joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40716d
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
mov dword [esp + 4], 0x43c190
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4071aa
mov dword [esp], str.Error_opening_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._rewind
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
jmp 0x40730c
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.part_d
lea eax, [ebp - 0x154]
mov dword [esp], eax
call sym._sprintf_9
mov dword [esp + 4], 0x43c1b0
lea eax, [ebp - 0x154]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x407252
mov dword [esp], str.Error_creating_output_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp + 0xc]
sub eax, 1
cmp dword [ebp - 0xc], eax
jne 0x40726d
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 0x18]
sub eax, edx
jmp 0x407270
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
jmp 0x4072c5
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x554]
mov dword [esp], eax
call sym._fwrite
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x24]
je 0x4072bc
mov dword [esp], str.Error_writing_to_output_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4072fd
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
lea eax, [ebp - 0x554]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x407275
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._fclose
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x4071f4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
nop
leave
ret
Function at 0x407326
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
mov dword [esp + 4], 0x43c1b0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x407363
mov dword [esp], str.Error_creating_output_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov dword [ebp - 0xc], 0
jmp 0x407467
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.part_d
lea eax, [ebp - 0x480]
mov dword [esp], eax
call sym._sprintf_9
lea eax, [ebp - 0x480]
mov dword [esp + 4], eax
mov dword [esp], str.Processing:_s_n
call sym._printf_11
mov dword [esp + 4], 0x43c190
lea eax, [ebp - 0x480]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40742a
mov dword [esp], str.Error_opening_input_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x41c]
mov dword [esp], eax
call sym._fwrite
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
je 0x40742a
mov dword [esp], str.Error_writing_to_output_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
lea eax, [ebp - 0x41c]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4073e3
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x40736f
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
nop
leave
ret
Function at 0x40d898
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x10], 0x28
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40d8d1
mov dword [esp], str.Unable_to_allocate_memory_for_the_reply_buffer._n
call sym._printf_14
jmp 0x40da1c
call sym._IcmpCreateFile_0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40d90d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str.IcmpCreateFile_returned_an_error:__ld_n
call sym._printf_14
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x18], 0
jmp 0x40da1c
mov dword [ebp - 0xc], 0
jmp 0x40d9f0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [esp + 0x1c], 0x3e8
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], str.Data
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._IcmpSendEcho_32
sub esp, 0x20
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40d9b3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax + 0x14]
movzx ecx, al
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x24]
movzx eax, word [eax + 0xc]
movzx eax, ax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Ping_to__s_successful:_bytes_d_time_ldms_TTL_d_n
call sym._printf_14
jmp 0x40d9db
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Ping_to__s_failed._Error:__ld_n
call sym._printf_14
mov dword [0x444fdc], 1
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x40d919
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._IcmpCloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x18], 0
leave
ret
Function at 0x40da1e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov dword [ebp - 0xc], 5
cmp dword [ebp - 0xc], 0
jg 0x40da47
mov dword [esp], str.Number_of_pings_must_be_a_positive_integer._n
call sym._printf_14
mov eax, 1
jmp 0x40daa3
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40da85
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.WSAStartup_failed:__d_n
call sym._printf_14
mov eax, 1
jmp 0x40daa3
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._pingit
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, dword [0x444fdc]
leave
ret

Function at 0x40dd60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x40ddc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x445010]
test esi, esi
jle 0x40dee0
mov eax, dword [0x445014]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40ddf4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40de77
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40dde0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40df07
mov eax, dword [0x445014]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x445014]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40dee7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40de70
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40de80
add dword [0x445010], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x445014]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40de70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40ddfe
mov eax, dword [0x445014]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x40e420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44502c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x445024]
sub esp, 4
test ebx, ebx
je 0x40e475
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40e46e
test esi, esi
je 0x40e46e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40e450
mov dword [esp], 0x44502c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e7b0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40e7d5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40e7e0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40e7d5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x40e828
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40e81e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40e82a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40e810
xor eax, eax
pop ebx
pop esi
ret

Function at 0x40ec50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sym.__errno
mov dword [eax], 0
test ebx, ebx
je 0x40edd0
cmp byte [ebx], 0
je 0x40ed98
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x40ede0
test al, 0x10
je 0x40ed98
lea esi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sym.__fullpath
mov dword [esp], esi
call sym._strlen
mov dword [esp + 0x1c], eax
mov ebx, eax
lea eax, [eax + 0x233]
mov dword [esp], eax
call sym._malloc
mov edx, eax
test eax, eax
je 0x40edef
lea ebp, [eax + 0x22c]
lea eax, [ebx + 1]
cmp eax, 4
jb 0x40ed70
mov ecx, dword [esp + eax + 0x28]
mov edi, ebp
mov dword [ebp + eax - 4], ecx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [edx + 0x22c], 0
je 0x40ed1a
movzx ecx, byte [edx + ebx + 0x22b]
cmp cl, 0x5c
je 0x40ed1a
cmp cl, 0x2f
jne 0x40edb8
mov eax, dword [esp + 0x1c]
mov ecx, 0x2a
lea ebx, [edx + 0x120]
mov edi, ebx
mov word [ebp + eax], cx
xor eax, eax
mov ecx, 0x41
mov dword [edx + 0x224], 0xffffffff
mov dword [edx + 0x228], 0
mov dword [edx + 0x118], 0
mov dword [edx + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x40ecfb
movzx ecx, byte [esp + 0x2c]
mov byte [ebp], cl
test al, 2
je 0x40ecfb
movzx ecx, word [esp + eax + 0x2a]
mov word [ebp + eax - 2], cx
jmp 0x40ecfb
call sym.__errno
xor edx, edx
mov dword [eax], 0x14
add esp, 0x13c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x5c
mov dword [esp + 0x1c], eax
mov word [ebp + ebx], si
jmp 0x40ed1a
call sym.__errno
xor edx, edx
mov dword [eax], 0xe
jmp 0x40eda5
call sym.__errno
xor edx, edx
mov dword [eax], 2
jmp 0x40eda5
call sym.__errno
xor edx, edx
mov dword [eax], 0xc
jmp 0x40eda5
Function at 0x40df7a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420450]
jne 0x40df84
repz ret
jmp fcn.0040ff01

Function at 0x415880
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410e9c
and dword [ebp - 4], 0
cmp dword [0x4222c0], 0
mov ebx, eax
jne 0x415931
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4159e2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4159e2
push eax
call fcn.00410e2a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4222c0], eax
call esi
push eax
call fcn.00410e2a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4222c4], eax
call esi
push eax
call fcn.00410e2a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4222c8], eax
call esi
push eax
call fcn.00410e2a
pop ecx
mov dword [0x4222d0], eax
test eax, eax
je 0x415931
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410e2a
pop ecx
mov dword [0x4222cc], eax
mov eax, dword [0x4222cc]
cmp eax, ebx
je 0x415989
cmp dword [0x4222d0], ebx
je 0x415989
push eax
call fcn.00410ea5
push dword [0x4222d0]
mov esi, eax
call fcn.00410ea5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x415989
test edi, edi
je 0x415989
call esi
test eax, eax
je 0x415980
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x415980
test byte [ebp - 0xc], 1
jne 0x415989
or dword [ebp + 0x10], 0x200000
jmp 0x4159c2
mov eax, dword [0x4222c4]
cmp eax, ebx
je 0x4159c2
push eax
call fcn.00410ea5
pop ecx
test eax, eax
je 0x4159c2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4159c2
mov eax, dword [0x4222c8]
cmp eax, ebx
je 0x4159c2
push eax
call fcn.00410ea5
pop ecx
test eax, eax
je 0x4159c2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4222c0]
call fcn.00410ea5
pop ecx
test eax, eax
je 0x4159e2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4159e4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x65c2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x65c2a6
pop ebp
sub ebp, 0x45854c
lea edi, [ebp + 0x45a155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x65c2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x65c2d9
mov dword [ebp + 0x45a159], 1
cmp dword [ebp + 0x45a159], 0
jne 0x65c2e4
jmp 0x65c2fa
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c389
pop ebp
jmp 0x65c30e
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c616
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x4589ae]
mov esi, edi
lodsb al, byte [esi]
dec dword [eax - 2]
test al, 0xc0
call 0x3cc3dd8d
test eax, 0x1592c302
sub byte [ecx + 0x4c], 0x81
call 0x89dacf1c
stosb byte es:[edi], al
bound esi, qword [edi + 0x41]
std
xchg esi, eax
add esp, dword [ecx]
stc
invalid
Function at 0x4045a4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004068bc
test esi, esi
jne 0x4045dc
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069f8
jmp 0x4045fa
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044e8
mov edi, eax
test esi, esi
je 0x4045fa
cmp dword [ebx], 0
je 0x4045fa
dec esi
jmp 0x4045e3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405e60
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e3054], 0
je 0x405ec1
cmp word [0x4e3330], 0xd7b2
jne 0x405e89
cmp dword [0x4e3338], 0
jbe 0x405e89
mov eax, 0x4e332c
call dword [0x4e3348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405eec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4dc030], 0
jne 0x405edd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40604c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4dc034], 0
je 0x406072
mov edx, esi
mov eax, ebx
call dword [0x4dc034]
jmp 0x406081
mov eax, 8
call fcn.00404230
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4e3055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406014
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4086b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40881f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004068bc
cmp si, word [0x4dc7dc]
jb 0x408752
cmp si, word [0x4dc9dc]
ja 0x408752
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408752
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4dc7dc]
jae 0x40872c
mov edi, ebx
dec edi
jmp 0x40874d
cmp si, word [ebx*8 + 0x4dc7dc]
jbe 0x40873c
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x40874d
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4dc7e0]
call fcn.004085c8
jmp 0x408752
cmp edi, dword [ebp - 0xc]
jae 0x408716
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408801
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408801
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406abc
push dword [ebp - 0x164]
push 0x40883c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406abc
push dword [ebp - 0x168]
push 0x40884c
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406abc
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408826
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004068b4
ret
Function at 0x4089d8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408add
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4e5b5c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4e5b74]
jne 0x408a24
mov eax, esi
mov edx, 0x4e5b78
mov ecx, 0x55
call fcn.00406abc
push 0x4e5b5c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408ac7
push 0x4e5b5c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.004068bc
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408a95
cmp byte [0x4e5b58], 0
je 0x408a5a
mov edx, esi
mov eax, ebx
call fcn.004088b8
jmp 0x408a95
mov edx, esi
mov eax, ebx
call fcn.004086b8
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408a95
cmp dword [esi], 0
je 0x408a7e
mov eax, esi
mov edx, 0x408af8
call fcn.00406cd0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004086b8
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406cd0
push 0x4e5b5c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4e5b74], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406948
push eax
push 0x4e5b78
call sub.kernel32.dll_lstrcpynW
push 0x4e5b5c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ae4
lea eax, [ebp - 4]
call fcn.004068ac
ret