joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f40
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push connect
push eax
or edi, 0xffffffff
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414f74
or eax, eax
or edx, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x414f8d
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x10
ret

Function at 0x414fa0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00405a30
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x415079
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x415045
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x41501e
cmp word [esp + 0x118], 4
jb 0x415079
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret
cmp eax, 2
jae 0x415028
cmp eax, 1
jne 0x415079
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret
cmp eax, 6
jne 0x415079
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x41506f
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret
cmp eax, 1
jne 0x415079
mov esi, 5
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040113c
add esp, 0x120
ret

Function at 0x415220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x4236c4
mov edi, eax
push 0x83
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x415293
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
mov eax, dword [esp + 0x14]
push esi
mov dword [eax], esi
call fcn.00401fd3
push esi
mov edi, eax
push 0
push edi
call fcn.00405a30
push esi
push ebp
push edi
call fcn.00406be0
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x415380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebx, 1
push esi
mov esi, eax
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x70], eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
call fcn.00401202
sub esi, dword [esp + 0x80]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], esi
fmul qword [0x4237c8]
fild dword [esp + 0x10]
fmulp st(1)
fiadd dword [esp + 0x80]
call fcn.004184a0
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x4154c0
jmp 0x415450
call fcn.00401202
mov dword [esp + 0x80], eax
fild dword [esp + 0x80]
fmul qword [0x4237c8]
fmul qword [0x4237d8]
fadd qword [0x4237d0]
call fcn.004184a0
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x4154a8
jmp 0x415490
add ecx, ebx
cmp ecx, 0x1a
jne 0x415499
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x415490
add esi, dword [esp + ecx*4 + 0x14]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x415450
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x415a10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x98
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
push 0x68
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], eax
mov dword [esp + 0x8a], eax
mov dword [esp + 0x8e], eax
mov dword [esp + 0x92], eax
mov dword [esp + 0x96], eax
mov dword [esp + 0x9a], eax
mov word [esp + 0x9e], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov word [esp + 0x88], bx
call fcn.00405a30
push esi
lea ecx, [esp + 0x20]
push 0x20
push ecx
call fcn.00401224
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc0]
lea esi, [esp + 0x94]
mov dword [esp + 0x8c], edx
call fcn.00415120
mov eax, esi
push eax
lea ecx, [esp + 0x6e]
push 0x10
push ecx
call fcn.00401224
add esp, 0x24
xor eax, eax
nop
mov dl, byte [esp + eax + 0x10]
not dl
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x68
jb 0x415ac0
push 0x42355c
push edi
call fcn.004013b5
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x415b1d
push esi
push 0x68
lea eax, [esp + 0x18]
push 1
push eax
call fcn.00401cbd
push esi
mov edi, 1
call fcn.00401b27
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0040113c
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x98
ret

Function at 0x415b40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x42311c
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.004013c8
add esp, 0xc
test eax, eax
je 0x415b64
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0040149f
mov eax, dword [esp + 0x1c]
push eax
call fcn.004016bc
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0040149f
mov edx, dword [esp + 0x38]
lea ebp, [esi + edx]
push ebp
call fcn.00401779
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
push 1
push esi
push edi
call fcn.00401a99
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00401b27
mov eax, dword [esp + 0x50]
lea ebx, [edi + esi]
call fcn.00414e50
mov edx, dword [esp + 0x4c]
push 0x423124
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.004013c8
add esp, 0x40
test eax, eax
je 0x415be5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x10]
push ecx
push 1
push ebp
push edi
call fcn.00401cbd
mov edx, dword [esp + 0x20]
push edx
call fcn.00401b27
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x416050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x434
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, dword [esp + 0x438]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], ecx
call fcn.00417d20
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x416266
push 0x206
push eax
lea ecx, [esp + 0x32]
push ecx
mov word [esp + 0x34], ax
call fcn.00405a30
add esp, 0xc
push 0x206
lea edx, [esp + 0x236]
push 0
push edx
mov word [esp + 0x23c], 0
call fcn.00405a30
add esp, 0xc
lea esi, [esp + 0x28]
call fcn.004154d0
push 0x42378c
mov eax, esi
push 0x104
push eax
call fcn.0040117b
add esp, 0xc
xor eax, eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov ebp, 0x427788
cmp word [ebp], 0
je 0x4161e6
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x234]
push 0x104
push edx
call fcn.00401224
add esp, 0xc
push ebp
lea eax, [esp + 0x234]
push 0x104
push eax
call fcn.0040117b
lea ecx, [esp + 0x23c]
add esp, 0xc
push ecx
lea edi, [esp + 0x18]
call fcn.004147f0
add esp, 4
test eax, eax
je 0x4161e6
mov eax, 0x14
lea ecx, [ebp + 0x104]
mov edx, edi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x41617f
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x416167
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4161ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4161ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4161ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4161dc
movzx esi, byte [edx]
movzx edx, byte [ecx]
sub esi, edx
je 0x4161dc
test esi, esi
mov eax, 1
jg 0x4161de
or eax, 0xffffffff
jmp 0x4161de
xor eax, eax
test eax, eax
jne 0x4161e6
mov word [ebp], ax
add ebp, 0x118
cmp ebp, 0x427d00
jl 0x416103
mov edi, dword [esp + 0x444]
mov ebp, dword [esp + 0x10]
mov esi, 0x427788
cmp word [esi], 0
je 0x416225
mov eax, dword [esi + 0x100]
push edi
push ebp
mov ecx, esi
mov dword [0x42777c], eax
call fcn.00417ab0
add esp, 8
add esi, 0x118
cmp esi, 0x427d00
jl 0x416208
push 0x4283c8
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.0040117b
add esp, 0xc
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x416262
mov dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040113c
add esp, 0x434
ret
Function at 0x417460
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push ebx
mov edi, eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x417493
mov eax, ebx
call fcn.00414f40
cmp eax, edi
jne 0x417493
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x200000
call fcn.00401779
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 4
push ebp
push eax
lea edx, [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x1c], 0x200000
call fcn.00418200
add esp, 8
test eax, eax
je 0x41755e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004011f5
add esp, 4
call fcn.00401202
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x4237c8]
fmul qword [0x4237e8]
fadd qword [0x4237e0]
call fcn.004184a0
mov esi, dword [esp + 0x14]
lea ebx, [esi + ebp]
mov edi, eax
call fcn.00414e50
add edi, esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
call fcn.0040dfb0
mov esi, eax
cmp esi, 0xffffffff
je 0x41755c
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
cmp eax, edi
jne 0x41753b
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
jne 0x41755c
push ebp
mov esi, ebx
call fcn.00401d4a
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor esi, esi
push ebp
call fcn.00401d4a
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x417860
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x4276b0
push 0x67
push edi
call esi
push 0x64
push 0x4275e8
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00415f20
mov eax, dword [ebp + 0x10]
mov edx, 0x4281b8
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4178b0
call fcn.00414fa0
mov dword [0x4260b0], eax
mov ecx, 0x422fd4
mov eax, 0x4281b8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4178f9
test dx, dx
je 0x4178f5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4178f9
add eax, 4
add ecx, 4
test dx, dx
jne 0x4178d3
xor eax, eax
jmp 0x4178fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x417918
call fcn.00416380
test eax, eax
je 0x417918
call fcn.00414ca0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.004170d0
add esp, 4
test eax, eax
jne 0x41793b
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0040113c
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.00405a30
mov eax, dword [0x427e00]
add esp, 0xc
test eax, eax
jbe 0x41798e
cmp word [0x427e04], 0
jbe 0x41798e
push eax
mov esi, 0x42664c
call fcn.004150a0
mov cx, word [0x427e04]
add esp, 4
mov word [0x42665c], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push 0x422fdc
mov edx, 0x4283c8
call fcn.00401000
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
call fcn.00416280
lea esi, [esp + 8]
call fcn.004154d0
push 0x422ff4
mov edx, esi
push 0x104
push edx
call fcn.0040117b
add esp, 0xc
push 0x4283c8
mov eax, esi
push 0x104
push eax
call fcn.0040117b
add esp, 0xc
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x417a2e
push 0x1f4
call edi
push 1
push 0
push 0x422ff8
mov edx, esi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00417580
call fcn.00414ca0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x417f30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp esi, 0xffffffff
push edi
mov dword [esp + 0x14], ebp
je 0x418152
push 0x400
call fcn.00401fd3
add esp, 4
push 0x400
mov ebx, eax
push ebp
push ebx
mov dword [esp + 0x24], ebx
call fcn.00405a30
add esp, 0xc
push esi
call fcn.00414950
add esp, 4
push ebx
push eax
call fcn.00414c40
add esp, 8
test eax, eax
je 0x418145
lea edi, [ebx + 4]
mov eax, 4
mov ecx, 0x422160
mov edx, edi
mov ebp, dword [edx]
cmp ebp, dword [ecx]
jne 0x417fac
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x417f94
test eax, eax
je 0x418015
movzx ebp, byte [ecx]
movzx ebx, byte [edx]
sub ebx, ebp
jne 0x417ffb
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x418011
movzx ebp, byte [ecx]
movzx ebx, byte [edx]
sub ebx, ebp
jne 0x417ffb
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x418011
movzx ebp, byte [ecx]
movzx ebx, byte [edx]
sub ebx, ebp
jne 0x417ffb
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x418011
movzx eax, byte [ecx]
movzx ebx, byte [edx]
sub ebx, eax
je 0x418011
mov ebp, dword [esp + 0x14]
test ebx, ebx
mov ebx, dword [esp + 0x18]
mov eax, 1
jg 0x41801b
or eax, 0xffffffff
jmp 0x41801b
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
xor eax, eax
test eax, eax
jne 0x418045
lea eax, [ebx + 0x10e]
lea edx, [eax + 2]
jmp 0x418030
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418030
sub eax, edx
sar eax, 1
jne 0x418131
lea ecx, [esp + 0x1c]
push ecx
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push 0x400
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], 0x3c00
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418145
mov eax, 4
mov ecx, 0x422168
mov edx, edi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x4180ae
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x418096
test eax, eax
je 0x41810b
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4180fd
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x41810b
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4180fd
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x41810b
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4180fd
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x41810b
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x41810b
test esi, esi
mov eax, 1
jg 0x41810d
or eax, 0xffffffff
jmp 0x41810d
xor eax, eax
test eax, eax
jne 0x418145
lea eax, [ebx + 0x10e]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418120
sub eax, edx
sar eax, 1
je 0x418145
mov edi, dword [esp + 0x34]
mov ecx, 0x8d
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ebp, 1
test ebx, ebx
je 0x418152
push ebx
call fcn.00401dd8
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x418160
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x425044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.00405a30
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [esp + 8]
sub edx, 0x41
lea ebx, [esp + 4]
call fcn.00414a90
mov ebx, dword [esp + 4]
call fcn.00414b90
cmp eax, 0xffffffff
jne 0x4181df
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret
push esi
call fcn.00417f30
mov ecx, dword [esp + 0x218]
add esp, 4
pop ebx
xor ecx, esp
call fcn.0040113c
add esp, 0x218
ret
Function at 0x4033a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47c00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40343c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40341c
xor eax, eax
push ebp
push 0x403415
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403458
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40341c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47c00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47c00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40411c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47e04c], 0
je 0x40417d
cmp word [0x47e220], 0xd7b2
jne 0x404145
cmp dword [0x47e228], 0
jbe 0x404145
mov eax, 0x47e21c
call dword [0x47e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47c054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4041a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47c01c], 0
jne 0x404199
push 0
push 0x47c074
push 0x47c054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405c2c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e5c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405caf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e5c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405caf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e78
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405d38
xor eax, eax
push ebp
push 0x405d31
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405a74
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405d16
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405e98
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405d16
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d38
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405e52
cmp byte [ebp - 0xd], 0
jne 0x405d7f
cmp byte [ebp - 0x12], 0
je 0x405e52
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405d98
dec ebx
cmp byte [ebx], 0x2e
je 0x405da7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405d97
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405e52
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405de4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405e52
cmp byte [ebp - 0xd], 0
je 0x405e52
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405e52
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret