joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490522
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49055a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048e562
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048e53a
jmp 0x490566
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x491c19
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x491c5b
call fcn.00497bba
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x491c5b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x491c52
xor eax, eax
jmp 0x491c63
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00491c69
pop edi
pop esi
pop ebx
ret 4

Function at 0x4980e9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x498117
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x498135
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049804f
jmp 0x498135
mov eax, dword [esi + 0x14]
test eax, eax
je 0x498135
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049804f
test edi, edi
mov eax, edi
jne 0x49811f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x2e83700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02e8378f
jae 0x2e8370e
xor ecx, ecx
call fcn.02e8378f
jae 0x2e8373d
xor eax, eax
call fcn.02e8378f
jae 0x2e8374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02e8378f
adc al, al
jae 0x2e8372f
jne 0x2e83779
stosb byte es:[edi], al
jmp 0x2e83711
call fcn.02e8379b
sub ecx, ebx
jne 0x2e83756
call fcn.02e83799
jmp 0x2e83775
lodsb al, byte [esi]
shr eax, 1
je 0x2e83783
adc ecx, ecx
jmp 0x2e83772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02e83799
cmp eax, 0x7d00
jae 0x2e83772
cmp ah, 5
jae 0x2e83773
cmp eax, 0x7f
ja 0x2e83774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2e83711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x2ea3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02ea378f
jae 0x2ea370e
xor ecx, ecx
call fcn.02ea378f
jae 0x2ea373d
xor eax, eax
call fcn.02ea378f
jae 0x2ea374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02ea378f
adc al, al
jae 0x2ea372f
jne 0x2ea3779
stosb byte es:[edi], al
jmp 0x2ea3711
call fcn.02ea379b
sub ecx, ebx
jne 0x2ea3756
call fcn.02ea3799
jmp 0x2ea3775
lodsb al, byte [esi]
shr eax, 1
je 0x2ea3783
adc ecx, ecx
jmp 0x2ea3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02ea3799
cmp eax, 0x7d00
jae 0x2ea3772
cmp ah, 5
jae 0x2ea3773
cmp eax, 0x7f
ja 0x2ea3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2ea3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x6d5617f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d5617fb
repz ret
jmp fcn.6d561b91

Function at 0x6d56184e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x6d56185d
pop dword [ebp - 0x38]
mov eax, 0xa1007665
sub eax, 0x33aa5e08
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x6fea7830
sub dword [ebp - 0x48], 0x219832e5
mov dword [ebp - 0x44], 0x90dacf4e
sub dword [ebp - 0x44], 0x5ea78309
mov dword [ebp - 0x40], 0x6ce15a46
add dword [ebp - 0x40], 0xdf6ae9e8
mov dword [ebp - 0x3c], 0xcb333181
add dword [ebp - 0x3c], 0x34ccce7f
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x5e90229a
add dword [ebp - 0x48], 0x15e246bc
mov dword [ebp - 0x44], 0x7460578
sub dword [ebp - 0x44], 0xc5d9a403
mov dword [ebp - 0x40], 0x5151ff10
add dword [ebp - 0x40], 0x121d6d5c
mov dword [ebp - 0x3c], 0xf6ea2c62
sub dword [ebp - 0x3c], 0xf6ea2c62
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39933
push 0
call eax
mov ecx, 0x64eaa3d8
sub ecx, 0x64ea4f9e
xor edi, edi
add edi, eax
mov ebx, 0x4e1ddbdf
add ebx, 0x1f388621
add ebx, dword [ebp - 0x38]
mov edx, 0x8a50fd27
add edx, 0xd613333b
sub dword [ebp - 0x24], 0x67ba9170
mov esi, dword [ebx]
sub dword [ebp - 0x30], 0x3857eaf9
xor esi, edx
add dword [ebp - 0x30], edi
mov dword [edi], esi
add dword [ebp - 0x10], edx
add edi, 4
add ebx, 0x64ca1f9f
sub ebx, 0x64ca1f9b
loop 0x6d561977
add eax, 0x610f3a12
sub eax, 0x610df657
mov ebx, eax
add eax, 5
mov ecx, 0x4d016589
add ecx, 0x20549a77
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4026d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40271b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402714
test esi, esi
je 0x402714
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4026f0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402900
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402950
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402a28
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40298e
cmp eax, 4
jne 0x4029b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40299e
cmp edx, 4
je 0x40299e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402900
Function at 0x1f63700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.01f6378f
jae 0x1f6370e
xor ecx, ecx
call fcn.01f6378f
jae 0x1f6373d
xor eax, eax
call fcn.01f6378f
jae 0x1f6374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.01f6378f
adc al, al
jae 0x1f6372f
jne 0x1f63779
stosb byte es:[edi], al
jmp 0x1f63711
call fcn.01f6379b
sub ecx, ebx
jne 0x1f63756
call fcn.01f63799
jmp 0x1f63775
lodsb al, byte [esi]
shr eax, 1
je 0x1f63783
adc ecx, ecx
jmp 0x1f63772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01f63799
cmp eax, 0x7d00
jae 0x1f63772
cmp ah, 5
jae 0x1f63773
cmp eax, 0x7f
ja 0x1f63774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1f63711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xcaeab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x32a000]
push edi
or ebp, 0xffffffff
jmp 0xcaead2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xcaead9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcaeac8
mov eax, 1
add ebx, ebx
jne 0xcaeaeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xcaeae0
jne 0xcaeafc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xcaeae0
xor ecx, ecx
sub eax, 3
jb 0xcaeb10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xcaeb82
mov ebp, eax
add ebx, ebx
jne 0xcaeb1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xcaeb28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xcaeb4c
inc ecx
add ebx, ebx
jne 0xcaeb38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xcaeb2d
jne 0xcaeb49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xcaeb2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xcaeb6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xcaeb5d
jmp 0xcaeace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xcaeb6c
add edi, ecx
jmp 0xcaeace
pop esi
mov edi, esi
mov ecx, 0x70f4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xcaeb8a
cmp byte [edi], 0x28
jne 0xcaeb8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xcaeb8f
lea edi, [esi + 0x8aa000]
mov eax, dword [edi]
or eax, eax
je 0xcaec07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8b0358]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8b0498]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xcaebbc
mov ecx, edi
jns 0xcaebeb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8b049c]
or eax, eax
je 0xcaec01
mov dword [ebx], eax
add ebx, 4
jmp 0xcaebd9
call dword [esi + 0x8b04ac]
mov ebp, dword [esi + 0x8b04a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xcaec3b
sub esp, 0xffffff80
jmp 0x4ea001
Function at 0x70e980
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21d000]
push edi
jmp 0x70e99a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x70e9a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70e990
mov eax, 1
add ebx, ebx
jne 0x70e9b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70e9c4
jne 0x70e9e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70e9e3
dec eax
add ebx, ebx
jne 0x70e9d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x70e9a8
add ebx, ebx
jne 0x70e9df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70ea35
xor ecx, ecx
sub eax, 3
jb 0x70e9fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x70ea6a
sar eax, 1
mov ebp, eax
jmp 0x70ea06
add ebx, ebx
jne 0x70ea06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70e9d4
inc ecx
add ebx, ebx
jne 0x70ea14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70e9d4
add ebx, ebx
jne 0x70ea21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x70ea16
jne 0x70ea32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x70ea16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70ea54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70ea46
jmp 0x70e996
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70ea54
add edi, ecx
jmp 0x70e996
pop esi
mov edi, esi
mov ecx, 0x198c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70ea72
cmp byte [edi], 0x11
jne 0x70ea72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x70ea77
lea edi, [esi + 0x309000]
mov eax, dword [edi]
or eax, eax
je 0x70eaef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x334ba0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x334d38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x70eaa4
mov ecx, edi
jns 0x70ead3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x334d40]
or eax, eax
je 0x70eae9
mov dword [ebx], eax
add ebx, 4
jmp 0x70eac1
call dword [esi + 0x334d3c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x70eb20
cmp al, 0xef
ja 0x70eb13
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x70eaf5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x70eb02
mov ebp, dword [esi + 0x334d44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x70eb54
sub esp, 0xffffff80
jmp 0x418feb
Function at 0x401020
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x2e0
mov ecx, dword [esp + 0x2e4]
push esi
lea eax, [esp + 0xe4]
push 0x200
push eax
push ecx
mov byte [esp + 0x70], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
dec esi
test eax, eax
je 0x4010a8
cmp byte [esp + esi + 0xe4], 0x2e
jne 0x40106e
mov byte [esp + esi + 0xe4], 0
cmp byte [esp + esi + 0xe4], 0x5c
je 0x401081
mov ecx, esi
dec esi
test ecx, ecx
jne 0x40105c
jmp 0x4010a8
lea edx, [esp + esi + 0xe5]
push edx
call fcn.00401110
add esp, 4
test eax, eax
je 0x4010a8
lea eax, [esp + esi + 0xe9]
lea ecx, [esp + 0x64]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edx, [esp + 4]
push 0x30
push edx
push 7
push 0x400
call esi
lea eax, [esp + 0x34]
push 0x30
push eax
push 3
push 0x400
call esi
lea ecx, [esp + 0x34]
lea edx, [esp + 4]
push ecx
lea eax, [esp + 0x68]
push edx
push eax
lea ecx, [esp + 0xf0]
push str.http:__update.brother.co.jp_genuine_redirect_index.aspx_model_scountry_sgengo_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0xf8]
push edx
call fcn.00401150
add esp, 0x18
pop esi
add esp, 0x2e0
ret
Function at 0x401150
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x580
push esi
lea eax, [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push eax
push str..html
push 0x80000000
mov byte [esp + 0x18c], 0
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4012c2
lea ecx, [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x80]
lea ecx, [esp + 0x14]
push edx
push ecx
push 0
push 0x408540
push eax
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x28], 1
call esi
test eax, eax
jne 0x4012b7
lea edx, [esp + 0x7c]
lea eax, [esp + 0x284]
push edx
push str._s_shellopencommand
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x284]
push ecx
push edx
push 0x80000000
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4012b7
lea eax, [esp + 8]
lea ecx, [esp + 0x7c]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x408540
push eax
mov dword [esp + 0x20], 0x104
call esi
test eax, eax
jne 0x4012ac
mov eax, dword [esp + 8]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 8], eax
je 0x401283
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 4
jb 0x401283
cmp byte [esp + eax + 0x7c], 0x2e
jne 0x40126e
lea edx, [esp + eax + 0x7d]
push 4
lea eax, [esp + 0x2c]
push edx
push eax
call esi
lea ecx, [esp + 0x28]
push 0x406090
push ecx
call edi
test eax, eax
mov eax, dword [esp + 8]
je 0x40127b
mov edx, eax
dec eax
test edx, edx
mov dword [esp + 8], eax
jne 0x401240
jmp 0x401283
mov byte [esp + eax + 0x80], 0
cmp byte [esp + 0x7c], 0x22
jne 0x401299
lea ecx, [esp + 0x7d]
lea edx, [esp + 0x180]
push ecx
push edx
jmp 0x4012a6
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x180]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x180]
test al, al
je 0x401386
lea ecx, [esp + 0x180]
push ecx
call fcn.00401390
add esp, 4
test eax, eax
je 0x401386
xor edx, edx
mov ecx, 0x11
mov dword [esp + 0x18], edx
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x1c], edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x20], edx
push eax
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 0x180]
push ecx
call fcn.004013c0
mov edx, dword [esp + 0x590]
add esp, 4
push edx
push eax
lea eax, [esp + 0x390]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x18]
lea edx, [esp + 0x38]
lea eax, [esp + 0x388]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1a0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401386
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
pop edi
pop esi
add esp, 0x580
ret
Function at 0x405a88
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405aee
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404144
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bc0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405ad8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405af5
lea eax, [ebp - 0x10]
call fcn.00403ed4
ret

Function at 0x40ad48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ad81
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403fc4
jmp 0x40ad8a
mov eax, ebx
mov edx, esi
call fcn.00403f28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ad94
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40adb5
mov al, byte [esp]
jmp 0x40adb7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bd54
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40be2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f6c
lea eax, [ebp - 8]
call fcn.004043e4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404394
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40be14
mov eax, ebx
call fcn.004026cc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40be0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404394
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bdf7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40be3c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bdf7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be14
mov eax, dword [ebp - 0x10]
call fcn.004026ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be31
lea eax, [ebp - 8]
call fcn.00403ed4
ret