joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100230f4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100600d4
call fcn.1005f0d0
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
je 0x10023120
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xfffffffd
jmp 0x100231b2
mov dword [ebp - 0x14], 0x73c7
cmp dword [ebp - 0x14], 0x75f2
jle 0x10023157
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10079cd8
xor eax, edi
cdq
push edx
push eax
call fcn.10015096
inc ebx
cmp ebx, 0xc97
jl 0x10023134
inc edi
cmp edi, 0x312b
jl 0x10023132
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x7280
jge 0x10023192
mov edx, str.jqmr_dkxxweji_gjyvaoujq_nxcdldlco_lwwj_uwgwssitr_gvlgfuemc_dys_dszim_wgpndxch_ijdttnr_iju
mov ecx, 0x10079cd8
call fcn.1001996e
jmp 0x10023192
mov dword [esi], 0
cmp dword [esi], 1
jge 0x100231b2
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 3
inc dword [esi]
cmp dword [esi], 1
jl 0x100231a0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10023591
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x100235d8
mov dword [esi], 0xa
cmp dword [esi], 0xfffffff6
jg 0x100236a5
xor ebx, ebx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x100235cc
push 0x1d96
push ebx
push 0x9a1
call dword [sym.imp.USER32.dll_GetWindowTextW]
dec dword [esi]
cmp dword [esi], 0xfffffff6
jle 0x100235b3
jmp 0x100236a5
mov dword [ebp - 0x10], 0x4e7d
cmp dword [ebp - 0x10], 0x4fe6
jle 0x1002363e
push 0x21ba
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0xc], 0x61ca
mov eax, edi
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002361c
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10015918
add edi, esi
dec dword [ebp - 0xc]
jne 0x10023605
inc esi
cmp esi, 0x1de3
jl 0x100235fc
cmp dword [ebp - 0x10], 0x4c49
jge 0x10023652
push str.oah_viavwc_xhqhhor_btj_bubooi_ggl_hmki_dkg_baisodpxf_okctwplc_cluqyu_liurhixb_thljeazp_isry
call fcn.1004881f
pop ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x28]
mov eax, dword [eax]
push 0xfffffffffffffff9
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [edx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [ecx]
mov ecx, 0x83518f4c
mov eax, dword [edx]
mov eax, dword [edx]
cmp ecx, eax
mov ecx, dword [esi]
mov edx, dword [edx]
sbb eax, eax
neg eax
inc ecx
add ecx, eax
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
inc ecx
imul edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x24]
pop edx
sete cl
sub edx, ecx
mov eax, dword [eax]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002462e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060110
call fcn.1005f0d0
sub esp, 0x38
push ebx
push esi
mov dword [ebp - 0x20], 0x4721
mov ebx, edx
cmp dword [ebp - 0x20], 0x4abd
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ecx
jle 0x100246ac
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x68ff
xor edi, edi
xor esi, esi
mov eax, edi
mov ecx, 0x10079cd8
cdq
idiv esi
xor edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10015096
inc esi
cmp esi, 0x190f
jl 0x1002466b
inc edi
cmp edi, 0x4836
jl 0x10024669
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x18]
jne 0x10024667
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2b05
jl 0x1002465e
mov ebx, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x44f7
jge 0x100246e7
mov edx, str.ygsk_rrrpf_fvndbvx_nyjgiubd_pomgpnpu_xnyeob
mov ecx, 0x10079cd8
call fcn.1001996e
jmp 0x100246e7
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10024713
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x10024709
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 5
inc dword [edx]
cmp dword [edx], 2
jl 0x100246fc
jmp 0x1002479c
mov dword [ebp - 0x20], 0x3117
cmp dword [ebp - 0x20], 0x31e8
jle 0x10024765
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x40]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10024740
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10015918
inc edi
cmp edi, 0x4c20
jl 0x10024727
inc esi
cmp esi, 0xebd
jl 0x10024725
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10024788
mov esi, dword [ebp - 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x9d4346
inc dword [edx]
cmp dword [edx], 1
jl 0x10024776
cmp dword [ebp - 0x20], 0x30c5
jge 0x1002479c
push str.ikm_zrelnb_iejym_yyo_eerpl_eionkglu_qgqlwfqt_rwvlgdd_zhm_quizahsj_naqyrzzy_xjgkln_cyjbs_gqmf
call fcn.1004881f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100251bb
Capabilities:
Start service

Disassembly:
mov eax, 0x10060140
call fcn.1005f0d0
sub esp, 0x1c
mov dword [ebp - 0x28], edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100252d7
mov dword [ebp - 0x20], 0x3e53
cmp dword [ebp - 0x20], 0x412a
jle 0x10025244
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
cdq
idiv edi
xor ebx, ebx
mov eax, edx
mov dword [ebp - 0x24], eax
mov esi, eax
mov edi, 0x7a00
mov eax, esi
mov ecx, 0x10079cd8
cdq
push edx
push eax
call fcn.10015096
add esi, ebx
dec edi
jne 0x10025206
mov eax, dword [ebp - 0x24]
dec ebx
cmp ebx, 0xffffee41
jg 0x100251ff
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3886
jl 0x100251f3
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2ecb
jl 0x100251ee
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3dd2
jge 0x10025260
mov edx, str.xsada_jkh_qldext_xre_alobahes
mov ecx, 0x10079cd8
call fcn.1001996e
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1002529b
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100252f1
push 0x11cd
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x100252f1
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [eax + 4], 0xfffffffc
mov eax, dword [esi]
cmp dword [eax + 4], 3
jge 0x100252f1
mov edi, dword [ebp - 0x28]
push 0x6b6e
push 1
push edi
push ecx
mov ecx, 0x62af
call fcn.100230f4
mov eax, dword [esi]
add esp, 0x10
inc dword [eax + 4]
mov eax, dword [esi]
cmp dword [eax + 4], 3
jl 0x100252b2
jmp 0x100252f1
cmp byte [ebp + 0xc], 0
push 0
je 0x100252e7
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x100252f1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100267b6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov byte [esp], cl
push ebx
mov ebx, edx
mov dword [esp + 0x10], ebx
push esi
push edi
test cl, cl
je 0x10026903
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
jmp 0x100268f8
mov dword [esp + 0x14], 0x4a82
cmp dword [esp + 0x14], 0x4b21
jle 0x1002683d
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x38]
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026813
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.10015918
inc ebx
cmp ebx, 0x440
jl 0x100267f7
inc edi
cmp edi, 0x2588
jl 0x100267f5
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], 0
cmp dword [esp + 0x14], 0x4808
jge 0x1002685a
push str.zbplxbw_lasng_mxpesc_ube_lwyzzugf_ojs_ffpsgjcii_axnilnz_zwgmukpay
call fcn.1004881f
pop ecx
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x20], 0xeb987642
mov dword [esp + 0x14], 0x591b68de
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x54207647
mov dword [esp + 0x24], 0x54c97515
mov dword [esp + 0x10], 0
jmp 0x100268ef
push 0x7786
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xfffb
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x34], 0xfffffff9
push eax
lea eax, [esp + 0x30]
xor ecx, ecx
push eax
push dword [ebp + 8]
lea eax, [esp + 0x3c]
inc ecx
push eax
push ebx
push 0
push 0x56bc
push ecx
lea eax, [esp + 0x54]
mov dword [esp + 0x50], ecx
push eax
lea eax, [esp + 0x5c]
push 0x114b
push eax
lea edx, [esp + 0x68]
call fcn.100262da
add esp, 0x34
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffc
jl 0x10026894
dec dword [esi]
cmp dword [esi], 0xfffffff8
jl 0x100267e1
jmp 0x10026909
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026c12
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov eax, 0x100601e6
call fcn.1005f0d0
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
je 0x10026c73
mov dword [esi], 0
jmp 0x10026c5d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x12df3d37
push eax
push 0x2ea1
push ecx
push ecx
mov dword [ebp - 0x20], 0xfffffff7
lea ecx, [ebp - 0x1c]
mov dl, 1
call fcn.10023838
add esp, 0x10
inc dword [esi]
cmp dword [esi], 0x1d
jg 0x10026c35
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0x43db
xor esi, esi
cmp dword [ebp - 0x28], 0x4479
jle 0x10026ccd
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, 0x525d
mov eax, esi
mov ecx, 0x10079cd8
xor eax, ebx
cdq
push edx
push eax
call fcn.10015096
dec esi
dec edi
jne 0x10026c9d
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3588
jl 0x10026c96
inc ebx
push 0
pop esi
cmp ebx, 0xb1f
jl 0x10026c91
mov dword [ebp - 0x24], 0x4fe1
cmp dword [ebp - 0x24], 0x5106
jle 0x10026d4e
mov ebx, esi
mov dword [ebp - 0x20], esi
mov eax, esi
mov dword [ebp - 0x1c], 0x19c
mov dword [ebp - 0x18], eax
mov edi, esi
cdq
idiv edi
mov eax, ebx
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026d0e
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10015918
mov eax, dword [ebp - 0x18]
inc edi
cmp edi, 0x4904
jl 0x10026cf0
mov edi, dword [ebp - 0x20]
add eax, edi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x10026cee
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x5253
jl 0x10026ce2
inc ebx
cmp ebx, 0x680a
jl 0x10026cdf
cmp dword [ebp - 0x24], 0x4fae
jge 0x10026d62
push str.eyvlw_agcktskc_dpiighap_oyy_kmvw_abuaxo_tcmxexuj_snx_tmrvkdzce_ixftfbf_scfw_tijdvtsdt
call fcn.1004881f
pop ecx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10026d73
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x41ad
jge 0x10026c62
mov edx, str.fthl_fcmxn_hdob_qmtp_okpr_kyua_ryuvog_enkcujdwq_muowiitb_xyyocve_qikzf_zofqd_pmabrx_rpjsrrzcx
mov ecx, 0x10079cd8
call fcn.1001996e
jmp 0x10026c62
Function at 0x10033849
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100607da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x31fa
mov dword [ebp - 0x3c], str.ihvylmikc_zre_etzs_panfcma_akfc_gcdmzms_tazt_ptti_mbdwsowjm
cmp dword [ebp - 0x20], 0x3207
jle 0x10033909
and dword [ebp - 0x1c], 0
jmp 0x10033893
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3df6
jge 0x10033909
and dword [ebp - 0x14], 0
jmp 0x100338a9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2866
jge 0x10033907
and dword [ebp - 0x18], 0
jmp 0x100338bf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1159
jge 0x10033905
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.10001ac3
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10014e06
push eax
call fcn.1004881f
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.10014dfc
jmp 0x100338b8
jmp 0x100338a2
jmp 0x1003388c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10033925
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 1
call fcn.100339b6
pop ecx
pop ecx
jmp 0x10033969
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003394d
push 0x69d
push 0x1e42
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x10033969
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10033969
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2ea5
jge 0x1003397f
push dword [ebp - 0x3c]
call fcn.1004881f
pop ecx
jmp 0x1003399b
or dword [ebp - 4], 0xffffffff
jmp 0x100339a5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c1a4
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060a4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003c372
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003c325
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1003c323
push 0xe27
push 0x4c72
push 1
push 0
call fcn.1003b527
add esp, 0x10
mov dword [ebp - 0x28], 0x65f7
mov dword [ebp - 0x3c], str.ceyjeq_rhfygqkc_vbtgfmurf_mms_kctumwp_voy
cmp dword [ebp - 0x28], 0x674b
jle 0x1003c2e3
and dword [ebp - 0x18], 0
jmp 0x1003c250
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x17f9
jge 0x1003c2cd
and dword [ebp - 0x1c], 0
jmp 0x1003c266
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7cae
jge 0x1003c2c8
and dword [ebp - 0x20], 0
jmp 0x1003c27c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x25c1
jge 0x1003c2c6
and dword [ebp - 0x24], 0
jmp 0x1003c292
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3de3
jge 0x1003c2c4
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
sub edx, dword [ebp - 0x24]
mov eax, edx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0x10079cd8
call fcn.10015096
jmp 0x1003c28b
jmp 0x1003c275
jmp 0x1003c25f
jmp 0x1003c249
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x63f8
jge 0x1003c2fd
mov edx, dword [ebp - 0x3c]
mov ecx, 0x10079cd8
call fcn.1001996e
jmp 0x1003c319
or dword [ebp - 4], 0xffffffff
jmp 0x1003c323
jmp 0x1003c370
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1003c353
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x1003c370
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.1001537d
mov dword [eax], 1
jmp 0x1003c348
jmp 0x1003c39e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
push 0x6259
push 0
push dword [ebp - 0x54]
push 0x16c9
push 0x1162
push 0x2c44
push 0x7f55
call fcn.1003998a
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f4ee
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060b04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1003f547
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0x2a41
push 1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.1003f6c9
add esp, 0x14
jmp 0x1003f6b8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1003f5ac
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x1003f58b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x11
jne 0x1003f5a7
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1003f5a5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1003f580
jmp 0x1003f6b8
mov dword [ebp - 0x2c], 0x3990
mov dword [ebp - 0x4c], str.lglbl_xtdqzlzqr_ozudwatod
cmp dword [ebp - 0x2c], 0x3d4e
jle 0x1003f62d
and dword [ebp - 0x28], 0
jmp 0x1003f5d0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffd
jge 0x1003f62d
and dword [ebp - 0x20], 0
jmp 0x1003f5e6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7b12
jge 0x1003f62b
and dword [ebp - 0x24], 0
jmp 0x1003f5fc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x2f59
jge 0x1003f629
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sar eax, cl
xor eax, dword [ebp - 0x28]
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0x10079cd8
call fcn.10015096
jmp 0x1003f5f5
jmp 0x1003f5df
jmp 0x1003f5c9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x384f
jge 0x1003f64d
mov edx, dword [ebp - 0x4c]
mov ecx, 0x10079cd8
call fcn.1001996e
jmp 0x1003f669
or dword [ebp - 4], 0xffffffff
jmp 0x1003f673
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x1003f69b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jge 0x1003f6b8
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x5c]
call fcn.1001537d
mov dword [eax], 3
jmp 0x1003f690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402c72
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x4026b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor esi, esi
test eax, eax
je 0x402cac
push 0x4026d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x402cac
push esi
push esi
push 1
push esi
mov ecx, edi
call dword [0x40f138]
call edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x40d53c], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, eax
call fcn.00402f73
mov edi, dword [ebp + 0xc]
mov cl, al
neg cl
sbb cl, cl
inc cl
cmp dword [ebp + 8], 2
jl 0x402d19
mov edx, dword [edi + 4]
mov ebx, 0x4026e4
movzx eax, byte [edx + esi]
cmp al, byte [ebx + esi]
jne 0x402cfa
inc esi
cmp esi, 3
jne 0x402ce9
jmp 0x402d0d
cmp byte [edx], 0x2f
jne 0x402d19
cmp byte [edx + 1], 0x3f
jne 0x402d19
movzx eax, byte [edx + 2]
test al, al
jne 0x402d19
mov edx, 0x402820
xor ecx, ecx
call fcn.00402df0
test cl, cl
je 0x402d23
cmp dword [ebp + 8], 4
je 0x402d33
cmp dword [ebp + 8], 3
je 0x402d33
xor ecx, ecx
mov edx, 0x402820
inc ecx
jmp 0x402d14
mov edx, dword [edi + 8]
mov ecx, dword [edi + 4]
call fcn.00402d45
mov edx, 0x4026e8
jmp 0x402d12

Function at 0x402df0
Capabilities:
Accept command line arguments
Terminate process
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x40c59c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
je 0x402ea9
push 0x100
xor ebx, ebx
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.00409940
add esp, 0xc
test edi, edi
jne 0x402e38
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x402e7d
mov eax, 0x402790
js 0x402e44
mov eax, 0x4027a0
push esi
push edi
push eax
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00402c10
add esp, 0x14
test eax, eax
jns 0x402e6a
xor eax, eax
mov byte [ebp - 0x104], bl
inc eax
jmp 0x402e77
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [ebp - 0x104]
mov ecx, dword [0x40d53c]
push ebx
test ecx, ecx
je 0x402e9a
lea edx, [ebp - 0x108]
push edx
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x402ea9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.msi.dll_MsiConfigureFeatureA]
xor eax, eax
test esi, esi
setne al
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402ebe
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
or dword [ebp - 8], 0xffffffff
mov eax, ecx
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x18], edx
push ecx
xor edi, edi
mov dword [ebp - 0x10], eax
push eax
mov esi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebx, eax
test ebx, ebx
je 0x402f41
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x402f04
push 8
pop edi
or ebx, 0xffffffff
jmp 0x402f57
push esi
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x402f41
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0x4027b0
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x402f49
cmp dword [ebp - 0x14], edi
je 0x402f49
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
jmp 0x402f4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or ebx, 0xffffffff
test esi, esi
je 0x402f57
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x402f60
mov dword [eax], ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x402f6c
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret