joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f92e
Capabilities:
Check if file exists
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d4218]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, ecx
call fcn.00472400
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Shcore.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, edi
call fcn.0042f8be
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42f9dd
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42f9dd
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cd3a
mov ebx, eax
test ebx, ebx
je 0x42f9dd
push str.SetProcessDpiAwareness
push ebx
call esi
push str.GetProcessDpiAwareness
push ebx
mov dword [edi + 0x18], eax
call esi
push str.GetDpiForMonitor
push ebx
mov dword [edi + 0x1c], eax
call esi
mov dword [edi + 0x20], eax
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x42fa1a
push str.SetProcessDPIAware
push ebx
call esi
push str.IsProcessDPIAware
push ebx
mov dword [edi + 0x24], eax
call esi
push str.LogicalToPhysicalPoint
push ebx
mov dword [edi + 0x28], eax
call esi
push str.PhysicalToLogicalPoint
push ebx
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004717cc
leave
ret
Function at 0x430855
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x338
lea ebp, [esp - 4]
mov eax, dword [0x4d4218]
xor eax, ebp
mov dword [ebp + 0x338], eax
push 0x10
mov eax, 0x4a8bde
call fcn.00471cf0
mov esi, dword [ebp + 0x344]
mov edi, ecx
call fcn.0042fcbc
push 0xffffffffffffffff
call fcn.0042ba18
push eax
lea ecx, [ebp + 0x2b4]
call fcn.0042b0ee
xor ebx, ebx
push 0xffffffffffffffff
mov dword [ebp - 4], ebx
call fcn.0042ba22
push eax
lea ecx, [ebp + 0x230]
call fcn.0042b0ee
lea ecx, [ebp + 0x230]
mov byte [ebp - 4], 1
call fcn.0042a8ca
test al, al
je 0x4309e3
push esi
lea ecx, [ebp + 0x2b4]
call fcn.0042a979
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea ecx, [ebp + 0x2b4]
call fcn.0042a7b9
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
push ebx
cmp eax, 0xffffffff
jne 0x430953
push str.Error_opening_file
mov ecx, edi
call fcn.0042feed
lea ecx, [ebp + 0x230]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], bl
call fcn.0042a79f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x2b4]
call fcn.0042a79f
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x338]
xor ecx, ebp
call fcn.004717cc
add ebp, 0x33c
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
jne 0x430968
push ebx
push str.File_is_empty
jmp 0x430904
cmp esi, 0x400000
jbe 0x430978
push ebx
push 0x4b2ad4
jmp 0x430904
push esi
mov dword [ebp - 0x18], ebx
call fcn.004715fe
pop ecx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push esi
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], esi
je 0x4309be
push dword [ebp - 0x14]
call fcn.00472ec7
pop ecx
mov ecx, edi
call fcn.0042fcbc
push ebx
push str.Could_not_read_file
jmp 0x430904
push dword [ebp + 0x348]
mov ecx, edi
push esi
push dword [ebp - 0x14]
call fcn.004306e9
push dword [ebp - 0x14]
mov byte [ebp - 0xd], al
call fcn.00472ec7
mov al, byte [ebp - 0xd]
pop ecx
jmp 0x43090b
call fcn.0042ba22
push eax
lea ecx, [ebp + 0x2b4]
call fcn.0042a979
push 2
push ebx
lea ecx, [ebp + 0x2b4]
call fcn.0042a8f5
push eax
call fcn.00424f8d
lea ecx, [ebp]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push 1
push esi
push eax
mov dword [ebp - 0x14], eax
call fcn.00425134
add esp, 0x20
test eax, eax
je 0x430a2e
push ebx
push str.Could_not_find_ziped_file
jmp 0x430904
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x430960
cmp eax, 0x400000
ja 0x430970
push eax
call fcn.004715fe
push 3
push dword [ebp - 0x18]
mov esi, eax
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.0042521b
add esp, 0x18
cmp eax, ebx
je 0x430a8c
cmp eax, 0x600
je 0x430a8c
push esi
call fcn.00472ec7
push dword [ebp - 0x14]
call fcn.00424628
pop ecx
pop ecx
push ebx
push str.Could_not_unzip_file
jmp 0x430904
push dword [ebp - 0x14]
call fcn.00424628
pop ecx
push dword [ebp + 0x348]
mov ecx, edi
push dword [ebp - 0x18]
push esi
call fcn.004306e9
push esi
jmp 0x4309d2
Function at 0x432186
Capabilities:
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x5f8]
sub esp, 0x674
mov eax, dword [0x4d4218]
xor eax, ebp
mov dword [ebp + 0x5f4], eax
fldz
and dword [ebp - 0x54], 0
push esi
fstp qword [ebp - 0x64]
fld1
mov esi, ecx
mov al, byte [esi]
fstp qword [ebp - 0x74]
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0
cmp al, 0x2b
je 0x4321cd
cmp al, 0x2d
jne 0x4321ce
fld qword [0x4b2cb0]
fstp qword [ebp - 0x74]
inc esi
mov al, byte [esi]
push ebx
push edi
call fcn.00430c02
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, 0x190
test eax, eax
je 0x432240
push 0xa
lea eax, [ebp - 0x54]
push eax
push esi
call fcn.0047a1e1
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
cmp esi, dword [ebp - 0x54]
je 0x43220d
fild qword [ebp - 0x5c]
mov esi, dword [ebp - 0x54]
mov byte [ebp - 0x4e], 1
fstp qword [ebp - 0x64]
xor eax, eax
push 0x31e
push eax
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4a]
push eax
call fcn.00472400
push dword [ebp - 0x58]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x5c]
push str.V______intPart___I64d_n
push ebx
push eax
call fcn.00472f91
add esp, 0x20
lea eax, [ebp - 0x4c]
push eax
call edi
cmp byte [esi], 0x2e
jne 0x4322ea
inc esi
mov al, byte [esi]
call fcn.00430c02
test eax, eax
je 0x4322ea
push 0xa
lea eax, [ebp - 0x54]
push eax
push esi
call fcn.0047a1e1
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x54]
add esp, 0xc
mov dword [ebp - 0x68], edx
cmp esi, eax
je 0x4322ab
fild qword [ebp - 0x6c]
sub eax, esi
mov dword [ebp - 0x58], eax
sub esp, 0x10
fstp qword [ebp - 0x7c]
fild dword [ebp - 0x58]
fstp qword [esp + 8]
fld qword [0x4b2c78]
fstp qword [esp]
call fcn.00479cc0
fdivr qword [ebp - 0x7c]
mov esi, dword [ebp - 0x54]
add esp, 0x10
mov byte [ebp - 0x4d], 1
fadd qword [ebp - 0x64]
fstp qword [ebp - 0x64]
xor eax, eax
push 0x31e
push eax
mov word [ebp + 0x2d4], ax
lea eax, [ebp + 0x2d6]
push eax
call fcn.00472400
push dword [ebp - 0x68]
lea eax, [ebp + 0x2d4]
push dword [ebp - 0x6c]
push str.V______fracPart___I64d_n
push ebx
push eax
call fcn.00472f91
add esp, 0x20
lea eax, [ebp + 0x2d4]
push eax
call edi
cmp byte [ebp - 0x4e], 0
pop edi
pop ebx
jne 0x4322fc
cmp byte [ebp - 0x4d], 0
jne 0x4322fc
fldz
jmp 0x432345
mov al, byte [esi]
cmp al, 0x65
je 0x432306
cmp al, 0x45
jne 0x43233f
push 0xa
lea eax, [ebp - 0x54]
push eax
inc esi
push esi
call fcn.00476663
add esp, 0xc
mov dword [ebp - 0x58], eax
cmp esi, dword [ebp - 0x54]
je 0x43233f
fild dword [ebp - 0x58]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [0x4b2c78]
fstp qword [esp]
call fcn.00479cc0
fmul qword [ebp - 0x64]
add esp, 0x10
fstp qword [ebp - 0x64]
fld qword [ebp - 0x74]
fmul qword [ebp - 0x64]
mov ecx, dword [ebp + 0x5f4]
xor ecx, ebp
pop esi
call fcn.004717cc
add ebp, 0x5f8
leave
ret
Function at 0x43fe94
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d4218]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
push edi
je 0x43fefb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.004731f0
mov ebx, esp
test ebx, ebx
je 0x43fefb
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x134
call fcn.0042a92e
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0042d566
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004717cc
leave
ret 0x10

Function at 0x44b581
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3b4], ebx
je 0x44b5e9
cmp dword [ebp + 8], 0x100
jne 0x44b5d8
cmp word [ebp + 0xc], 0xd
jne 0x44b5d8
cmp byte [esi + 0x3ba], bl
je 0x44b5bf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44b5d8
cmp byte [esi + 0x3bb], bl
jne 0x44b5d8
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x44b5d4
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0042d566
xor eax, eax
jmp 0x44b5ec
mov eax, dword [esi + 0x3b4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x44c75e
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4d4218]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
mov ebx, dword [ebp + 0x19c]
push esi
push edi
mov edi, dword [ebp + 0x198]
mov esi, ecx
push 0
lea eax, [esi + 0x48]
push eax
push edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], 1
call fcn.0044c60b
add esp, 0xc
test eax, eax
jl 0x44c8b8
lea eax, [esi + 0xbc]
push eax
push edi
call fcn.00449d61
pop ecx
pop ecx
test eax, eax
jl 0x44c8b8
mov ecx, edi
mov dword [esi + 0x14], 4
call fcn.0044a8fa
movzx eax, al
shl eax, 3
xor eax, dword [esi + 0x18]
and eax, 8
xor dword [esi + 0x18], eax
mov edx, dword [esi + 0x18]
call fcn.0044aa94
mov dword [esi + 0x20], eax
test ebx, ebx
je 0x44c801
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x14], eax
test eax, 0x100080
jne 0x44c801
or edx, 2
mov dword [esi + 0x18], edx
mov eax, dword [esi + 0x14]
test al, 1
je 0x44c80c
push 3
jmp 0x44c812
test al, 2
je 0x44c81a
push 2
pop eax
mov word [esi + 0xd4], ax
or dword [esi + 0x18], 0x20
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00472400
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Riched20.dll
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040cd3a
mov dword [esi + 4], eax
test eax, eax
je 0x44c8b8
push str.CreateTextServices
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44c8b8
lea ecx, [ebp - 0x80]
push ecx
push esi
push 0
call eax
test eax, eax
jl 0x44c8b8
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
add esi, 0x10
push esi
push 0x4b5814
push eax
call dword [ecx]
mov edi, eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test edi, edi
jl 0x44c8b8
test ebx, ebx
je 0x44c8bc
mov ebx, dword [ebx + 0x24]
test ebx, ebx
je 0x44c8bc
mov ecx, dword [esi]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x38]
test eax, eax
jge 0x44c8bc
xor eax, eax
jmp 0x44c8bf
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004717cc
add ebp, 0x190
leave
ret 8
Function at 0x4717cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d4218]
jne 0x4717d6
repz ret
jmp fcn.0047c4d4

Function at 0x49982d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047d84d
and dword [ebp - 4], 0
cmp dword [0x4d8538], 0
mov ebx, eax
jne 0x4998de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x49998f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x49998f
push eax
call fcn.0047d7db
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d8538], eax
call esi
push eax
call fcn.0047d7db
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d853c], eax
call esi
push eax
call fcn.0047d7db
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d8540], eax
call esi
push eax
call fcn.0047d7db
pop ecx
mov dword [0x4d8548], eax
test eax, eax
je 0x4998de
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047d7db
pop ecx
mov dword [0x4d8544], eax
mov eax, dword [0x4d8544]
cmp eax, ebx
je 0x499936
cmp dword [0x4d8548], ebx
je 0x499936
push eax
call fcn.0047d856
push dword [0x4d8548]
mov esi, eax
call fcn.0047d856
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x499936
test edi, edi
je 0x499936
call esi
test eax, eax
je 0x49992d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49992d
test byte [ebp - 0xc], 1
jne 0x499936
or dword [ebp + 0x10], 0x200000
jmp 0x49996f
mov eax, dword [0x4d853c]
cmp eax, ebx
je 0x49996f
push eax
call fcn.0047d856
pop ecx
test eax, eax
je 0x49996f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x49996f
mov eax, dword [0x4d8540]
cmp eax, ebx
je 0x49996f
push eax
call fcn.0047d856
pop ecx
test eax, eax
je 0x49996f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d8538]
call fcn.0047d856
pop ecx
test eax, eax
je 0x49998f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x499991
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403654
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x459020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036cc
xor eax, eax
push ebp
push 0x4036c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403708
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x459020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x459020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4043b0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45b048], 0
je 0x404411
cmp word [0x45b21c], 0xd7b2
jne 0x4043d9
cmp dword [0x45b224], 0
jbe 0x4043d9
mov eax, 0x45b218
call dword [0x45b234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x459070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404438
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x459030], 0
jne 0x40442d
push 0
push 0x459068
push 0x459070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405810
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a40
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405893
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a40
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405893
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405a5c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40591c
xor eax, eax
push ebp
push 0x405915
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405658
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4058fa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405a7c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4058fa
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40591c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405a36
cmp byte [ebp - 0xd], 0
jne 0x405963
cmp byte [ebp - 0x12], 0
je 0x405a36
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40597c
dec ebx
cmp byte [ebx], 0x2e
je 0x40598b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40597b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405a36
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4059c8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a36
cmp byte [ebp - 0xd], 0
je 0x405a36
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405a36
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406108
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40616e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040479c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030bc
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406158
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406175
lea eax, [ebp - 0x10]
call fcn.0040452c
ret

Function at 0x40c2ec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c325
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040461c
jmp 0x40c32e
mov eax, ebx
mov edx, esi
call fcn.00404580
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c338
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c359
mov al, byte [esp]
jmp 0x40c35b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c9e0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c858
mov eax, dword [0x45a188]
cmp byte [eax], 0
je 0x40ca5c
mov eax, dword [0x459f9c]
call fcn.00402d14
call fcn.00402864
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409a8c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40caa4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ca92
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x459f4c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45b664]
call fcn.0040561c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d2f8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d3ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004045c4
lea eax, [ebp - 8]
call fcn.00404a3c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004049ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d3b8
mov eax, ebx
call fcn.004026fc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d3b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004049ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d39b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d3e0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d39b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3b8
mov eax, dword [ebp - 0x10]
call fcn.0040271c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3d5
lea eax, [ebp - 8]
call fcn.0040452c
ret

Function at 0x40d8e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d944
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040479c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004095d4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d94b
lea eax, [ebp - 0xc]
call fcn.0040452c
ret

Function at 0x41bbb8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45b884
cmp dword [edi], 0
jne 0x41bc34
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45b880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x459450
mov ecx, 2
call fcn.004028f8
mov edx, 0x41bb90
lea eax, [esi + 5]
call fcn.0041bbb0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041bbb0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41bc09
mov dword [0x45b880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d1b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41d1b6
ret