joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ff44
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000feef
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000ff0d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000ff6b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000ff52
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000ff5b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000ff65
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000ff47
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000fed1
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x10010032
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
Function at 0x10011d46
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10028ed8]
je 0x10011d61
inc edi
cmp edi, 0x17
jb 0x10011d52
cmp edi, 0x17
jae 0x10011ee1
push ebp
push 3
call fcn.10017aa3
cmp eax, 1
pop ecx
je 0x10011ead
push 3
call fcn.10017aa3
test eax, eax
pop ecx
jne 0x10011d95
cmp dword [0x1002beb4], 1
je 0x10011ead
cmp ebx, 0xfc
je 0x10011ee0
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1002c4b0
push ebp
call fcn.10016caa
add esp, 0xc
test eax, eax
je 0x10011dcb
push esi
push esi
push esi
push esi
push esi
call fcn.10012e05
add esp, 0x14
push 0x104
mov esi, 0x1002c4c9
push esi
push 0
mov byte [0x1002c5cd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10011e0f
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10016caa
add esp, 0xc
test eax, eax
je 0x10011e0f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10012e05
add esp, 0x14
push esi
call fcn.10016d10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10011e54
push esi
call fcn.10016d10
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1002c7c4
push 0x1002221c
sub ecx, eax
push ecx
push eax
call fcn.100179f0
add esp, 0x14
test eax, eax
je 0x10011e54
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10012e05
add esp, 0x14
jmp 0x10011e56
xor esi, esi
push 0x10022218
push ebx
push ebp
call fcn.1001797f
add esp, 0xc
test eax, eax
je 0x10011e76
push esi
push esi
push esi
push esi
push esi
call fcn.10012e05
add esp, 0x14
push dword [edi*8 + 0x10028edc]
push ebx
push ebp
call fcn.1001797f
add esp, 0xc
test eax, eax
je 0x10011e98
push esi
push esi
push esi
push esi
push esi
call fcn.10012e05
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.100177c2
add esp, 0xc
jmp 0x10011ee0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10011ee0
cmp ebp, 0xffffffff
je 0x10011ee0
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10028edc]
push dword [esi]
call fcn.10016d10
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100177c2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000ffb2
xor ebx, ebx
cmp dword [0x1002c934], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10017898
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10017978
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10017978
push eax
call fcn.1000ff44
mov dword [esp], 0x10022b18
push edi
mov dword [0x1002c934], eax
call esi
push eax
call fcn.1000ff44
mov dword [esp], 0x10022b04
push edi
mov dword [0x1002c938], eax
call esi
push eax
call fcn.1000ff44
mov dword [0x1002c93c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000d343
test eax, eax
pop ecx
pop ecx
je 0x10017866
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012e05
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10017898
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1000ff44
cmp eax, ebx
pop ecx
mov dword [0x1002c944], eax
je 0x10017898
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000ff44
pop ecx
mov dword [0x1002c940], eax
mov eax, dword [0x1002c940]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001791d
cmp dword [0x1002c944], ecx
je 0x1001791d
push eax
call fcn.1000ffbb
push dword [0x1002c944]
mov esi, eax
call fcn.1000ffbb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001791d
cmp edi, ebx
je 0x1001791d
call esi
cmp eax, ebx
je 0x100178ea
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100178ea
test byte [ebp - 0x18], 1
jne 0x1001791d
lea eax, [ebp - 0x10]
push eax
call fcn.1000d37a
test eax, eax
pop ecx
je 0x10017905
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012e05
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10017914
or dword [ebp + 0x10], 0x200000
jmp 0x10017958
or dword [ebp + 0x10], 0x40000
jmp 0x10017958
mov eax, dword [0x1002c938]
cmp eax, dword [ebp - 8]
je 0x10017958
push eax
call fcn.1000ffbb
cmp eax, ebx
pop ecx
je 0x10017958
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10017958
mov eax, dword [0x1002c93c]
cmp eax, dword [ebp - 8]
je 0x10017958
push eax
call fcn.1000ffbb
cmp eax, ebx
pop ecx
je 0x10017958
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002c934]
call fcn.1000ffbb
cmp eax, ebx
pop ecx
je 0x10017978
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001797a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001e76e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10028cb8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1001e703
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1000d220
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1001e7bd
cmp dword [ebp - 0x1c], 5
jb 0x1001e7d5
jmp 0x1001e7d1
cmp dword [ebp - 0x10], 1
jne 0x1001e7d5
cmp dword [ebp - 0x1c], 4
ja 0x1001e7d1
jne 0x1001e7d5
cmp dword [ebp - 0x18], 0
jbe 0x1001e7d5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100235c8
call fcn.1001e5d7
test eax, eax
jge 0x1001e7f6
mov byte [0x1002ca94], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000c7b4
add ebp, 0x78
leave
ret
Function at 0x4116d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x62f630]
cmp ax, 0xcb
je 0x4117cf
cmp ax, 0xcc
je 0x4117cf
mov edx, dword [0x6f8710]
test edx, edx
je 0x411702
mov eax, dword [0x6f85c0]
call edx
mov ebx, eax
jmp 0x411707
mov ebx, 0x6f85c4
cmp word [0x6f85b0], 0
jle 0x41172a
mov eax, 0x6f8590
call fcn.00411980
mov eax, ebx
call fcn.004112a0
mov eax, ebx
call fcn.00411320
mov esi, dword [ebx]
jmp 0x41174d
mov edi, dword [esi + 4]
test byte [esi], 1
jne 0x411748
mov edx, esi
mov eax, ebx
call fcn.00410740
jmp 0x41174b
and dword [esi], 0xfffffffe
mov esi, edi
test esi, esi
jne 0x411730
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x6f85b0], 0
jle 0x4117cf
mov edx, 0x6f84d0
mov eax, ebx
call fcn.00410890
mov esi, eax
test eax, eax
je 0x4117a2
mov eax, dword [0x6f8564]
mov dword [esi + 0xc], eax
cmp dword [0x6f8564], 0
je 0x411797
mov eax, dword [0x6f8564]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x94]
mov dword [0x6f8564], eax
sub word [0x6f85b0], 1
cmp word [0x6f85b0], 0
sete bl
mov eax, 0x6f8590
call fcn.004119a0
test bl, bl
je 0x4117cf
mov eax, 0x6f8590
call fcn.00411970
pop edi
pop esi
pop ebx
ret
Function at 0x413e00
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00413df0
push ebp
push 0x415910
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x6f8710]
test edx, edx
je 0x413e3a
mov eax, dword [0x6f8170]
call edx
jmp 0x413e3f
mov eax, 0x6f8174
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x413e55
mov eax, 0x6f82e0
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [eax - 1]
lea eax, [ebp - 0xc]
call fcn.0040c220
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x413e78
mov eax, 0x6f82e0
push eax
push esi
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x413e86
mov eax, 0x6f82e0
push eax
call sub.kernel32.dll_GetFullPathNameW
mov edx, eax
test eax, eax
je 0x413f30
jmp 0x413ea3
sub edx, 1
cmp edx, 3
jbe 0x413eb4
mov eax, dword [ebp - 0xc]
cmp word [eax + edx*2 - 2], 0x5c
je 0x413ea0
xor ecx, ecx
sub esi, 1
sbb ecx, 0
mov ebx, edx
xor eax, eax
cmp ecx, eax
jne 0x413ec8
cmp esi, ebx
je 0x413ed0
lea eax, [ebp - 0xc]
call fcn.0040c220
mov eax, 0x401250
mov edx, dword [ebp - 0xc]
call fcn.00413d30
cmp word [edi], 0
jne 0x413f3d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x413eee
mov eax, dword [eax - 4]
cmp eax, 2
jle 0x413f3d
mov eax, dword [ebp - 0x14]
cmp word [eax + 2], 0x3a
jne 0x413f3d
mov word [ebp - 8], 0x3d
mov eax, dword [ebp - 0x14]
mov dx, word [eax]
mov word [ebp - 6], dx
mov dword [ebp - 4], 0x3a
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x413f21
mov eax, 0x6f82e0
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_SetEnvironmentVariableW
jmp 0x413f3d
mov eax, 0x401250
mov edx, dword [ebp - 0x14]
call fcn.00413d30
cmp word [edi], 2
jne 0x413f49
mov word [edi], 3
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413f60
push ebp
push 0x415910
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x4140b0
movzx eax, byte [ebp - 0x20]
add eax, 0x40
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040c220
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41400a
mov eax, 0x6f82e0
push eax
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test eax, eax
jne 0x414060
call sub.kernel32.dll_GetLastError
call fcn.004045b0
lea eax, [ebp - 0x10]
call fcn.0040acc0
movzx eax, byte [ebp - 0x20]
add eax, 0x40
lea edx, [ebp - 0x14]
call fcn.0040b170
mov edx, dword [ebp - 0x14]
mov ecx, 0x6673a0
lea eax, [ebp - 0x10]
call fcn.0040aff0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b9d0
jmp 0x4140fc
mov edi, esi
xor eax, eax
sub edi, 1
sbb eax, 0
mov edx, ebx
xor ecx, ecx
cmp eax, ecx
jne 0x414076
cmp edi, edx
je 0x414080
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040c220
cmp byte [0x62f8c0], 0
jne 0x4140fc
lea edx, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call fcn.0040c820
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040baf0
jmp 0x4140fc
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040c220
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x4140d4
mov edx, 0x6f82e0
push edx
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x62f8c0], 0
jne 0x4140fc
lea edx, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call fcn.0040c820
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040baf0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00413f60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414940
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x22c]
push ebx
push esi
push edi
call sub.kernel32.dll_GetCommandLineA
mov dword [0x62f6b0], eax
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
push 0x105
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
push 0
push 0
push 0
push 0
mov esi, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
movzx eax, word [0x6f7040]
push eax
call sub.kernel32.dll_WideCharToMultiByte
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x218]
push eax
xor ecx, ecx
xor edx, edx
mov edi, ebx
mov eax, ebx
call fcn.00414780
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [0x6f8240], eax
mov dword [0x6f8770], 0
nop dword [eax]
mov eax, dword [0x6f8240]
shl eax, 2
add eax, dword [0x6f8770]
mov dword [0x6f8250], eax
mov eax, dword [0x6f8240]
shl eax, 2
add eax, dword [0x6f8250]
lea ebx, [eax + 4]
add eax, 4
lea eax, [eax + esi*2]
add eax, 2
mov edx, dword [ebp - 0x214]
lea eax, [eax + edx*2]
mov dword [ebp - 0x228], eax
cmp dword [0x6f8770], 0
jne 0x414a31
mov eax, dword [ebp - 0x228]
mov edx, dword [ebp - 0x22c]
lea eax, [eax + edx + 1]
add eax, dword [ebp - 0x210]
call fcn.00411090
mov dword [0x6f8770], eax
test eax, eax
jne 0x4149c8
lea eax, [ebp - 0x20c]
lea ecx, [esi + esi]
mov edx, ebx
call fcn.00403340
mov word [ebx + esi*2], 0
mov eax, dword [0x6f8770]
mov edx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x224]
push eax
lea ecx, [edx + esi*2 + 2]
mov eax, dword [0x6f8770]
lea edx, [eax + 4]
mov eax, edi
call fcn.00414780
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x22c]
lea eax, [ecx + eax + 1]
add eax, dword [ebp - 0x210]
mov edi, eax
mov esi, dword [ebp - 0x218]
test esi, esi
jl 0x414af9
mov ebx, 0xffffffff
nop dword [eax]
add ebx, 1
mov edx, dword [0x6f8250]
mov eax, dword [ebp - 0x228]
mov dword [edx + ebx*4], eax
push 0
push 0
mov eax, edi
sub eax, dword [ebp - 0x228]
push eax
push dword [ebp - 0x228]
mov eax, dword [0x6f8770]
mov eax, dword [eax + ebx*4]
call fcn.00404f20
push eax
mov eax, dword [0x6f8770]
push dword [eax + ebx*4]
push 0
movzx eax, word [0x6f7040]
push eax
call sub.kernel32.dll_WideCharToMultiByte
add eax, 1
add dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov byte [eax - 1], 0
cmp ebx, esi
jl 0x414a98
mov edx, dword [0x6f8250]
mov eax, dword [0x6f8240]
mov dword [edx + eax*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4163d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.004163c0
push ebp
push 0x415910
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
lea eax, [ebp - 0xc10]
mov edx, dword [ebp - 4]
call fcn.00409460
lea eax, [ebp - 0xc10]
call fcn.00403e70
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x416430
mov eax, 0x6f82e0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x4164e0
lea eax, [ebp - 0xc0c]
mov edx, dword [ebp - 0xc18]
call fcn.00410590
xor eax, eax
push fcn.004163b0
push ebp
push 0x415910
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x41648c
mov eax, 0x6f82e0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4164c5
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x669f7c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4164c5
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004163b0
jmp 0x41653c
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x416502
mov eax, 0x6f82e0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x41653c
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x669f7c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x41653c
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004163c0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x424730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x270]
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0x270], cl
lea eax, [ebp - 0x268]
mov edx, 0x66b1f8
call fcn.0040f370
xor eax, eax
push fcn.00424710
push ebp
push 0x415910
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x424776
mov eax, 0x6f82e0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4247c0
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x424792
clc
jmp 0x424799
bt dword [0x66a590], eax
jb 0x4247b0
mov eax, ebp
call fcn.00424880
test al, al
setne byte [ebp - 0x26c]
jmp 0x424860
mov byte [ebp - 0x26c], 0
jmp 0x424860
movzx edx, byte [ebp - 8]
mov eax, ebx
and eax, 0x10
cmp eax, dword [edx*4 + 0x630cd0]
sete byte [ebp - 0x26c]
mov al, byte [ebp - 0x26c]
and al, byte [ebp - 0x270]
je 0x424860
test bx, 0x400
je 0x424860
lea ebx, [ebp - 0x268]
mov edx, 0x66b1f8
mov eax, ebx
call fcn.0040f450
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.00424390
test eax, eax
je 0x424820
sub eax, 1
je 0x424840
jmp 0x424850
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00424730
mov byte [ebp - 0x26c], al
jmp 0x424860
mov byte [ebp - 0x26c], 1
jmp 0x424860
mov byte [ebp - 0x26c], 0
nop word [eax + eax]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00424710
mov al, byte [ebp - 0x26c]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424bf0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x424bfc
mov eax, 0x6f82e0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x424d00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00424cf0
push ebp
push 0x415910
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test eax, eax
jle 0x424d70
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0040c220
cmp ebx, 1
jle 0x424d5a
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0040b8a0
jmp 0x424d7b
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00409460
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00424cf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4251f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.004251e0
push ebp
push 0x415910
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
nop dword [eax + eax]
lea eax, [ebx*4 + 0x6f8e7c]
xor edx, edx
call fcn.00409460
mov dword [ebx*4 + 0x6f8e9c], 0xffffffff
add ebx, 1
cmp ebx, 7
jle 0x425220
call sub.kernel32.dll_GetThreadLocale
mov ebx, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4252a8
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00409eb0
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.0041a770
mov esi, eax
sub eax, 3
cmp eax, 3
jae 0x4252a8
push 4
push esi
push ebx
mov eax, 0x4250b0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push esi
push ebx
mov eax, 0x425150
push eax
call sub.kernel32.dll_EnumCalendarInfoA
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004251e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425a20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push fcn.004259f0
push ebp
push 0x415910
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
call fcn.00419ea0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00409460
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.0040ab30
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00409460
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x1c], eax
mov ebx, eax
jmp 0x425b2e
lea ecx, [ebp - 8]
xor dx, dx
mov eax, ebx
call fcn.00409e10
mov eax, dword [ebp - 8]
test eax, eax
je 0x425ab7
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.0040ab30
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.0040a500
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.0040a2d0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00419ea0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040a060
test eax, eax
jne 0x425b28
push dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x425b13
mov ecx, dword [ecx - 4]
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.0040a2d0
jmp 0x425b37
lea eax, [ebx + edi]
lea ebx, [eax + 1]
cmp byte [ebx], 0
jne 0x425aa0
push dword [ebp - 0x1c]
call sub.kernel32.dll_FreeEnvironmentStringsA
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004259f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret