joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406c58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x406dae
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x40a2bc]
cmp byte [eax + 0xb], 0
jbe 0x406d35
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.00406e9c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004069f4
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.00406e9c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.004069f4
lea eax, [ebp - 0xc]
call fcn.00408178
mov eax, dword [0x40a2d4]
mov eax, dword [eax]
call fcn.00403024
test eax, eax
je 0x406cd9
mov eax, dword [0x40a2d4]
mov eax, dword [eax]
call fcn.00402584
mov eax, dword [ebp - 4]
call fcn.00403024
cmp eax, 4
jle 0x406d2d
mov eax, dword [ebp - 4]
call fcn.00406fb0
test al, al
je 0x406cfe
mov eax, dword [ebp - 4]
call fcn.00406950
mov ebx, eax
jmp 0x406d2d
push 5
mov eax, dword [0x40a2d4]
mov eax, dword [eax]
call fcn.004031e8
push eax
mov eax, dword [ebp - 8]
call fcn.004031e8
push eax
mov eax, dword [ebp - 4]
call fcn.004031e8
push eax
push 0x406dbc
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.00402584
cmp ebx, 0x20
jb 0x406d93
mov eax, dword [0x40a2d0]
cmp byte [eax], 0
je 0x406d93
lea edx, [ebp - 0x18]
mov eax, dword [0x40a2d4]
mov eax, dword [eax]
call fcn.00405d58
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x40a2dc]
mov eax, dword [eax]
call fcn.00405d58
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00405e74
test al, al
je 0x406d93
lea edx, [ebp - 0x20]
mov eax, dword [0x40a2dc]
mov eax, dword [eax]
call fcn.00405d58
mov eax, dword [ebp - 0x20]
call fcn.00405c10
test al, al
je 0x406d93
call fcn.00406a80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406db5
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00402ecc
ret

Function at 0x407238
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, dword [0x40a320]
movzx eax, bx
mov dx, 0xfff8
test eax, 1
jbe 0x407259
shr eax, 1
xor eax, 0xedb88320
jmp 0x40725b
shr eax, 1
inc dx
jne 0x407248
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp bx, 0x100
jne 0x407241
pop ebx
ret

Function at 0x407270
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [0x40a2b8]
mov edx, dword [esi]
mov eax, ebx
call fcn.004059c0
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00404550
call fcn.00404554
mov edx, dword [esi + 8]
call fcn.004059c0
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
Function at 0x407370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov ebx, dword [ebp + 8]
mov byte [ebp - 2], 0
test ebx, ebx
je 0x40740d
mov eax, ebx
call fcn.004072b8
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x4073d0
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.00407348
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.00407270
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x4073a2
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x4073fa
mov eax, dword [ebp + 0x10]
call fcn.00404550
call fcn.00404554
cmp bl, al
jne 0x40740d
mov byte [ebp - 2], 1
jmp 0x40740d
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x40740d
mov byte [ebp - 2], 1
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x407558
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
lea edi, [ebp - 0x30]
xor edx, edx
push ebp
push 0x40769a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x191
push eax
call sub.user32.dll_GetDlgItem
mov esi, eax
push 0x4011
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
lea edx, [ebp - 0x194]
mov eax, ebx
call fcn.00405bd4
mov eax, dword [ebp - 0x194]
call fcn.004031e8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov dword [edi], 0xf
mov dword [edi + 4], 0x7fffffff
xor eax, eax
mov dword [edi + 8], eax
mov eax, dword [0x40a2bc]
test byte [eax + 6], 2
jne 0x4075ea
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0x4075f1
mov dword [edi + 0xc], 2
mov dword [edi + 0x10], 2
mov eax, ebx
call fcn.004031e8
mov dword [edi + 0x14], eax
mov eax, ebx
call fcn.00403024
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x18c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x20], eax
push edi
push 0
push 0x1007
push esi
call sub.user32.dll_SendMessageA
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], 1
lea edx, [ebp - 0x294]
mov eax, dword [ebp - 4]
call fcn.00402664
lea edx, [ebp - 0x294]
lea eax, [ebp - 8]
call fcn.00403000
mov eax, dword [ebp - 8]
call fcn.004031e8
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 8]
call fcn.00403024
mov dword [edi + 0x18], eax
push edi
push 0
push 0x1006
push esi
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4076a1
lea eax, [ebp - 0x194]
call fcn.00402ea8
lea eax, [ebp - 8]
call fcn.00402ea8
ret

Function at 0x408178
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00402f90
add esp, 0x108
pop ebx
ret
Function at 0x4092c4
Capabilities:
Get file system object information
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 0x110], eax
mov eax, 0x409254
call fcn.0040430c
xor eax, eax
push ebp
push 0x40941c
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10c]
call fcn.0040347c
lea edx, [ebp - 0x10c]
mov eax, 0x40bd50
call fcn.00403000
mov eax, dword [0x40bd50]
call fcn.004031e8
push eax
push 0x409428
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.comctl32.dll_InitCommonControls
push 0x105
push 0x40bc48
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
mov edx, 0x40bc48
mov eax, dword [0x40a314]
call fcn.00402f90
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0x40a314]
mov eax, dword [eax]
call fcn.004031e8
push eax
call sub.kernel32.dll_CreateFileA_1
mov edx, dword [0x40a2f8]
mov dword [edx], eax
mov eax, dword [0x40a2f8]
cmp dword [eax], 0xffffffff
jne 0x4093a7
lea eax, [ebp - 0x110]
push eax
mov edx, dword [0x40a314]
xor ecx, ecx
mov eax, 0x409438
call fcn.00406dc4
mov eax, dword [ebp - 0x110]
call fcn.00408050
call fcn.00407238
call fcn.004065a0
mov eax, 0x40bae8
xor ecx, ecx
mov edx, 0x160
call fcn.004025e4
push 0x4001
push 0x160
push 0x40bae8
push 0
mov eax, dword [0x40a314]
mov eax, dword [eax]
call fcn.004031e8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [0x40a30c]
mov dword [edx], eax
push 0x4086a8
mov edx, 0x409454
xor ecx, ecx
mov eax, dword [0x40b4c4]
call fcn.0040455c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409423
lea eax, [ebp - 0x110]
call fcn.00402ea8
ret
Function at 0x10004433
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.1002aaf0
mov eax, dword [0x891ed8c]
push ebx
push esi
push edi
push dword [ebp + 0xc]
call dword [eax + 0x70]
mov ecx, dword [0x891ed8c]
xor edi, edi
mov ebx, eax
mov dword [esp], 0x104b2
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [ecx + 0x64]
lea ecx, [ebp - 8]
push ecx
push 0x890f6d4
push eax
call fcn.100046e0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10004496
call dword [0x890f0e8]
mov esi, eax
jmp 0x1000456a
push 0xf0000000
push 1
push edi
push edi
lea eax, [ebp - 0xc]
push eax
call dword [0x890f044]
test eax, eax
je 0x10004489
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [0x890f038]
test eax, eax
je 0x10004489
push dword [ebp - 8]
lea eax, [ebp - 0x4018]
push 0x4000
push 1
push eax
call fcn.1002a359
add esp, 0x10
test eax, eax
jne 0x10004533
mov ebx, dword [0x890f03c]
lea eax, [ebp - 0x18]
push 4
pop ecx
push edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push ecx
push dword [ebp - 4]
mov dword [ebp - 0x18], ecx
call ebx
mov edi, dword [0x890f0e8]
test eax, eax
je 0x1000450e
cmp dword [ebp - 0x10], 0
jne 0x10004512
call edi
mov esi, eax
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x4018]
push eax
push 2
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x1000454a
call edi
mov ebx, dword [ebp - 0x14]
mov esi, eax
jmp 0x10004568
push edi
push eax
lea eax, [ebp - 0x4018]
push eax
push dword [ebp - 4]
call dword [0x890f034]
jmp 0x100044bf
push dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x4018]
push eax
mov eax, dword [0x891ed8c]
push 0x404b6
push ebx
call dword [eax + 0x24]
add esp, 0x10
xor edi, edi
cmp dword [ebp - 4], 0
je 0x10004579
push dword [ebp - 4]
call dword [0x890f030]
cmp dword [ebp - 0xc], 0
je 0x10004589
push edi
push dword [ebp - 0xc]
call dword [0x890f040]
cmp dword [ebp - 8], 0
je 0x10004598
push dword [ebp - 8]
call fcn.1002a0f7
pop ecx
mov eax, dword [0x891ed8c]
push ebx
push dword [ebp + 8]
push esi
call dword [eax + 0x60]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e6ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
lea eax, [ebp - 0x408]
push esi
push edi
push 0x400
xor esi, esi
push esi
push eax
call fcn.10029790
add esp, 0xc
lea eax, [ebp - 0x408]
push 0x3ff
push eax
push 0x8910560
call dword [0x890f244]
push 0x8910570
push 0x65
push dword [0x891ed90]
call dword [0x890f248]
mov edi, eax
test edi, edi
je 0x1000e799
push edi
push dword [0x891ed90]
call dword [0x890f23c]
push eax
call dword [0x890f238]
push edi
push dword [0x891ed90]
mov dword [ebp - 4], eax
call dword [0x890f240]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x408]
push eax
call dword [0x890f250]
lea eax, [ebp - 0x408]
push eax
call dword [0x890f30c]
cmp eax, 0xffffffff
jne 0x1000e783
lea eax, [ebp - 0x408]
push 0x8910574
push eax
call fcn.1002bd20
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1000e77b
push edi
push dword [ebp - 8]
push 1
push dword [ebp - 4]
call fcn.1002aa6c
push edi
call fcn.1002a0f7
add esp, 0x14
jmp 0x1000e783
call dword [0x890f0e8]
mov esi, eax
lea eax, [ebp - 0x408]
push eax
call dword [0x890f10c]
mov dword [0x891efc8], eax
test eax, eax
jne 0x1000e7a1
call dword [0x890f0e8]
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x450008], 0x8088405
inc edx
mov dword [ebx + 0x450008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x43458e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4358f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x45254c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x45254c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x451378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4358fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x402fb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x460020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403050
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403030
xor eax, eax
push ebp
push 0x403029
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40306c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403030
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x460020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x460020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cfc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x462048], 0
je 0x403d5d
cmp word [0x46221c], 0xd7b2
jne 0x403d25
cmp dword [0x462224], 0
jbe 0x403d25
mov eax, 0x462218
call dword [0x462234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46006c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d84
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x460030], 0
jne 0x403d79
push 0
push 0x460064
push 0x46006c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4059d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a36
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040e8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b1c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a20
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a3d
lea eax, [ebp - 0x10]
call fcn.00403e78
ret

Function at 0x4082ec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x40831d
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x408324
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x408355
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x40b14c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x40b194
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.00403f68
jmp 0x40b19f
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00403ecc
mov esp, ebp
pop ebp
ret 4

Function at 0x40b1a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b1d6
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], al
jmp 0x40b1dc
mov al, byte [ebp - 9]
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x40b964
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x400
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b7ac
mov eax, dword [0x461070]
cmp byte [eax], 0
je 0x40b9f7
mov eax, dword [0x460e98]
call fcn.00402988
call fcn.0040282c
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x44c]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44c]
call fcn.00408570
push eax
lea eax, [ebp - 0x44c]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40ba3c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ba2d
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x460e48]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x462664]
call fcn.00404ee4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov esp, ebp
pop ebp
ret

Function at 0x40c404
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40c4e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403f10
lea eax, [ebp - 0xc]
call fcn.00404388
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404338
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40c4cc
mov eax, dword [ebp - 0x10]
call fcn.004026c4
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x40c4c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404338
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c4af
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x40c4f0
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c4af
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4cc
mov eax, dword [ebp - 0x18]
call fcn.004026e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4e9
lea eax, [ebp - 0xc]
call fcn.00403e78
ret