joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov dl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x41d14b
movzx esi, dl
push edi
nop
mov ecx, dword [eax + 0x260]
mov edi, ecx
shr edi, 0x18
shl ecx, 8
xor edi, esi
xor ecx, dword [edi*4 + 0x46d040]
mov dword [eax + 0x260], ecx
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
jl 0x41d120
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x41d1d9
sub ecx, ebx
je 0x41d1bb
sub ecx, ebx
je 0x41d1af
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41e5c3
mov dword [edi], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41e72a
cmp dword [ebp + 0x10], 0
mov dword [esi + 0x13c4], 0
je 0x41e72a
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jl 0x41e72a
cmp byte [esi + 0x1390], 0
jne 0x41e611
test edi, edi
je 0x41e600
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [esi]
push eax
call fcn.0043aac7
add esp, 4
test eax, eax
je 0x41e63b
test edi, edi
je 0x41e62a
mov dword [edi], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test ebx, ebx
jne 0x41e65a
test edi, edi
je 0x41e649
mov dword [edi], 0
pop edi
mov dword [esi + 0x13c4], 0
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1394]
mov dword [esi + 0x1398], ebx
push 0
lea ebx, [esi + 4]
push eax
mov dword [eax], ecx
mov dword [esi + 0x13a8], 0x1388
mov dword [esi + 0x13a4], ebx
call fcn.0041d530
cmp eax, 1
jne 0x41e6f9
jmp 0x41e690
mov eax, dword [esi + 0x13a8]
cmp eax, 0x1388
jae 0x41e6c9
mov edx, dword [esi]
push edx
mov edi, 0x1388
sub edi, eax
push edi
push 1
push ebx
call fcn.0043ac55
add esp, 0x10
cmp edi, eax
jne 0x41e70c
mov eax, dword [esi]
push eax
call fcn.0043aac7
add esp, 4
test eax, eax
jne 0x41e70c
mov edi, dword [ebp + 8]
cmp dword [esi + 0x1398], 0
je 0x41e63f
push 0
lea eax, [esi + 0x1394]
mov dword [esi + 0x13a8], 0x1388
push eax
mov dword [esi + 0x13a4], ebx
call fcn.0041d530
cmp eax, 1
je 0x41e690
test edi, edi
je 0x41e6ff
mov dword [edi], eax
pop edi
mov dword [esi + 0x13c4], eax
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e719
mov dword [eax], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test edi, edi
je 0x41e734
mov dword [edi], 0xfffffffe
test esi, esi
je 0x41e742
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x41e750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x41e76d
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e93c
mov dword [eax], edi
pop edi
pop ebp
ret 0x1c
cmp byte [edi + 0x1390], 0
jne 0x41e792
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e783
mov dword [eax], 0xffffffff
mov dword [edi + 0x13c4], 0xffffffff
pop edi
pop ebp
ret 0x1c
mov eax, dword [edi]
push eax
call fcn.0043aac7
add esp, 4
test eax, eax
je 0x41e7bd
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e7ae
mov dword [eax], 0xfffffffa
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
pop ebp
ret 0x1c
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x41e7ca
mov dword [ecx], 0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x41e7d7
mov dword [eax], 0
push ebx
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x41e7e5
mov dword [ebx], 0
push esi
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x41e7f3
mov dword [esi], 0
cmp dword [ebp + 0x10], 0
jne 0x41e8de
cmp dword [edi + 0x13c4], 0
jne 0x41e87e
jmp 0x41e810
lea eax, [edi + 4]
mov dword [edi + 0x13a4], eax
push 2
lea eax, [edi + 0x1394]
mov esi, 0x1388
push eax
mov dword [edi + 0x13a8], esi
call fcn.0041d530
mov ebx, eax
cmp ebx, 3
je 0x41e842
cmp ebx, 4
jne 0x41e8c2
mov eax, dword [edi + 0x13a8]
cmp eax, esi
jae 0x41e873
mov ecx, dword [edi]
push ecx
sub esi, eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0043ac55
add esp, 0x10
cmp esi, eax
jne 0x41e8a4
mov edx, dword [edi]
push edx
call fcn.0043aac7
add esp, 4
test eax, eax
jne 0x41e8a4
cmp ebx, 4
jne 0x41e810
mov esi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x1c]
mov eax, dword [edi]
push eax
call fcn.0043aac7
add esp, 4
test eax, eax
jne 0x41e8d8
mov ecx, dword [edi]
push ecx
call fcn.0043ae55
mov edx, dword [edi]
push edx
call fcn.0043aac7
add esp, 8
test eax, eax
je 0x41e8d8
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e8b1
mov dword [eax], 0xfffffffa
pop esi
pop ebx
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e8cb
mov dword [eax], ebx
pop esi
mov dword [edi + 0x13c4], ebx
pop ebx
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x41e8ea
mov edx, dword [edi + 0x139c]
mov dword [ecx], edx
test eax, eax
je 0x41e8f6
mov ecx, dword [edi + 0x13a0]
mov dword [eax], ecx
test ebx, ebx
je 0x41e902
mov edx, dword [edi + 0x13ac]
mov dword [ebx], edx
test esi, esi
je 0x41e90e
mov eax, dword [edi + 0x13b0]
mov dword [esi], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e91b
mov dword [eax], 0
lea ecx, [edi + 0x1394]
push ecx
mov dword [edi + 0x13c4], 0
call fcn.0041d680
push edi
call fcn.00436f68
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
ret 0x1c
Function at 0x41eb50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0041eb30
mov esi, dword [ebp + 8]
push eax
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__10_December_2007._n_n
call fcn.0043af9f
add eax, 0x40
push eax
call fcn.0043b17b
add esp, 0x10
cmp esi, 0x3ef
jne 0x41eb92
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call fcn.0043af9f
add eax, 0x40
push eax
call fcn.0043b17b
add esp, 8
push 3
call fcn.004385fd
int3
Function at 0x41ed50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
cmp ebx, edx
push edi
je 0x41ed60
mov dword [ebx], edx
mov edi, dword [ebp + 0xc]
cmp edi, edx
je 0x41ef37
mov eax, dword [ebp + 0x10]
cmp eax, edx
mov dword [edi + 0x13c4], edx
je 0x41ef37
mov ecx, dword [ebp + 0x14]
cmp ecx, edx
jl 0x41ef37
cmp byte [edi + 0x1390], dl
je 0x41edab
cmp ebx, edx
je 0x41ed99
mov dword [ebx], 0xffffffff
mov dword [edi + 0x13c4], 0xffffffff
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
cmp ecx, edx
jne 0x41edc3
cmp ebx, edx
je 0x41edb5
mov dword [ebx], edx
mov dword [edi + 0x13c4], edx
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
mov dword [edi + 0x13a4], eax
mov eax, dword [edi]
push esi
push eax
mov dword [edi + 0x13a8], ecx
call fcn.0043aac7
add esp, 4
test eax, eax
jne 0x41ee85
cmp dword [edi + 0x1398], 0
jne 0x41ee34
mov esi, dword [edi]
call fcn.0041e460
test al, al
jne 0x41ee34
mov ecx, dword [edi]
push ecx
push 0x1388
lea esi, [edi + 4]
push 1
push esi
call fcn.0043b566
mov edx, dword [edi]
push edx
mov ebx, eax
call fcn.0043aac7
add esp, 0x14
test eax, eax
jne 0x41eec7
mov dword [edi + 0x138c], ebx
mov dword [edi + 0x1398], ebx
mov ebx, dword [ebp + 8]
mov dword [edi + 0x1394], esi
lea eax, [edi + 0x1394]
push eax
call fcn.0041eba0
test eax, eax
jne 0x41eea2
mov esi, dword [edi]
call fcn.0041e460
test al, al
je 0x41ee65
cmp dword [edi + 0x1398], 0
jne 0x41ee65
cmp dword [edi + 0x13a8], 0
ja 0x41eefc
cmp dword [edi + 0x13a8], 0
je 0x41ef19
mov ecx, dword [edi]
push ecx
call fcn.0043aac7
add esp, 4
test eax, eax
je 0x41ede3
test ebx, ebx
je 0x41ee8f
mov dword [ebx], 0xfffffffa
pop esi
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
cmp eax, 4
jne 0x41eee7
test ebx, ebx
je 0x41eead
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
sub eax, dword [edi + 0x13a8]
pop esi
mov dword [edi + 0x13c4], 4
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ee8f
mov dword [eax], 0xfffffffa
pop esi
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x41eeed
mov dword [ebx], eax
pop esi
mov dword [edi + 0x13c4], eax
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x41ef06
mov dword [ebx], 0xfffffff9
pop esi
mov dword [edi + 0x13c4], 0xfffffff9
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x41ef23
mov dword [ebx], 0
mov eax, dword [ebp + 0x14]
pop esi
mov dword [edi + 0x13c4], 0
pop edi
pop ebx
pop ebp
ret 0x10
cmp ebx, edx
je 0x41ef41
mov dword [ebx], 0xfffffffe
cmp edi, edx
je 0x41ef4f
mov dword [edi + 0x13c4], 0xfffffffe
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x4261dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x44f558
call fcn.0043bfb1
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0043066e
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x426227
call fcn.0043066e
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x426238
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x426245
or eax, 0xffffffff
jmp 0x4263a1
mov ecx, esi
call fcn.00425d23
mov dword [ebp - 0x14], eax
call fcn.00428e64
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x4262c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x4262c3
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4262c3
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00425bd4
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x4262c3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x4262c3
mov ecx, ebx
call fcn.004266af
test eax, eax
je 0x4262c3
push 0
mov ecx, ebx
call fcn.004266ca
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0042a6ec
push dword [ebp - 0x14]
call fcn.00428dbc
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00425fe4
xor edi, edi
cmp eax, edi
je 0x426320
test byte [esi + 0x3c], 0x10
je 0x42630a
push 4
pop edi
mov ecx, esi
call fcn.00426596
test ax, 0x100
je 0x426300
push 5
pop edi
push edi
mov ecx, esi
call fcn.00428984
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x426320
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00426731
or dword [ebp - 4], 0xffffffff
jmp 0x42634b
cmp dword [ebp - 0x28], edi
je 0x426359
push 1
mov ecx, ebx
call fcn.004266ca
cmp dword [ebp - 0x2c], edi
je 0x426369
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x426382
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x426382
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00425d5d
cmp dword [esi + 0x58], edi
je 0x42639e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0043c057
ret
Function at 0x42640b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x42642b
cmp dword [edi + 0x54], 0
jne 0x42642b
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0043066e
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004263d2
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x429ddb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x429e14
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00409e2b
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00405628
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x42b32c
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x45b10c
mov ecx, edi
call fcn.0040166a
cmp dword [esi + 0x4c], 0
push dword [esp + 0xc]
jne 0x42b37f
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x42b392
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00409e2b
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00405628
jmp 0x42b392
mov ecx, esi
call fcn.004264d6
test eax, eax
je 0x42b392
push edi
mov ecx, eax
call fcn.00429ddb
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
pop edi
pop esi
ret 8

Function at 0x42b876
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x42b8b9
call fcn.0043066e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42b8b9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42b8d4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0042b430
test ebx, ebx
mov esi, eax
je 0x42b8d2
test edi, edi
je 0x42b8d2
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4323dc
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x46ed08]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
cmp dword [ebp + 0x200], 0x800
mov eax, dword [ebp + 0x1fc]
push esi
mov dword [ebp - 0x40], eax
mov esi, ecx
lea eax, [ebp + 0x1e8]
jne 0x43247a
push 0x4581ac
push 4
push eax
call fcn.00437dff
push eax
call fcn.00401616
add esp, 0x10
push ebx
push edi
call fcn.0043c346
mov edi, dword [eax]
call fcn.0043c346
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp + 0x1e8]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0043c2ec
add esp, 0x18
mov dword [ebp - 0x40], eax
call fcn.0043c346
cmp dword [eax], ebx
je 0x432491
call fcn.0043c346
push dword [eax]
call fcn.00418780
pop ecx
jmp 0x432498
push 4
push eax
push 3
push dword [ebp + 0x200]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x43242b
jmp 0x43250a
call fcn.0043c346
mov dword [eax], edi
cmp dword [ebp - 0x40], 0xffffffff
je 0x432506
cmp dword [ebp - 0x40], esi
jae 0x432506
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.00436bb0
add esp, 0xc
push 0x4577d0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4324f8
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4324f8
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4324f8
push ebx
push ebx
push esi
jmp 0x4324fe
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x432508
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x1f0]
xor ecx, ebp
pop esi
call fcn.00436b27
add ebp, 0x1f4
leave
ret
Function at 0x436b27
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46ed08]
jne 0x436b31
repz ret
jmp fcn.00441048
Function at 0x43b2ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x43b307
cmp dword [ebp + 0x14], edi
je 0x43b307
cmp ecx, edi
jne 0x43b30e
call fcn.0043c346
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0043e9ea
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x43b322
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x43b343
cmp ebx, 0xffffffff
je 0x43b332
push ebx
push edi
push ecx
call fcn.00436bb0
add esp, 0xc
cmp esi, edi
je 0x43b2ef
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x43b2ef
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43b35f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x43b366
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x43b457
test word [esi + 0xc], 0x10c
je 0x43b3ba
mov eax, dword [esi + 4]
test eax, eax
je 0x43b3ba
jl 0x43b4b8
cmp ebx, eax
mov edi, ebx
jb 0x43b38b
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43b45f
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00436aac
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43b44f
cmp ebx, dword [ebp - 0xc]
jb 0x43b427
cmp dword [ebp - 0xc], 0
je 0x43b3e4
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x43b3d9
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x43b3e0
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x43b3ef
mov eax, SysReAllocString
cmp ebx, eax
ja 0x43b3ef
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x43b48b
push eax
push dword [ebp - 8]
push esi
call fcn.0043c86a
pop ecx
push eax
call fcn.00446e9a
add esp, 0xc
test eax, eax
je 0x43b4ca
cmp eax, 0xffffffff
je 0x43b4b8
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43b44f
push esi
call fcn.00445026
cmp eax, 0xffffffff
pop ecx
je 0x43b4bc
cmp dword [ebp - 4], 0
je 0x43b48b
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43b36e
mov eax, dword [ebp + 0x14]
jmp 0x43b309
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43b476
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00436bb0
add esp, 0xc
call fcn.0043c346
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x43b2ff
cmp dword [ebp + 0xc], 0xffffffff
je 0x43b4a1
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00436bb0
add esp, 0xc
call fcn.0043c346
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x43b2ff
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43b309
or dword [esi + 0xc], 0x10
jmp 0x43b4bc
Function at 0x43d657
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x46ee90]
je 0x43d672
inc edi
cmp edi, 0x17
jb 0x43d663
cmp edi, 0x17
jae 0x43d7f2
push ebp
push 3
call fcn.00449e0f
cmp eax, 1
pop ecx
je 0x43d7be
push 3
call fcn.00449e0f
test eax, eax
pop ecx
jne 0x43d6a6
cmp dword [0x46e9d8], 1
je 0x43d7be
cmp ebx, 0xfc
je 0x43d7f1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x472cf0
push ebp
call fcn.00449daa
add esp, 0xc
test eax, eax
je 0x43d6dc
push esi
push esi
push esi
push esi
push esi
call fcn.0043e8ee
add esp, 0x14
push 0x104
mov esi, 0x472d09
push esi
push 0
mov byte [0x472e0d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43d720
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00449daa
add esp, 0xc
test eax, eax
je 0x43d720
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0043e8ee
add esp, 0x14
push esi
call fcn.00437b30
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43d765
push esi
call fcn.00437b30
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x473004
push 0x45961c
sub ecx, eax
push ecx
push eax
call fcn.00449cf7
add esp, 0x14
test eax, eax
je 0x43d765
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0043e8ee
add esp, 0x14
jmp 0x43d767
xor esi, esi
push 0x459618
push ebx
push ebp
call fcn.00449c86
add esp, 0xc
test eax, eax
je 0x43d787
push esi
push esi
push esi
push esi
push esi
call fcn.0043e8ee
add esp, 0x14
push dword [edi*8 + 0x46ee94]
push ebx
push ebp
call fcn.00449c86
add esp, 0xc
test eax, eax
je 0x43d7a9
push esi
push esi
push esi
push esi
push esi
call fcn.0043e8ee
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00449ac9
add esp, 0xc
jmp 0x43d7f1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x43d7f1
cmp ebp, 0xffffffff
je 0x43d7f1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46ee94]
push dword [esi]
call fcn.00437b30
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret