joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418e81
Capabilities:
Create shortcut via ishelllink
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44b5a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
push esi
mov dword [ebp - 0x218], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
push eax
push 0x43f0bc
push 1
push esi
push 0x43f0dc
mov dword [ebp - 0x210], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x418ee0
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x418fb5
mov eax, dword [ebp - 0x210]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x210]
push str._ProgramFiles_Internet_Explorer
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test edi, edi
jne 0x418f41
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00424520
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x103
push eax
push str._ProgramFiles_Internet_Exploreriexplore.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
lea edx, [ebp - 0x20c]
push edx
jmp 0x418f43
push esi
push edi
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
mov dword [ebp - 0x214], esi
mov ecx, dword [eax]
push 0x43f0cc
push eax
call dword [ecx]
test eax, eax
jns 0x418f7e
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x418fad
mov eax, dword [ebp - 0x214]
push 2
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor esi, esi
inc esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423fbd
leave
ret
Function at 0x41901b
Capabilities:
Delete file

Disassembly:
push 0x34
mov eax, 0x43c102
call fcn.00424059
xor esi, esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.0041da59
test eax, eax
jle 0x419046
lea ecx, [ebp + 8]
call fcn.0041da59
mov dword [ebp - 0x10], eax
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], 0x43e880
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0041da59
inc eax
je 0x419075
push eax
lea ecx, [ebp - 0x20]
call fcn.00419e68
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
lea ecx, [ebp + 8]
call fcn.0041da59
lea eax, [eax*2 + 2]
push eax
lea ecx, [ebp + 8]
call fcn.0041d83c
push eax
push edi
call fcn.00423960
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.0041da59
inc eax
mov dword [ebp - 0x14], eax
lea ecx, [eax + 1]
cmp ebx, ecx
jae 0x4190bb
sub ecx, ebx
push ecx
lea ecx, [ebp - 0x20]
call fcn.00419e68
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp dword [ebp - 0x10], 0x104
mov word [edi + eax*2], cx
jge 0x419109
push 0x1e
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00424520
mov eax, 0x414
add esp, 0xc
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x2a], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x26], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push edi
call fcn.004247f5
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp + 8]
call fcn.0041d7ee
mov eax, esi
call fcn.00424027
ret
Function at 0x419920
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c20b
mov eax, dword fs:[0]
push eax
mov eax, 0x2920
call fcn.00425320
mov eax, dword [0x44b5a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x292c]
push eax
lea eax, [ebp - 0x28f8]
push eax
mov dword [ebp - 0x292c], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x28fc], 7
mov dword [ebp - 0x2900], ebx
mov word [ebp - 0x2910], cx
mov dword [ebp - 4], ebx
test eax, eax
je 0x4199af
mov edi, str.000000
push edi
call fcn.00423fa4
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2910]
call fcn.00411854
jmp 0x419aac
movzx eax, byte [ebp - 0x275f]
push eax
movzx eax, byte [ebp - 0x2760]
push eax
movzx eax, byte [ebp - 0x2761]
push eax
movzx eax, byte [ebp - 0x2762]
push eax
movzx eax, byte [ebp - 0x2763]
push eax
movzx eax, byte [ebp - 0x2764]
push eax
lea eax, [ebp - 0x44]
push str._02x_02x_02x_02x_02x_02x
push eax
lea esi, [ebp - 0x28f8]
call fcn.0042527d
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2928]
push eax
call fcn.00419eaa
add esp, 0x28
lea ecx, [ebp - 0x2910]
push eax
call fcn.0040f87c
push ebx
push 1
lea ecx, [ebp - 0x2928]
call fcn.0041157d
mov edi, str.000000
jmp 0x419a98
mov esi, dword [esi]
test esi, esi
je 0x419aac
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x78]
push str._02x_02x_02x_02x_02x_02x
push eax
call fcn.0042527d
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x2928]
push eax
call fcn.00419eaa
add esp, 0x28
lea ecx, [ebp - 0x2910]
push eax
call fcn.0040f87c
push ebx
push 1
lea ecx, [ebp - 0x2928]
call fcn.0041157d
push edi
lea ecx, [ebp - 0x2910]
call fcn.0041cd04
test eax, eax
je 0x419a27
cmp dword [ebp - 0x28fc], 8
push ebx
lea esi, [ebp - 0x2910]
cmovae esi, dword [ebp - 0x2910]
push 1
lea ecx, [ebp - 0x2910]
call fcn.0041157d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00423fbd
leave
ret
Function at 0x419bf5
Capabilities:
Enumerate processes

Disassembly:
push 0x248
mov eax, 0x43c243
call fcn.0042408c
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 4], ebx
mov edi, ebx
mov dword [ebp - 0x254], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x254]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x419cd4
jmp 0x419ca1
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x230], ax
jne 0x419c53
mov eax, ebx
jmp 0x419c60
lea eax, [ebp - 0x230]
push eax
call fcn.00423fa4
pop ecx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x28]
call fcn.00411854
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp + 0x18]
lea ecx, [ebp + 8]
push ebx
mov byte [ebp - 4], 1
call fcn.0041cc9c
push ebx
lea ecx, [ebp - 0x28]
push 1
test eax, eax
je 0x419cc2
mov byte [ebp - 4], bl
call fcn.0041157d
lea eax, [ebp - 0x254]
push eax
push esi
mov dword [ebp - 0x254], 0x22c
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x419c36
jmp 0x419ccd
mov edi, dword [ebp - 0x24c]
call fcn.0041157d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0041157d
mov eax, edi
call fcn.0042403b
ret
Function at 0x41a1d0
Capabilities:
Get common file path

Disassembly:
push 0x540
mov eax, 0x43c344
call fcn.0042408c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x54c], eax
call fcn.0041daf6
pop ecx
mov esi, eax
xor eax, eax
push eax
push 0x19
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea ecx, [ebp - 0x438]
call fcn.0040f20d
and dword [ebp - 4], 0
push esi
call fcn.004247f5
pop ecx
test edi, edi
jne 0x41a243
mov esi, 0x43eab8
push esi
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.004116f7
mov edi, str.Internet_Explorer.lnk
jmp 0x41a290
mov esi, 0x43e2f0
push esi
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.004116f7
xor eax, eax
cmp word [edi], ax
je 0x41a26a
push edi
call fcn.00423fa4
pop ecx
push eax
push edi
lea ecx, [ebp - 0x438]
call fcn.004116f7
mov esi, str..lnk
push esi
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.004116f7
cmp byte [ebp + 0x14], 0
je 0x41a2dc
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.00419e9c
mov esi, dword [ebp - 0x54c]
pop ecx
test eax, eax
jne 0x41a2e2
cmp dword [ebp - 0x424], 8
push esi
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push ebx
push eax
call fcn.00418e81
add esp, 0xc
jmp 0x41a2e2
mov esi, dword [ebp - 0x54c]
xor ecx, ecx
push ecx
push 0x1a
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x548]
call fcn.0041d7da
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x548]
push str._sMicrosoftInternet_ExplorerQuick_Launch_s.lnk
push eax
mov byte [ebp - 4], 1
call fcn.0041d9c9
add esp, 0x10
cmp byte [ebp + 0x18], 0
je 0x41a352
lea ecx, [ebp - 0x548]
call fcn.0041d83c
push eax
call fcn.00419e9c
pop ecx
test eax, eax
jne 0x41a352
push esi
push ebx
lea ecx, [ebp - 0x548]
call fcn.0041d83c
push eax
call fcn.00418e81
add esp, 0xc
xor ecx, ecx
push ecx
push 0x16
lea eax, [ebp - 0x420]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x4c0]
call fcn.0041d7da
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x4c0]
push str._s_s.lnk
push eax
mov byte [ebp - 4], 2
call fcn.0041d9c9
add esp, 0x10
cmp byte [ebp + 0x1c], 0
je 0x41a3c2
lea ecx, [ebp - 0x4c0]
call fcn.0041d83c
push eax
call fcn.00419e9c
pop ecx
test eax, eax
jne 0x41a3c2
push esi
push ebx
lea ecx, [ebp - 0x4c0]
call fcn.0041d83c
push eax
call fcn.00418e81
add esp, 0xc
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 1
call fcn.0041d7ee
xor ebx, ebx
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], bl
call fcn.0041d7ee
push ebx
push 1
lea ecx, [ebp - 0x438]
call fcn.0041157d
call fcn.0042403b
ret
Function at 0x41a535
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c6e7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x172c
call fcn.00425320
mov eax, dword [0x44b5a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.c0
lea ecx, [ebp - 0x74c]
mov dword [ebp - 4], 1
call fcn.00403490
push 0x445615
lea ecx, [ebp - 0x65c]
mov byte [ebp - 4], 2
call fcn.00403490
push 0x43ecd0
lea ecx, [ebp - 0x6a4]
mov byte [ebp - 4], 3
call fcn.00403490
push str._otptjejhjemghgstehqiqrirtrhhtrnm_52424c4_nuyiv2qmr2nw
lea ecx, [ebp - 0x6ec]
mov byte [ebp - 4], 4
call fcn.00403490
lea eax, [ebp - 0x6ec]
push eax
push 4
mov byte [ebp - 4], 5
call fcn.00418fc4
xor ebx, ebx
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
lea eax, [ebp - 0x7f4]
push eax
mov byte [ebp - 0x171d], bl
call fcn.0041c85d
add esp, 0x10
mov byte [ebp - 4], 6
cmp dword [ebp - 0x7e4], ebx
je 0x41a61b
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x7f4]
push eax
lea ecx, [ebp - 0x6a4]
call fcn.0040b3b0
mov byte [ebp - 0x171d], 1
xor eax, eax
push 0x206
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push ebx
push eax
call fcn.00424520
add esp, 0xc
lea eax, [ebp - 0x62c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0xcd4]
call fcn.0041d7b6
lea ecx, [ebp - 0x14cc]
mov byte [ebp - 4], 7
call fcn.0041d7da
lea ecx, [ebp - 0x119c]
mov byte [ebp - 4], 8
call fcn.0041d7da
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x119c]
mov byte [ebp - 4], 9
call fcn.0041d825
lea ecx, [ebp - 0xcd4]
call fcn.0041d83c
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x447dc8
lea eax, [ebp - 0x173c]
push eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x173c], 1
call fcn.00423fcc
lea eax, [ebp - 0x14cc]
push eax
push 0
lea ecx, [ebp - 0x119c]
call fcn.0041d83c
push eax
call fcn.0041940b
add esp, 0xc
test eax, eax
jne 0x41a75e
mov eax, 0x41a6f0
ret
mov eax, 0x41a764
ret
Function at 0x41c986
Capabilities:
Write file on windows

Disassembly:
push 0x28
mov eax, 0x43c7b5
call fcn.0042408c
mov esi, ecx
mov dword [ebp - 0x2c], esi
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x41ca8a
cmp byte [esi + 0x45], bl
je 0x41ca8a
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x41c9be
xor al, al
jmp 0x41ca8c
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0040c780
lea eax, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
mov ecx, dword [ecx + 0x40]
push eax
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x28]
cmovae edi, edx
lea esi, [ebp - 0x28]
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
push dword [ebp - 0x30]
call dword [edx + 0x20]
sub eax, ebx
je 0x41ca19
dec eax
jne 0x41ca71
mov esi, dword [ebp - 0x2c]
jmp 0x41ca1f
mov esi, dword [ebp - 0x2c]
mov byte [esi + 0x45], bl
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x34]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edx
sub edi, eax
je 0x41ca57
push dword [esi + 0x50]
cmp ecx, 0x10
push edi
lea eax, [ebp - 0x28]
cmovae eax, edx
push 1
push eax
call fcn.0042621b
add esp, 0x10
cmp edi, eax
jne 0x41ca7a
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [esi + 0x45], 0
je 0x41ca78
test edi, edi
jne 0x41c9e5
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00409a40
jmp 0x41c9df
dec eax
dec eax
jne 0x41ca7e
inc eax
jmp 0x41ca7c
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00403560
mov al, bl
jmp 0x41ca8c
mov al, 1
call fcn.0042403b
ret
Function at 0x41ced2
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x43c82a
call fcn.0042408c
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp edi, ebx
jne 0x41cef4
xor eax, eax
jmp 0x41d04a
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x41cf1e
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x41cf1e
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x41d04a
cmp dword [esi + 0x50], 0
je 0x41d048
mov ecx, esi
call fcn.0041cb81
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x41cf4b
push dword [esi + 0x50]
push edi
call fcn.00418649
pop ecx
test al, al
pop ecx
cmovne ebx, edi
jmp 0x41d048
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
push 8
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x14], 0xf
call fcn.0040c780
and dword [ebp - 4], 0
lea eax, [esi + 0x48]
mov dword [ebp - 0x40], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x40]
cmp edi, 0x10
mov edi, dword [esi]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
mov ecx, esi
call dword [edi + 0x1c]
test eax, eax
js 0x41d040
cmp eax, 1
jg 0x41d025
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
cmp edi, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x41cff6
push dword [esi + 0x50]
lea eax, [ebp - 0x28]
push edx
cmp edi, 0x10
cmovae eax, ecx
push 1
push eax
call fcn.0042621b
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x41d040
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x45], 1
cmp dword [ebp - 0x38], eax
jne 0x41d020
test edx, edx
jne 0x41cf76
cmp dword [ebp - 0x18], 0x20
jae 0x41d040
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.00409a40
jmp 0x41cf73
mov ebx, dword [ebp + 8]
jmp 0x41d040
cmp eax, 3
jne 0x41d040
mov eax, dword [ebp - 0x30]
push dword [eax + 0x50]
push dword [ebp - 0x2c]
call fcn.00418649
pop ecx
test al, al
cmovne ebx, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00403560
mov eax, ebx
call fcn.0042403b
ret 4
Function at 0x4332d6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44b5a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0042892e
mov dword [ebp - 0x14], eax
cmp dword [0x44e8f0], edi
jne 0x4333c7
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x433354
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4334a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4334a7
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4334a7
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x44e8f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x44e8f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x44e8f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44e900], eax
test eax, eax
je 0x4333c4
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44e8fc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4333ec
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4333df
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x433401
push 4
pop eax
jmp 0x4334a9
cmp dword [ebp - 0x14], edi
je 0x433401
push dword [0x44e8f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4333e6
mov eax, dword [0x44e8fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x43345f
cmp dword [0x44e900], esi
je 0x43345f
push eax
call ebx
push dword [0x44e900]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43345f
test eax, eax
je 0x43345f
call ecx
test eax, eax
je 0x433454
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x433454
test byte [ebp - 8], 1
jne 0x43345f
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x43348f
mov eax, dword [0x44e8f4]
cmp eax, esi
je 0x43348c
push eax
call ebx
test eax, eax
je 0x43348c
call eax
mov edi, eax
test edi, edi
je 0x43348c
mov eax, dword [0x44e8f8]
cmp eax, esi
je 0x43348c
push eax
call ebx
test eax, eax
je 0x43348c
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x44e8f0]
call ebx
test eax, eax
je 0x4334a7
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4334a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423fbd
leave
ret
Function at 0x4358a6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042a302
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4358de
xor eax, eax
jmp 0x43590a
cmp esi, dword [ebp - 4]
je 0x435907
cmp dword [ebp + 0xc], 0
je 0x435907
push dword [edi + 0x9c]
call fcn.004354b4
push dword [edi + 0x9c]
mov esi, eax
call fcn.00423fa4
pop ecx
pop ecx
cmp esi, eax
je 0x4358da
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x401120
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
push 0
mov dword [esp + 0xc], 0
push dword [esi]
call fcn.0040a118
push dword [esi]
lea eax, [esp + 0x1c]
push 2
push 1
push eax
call fcn.00409dae
mov ax, word [esp + 0x28]
add esp, 0x1c
cmp al, 0x4d
jne 0x4011f2
cmp ah, 0x5a
jne 0x4011f2
push 0
push 0x3c
push dword [esi]
call fcn.0040a118
push dword [esi]
lea eax, [esp + 0x14]
push 1
push 4
push eax
call fcn.00409dae
mov eax, dword [esp + 0x20]
push 0
add eax, 0x18
push eax
push dword [esi]
call fcn.0040a118
push dword [esi]
lea eax, [esp + 0x38]
push 1
push 2
push eax
call fcn.00409dae
mov ax, word [esp + 0x44]
add esp, 0x38
cmp al, 0xb
jne 0x4011f2
cmp ah, 1
jne 0x4011b6
mov ecx, 0x98
jmp 0x4011c0
cmp ah, 2
jne 0x4011f2
mov ecx, 0xa8
mov eax, dword [esp + 4]
push 0
add eax, ecx
push eax
push dword [esi]
call fcn.0040a118
push dword [esi]
lea eax, [esp + 0x14]
push 1
push 4
push eax
call fcn.00409dae
mov eax, dword [esp + 0x20]
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
pop esi
pop ecx
ret
or eax, 0xffffffff
pop esi
pop ecx
ret

Function at 0x401220
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi], 0
jne 0x401252
lea eax, [edi + 0x68]
push 0x420200
push eax
call fcn.00402960
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x401252
push str.Cannot_open_archive_file_n
call fcn.00401a80
add esp, 4
xor eax, eax
pop edi
ret
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push 0
push dword [ebp + 4]
call sub.WS2_32.dll_ntohl
add eax, dword [edi + 4]
push eax
push dword [edi]
call fcn.0040a118
add esp, 0xc
push dword [ebp + 8]
call sub.WS2_32.dll_ntohl
push eax
call fcn.00409a8b
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40129a
push str.Could_not_allocate_read_buffer_n
call fcn.00401a80
add esp, 4
xor eax, eax
pop ebp
pop ebx
pop edi
ret
push dword [edi]
push 1
push dword [ebp + 8]
call sub.WS2_32.dll_ntohl
push eax
push ebx
call fcn.00409dae
add esp, 0x10
cmp eax, 1
jae 0x4012ce
push str.Could_not_read_from_file_n
call fcn.00401a80
push ebx
call fcn.00409a86
add esp, 8
xor eax, eax
pop ebp
pop ebx
pop edi
ret
cmp byte [ebp + 0x10], 1
jne 0x401305
push esi
push ebp
push ebx
call fcn.00401030
push ebx
mov esi, eax
call fcn.00409a86
add esp, 0xc
mov ebx, esi
test esi, esi
pop esi
jne 0x401305
lea eax, [ebp + 0x12]
push eax
push str.Error_decompressing__s_n
call fcn.00401a80
add esp, 8
xor eax, eax
pop ebp
pop ebx
pop edi
ret
mov eax, dword [edi]
test eax, eax
je 0x40131a
push eax
call fcn.00409b0c
add esp, 4
mov dword [edi], 0
pop ebp
mov eax, ebx
pop ebx
pop edi
ret