joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4028c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x479dab
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x49c550]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
push esi
push edi
mov eax, dword [0x49c550]
xor eax, esp
push eax
lea eax, [esp + 0x818]
mov dword fs:[0], eax
mov edi, dword [esp + 0x828]
push 0x7fe
lea eax, [esp + 0x1a]
push 0
push eax
mov word [esp + 0x20], 0
call fcn.004447d0
mov edx, dword [esp + 0x838]
lea ecx, [esp + 0x83c]
push ecx
push edx
lea eax, [esp + 0x28]
push 0x800
push eax
call fcn.00444bfa
lea eax, [esp + 0x30]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402942
sub eax, edx
sar eax, 1
mov ebx, eax
je 0x402a77
call fcn.00428efe
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402973
push 0x80004005
call fcn.004014c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
xor esi, esi
test ebx, ebx
mov dword [esp + 0x820], 0
jle 0x4029d7
movzx eax, word [esp + esi*2 + 0x14]
cmp ax, 0xa
je 0x4029b3
push eax
lea ecx, [esp + 0x14]
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0x40
jl 0x4029d0
mov eax, dword [edi + 0x80]
lea edx, [esp + 0x10]
lea ecx, [edi + 0x78]
push edx
push eax
call fcn.0042ac7e
lea ecx, [esp + 0x10]
call fcn.004022b0
add esi, 1
cmp esi, ebx
jl 0x402994
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
je 0x4029f5
mov eax, dword [edi + 0x80]
lea ecx, [edi + 0x78]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.0042ac7e
xor esi, esi
cmp dword [edi + 0x80], esi
jle 0x402a30
nop
test esi, esi
jl 0x402a9e
cmp esi, dword [edi + 0x80]
jge 0x402a9e
mov eax, dword [edi + 0x7c]
lea eax, [eax + esi*4]
mov eax, dword [eax]
push eax
call fcn.00414070
add esi, 1
add esp, 4
cmp esi, dword [edi + 0x80]
jl 0x402a00
push edi
call fcn.004020c0
add esp, 4
push 5
mov ecx, edi
call fcn.004223a2
mov ecx, dword [edi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x820], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402a77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x818]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00443fd7
add esp, 0x814
ret
jmp fcn.00428e24
Function at 0x402b90
Capabilities:
Clear file content
Set file attributes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0
push edi
call fcn.00462840
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x402d01
push esi
call fcn.00462990
push esi
mov ebx, eax
call fcn.004628f0
add esp, 8
cmp ebx, dword [esp + 0x20]
jne 0x402d01
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 2
push edi
call fcn.00462840
mov ebp, eax
add esp, 8
cmp ebp, 0xffffffff
je 0x402c08
push 0x9c4000
call fcn.004629a0
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
push ebp
jne 0x402c15
call fcn.004628f0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
call fcn.00462990
mov edi, eax
sub edi, dword [esp + 0x2c]
add esp, 4
test edi, edi
jle 0x402d0b
mov ecx, dword [esp + 0x24]
xor ebx, ebx
xor esi, esi
test ecx, ecx
jle 0x402c5b
jmp 0x402c40
cmp ecx, 0x9c4000
mov eax, 0x9c4000
jg 0x402c4f
mov eax, ecx
sub ecx, eax
add esi, eax
add ebx, eax
sub edi, eax
test ecx, ecx
jg 0x402c40
push 0
push ebx
push ebp
call fcn.00462970
add esp, 0xc
cmp eax, ebx
jne 0x402d0b
add esi, dword [esp + 0x28]
test edi, edi
mov dword [esp + 0x10], esi
jle 0x402ce7
jmp 0x402c80
cmp edi, 0x9c4000
mov esi, 0x9c4000
jg 0x402c8f
mov esi, edi
mov eax, dword [esp + 0x10]
push 0
push eax
push ebp
call fcn.00462970
add esp, 0xc
cmp eax, dword [esp + 0x10]
jne 0x402d0b
mov ecx, dword [esp + 0x14]
push esi
push ecx
push ebp
call fcn.00462890
add esp, 0xc
cmp eax, esi
jne 0x402d0b
add dword [esp + 0x10], esi
push 0
push ebx
push ebp
call fcn.00462970
add esp, 0xc
cmp eax, ebx
jne 0x402d0b
mov edx, dword [esp + 0x14]
push esi
push edx
push ebp
call fcn.004628c0
add esp, 0xc
cmp eax, esi
jne 0x402d0b
sub edi, esi
add ebx, esi
test edi, edi
jg 0x402c80
push ebp
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004629d0
push ebp
call fcn.004628f0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
push eax
call fcn.004629d0
push ebp
call fcn.004628f0
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x402ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x402eb9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x402ef4
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402ef0
lea ebx, [ebx]
cmp esi, eax
jae 0x402ef4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402ee0
cmp esi, eax
jb 0x402efa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x408980
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x47a316
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x49c550]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49c550]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov eax, dword [esp + 0x138]
lea edx, [esp + 0x20]
mov esi, ecx
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4089d0
lea eax, [esp + 0x20]
push eax
call fcn.00446d11
add esp, 4
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x20]
call fcn.00405790
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x138], 0
call fcn.00407a50
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x130], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x14]
test edi, edi
mov ebx, dword [esi + 4]
je 0x408a4d
cmp edi, esi
je 0x408a52
call fcn.00445c38
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x408a75
test edi, edi
jne 0x408a63
call fcn.00445c38
cmp ebp, dword [edi + 4]
jne 0x408a6d
call fcn.00445c38
mov eax, dword [ebp + 0x10]
jmp 0x408b05
push 0x80
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea edx, [esp + 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
push edx
call fcn.0046f840
mov edi, eax
add esp, 8
test edi, edi
je 0x408af1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00405790
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x134], 1
call fcn.00408880
mov dword [eax], edi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x130], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408b03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x408b03
lea ecx, [esp + 0x20]
push ecx
push str.zpakOpenPackageFile_Failed___s
call fcn.00414100
add esp, 8
mov eax, edi
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00443fd7
add esp, 0x120
ret 4
Function at 0x408b70
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x47a35b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x49c550]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
push esi
push edi
mov eax, dword [0x49c550]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x23c]
cmp byte [eax], 0
mov esi, dword [esp + 0x240]
mov ebp, dword [esp + 0x244]
jne 0x408ca3
push 0x206
lea eax, [esp + 0x26]
push 0
push eax
mov word [esp + 0x2c], 0
call fcn.004447d0
push 0x208
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.00413c00
add esp, 0x18
push 0x80
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea ecx, [esp + 0x10]
call fcn.0042978e
push 0
push 0x9001
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x240], 0
call fcn.00429cab
test eax, eax
jne 0x408c6d
lea ecx, [esp + 0x10]
mov dword [esp + 0x234], 0xffffffff
call fcn.00429915
xor eax, eax
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00443fd7
add esp, 0x228
ret
mov ecx, dword [esp + 0x248]
push ecx
push ebp
lea ecx, [esp + 0x18]
call fcn.004294dc
lea ecx, [esp + 0x10]
call fcn.0042972c
lea ecx, [esp + 0x10]
mov dword [esp + 0x234], 0xffffffff
call fcn.00429915
mov eax, 1
jmp 0x408c46
push eax
mov ecx, 0x49f3bc
call fcn.00408980
test eax, eax
je 0x408c44
push 0
push esi
push eax
call fcn.00470c10
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x408c44
mov edi, dword [esp + 0x248]
push edi
push ebp
push esi
call fcn.00470f70
xor edx, edx
cmp eax, edi
sete dl
push esi
mov edi, edx
call fcn.00470c50
add esp, 0x10
mov eax, edi
jmp 0x408c46
Function at 0x413960
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov eax, edx
push edi
xor edi, edi
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x413970
mov ecx, dword [esp + 0xc]
sub eax, esi
add eax, 1
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov eax, 1
je 0x41399f
mov eax, edi
pop edi
pop esi
ret

Function at 0x413b90
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x804
mov eax, dword [0x49c550]
xor eax, esp
mov dword [esp + 0x800], eax
push 0x7fe
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.004447d0
mov edx, dword [esp + 0x814]
lea ecx, [esp + 0x818]
push ecx
push edx
lea eax, [esp + 0x14]
push 0x800
push eax
call fcn.00444bfa
add esp, 0x1c
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00443fd7
add esp, 0x804
ret

Function at 0x413d20
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x47b398
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x49c550]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.0042978e
mov esi, dword [esp + 0x28]
push 0x80
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 0
push 0x9001
push esi
lea ecx, [esp + 0x14]
call fcn.00429cab
test eax, eax
jne 0x413d9e
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00429915
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.004294dc
lea ecx, [esp + 8]
call fcn.0042972c
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00429915
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x414630
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x47b3c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x49c550]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49c550]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
push 0x5c
push 0x2f
lea ecx, [esp + 0x238]
mov dword [esp + 0x230], 0
call fcn.0040bd80
mov ebp, dword [esp + 0x230]
lea edx, [esp + 0x14]
mov eax, ebp
sub edx, ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x414695
cmp word [esp + 0x14], 0x5c
lea esi, [esp + 0x14]
jne 0x4146b4
lea esi, [esp + 0x16]
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov edi, esi
lea esp, [esp]
push 0x5c
push esi
call fcn.00446231
mov esi, eax
add esp, 8
test esi, esi
je 0x4146d6
mov word [esi], 0
push 0
push edi
call ebx
test esi, esi
je 0x4146ea
add esi, 2
mov word [esi - 2], 0x5c
jne 0x4146c0
lea eax, [ebp - 0x10]
mov dword [esp + 0x228], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414711
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00443fd7
add esp, 0x218
ret
Function at 0x4148a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b408
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x49c550]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
push esi
push str.CreateProcess__s_r_n
call fcn.00413b90
add esp, 8
call fcn.00428efe
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4148f2
push 0x80004005
call fcn.004014c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
test esi, esi
mov dword [esp + 0x70], 0
jne 0x414912
xor eax, eax
jmp 0x414926
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414917
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00403490
mov edi, dword [esp + 0x10]
push 0x5c
push edi
call fcn.00446f3c
add esp, 8
or ebx, 0xffffffff
test eax, eax
jne 0x41494b
mov edi, ebx
jmp 0x414951
sub eax, edi
sar eax, 1
mov edi, eax
test esi, esi
mov word [esi + edi*2], 0
jne 0x41495f
xor eax, eax
jmp 0x414973
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414964
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00403490
push 0x44
lea ecx, [esp + 0x28]
push 0
push ecx
mov word [esi + edi*2], 0x5c
call fcn.004447d0
mov edi, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
cmp dword [edi - 4], 1
jle 0x4149ca
mov edx, dword [edi - 0xc]
push edx
lea ecx, [esp + 0x14]
call fcn.00401e60
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x414a12
push esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.CreateProcess_failed__d___r_n_s
call fcn.00413b10
lea eax, [edi - 0x10]
add esp, 0xc
mov dword [esp + 0x70], ebx
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
jmp 0x414a35
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
lea eax, [edi - 0x10]
mov dword [esp + 0x70], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x414a43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x64
ret
Function at 0x4194e2
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x49c550]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
cmp dword [ebp + 0x200], 0x800
mov eax, dword [ebp + 0x1fc]
push esi
mov dword [ebp - 0x40], eax
mov esi, ecx
lea eax, [ebp + 0x1e8]
jne 0x419580
push 0x483284
push 4
push eax
call fcn.00448fe5
push eax
call fcn.00402e10
add esp, 0x10
push ebx
push edi
call fcn.004490a2
mov edi, dword [eax]
call fcn.004490a2
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp + 0x1e8]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00444ef6
add esp, 0x18
mov dword [ebp - 0x40], eax
call fcn.004490a2
cmp dword [eax], ebx
je 0x419597
call fcn.004490a2
push dword [eax]
call fcn.00419454
pop ecx
jmp 0x41959e
push 4
push eax
push 3
push dword [ebp + 0x200]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jne 0x419531
jmp 0x419610
call fcn.004490a2
mov dword [eax], edi
cmp dword [ebp - 0x40], 0xffffffff
je 0x41960c
cmp dword [ebp - 0x40], esi
jae 0x41960c
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.004447d0
add esp, 0xc
push 0x480170
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
cmp eax, ebx
je 0x4195fe
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x4195fe
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4195fe
push ebx
push ebx
push esi
jmp 0x419604
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
jmp 0x41960e
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x1f0]
xor ecx, ebp
pop esi
call fcn.00443fd7
add ebp, 0x1f4
leave
ret
Function at 0x41c600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0043187c
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x41c637
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0041c212
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x420443
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42047c
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00420406
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00406cf0
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x422178
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4221bb
call fcn.0043187c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x4221bb
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x4221d6
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00421d32
test ebx, ebx
mov esi, eax
je 0x4221d4
test edi, edi
je 0x4221d4
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x423773
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x4237b9
call fcn.0043187c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x4237b9
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4237fc
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4237e5
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4237e5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4237f9
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc