joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e567
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x452e45
call fcn.00435b4e
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0041e8f6
call fcn.00407aa7
push eax
lea ecx, [ebp - 0x94]
call fcn.0040aeab
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00407aad
mov ecx, eax
call fcn.0040b594
test al, al
je 0x41e67d
push ebx
lea ecx, [ebp - 0x94]
call fcn.0040b0a1
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea ecx, [ebp - 0x94]
call fcn.0040b436
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x41e5ee
push str.Error_opening_file
jmp 0x41e75e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x41e6f7
cmp edi, 0x400000
ja 0x41e708
and dword [ebp - 0x2c8], 0
push edi
call fcn.0043553b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x41e666
push ebx
call fcn.00435088
pop ecx
mov ecx, esi
call fcn.0041e8f6
push 0
push str.Could_not_read_file
jmp 0x41e75e
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0041e7a9
push dword [ebp - 0x2cc]
jmp 0x41e78c
call fcn.00407aad
push eax
lea ecx, [ebp - 0x94]
call fcn.0040b084
call fcn.00407b79
test al, al
je 0x41e69e
call fcn.00407ab3
jmp 0x41e6b5
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0040b436
push eax
call fcn.0041999a
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x41e6c6
push eax
push str.Error_opening_zip_file
jmp 0x41e75e
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.004193db
add esp, 0x14
test eax, eax
je 0x41e6ed
push 0
push str.Could_not_find_ziped_file
jmp 0x41e75e
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x41e700
push 0
push str.File_is_empty
jmp 0x41e75e
cmp ebx, 0x400000
jbe 0x41e711
push 0
push str.File_too_large
jmp 0x41e75e
push ebx
call fcn.0043553b
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.00419d5a
add esp, 0x18
test eax, eax
je 0x41e769
cmp eax, 0x600
je 0x41e769
push dword [ebp - 0x2c8]
call fcn.00435088
pop ecx
call fcn.00407b79
test al, al
jne 0x41e757
push edi
call fcn.00419235
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0041e91e
mov bl, al
jmp 0x41e794
call fcn.00407b79
test al, al
jne 0x41e779
push edi
call fcn.00419235
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0041e7a9
push edi
mov bl, al
call fcn.00435088
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0040af8f
mov al, bl
call fcn.00435b09
ret 8
Function at 0x424b8a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x424bae
cmp dword [esi + 8], edi
jge 0x424ba6
push esi
call fcn.00422e80
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x424bd7
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x424bba
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x424bf4
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x424be2
xor eax, eax
jmp 0x424bea
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x424bd9
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x424c29
push str.zlib_corrupt
call fcn.00422d3b
add esp, 4
jmp 0x424c66
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x424c39
push str.read_past_buffer
jmp 0x424c1f
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x424c50
push edi
push esi
call fcn.00422d4a
pop ecx
pop ecx
test eax, eax
je 0x424c66
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00438bd0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x432c41
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x46c2f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x432cae
cmp dword [esi + 0x10], 0
je 0x432cae
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00435bc0
mov ebx, esp
test ebx, ebx
je 0x432cae
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1c4
call fcn.0040b02d
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00409984
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043503f
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ed6d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x40eae0
add edi, eax
call fcn.0040ed9b
xor dword [esi], edx
inc esi
and eax, eax
sub edi, 0x457ff9fb
cmp esi, ecx
jne fcn.0040ed6d
add edi, 0x4ac27f93
ret
Function at 0x40c5a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x449490], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x44948c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x449490], edx
cmp eax, 0x26f
jl 0x40c5a8
mov dword [0x43bd30], 0x270
ret

Function at 0x40c5e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x449494]
mov ebx, dword [eax*4 + 0x449490]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x449ac4]
mov dword [eax*4 + 0x449490], edx
cmp eax, 0xe2
jl 0x40c5e8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x449494]
mov ebx, dword [eax*4 + 0x449490]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x449104]
mov dword [eax*4 + 0x449490], edx
cmp eax, 0x26e
jl 0x40c638
mov edx, dword [0x449490]
mov ecx, dword [0x449e4c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x449ac0]
mov dword [0x449e4c], eax
mov dword [0x43bd30], 0
pop ebx
ret

Function at 0x40c6c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x43bd30]
add dword [0x43bd30], 1
mov eax, dword [0x448030]
cmp eax, dword [0x43b480]
jne 0x40c6e3
cmp ebx, 0x271
jb 0x40c704
mov eax, dword [0x448030]
call fcn.0040c5a0
not dword [0x448030]
mov eax, dword [0x448030]
mov dword [0x43b480], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40c720
call fcn.0040c5e0
xor ebx, ebx
mov dword [0x43bd30], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x449490]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x40e230
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x43b210]
cmp ax, 0xcb
je 0x40e33c
cmp ax, 0xcc
je 0x40e33c
lea esi, [esi]
mov edx, dword [0x44a090]
test edx, edx
je 0x40e265
mov eax, dword [0x449f40]
call edx
mov ebx, eax
jmp 0x40e26a
mov ebx, 0x449f44
cmp word [0x449f30], 0
jle 0x40e290
mov eax, 0x449f10
call fcn.0040e4a0
mov eax, ebx
call fcn.0040ddf0
mov eax, ebx
call fcn.0040de60
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40e2b2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40e2ad
mov edx, edi
mov eax, ebx
call fcn.0040d260
jmp 0x40e2b0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40e298
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x449f30], 0
jle 0x40e33c
mov edx, 0x449e50
mov eax, ebx
call fcn.0040d3a0
mov edi, eax
test edi, edi
je 0x40e30c
mov eax, dword [0x449ee4]
mov dword [edi + 0xc], eax
cmp dword [0x449ee4], 0
je 0x40e300
mov eax, dword [0x449ee4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x449ee4], eax
nop
sub word [0x449f30], 1
cmp word [0x449f30], 0
sete bl
mov eax, 0x449f10
call fcn.0040e4c0
test bl, bl
je 0x40e33c
mov eax, 0x449f10
call fcn.0040e490
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x410aa0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x449270], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00410c80
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x449270]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402270
call sub.kernel32.dll_GetCommandLineA
mov dword [0x43b280], eax
mov ebx, eax
jmp 0x410c43
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x410b28
cmp byte [ebx], 0
je 0x410c4c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x410ba3
mov al, byte [ebx]
cmp al, 1
jb 0x410b98
sub al, 0x20
jbe 0x410b68
sub al, 2
je 0x410b7c
jmp 0x410b98
mov al, byte [ebp - 0x114]
test al, al
je 0x410ba8
add dword [ebp - 0x110], 1
jmp 0x410ba0
cmp byte [ebx + 1], 0x22
je 0x410b93
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x410ba0
add ebx, 1
jmp 0x410ba0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x410b58
test dword [ebp - 0x10c], 0xffffffff
je 0x410c3c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00410c80
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x449270]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x410c33
mov al, byte [ebx]
cmp al, 1
jb 0x410c28
sub al, 0x20
jbe 0x410bf8
sub al, 2
je 0x410c0c
jmp 0x410c28
mov al, byte [ebp - 0x114]
test al, al
je 0x410c38
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x410c30
cmp byte [ebx + 1], 0x22
je 0x410c23
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x410c30
add ebx, 1
jmp 0x410c30
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x410be8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x410b2b
mov ebx, dword [ebp - 0x10c]
mov dword [0x449260], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x449270
call fcn.0040e070
mov eax, dword [0x449270]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4144a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov dx, 0xffff
lea esi, [esi]
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x4144d1
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x4144d3
shr ecx, 1
cmp bx, 8
jl 0x4144b8
movzx eax, dx
mov dword [eax*4 + 0x46bd50], ecx
cmp dx, 0xff
jl 0x4144a8
pop ebx
ret

Function at 0x4144f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x46bd54], 0
jne 0x414508
call fcn.004144a0
nop
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x41453c
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x46bd50]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x414518
mov esi, esi
not eax
pop edi
pop esi
pop ebx
ret
Function at 0x415650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00415640
push ebp
push 0x411900
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x415760
mov al, byte [ebp - 0x110]
test al, al
je 0x415729
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403840
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00407b90
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004088a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x4156ba
mov ecx, ebp
call fcn.004117c0
jmp 0x415760
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x415729
mov ecx, ebp
call fcn.004117c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x415824
mov al, byte [ebp - 0x110]
test al, al
je 0x4157ed
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403840
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00407b90
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004088a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x41577e
mov ecx, ebp
call fcn.004117c0
jmp 0x415824
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x4157ed
mov ecx, ebp
call fcn.004117c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00415380
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00415640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4156ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00415640
push ebp
push 0x411900
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x415760
mov al, byte [ebp - 0x110]
test al, al
je 0x415729
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403840
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00407b90
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004088a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x4156ba
mov ecx, ebp
call fcn.004117c0
jmp 0x415760
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x415729
mov ecx, ebp
call fcn.004117c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x415824
mov al, byte [ebp - 0x110]
test al, al
je 0x4157ed
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403840
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00407b90
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004088a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x41577e
mov ecx, ebp
call fcn.004117c0
jmp 0x415824
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x4157ed
mov ecx, ebp
call fcn.004117c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00415380
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00415640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x415729
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00415640
push ebp
push 0x411900
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x415760
mov al, byte [ebp - 0x110]
test al, al
je 0x415729
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403840
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00407b90
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004088a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x4156ba
mov ecx, ebp
call fcn.004117c0
jmp 0x415760
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x415729
mov ecx, ebp
call fcn.004117c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x415824
mov al, byte [ebp - 0x110]
test al, al
je 0x4157ed
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403840
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00407b90
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004088a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x41577e
mov ecx, ebp
call fcn.004117c0
jmp 0x415824
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43ecd0
call fcn.00429c60
mov edx, 0x4157ed
mov ecx, ebp
call fcn.004117c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00415380
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00415640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42ab40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.0042ab30
push ebp
push 0x411900
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x42abb0
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.00409830
cmp ebx, 1
jle 0x42aba0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.004093a0
jmp 0x42abbb
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407310
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0042ab30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42afc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0042afb0
push ebp
push 0x411900
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x46c4dc]
xor edx, edx
call fcn.00407310
mov dword [ebx*4 + 0x46c4fc], 0xffffffff
cmp ebx, 7
jl 0x42afe8
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x42b074
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00407d00
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.004228c0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x42b074
push 4
push ebx
push esi
mov eax, 0x42ae90
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x42af20
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042afb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret