joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b1aa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5a23
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], edi
mov dword [edi], 0
push 0x10
mov dword [ebp - 0x20], ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100ba448
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edi + 0x18], 7
mov dword [edi + 0x1c], 8
mov dword [edi], 0x3f800000
push dword [edi + 4]
mov byte [ebp - 4], 1
push 0x10
call fcn.1003ad50
mov dword [ebp - 4], 2
cmp esi, ebx
je 0x100b1c64
nop
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.10037760
cmp dword [ebp - 0x14], 0
jne 0x100b1c58
cmp dword [edi + 8], 0xfffffff
je 0x100b1c7a
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
push 0x10
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], 0
call fcn.100ba448
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
lea edx, [eax + 8]
mov eax, dword [esi]
mov dword [ebp - 0x1c], edx
mov dword [edx], eax
mov dword [edx + 4], ecx
mov eax, dword [edi + 8]
inc eax
mov byte [ebp - 4], 4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9750]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9750]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x100b1c3e
mov ecx, edi
call fcn.1003b350
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.10037760
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x100b1c41
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
push ecx
push ebx
mov ecx, edi
call fcn.1003b2f0
mov byte [ebp - 4], 2
add esi, 8
cmp esi, dword [ebp - 0x20]
jne 0x100b1b50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100b8cc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x100b8e1a
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1002dc50
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100b8ded
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x100b8d73
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100b8de3
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100b8dad
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100b8da5
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x100b8de0
cmp edi, edx
je 0x100b8dbd
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x100b8df6
cmp edi, edx
jne 0x100b8db1
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x100b8d22
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100b8de0
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x4010c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.004071f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._birdwp.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00403510
add esp, 4
test eax, eax
jne 0x40113a
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403fcc
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0xfffe
call fcn.00403fe2
mov esi, eax
add esp, 4
test esi, esi
jne 0x401163
lea eax, [esi - 2]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403fcc
mov esp, ebp
pop ebp
ret 0x10
push edi
lea eax, [ebp - 0x20c]
push eax
push str.__s___s
push 0x7fff
push esi
call fcn.00401030
push 0x40
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x44
push 0
push eax
call fcn.004071f0
add esp, 0x20
lea eax, [ebp - 0x260]
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
push eax
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4011e9
push esi
call fcn.00403fdd
add esp, 4
mov eax, 0xfffffffd
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403fcc
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 0x25c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop edi
call fcn.00403fcc
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x690051
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x420af8
mov dword [ebp - 0x5c], 0x6f0068
push edi
mov dword [ebp - 0x58], 0x20006f
mov edx, 0x2d
mov dword [ebp - 0x54], 0x360033
sub esi, eax
mov dword [ebp - 0x50], 0x200030
mov dword [ebp - 0x4c], 0x6f0053
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x44], 0x610077
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x280020
mov dword [ebp - 0x38], 0x650042
mov dword [ebp - 0x34], 0x6a0069
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x290067
mov dword [ebp - 0x28], 0x430020
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x20], 0x610070
mov dword [ebp - 0x1c], 0x79006e
mov dword [ebp - 0x18], 0x4c0020
mov dword [ebp - 0x14], 0x6d0069
mov dword [ebp - 0x10], 0x740069
mov dword [ebp - 0xc], 0x640065
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x402270
movzx ecx, word [esi + eax]
test cx, cx
je 0x402270
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x402252
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403fcc
mov esp, ebp
pop ebp
ret
Function at 0x402a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x420d88
mov dword [ebp - 0x5c], 0x680043
lea esi, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x6e0065
push edi
mov dword [ebp - 0x54], 0x640067
mov edx, 0x2c
mov dword [ebp - 0x50], 0x200075
sub esi, eax
mov dword [ebp - 0x4c], 0x690041
mov dword [ebp - 0x48], 0x680073
mov dword [ebp - 0x44], 0x6e0061
mov dword [ebp - 0x40], 0x200067
mov dword [ebp - 0x3c], 0x66004f
mov dword [ebp - 0x38], 0x690066
mov dword [ebp - 0x34], 0x650063
mov dword [ebp - 0x30], 0x540020
mov dword [ebp - 0x2c], 0x630065
mov dword [ebp - 0x28], 0x6e0068
mov dword [ebp - 0x24], 0x6c006f
mov dword [ebp - 0x20], 0x67006f
mov dword [ebp - 0x1c], 0x200079
mov dword [ebp - 0x18], 0x6f0043
mov dword [ebp - 0x14], 0x2c002e
mov dword [ebp - 0x10], 0x4c0020
mov dword [ebp - 0xc], 0x640074
mov dword [ebp - 8], 0x2e
nop dword [eax]
lea ecx, [edx + 0x7fffffd2]
test ecx, ecx
je 0x402b4e
movzx ecx, word [esi + eax]
test cx, cx
je 0x402b4e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x402b30
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403fcc
mov esp, ebp
pop ebp
ret
Function at 0x406758
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x40677c
xor eax, eax
test eax, eax
je 0x40678e
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40678e
xor ecx, ecx
jmp 0x406791
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x40687d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ee4], 0
push esi
jne 0x4068b4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40688e
mov dword [ecx*4 + 0x422ee0], eax
inc ecx
cmp ecx, 0x100
jl 0x406889
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4068e5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ee0]
xor eax, esi
inc ecx
dec edx
jne 0x4068c7
pop edi
not eax
pop esi
ret 0xc
Function at 0x40f4f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x604470], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x60446c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x604470], edx
cmp eax, 0x26f
jl 0x40f500
mov dword [0x589fe0], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x40f540
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x604474]
mov ebx, dword [eax*4 + 0x604470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x604aa4]
mov dword [eax*4 + 0x604470], edx
cmp eax, 0xe2
jl 0x40f550
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x604474]
mov ebx, dword [eax*4 + 0x604470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6040e4]
mov dword [eax*4 + 0x604470], edx
cmp eax, 0x26e
jl 0x40f5a0
mov edx, dword [0x604470]
mov ecx, dword [0x604e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x604aa0]
mov dword [0x604e2c], eax
mov dword [0x589fe0], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f630
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x589fe0]
add dword [0x589fe0], 1
mov eax, dword [0x603020]
cmp eax, dword [0x589730]
jne 0x40f656
cmp ebx, 0x271
jb 0x40f678
mov eax, dword [0x603020]
call fcn.0040f4f0
not dword [0x603020]
mov eax, dword [0x603020]
mov dword [0x589730], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x40f694
call fcn.0040f540
xor ebx, ebx
mov dword [0x589fe0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x604470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4112c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x589480]
cmp ax, 0xcb
je 0x4113cc
cmp ax, 0xcc
je 0x4113cc
mov edx, dword [0x605070]
test edx, edx
je 0x4112f5
mov eax, dword [0x604f20]
call edx
mov ebx, eax
jmp 0x4112fa
mov ebx, 0x604f24
cmp word [0x604f10], 0
jle 0x411320
mov eax, 0x604ef0
call fcn.00411540
mov eax, ebx
call fcn.00410e40
mov eax, ebx
call fcn.00410ec0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x411342
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x41133d
mov edx, edi
mov eax, ebx
call fcn.00410290
jmp 0x411340
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x411328
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x604f10], 0
jle 0x4113cc
mov edx, 0x604e30
mov eax, ebx
call fcn.004103e0
mov edi, eax
test edi, edi
je 0x41139c
mov eax, dword [0x604ec4]
mov dword [edi + 0xc], eax
cmp dword [0x604ec4], 0
je 0x411390
mov eax, dword [0x604ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x604ec4], eax
nop
sub word [0x604f10], 1
cmp word [0x604f10], 0
sete bl
mov eax, 0x604ef0
call fcn.00411560
test bl, bl
je 0x4113cc
mov eax, 0x604ef0
call fcn.00411530
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413a80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413a60
push ebp
push 0x414f80
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x413baa
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b980
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x413b0f
mov edx, 0x6042f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413b61
call sub.kernel32.dll_GetLastError
call fcn.00404130
lea eax, [ebp - 0x10]
call fcn.0040a240
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a7e0
mov edx, dword [ebp - 0x14]
mov ecx, 0x5a633c
lea eax, [ebp - 0x10]
call fcn.0040a570
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b260
jmp 0x413bf8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x413b7a
cmp eax, ecx
je 0x413b84
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b980
cmp byte [0x5896f0], 0
jne 0x413bf8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bf20
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b2f0
lea esi, [esi]
jmp 0x413bf8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b980
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x413bce
mov eax, 0x6042f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5896f0], 0
jne 0x413bf8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bf20
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b2f0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413a60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4140d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x604260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.004142b0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x604260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004036b0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5894f0], eax
mov ebx, eax
jmp 0x414273
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x414158
cmp byte [ebx], 0
je 0x41427c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x4141d3
mov al, byte [ebx]
cmp al, 1
jb 0x4141c8
sub al, 0x20
jbe 0x414198
sub al, 2
je 0x4141ac
jmp 0x4141c8
mov al, byte [ebp - 0x114]
test al, al
je 0x4141d8
add dword [ebp - 0x110], 1
jmp 0x4141d0
cmp byte [ebx + 1], 0x22
je 0x4141c3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4141d0
add ebx, 1
jmp 0x4141d0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x414188
test dword [ebp - 0x10c], 0xffffffff
je 0x41426c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.004142b0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x604260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x414263
mov al, byte [ebx]
cmp al, 1
jb 0x414258
sub al, 0x20
jbe 0x414228
sub al, 2
je 0x41423c
jmp 0x414258
mov al, byte [ebp - 0x114]
test al, al
je 0x414268
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x414260
cmp byte [ebx + 1], 0x22
je 0x414253
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x414260
add ebx, 1
jmp 0x414260
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x414218
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41415b
mov ebx, dword [ebp - 0x10c]
mov dword [0x604250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x604260
call fcn.004110f0
mov eax, dword [0x604260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fda0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x43fe4a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x43fe66
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x43fe66
sub dx, 0x20
je 0x43fe40
sub dx, 0x80
je 0x43fe40
sub dx, 0x1f62
jb 0x43fe66
sub dx, 1
jbe 0x43fe40
sub dx, 6
je 0x43fe40
sub dx, 0x26
jne 0x43fe66
nop
jmp 0x43fe40
cmp eax, dword [ebp - 0x20]
jg 0x43fde8
lea esi, [esi]
jmp 0x43fe66
cmp dword [ebp - 0x1c], 2
jne 0x43fe5a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x43fe66
mov al, byte [ebp - 0xc]
call fcn.0040b5d0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x43fee4
sub ax, 0x21
je 0x43fef8
sub ax, 0x17
je 0x43ff04
sub ax, 0x222
je 0x43ff10
sub ax, 0x392
je 0x43ff18
sub ax, 1
je 0x43ff20
sub ax, 0x1996
je 0x43ff28
sub ax, 1
je 0x43ff30
sub ax, 6
je 0x43ff38
sub ax, 0xb
je 0x43ff48
sub ax, 0x1b
je 0x43ff40
sub ax, 0x367
je 0x43ff50
jmp 0x43ff58
mov ax, word [ebp - 0x24]
call fcn.0040b670
mov byte [ebp - 0x10], al
jmp 0x43ff60
mov byte [ebp - 0x10], 0x20
jmp 0x43ff60
mov byte [ebp - 0x10], 0x2e
jmp 0x43ff60
mov byte [ebp - 0x10], 0x27
jmp 0x43ff60
mov byte [ebp - 0x10], 0x2c
jmp 0x43ff60
mov byte [ebp - 0x10], 0x27
jmp 0x43ff60
mov byte [ebp - 0x10], 0x20
jmp 0x43ff60
mov byte [ebp - 0x10], 0x20
jmp 0x43ff60
mov byte [ebp - 0x10], 0x20
jmp 0x43ff60
mov byte [ebp - 0x10], 0x20
jmp 0x43ff60
mov byte [ebp - 0x10], 0x2d
jmp 0x43ff60
mov byte [ebp - 0x10], 0x27
jmp 0x43ff60
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x44d970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.0044d960
push ebp
push 0x414f80
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x44da80
mov al, byte [ebp - 0x110]
test al, al
je 0x44da49
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e90
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092d0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a0c0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5b1c30
call fcn.00466b60
mov edx, 0x44d9da
mov ecx, ebp
call fcn.00414e20
jmp 0x44da80
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5b1c30
call fcn.00466b60
mov edx, 0x44da49
mov ecx, ebp
call fcn.00414e20
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x44db44
mov al, byte [ebp - 0x110]
test al, al
je 0x44db0d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e90
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092d0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a0c0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5b1c30
call fcn.00466b60
mov edx, 0x44da9e
mov ecx, ebp
call fcn.00414e20
jmp 0x44db44
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5b1c30
call fcn.00466b60
mov edx, 0x44db0d
mov ecx, ebp
call fcn.00414e20
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.0044cf90
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044d960
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8