joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443e40
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d79
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x45f918]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x7c], 0
jne 0x443e78
xor eax, eax
jmp 0x444014
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0x7c]
call fcn.00445100
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x443e93
xor eax, eax
jmp 0x444014
mov dword [ebp - 0x10], 0
push 0
push 0x452c38
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0x20]
call edx
test eax, eax
je 0x443fcd
lea ecx, [ebp - 0x20]
call fcn.004011d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004011d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004011d0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x64]
call eax
test eax, eax
je 0x443f8b
lea ecx, [ebp - 0x1c]
push ecx
push 3
lea ecx, [ebp - 0x20]
call fcn.004031a0
push eax
call fcn.0043f520
add esp, 0xc
test eax, eax
je 0x443f8b
lea edx, [ebp - 0x18]
push edx
push 1
lea ecx, [ebp - 0x1c]
call fcn.004031a0
push eax
call fcn.0043f520
add esp, 0xc
test eax, eax
je 0x443f8b
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0x7c]
call fcn.00446e00
lea ecx, [ebp - 0x18]
call fcn.004031a0
push eax
call fcn.00401210
add esp, 4
mov dword [ebp - 0x24], eax
movzx edx, word [ebp + 8]
sar edx, 0xa
test edx, edx
jne 0x443f79
movzx eax, word [ebp - 0x24]
and eax, 0x3ff
movzx ecx, word [ebp + 8]
and ecx, 0x3ff
xor edx, edx
cmp eax, ecx
sete dl
mov dword [ebp - 0x10], edx
jmp 0x443f8b
movzx eax, word [ebp - 0x24]
movzx ecx, word [ebp + 8]
xor edx, edx
cmp eax, ecx
sete dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x443fa6
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x24]
call eax
test eax, eax
jne 0x443edd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401070
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401070
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401070
cmp dword [ebp - 0x10], 0
je 0x444011
movzx ecx, word [ebp + 8]
and ecx, 0x3ff
cmp ecx, 0xd
jne 0x444011
mov edx, dword [ebp - 0x28]
movzx eax, word [edx + 0xac]
and eax, 0x3ff
cmp eax, 0xd
je 0x444011
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
and ecx, 0x3ff
cmp ecx, 0xd
je 0x444011
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4460b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x12
call fcn.004034d0
test eax, eax
je 0x446115
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
call fcn.004031a0
test eax, eax
je 0x446115
mov dword [ebp - 4], 6
push str.GdipDisposeImage
call fcn.004034d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44610c
mov ecx, dword [ebp - 0xc]
call fcn.004031a0
push eax
call dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 8
call fcn.004012b0
movzx ecx, al
test ecx, ecx
jne 0x446139
mov ecx, dword [ebp - 0xc]
add ecx, 8
call fcn.004031a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00403510
mov ecx, dword [ebp - 0xc]
call fcn.004034f0
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x40100a
repz ret
jmp fcn.004015c0

Function at 0x4051ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403c81
and dword [ebp - 0x14], 0
cmp dword [0x42cd68], 0
mov dword [ebp - 0x18], eax
jne 0x40525e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405306
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405306
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42cd68], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42cd6c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42cd70], eax
call edi
push eax
call esi
mov dword [0x42cd78], eax
test eax, eax
je 0x40525e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42cd74], eax
mov eax, dword [0x42cd74]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4052b7
cmp dword [0x42cd78], ecx
je 0x4052b7
push eax
call esi
push dword [0x42cd78]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4052b7
test ebx, ebx
je 0x4052b7
call edi
test eax, eax
je 0x4052ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4052ae
test byte [ebp - 8], 1
jne 0x4052b7
or dword [ebp + 0x10], 0x200000
jmp 0x4052ea
mov eax, dword [0x42cd6c]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4052ea
mov eax, dword [0x42cd70]
cmp eax, dword [ebp - 0x18]
je 0x4052ea
push eax
call esi
test eax, eax
je 0x4052ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42cd68]
call esi
test eax, eax
je 0x405306
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405308
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x425b60
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x42a004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x42d2a4]
imul eax, eax, 0x343fd
cmp dword [0x81bf8c], 0x139e
mov dword [0x42d2a4], eax
jne 0x425baf
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x42d2a4]
add eax, 0x269ec3
push esi
mov dword [0x42d2a4], eax
movzx esi, word [0x42d2a6]
and esi, 0x7fff
cmp dword [0x81bf8c], 0x8e7
jne 0x425be4
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x425c30
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x425c44
call fcn.00425b60
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x425c37
pop esi
cmp ebx, 0x2d
jne 0x425c5e
mov dword [0x81bf98], 0xa62e7790
mov dword [0x81bf9c], 0xffffffff
ret

Function at 0x425c60
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42b1f0]
push ebx
mov ebx, dword [0x81bf8c]
push edi
mov edi, dword [0x81b930]
call fcn.00425c00
cmp dword [0x81bf8c], 0x2f
jne 0x425cc5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00425c30
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x426020
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00409b30
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x426049
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0392
jge 0x4260f1
cmp dword [0x81bf8c], 0xa5f
jne 0x426095
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x818]
push edx
push str.kilibugerenegupezocezicuberusog
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 4], 0x845653
jne 0x4260ba
mov eax, dword [0x42c010]
mov dword [0x81bf8c], eax
mov ecx, dword [0x81bf8c]
add ecx, 0xa231
mov dword [0x81bf8c], ecx
cmp dword [0x81bf8c], 0x141
jne 0x4260ec
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x42d2a8], 0xec58acac
mov dword [0x42d2ac], 0xffffffff
jmp 0x426040
call fcn.00425ce0
jmp dword [0x81b930]
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402c00
pop dword [ebp - 0x50]
mov eax, 0xff3f651d
add eax, 0x100c6e3
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x37b533a9
add dword [ebp - 0x60], 0x169d11a2
mov dword [ebp - 0x5c], 0x6a71a36c
sub dword [ebp - 0x5c], 0x383e5727
mov dword [ebp - 0x58], 0x9d0c74db
sub dword [ebp - 0x58], 0x50c030ad
mov dword [ebp - 0x54], 0x115780d9
sub dword [ebp - 0x54], 0x115780d9
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xc59eba01
add dword [ebp - 0x60], 0xaed3af55
mov dword [ebp - 0x5c], 0x81405e07
sub dword [ebp - 0x5c], 0x3fd3fc92
mov dword [ebp - 0x58], 0x20c2d87f
add dword [ebp - 0x58], 0x42ac93ed
mov dword [ebp - 0x54], 0xa0f8b6b6
sub dword [ebp - 0x54], 0xa0f8b6b6
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3d2b6
push 0
call eax
mov ecx, 0x61ec
mov ebx, eax
mov esi, 0x5e096e26
sub esi, 0x5dc86e26
add esi, dword [ebp - 0x50]
mov edx, 0x4c5ba8e9
xor dword [ebp - 0x44], eax
mov edi, dword [esi]
mov dword [ebp - 0x14], 0x14553078
sub edi, edx
add dword [ebp - 0x38], 0xe467da86
mov dword [ebx], edi
sub dword [ebp - 0x30], ecx
add ebx, 0x89a8acb6
add ebx, 0x7657534e
add esi, 4
loop 0x402d0c
add eax, 0xde422e31
sub eax, 0xde40b3ae
mov ebx, eax
add eax, 0x473205d4
sub eax, 0x473205cf
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10003cd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
jne 0x10003cf7
push 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10003f20
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10003e03
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10003150
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10003d31
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003f20
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10003e03
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push eax
call dword [section..data]
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10003d69
push 0
push 3
mov eax, dword [ebp + 8]
push eax
call fcn.10003f20
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10003e03
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.10012c75
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 4]
je 0x10003dac
mov eax, dword [ebp - 0x10]
push eax
call dword [0x10033004]
add esp, 4
push 0
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.10003f20
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10003e03
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.100030c0
add esp, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push eax
push 1
push 1
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10009440
add esp, 0xc
push eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10003aa0
add esp, 0x28
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c834
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001c6aa

Function at 0x1001e842
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e7c4

Function at 0x10027620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002764d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002764d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4b2915
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b2794

Function at 0x4b61fd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b5ebd

Function at 0x4bac9f
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x4de870]
mov ebx, eax
push 0
push 0
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ecx, dword [0x4de8ac]
mov ebp, eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x104
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor esi, esi
nop dword [eax + eax]
movzx ecx, word [edi + edx*2]
mov eax, edx
cmp ecx, 0x5c
cmovne eax, esi
mov esi, eax
test cx, cx
je 0x4bad05
inc edx
jmp 0x4bacef
lea edi, [edi + esi*2]
mov esi, dword [0x4de890]
add edi, 2
cmp dword [esi], 0
je 0x4bad62
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp al, byte [esi]
je 0x4bad2a
cmp al, byte [esi + 1]
jne 0x4bae14
movzx eax, word [edi]
xor edx, edx
xor ecx, ecx
mov ebx, eax
test ax, ax
je 0x4bad50
nop dword [eax]
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [edi + ecx*2]
test ax, ax
jne 0x4bad3f
cmp edx, dword [esi + 4]
je 0x4bad5e
cmp edx, dword [esi + 8]
jne 0x4bae14
mov ebx, dword [esp + 0x14]
mov eax, dword [0x4de8ac]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + eax], ecx
add al, byte [ebx - 0x57cfb3e]
inc eax
jl 0x4bad81
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
je 0x4bae14
mov edi, dword [0x4de8b0]
lea eax, [esp + 0x10]
mov ecx, dword [0x4de898]
push eax
push ecx
push 0x7000
push edi
call ebp
mov esi, dword [0x4de88c]
dec ebp
add byte [ebp - 0xcfcf7b1], cl
mov edx, 0x1bfe
mov ebx, dword [esi + 4]
sub esi, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
add eax, ebx
mov dword [ecx - 4], eax
invalid
Function at 0x4bad8c
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x4de870]
mov ebx, eax
push 0
push 0
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ecx, dword [0x4de8ac]
mov ebp, eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x104
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor esi, esi
nop dword [eax + eax]
movzx ecx, word [edi + edx*2]
mov eax, edx
cmp ecx, 0x5c
cmovne eax, esi
mov esi, eax
test cx, cx
je 0x4bad05
inc edx
jmp 0x4bacef
lea edi, [edi + esi*2]
mov esi, dword [0x4de890]
add edi, 2
cmp dword [esi], 0
je 0x4bad62
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp al, byte [esi]
je 0x4bad2a
cmp al, byte [esi + 1]
jne 0x4bae14
movzx eax, word [edi]
xor edx, edx
xor ecx, ecx
mov ebx, eax
test ax, ax
je 0x4bad50
nop dword [eax]
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [edi + ecx*2]
test ax, ax
jne 0x4bad3f
cmp edx, dword [esi + 4]
je 0x4bad5e
cmp edx, dword [esi + 8]
jne 0x4bae14
mov ebx, dword [esp + 0x14]
mov eax, dword [0x4de8ac]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + eax], ecx
add al, byte [ebx - 0x57cfb3e]
inc eax
jl 0x4bad81
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
je 0x4bae14
mov edi, dword [0x4de8b0]
lea eax, [esp + 0x10]
mov ecx, dword [0x4de898]
push eax
push ecx
push 0x7000
push edi
call ebp
mov esi, dword [0x4de88c]
dec ebp
add byte [ebp - 0xcfcf7b1], cl
mov edx, 0x1bfe
mov ebx, dword [esi + 4]
sub esi, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
add eax, ebx
mov dword [ecx - 4], eax
invalid
Function at 0x4bb860
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov eax, 0x1400
cmp ax, di
je 0x4bb910
push 9
lea eax, [ebp - 0x18]
mov ebx, edi
push eax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4bb910
mov ecx, dword [ebp - 0x1c]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004064e0
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4bb8cb
mov eax, dword [esi]
jmp 0x4bb8cd
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, 0x400
cmp di, ax
jb 0x4bb8fd
push 9
lea eax, [ebp - 0x18]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4bb8fd
dec eax
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004064e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049510d
mov esp, ebp
pop ebp
ret
Function at 0x4013cc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4013de
mov eax, dword [0x4b208b]
shl eax, 2
mov dword [0x4b208f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00490378
pop edx
call fcn.004902dc
call fcn.004903b8
push 0
call fcn.004919a8
pop ecx
push 0x4b2034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4b2093], eax
push 0
jmp fcn.00497fb8
Function at 0x402b84
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
add esp, 0xfffffc00
cmp byte [0x4b2dc0], 0
jne 0x402c21
mov esi, 0x4b31c1
mov edi, esp
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [esp + 4]
push eax
push str.374DE290_123F_4565_9164_39C4925E467B
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push SysReAllocStringLen
call fcn.004113dc
add esp, 0x14
cmp byte [esp], 0
jne 0x402bef
push 0x400
lea edx, [esp + 4]
push edx
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push SysReAllocStringLen
call fcn.004113dc
add esp, 0x14
cmp byte [esp], 0
jne 0x402c0d
push 0x400
call fcn.00402b64
push eax
lea ecx, [esp + 8]
push ecx
call fcn.004119e8
add esp, 0xc
push 0x400
push 0x4b2dc0
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov eax, 0x4b2dc0
add esp, 0x400
pop edi
pop esi
ret
Function at 0x40b120
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2c0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40b34d
cmp ebx, 1
jne 0x40b149
cmp dword [ebp + 8], 0
je 0x40b34d
cmp ebx, 2
jne 0x40b162
cmp dword [ebp + 0x14], 0
je 0x40b34d
cmp dword [ebp + 0x18], 1
jb 0x40b34d
cmp ebx, 1
je 0x40b170
cmp ebx, 2
jne 0x40b34d
cmp byte [eax], 0
je 0x40b34d
mov esi, 0x4bf2cd
lea edi, [ebp - 0x400]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
push 0x400
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.004119e8
add esp, 0xc
push 0x400
lea edx, [ebp - 0x400]
push edx
call fcn.0041203c
add esp, 8
lea edi, [ebp - 0x800]
mov esi, 0x4bf6ce
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x940]
mov ecx, 0x50
mov esi, 0x4bfad0
lea eax, [ebp - 0x400]
rep movsd dword es:[edi], dword [esi]
push eax
push str._s.
lea edx, [ebp - 0x800]
push 0x400
push edx
call fcn.00493644
add esp, 0x10
lea ecx, [ebp - 0x940]
push ecx
lea eax, [ebp - 0x800]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x40b34d
push esi
mov esi, 0x4bfc10
lea edi, [ebp - 0xd40]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x914]
push eax
lea edx, [ebp - 0x400]
push edx
push str._s_s
push 0x400
lea ecx, [ebp - 0xd40]
push ecx
call fcn.00493644
add esp, 0x14
mov eax, dword [ebp - 0x940]
test al, 0x10
je 0x40b2e4
test ah, 4
jne 0x40b332
lea eax, [ebp - 0x914]
mov edx, 0x4c6a1f
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x40b293
test cl, cl
je 0x40b332
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x40b293
add eax, 2
add edx, 2
test cl, cl
jne 0x40b273
je 0x40b332
lea eax, [ebp - 0x914]
mov edx, 0x4c6a21
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x40b2c4
test cl, cl
je 0x40b332
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x40b2c4
add eax, 2
add edx, 2
test cl, cl
jne 0x40b2a4
je 0x40b332
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0xd40]
push eax
mov edx, dword [ebp + 0x14]
push edx
push ebx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040b120
add esp, 0x14
jmp 0x40b332
push str.prefs.js
lea edx, [ebp - 0x914]
push edx
call fcn.00490aa8
add esp, 8
test eax, eax
jne 0x40b332
cmp ebx, 1
jne 0x40b316
lea ecx, [ebp - 0xd40]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040ac4c
add esp, 8
jmp 0x40b332
cmp ebx, 2
jne 0x40b332
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
lea eax, [ebp - 0xd40]
push eax
call fcn.0040af00
add esp, 0xc
lea edx, [ebp - 0x940]
push edx
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x40b216
push esi
call sub.KERNEL32.DLL_FindClose
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret