joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x214
push 0xffffffffffffffff
push 0x439f2e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp + 0x210], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp + 4], ebx
mov eax, dword [ebp + 0x220]
mov esi, dword [ebp + 0x21c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], 0
push eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
push 0x443268
mov word [ebx], ax
call fcn.00407760
push 0x208
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x10], 1
call fcn.0040b160
add esp, 0xc
mov dword [ebp + 4], 0x208
lea eax, [ebp]
push eax
push 0x20019
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405c99
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405c90
lea ecx, [ebp + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405c75
sub ecx, edx
lea eax, [ebp + 8]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00407760
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x210]
xor ecx, ebp
call fcn.00409353
lea esp, [ebp + 0x214]
pop ebp
ret
Function at 0x406420
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x406432
mov eax, dword [esi]
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp dword [esp + 0x20], 8
lea ecx, [esp + 0xc]
push 0
cmovae ecx, dword [esp + 0x10]
push 0
push 3
push 0
push 0
push dword [esp + 0x38]
mov dword [esi + 0x1c], eax
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x406472
xor bl, bl
jmp 0x406478
mov byte [esi + 0x18], 1
mov bl, 1
mov edx, dword [esp + 0x20]
cmp edx, 8
jb 0x4064b0
mov ecx, dword [esp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4064a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4064b7
push edx
push ecx
call fcn.00409391
add esp, 8
pop esi
mov al, bl
pop ebx
ret 0x20
call fcn.00413e93
int3

Function at 0x42556d
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004253ab

Function at 0x4274eb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00426d97

Function at 0x4274f6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00426fd2
Function at 0x4012d0
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov edi, str.mykbfilt
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x1c]
mov ebx, ecx
mov ecx, 0x41
push str.SystemCurrentControlSetServicesmykbfiltSecurity
push 0x80000002
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], 0
call esi
push str.SystemCurrentControlSetServicesmykbfiltEnum
push 0x80000002
call esi
push str.SystemCurrentControlSetServicesmykbfilt
push 0x80000002
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401334
call ebp
lea eax, [esp + 0x14]
push eax
push str.SystemCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4013f2
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.UpperFilters
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4013f2
mov edx, dword [esp + 0x10]
push str.mykbfilt
lea eax, [esp + 0x20]
push edx
push eax
call section..text
add esp, 0xc
test eax, eax
je 0x4013f4
mov ecx, dword [esp + 0x10]
sub ecx, eax
sub ecx, ebx
lea ecx, [esp + ecx + 0x1b]
test ecx, ecx
jne 0x4013ae
mov ecx, 1
mov edx, ecx
lea esi, [eax + ebx + 1]
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or ecx, 0xffffffff
sub ecx, ebx
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push 0
push str.UpperFilters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4013f4
call ebp
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x401407
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x110
ret
Function at 0x100120ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001227d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x2252
cmp dword [ebp - 0x14], 0x6ed
jge 0x10012246
push 0x1e8480
push 0xffffffffffffffff
push 0x10623890
call fcn.1003f183
add esp, 0xc
push 0x1080bd10
push 0x1000b210
call fcn.10060cbb
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x10012246
and dword [ebp - 8], 0
jmp 0x10012159
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x1001216f
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x1080bd2c], 4
jmp 0x10012152
and dword [ebp - 0xc], 0
push 0x1080bd10
call fcn.10060c30
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
jmp 0x1001218e
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jge 0x100121cf
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x1080bd10]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x1080bd10]
mov eax, dword [eax*4 + 0x1080bc68]
dec eax
mov ecx, dword [ebp - 4]
movsx ecx, byte [ecx + 0x1080bd10]
mov dword [ecx*4 + 0x1080bc68], eax
jmp 0x10012187
mov eax, dword [ebp - 0x10]
and eax, 1
je 0x1001220d
push dword [ebp - 0xc]
call fcn.10011fa9
pop ecx
movzx eax, al
test eax, eax
je 0x100121fa
push 0x1080bd10
push 0x1000b214
call fcn.10060fa3
pop ecx
pop ecx
jmp 0x1001220b
push 0x1080bd10
push 0x1000b21c
call fcn.10060fa3
pop ecx
pop ecx
jmp 0x10012241
push dword [ebp - 0xc]
call fcn.10011fa9
pop ecx
movzx eax, al
test eax, eax
je 0x10012230
push 0x1080bd10
push 0x1000b21c
call fcn.10060fa3
pop ecx
pop ecx
jmp 0x10012241
push 0x1080bd10
push 0x1000b214
call fcn.10060fa3
pop ecx
pop ecx
jmp 0x10012132
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001226e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.1001b01e
mov dword [eax], 0xfffad55a
jmp 0x1001227b
push 0x1d94
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x10012291
push 0x1a0d
push 0
push 0x3f06
call fcn.1001679e
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10020445
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1002053e
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10020511
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
jmp 0x100204d8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
sub edx, dword [ecx]
mov eax, dword [eax + 4]
sub eax, edx
mov ecx, dword [ebp - 8]
cmp dword [ecx], eax
jae 0x1002050f
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 8]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x100204cd
jmp 0x10020539
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x10020539
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100205c1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x10020599
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x100205c1
mov byte [ebp - 1], 0
push 0x4bbf
push 0
push 0x25c9
push 0x26f8
push 1
lea eax, [ebp - 1]
push eax
push 0x284a
call fcn.1001feeb
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x1002879d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100287ff
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100287e1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100287df
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100287fd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100287fd
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x10028813
push 0x33b3
push 0x3c63
push 0
call fcn.1002cd57
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10028921
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10028957
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 0x6e94
push 0x1cdb
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.10028997
add esp, 0x14
jmp 0x10028993
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10028986
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10028993
push 0x1d94
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x10040c62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10040c86
push 0x26a4
push 0x37d4
push 0
call fcn.10045b64
add esp, 0xc
jmp 0x10040cfc
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10040cef
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10040cd0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10040ced
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001b01e
mov dword [eax], 1
jmp 0x10040cc5
jmp 0x10040cfc
push 0x1d94
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x10044667
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004468a
push 0x22b7
push 0x4855
push 1
call fcn.100446cf
add esp, 0xc
jmp 0x100446cb
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100446ba
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100446b8
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100446cb
push 0
push 0
push 0
push 0x1027
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov esp, ebp
pop ebp
ret
Function at 0x1004b000
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004b02c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 0
call fcn.10050c0b
add esp, 0xc
jmp 0x1004b0a6
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1004b088
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004b086
push 0
push 0x4f04
push 0x4a4b
push 0x23aa
push 0x34b7
push 0x78b7
push 0x703f
call fcn.10044af5
add esp, 0x1c
jmp 0x1004b0a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1004b0a6
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret
Function at 0x1004b5ed
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004b654
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1004b649
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004b647
push 0xcd2
push 1
push 0x565c
push 0x39b0
push 0x1807
push 0
call fcn.10057e91
add esp, 0x18
jmp 0x1004b64f
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1004b711
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1004b6c9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004b6aa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1004b6c7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.1001b01e
mov dword [eax], 0xfffffffc
jmp 0x1004b69f
jmp 0x1004b711
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1004b6f7
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1004b711
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1001b01e
and dword [eax], 0
jmp 0x1004b6ec
mov esp, ebp
pop ebp
ret
Function at 0x1004d240
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1004d26c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
call fcn.1004d2ea
add esp, 0xc
jmp 0x1004d2e6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004d2d5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004d2b6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1004d2d3
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1001b01e
mov dword [eax], 0xfffffffd
jmp 0x1004d2ab
jmp 0x1004d2e6
push 0x7aa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x1004dd9e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004de5e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1004de11
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004de0f
push 0x3f67
push 1
push 0x3626
push 1
push 0x61c8
push 0x6f77
push 0x1903
push 1
call fcn.10049a04
add esp, 0x20
jmp 0x1004de5c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004de3f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1004de5c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.1001b01e
mov dword [eax], 1
jmp 0x1004de34
jmp 0x1004decf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1004de84
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1004decf
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1004deb2
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x1004decf
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1001b01e
mov dword [eax], 6
jmp 0x1004dea7
mov esp, ebp
pop ebp
ret

Function at 0x1004e922
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004e983
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004e961
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x7919
push 1
call fcn.1004aeaf
add esp, 0x10
jmp 0x1004e981
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1004e981
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1004e99b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 1
push 0x3c30
call fcn.1004a94f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100561b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x10056219
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.100562c4
add esp, 0x24
jmp 0x100562c0
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100562af
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0x39c1d5
mov eax, dword [ebp - 0x50]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.1001b01e
cmp dword [eax], 0x39c1d5
jl 0x1005629e
mov eax, 0x98d7e942
test eax, eax
jne 0x1005629e
and dword [ebp - 4], 0
jmp 0x100562a5
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x100562c0
push 0x7aa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret