joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401350
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x401366
mov esi, 0x100000
jmp 0x401372
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_VirtualQuery
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x4013af
mov edx, ebx
mov eax, 0x4915e4
call fcn.00401204
test al, al
jne 0x4013af
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4013b4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_VirtualQuery
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4013fe
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_VirtualQuery
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x401426
mov edx, ebx
mov eax, 0x4915e4
call fcn.00401204
test al, al
jne 0x401426
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40142c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x4915e4]
jmp 0x4014ac
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x4014aa
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x4014aa
cmp esi, dword [esp + 8]
jae 0x401479
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x401488
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x4014a3
mov dword [0x4915c0], 1
mov eax, ebx
call fcn.00401234
mov ebx, edi
cmp ebx, 0x4915e4
jne 0x40145b
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x4014dc
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401578
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x4915e4]
jmp 0x4015e7
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x4015bf
mov ebx, dword [esp]
cmp ebp, edi
jae 0x4015c5
mov edi, ebp
cmp edi, ebx
jbe 0x4015e5
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x4015e5
mov dword [0x4915c0], 2
mov esi, dword [esi]
cmp esi, 0x4915e4
jne 0x4015af
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401f24
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4915bc], 0
jne 0x401f41
call fcn.00401838
test al, al
je 0x401f49
cmp ebx, 0x7ffffff8
jle 0x401f53
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4020a7
xor ecx, ecx
push ebp
push 0x4020a0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x491045], 0
je 0x401f74
push 0x4915c4
call sub.KERNEL32.DLL_LocalAlloc
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401f84
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402023
mov eax, ebx
test eax, eax
jns 0x401f99
add eax, 3
sar eax, 2
mov edx, dword [0x49161c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402023
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401fd4
mov eax, ebx
test eax, eax
jns 0x401fc3
add eax, 3
sar eax, 2
mov ecx, dword [0x49161c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401ffa
mov ecx, ebx
test ecx, ecx
jns 0x401fdd
add ecx, 3
sar ecx, 2
mov edi, dword [0x49161c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4915ac]
sub ebx, 4
add dword [0x4915b0], ebx
call fcn.00403100
jmp 0x4020a7
cmp ebx, dword [0x491614]
jg 0x402075
sub dword [0x491614], ebx
cmp dword [0x491614], 0xc
jge 0x402047
add ebx, dword [0x491614]
xor eax, eax
mov dword [0x491614], eax
mov eax, dword [0x491618]
add dword [0x491618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4915ac]
sub ebx, 4
add dword [0x4915b0], ebx
call fcn.00403100
jmp 0x4020a7
mov eax, ebx
call fcn.00401e30
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4020a7
cmp byte [0x491045], 0
je 0x40209f
push 0x4915c4
call sub.KERNEL32.DLL_TlsGetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4020b4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4915c0], eax
cmp byte [0x4915bc], 0
jne 0x4020ec
call fcn.00401838
test al, al
jne 0x4020ec
mov dword [0x4915c0], 8
mov dword [ebp - 4], 8
jmp 0x40224d
xor ecx, ecx
push ebp
push 0x402246
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x491045], 0
je 0x40210d
push 0x4915c4
call sub.KERNEL32.DLL_LocalAlloc
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402128
mov dword [0x4915c0], 9
jmp 0x40221d
dec dword [0x4915ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4915b0], eax
test bl, 1
je 0x402188
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402158
test edx, 0x80000003
je 0x402167
mov dword [0x4915c0], 0xa
jmp 0x40221d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40217f
mov dword [0x4915c0], 0xa
jmp 0x40221d
add ebx, edx
mov esi, eax
call fcn.004019dc
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x491618]
jne 0x4021c8
sub dword [0x491618], ebx
add dword [0x491614], ebx
cmp dword [0x491614], 0x3c00
jle 0x4021b9
call fcn.00401ccc
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403100
jmp 0x40224d
mov edx, dword [eax]
test dl, 2
je 0x4021eb
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4021e6
mov dword [0x4915c0], 0xb
jmp 0x40221d
or dword [eax], 1
jmp 0x402214
mov eax, edi
cmp dword [eax + 4], 0
je 0x4021fe
cmp dword [eax], 0
je 0x4021fe
cmp dword [eax + 8], 0xc
jge 0x40220a
mov dword [0x4915c0], 0xb
jmp 0x40221d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.004019dc
mov edx, ebx
mov eax, esi
call fcn.00401c44
mov eax, dword [0x4915c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40224d
cmp byte [0x491045], 0
je 0x402245
push 0x4915c4
call sub.KERNEL32.DLL_TlsGetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x403cac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x403e40
call sub.KERNEL32.DLL_DeleteCriticalSection
mov esi, eax
test esi, esi
je 0x403d14
push 0x403e50
push esi
call sub.KERNEL32.DLL_EnumCalendarInfoA
mov ebx, eax
test ebx, ebx
je 0x403d14
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x403d14
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
jmp 0x403e36
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x403d54
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x403e36
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00403c98
mov esi, eax
cmp byte [esi], 0
je 0x403e36
lea eax, [esi + 1]
call fcn.00403c98
mov esi, eax
cmp byte [esi], 0
je 0x403e36
jmp 0x403d5a
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
jmp 0x403e19
lea eax, [esi + 1]
call fcn.00403c98
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x403e36
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
cmp esi, 0xffffffff
je 0x403e36
push esi
call sub.KERNEL32.DLL_LocalFree
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x403e36
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x403d78
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e64
Capabilities:
Get disk size
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_LeaveCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404094
push 0x80000001
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x403ee7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404094
push 0x80000002
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x403ee7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4040b0
push 0x80000001
call sub.user32.dll_GetKeyboardType
test eax, eax
jne 0x403f70
xor eax, eax
push ebp
push 0x403f69
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403cac
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_CharToOemA
test eax, eax
je 0x403f4e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4040d0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_CharToOemA
test eax, eax
je 0x403f4e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f70
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetCPInfo
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40408a
cmp byte [ebp - 0xd], 0
jne 0x403fb7
cmp byte [ebp - 0x12], 0
je 0x40408a
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403fd0
dec ebx
cmp byte [ebx], 0x2e
je 0x403fdf
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403fcf
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40408a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40401c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, eax
test esi, esi
jne 0x40408a
cmp byte [ebp - 0xd], 0
je 0x40408a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, eax
test esi, esi
jne 0x40408a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403940
xor eax, eax
push ebp
push 0x407d85
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403868
mov esi, eax
test esi, esi
jle 0x407d64
mov ebx, 1
lea eax, [ebp - 4]
call fcn.004039a0
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor edx, edi
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x407d4a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403648
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d8c
lea eax, [ebp - 4]
call fcn.004035f4
ret

Function at 0x407d94
Capabilities:
Encode data using xor

Disassembly:
inc edx
test edx, edx
jl 0x407da0
inc edx
xor byte [eax], cl
inc eax
dec edx
jne 0x407d9a
ret
Function at 0x402d34
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40a008], 0x8088405
inc edx
mov dword [ebx + 0x40a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406ca8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x406dbb
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov dword [ebp - 4], eax
mov ebx, 1
mov esi, 0x40b6a4
mov edi, 0x40b6d4
push ebp
push 0xb
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x40a134
mov edx, ebx
dec edx
lea eax, [ebx + 0x44]
dec eax
call fcn.00406c6c
pop ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403dc8
push ebp
push 0xb
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x40a164
mov edx, ebx
dec edx
lea eax, [ebx + 0x38]
dec eax
call fcn.00406c6c
pop ecx
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00403dc8
inc ebx
add edi, 4
add esi, 4
cmp ebx, 0xd
jne 0x406cdb
mov ebx, 1
mov esi, 0x40b704
mov edi, 0x40b720
lea eax, [ebx + 5]
mov ecx, 7
cdq
idiv ecx
mov dword [ebp - 8], edx
push ebp
push 6
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x40a194
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x31
call fcn.00406c6c
pop ecx
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00403dc8
push ebp
push 6
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x40a1b0
mov edx, ebx
dec edx
mov eax, dword [ebp - 8]
add eax, 0x2a
call fcn.00406c6c
pop ecx
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00403dc8
inc ebx
add edi, 4
add esi, 4
cmp ebx, 8
jne 0x406d3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406dc2
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403d98
ret

Function at 0x406e80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push esi
xor eax, eax
push ebp
push 0x406f17
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov ecx, 0x406f2c
mov edx, 0x100b
call fcn.00406bf8
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.00405eb4
mov esi, eax
mov eax, esi
add eax, 0xfffffffd
sub eax, 3
jae 0x406f01
push 4
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
push eax
push 0x406dcc
call sub.KERNEL32.DLL_VirtualFree
mov edx, 7
mov eax, 0x40b768
mov dword [eax], 0xffffffff
add eax, 4
dec edx
jne 0x406ee2
push 3
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
push eax
push 0x406e08
call sub.KERNEL32.DLL_VirtualFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f1e
lea eax, [ebp - 4]
call fcn.00403d74
ret
Function at 0x406f30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4070fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
mov eax, edi
call fcn.00403d74
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov ecx, 0x407110
mov edx, 0x1009
call fcn.00406bf8
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00405eb4
add eax, 0xfffffffd
sub eax, 3
jb 0x4070d0
mov eax, dword [0x40b740]
sub eax, 4
je 0x406fa2
add eax, 0xfffffff3
sub eax, 2
jb 0x406fa2
xor eax, eax
jmp 0x406fa4
mov al, 1
test al, al
je 0x406fdd
jmp 0x406fcd
mov al, byte [esi + ebx - 1]
sub al, 0x47
je 0x406fcc
sub al, 0x20
je 0x406fcc
lea eax, [ebp - 0xc]
mov dl, byte [esi + ebx - 1]
call fcn.00403f40
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00403ff0
inc ebx
mov eax, esi
call fcn.00403fe8
cmp ebx, eax
jle 0x406faa
jmp 0x4070df
mov eax, edi
mov edx, esi
call fcn.00403dc8
jmp 0x4070df
mov al, byte [esi + ebx - 1]
and eax, 0xff
bt dword [0x40a0ec], eax
jae 0x40702b
mov edx, ebx
mov eax, esi
call fcn.00407cb8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.004041e4
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00403ff0
add ebx, dword [ebp - 4]
jmp 0x4070d0
mov edx, 0x407114
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.00406148
test eax, eax
jne 0x407051
mov eax, edi
mov edx, 0x407120
call fcn.00403ff0
inc ebx
jmp 0x4070cf
mov edx, 0x407124
lea eax, [esi + ebx - 1]
mov ecx, 4
call fcn.00406148
test eax, eax
jne 0x407079
mov eax, edi
mov edx, 0x407134
call fcn.00403ff0
add ebx, 3
jmp 0x4070cf
mov edx, 0x40713c
lea eax, [esi + ebx - 1]
mov ecx, 2
call fcn.00406148
test eax, eax
jne 0x40709f
mov eax, edi
mov edx, 0x407148
call fcn.00403ff0
inc ebx
jmp 0x4070cf
mov al, byte [esi + ebx - 1]
sub al, 0x59
je 0x4070ab
sub al, 0x20
jne 0x4070b9
mov eax, edi
mov edx, 0x407154
call fcn.00403ff0
jmp 0x4070cf
lea eax, [ebp - 0x14]
mov dl, byte [esi + ebx - 1]
call fcn.00403f40
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00403ff0
inc ebx
mov eax, esi
call fcn.00403fe8
cmp ebx, eax
jle 0x406feb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407101
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403d98
ret
Function at 0x4077c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x407983
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 4]
cmp dword [ebx + 0x14], 0
jne 0x407819
lea edx, [ebp - 4]
mov eax, dword [0x40a420]
call fcn.00404b10
jmp 0x407826
lea edx, [ebp - 4]
mov eax, dword [0x40a3b0]
call fcn.00404b10
mov esi, dword [ebx + 0x18]
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
cmp dword [ebp - 0x10], 0x1000
jne 0x4078f8
push 0x105
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x4078f8
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x148], eax
mov byte [ebp - 0x144], 5
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00403fbc
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00406040
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0xb
mov dword [ebp - 0x130], esi
mov byte [ebp - 0x12c], 5
lea eax, [ebp - 0x148]
push eax
push 3
lea edx, [ebp - 0x154]
mov eax, dword [0x40a3d8]
call fcn.00404b10
mov ecx, dword [ebp - 0x154]
mov dl, 1
mov eax, dword [0x4059e4]
call fcn.004073f0
mov ebx, eax
jmp 0x407952
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x16c], eax
mov byte [ebp - 0x168], 5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x164], eax
mov byte [ebp - 0x160], 0xb
mov dword [ebp - 0x15c], esi
mov byte [ebp - 0x158], 5
lea eax, [ebp - 0x16c]
push eax
push 2
lea edx, [ebp - 0x170]
mov eax, dword [0x40a3b4]
call fcn.00404b10
mov ecx, dword [ebp - 0x170]
mov dl, 1
mov eax, dword [0x4059e4]
call fcn.004073f0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40798a
lea eax, [ebp - 0x170]
call fcn.00403d74
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403d98
lea eax, [ebp - 4]
call fcn.00403d74
ret

Function at 0x407b74
Capabilities:
Get disk information

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetLogicalDrives
test eax, eax
je 0x407bdb
mov eax, dword [esp + 0x10]
mov dword [0x40a0d8], eax
mov eax, dword [esp + 4]
mov dword [0x40a0dc], eax
mov eax, dword [esp + 8]
mov dword [0x40a0e0], eax
cmp dword [0x40a0d8], 1
jne 0x407bbf
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x40a0e4], eax
jmp 0x407bc8
mov eax, dword [esp + 0xc]
mov dword [0x40a0e4], eax
mov eax, 0x40a0e8
lea edx, [esp + 0x14]
mov ecx, 0x80
call fcn.00403fbc
add esp, 0x94
ret