joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov eax, 0x447a20
push ebx
push esi
push edi
call fcn.0042ce8c
mov esi, 0x445ce4
lea edi, [ebp - 0x128]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
je 0x4056d8
jne 0x4056d8
lodsb al, byte [esi]
iretd
lea eax, [ebp - 0x128]
push eax
push 0x446832
push str.Software
push SysReAllocStringLen
call fcn.00409fb4
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
add esp, 0x10
lea edx, [ebp - 0x128]
lea eax, [ebp - 4]
call fcn.0043a564
inc dword [ebp - 0xc]
call fcn.0043ab44
mov ebx, eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0043a774
mov word [ebp - 0x18], 0
jmp 0x40574e
push ebx
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x40577b
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x405785
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40578c
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4057ff
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x104]
push ecx
call fcn.0042cd10
add esp, 8
test eax, eax
jne 0x4057ee
push 0
mov eax, dword [ebp - 0x120]
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
lea edx, [ebp - 0x128]
push edx
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4057bc
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409e6c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
lea eax, [ebp - 0x210]
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push 0x100
push eax
push edx
push ecx
lea eax, [ebp - 4]
lea edx, [ebp - 0x110]
push eax
push 0x100
push edx
push 0x44a7fe
call sub.KERNEL32.DLL_GetVolumeInformationA
test ebx, ebx
jne 0x409eb5
mov esi, str.0123456789ABCDEF
cmp ebx, 1
jne 0x409ebf
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
cmp ebx, 2
jne 0x409ec9
mov esi, str.abcdefghijklmnopqrstuvwxyz
test edi, edi
jne 0x409ed4
mov edi, dword [ebp - 4]
and edi, 7
inc edi
push esi
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [ebp + 8]
mov ebx, eax
cmp edi, ecx
jle 0x409f0c
lea eax, [ecx + 0xd]
imul dword [ebp - 4]
add eax, dword [ebp + 0x10]
push ecx
mov ecx, 0x11
xor edx, edx
div ecx
pop ecx
xor edx, edx
div dword [ebp - 0x10]
mov al, byte [esi + edx]
mov byte [ebx], al
inc ecx
inc ebx
cmp edi, ecx
jg 0x409ee8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a040
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
push 0
push 0x8000000
push 3
push 0
push 3
push 0xc0000000
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
test ebx, ebx
je 0x40a0ba
test esi, esi
je 0x40a0ba
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
push ecx
push ebx
call sub.KERNEL32.DLL_GetFileTime
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
push ecx
push esi
call sub.KERNEL32.DLL_SetFileTime
push ebx
call sub.KERNEL32.DLL_CloseHandle
push esi
call sub.KERNEL32.DLL_CloseHandle
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a0c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push esi
push edi
mov esi, 0x449f98
lea edi, [ebp - 0x100]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
push 0x100
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push eax
call fcn.0040a10f
inc esi
add esp, 0xfd9d4902
pop edx
aad 0x50
invalid

Function at 0x40a15c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, 0x44a098
lea edi, [ebp - 0x100]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
push 0x100
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x100
push 0
push ebx
call fcn.0042ca3c
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x100]
push ecx
push str._s_s
push ebx
call fcn.004301a8
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a1c0
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
mov ecx, 0x20
push ebx
push esi
push edi
lea edi, [ebp - 0x80]
mov ebx, dword [ebp + 8]
mov esi, 0x44a198
rep movsd dword es:[edi], dword [esi]
push ebx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x40a1ef
mov al, 1
jmp 0x40a305
lea edi, [ebp - 0x184]
mov esi, 0x44a218
mov ecx, 0x41
lea eax, [ebp - 0x184]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x80]
push edx
push 0
push 0x44a8c1
lea ecx, [ebp - 0x184]
push ecx
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x40a234
xor eax, eax
jmp 0x40a305
mov dl, byte [ebp - 0x80]
cmp dl, byte [ebx]
jne 0x40a248
movsx ecx, byte [ebp - 0x7f]
cmp ecx, 0x3a
je 0x40a2da
lea eax, [ebp - 0x184]
push eax
call sub.KERNEL32.DLL_lstrlenA
push eax
push 0
lea edx, [ebp - 0x184]
push edx
call fcn.0042ca3c
add esp, 0xc
lea ecx, [ebp - 0x184]
push 2
push ebx
push ecx
call fcn.0042c9cc
add esp, 0xc
push str._recycled
lea eax, [ebp - 0x184]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_lstrlenA
push eax
push 0
lea ecx, [ebp - 0x80]
push ecx
call fcn.0042ca3c
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
push 0x44a8ce
lea edx, [ebp - 0x184]
push edx
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x40a2da
lea ecx, [ebp - 0x184]
push ecx
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.1.tmp
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_lstrcatA
push 1
lea ecx, [ebp - 0x80]
push ecx
push ebx
call sub.KERNEL32.DLL_MoveFileExA
test eax, eax
je 0x40a2ee
mov al, 1
jmp 0x40a305
push 4
push 0
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_MoveFileExA
test eax, eax
je 0x40a303
mov al, 1
jmp 0x40a305
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a484
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
lea edx, [ebx + 5]
mov ecx, dword [ebp + 0x10]
sub ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [0x44a390]
mov dword [ebp - 0x14], eax
mov eax, dword [0x44a394]
mov dword [ebp - 0x10], eax
mov ax, word [0x44a398]
mov word [ebp - 0xc], ax
call sub.KERNEL32.DLL_GetCurrentProcess
mov dword [ebp - 8], eax
lea edx, [esi + 0xf]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0042c3fc
pop ecx
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push 0x40
mov edx, dword [ebp - 0x1c]
push edx
push edi
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_VirtualProtectEx
mov edx, ebx
mov byte [ebp - 0x1d], 0
mov al, byte [edx]
cmp al, 0xe9
je 0x40a514
cmp al, 0xff
jne 0x40a645
push esi
push edi
lea edi, [ebp - 0x12c]
mov esi, 0x44a39a
mov ecx, 0x40
lea eax, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [ebp - 0x22c]
mov esi, 0x44a49a
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040a15c
add esp, 8
xor eax, eax
or ecx, 0xffffffff
push esi
push edi
lea edi, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x22c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x22c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push str.1.dll
push eax
call fcn.0042cae0
add esp, 8
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0040a3c0
add esp, 8
push eax
call 0x40a5b2
cmpsd dword [esi], dword es:[edi]
pop eax
add eax, 0x22
jmp eax
push esi
push edx
push edi
call fcn.0042c9cc
add esp, 0xc
mov eax, esi
mov ecx, edi
add ecx, eax
mov edx, eax
add edx, ebx
add ecx, 5
sub edx, ecx
mov byte [edi + esi], 0xe9
mov dword [edi + esi + 1], edx
lea edx, [ebp - 0x18]
push edx
add eax, 0xa
push 0x40
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtectEx
cmp byte [ebp - 0x1d], 0
je 0x40a690
push 0xa
lea ecx, [ebp - 0x14]
push ecx
push ebx
call fcn.0042c9cc
add esp, 0xc
mov byte [ebx], 0xe9
lea eax, [ebx + 1]
mov edx, dword [ebp - 4]
mov dword [eax], edx
push 8
call fcn.0042bc18
pop ecx
mov dword [eax], ebx
mov dword [eax + 4], esi
lea ecx, [ebp - 0x2c]
push ecx
push 0
push eax
push 0x40a30c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0xa
call sub.KERNEL32.DLL_Sleep
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a460
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x41a499
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004299e0
jmp 0x41a4a2
mov eax, ebx
mov edx, esi
call fcn.00429944
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41a4ac
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x41a4cd
mov al, byte [esp]
jmp 0x41a4cf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41ab54
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x41a9cc
mov eax, dword [0x44fbf4]
cmp byte [eax], 0
je 0x41abc1
mov eax, dword [0x44fbf8]
call fcn.0042863c
call fcn.00428230
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00417d30
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x41ac08
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x41abf7
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x44fab4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x44fc38]
call fcn.0042afd0
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret

Function at 0x41b8c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x41b924
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00429b58
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00417854
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b92b
lea eax, [ebp - 0xc]
call fcn.004298f0
ret
Function at 0x428c48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x44b96c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x428ce0
push reloc.OLEAUT32.DLL_SysReAllocString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x428cc0
xor eax, eax
push ebp
push 0x428cb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x428cfc
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428cc0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x44b96c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x44b96c], ax
mov esp, ebp
pop ebp
ret

Function at 0x429774
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4501c0], 0
je 0x4297d5
cmp word [0x450394], 0xd7b2
jne 0x42979d
cmp dword [0x45039c], 0
jbe 0x42979d
mov eax, 0x450390
call dword [0x4503ac]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4297fc
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x44b97c], 0
jne 0x4297f1
push 0
push 0x44b9d4
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x42b1c4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x42b3f4
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x42b247
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x42b3f4
push reloc.OLEAUT32.DLL_SysReAllocString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x42b247
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x42b410
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x42b2d0
xor eax, eax
push ebp
push 0x42b2c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0042b00c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x42b2ae
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x42b430
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x42b2ae
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b2d0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x42b3ea
cmp byte [ebp - 0xd], 0
jne 0x42b317
cmp byte [ebp - 0x12], 0
je 0x42b3ea
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x42b330
dec ebx
cmp byte [ebx], 0x2e
je 0x42b33f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x42b32f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x42b3ea
inc ebx
cmp byte [ebp - 0x12], 0
je 0x42b37c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x42b3ea
cmp byte [ebp - 0xd], 0
je 0x42b3ea
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x42b3ea
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bb30
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x450734], 1
jae 0x42bbb6
mov byte [0x44b968], 2
mov dword [0x450184], 0x43b2b2
mov dword [0x450188], 0x43b2c4
mov byte [0x4501c2], 2
mov dword [0x450170], 0x42a7fc
call fcn.00428c18
test al, al
je 0x42bb73
call fcn.00428c48
call fcn.00428d0c
mov word [0x4501c8], 0xd7b0
mov word [0x450394], 0xd7b0
mov word [0x450560], 0xd7b0
call fcn.0042a6d4
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4501b4], eax
call fcn.00426d1c
mov dword [0x4501b0], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4501a8], eax
ret

Function at 0x42dd94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x42ddb0
call fcn.0042f23c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x42ddcc
test bl, 1
je 0x42ddcc
call fcn.00435690
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x42dfb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0042edd8
test byte [ebp + 0xd], 0xc0
jne 0x42dfd4
mov eax, dword [0x44c888]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x42dfe1
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x42e00e
je 0x42e020
sub ecx, 0x100
je 0x42e02e
sub ecx, 0x100
je 0x42e035
sub ecx, 0x100
je 0x42e027
jmp 0x42e03c
sub ecx, 0x600
je 0x42e035
sub ecx, 0x100
je 0x42e020
jmp 0x42e03c
mov edi, 1
jmp 0x42e041
mov edi, 2
jmp 0x42e041
mov edi, 4
jmp 0x42e041
mov edi, 5
jmp 0x42e041
mov edi, 3
test byte [ebp + 0xd], 1
je 0x42e068
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x44c300]
test al, 0x80
je 0x42e061
mov ebx, 0x80
jmp 0x42e07a
mov ebx, 1
jmp 0x42e07a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x42e07a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x42e08c
je 0x42e095
dec eax
je 0x42e09e
jmp 0x42e0a7
mov dword [ebp - 4], SysStringLen
jmp 0x42e0b6
mov dword [ebp - 4], 0x40000000
jmp 0x42e0b6
mov dword [ebp - 4], 0xc0000000
jmp 0x42e0b6
push 1
call fcn.0042f1d0
pop ecx
mov ebx, eax
jmp 0x42e1a6
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x42e0d2
sub eax, 0x10
je 0x42e0d9
sub eax, 0x10
je 0x42e0e2
sub eax, 0x10
je 0x42e0eb
jmp 0x42e0eb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x42e0f2
mov dword [ebp - 8], 1
jmp 0x42e0f2
mov dword [ebp - 8], 2
jmp 0x42e0f2
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x42e15f
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x42e154
test byte [ebp + 0xd], 1
je 0x42e14f
mov ebx, 0x50
jmp 0x42e154
mov ebx, 2
push ebx
call fcn.0042f1d0
pop ecx
mov ebx, eax
jmp 0x42e1a6
mov edi, esi
push edi
call fcn.0042df14
pop ecx
test eax, eax
je 0x42e173
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x42e17f
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0042eef8
add esp, 8
mov ebx, eax
inc eax
jne 0x42e1a6
push 4
call fcn.0042f1d0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0042ee0c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431ba0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
mov ecx, 0x10
push ebx
push esi
push edi
xor edi, edi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], eax
push esi
push edi
lea edi, [ebp - 0x64]
mov esi, str.none
mov ebx, 1
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x44d4e0]
mov dword [ebp - 0x14], eax
push esi
call fcn.00432fe8
pop ecx
jmp 0x431c5d

Function at 0x432594
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.0042cae0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0042cb70
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0042cb70
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x44d5a9
lea ecx, [ebp - 0x200]
push ecx
call fcn.0042cae0
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0042cb70
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00433784
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4326a5
push esi
call fcn.0042cb70
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0042cb70
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0042c3fc
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x43267c
xor eax, eax
jmp 0x43272c
push esi
call fcn.0042cb70
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0042cb70
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0042ca3c
add esp, 0xc
jmp 0x4326e5
mov edi, dword [ebx + 0x24]
push edi
call fcn.0042cb70
pop ecx
push eax
push esi
call fcn.0042cb70
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0042cb70
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0042c41c
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4326e5
xor eax, eax
jmp 0x43272c
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0042cae0
add esp, 8
push 0x44d5ab
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0042cae0
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.0042cae0
add esp, 8
push 0x44d5ad
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0042cae0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret