joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41afbc
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00421a5d
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41aff9
call fcn.0041aa92
mov dword [esi + 0xc], 1
jmp 0x41affe
call fcn.0041aa92
cmp dword [esi], 0
je 0x41b047
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x41b01f
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041af3c
jmp 0x41b031
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401540
push pe_nt_image_headers32
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00404600
jmp 0x41b06b
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x41b06b
push dword [esi]
push dword [ebp + 8]
call fcn.0042af9f
pop esi
pop ebp
ret 0xc

Function at 0x421273
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4212ba
call fcn.00427d67
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4212ba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4212d6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00420d78
mov esi, eax
test edi, edi
je 0x4212d4
test ebx, ebx
je 0x4212d4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42218a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x534a40
call fcn.0051666f
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4221af
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x422201
call fcn.00418851
push eax
lea ecx, [ebp - 0x10]
call fcn.00401370
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0051696f
push eax
call fcn.00414af0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004013f0
mov eax, esi
call fcn.00516747
ret 8
Function at 0x424e46
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x424e8e
call fcn.00427d67
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x424e8e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x424ed1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x424eba
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x424eba
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x424ece
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x47dd89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x47dda3
call fcn.00427d67
mov esi, dword [eax + 0xc]
push dword [0x594c74]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x47ddc1
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x47ddb9
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x47ddee
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x47ddbb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0047dcb7
mov esi, eax
jmp 0x47dde0
Function at 0x4fb3f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4fb40d
mov edi, dword [esi + 0xc]
jmp 0x4fb44d
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4fb426
call fcn.0041907d
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4fb43b
call fcn.0041907d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4fb44d
call fcn.0041907d
call fcn.00427d67
cmp dword [eax + 0x3c], 0
je 0x4fb462
push edi
mov ecx, ebx
call fcn.004fa2bb
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004fb30f
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4fb480
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4fb48c
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5149e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x58fa50]
jne 0x5149f1
repz ret
jmp fcn.0051c584
Function at 0x52a349
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x58fa50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0051f547
and dword [ebp - 0x14], 0
cmp dword [0x5975c4], 0
mov dword [ebp - 0x18], eax
jne 0x52a3fc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x52a4a4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x52a4a4
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x566ad4
push ebx
mov dword [0x5975c4], eax
call edi
push eax
call esi
push 0x566ac0
push ebx
mov dword [0x5975c8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5975cc], eax
call edi
push eax
call esi
mov dword [0x5975d4], eax
test eax, eax
je 0x52a3fc
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5975d0], eax
mov eax, dword [0x5975d0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x52a455
cmp dword [0x5975d4], ecx
je 0x52a455
push eax
call esi
push dword [0x5975d4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x52a455
test ebx, ebx
je 0x52a455
call edi
test eax, eax
je 0x52a44c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x52a44c
test byte [ebp - 8], 1
jne 0x52a455
or dword [ebp + 0x10], 0x200000
jmp 0x52a488
mov eax, dword [0x5975c8]
cmp eax, dword [ebp - 0x18]
je 0x52a488
push eax
call esi
test eax, eax
je 0x52a488
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x52a488
mov eax, dword [0x5975cc]
cmp eax, dword [ebp - 0x18]
je 0x52a488
push eax
call esi
test eax, eax
je 0x52a488
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5975c4]
call esi
test eax, eax
je 0x52a4a4
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x52a4a6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005149e7
leave
ret

Function at 0xdc4fa8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdc4fb2
pushal
call 0xdc4fb8
pop ebp
sub ebp, 0x10
sub ebp, 0x9c4fa8
jmp 0xdc4fce
mov eax, 0x9c4fa8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b5
mov edx, 0x2bd5235
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc4fe5
jmp 0xdc4ff8
mov esi, 0x9bcbef8
xor eax, 0xf4b43535
int 0x35
xor eax, 0x8df83635
xor esi, dword [0x1d8f3535]
xor eax, 0xd7c23535
std
mov esi, 0x353539b4
xor eax, 0x6565f036
pop ebp
push ebp
invalid
Function at 0x40d360
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x439230]
cmp ax, 0xcb
je 0x40d46c
cmp ax, 0xcc
je 0x40d46c
lea esi, [esi]
mov edx, dword [0x4446a0]
test edx, edx
je 0x40d395
mov eax, dword [0x444550]
call edx
mov ebx, eax
jmp 0x40d39a
mov ebx, 0x444554
cmp word [0x444540], 0
jle 0x40d3c0
mov eax, 0x444520
call fcn.0040d5d0
mov eax, ebx
call fcn.0040cf20
mov eax, ebx
call fcn.0040cf90
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40d3e2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40d3dd
mov edx, edi
mov eax, ebx
call fcn.0040c390
jmp 0x40d3e0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40d3c8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x444540], 0
jle 0x40d46c
mov edx, 0x444460
mov eax, ebx
call fcn.0040c4d0
mov edi, eax
test edi, edi
je 0x40d43c
mov eax, dword [0x4444f4]
mov dword [edi + 0xc], eax
cmp dword [0x4444f4], 0
je 0x40d430
mov eax, dword [0x4444f4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x4444f4], eax
nop
sub word [0x444540], 1
cmp word [0x444540], 0
sete bl
mov eax, 0x444520
call fcn.0040d5e0
test bl, bl
je 0x40d46c
mov eax, 0x444520
call fcn.0040d5c0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x40f480
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x444250], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.0040f660
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x444250]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402960
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4392a0], eax
mov ebx, eax
jmp 0x40f623
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x40f508
cmp byte [ebx], 0
je 0x40f62c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x40f583
mov al, byte [ebx]
cmp al, 1
jb 0x40f578
sub al, 0x20
jbe 0x40f548
sub al, 2
je 0x40f55c
jmp 0x40f578
mov al, byte [ebp - 0x114]
test al, al
je 0x40f588
add dword [ebp - 0x110], 1
jmp 0x40f580
cmp byte [ebx + 1], 0x22
je 0x40f573
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40f580
add ebx, 1
jmp 0x40f580
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40f538
test dword [ebp - 0x10c], 0xffffffff
je 0x40f61c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.0040f660
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x444250]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x40f613
mov al, byte [ebx]
cmp al, 1
jb 0x40f608
sub al, 0x20
jbe 0x40f5d8
sub al, 2
je 0x40f5ec
jmp 0x40f608
mov al, byte [ebp - 0x114]
test al, al
je 0x40f618
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x40f610
cmp byte [ebx + 1], 0x22
je 0x40f603
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40f610
add ebx, 1
jmp 0x40f610
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40f5c8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x40f50b
mov ebx, dword [ebp - 0x10c]
mov dword [0x444240], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x444250
call fcn.0040d1a0
mov eax, dword [0x444250]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415230
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10c]
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 0x10c], edx
test edi, edi
jne 0x41527c
mov ebx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.00402cb0
push 0
push 0x105
lea eax, [ebp - 0x108]
push eax
push 0
call fcn.00413650
mov ecx, eax
mov eax, ebx
lea edx, [ebp - 0x108]
call fcn.00408a70
jmp 0x4152d8
call fcn.00413640
mov ebx, eax
lea esi, [esi]
nop
mov eax, ebx
call fcn.004151d0
mov esi, eax
call fcn.004151f0
mov ebx, eax
sub edi, 1
test edi, edi
jge 0x415288
mov eax, ebx
sub eax, esi
cmp eax, 2
jl 0x4152bc
cmp byte [esi], 0x22
jne 0x4152bc
cmp byte [ebx - 1], 0x22
jne 0x4152bc
add esi, 1
sub ebx, 1
lea esi, [esi]
mov edi, dword [ebp - 0x10c]
mov eax, edi
call fcn.00402cb0
push 0
mov eax, edi
mov ecx, ebx
sub ecx, esi
mov edx, esi
call fcn.00408a70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415600
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.004155f0
push ebp
push 0x4102b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax + 0x18], 0
jne 0x41566a
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1c]
test edx, edx
jne 0x415643
mov edx, 0x4442e0
push edx
push esi
mov eax, edi
test edi, edi
jne 0x415650
mov eax, 0x4442e0
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x20]
test edx, edx
jne 0x415660
mov edx, 0x4442e0
push edx
call fcn.00413670
mov ebx, eax
jmp 0x4156b4
mov ebx, esi
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
test eax, eax
jne 0x41567b
mov eax, 0x4442e0
push eax
mov eax, esi
lea edx, [ebp - 4]
call fcn.00414f10
mov eax, dword [ebp - 4]
test eax, eax
jne 0x415692
mov eax, 0x4442e0
push eax
mov eax, edi
test edi, edi
jne 0x41569e
mov eax, 0x4442e0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
test eax, eax
jne 0x4156ae
mov eax, 0x4442e0
push eax
call fcn.00413690
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004155f0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417080
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
and dword [ebx + 0x24], 0xefffffff
test dl, dl
je 0x417098
or dword [ebx + 0x24], 0x10000000
test dl, dl
je 0x4170a2
or byte [ebx + 0x27], 0x10
jmp 0x4170a6
and byte [ebx + 0x27], 0xef
cmp dword [ebx + 0x1c], 0
je 0x4170da
test dl, dl
je 0x4170c4
mov eax, ebx
call dword [0x439ef0]
push 5
push dword [ebx + 0x1c]
call sub.user32.dll_ShowWindow
jmp 0x4170da
and byte [ebx + 0x37], 0xfe
push 0
push dword [ebx + 0x1c]
call sub.user32.dll_ShowWindow
mov eax, ebx
call dword [0x439ef0]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x420654
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x42075e
mov esi, esi
xor eax, eax
push 0x42073f
push ebp
push 0x410630
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040a510
mov eax, 0x38
call fcn.0040c240
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov edx, dword [ebp - 8]
mov ecx, 0x420840
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov eax, 0x420a90
mov ecx, dword [edx + 4]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 8]
mov eax, 0x420ad0
mov ecx, dword [edx + 4]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
mov ecx, dword [ebp - 8]
mov eax, 0x420b00
mov edx, dword [ecx + 4]
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 8]
mov edx, 0x420b30
mov ecx, dword [eax + 4]
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x24], eax
mov eax, dword [ebp - 8]
mov edx, 0x420b50
mov ecx, dword [eax + 4]
mov dword [ecx + 0x28], edx
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 8]
mov edx, 0x420b70
mov ecx, dword [eax + 4]
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0xffffffff
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x420734
cmp dword [ebp - 4], 0
je 0x420734
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x42075e
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42df10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.0042df00
push ebp
push 0x4102b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x42df80
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.00409b20
cmp ebx, 1
jle 0x42df70
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.004096d0
jmp 0x42df8b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407640
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0042df00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42e390
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0042e380
push ebp
push 0x4102b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4451f0
xor edx, edx
call fcn.00407640
mov dword [0x445210], 0xffffffff
mov eax, 0x4451f4
xor edx, edx
call fcn.00407640
mov dword [0x445214], 0xffffffff
mov eax, 0x4451f8
xor edx, edx
call fcn.00407640
mov dword [0x445218], 0xffffffff
mov eax, 0x4451fc
xor edx, edx
call fcn.00407640
mov dword [0x44521c], 0xffffffff
mov eax, 0x445200
xor edx, edx
call fcn.00407640
mov dword [0x445220], 0xffffffff
mov eax, 0x445204
xor edx, edx
call fcn.00407640
mov dword [0x445224], 0xffffffff
mov eax, 0x445208
xor edx, edx
call fcn.00407640
mov dword [0x445228], 0xffffffff
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x42e4b8
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00408030
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.00427b60
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x42e4b8
push 4
push ebx
push esi
mov eax, 0x42e260
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x42e2f0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042e380
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ead0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x445250], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x4450b0], eax
mov eax, dword [ebp - 0x90]
mov dword [0x4450c0], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x4450d0], eax
mov eax, dword [ebp - 0x88]
mov dword [0x4450e0], eax
mov edx, 0x4450f1
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00402960
lea eax, [ebp - 0x80]
call fcn.00403680
mov byte [0x4450f0], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x445260], eax
test eax, eax
je 0x42eb70
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x445260]
call sub.kernel32.dll_GetProcAddress
mov dword [0x445250], eax
nop
cmp dword [0x4450c0], 6
jae 0x42eb84
mov dword [0x43ab60], 0
nop
cmp dword [0x4450c0], 6
jb 0x42eba0
cmp dword [0x4450d0], 1
jb 0x42eba0
mov dword [0x43ab70], 2
mov esp, ebp
pop ebp
ret
Function at 0x436f60
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov ebx, eax
mov si, dx
mov edi, ecx
cmp dword [ebx + 0xc], 0
jne 0x437008
nop
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0xc], eax
mov word [ebp - 0x10], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
test edi, edi
jne 0x436fa7
mov dword [ebp - 0xc], 0
jmp 0x436fb9
test edi, edi
jne 0x436fb0
mov edi, 0x4442e0
push edi
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0xc]
call sub.wsock32.dll_bind
cmp eax, 0xffffffff
jne 0x436fdd
push dword [ebx + 0xc]
call sub.wsock32.dll_closesocket
mov dword [ebx + 0xc], 0
jmp 0x437008
call fcn.00413d50
mov dword [ebx + 8], eax
push 0x28
push 0x400
push dword [0x445280]
push dword [ebx + 0xc]
call sub.wsock32.dll_WSAAsyncSelect
cmp dword [ebx + 0x24], 0
je 0x437008
mov eax, dword [ebx + 0x28]
mov edx, ebx
call dword [ebx + 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret