joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57f770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x122000]
push edi
jmp 0x57f78a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x57f791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f780
mov eax, 1
add ebx, ebx
jne 0x57f7a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x57f7b4
jne 0x57f7d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7d3
dec eax
add ebx, ebx
jne 0x57f7c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x57f798
add ebx, ebx
jne 0x57f7cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x57f825
xor ecx, ecx
sub eax, 3
jb 0x57f7eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x57f85a
sar eax, 1
mov ebp, eax
jmp 0x57f7f6
add ebx, ebx
jne 0x57f7f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7c4
inc ecx
add ebx, ebx
jne 0x57f804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7c4
add ebx, ebx
jne 0x57f811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x57f806
jne 0x57f822
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x57f806
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x57f844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x57f836
jmp 0x57f786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x57f844
add edi, ecx
jmp 0x57f786
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x57f862
cmp byte [edi], 0x11
jne 0x57f862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x57f867
lea edi, [esi + 0x178000]
mov eax, dword [edi]
or eax, eax
je 0x57f8df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2196c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x219840]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x57f894
mov ecx, edi
jns 0x57f8c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x219844]
or eax, eax
je 0x57f8d9
mov dword [ebx], eax
add ebx, 4
jmp 0x57f8b1
call dword [esi + 0x219854]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x57f910
cmp al, 0xef
ja 0x57f903
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x57f8e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x57f8f2
mov ebp, dword [esi + 0x219848]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x57f944
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x40ed80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5cd470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5cd46c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5cd470], edx
cmp eax, 0x26f
jl 0x40ed88
mov dword [0x55cfa0], 0x270
ret

Function at 0x40edc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5cd474]
mov ebx, dword [eax*4 + 0x5cd470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5cdaa4]
mov dword [eax*4 + 0x5cd470], edx
cmp eax, 0xe2
jl 0x40edc8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5cd474]
mov ebx, dword [eax*4 + 0x5cd470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5cd0e4]
mov dword [eax*4 + 0x5cd470], edx
cmp eax, 0x26e
jl 0x40ee18
mov edx, dword [0x5cd470]
mov ecx, dword [0x5cde2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5cdaa0]
mov dword [0x5cde2c], eax
mov dword [0x55cfa0], 0
pop ebx
ret

Function at 0x40eea0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x55cfa0]
add dword [0x55cfa0], 1
mov eax, dword [0x5cc020]
cmp eax, dword [0x55c6f0]
jne 0x40eec3
cmp ebx, 0x271
jb 0x40eee4
mov eax, dword [0x5cc020]
call fcn.0040ed80
not dword [0x5cc020]
mov eax, dword [0x5cc020]
mov dword [0x55c6f0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40ef00
call fcn.0040edc0
xor ebx, ebx
mov dword [0x55cfa0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5cd470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410a50
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x55c440]
cmp ax, 0xcb
je 0x410b5c
cmp ax, 0xcc
je 0x410b5c
lea esi, [esi]
mov edx, dword [0x5ce070]
test edx, edx
je 0x410a85
mov eax, dword [0x5cdf20]
call edx
mov ebx, eax
jmp 0x410a8a
mov ebx, 0x5cdf24
cmp word [0x5cdf10], 0
jle 0x410ab0
mov eax, 0x5cdef0
call fcn.00410d10
mov eax, ebx
call fcn.00410610
mov eax, ebx
call fcn.00410680
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410ad2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410acd
mov edx, edi
mov eax, ebx
call fcn.0040fa80
jmp 0x410ad0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410ab8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5cdf10], 0
jle 0x410b5c
mov edx, 0x5cde30
mov eax, ebx
call fcn.0040fbc0
mov edi, eax
test edi, edi
je 0x410b2c
mov eax, dword [0x5cdec4]
mov dword [edi + 0xc], eax
cmp dword [0x5cdec4], 0
je 0x410b20
mov eax, dword [0x5cdec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5cdec4], eax
nop
sub word [0x5cdf10], 1
cmp word [0x5cdf10], 0
sete bl
mov eax, 0x5cdef0
call fcn.00410d30
test bl, bl
je 0x410b5c
mov eax, 0x5cdef0
call fcn.00410d00
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x4132a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413280
push ebp
push 0x414620
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x4133ca
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b650
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x41332f
mov edx, 0x5cd2f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413381
call sub.kernel32.dll_GetLastError
call fcn.00404050
lea eax, [ebp - 0x10]
call fcn.0040a230
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a6d0
mov edx, dword [ebp - 0x14]
mov ecx, 0x578314
lea eax, [ebp - 0x10]
call fcn.0040a560
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040af20
jmp 0x413418
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x41339a
cmp eax, ecx
je 0x4133a4
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b650
cmp byte [0x55c6c0], 0
jne 0x413418
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bbf0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040afb0
lea esi, [esi]
jmp 0x413418
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b650
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x4133ee
mov eax, 0x5cd2f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x55c6c0], 0
jne 0x413418
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bbf0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040afb0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4137b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5cd260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413990
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5cd260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004035c0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x55c4c0], eax
mov ebx, eax
jmp 0x413953
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413838
cmp byte [ebx], 0
je 0x41395c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x4138b3
mov al, byte [ebx]
cmp al, 1
jb 0x4138a8
sub al, 0x20
jbe 0x413878
sub al, 2
je 0x41388c
jmp 0x4138a8
mov al, byte [ebp - 0x114]
test al, al
je 0x4138b8
add dword [ebp - 0x110], 1
jmp 0x4138b0
cmp byte [ebx + 1], 0x22
je 0x4138a3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4138b0
add ebx, 1
jmp 0x4138b0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413868
test dword [ebp - 0x10c], 0xffffffff
je 0x41394c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413990
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5cd260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413943
mov al, byte [ebx]
cmp al, 1
jb 0x413938
sub al, 0x20
jbe 0x413908
sub al, 2
je 0x41391c
jmp 0x413938
mov al, byte [ebp - 0x114]
test al, al
je 0x413948
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413940
cmp byte [ebx + 1], 0x22
je 0x413933
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413940
add ebx, 1
jmp 0x413940
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4138f8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41383b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5cd250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5cd260
call fcn.00410890
mov eax, dword [0x5cd260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415830
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov dx, 0xffff
lea esi, [esi]
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x415861
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x415863
shr ecx, 1
cmp bx, 8
jl 0x415848
movzx eax, dx
mov dword [eax*4 + 0x5d0020], ecx
cmp dx, 0xff
jl 0x415838
pop ebx
ret

Function at 0x415880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x5d0024], 0
jne 0x415898
call fcn.00415830
nop
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x4158cc
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x5d0020]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x4158a8
mov esi, esi
not eax
pop edi
pop esi
pop ebx
ret
Function at 0x429140
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x4291ea
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x429206
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x429206
sub dx, 0x20
je 0x4291e0
sub dx, 0x80
je 0x4291e0
sub dx, 0x1f62
jb 0x429206
sub dx, 1
jbe 0x4291e0
sub dx, 6
je 0x4291e0
sub dx, 0x26
jne 0x429206
nop
jmp 0x4291e0
cmp eax, dword [ebp - 0x20]
jg 0x429188
lea esi, [esi]
jmp 0x429206
cmp dword [ebp - 0x1c], 2
jne 0x4291fa
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x429206
mov al, byte [ebp - 0xc]
call fcn.0040b2b0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x429284
sub ax, 0x21
je 0x429298
sub ax, 0x17
je 0x4292a4
sub ax, 0x222
je 0x4292b0
sub ax, 0x392
je 0x4292b8
sub ax, 1
je 0x4292c0
sub ax, 0x1996
je 0x4292c8
sub ax, 1
je 0x4292d0
sub ax, 6
je 0x4292d8
sub ax, 0xb
je 0x4292e8
sub ax, 0x1b
je 0x4292e0
sub ax, 0x367
je 0x4292f0
jmp 0x4292f8
mov ax, word [ebp - 0x24]
call fcn.0040b350
mov byte [ebp - 0x10], al
jmp 0x429300
mov byte [ebp - 0x10], 0x20
jmp 0x429300
mov byte [ebp - 0x10], 0x2e
jmp 0x429300
mov byte [ebp - 0x10], 0x27
jmp 0x429300
mov byte [ebp - 0x10], 0x2c
jmp 0x429300
mov byte [ebp - 0x10], 0x27
jmp 0x429300
mov byte [ebp - 0x10], 0x20
jmp 0x429300
mov byte [ebp - 0x10], 0x20
jmp 0x429300
mov byte [ebp - 0x10], 0x20
jmp 0x429300
mov byte [ebp - 0x10], 0x20
jmp 0x429300
mov byte [ebp - 0x10], 0x2d
jmp 0x429300
mov byte [ebp - 0x10], 0x27
jmp 0x429300
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x435b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00435b10
push ebp
push 0x414620
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x435c30
mov al, byte [ebp - 0x110]
test al, al
je 0x435bf9
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e70
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a0b0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57f0e8
call fcn.0044f020
mov edx, 0x435b8a
mov ecx, ebp
call fcn.004144e0
jmp 0x435c30
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57f0e8
call fcn.0044f020
mov edx, 0x435bf9
mov ecx, ebp
call fcn.004144e0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x435cf4
mov al, byte [ebp - 0x110]
test al, al
je 0x435cbd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e70
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a0b0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57f0e8
call fcn.0044f020
mov edx, 0x435c4e
mov ecx, ebp
call fcn.004144e0
jmp 0x435cf4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57f0e8
call fcn.0044f020
mov edx, 0x435cbd
mov ecx, ebp
call fcn.004144e0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.004354b0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00435b10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x438db0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x57fd74
call fcn.0040ce80
test al, al
je 0x438e96
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00438eb0
xor eax, eax
push fcn.00438da0
push ebp
push 0x414620
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408a60
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.00437fc0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.00437b10
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00438da0
jmp 0x438ea1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043ba10
mov esp, ebp
pop ebp
ret

Function at 0x43ad30
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x43ad4c
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4459c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.004459b0
push ebp
push 0x414620
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408a60
lea eax, [ebp - 0xc10]
call fcn.00403ae0
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x445a20
mov eax, 0x5cd2f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x445aca
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040f8c0
xor eax, eax
push fcn.004459a0
push ebp
push 0x414620
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x445a7c
mov eax, 0x5cd2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x445ab8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x58493c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x445ab8
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004459a0
jmp 0x445b28
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x445aec
mov eax, 0x5cd2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x445b28
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x58493c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x445b28
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004459b0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x450530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x585820
lea eax, [ebp - 0x268]
call fcn.0040e670
xor eax, eax
push fcn.00450510
push ebp
push 0x414620
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x450573
mov eax, 0x5cd2f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x4505bb
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x45058f
clc
jmp 0x450596
bt dword [0x584df0], eax
jb 0x4505af
mov eax, ebp
call fcn.00450660
test al, al
je 0x4505af
mov byte [ebp - 0x26c], 1
jmp 0x450640
mov byte [ebp - 0x26c], 0
jmp 0x450640
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x55de50]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x450640
and esi, 0x400
je 0x450640
lea ebx, [ebp - 0x268]
mov edx, 0x585820
mov eax, ebx
call fcn.0040e730
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.004501d0
test eax, eax
je 0x450614
sub eax, 1
je 0x45062c
jmp 0x450638
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00450530
mov byte [ebp - 0x26c], al
jmp 0x450640
mov byte [ebp - 0x26c], 1
jmp 0x450640
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00450510
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450850
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x45085c
mov eax, 0x5cd2f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x450900
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.004508f0
push ebp
push 0x414620
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x450970
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0040b650
cmp ebx, 1
jle 0x450960
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0040ae00
jmp 0x45097b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00408a60
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004508f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4