joyce8/EMBER2024-capa huggingface dataset:
Function at 0x91c598
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040882c
xor eax, eax
push ebp
push 0x91c644
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea eax, [ebp - 0x210]
mov edx, dword [ebp - 4]
call fcn.0042323c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x91c62e
mov eax, ebx
call fcn.00404e98
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x91c654
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x91c627
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x91c627
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
mov eax, esi
call fcn.00404eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x91c64b
lea eax, [ebp - 4]
call fcn.00408748
ret

Function at 0x91c794
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x91c7b5
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x91c7b5
xor eax, eax
ret
mov al, 1
ret

Function at 0x91c7b8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
test dl, dl
je 0x91c7c9
add esp, 0xfffffff0
call fcn.00406f54
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0055e7d0
push 2
call sub.user32.dll_GetSystemMetrics
add eax, 2
mov dword [ebx + 0x350], eax
mov byte [ebx + 0x357], 0
mov byte [ebx + 0x36a], 0
mov dl, 1
mov eax, ebx
call fcn.00518e5c
xor edx, edx
mov eax, ebx
call fcn.0051a670
xor edx, edx
mov eax, ebx
call fcn.0051a634
mov byte [ebx + 0x355], 0
mov byte [ebx + 0x328], 0
xor eax, eax
mov dword [ebx + 0x32c], eax
mov byte [ebx + 0x354], 0
mov byte [ebx + 0x35e], 0
mov byte [ebx + 0x35c], 0
mov dword [ebx + 0x358], 0x1fffffff
mov dword [ebx + 0x344], 0x1fffffff
mov dword [ebx + 0x348], 0x1fffffff
mov dword [ebx + 0x334], 0x1fffffff
mov dword [ebx + 0x33c], 0x1fffffff
mov dword [ebx + 0x340], 0x1fffffff
mov dword [ebx + 0x34c], 0x1fffffff
mov dword [ebx + 0x338], 0x1fffffff
call sub.kernel32.dll_GetVersion_1
movzx edx, al
movzx eax, ax
shr eax, 8
movzx eax, al
cmp edx, 5
ja 0x91c8af
cmp edx, 5
jne 0x91c8ab
cmp eax, 1
jae 0x91c8af
xor eax, eax
jmp 0x91c8b1
mov al, 1
mov byte [ebx + 0x356], al
mov eax, 0x91c914
call fcn.0091c598
shr eax, 0x10
and eax, 0xff
cmp eax, 5
setg al
mov byte [ebx + 0x330], al
mov byte [ebx + 0x35f], 0
mov byte [ebx + 0x360], 1
mov byte [ebx + 0x36b], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x91c901
call fcn.00406fac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x929f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov byte [esp + 1], 1
mov byte [esi], 0
mov byte [esi + 1], 0
mov byte [esi + 2], 0
mov byte [esi + 3], 0
mov byte [esi + 4], 0
mov byte [esi + 5], 0
mov byte [esi + 6], 0
movzx eax, byte [esp]
mov byte [esi + 7], al
lea eax, [esi + 8]
call fcn.00408748
mov byte [esi + 0xc], 0
mov byte [esi + 0xd], 0
movzx eax, byte [esp]
mov byte [esi + 0xe], al
lea eax, [esi + 0x10]
call fcn.00408748
mov byte [esi + 0x14], 0
mov byte [esi + 0x15], 1
mov byte [esi + 0x16], 0
mov byte [esi + 0x17], bl
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
movzx eax, byte [esp + 1]
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 0
mov byte [esi + 0x22], bl
xor edx, edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edx
mov byte [esi + 0x30], al
mov byte [esi + 0x31], 0
mov byte [esi + 0x32], bl
xor edx, edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov byte [esi + 0x40], al
mov byte [esi + 0x41], 0
mov byte [esi + 0x42], bl
xor edx, edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov byte [esi + 0x50], al
mov byte [esi + 0x51], 0
mov byte [esi + 0x52], bl
xor eax, eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], 0x40490000
mov byte [esi + 0x60], 0
mov byte [esi + 0x61], 0
movzx eax, byte [esp]
mov byte [esi + 0x62], al
lea eax, [esi + 0x64]
call fcn.00408748
mov byte [esi + 0x68], 0
mov byte [esi + 0x69], 0
movzx eax, byte [esp]
mov byte [esi + 0x6a], al
lea eax, [esi + 0x6c]
call fcn.00408748
mov byte [esi + 0x70], 0
mov byte [esi + 0x71], bl
mov dword [esi + 0x74], 1
mov byte [esi + 0x78], 0
mov byte [esi + 0x79], bl
mov dword [esi + 0x7c], 1
mov byte [esi + 0x80], 0
mov byte [esi + 0x81], 0
movzx eax, byte [esp]
mov byte [esi + 0x82], al
lea eax, [esi + 0x84]
call fcn.00408748
mov byte [esi + 0x88], 0
mov byte [esi + 0x89], bl
mov dword [esi + 0x8c], 1
mov byte [esi + 0x90], 0
mov byte [esi + 0x91], 0
movzx eax, byte [esp]
mov byte [esi + 0x92], al
lea eax, [esi + 0x94]
call fcn.00408748
mov byte [esi + 0x98], 0
mov byte [esi + 0x99], bl
mov dword [esi + 0x9c], 1
mov byte [esi + 0xa0], 0
mov byte [esi + 0xa1], 0
movzx eax, byte [esp]
mov byte [esi + 0xa2], al
lea eax, [esi + 0xa4]
call fcn.00408748
mov byte [esi + 0xa8], 0
mov byte [esi + 0xa9], bl
call fcn.00425750
fstp qword [esi + 0xb0]
wait
mov byte [esi + 0xb8], 0
mov byte [esi + 0xb9], bl
call fcn.00425750
fstp qword [esi + 0xc0]
wait
mov byte [esi + 0xc8], 0
mov byte [esi + 0xc9], bl
call fcn.00425750
fstp qword [esi + 0xd0]
wait
pop edx
pop esi
pop ebx
ret
Function at 0x92cd24
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x92cdfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x4dd3e0]
call fcn.004de9bc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x92cdd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.004deaa4
xor ecx, ecx
mov edx, 0x92ce18
mov eax, dword [ebp - 0xc]
call fcn.004debfc
test al, al
je 0x92cdbf
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004df3c8
mov eax, dword [ebp - 0xc]
call fcn.004dea74
push dword [ebp - 4]
push 0x92cea8
push esi
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004099dc
mov eax, dword [ebp - 0x10]
mov dl, 1
call fcn.0042269c
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x92cddc
mov eax, dword [ebp - 0xc]
call fcn.004069e4
ret
Function at 0x9468b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdac
push ebx
xor ecx, ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040882c
xor eax, eax
push ebp
push 0x946a71
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 4]
call fcn.00422e74
cmp dword [ebp - 0x248], 0
jne 0x94692f
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.00423050
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 4]
call fcn.00408b70
xor edx, edx
mov eax, 2
call fcn.004c5a38
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x946a3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x244], 0x22c
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 0x10]
call fcn.004c5a58
test eax, eax
je 0x946a28
mov ebx, dword [ebp - 0x22c]
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x23c]
call fcn.004c5d3c
cmp ebx, dword [ebp - 0x18]
jne 0x946a12
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 8]
call fcn.0042117c
mov eax, dword [ebp - 0x250]
push eax
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 4]
call fcn.0042117c
mov edx, dword [ebp - 0x254]
pop eax
call fcn.00409aec
jne 0x946a12
mov eax, dword [ebp - 0x23c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x946a12
xor eax, eax
push ebp
push 0x946a0b
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x9469f4
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x946a12
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 0x10]
call fcn.004c5a78
test eax, eax
jne 0x94696c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x946a46
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x9491f8
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x949200
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x94943d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x98
call fcn.00405c80
mov eax, ebx
mov edx, dword [0x9f1f78]
mov edx, dword [edx]
call fcn.00408b28
lea eax, [ebp - 4]
call reloc.user32.dll_DrawStateW
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.00408b28
mov byte [ebx + 5], 1
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00405300
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov edx, 0x949458
call fcn.00422d94
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xc]
call fcn.00408b28
lea eax, [ebp - 0x10]
call reloc.user32.dll_DrawStateW
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x14]
mov ecx, 0x949470
call fcn.00409954
mov edx, dword [ebx + 0x14]
lea eax, [ebx + 0x18]
mov ecx, 0x949490
call fcn.00409954
lea eax, [ebp - 0x14]
call reloc.user32.dll_DrawStateW
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x80]
mov ecx, 0x9494b4
call fcn.00409954
mov dword [ebx + 0x4c], 0x8000
mov dword [ebx + 0x50], 0xffff
mov dword [ebx + 0x6c], 0xff0000
mov dword [ebx + 0x70], 0xff
mov dword [ebx + 0x1c], 0x789c58
mov dword [ebx + 0x20], 0xd3e0c9
mov dword [ebx + 0x24], 0xa7c18e
mov dword [ebx + 0x28], 0xeef3eb
mov dword [ebx + 0x2c], 0xffffff
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], 0xf38b18
mov dword [ebx + 0x38], 0xffffff
mov dword [ebx + 0x3c], 0xf7ae5e
mov al, 0xe6
call fcn.005fb478
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 0xffffff
xor eax, eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x54], 0xf1e7ee
mov dword [ebx + 0x58], 0xb86cc6
mov dword [ebx + 0x5c], 0xdfaee8
mov dword [ebx + 0x60], 0xcc44e3
mov dword [ebx + 0x64], 0xdfaee8
mov dword [ebx + 0x68], 0x481a47
mov byte [ebx + 0x74], 1
mov byte [ebx + 0x75], 1
mov byte [ebx + 0x76], 1
lea eax, [ebx + 0x78]
mov edx, 0x9494dc
call fcn.00408b28
lea eax, [ebx + 0x7c]
mov edx, 0x949504
call fcn.00408b28
mov eax, 0x949538
mov dword [ebp - 0x28], eax
mov eax, 0x94955c
mov dword [ebp - 0x24], eax
mov eax, 0x94957c
mov dword [ebp - 0x20], eax
mov eax, 0x94959c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x18]
mov edx, 3
call fcn.00616fa0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x84]
call fcn.00408b28
mov eax, 0x9495c0
mov dword [ebp - 0x28], eax
mov eax, 0x9495f0
mov dword [ebp - 0x24], eax
mov eax, 0x949624
mov dword [ebp - 0x20], eax
mov eax, 0x949644
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
mov edx, 3
call fcn.00616fa0
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x94]
call fcn.00408b28
lea eax, [ebp - 0x30]
call reloc.user32.dll_DrawStateW
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x8c]
mov ecx, 0x949660
call fcn.00409954
lea eax, [ebx + 0x90]
call fcn.00408748
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x949444
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004087a8
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004087a8
ret
Function at 0x94d644
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 5
push 0x94d66c
push 0x94d66c
mov eax, ebx
call fcn.004096e8
push eax
push 0x94d670
push esi
call sub.shell32.dll_ShellExecuteW
pop esi
pop ebx
ret

Function at 0x95ad34
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x95ad55
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x95ad55
xor eax, eax
ret
mov al, 1
ret

Function at 0x96aa70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004096e8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x96aa89
test al, 0x10
jne 0x96aa8d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x96bec4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x81
push 0
push 0
dec ecx
jne 0x96becd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x31c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, edx
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x97224c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00408748
lea eax, [ebp - 0x18]
call fcn.00408748
xor eax, eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x3c]
mov eax, dword [eax]
sub dword [ebp - 0x310], eax
mov eax, dword [ebp + 0x44]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1f], 0
mov eax, dword [ebp + 0x20]
mov byte [eax], 0
mov eax, dword [ebp + 0x1c]
mov byte [eax], 0
mov eax, dword [ebp + 0x4c]
add eax, 0xffffffb8
call fcn.00408748
mov eax, dword [ebp + 0x40]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x40]
xor edx, edx
mov dword [eax], edx
lea esi, [ebp - 0x31c]
lea edi, [ebp - 0x32c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 8]
call fcn.00408748
cmp byte [ebp + 0x48], 0
jne 0x96bf82
mov eax, dword [ebp + 0x18]
add dword [ebp - 0x32c], eax
mov eax, dword [ebp + 0x4c]
cmp byte [eax - 0x49], 0
je 0x97211d
cmp byte [ebp + 0x48], 0
jne 0x97211d
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp + 0x4c]
mov dword [edx - 0x50], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x44]
call fcn.004e9790
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax - 0x58]
push eax
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0x4c]
mov edx, dword [eax - 0x60]
mov ecx, dword [ebp - 0x318]
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0x7c]
jmp 0x97211d

Function at 0x973cbc
Capabilities:
Check os version

Disassembly:
call sub.kernel32.dll_GetVersion_1
movzx edx, al
movzx eax, ax
shr eax, 8
movzx eax, al
cmp edx, 5
ja 0x973cdf
cmp edx, 5
jne 0x973cdc
cmp eax, 1
jae 0x973cdf
xor eax, eax
ret
mov al, 1
ret
Function at 0x973e00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040882c
xor eax, eax
push ebp
push 0x973eac
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea eax, [ebp - 0x210]
mov edx, dword [ebp - 4]
call fcn.0042323c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x973e96
mov eax, ebx
call fcn.00404e98
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x973ebc
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x973e8f
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x973e8f
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
mov eax, esi
call fcn.00404eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x973eb3
lea eax, [ebp - 4]
call fcn.00408748
ret

Function at 0x973ec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
test dl, dl
je 0x973ed6
add esp, 0xfffffff0
call fcn.00406f54
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0051d310
mov edx, 0x87
mov eax, ebx
call fcn.00510ba4
mov edx, 0x14
mov eax, ebx
call fcn.00510bdc
mov dword [ebx + 0x2f4], 0x3f800000
mov dword [ebx + 0x2c0], 0xff0000
mov byte [ebx + 0x2c8], 0
mov dl, 1
mov eax, dword [0x7260ec]
call fcn.004069b4
mov dword [ebx + 0x2c4], eax
test byte [ebx + 0x1c], 0x10
je 0x973f41
mov eax, dword [ebx + 4]
test byte [eax + 0x1c], 2
jne 0x973f41
mov eax, dword [ebx + 4]
test byte [eax + 0x1c], 1
je 0x973f45
xor eax, eax
jmp 0x973f47
mov al, 1
test al, al
je 0x973f58
lea edx, [ebx + 0x2cc]
mov eax, dword [ebx]
call fcn.004068dc
mov dword [ebx + 0x2d4], 1
mov dword [ebx + 0x2d8], 0x808080
mov dword [ebx + 0x2ec], 0x808080
mov byte [ebx + 0x29b], 1
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x114], 5
ja 0x973fb2
cmp dword [ebp - 0x114], 5
jne 0x973fae
cmp dword [ebp - 0x110], 1
jae 0x973fb2
xor eax, eax
jmp 0x973fb4
mov al, 1
mov byte [ebx + 0x2dc], al
cmp dword [ebp - 0x114], 6
ja 0x973fd9
cmp dword [ebp - 0x114], 6
jne 0x973fd5
cmp dword [ebp - 0x110], 1
jae 0x973fd9
xor eax, eax
jmp 0x973fdb
mov al, 1
mov byte [ebx + 0x2dd], al
mov dl, 1
mov eax, dword [0x4e6d30]
call fcn.004efc38
mov dword [ebx + 0x2e4], eax
mov byte [ebx + 0x2e8], 0
mov byte [ebx + 0x2e9], 0
mov byte [ebx + 0x2ea], 1
mov byte [ebx + 0x2df], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x974026
call fcn.00406fac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9a0514
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040882c
xor eax, eax
push ebp
push 0x9a0571
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0x9a057c
push 0x9a057c
mov eax, dword [ebp - 4]
call fcn.004096e8
push eax
push 0x9a0580
mov eax, ebx
call fcn.0051a434
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9a0578
lea eax, [ebp - 4]
call fcn.00408748
ret
Function at 0x404608
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406af4
test esi, esi
jne 0x404640
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406c30
jmp 0x40465e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040454c
mov edi, eax
test esi, esi
je 0x40465e
cmp dword [ebx], 0
je 0x40465e
dec esi
jmp 0x404647
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405ef4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x576054], 0
je 0x405f55
cmp word [0x576330], 0xd7b2
jne 0x405f1d
cmp dword [0x576338], 0
jbe 0x405f1d
mov eax, 0x57632c
call dword [0x576348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405f80
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x56d034], 0
jne 0x405f71
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x56d038], 0
je 0x406126
mov edx, esi
mov eax, ebx
call dword [0x56d038]
jmp 0x406135
mov eax, 8
call fcn.0040425c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x576055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4060c8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4075a8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4075ea
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40760a
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00406d04
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x408a90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408bf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406af4
cmp si, word [0x56d7d4]
jb 0x408b2a
cmp si, word [0x56d9d4]
ja 0x408b2a
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408b2a
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x56d7d4]
jae 0x408b04
mov edi, ebx
dec edi
jmp 0x408b25
cmp si, word [ebx*8 + 0x56d7d4]
jbe 0x408b14
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408b25
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x56d7d8]
call fcn.004089a0
jmp 0x408b2a
cmp edi, dword [ebp - 0xc]
jae 0x408aee
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408bd9
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408bd9
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406d04
push dword [ebp - 0x164]
push 0x408c14
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406d04
push dword [ebp - 0x168]
push 0x408c24
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406d04
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.004070bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408bfe
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406aec
ret