joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b868
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc7c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, ebx
call fcn.0040a274
test al, al
jne 0x48b88e
mov byte [ebp - 1], 0
jmp 0x48ba5e
lea eax, [ebp - 0x119]
mov edx, edi
call fcn.0040a930
lea eax, [ebp - 0x21e]
mov edx, ebx
call fcn.0040a930
lea eax, [ebp - 0x323]
mov edx, esi
call fcn.0040a930
xor eax, eax
push ebp
push 0x48ba57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x384]
xor ecx, ecx
mov edx, 0xc
call fcn.00403af4
mov dword [ebp - 0x384], 0xc
xor eax, eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x21e]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48b92b
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48ba5e
push 0
push pe_nt_image_headers32
push 2
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x323]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x48b965
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48ba5e
lea eax, [ebp - 0x368]
xor ecx, ecx
mov edx, 0x44
call fcn.00403af4
mov dword [ebp - 0x368], 0x44
mov dword [ebp - 0x33c], 0x101
mov word [ebp - 0x338], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0x110
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x119]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x48ba02
push 0xffffffffffffffff
mov eax, dword [ebp - 0x378]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x378]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xc], eax
jmp 0x48ba0d
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x48ba5e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ba5e
cmp dword [ebp - 0x14], 0
je 0x48ba29
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x10], 0
je 0x48ba38
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0xc], 0
je 0x48ba47
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x48ba56
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48bb14
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48bbc3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48bba1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a274
test al, al
je 0x48bb66
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
call sub.kernel32.dll_DeleteFileA
mov dl, 1
mov eax, dword [0x41783c]
call fcn.00404620
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bba8
mov eax, dword [ebp - 0xc]
call fcn.00404650
ret

Function at 0x48bbd0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48bd1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405530
mov eax, 0x320
call fcn.00402f00
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x48bc26
mov eax, 0x48bd34
call fcn.0048aaec
lea eax, [ebp - 0x10]
push eax
push 0x320
mov eax, dword [ebp - 0xc]
push eax
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x48bc4c
mov eax, 0x48bd54
call fcn.0048aaec
mov eax, 0xff
call fcn.00402f00
mov ebx, eax
mov eax, 0xff
call fcn.00402f00
mov esi, eax
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x48bceb
inc edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405728
push dword [ebp - 0x24]
push 0x48bd78
lea eax, [ebp - 0x28]
mov edx, esi
call fcn.00405728
push dword [ebp - 0x28]
push 0x48bd84
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004058e0
inc dword [ebp - 0x14]
dec edi
jne 0x48bc76
mov eax, ebx
call fcn.00402f1c
mov eax, esi
call fcn.00402f1c
mov eax, dword [ebp - 0xc]
call fcn.00402f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bd23
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405554
ret
Function at 0x48bd88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48be48
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040aab0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48bde4
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405a44
mov eax, dword [ebp - 0x114]
mov edx, 0x48be60
call fcn.00405974
je 0x48be1d
mov eax, esi
mov ecx, 0x48be60
mov edx, dword [ebp - 4]
call fcn.00405864
jmp 0x48be27
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48be4f
lea eax, [ebp - 0x114]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48bfa4
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x48c0af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x320
call fcn.00402f00
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x48bfe8
push 1
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 8]
push eax
push 0x320
push edi
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x48c008
push 1
call sub.kernel32.dll_Sleep_2
mov eax, 0xff
call fcn.00402f00
mov ebx, eax
mov eax, 0xff
call fcn.00402f00
mov dword [ebp - 0x10], eax
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x48c083
inc esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0xff
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
lea eax, [edi + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00405728
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.0048be64
inc dword [ebp - 0xc]
dec esi
jne 0x48c030
mov eax, ebx
call fcn.00402f1c
mov eax, dword [ebp - 0x10]
call fcn.00402f1c
mov eax, edi
call fcn.00402f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c0b6
lea eax, [ebp - 0x20]
call fcn.00405530
ret
Function at 0x48d5d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48d695
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48d673
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403af4
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403af4
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.0040a930
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d67f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d69c
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48d7a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48d8a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48d86b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x105
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.004057a0
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call fcn.00409b84
cmp dword [ebp - 0x11c], 0
jne 0x48d853
mov eax, dword [ebp - 8]
mov edx, 0x48d8c0
call fcn.00405584
jmp 0x48d861
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x115]
call fcn.0040aab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d882
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d8af
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00405554
lea eax, [ebp - 4]
call fcn.00405530
ret
Function at 0x48d8d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48d9b6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48d989
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x104
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48d97f
test bl, bl
jne 0x48d94e
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.00409e64
jmp 0x48d97f
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x48d9cc
call fcn.0040afa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d9a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d9bd
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48d9e4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48da8b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48da5e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x48da54
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x115]
call fcn.0040aab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48da75
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48da92
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x48de30
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x48de5c
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040aab0
jmp 0x48de63
mov eax, ebx
call fcn.00405530
add esp, 0x104
pop ebx
ret

Function at 0x48de6c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48de98
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040aab0
jmp 0x48de9f
mov eax, ebx
call fcn.00405530
add esp, 0x104
pop ebx
ret
Function at 0x48dea8
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push 5
lea eax, [esp + 4]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
sete al
test al, al
je 0x48ded6
mov eax, ebx
mov edx, esp
call fcn.00405728
jmp 0x48dee2
mov eax, ebx
mov edx, 0x48def0
call fcn.00405584
pop ecx
pop edx
pop ebx
ret

Function at 0x48e660
Capabilities:
Identify system language via api

Disassembly:
push ebx
add esp, 0xffffff98
mov ebx, eax
call sub.kernel32.dll_GetUserDefaultLangID
push 0x64
lea edx, [esp + 4]
push edx
movzx eax, ax
push eax
call sub.kernel32.dll_VerLanguageNameA
mov eax, ebx
mov edx, esp
mov ecx, 0x65
call fcn.004057a0
add esp, 0x68
pop ebx
ret

Function at 0x48ecc8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48ed69
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48ed3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x48ed80
call fcn.0040afa0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, 0x48ed8c
call fcn.00405864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48ed53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ed70
lea eax, [ebp - 0x28]
call fcn.00405530
ret

Function at 0x48ed9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48ee2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xa
push ebx
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
lea edx, [ebp - 8]
mov ecx, ebx
xchg edx, eax
call fcn.00405620
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00405584
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ee34
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x405a20
Capabilities:
Check if file exists
Delete file
Print debug messages

Disassembly:
push ebx
push esi
push edi
push dword [0x430554]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405a46
call esi
cmp eax, 2
je 0x405a46
xor bh, bh
jmp 0x405a48
mov bh, 1
push dword [0x430550]
call edi
test eax, eax
jne 0x405a5f
call esi
cmp eax, 2
je 0x405a5f
xor bl, bl
jmp 0x405a61
mov bl, 1
push dword [0x430564]
call edi
test eax, eax
jne 0x405a78
call esi
cmp eax, 2
je 0x405a78
xor al, al
jmp 0x405a7a
mov al, 1
test bh, bh
je 0x405a8c
test bl, bl
je 0x405a8c
test al, al
je 0x405a8c
pop edi
pop esi
mov al, 1
pop ebx
ret
push str.DeleteSymbolsIfExist___failed_to_delete
xor bl, bl
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x405aa0
Capabilities:
Check if file exists
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x430514]
test eax, eax
je 0x405afe
lea ecx, [ebp - 0x28]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x405afe
test byte [ebp - 0x28], 0x10
je 0x405afe
call fcn.00405a20
test al, al
jne 0x405ae0
push str.DownloadAndUnzipSymbols__:_DeleteSymbolsIfExist___failed
jmp 0x405b03
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405b0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405b0b
push str.DownloadAndUnzipSymbols__:_deleting_pdbZipPath_failed
jmp 0x405b03
push str.DownloadAndUnzipSymbols__:_exiting_because_symDir_doesnt_exist
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x405b60
Capabilities:
Create directory
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0
push dword [0x430514]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405b9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test al, al
jne 0x405b9d
push str.SubmitCrashInfo__:_couldnt_create_symbols_dir
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x430504]
push ecx
push str.SubmitCrashInfo__:_gSymbolPathW:__s
call fcn.00405570
add esp, 8
xor dl, dl
call fcn.0040ba10
test al, al
jne 0x405bcd
push str.SubmitCrashInfo__:_dbghelp::Initialize___failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, fcn.0040b970
cdq
mov esi, edx
mov edi, eax
push esi
push edi
call fcn.0040b970
add esp, 8
test al, al
jne 0x405c21
call fcn.00405aa0
test al, al
jne 0x405bff
push str.SubmitCrashInfo__:_failed_to_download_symbols
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x430504]
mov dl, 1
call fcn.0040ba10
test al, al
jne 0x405c21
push str.SubmitCrashInfo__:_second_dbghelp::Initialize___failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.0040b970
add esp, 8
test al, al
jne 0x405c40
push str.SubmitCrashInfo__:_HasSymbols___false_after_downloading_symbols
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00405630
mov esi, eax
test esi, esi
je 0x405c65
mov ecx, esi
call fcn.00405b20
mov ecx, esi
call fcn.004057f0
mov ecx, dword [0x430520]
push esi
mov edx, dword [ecx]
call dword [edx + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4061d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov byte [ebp - 0x24], 0
push edi
push 0x1f
mov dword [ebp - 0x23], eax
mov edi, ecx
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov byte [ebp - 0x44], al
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x3b], eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov word [ebp - 0x27], ax
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x24]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x1f
lea eax, [ebp - 0x44]
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
push str.Lang:__s__s_r_n
push edi
call fcn.004069f0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
call fcn.0040e41c
mov esp, ebp
pop ebp
ret
Function at 0x406270
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x74]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x60]
push str.Number_Of_Processors:__d_r_n
push esi
call fcn.004069f0
add esp, 0xc
mov ecx, esi
call fcn.00405f20
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, ecx
and ecx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x4c], ecx
sub esp, 0x10
fild qword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 0
fild qword [ebp - 0x50]
fchs
faddp st(1)
fstp dword [ebp - 0x4c]
fld dword [ebp - 0x4c]
fld qword [0x42ce78]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
fmul st(1), st(0)
fxch st(1)
mov dword [ebp - 0x50], eax
mov eax, ecx
and ecx, 0x7fffffff
and eax, 0x80000000
fstp dword [ebp - 0x4c]
fld dword [ebp - 0x4c]
fstp qword [esp + 8]
mov dword [ebp - 0x4c], ecx
fild qword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 0
fild qword [ebp - 0x50]
fchs
faddp st(1)
fstp dword [ebp - 0x4c]
fmul dword [ebp - 0x4c]
fstp dword [ebp - 0x4c]
fld dword [ebp - 0x4c]
fstp qword [esp]
push str.Physical_Memory:__.2f_GB_r_nCommit_Charge_Limit:__.2f_GB_r_nMemory_Used:__d___r_n
push esi
call fcn.004069f0
add esp, 0x1c
mov ecx, esi
call fcn.00405f90
mov ecx, esi
call fcn.004061d0
mov ecx, esi
call fcn.00406070
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040e41c
mov esp, ebp
pop ebp
ret