joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403084
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, 0x9c
push edi
xor ebx, ebx
push esi
lea eax, [ebp - 0xb4]
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x18]
mov dword [ebp - 0xb4], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.win32
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0xb4]
push eax
call edi
test eax, eax
jne 0x4030e8
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0x94
push eax
call edi
cmp dword [ebp - 0xa4], 2
jne 0x403165
cmp dword [ebp - 0xb0], 4
jne 0x403104
push str.winnt
jmp 0x40319c
cmp dword [ebp - 0xb0], 6
jne 0x40312d
cmp dword [ebp - 0xac], ebx
jne 0x4031a2
cmp byte [ebp - 0x1a], 1
jne 0x403126
push str.winvista
jmp 0x40319c
push str.winlong
jmp 0x40319c
cmp dword [ebp - 0xb0], 5
jne 0x4031a2
cmp dword [ebp - 0xac], ebx
jne 0x403145
push str.win2000
jmp 0x40319c
cmp dword [ebp - 0xac], 1
jne 0x403155
push str.winxp
jmp 0x40319c
cmp dword [ebp - 0xac], 2
jne 0x4031a2
push str.win2003
jmp 0x40319c
cmp dword [ebp - 0xa4], 1
jne 0x4031a2
cmp dword [ebp - 0xb0], 4
jne 0x403197
cmp dword [ebp - 0xac], 0xa
jne 0x403187
push str.win98
jmp 0x40319c
cmp dword [ebp - 0xac], 0x5a
jne 0x403197
push str.winme
jmp 0x40319c
push str.win95
lea eax, [ebp - 0x18]
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
push eax
push 0x4060f0
push dword [ebp + 8]
call edi
lea eax, [ebp - 0xa0]
add esp, 0xc
test eax, eax
je 0x403206
lea eax, [ebp - 0xa0]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x403206
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa0]
push str.Service_Pack__d
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [ebp - 4], ebx
jbe 0x403206
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
push str._s_sp_d
push dword [ebp + 8]
call edi
add esp, 0x10
mov word [ebp - 0xd8], bx
mov ebx, dword [ebp + 0x10]
push str.Unknown
push ebx
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403244
push str.GetNativeSystemInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403244
lea ecx, [ebp - 0xd8]
push ecx
call eax
jmp 0x403251
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test edi, edi
je 0x40325c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [ebp - 0xd8]
test eax, eax
je 0x40327f
cmp eax, 6
je 0x403278
cmp eax, 9
jne 0x403287
push str.amd64
jmp 0x403284
push str.ia64
jmp 0x403284
push str.i586
push ebx
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e94
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_time]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_localtime]
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x40775c
push eax
call sub.MSVCRT.dll_strcpy
xor ebx, ebx
add esp, 0x10
cmp esi, ebx
je 0x403ef2
push esi
call dword [sym.imp.MSVCRT.dll_asctime]
cmp eax, ebx
pop ecx
je 0x403ef2
push eax
lea eax, [ebp - 0x20c]
push str._n_s::
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov edi, 0x104
lea eax, [ebp - 0x10c]
push edi
push eax
push str.TMPDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x403f24
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x403f32
lea eax, [ebp - 0x10c]
push 0x4061d4
push eax
call esi
lea eax, [ebp - 0x10c]
push str.jusched.log
push eax
call esi
push ebx
push 0x80
push 4
push ebx
push 2
lea eax, [ebp - 0x10c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403fae
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strlen
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
lea eax, [ebp - 4]
push ebx
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push dword [ebp + 8]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403fb3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4051f8
push 0x404270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], 0x94
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 2
jne 0x404052
cmp dword [ebp - 0xac], 5
jb 0x404052
mov dword [ebp - 4], esi
push str.Crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xb4], eax
cmp eax, esi
je 0x404049
push str.CryptProtectData
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404049
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
call fcn.00404064
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404142
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404179
push str.EnableAutoUpdateCheck
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40417b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0x80000001
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x64
mov dword [ebp - 0xc], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40421a
call fcn.00403fb3
test eax, eax
je 0x4041e1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040407a
add esp, 0x10
jmp 0x4041f6
lea eax, [ebp - 8]
push 4
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0xc]
lea eax, [ebp - 0x210]
push eax
push 3
push esi
push str.EnableAutoUpdateCheck
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x427f09
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006240
push 0x10005460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
mov eax, 0x10a8
call fcn.004290b0
push ebx
push esi
push edi
push 1
pop esi
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
call dword [0x1000608c]
test eax, eax
je 0x4289f6
push dword [ebp + 8]
call fcn.00427e0e
pop ecx
test eax, eax
je 0x4289f6
cmp dword [0x100083d0], 0
jne 0x427fc7
push 0x14
push 0x100083b8
push 0x14
push 0x100083a4
call fcn.00427c05
push 0x20
push 0x10008384
call fcn.00425b6e
lea eax, [ebp - 0xa1c]
push eax
call fcn.00426a68
add esp, 0x1c
test eax, eax
je 0x427fb1
push 0x1e
lea eax, [ebp - 0xa1c]
push eax
push 0x10008364
call dword [0x100060e8]
add esp, 0xc
jmp 0x427fc1
push 0x10007e20
push 0x10008364
call dword [0x100060a4]
mov dword [0x100083d0], esi
push 0x100083d8
lea eax, [ebp - 0xd44]
push eax
mov esi, dword [0x100060a4]
call esi
push 0x10007e24
lea eax, [ebp - 0x81c]
push eax
call esi
push 0x10007e58
push 0x10007e5c
lea eax, [ebp - 0x81c]
push eax
call fcn.00427ec5
add esp, 0xc
push dword [ebp + 8]
call dword [0x1000608c]
mov dword [ebp - 0xc44], eax
push 0x10007e68
push dword [ebp + 8]
mov ebx, dword [0x100060c4]
call ebx
mov esi, eax
push 0x10007e6c
push 0x10007e7c
lea eax, [ebp - 0xd5c]
push eax
mov edi, dword [0x10006110]
call edi
add esp, 0x14
test esi, esi
je 0x428061
mov eax, esi
sub eax, dword [ebp + 8]
mov dword [ebp - 0xc44], eax
inc esi
push esi
push 0x10007e80
lea eax, [ebp - 0xd5c]
push eax
call edi
add esp, 0xc
push 0x10007e84
lea eax, [ebp - 0xd5c]
movsb byte es:[edi], byte [esi]
invalid
invalid
call dword [eax - 0x75]
xor eax, 0x10006048
mov eax, esi

Function at 0x10c1328
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x10c1363
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x10c1340
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x10c137f
dec esi
je 0x10c1378
dec esi
jne 0x10c1384
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x1262660
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x126269b
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1262678
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x12626b7
dec esi
je 0x12626b0
dec esi
jne 0x12626bc
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x402f10
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x403488
call fcn.0040323c
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x4043a0
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x402d98
cmp eax, esi
jne 0x402d8b
xor esi, esi
inc esi
mov edi, esi
jmp 0x402d9b
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x402d6f
xor esi, esi
inc esi
cmp dword [0x4043a4], esi
jne 0x402dad
push 0x1f
call fcn.00541000
pop ecx
jmp 0x402de7
cmp dword [0x4043a4], ebx
jne 0x402de1
mov dword [0x4043a4], esi
push 0x4011a8
push 0x40119c
call fcn.00402ec2
pop ecx
pop ecx
test eax, eax
je 0x402de7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402ebc
mov dword [0x404034], esi
cmp dword [0x4043a4], esi
jne 0x402e0a
push 0x401198
push 0x401190
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4043a4], 2
test edi, edi
jne 0x402e17
xor eax, eax
mov ecx, 0x4043a0
xchg dword [ecx], eax
cmp dword [0x4043a8], 0
je 0x402e43
push 0x4043a8
call fcn.00403090
pop ecx
test eax, eax
je 0x402e43
push ebx
push 2
push ebx
mov esi, dword [0x4043a8]
mov ecx, esi
call dword [0x40515c]
call esi
push dword [0x404040]
push dword [0x40403c]
push dword [0x404038]
call fcn.00401a43
add esp, 0xc
mov dword [0x404030], eax
cmp dword [0x404048], 0
jne 0x402ea1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x404034], 0
jne 0x402eb5
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404030]
mov dword [ebp - 4], 0xfffffffe
call fcn.00403284
ret
call fcn.00403183
jmp 0x402d53

Function at 0x402f94
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4034a8
call fcn.0040340c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x402ff4
cmp eax, 0xffffffff
je 0x402ff4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x402fed
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x402fed
cmp edx, 0x10000000
jae 0x402fed
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x402fea
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00403451
ret 4

Function at 0x403040
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40307e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x403076
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x403080
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x403066
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402d84
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402dc1
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402de1
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404b44
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402fc0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x403019
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402e5c
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402e5c
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x403003
inc ebx
jmp 0x402fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403020
lea eax, [ebp - 8]
call fcn.004048d4
ret

Function at 0x403028
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004048d4
test esi, esi
jne 0x40305f
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004049c4
jmp 0x403080
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402e5c
mov dword [esp], eax
test esi, esi
je 0x403080
cmp dword [ebx], 0
je 0x403080
dec esi
jmp 0x403067
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x570020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403888
xor eax, eax
push ebp
push 0x403881
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038c4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403888
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x570020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x570020], ax
mov esp, ebp
pop ebp
ret
Function at 0x4046cc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x57804c], 0
je 0x40472d
cmp word [0x578220], 0xd7b2
jne 0x4046f5
cmp dword [0x578228], 0
jbe 0x4046f5
mov eax, 0x57821c
call dword [0x578238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x57006c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404754
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x570030], 0
jne 0x404749
push 0
push 0x570064
push 0x57006c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404888
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402b84
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x57804d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404850
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406ddc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406e42
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404b44
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004033c8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406e2c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e49
lea eax, [ebp - 0x10]
call fcn.004048d4
ret

Function at 0x40a03c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404db0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a055
test al, 0x10
jne 0x40a059
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a1d8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404db0
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40a1fa
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40d540
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d579
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004049c4
jmp 0x40d582
mov eax, ebx
mov edx, esi
call fcn.00404928
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d58c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40d5ad
mov al, byte [esp]
jmp 0x40d5af
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40e5d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e6a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040496c
lea eax, [ebp - 8]
call fcn.00404e00
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404db0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40e690
mov eax, ebx
call fcn.00402b84
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40e689
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404db0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40e673
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40e6b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e673
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e690
mov eax, dword [ebp - 0x10]
call fcn.00402bb4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e6ad
lea eax, [ebp - 8]
call fcn.004048d4
ret

Function at 0x40ed90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40edf4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b44
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409bf0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40edfb
lea eax, [ebp - 0xc]
call fcn.004048d4
ret

Function at 0x40f61c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov eax, dword [0x5770a0]
cmp dword [eax], 0
je 0x40f652
push 0xa
push 0x40f6a8
mov eax, dword [0x5770a0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x5770a0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
jmp 0x40f69e
xor eax, eax
mov dword [esp], eax
mov eax, dword [0x57765c]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x40f69e
mov ebx, dword [esp + 4]
push 0xa
push 0x40f6a8
mov esi, dword [ebx + 4]
push esi
call sub.kernel32.dll_FindResourceA
push eax
push esi
call sub.kernel32.dll_LoadResource
mov dword [esp], eax
cmp dword [esp], 0
jne 0x40f69e
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x40f669
mov eax, dword [esp]
pop ecx
pop edx
pop esi
pop ebx
ret