joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2c388
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2c4fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x2c514
call fcn.00013c90
mov eax, 0x400
call fcn.00019248
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x2c4db
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
push 0x2c530
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x2c4b1
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x2c574
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.00018af4
test eax, eax
jne 0x2c4b1
cmp dword [ebp - 4], 1
jne 0x2c4b1
cmp dword [ebp - 0x18], 0
jbe 0x2c4b1
mov eax, dword [ebp - 0x14]
call fcn.00018ad0
cmp eax, dword [ebp - 0x18]
jb 0x2c4b1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00018adc
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00014350
mov edx, dword [ebp - 0xc]
mov eax, 0x2c598
call fcn.00014874
mov esi, eax
test esi, esi
jle 0x2c47c
lea eax, [ebp - 0x10]
mov ecx, esi
mov edx, 1
call fcn.00014748
mov edx, dword [ebp - 0x10]
mov eax, 0x2c598
call fcn.00014874
mov edi, eax
test esi, esi
jle 0x2c4b1
test edi, edi
jle 0x2c4b1
lea eax, [ebp - 0xc]
push eax
lea ecx, [edi + esi]
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.000146fc
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00013e94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2c4e2
cmp dword [ebp - 8], 0
je 0x2c4cd
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
call fcn.00019258
ret

Function at 0x2c5c8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov edx, ebx
mov eax, 0x2c648
call fcn.00031d88
mov eax, pe_nt_image_headers32
call fcn.00019220
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x2c639
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00018998
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.000189b0
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x2c623
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0001899c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2c640
lea eax, [ebp - 8]
call fcn.00019230
ret

Function at 0x2c678
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00014090
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x2c691
test al, 0x10
jne 0x2c695
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x2d600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
xor eax, eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x2d86e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x2d841
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00025330
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x2d81f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2d87c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2d81f
cmp dword [ebp - 0xc], 4
jne 0x2d81f
mov eax, dword [ebp - 8]
mov dword [0x1b399c], eax
mov eax, dword [ebp - 8]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x118]
call fcn.0002b0cc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00013ea8
lea edx, [ebp - 0x114]
mov eax, 0x1b39a8
mov cl, 0xb
call fcn.00012a70
shr dword [ebp - 8], 8
lea eax, [ebp - 0x120]
mov edx, 0x1b39a8
call fcn.00013e70
push dword [ebp - 0x120]
lea edx, [ebp - 0x124]
mov eax, 0x2d890
call fcn.00031d88
push dword [ebp - 0x124]
mov eax, dword [ebp - 8]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x128]
call fcn.0002b0cc
push dword [ebp - 0x128]
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00013ea8
lea edx, [ebp - 0x114]
mov eax, 0x1b39a8
mov cl, 0xb
call fcn.00012a70
shr dword [ebp - 8], 8
lea eax, [ebp - 0x130]
mov edx, 0x1b39a8
call fcn.00013e70
push dword [ebp - 0x130]
lea edx, [ebp - 0x134]
mov eax, 0x2d890
call fcn.00031d88
push dword [ebp - 0x134]
mov eax, dword [ebp - 8]
and eax, 0xff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x138]
call fcn.0002b0cc
push dword [ebp - 0x138]
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00013ea8
lea edx, [ebp - 0x114]
mov eax, 0x1b39a8
mov cl, 0xb
call fcn.00012a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2d848
cmp dword [ebp - 4], 0
je 0x2d83b
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 4], eax
ret
Function at 0x2fd6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x2fe0f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
push 0x2fe20
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [ebp - 0x14], 0
je 0x2fded
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x2fe64
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2fded
cmp dword [ebp - 0x10], 4
jne 0x2fded
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2fe16
cmp dword [ebp - 0x14], 0
je 0x2fe09
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0x2fe78
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x2ff07
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x1b3998]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x2ff18
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x2fee5
mov dword [ebp - 0x10], ebx
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x2ff5c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ff0e
cmp dword [ebp - 8], 0
je 0x2ff01
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0x2ff70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x30000
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x1b3998]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x30010
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2ffde
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x3004c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30007
cmp dword [ebp - 8], 0
je 0x2fffa
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0x30228
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00014314
xor eax, eax
mov dword [ebp - 8], eax
mov eax, 0x400
call fcn.00019248
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x3032c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
push 0x30338
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x302f0
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x3037c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00018af4
test eax, eax
jne 0x302f0
cmp dword [ebp - 4], 1
jne 0x302f0
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00018adc
mov eax, dword [ebx]
call fcn.0001d908
test al, al
jne 0x302f0
mov eax, dword [ebp - 0xc]
call fcn.00018abc
mov eax, dword [ebp - 0xc]
call fcn.00018ad4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00018af0
push eax
push 0x3039c
call sub.kernel32.dll_GetEnvironmentVariableW
cmp eax, 3
jbe 0x302f0
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00018adc
mov eax, dword [ebx]
call fcn.0001d908
test al, al
jne 0x30302
mov eax, ebx
call fcn.0002b4d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30333
cmp dword [ebp - 8], 0
je 0x3031e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
call fcn.00019258
ret

Function at 0x30fa0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov esi, eax
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
push ebp
push 0x31058
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, esi
call fcn.00014090
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebx], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x31000
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp 0x3103b
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x3102d
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00030f64
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp 0x3103b
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3105f
cmp dword [ebp - 0x10], 0xffffffff
je 0x31057
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x3106c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov esi, eax
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
push ebp
push 0x31124
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, esi
call fcn.00014538
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebx], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x310cc
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp 0x31107
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x310f9
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00030f64
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp 0x31107
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3112b
cmp dword [ebp - 0x10], 0xffffffff
je 0x31123
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x31230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x312d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
push 0
push 0
push 0x312e4
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x31320
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x312b4
cmp dword [ebp - 0x18], 4
jne 0x312b4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x312dd
cmp dword [ebp - 0xc], 0
je 0x312d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret

Function at 0x317fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00014090
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x31815
test al, 0x10
je 0x31819
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x33b80
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x33dcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00013c90
cmp dword [0x1b3b04], 1
jne 0x33bcb
cmp dword [0x1b3b08], 4
jle 0x33c0a
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.00014090
push eax
call sub.mpr.dll_WNetGetUniversalNameA
test eax, eax
jne 0x33daf
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x420]
mov edx, dword [edx]
call fcn.00013e04
jmp 0x33daf
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.000129d0
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x41
jb 0x33daf
cmp byte [ebp - 0x15], 0x5a
ja 0x33daf
mov eax, dword [ebp - 4]
call fcn.00013ecc
cmp eax, 3
jl 0x33daf
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x33daf
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x5c
jne 0x33daf
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
push 1
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x33daf
xor edx, edx
push ebp
push 0x33da8
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0x640
mov eax, dword [ebp - 0xc]
call fcn.0001271c
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x33d8a
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x33cd9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.0001274c
jmp 0x33c9d
test eax, eax
je 0x33cec
call fcn.0001370c
call fcn.0001370c
jmp 0x33daf
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x33c9d
inc esi
xor edi, edi
mov eax, edi
shl eax, 2
mov edx, dword [ebp - 0x20]
lea ebx, [edx + eax*8]
cmp dword [ebx + 0x10], 0
je 0x33d68
mov eax, dword [ebx + 0x10]
mov al, byte [eax]
call fcn.000129d0
cmp al, byte [ebp - 0x15]
jne 0x33d68
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.00013ecc
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.000140d4
mov eax, dword [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx + 0x14]
call fcn.00013e04
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00013f18
call fcn.0001370c
call fcn.0001370c
jmp 0x33daf
inc edi
dec esi
jne 0x33cf7
jmp 0x33c9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x33dd4
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00013c60
ret

Function at 0x33ed8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00013d24
add esp, 0x104
pop ebx
ret
Function at 0x34d10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x34d49
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00013d24
jmp 0x34d52
mov eax, ebx
mov edx, esi
call fcn.00013c90
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x34d5c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x34d7d
mov al, byte [esp]
jmp 0x34d7f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x3f82c
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x3f83c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x3f851
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x42d88
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42dee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x2a9144]
cmp byte [eax], 0
je 0x42dbc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
jmp 0x42dd8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00013e34
mov eax, dword [ebp - 0xc]
call fcn.00014090
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42df5
lea eax, [ebp - 0xc]
call fcn.00013c3c
ret
Function at 0x43128
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.0001800c
cmp ax, 0xffff
jne 0x43152
mov eax, dword [ebp - 8]
neg eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
shr eax, 4
and eax, 0xffff
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
and eax, 0xf
mov dword [ebp - 0x20], eax
push 6
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43222
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43222
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
dec eax
test eax, eax
jl 0x431d8
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
add eax, eax
add eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x431bf
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov dword [ebp - 0x10], eax
add dword [ebp - 0x1c], 2
cmp dword [ebp - 0xc], 0
je 0x43222
cmp dword [ebp + 8], 0
jle 0x43222
mov eax, dword [ebp + 8]
dec eax
mov edx, dword [ebp - 0x10]
call fcn.000417cc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x43216
mov ecx, dword [ebp - 0x10]
add ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00018020
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov word [eax + edx*2], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x443f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
je 0x44457
lea eax, [ebp - 4]
push eax
push 0x40
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4442b
call fcn.00041c4c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 6
call fcn.00012840
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x44457
call fcn.00041c4c
pop edi
pop esi
mov esp, ebp
pop ebp
ret