joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46daa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push 2
push 0
mov dword [esp + 0x20], ecx
push ebx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebp, eax
test ebp, ebp
je 0x46dc50
mov eax, dword [esp + 0x24]
test eax, eax
je 0x46dc19
push 0xe
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x46dc49
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46dc49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x46dc49
xor eax, eax
mov ax, word [edi + 4]
shl eax, 5
add eax, 0x210
push eax
call fcn.004745a7
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x10], esi
je 0x46dc49
xor ecx, ecx
lea edx, [esi + 0x108]
mov cx, word [edi + 4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edx
mov dword [esi + 0x20c], ecx
call ebx
lea eax, [esi + 4]
push 0x4f183c
push eax
call ebx
mov eax, dword [esi + 0x20c]
mov dword [esp + 0x24], 0
test eax, eax
jbe 0x46dc19
mov ecx, esi
add edi, 0x12
mov dword [esp + 0x20], edi
lea ebx, [ecx + 0x21c]
mov eax, dword [esp + 0x20]
xor edx, edx
push 3
mov dx, word [eax]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x46dc2e
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x46dc35
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov dword [ebx + 4], eax
call fcn.004745a7
add esp, 4
mov dword [ebx], eax
mov esi, dword [ebx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, dword [ebx]
mov ecx, esi
mov esi, eax
mov edx, ecx
lea eax, [ebx - 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
call fcn.0046d960
test eax, eax
je 0x46dc3c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
inc eax
mov edx, dword [ecx + 0x20c]
add edi, 0xe
add ebx, 0x20
cmp eax, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edi
jb 0x46db7c
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov edx, dword [esp + 0x10]
push edx
jmp 0x46dc41
mov eax, dword [esp + 0x10]
push eax
jmp 0x46dc41
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004744be
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x46dc60
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x10]
push 2
push ecx
push esi
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x46dc90
pop edi
pop esi
pop ecx
ret 8
cmp dword [esp + 0x10], 2
je 0x46dc9f
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x10]
push 2
push eax
push esi
mov dword [esp + 0x1c], 1
call edi
test eax, eax
jne 0x46dcc2
pop edi
pop esi
pop ecx
ret 8
cmp dword [esp + 0x10], 2
je 0x46dcd1
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x10]
push 2
push eax
push esi
mov dword [esp + 0x1c], ecx
call edi
test eax, eax
jne 0x46dcf4
pop edi
pop esi
pop ecx
ret 8
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 2
pop edi
sete al
pop esi
pop ecx
ret 8
Function at 0x46dd40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov eax, dword [esp + 0x24]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
mov esi, ecx
push 0x40000000
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x46deb7
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi + 0x20c]
push ecx
push ebx
mov ecx, esi
call fcn.0046dc60
test eax, eax
jne 0x46dda3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
mov eax, dword [edi + 0x20c]
xor ebp, ebp
test eax, eax
jbe 0x46de52
lea esi, [edi + 0x224]
mov al, byte [esi - 0x10]
mov dl, byte [esi - 0x14]
mov byte [esp + 0x19], al
mov eax, dword [esi]
mov byte [esp + 0x18], dl
mov byte [esp + 0x1b], 0
mov cx, word [eax + 0xc]
mov word [esp + 0x1c], cx
mov dx, word [eax + 0xe]
mov word [esp + 0x1e], dx
mov ecx, dword [esp + 0x1e]
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and eax, 0xffff
imul ecx, eax
cmp ecx, 8
jl 0x46de02
mov byte [esp + 0x1a], 0
jmp 0x46de0a
mov dl, 1
shl dl, cl
mov byte [esp + 0x1a], dl
mov eax, dword [esi - 4]
mov ecx, dword [esp + 0x14]
push ebp
push edi
mov dword [esp + 0x28], eax
call fcn.0046dd10
lea ecx, [esp + 0x30]
push 0
push ecx
lea edx, [esp + 0x20]
push 0x10
push edx
push ebx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46deb7
cmp dword [esp + 0x30], 0x10
jne 0x46deb7
mov eax, dword [edi + 0x20c]
inc ebp
add esi, 0x20
cmp ebp, eax
jb 0x46ddb9
mov eax, dword [edi + 0x20c]
xor ebx, ebx
test eax, eax
jbe 0x46deac
lea esi, [edi + 0x224]
mov eax, dword [esi]
push 0
mov ebp, dword [eax + 0x14]
mov dword [eax + 0x14], 0
mov ecx, dword [esi - 4]
mov edx, dword [esi - 8]
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46deb7
mov ecx, dword [esp + 0x30]
mov eax, dword [esi - 4]
cmp ecx, eax
jne 0x46deb7
mov edx, dword [esi]
inc ebx
add esi, 0x20
mov dword [edx + 0x14], ebp
mov eax, dword [edi + 0x20c]
cmp ebx, eax
jb 0x46de64
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
Function at 0x46ded0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46df4f
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x46df4f
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x46df4f
push ebx
push ebp
push edi
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
mov ebp, eax
mov eax, ecx
mov edi, ebp
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x46e0d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46e1bd
mov esi, dword [esp + 0x28]
mov ecx, edi
push esi
mov word [esp + 0x14], 0x4d42
mov word [esp + 0x1a], bp
mov word [esp + 0x1c], bp
call fcn.0046e090
and eax, 0xffff
push esi
add eax, 0x36
mov ecx, edi
mov dword [esp + 0x1e], eax
call fcn.0046e0a0
imul eax, dword [esi + 8]
mov edx, dword [esp + 0x1a]
lea ecx, [esp + 0x24]
add eax, edx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
lea edx, [esp + 0x18]
push 0xe
shr eax, 2
push edx
push ebx
mov dword [esp + 0x26], eax
call ebp
test eax, eax
je 0x46e1b6
cmp dword [esp + 0x24], 0xe
jne 0x46e1b6
mov eax, dword [esi + 8]
push esi
cdq
sub eax, edx
mov ecx, edi
sar eax, 1
mov dword [esi + 8], eax
call fcn.0046e0a0
mov edi, eax
mov ecx, dword [esp + 0x1a]
imul edi, dword [esi + 8]
lea eax, [esp + 0x24]
add edi, ecx
push 0
push eax
push edi
push esi
push ebx
call ebp
test eax, eax
je 0x46e1b6
cmp dword [esp + 0x24], edi
jne 0x46e1b6
mov ecx, dword [esi + 8]
push ebx
shl ecx, 1
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x46f460
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4c6974]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x46f473
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x46f4b4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4c6a1c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x46f4e6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x46f4ea
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x46f4db
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x46f508
mov bl, byte [esp + ecx + 0x4c]
jmp 0x46f50c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x46f4fd
xor ecx, ecx
mov eax, 0x4c6984
xor ebx, ebx
mov bl, byte [ecx + 0x4c6a2c]
cmp byte [esp + ebx + 0x14], 0
je 0x46f537
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4c6a44]
cmp byte [esp + ebx + 0x14], 0
je 0x46f54e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x46f51e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x46f4a7
lea edx, [esp + 0x84]
push edx
call fcn.0046f590
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x486071
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4860a9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00484113
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004840eb
jmp 0x4860b5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48775f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4877a1
call fcn.0048d29f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4877a1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x487798
xor eax, eax
jmp 0x4877a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004877af
pop edi
pop esi
pop ebx
ret 4

Function at 0x48d7cf
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48d7fd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48d81b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048d735
jmp 0x48d81b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48d81b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048d735
test edi, edi
mov eax, edi
jne 0x48d805
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x159814cb
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x431344bf
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1049c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1049c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1049c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049c06a
add dl, dl
jne 0x1049c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049c0dc
xor eax, eax
add dl, dl
jne 0x1049c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049c17d
add dl, dl
jne 0x1049c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1049c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1049c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1049c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1049c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1049c075
mov eax, 1
add dl, dl
jne 0x1049c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1049c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1049c0e1
sub eax, ebx
mov ebx, 1
jne 0x1049c128
mov ecx, 1
add dl, dl
jne 0x1049c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1049c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1049c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1049c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1049c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1049c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1049c136
cmp eax, 0x7d00
jae 0x1049c16d
cmp eax, 0x500
jb 0x1049c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1049c075
cmp eax, 0x7f
ja 0x1049c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1049c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1049c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1049c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x30002e2b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x14], esi
push edi
je 0x30002e55
push dword [ebp + 8]
call fcn.3000684a
test eax, eax
pop ecx
je 0x30002e55
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
cmp dword [ebp + 0x14], esi
push esi
setne al
mov ebx, 0x8000001
push ebx
mov edi, 0x40000000
lea eax, [eax + eax + 2]
push eax
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push dword [ebp + 8]
mov dword [ebp - 8], eax
call esi
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x30002eda
cmp dword [ebp - 4], 0xffffffff
jne 0x30002eda
push dword [ebp + 8]
push 0x104
push 0x300129e8
call fcn.30002c36
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x35
add eax, 0x351
push eax
push 0x149
push dword [ebp + 0x10]
call fcn.30006e80
add esp, 0x10
cmp eax, 4
jne 0x30002eda
xor eax, eax
push eax
push ebx
push dword [ebp - 8]
push eax
push eax
push edi
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
jmp 0x30002e88
pop edi
xor eax, eax
cmp dword [ebp + 0x14], eax
pop esi
pop ebx
je 0x30002ef7
cmp dword [ebp - 4], 0xffffffff
je 0x30002ef7
push 2
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x30002efc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x30002f24
cmp dword [ebp - 4], esi
je 0x30002f70
cmp dword [ebp + 0x18], 0
je 0x30002f75
push dword [ebp + 0xc]
push 0x104
push 0x300129e8
call fcn.30002c36
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x35
add eax, 0x351
push eax
push 0x14a
push dword [ebp + 0x1c]
call fcn.30006e80
add esp, 0x10
cmp eax, 4
jne 0x30002f75
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x30002f08
add dword [ebp + 0x10], eax
sub esi, eax
jmp 0x30002f04
xor eax, eax
inc eax
jmp 0x30002f77
xor eax, eax
pop esi
leave
ret

Function at 0x30002f7a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x30002ff1
and dword [ebp + 0x14], 0
push 0
lea eax, [ebp + 0x14]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x30002fa5
cmp dword [ebp + 0x14], esi
je 0x30002ff1
cmp dword [ebp + 0x18], 0
je 0x30002ff6
push dword [ebp + 0xc]
push 0x104
push 0x300129e8
call fcn.30002c36
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x35
add eax, 0x351
push eax
push 0x14b
push dword [ebp + 0x1c]
call fcn.30006e80
add esp, 0x10
cmp eax, 4
jne 0x30002ff6
mov eax, dword [ebp + 0x14]
test eax, eax
jbe 0x30002f89
add dword [ebp + 0x10], eax
sub esi, eax
jmp 0x30002f85
xor eax, eax
inc eax
jmp 0x30002ff8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x30003bbb
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x30012970]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp + 8]
mov dword [ebp - 4], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x30c
lea ecx, [ebp - 0x61c]
push ecx
push eax
mov dword [ebp - 0x624], eax
call ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x61c]
push eax
call esi
mov ecx, 0x30c
sub ecx, eax
push ecx
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp + eax*2 - 0x61c]
push eax
push dword [ebp - 0x620]
call ebx
push 0
push dword [ebp - 0x620]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [ebp - 0x620]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x14], 0
je 0x30003c99
push dword [ebp + 0x14]
push dword [ebp + 8]
call edi
mov edi, eax
lea eax, [ebp - 0x61c]
push eax
call esi
mov ecx, 0x30c
sub ecx, eax
push ecx
lea eax, [ebp - 0x61c]
push eax
call esi
lea eax, [ebp + eax*2 - 0x61c]
push eax
push edi
call ebx
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x624]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.300101bf
leave
ret

Function at 0x3000491b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x30012970]
mov dword [ebp + 0x94], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x70], 2
jne 0x30004956
cmp dword [ebp - 0x7c], 5
jb 0x30004956
xor eax, eax
inc eax
jmp 0x30004958
xor eax, eax
mov ecx, dword [ebp + 0x94]
call fcn.300101bf
add ebp, 0x98
leave
ret
Function at 0x3000496b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x30012970]
mov dword [ebp - 4], eax
push 0x20
lea eax, [ebp - 0x44]
push eax
movzx eax, word [ebp + 8]
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x44]
push eax
call fcn.3000692a
lea eax, [ebp - 0x44]
push eax
call fcn.300048ee
pop ecx
pop ecx
mov ecx, 0x4e4
cmp eax, ecx
ja 0x300049ed
je 0x30004a03
sub eax, 0x36a
je 0x300049e9
sub eax, 0x3a
je 0x300049e5
sub eax, 4
je 0x300049e1
sub eax, 0xd
je 0x300049dd
dec eax
je 0x300049d9
sub eax, 0x12c
je 0x300049d5
dec eax
jne 0x30004a03
mov al, 0xcc
jmp 0x30004a1d
mov al, 0xee
jmp 0x30004a1d
mov al, 0x88
jmp 0x30004a1d
mov al, 0x81
jmp 0x30004a1d
mov al, 0x86
jmp 0x30004a1d
mov al, 0x80
jmp 0x30004a1d
mov al, 0xde
jmp 0x30004a1d
sub eax, 0x4e5
je 0x30004a1b
dec eax
je 0x30004a17
dec eax
je 0x30004a13
dec eax
je 0x30004a0f
dec eax
je 0x30004a0b
dec eax
je 0x30004a07
xor al, al
jmp 0x30004a1d
mov al, 0xa3
jmp 0x30004a1d
mov al, 0xba
jmp 0x30004a1d
mov al, 0xb2
jmp 0x30004a1d
mov al, 0xb1
jmp 0x30004a1d
mov al, 0xa2
jmp 0x30004a1d
mov al, 0xa1
mov ecx, dword [ebp - 4]
call fcn.300101bf
leave
ret
Function at 0x30004a3e
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x30012970]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edi, 0x3ff
push 0
mov ebx, eax
mov esi, ebx
mov dword [ebp - 0x260], ebx
and esi, edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and ax, di
cmp ax, 0x37
jne 0x30004a7d
push 0x37
pop esi
movzx eax, si
mov dword [ebp - 0x264], eax
sub eax, 4
je 0x30004ad8
sub eax, 0xd
je 0x30004aca
dec eax
je 0x30004abc
xor bl, bl
sub eax, 0x25
mov dword [ebp - 0x25c], 8
je 0x30004ab0
mov dword [ebp - 0x258], 0x300013a0
jmp 0x30004b11
mov dword [ebp - 0x258], 0x30001390
jmp 0x30004b11
mov bl, 0x81
mov dword [ebp - 0x258], 0x30001388
jmp 0x30004b07
mov bl, 0x80
mov dword [ebp - 0x258], 0x30001374
jmp 0x30004b07
cmp bx, 0x404
je 0x30004afb
cmp bx, 0xc04
je 0x30004afb
cmp bx, 0x1404
je 0x30004afb
mov bl, 0x86
mov dword [ebp - 0x258], 0x3000136c
jmp 0x30004b07
mov bl, 0x88
mov dword [ebp - 0x258], 0x30001360
mov dword [ebp - 0x25c], 9
push 0x7c
pop ecx
xor eax, eax
push eax
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
push 0
push 0x29
mov dword [ebp - 0x254], 0x1f4
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x17
pop ecx
push 0x5a
push dword [ebp + 8]
lea esi, [ebp - 0xbc]
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
imul eax, eax, 0xffffffef
cdq
sub eax, edx
sar eax, 1
push 0x48
cdq
pop ecx
idiv ecx
test bl, bl
mov dword [ebp - 0x60], eax
je 0x30004ba1
push 0x5a
push dword [ebp + 8]
mov dword [ebp - 0x50], 0x190
mov byte [ebp - 0x49], bl
call esi
imul eax, dword [ebp - 0x25c]
push 0xffffffffffffffb8
pop ecx
cdq
idiv ecx
push dword [ebp - 0x258]
push 0x20
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x44]
push eax
call fcn.30002c36
jmp case.0x30004bbd.3
call fcn.3000491b
test eax, eax
je case.0x30004bbd.3
mov eax, dword [ebp - 0x264]
dec eax
cmp eax, 0x3d
ja case.0x30004bbd.23
movzx eax, byte [eax + 0x30004c74]
jmp dword [eax*4 + 0x30004c44]
mov byte [ebp - 0x49], 0xb2
jmp case.0x30004bbd.3
mov byte [ebp - 0x49], 0xba
jmp case.0x30004bbd.3
mov byte [ebp - 0x49], 0xee
jmp case.0x30004bbd.3
mov byte [ebp - 0x49], 0xb1
jmp case.0x30004bbd.3
mov byte [ebp - 0x49], 0xa1
jmp case.0x30004bbd.3
mov byte [ebp - 0x49], 0xcc
jmp case.0x30004bbd.3
mov byte [ebp - 0x49], 0xa2
jmp case.0x30004bbd.3
mov byte [ebp - 0x49], 0xa3
jmp case.0x30004bbd.3
cmp word [ebp - 0x260], 0xc1a
setne al
dec al
and al, 0xde
add al, 0xee
jmp 0x30004c25
push dword [ebp - 0x258]
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.30002c36
push dword [ebp - 0x260]
call fcn.3000496b
pop ecx
mov byte [ebp - 0x49], al
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [0x300129b8], eax
pop ebx
call fcn.300101bf
leave
ret