joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5de8c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613902
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x697400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004d6d50
mov dword [edi], vtable.CSkyObject.0
xorps xmm0, xmm0
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00569ee1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
xorps xmm0, xmm0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
movups xmmword [edi + 0x1d8], xmm0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 3
call fcn.004e4ea0
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 4
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x6e8810]
call fcn.004c2d20
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e4a60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5e4a8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5e4a8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5e6180
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x5e6190
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x5e6199
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x5e61ac
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x5e61b5
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x5e6222
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x5e61d0
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5e6240
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x5e624a
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x5e625b
xor edi, dword [edx]
test esi, esi
je 0x5e6261
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x5e6277
xor edx, dword [ecx]
test esi, esi
je 0x5e627d
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x5e6290
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x5e6296
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x1002cd5b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1002cd6a
pop dword [ebp - 0x18]
mov eax, 0x369b5d2e
sub eax, 0x26988fc4
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe70c2464
add dword [ebp - 0x28], 0x674620e7
mov dword [ebp - 0x24], 0x237a4f24
add dword [ebp - 0x24], 0xeb8fd21
mov dword [ebp - 0x20], 0x4037c470
sub dword [ebp - 0x20], 0xf3eb8042
mov dword [ebp - 0x1c], 0xa7bd7b14
sub dword [ebp - 0x1c], 0xa7bd7b14
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd4bcc3cf
sub eax, 0xc4b7f4ef
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x74b5b33c
add dword [ebp - 0x28], 0xffbcb61a
mov dword [ebp - 0x24], 0xb49aeb43
add dword [ebp - 0x24], 0x8cd17632
mov dword [ebp - 0x20], 0xc64256ff
add dword [ebp - 0x20], 0x9d2d156d
mov dword [ebp - 0x1c], 0x1bd7848d
add dword [ebp - 0x1c], 0xe4287b73
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xed14522a
add eax, 0x22f07c5a
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3aea8
push 0
call eax
mov ecx, 0xf6ff3ec3
sub ecx, 0xf6ff09c5
xor ebx, ebx
add ebx, eax
mov esi, 0x1005b400
add esi, dword [ebp - 0x18]
mov edx, 0x8808c200
sub edx, 0x8f5c1d01
add dword [ebp - 0x10], 0x2ebd9cd6
mov edi, dword [esi]
xor dword [ebp - 8], 0x4b1130d4
sub edi, edx
sub dword [ebp - 8], ebx
mov dword [ebx], edi
xor dword [ebp - 0xc], ebx
add ebx, 0xf968115b
sub ebx, 0xf9681157
add esi, 4
loop 0x1002ce88
add eax, 0xc6cb
mov ebx, eax
add eax, 5
mov ecx, 0x2b2d0ba0
add ecx, 0xe4d2f460
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10066708
Capabilities:
Delete directory

Disassembly:
push 0x10
mov eax, 0x1009ec1c
call fcn.1003d9e2
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x1001c77c
mov dword [edi + 4], 0x1001d894
mov dword [edi + 0xc], 0x1001c78c
mov dword [edi + 0x10], 0x1001c7c8
xor ebx, ebx
mov dword [ebp - 4], 2
cmp dword [edi + 0x38], ebx
je 0x1006679c
lea eax, [edi + 0x1e8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10069288
mov esi, dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x10066770
push 0x326a6f78
call fcn.10075ff0
cmp dword [edi + 0x208], ebx
je 0x10066782
push 0x326a6f79
call fcn.10075ff0
cmp dword [edi + 0x204], ebx
je 0x10066794
push 0x326a6f7a
call fcn.10075ff0
lea ecx, [ebp - 0x1c]
call fcn.1007e529
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100667ac
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x14], ebx
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x100667bc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 0x18], ebx
mov eax, dword [edi + 0x214]
cmp eax, 0xffffffff
je 0x100667d5
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [edi + 0x214], 0xffffffff
cmp dword [edi + 0x218], ebx
je 0x10066803
lea esi, [edi + 0x21c]
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x100667f8
push 0x326a7030
call fcn.10075ff0
xor eax, eax
mov word [esi], ax
mov dword [edi + 0x218], ebx
lea eax, [edi + 0x1e8]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x40]
call fcn.10064f06
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1004f259
call fcn.1003daba
ret
Function at 0x10075ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10075fff
pop dword [ebp - 0x2c]
mov eax, 0x10075fff
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x8ca42caa
add dword [ebp - 0x3c], 0xc1ae18a1
mov dword [ebp - 0x38], 0x3a300321
add dword [ebp - 0x38], 0xf8034924
mov dword [ebp - 0x34], 0x3e6be02b
add dword [ebp - 0x34], 0xde06403
mov dword [ebp - 0x30], 0x6dcc9042
add dword [ebp - 0x30], 0x92336fbe
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x35a31c07
add dword [ebp - 0x3c], 0x3ecf4d4f
mov dword [ebp - 0x38], 0xe03a9088
sub dword [ebp - 0x38], 0x9ece2f13
mov dword [ebp - 0x34], 0x289e9691
add dword [ebp - 0x34], 0x3ad0d5db
mov dword [ebp - 0x30], 0x716b313d
sub dword [ebp - 0x30], 0x716b313d
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x512ab
push 0
call eax
mov ecx, 0x5f76d5c9
add ecx, 0xa0897253
mov edi, eax
mov edx, 0x100b4600
add edx, dword [ebp - 0x2c]
mov esi, 0x5f2d7c0e
add esi, 0xedb1a2d5
sub dword [ebp - 0x18], ecx
mov ebx, dword [edx]
add dword [ebp - 0xc], esi
add ebx, esi
xor dword [ebp - 0x10], 0x2d0cbfa2
mov dword [edi], ebx
xor dword [ebp - 0x20], ebx
add edi, 0x26dd3b0c
add edi, 0xd922c4f8
add edx, 0x3fe59ecd
add edx, 0xc01a6137
loop 0x1007610c
add eax, 0x577fd4b5
sub eax, 0x577ec172
mov ebx, eax
add eax, 0xd319d806
add eax, 0x2ce627ff
mov ecx, 0x153a9820
add ecx, 0xfac567e0
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x10098e80
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x1009f32b
call fcn.1003d9e2
mov edi, ecx
mov dword [ebp - 0x18], edi
xor edx, edx
mov dword [edi], edx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], edx
je 0x10098f1d
mov esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x10098ea7
sub esi, ecx
sar esi, 1
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcr100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10098eea
push 0x100a3d54
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 0x8007000e
call sub.msvcr100.dll__CxxThrowException
lea ecx, [esi + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
ja 0x10098f0b
push 2
pop eax
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push ecx
push dword [ebp + 8]
push eax
call sub.msvcr100.dll_memcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [edi], eax
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.1003daba
ret 4
Function at 0x10099080
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
mov eax, 0x1009f374
call fcn.1003da4b
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov dword [ebp - 0x230], eax
mov esi, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 0x208
test eax, eax
je 0x100990e3
push eax
mov dword [ebp - 0x21c], ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor ecx, ecx
lea eax, [ebp - 0x21c]
push eax
push 1
push ecx
push dword [ebp - 0x22c]
push edi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov edi, 0xffff
test eax, eax
je 0x10099117
mov esi, eax
jle 0x1009910f
and esi, edi
or esi, 0x80070000
test esi, esi
js 0x100991cd
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x21c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x10099150
mov esi, eax
jle 0x10099150
and esi, edi
or esi, 0x80070000
test esi, esi
js 0x100991cd
cmp dword [ebp - 0x224], 1
je 0x1009916d
cmp dword [ebp - 0x224], 7
je 0x1009916d
mov esi, 0x8000ffff
jmp 0x100991cd
mov eax, dword [ebp - 0x220]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcr100.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
pop ecx
test edi, edi
jne 0x100991ab
push 0x100a3d54
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x228], 0x8007000e
call sub.msvcr100.dll__CxxThrowException
mov ecx, dword [ebp - 0x230]
push edi
call fcn.10075ff0
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push edi
call sub.msvcr100.dll_memcpy
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x100991e9
and dword [ebp - 0x21c], 0
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
call fcn.1003dace
ret 0x10
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40611c
pop dword [ebp - 0x48]
mov eax, 0xb238c4c1
add eax, 0x4e079c5b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xcfcf3815
add dword [ebp - 0x58], 0x7e830d36
mov dword [ebp - 0x54], 0x4aacbfb4
add dword [ebp - 0x54], 0xe7868c91
mov dword [ebp - 0x50], 0xd35fd770
add dword [ebp - 0x50], 0x78ec6cbe
mov dword [ebp - 0x4c], 0x18b646e7
add dword [ebp - 0x4c], 0xe749b919
lea eax, [ebp - 0x58]
push eax
mov eax, 0x6a3fdacc
sub eax, 0x69ff6a6c
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xe306cdfc
add dword [ebp - 0x58], 0x916b9b5a
mov dword [ebp - 0x54], 0x31ac141b
sub dword [ebp - 0x54], 0xf03fb2a6
mov dword [ebp - 0x50], 0x6f6e474e
sub dword [ebp - 0x50], 0xbfedae2
mov dword [ebp - 0x4c], 0x8ad621fc
add dword [ebp - 0x4c], 0x7529de04
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x367f7
push 0
call eax
mov ecx, 0x478f
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x48]
mov edi, 0x16e8910b
add dword [ebp - 0x28], esi
mov esi, dword [ebx]
sub dword [ebp - 0x3c], 0x95d15e42
sub esi, edi
mov dword [edx], esi
xor dword [ebp - 0x1c], esi
add edx, 0xeaf84e1d
add edx, 0x1507b1e7
add ebx, 0xff232705
add ebx, 0xdcd8ff
loop 0x406229
add eax, 0xcde21944
add eax, 0x321ef7cb
xor ebx, ebx
add ebx, eax
add eax, 0xeb24d31d
sub eax, 0xeb24d318
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4034d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x473020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403568
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403548
xor eax, eax
push ebp
push 0x403541
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403584
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403548
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x473020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x473020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40429c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47e044], 0
je 0x4042fd
cmp word [0x47e218], 0xd7b2
jne 0x4042c5
cmp dword [0x47e220], 0
jbe 0x4042c5
mov eax, 0x47e214
call dword [0x47e230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x473090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404324
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x473030], 0
jne 0x404319
push 0
push 0x473088
push 0x473090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405f90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405ff6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004046a8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403094
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405fe0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ffd
lea eax, [ebp - 0x10]
call fcn.00404438
ret

Function at 0x408900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x408931
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x408938
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x408969
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x40bb7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x40bbc4
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.00404528
jmp 0x40bbcf
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.0040448c
mov esp, ebp
pop ebp
ret 4

Function at 0x40bbd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bc06
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], al
jmp 0x40bc0c
mov al, byte [ebp - 9]
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x40c394
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x400
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040c1dc
mov eax, dword [0x47d1c8]
cmp byte [eax], 0
je 0x40c427
mov eax, dword [0x47cfd8]
call fcn.00402ce8
call fcn.00402878
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x44c]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44c]
call fcn.00408d14
push eax
lea eax, [ebp - 0x44c]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40c46c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c45d
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x47cf84]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x47e660]
call fcn.004054a4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov esp, ebp
pop ebp
ret

Function at 0x40ce34
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40cf12
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004044d0
lea eax, [ebp - 0xc]
call fcn.00404948
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048f8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40cefc
mov eax, dword [ebp - 0x10]
call fcn.00402710
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x40cef5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048f8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cedf
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x40cf20
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cedf
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cefc
mov eax, dword [ebp - 0x18]
call fcn.00402730
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf19
lea eax, [ebp - 0xc]
call fcn.00404438
ret
Function at 0x40d600
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40d66a
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.004046a8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004085f4
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d671
lea eax, [ebp - 0x14]
call fcn.00404438
ret

Function at 0x4188c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceA
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x4188f6
push ebp
call fcn.00418850
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
jne 0x41891c
push ebp
call fcn.00418850
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.00418484
mov esp, ebp
pop ebp
ret 4