test eax, eax
js 0x402114
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cd1b
push str.SiemensSiemens_Install.lnk
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040cc46
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cd1b
push str.SiemensBatch_Tool.lnk
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cd1b
push str.SiemensSiemens_UninstallUninstall_Siemens_Products.lnk
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cd1b
push str.SiemensSiemens_UninstallUninstall_Siemens_Install.lnk
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0xa2c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_LicensingConfigure_Licensing.lnk
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0xc34]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0xe3c]
push eax
call fcn.0040cd1b
push str.SiemensSiemens_Uninstall
lea eax, [ebp - 0xe3c]
push 0x104
push eax
call fcn.0040cc46
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0xe3c]
add esp, 0x18
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cd1b
push str.Mentor_Licensing
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x1044]
push eax
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040cd1b
push 0x4458f0
lea eax, [ebp - 0x124c]
push 0x104
push eax
call fcn.0040cc46
add esp, 0x18
lea eax, [ebp - 0x124c]
push eax
call esi
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00402bcd
mov esp, ebp
pop ebp
ret
Function at 0x402130
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x44f044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44598c
push 0
call fcn.0042197a
push 0x110
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.00403ba0
add esp, 0x14
mov dword [ebp - 0x198], 0x114
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x194], 6
push 0x40
sbb eax, eax
inc eax
mov dword [0x44fc74], eax
lea eax, [ebp - 0x84]
push eax
push 0x445990
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40224b
push esi
lea eax, [ebp - 0x84]
push 0x5f
push eax
call fcn.00403855
add esp, 8
test eax, eax
je 0x4021d7
mov esi, 0x2d
mov word [eax], si
add eax, 2
push 0x5f
push eax
call fcn.00403855
add esp, 8
test eax, eax
jne 0x4021c2
cmp dword [0x44fc74], 0
je 0x402237
push ebx
push edi
push 0x4459a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x4459bc
push edi
call esi
push 0x4459d0
push edi
mov ebx, eax
call esi
push 4
push 0x44fc70
push 0x20000001
lea ecx, [ebp - 0x84]
push ecx
call eax
movzx eax, word [0x44fc70]
push eax
call ebx
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402bcd
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x84]
push eax
call sub.Nlsdl.dll_DownlevelLocaleNameToLCID
mov dword [0x44fc70], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402bcd
mov esp, ebp
pop ebp
ret
Function at 0x42eb35
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042e914

Function at 0x430d73
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043056d

Function at 0x430d7e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004307a8

Function at 0x4382d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00437ed8

Function at 0x4382de
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438059
Function at 0x405b4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405bb2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404208
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c84
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b9c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bb9
lea eax, [ebp - 0x10]
call fcn.00403f98
ret

Function at 0x40ada8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ade1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404088
jmp 0x40adea
mov eax, ebx
mov edx, esi
call fcn.00403fec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40adf4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ae15
mov al, byte [esp]
jmp 0x40ae17
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b49c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b314
mov eax, dword [0x4699a8]
cmp byte [eax], 0
je 0x40b518
mov eax, dword [0x4697bc]
call fcn.00402af0
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040861c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b560
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b54e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46976c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46a664]
call fcn.00405060
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bdb4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40be8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404030
lea eax, [ebp - 8]
call fcn.004044a8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404458
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40be74
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40be6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404458
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40be57
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40be9c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40be57
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be74
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be91
lea eax, [ebp - 8]
call fcn.00403f98
ret

Function at 0x40c3e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c444
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404208
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408110
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c44b
lea eax, [ebp - 0xc]
call fcn.00403f98
ret

Function at 0x41a89c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46a884
cmp dword [edi], 0
jne 0x41a918
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46a880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4683ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a874
lea eax, [esi + 5]
call fcn.0041a894
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a894
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a8ed
mov dword [0x46a880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41be9c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41bea2
ret
Function at 0x41e338
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e389
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e370
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e360
jmp 0x41e389
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e371
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4271b4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404448
xor eax, eax
push ebp
push 0x4272e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4272b5
xor eax, eax
push ebp
push 0x4272ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404258
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x427283
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x427272
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404258
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404458
mov edx, ebx
pop ecx
call fcn.004028b8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427279
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x469718]
mov dl, 1
mov eax, dword [0x406e94]
call fcn.0040b620
call fcn.004039d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4272e9
lea eax, [ebp - 4]
call fcn.00403f98
ret