joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401fe0
Capabilities:
Get common file path
Move file
Read .ini file

Disassembly:
jmp 0x401fe0
mov eax, 0x10210
call fcn.0041be90
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x1020c], eax
mov eax, dword [esp + 0x10218]
push ebp
mov ebp, dword [esp + 0x10218]
test ebp, ebp
mov dword [esp + 4], eax
jne 0x402027
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1020c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10210
ret
test eax, eax
je 0x40200f
push ebx
xor ebx, ebx
cmp dword [0x44fe24], 3
jl 0x40204e
push 5
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
jmp 0x402119
push esi
push edi
push 0xfffe
lea esi, [esp + 0x220]
mov eax, esi
push 0
push eax
call fcn.0041be10
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.WinInit.ini
lea edx, [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x14]
push eax
push 0x7fff
mov ecx, esi
push ecx
push 0x435c10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp word [esp + 0x21c], bx
je 0x4020c0
lea ecx, [ecx]
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x4020b0
cmp word [esi], bx
jne 0x4020b0
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x435c0c
push esi
call edi
push ebp
push esi
call edi
jmp 0x4020e0
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x4020e0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x220]
push eax
push 0x435c10
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
mov ecx, dword [esp + 0x10214]
mov eax, ebx
pop ebx
pop ebp
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10210
ret
Function at 0x4027a0
Capabilities:
Get common file path
Get installed programs

Disassembly:
jmp 0x4027a0
sub esp, 0x670
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x66c], eax
mov eax, dword [esp + 0x674]
push esi
xor esi, esi
push 0x208
lea ecx, [esp + 0x264]
push esi
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call fcn.0041be10
push 0x208
lea edx, [esp + 0x478]
push esi
push edx
call fcn.0041be10
push 0x250
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.0041be10
add esp, 0x24
lea ecx, [esp + 0x468]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x402830
pop esi
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x670
ret
push ebx
push ebp
push edi
push 0x479448
lea edx, [esp + 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402860
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x478]
push ecx
call ebp
cmp eax, 0xffffffff
je 0x402886
push eax
call edi
push 0x3e8
add esi, 1
call ebx
cmp esi, 0x3c
jl 0x402860
cmp esi, 0x3c
je 0x402893
mov dword [esp + 0x14], 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edx, [esp + 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x10]
push edx
push 0x20019
xor edi, edi
push edi
lea eax, [esp + 0x278]
push eax
push 0x80000002
call esi
test eax, eax
je 0x402906
cmp dword [0x44fe24], 5
jl 0x402915
lea edx, [esp + 0x10]
push edx
push 0x20119
push edi
lea eax, [esp + 0x278]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x402915
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x67c]
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0x670
ret

Function at 0x403350
Capabilities:
Write file on windows

Disassembly:
jmp 0x403350
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x403388
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
add esp, 0xc
cmp dword [esp + 0x424], 1
push 0xa
push 0xd
push esi
jne 0x4033bf
push str.FILEREGI__s__1c_1c
lea ecx, [esp + 0x18]
push ecx
jmp 0x4033c9
push str.FILE__s__1c_1c
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
mov eax, dword [0x486308]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret
Function at 0x403450
Capabilities:
Write file on windows

Disassembly:
jmp 0x403450
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x403488
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
mov eax, dword [0x478bf8]
push 0xa
push 0xd
add eax, 1
push esi
push eax
lea ecx, [esp + 0x24]
push str.FOLDER_d___s__1c_1c
push ecx
mov dword [0x478bf8], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
push 0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x486308]
add eax, eax
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret

Function at 0x403540
Capabilities:
Write file on windows

Disassembly:
jmp 0x403540
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
mov ebx, dword [esp + 0x428]
push esi
mov esi, dword [esp + 0x424]
test esi, esi
push edi
mov edi, dword [esp + 0x42c]
jne 0x40358a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
test edi, edi
je 0x403570
test ebx, ebx
je 0x403570
push 0x410
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.0041be10
push 0xa
push 0xd
push ebx
push edi
push esi
lea ecx, [esp + 0x30]
push str.REGI_s___s____s__1c_1c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x486308]
add eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x420]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
add eax, 1
call fcn.0041bdf4
add esp, 0x418
ret
Function at 0x403640
Capabilities:
Write file on windows

Disassembly:
jmp 0x403640
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
push edi
mov edi, dword [esp + 0x428]
jne 0x403681
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
test edi, edi
je 0x403668
push 0x410
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.0041be10
mov eax, dword [0x478e28]
push 0xa
push 0xd
push edi
add eax, 1
push esi
push eax
lea ecx, [esp + 0x2c]
push str.REGIFLDR_d__s___s__1c_1c
push ecx
mov dword [0x478e28], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x486308]
add eax, eax
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x41c]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
add eax, 1
call fcn.0041bdf4
add esp, 0x418
ret

Function at 0x4039e0
Capabilities:
Create process on windows

Disassembly:
jmp 0x4039e0
sub esp, 0x260
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x25c], eax
push esi
mov esi, dword [esp + 0x268]
test esi, esi
jne 0x403a18
xor eax, eax
pop esi
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x260
ret
push 0x208
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.0041be10
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call fcn.0041be10
push 0x44f400
lea edx, [esp + 0x74]
push 0x104
push edx
call fcn.0041c22f
push 0x435bfc
lea eax, [esp + 0x80]
push 0x104
push eax
call fcn.0041c1b5
push esi
lea ecx, [esp + 0x8c]
push 0x104
push ecx
call fcn.0041c1b5
push 0x435c6c
lea edx, [esp + 0x98]
push 0x104
push edx
call fcn.0041c1b5
add esp, 0x48
push 0x435c70
lea eax, [esp + 0x5c]
push 0x104
push eax
call fcn.0041c1b5
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
push eax
call esi
mov ecx, dword [esp + 0x260]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x260
ret
Function at 0x405060
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
jmp 0x405060
sub esp, 0x468
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x464], eax
xor eax, eax
cmp dword [esp + 0x46c], eax
push esi
mov esi, dword [esp + 0x474]
je 0x405284
test esi, esi
je 0x405284
push edi
push 0x44c
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
lea eax, [esp + 0x28]
push eax
call fcn.0041be10
push esi
lea ecx, [esp + 0x30]
push 0x226
push ecx
call fcn.0041c22f
xor edi, edi
add esp, 0x18
cmp word [esp + 0x20], di
je 0x405136
lea edx, [esp + 0x20]
lea ecx, [ecx]
mov ax, word [edx]
cmp ax, word [0x450440]
jne 0x405127
mov eax, 0x450440
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4050f4
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x10]
push 0xb
push ecx
call fcn.0041c29b
lea edx, [esp + 0x18]
push 0x450440
push edx
call fcn.0041c5e7
add esp, 0x18
test eax, eax
je 0x405136
add edi, 1
cmp word [esp + edi*2 + 0x20], 0
lea edx, [esp + edi*2 + 0x20]
jne 0x4050e0
cmp word [esp + edi*2 + 0x20], 0
je 0x405157
mov eax, 0x450440
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405146
sub eax, edx
sar eax, 1
add edi, eax
cmp word [esp + edi*2 + 0x20], 0
lea eax, [esp + edi*2 + 0x20]
je 0x40517e
mov word [eax], 0
push 0
lea eax, [esp + 0x24]
push eax
push 0x450440
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x405197
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x464]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x468
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
lea ecx, [esp + 0x24]
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and eax, 0xfffffffe
push eax
lea edx, [esp + 0x28]
push edx
call ebx
xor esi, esi
cmp word [esp + 0x24], si
je 0x40521f
push ebp
mov bp, word [0x450440]
lea eax, [esp + 0x28]
jmp 0x4051d0
cmp word [eax], bp
jne 0x40520f
mov ecx, 0x450440
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405206
test dx, dx
je 0x405202
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405206
add eax, 4
add ecx, 4
test dx, dx
jne 0x4051e0
xor eax, eax
jmp 0x40520b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40521e
add esi, 1
cmp word [esp + esi*2 + 0x28], 0
lea eax, [esp + esi*2 + 0x28]
jne 0x4051d0
pop ebp
push 0x479448
lea eax, [esp + 0x28]
push 0x226
push eax
mov word [esp + esi*2 + 0x30], 0
call fcn.0041c1b5
add esp, 0xc
push 0
lea ecx, [esp + 0x28]
push ecx
push 0x479448
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40526b
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x464]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x468
ret
lea edx, [esp + 0x24]
push edx
call edi
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x28]
push eax
call ebx
pop ebx
mov eax, 1
pop edi
mov ecx, dword [esp + 0x468]
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0x468
ret
Function at 0x4054b0
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4054b0
sub esp, 0x230
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
mov edi, dword [esp + 0x23c]
push 0x22c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041be10
add esp, 0xc
push 0
push 2
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x405523
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
lea edx, [esp + 0x34]
push edx
call ebx
test eax, eax
je 0x405581
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x405560
push edi
lea ecx, [esp + 0x34]
push ecx
call ebx
test eax, eax
je 0x405581
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405545
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop ebx
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x230
ret

Function at 0x4058e0
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4058e0
sub esp, 0x230
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x238]
push esi
push edi
push 0x22c
xor edi, edi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0041be10
add esp, 0xc
push edi
push 2
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0xc]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x405955
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push ebx
lea edx, [esp + 0x38]
push edx
call ebp
test eax, eax
jne 0x40596b
lea edi, [eax + 1]
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40599e
lea ebx, [ebx]
push ebx
lea ecx, [esp + 0x38]
push ecx
call ebp
test eax, eax
jne 0x40598f
add edi, 1
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405980
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
Function at 0x4064e0
Capabilities:
Write file on windows

Disassembly:
jmp 0x4064e0
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x406518
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
add esp, 0xc
cmp dword [esp + 0x424], 1
push 0xa
push 0xd
push esi
jne 0x406565
cmp dword [esp + 0x434], 0
je 0x406559
push str.FILEREGI64__s__1c_1c
lea ecx, [esp + 0x18]
push ecx
jmp 0x40656f
push str.FILEREGI__s__1c_1c
lea edx, [esp + 0x18]
push edx
jmp 0x40656f
push str.FILE__s__1c_1c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x486308]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret

Function at 0x406f70
Capabilities:
Get geographical location

Disassembly:
jmp 0x406f70
sub esp, 0x18
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
xor eax, eax
push edi
push 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edi, edi
mov esi, 0x447dc0
mov eax, dword [esi]
lea ecx, [esi - 0x14]
lea eax, [esp + eax*2 + 8]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406fe6
test dx, dx
je 0x406fe2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406fe6
add eax, 4
add ecx, 4
test dx, dx
jne 0x406fc0
xor eax, eax
jmp 0x406feb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407013
add esi, 0x21c
add edi, 1
cmp esi, 0x44b060
jl 0x406fb1
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x18
ret
mov ecx, dword [0x46b144]
imul edi, edi, 0x21c
imul ecx, ecx, 0xb0
mov eax, dword [ecx + 0x4478bc]
and eax, dword [edi + 0x447da8]
mov ecx, dword [esp + 0x1c]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x18
ret
Function at 0x407590
Capabilities:
Get geographical location

Disassembly:
jmp 0x407590
sub esp, 0xc
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
test esi, esi
je 0x407626
push ebx
push edi
push 6
mov dword [esp + 0x10], eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x10]
push eax
push 0x5a
push 0x800
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, dword [esp + 0x20]
test ebx, ebx
jle 0x407622
add esi, 0x202
jmp 0x4075e0
mov ecx, esi
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40760c
test dx, dx
je 0x407608
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40760c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4075e6
xor eax, eax
jmp 0x407611
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407636
add edi, 1
add esi, 0x216
cmp edi, ebx
jl 0x4075e0
pop edi
xor eax, eax
pop ebx
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc
ret
Function at 0x4094a0
Capabilities:
Find graphical window

Disassembly:
jmp 0x4094a0
sub esp, 0x814
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x82c]
push ebx
mov ebx, dword [esp + 0x81c]
push ebp
push esi
mov esi, dword [esp + 0x82c]
push edi
mov edi, dword [esp + 0x82c]
push 0x400
xor ebp, ebp
lea ecx, [esp + 0x24]
push ebp
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 1
call fcn.0041be10
push 0x400
lea edx, [esp + 0x430]
push ebp
push edx
call fcn.0041be10
push esi
call fcn.0041bee1
add esp, 0x1c
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x40966a
cmp word [edi], bp
jne 0x409528
xor edi, edi
push edi
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x409664
cmp dword [0x479648], ebp
jne 0x4095ef
cmp word [0x450e58], bp
push 0x100
jne 0x4095a2
mov ecx, dword [0x486304]
lea eax, [esp + 0x24]
push eax
push 0x45f
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44f200
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x428]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea ecx, [esp + 0x430]
push ecx
push 0
call fcn.004010be
add esp, 0x18
mov dword [esp + 0x10], ebp
mov eax, ebp
jmp 0x40966f
mov eax, dword [0x486304]
lea edx, [esp + 0x24]
push edx
push 0x45f
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x450e58
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x428]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea eax, [esp + 0x430]
push eax
push 0
call fcn.004010be
add esp, 0x18
mov dword [esp + 0x10], ebp
mov eax, ebp
jmp 0x40966f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00401078
add esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
je 0x40966a
mov edx, dword [esp + 0x838]
push 0
push 0
push edx
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x14], ebp
jbe 0x409664
lea ecx, [ecx]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
push edi
je 0x40962f
push ebx
jmp 0x409631
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call fcn.00401078
add esp, 4
test esi, esi
jne 0x409650
cmp eax, dword [esp + 0x1c]
jb 0x409664
push 0x3e8
add ebp, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, dword [esp + 0x14]
jb 0x409620
mov eax, dword [esp + 0x10]
jmp 0x40966f
mov eax, 1
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x814
ret
Function at 0x409a10
Capabilities:
Create directory

Disassembly:
jmp 0x409a10
sub esp, 0x664
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x660], eax
push edi
mov edi, dword [esp + 0x66c]
test edi, edi
jne 0x409a48
xor eax, eax
pop edi
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x664
ret
push 0x208
lea eax, [esp + 0x258]
push 0
push eax
call fcn.0041be10
push 0x250
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0041be10
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x409afb
push ebx
push ebp
lea ebx, [esp + 0x25c]
push esi
mov esi, edi
sub ebx, edi
mov ebp, eax
nop
cmp word [esi], 0x5c
jne 0x409ae9
push esi
push edi
call fcn.00401113
add esp, 8
test eax, eax
je 0x409ae9
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x409ae2
push 0
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x409ae9
lea edx, [esp + 0x260]
push edx
call fcn.004012c1
add esp, 4
jmp 0x409ae9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ax, word [esi]
mov word [ebx + esi], ax
add esi, 2
sub ebp, 1
jne 0x409a90
pop esi
pop ebp
pop ebx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x409b39
push 0
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x409b40
lea ecx, [esp + 0x254]
push ecx
call fcn.004012c1
add esp, 4
jmp 0x409b40
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x664]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x664
ret