joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017fd
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
xor edi, edi
mov word [ebp - 0xc34], ax
lea eax, [ebp - 0xc32]
mov ebx, ecx
push edi
push eax
call fcn.00404f10
xor eax, eax
push esi
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push edi
push eax
call fcn.00404f10
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.00404f10
xor eax, eax
push esi
mov word [ebp - 0xa2c], ax
lea eax, [ebp - 0xa2a]
push edi
push eax
call fcn.00404f10
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.00404f10
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00404f10
add esp, 0x48
lea eax, [ebp - 0xc34]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004056a3
lea eax, [ebp - 0x414]
push eax
call fcn.004056c3
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.004056dc
add esp, 0x14
test eax, eax
je 0x401a2f
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.004056a3
lea eax, [ebp - 0x824]
push str.Local
push eax
call fcn.00405674
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.004056a3
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.00405674
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.004056a3
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.00405674
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x401a2f
cmp dword [ebp - 0xc38], edi
je 0x401a2f
test ecx, ecx
je 0x401a2f
push str.WnPicView.users
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push 0x4172f0
push eax
call fcn.00405a40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401a05
lea eax, [ebp - 0x20c]
push eax
call fcn.004032e3
pop ecx
cmp word [ebp - 0x20c], di
je 0x401a1d
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00402f3a
jmp 0x401a36
mov ecx, ebx
call fcn.0040138c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x401a47
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x34]
cmp dword [eax + 0x14], 8
jb 0x401a68
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.00405a40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401aa0
lea eax, [ebp - 0x20c]
push eax
call fcn.004032e3
pop ecx
lea eax, [ebp - 0x20c]
push str.Config.ini
push eax
call fcn.00405674
cmp word [ebp - 0x20c], 0
pop ecx
pop ecx
jne 0x401ac1
xor eax, eax
jmp 0x401ace
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x4c]
call fcn.00402f3a
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x40222b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
mov ebx, ecx
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00404f10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov edi, eax
mov dword [ebp - 0x438], esi
lea eax, [ebp - 0x434]
push esi
push eax
call fcn.00404f10
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4022fe
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4022c3
cmp dword [ebp - 0x430], edi
je 0x4022c9
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4022ae
jmp 0x4022de
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004056a3
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call fcn.004059a4
pop ecx
push eax
lea ecx, [ebx + 0x10c]
call fcn.00402f13
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x40230f
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
xor ebx, ebx
lea eax, [ebp - 0x412]
mov esi, ecx
push ebx
push eax
call fcn.00404f10
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00404f10
add esp, 0x18
lea eax, [ebp - 0x414]
push ebx
push 0x2b
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x414]
push 0x417320
push eax
call fcn.00405674
mov edi, 0x417324
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00405674
lea eax, [ebp - 0x414]
push 0x417320
push eax
call fcn.00405674
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00405674
lea eax, [ebp - 0x414]
push str..ini
push eax
call fcn.00405674
add esp, 0x28
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x417220
push str.CfgRootPath
push str.Globals
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
test eax, eax
jle 0x402442
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x402442
cmp word [ebp - 0x20c], bx
je 0x402429
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x34]
call fcn.00402f3a
mov byte [esi + 0x18], 1
jmp 0x40256e
push 0x104
lea eax, [ebp - 0x824]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x824]
push 0x5c
push eax
call fcn.004056dc
xor ecx, ecx
push 0x206
push ebx
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.00404f10
push str.WnPicInfo.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call fcn.00405a40
add esp, 0x24
lea eax, [ebp - 0x61c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x417220
push str.CfgRootPath
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
test eax, eax
jle 0x4024ee
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x402411
lea eax, [esi + 0x94]
cmp dword [eax + 0x14], 8
jb 0x4024fc
mov eax, dword [eax]
push str.WnPicInfo.ini
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call fcn.00405a40
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x417220
push str.CfgRootPath
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
test eax, eax
jle 0x402560
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x402411
push str.CBaseConfigure::InitSoftCfgRootPath__.....not_find_error
call fcn.0040336d
pop ecx
mov byte [esi + 0x18], bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x40257f
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
xor ebx, ebx
lea eax, [ebp - 0x412]
mov esi, ecx
push ebx
push eax
call fcn.00404f10
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00404f10
add esp, 0x18
lea eax, [ebp - 0x414]
push ebx
push 0x2b
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x414]
push 0x417320
push eax
call fcn.00405674
mov edi, 0x417324
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00405674
lea eax, [ebp - 0x414]
push 0x417320
push eax
call fcn.00405674
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00405674
lea eax, [ebp - 0x414]
push str..ini
push eax
call fcn.00405674
add esp, 0x28
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x417220
push str.CfgUserPath
push str.Globals
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
test eax, eax
jle 0x4026b2
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x4026b2
cmp word [ebp - 0x20c], bx
je 0x402699
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00402f3a
mov byte [esi + 0x19], 1
jmp 0x402761
push 0x104
lea eax, [ebp - 0x824]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x824]
push 0x5c
push eax
call fcn.004056dc
xor ecx, ecx
push 0x206
push ebx
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.00404f10
push str.WnPicInfo.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call fcn.00405a40
add esp, 0x24
lea eax, [ebp - 0x61c]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x417220
push str.CfgUserPath
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
test eax, eax
jle 0x40275e
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x402681
mov byte [esi + 0x19], bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x402772
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x34]
cmp dword [eax + 0x14], 8
jb 0x402793
mov eax, dword [eax]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.00405a40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4027cb
lea eax, [ebp - 0x20c]
push eax
call fcn.004032e3
pop ecx
cmp word [ebp - 0x20c], 0
jne 0x4027d9
xor eax, eax
jmp 0x4027e6
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xf4]
call fcn.00402f3a
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00405ae3
mov esp, ebp
pop ebp
ret

Function at 0x402808
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push 0x30
mov ebx, ecx
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + 8], eax
xor ecx, ebp
mov eax, dword [ebp - 8]
pop edi
sub eax, edx
mov dword [ebx + 4], edx
pop esi
mov dword [ebx + 0xc], eax
pop ebx
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x40319f
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x11c], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4031de
xor al, al
jmp 0x4032d3
push ebx
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
mov eax, ebx
push 0x3c
cmove eax, dword [ebp - 0x114]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x160]
push ebx
push eax
call fcn.00404f10
add esp, 0xc
mov dword [ebp - 0x160], 0x3c
mov dword [ebp - 0x15c], 0x40
mov dword [ebp - 0x158], ebx
push 5
pop edx
test edi, edi
je 0x403256
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x124], edx
cmovg eax, edi
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x150]
test esi, esi
mov ecx, dword [ebp - 0x120]
cmovne eax, esi
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x150], eax
test ecx, ecx
mov eax, dword [ebp - 0x14c]
cmovne eax, ecx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x14c], eax
xor eax, eax
cmp byte [ebp + 0x18], al
cmovne eax, edx
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4032d0
cmp byte [ebp + 0x1c], bl
je 0x4032d0
push 0xffffffffffffffff
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x11c]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405ae3
mov esp, ebp
pop ebp
ret

Function at 0x4032e3
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004056c3
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404535
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.004056a3
mov eax, dword [ebp - 4]
add esp, 0x10
xor edi, edi
mov bl, 1
test eax, eax
js 0x40335c
push 0x5c
pop ecx
cmp word [esi + edi*2], cx
jne 0x403353
xor eax, eax
push esi
mov word [esi + edi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403349
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40335a
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + edi*2], cx
inc edi
cmp edi, eax
jle 0x403326
jmp 0x40335c
xor bl, bl
push esi
call fcn.00406ad8
pop ecx
pop edi
pop esi
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40336d
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
xor edi, edi
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.00404f10
lea eax, [ebp - 0x414]
push str.C:log_
push eax
call fcn.004056a3
xor eax, eax
push 0x3e6
mov word [ebp - 0xc0c], ax
lea eax, [ebp - 0xc0a]
push edi
push eax
call fcn.00404f10
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push str._sgswb.log
push eax
call fcn.00405a40
xor eax, eax
push esi
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push edi
push eax
call fcn.00404f10
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00404f10
add esp, 0x44
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004056dc
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x61c]
push eax
call esi
test eax, eax
je 0x40355e
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004056c3
lea eax, [ebp + eax*2 - 0x20a]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.004056a3
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push str._s_s.txt
push eax
call fcn.00405a40
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc0c]
push 0x1f3
push eax
call fcn.00406872
xor eax, eax
add esp, 0x2c
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x61c]
push eax
call esi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x61c]
push 0x4177f8
push eax
cmovne edi, ebx
call fcn.004069f9
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40355d
test edi, edi
jne 0x403503
push esi
push 2
lea eax, [ebp - 0xc14]
mov dword [ebp - 0xc14], 0xfeff
push ebx
push eax
call fcn.00406d19
add esp, 0x10
lea eax, [ebp - 0xc0c]
push eax
call fcn.004056c3
push esi
add eax, eax
push eax
lea eax, [ebp - 0xc0c]
push ebx
push eax
call fcn.00406d19
push esi
push 2
lea eax, [ebp - 0xc10]
mov dword [ebp - 0xc10], 0xd
push ebx
push eax
call fcn.00406d19
push esi
push 2
lea eax, [ebp - 0xc10]
mov dword [ebp - 0xc10], 0xa
push ebx
push eax
call fcn.00406d19
push esi
call fcn.00406b49
add esp, 0x38
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x410066
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004082f0
mov dword [ebp - 0x14], eax
cmp dword [0x4215f0], esi
jne 0x410159
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4100e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410239
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x410239
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410239
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4215f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4215f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4215f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x421600], eax
test eax, eax
je 0x410156
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4215fc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41017e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410171
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x410193
push 4
pop eax
jmp 0x41023b
cmp dword [ebp - 0x14], esi
je 0x410193
push dword [0x4215f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410178
mov eax, dword [0x4215fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4101f1
cmp dword [0x421600], edi
je 0x4101f1
push eax
call ebx
push dword [0x421600]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4101f1
test eax, eax
je 0x4101f1
call ecx
test eax, eax
je 0x4101e6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4101e6
test byte [ebp - 8], 1
jne 0x4101f1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x410221
mov eax, dword [0x4215f4]
cmp eax, edi
je 0x41021e
push eax
call ebx
test eax, eax
je 0x41021e
call eax
mov esi, eax
test esi, esi
je 0x41021e
mov eax, dword [0x4215f8]
cmp eax, edi
je 0x41021e
push eax
call ebx
test eax, eax
je 0x41021e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4215f0]
call ebx
test eax, eax
je 0x410239
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41023b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405ae3
mov esp, ebp
pop ebp
ret
Function at 0x405968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b14
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059d5
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x40aa24
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aa5d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f00
jmp 0x40aa66
mov eax, ebx
mov edx, esi
call fcn.00403e64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aa70
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aa91
mov al, byte [esp]
jmp 0x40aa93
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b118
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40af90
mov eax, dword [0x451088]
cmp byte [eax], 0
je 0x40b194
mov eax, dword [0x450eac]
call fcn.00402980
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408298
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b1dc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b1ca
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x450e5c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x452664]
call fcn.00404e7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret