joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b1f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
push esi
mov edi, ecx
call fcn.00407d40
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push esi
mov ecx, edi
call fcn.00407d40
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp + 8]
mov ecx, edi
push 1
push esi
call fcn.00407d40
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push esi
mov ecx, edi
call fcn.00407d40
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push 0x401
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov ecx, edi
call fcn.00407d40
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
ret 8

Function at 0x40b8a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test esi, esi
je 0x40b96b
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b8c0
sub ecx, edx
sar ecx, 1
je 0x40b96b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b90b
test al, 0x10
je 0x40b90b
mov ecx, dword [ebp + 8]
sub ecx, esi
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x40b8f0
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x40b911
sub edi, ecx
sar edi, 1
lea eax, [edi - 1]
cmp eax, 1
ja 0x40b962
push esi
call fcn.0040ba50
add esp, 4
test eax, eax
je 0x40b953
movzx eax, word [esi]
push eax
call fcn.00435fd4
mov ecx, dword [ebp + 8]
add esp, 4
mov ebx, 1
mov word [ecx], ax
mov dword [ecx + 2], 0x3a
cmp edi, 2
jne 0x40b962
xor eax, eax
cmp word [esi + 2], 0x3a
cmovne ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ffc0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
mov dword [edi], 1
cmp dword [0x4a906c], 0xffffffff
jne 0x41000b
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp dword [ebp - 0x84], 1
sete al
mov dword [0x4a906c], eax
mov dword [ebp - 0x6c], 0
xorps xmm0, xmm0
movq qword [ebp - 0x74], xmm0
test esi, esi
je 0x410028
mov dword [ebp - 0x74], 0xc
mov dword [ebp - 0x70], esi
test ebx, ebx
jne 0x410054
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x10
mov dword [edi + 4], eax
call fcn.00428aa3
xorps xmm0, xmm0
mov dword [edi + 0xc], eax
add esp, 4
movups xmmword [eax], xmm0
jmp 0x4100d9
cmp dword [ebp + 0xc], 0
mov eax, str.Global_s_s
push ebx
mov esi, str.Global_s_S
mov byte [ebp - 0x68], 0
cmove esi, eax
lea eax, [ebp - 0x68]
push str.Optex_Event_
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x68]
push eax
push 0
push 0
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push str.Optex_MMF_
mov dword [edi + 4], eax
lea eax, [ebp - 0x68]
push esi
push eax
mov byte [ebp - 0x68], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x68]
push eax
push 0x10
push 0
push 4
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi + 8], eax
test eax, eax
je 0x4100d9
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0xc], eax
cmp dword [edi], 0
je 0x4100f3
cmp dword [0x4a906c], 0
jne 0x4100f3
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4100f3
mov eax, dword [ebp + 8]
xchg dword [ecx], eax
cmp dword [edi + 4], 0
je 0x410105
cmp dword [edi + 0xc], 0
je 0x410105
cmp dword [edi + 8], 0
jne 0x41010b
mov dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a63
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4102e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4a5578
push 0x42f430
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4a90d4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, dword [0x4ab610]
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 8]
lea eax, [ebx - 1]
cmp eax, 3
ja case.default.0x410324
jmp dword [eax*4 + 0x410440]
mov esi, dword [0x4ab614]
jmp 0x410349
mov esi, dword [0x4ab618]
jmp 0x410349
mov esi, dword [0x4ab61c]
jmp 0x410349
mov esi, dword [0x4ab620]
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x20], edi
push 0x102
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4103dd
mov ecx, esi
call fcn.00410180
test eax, eax
je 0x4103dd
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], 1
push ebx
call fcn.00410810
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
jne 0x410395
push ebx
call fcn.00410450
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x24], 0
call fcn.004103b0
jmp 0x4103e0
mov ebx, dword [ebp + 0xc]
test edi, edi
jne 0x41042c
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push str.Unable_to_open_MYDEBUG_log_file
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x4ab624]
xor ecx, ecx
test ebx, ebx
cmovne eax, ecx
mov dword [0x4ab624], eax
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411500
Capabilities:
Delete file
Get file attributes
Get file size
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4a55c0
push 0x42f430
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4a90d4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor bl, bl
mov byte [ebp - 0x1d], bl
mov edi, 0x4ab690
mov eax, dword [ebp + 8]
dec eax
cmp eax, 3
ja case.default.0x411549
jmp dword [eax*4 + 0x411738]
mov edi, 0x4ab898
jmp case.default.0x411549
mov edi, 0x4abaa0
jmp case.default.0x411549
mov edi, 0x4abca8
jmp case.default.0x411549
mov edi, 0x4abeb0
push 0x102
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4116f7
cmp dword [ebp + 0x10], 0
je 0x4116f7
mov ecx, eax
call fcn.00410180
test eax, eax
je 0x4116f7
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
je 0x4115bc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
call fcn.00411a90
add esp, 8
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
je 0x4116e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.00411a40
add esp, 8
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x24], 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00411160
add esp, 8
mov dword [ebp - 0x2c], eax
inc eax
lea ecx, [eax + 8]
cmp eax, ecx
sbb eax, eax
and eax, ecx
je 0x4116ad
cmp eax, 0x400
ja 0x411640
call fcn.00428b10
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x30], esi
test esi, esi
je 0x4116ad
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x30], esi
jmp 0x41165e
push eax
call fcn.004360b7
add esp, 4
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4116ad
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4116ad
mov eax, dword [ebp - 0x2c]
inc eax
push eax
push 0
push esi
call fcn.0042e960
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x2c]
push esi
call fcn.00410120
add esp, 0x1c
push 0
lea ecx, [ebp - 0x24]
push ecx
push eax
push esi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov byte [ebp - 0x1d], bl
push esi
call fcn.00413380
add esp, 4
jmp 0x4116b8
push str.MyDebug_LogToFile_ALT:_memory_allocation_failed__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [ebp - 0x24]
push esi
call fcn.0040fb80
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x38], 0
call fcn.0041171b
mov al, bl
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
Function at 0x411750
Capabilities:
Print debug messages
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x47e844
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x41179a
push str.C:_bambooxml_data_build_dirCRED_CBV99_JOB1_srcBaseComponentCmgClientCommonLib_srcMyDebug.cpp:MyDebug_LogToFile_CEF____error_opening_CEF_device_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4118bc
mov edi, dword [ebp + 0xc]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4117a0
sub edi, ecx
sar edi, 1
lea eax, [edi + 0x19]
lea ecx, [eax + 8]
cmp eax, ecx
sbb eax, eax
and eax, ecx
je 0x4118a3
cmp eax, 0x400
ja 0x4117df
call fcn.00428b10
mov esi, esp
test esi, esi
je 0x4118a3
mov dword [esi], 0xcccc
jmp 0x4117f8
push eax
call fcn.004360b7
mov esi, eax
add esp, 4
test esi, esi
je 0x4118a3
mov dword [esi], 0xdddd
add esi, 8
test esi, esi
je 0x4118a3
lea eax, [edi + 0x19]
push eax
push 0
push esi
call fcn.0042e960
lea ecx, [edi + 1]
mov dword [esi + 4], 0
push edi
push dword [ebp + 0xc]
lea eax, [ecx + 0x18]
mov dword [esi + 8], 0x18
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x18]
push ecx
push eax
lea eax, [ebp - 0xc]
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.00437be4
add esp, 0x20
test eax, eax
jne 0x41187f
mov edi, dword [ebp - 8]
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push dword [esi]
push esi
push 0x83210124
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41188d
mov bl, 1
jmp 0x41188d
push str.MyDebug_LogToFile_CEF:_wcstombs_s_failed__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [ebp - 8]
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x4118b1
push esi
call fcn.0043609c
add esp, 4
jmp 0x4118b1
push str.MyDebug_LogToFile_CEF:_memory_allocation_failed__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [ebp - 8]
test edi, edi
je 0x4118bc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
Function at 0x411a90
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b080
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 4
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411ae3
or eax, eax
jmp 0x411bef
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0042e960
xor eax, eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x230]
push eax
call fcn.00410b90
add esp, 0x10
test al, al
je 0x411b8c
push 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
je 0x411b8c
lea eax, [ebp - 0x218]
push 0x3a
push eax
call fcn.0042f325
add esp, 8
test eax, eax
je 0x411b8c
push dword [ebp - 0x220]
sub eax, 2
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae ecx, dword [ebp - 0x230]
push ecx
push eax
call fcn.00437266
add esp, 0xc
test eax, eax
je 0x411bb1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x218]
push eax
je 0x411ba8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x411bae
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or esi, 0xffffffff
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x411bed
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411be3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c09
push edx
push ecx
call fcn.00428a50
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
call fcn.00435e90
int3
Function at 0x411e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b0bd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4a90d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 8
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xc], 0
call fcn.00428aa3
mov esi, eax
add esp, 4
test esi, esi
je 0x411ebd
push 1
mov dword [ebp - 4], 0
call fcn.00426554
add esp, 4
mov dword [esi + 4], eax
jmp 0x411ebf
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push eax
call fcn.0040cef0
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
movzx edi, ax
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x411f4e
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x411f4e
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
cmp dword [ebx + 0x38], 0
mov eax, dword [ebp - 0x14]
mov word [ebx + 0x40], ax
jne 0x411f6e
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
and eax, 0x13
or eax, 4
mov dword [ebx + 0xc], eax
and ecx, eax
jne 0x411f91
cmp byte [ebp + 0xc], 0
je 0x411f7d
push ebx
call fcn.00426c2e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x411f9d
mov esi, str.ios_base::badbit_set
jmp 0x411fad
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.0040e790
add esp, 8
lea ecx, [ebp - 0x2c]
push eax
push esi
call fcn.0040d470
push 0x4a5430
lea eax, [ebp - 0x2c]
push eax
call fcn.0042eb3c
int3
Function at 0x4127b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
call fcn.00401640
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0
push dword [ebp + 8]
mov ecx, dword [eax]
push 0
push 0
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00435c8c
mov edi, eax
add esp, 0x1c
or eax, 0xffffffff
test edi, edi
cmovs edi, eax
cmp edi, eax
je 0x4128f1
push ebx
push esi
mov esi, 0
mov dword [ebp - 0x1c], esi
mov eax, esi
mov dword [ebp - 0x18], eax
mov ebx, eax
mov dword [ebp - 0x14], ebx
add edi, 1
je 0x41281e
lea eax, [ebp - 1]
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040f3e0
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, eax
sub ecx, esi
mov edx, ecx
sar edx, 1
mov dword [ebp - 0xc], edx
cmp edx, edi
jb 0x4128b2
xor eax, eax
lea edi, [ebp - 2]
mov word [ebp - 8], ax
mov word [ebp - 2], ax
movzx eax, byte [edi]
lea edi, [ebp - 8]
cmp al, byte [edi]
lea edi, [ebp - 2]
jne 0x41285b
movzx eax, byte [edi + 1]
lea edi, [ebp - 8]
cmp al, byte [edi + 1]
jne 0x41285b
xor eax, eax
jmp 0x412860
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412878
lea eax, [edx + edx]
push eax
push 0
push esi
call fcn.0042e960
mov edx, dword [ebp - 0xc]
add esp, 0xc
jmp 0x412892
inc ecx
xor eax, eax
shr ecx, 1
cmp esi, dword [ebp - 0x18]
cmova ecx, eax
test ecx, ecx
je 0x412892
shr ecx, 1
mov edi, esi
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x10]
push 0
push dword [ebp + 8]
push 0xffffffffffffffff
push edx
push esi
push dword [eax + 4]
push dword [eax]
call fcn.00435c1d
add esp, 0x20
push esi
jmp 0x4128b7
push str.CMGOutputDebugString:_Failed_to_allocated_space_for_formatted_output_string_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test esi, esi
je 0x4128ea
sub ebx, esi
mov eax, esi
and ebx, 0xfffffffe
cmp ebx, 0x1000
jb 0x4128e0
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412901
push ebx
push esi
call fcn.00428a50
add esp, 8
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push str.CMGOutputDebugString:_Failed_to_calculate_length_of_formatted_output_string_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00435e90
int3
Function at 0x4133a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
call fcn.00428fea
push 0x800
mov esi, eax
push 0
push esi
call fcn.0042e960
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x59
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4135e3
mov ecx, 0x104
sub ecx, eax
je 0x4135e3
lea edx, [ebp - 0x20c]
push ecx
lea eax, [edx + eax*2]
mov dword [eax - 2], 0x2d
push eax
push 0x5a
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4135e3
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x214], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x210], 7
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413450
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.00402bd0
push 0
push 0x48052c
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x413492
mov ecx, 0x480578
jmp 0x413587
push 0
push 0x480534
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x4134b2
mov ecx, 0x4807f8
jmp 0x413587
push 0
push 0x48053c
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x4134d2
mov ecx, 0x480ab8
jmp 0x413587
push 0
push 0x480544
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x4134f2
mov ecx, 0x480d88
jmp 0x413587
push 0
push 0x48054c
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x41350f
mov ecx, 0x481020
jmp 0x413587
push 0
push 0x480554
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x41352c
mov ecx, 0x4812a8
jmp 0x413587
push 0
push 0x48055c
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x413549
mov ecx, 0x481438
jmp 0x413587
push 0
push str.pt_BR
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x413566
mov ecx, 0x481588
jmp 0x413587
push 0
push 0x480570
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
mov ecx, 0x481838
mov edx, 0x480578
cmovne ecx, edx
push ecx
push 0x400
push esi
call fcn.0043703a
mov edx, dword [ebp - 0x210]
add esp, 0xc
cmp edx, 8
jb 0x4135f6
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4135c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413607
push edx
push ecx
call fcn.00428a50
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push 0x480578
push 0x400
push esi
call fcn.0043703a
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret
call fcn.00435e90
int3
Function at 0x413610
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x208
call fcn.00428fea
push 0x208
mov edi, eax
push 0
push edi
call fcn.0042e960
push esi
push 0x104
push edi
call fcn.0043703a
add esp, 0x1c
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x59
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41378d
mov ecx, 0x104
sub ecx, eax
je 0x41378d
lea edx, [ebp - 0x20c]
push ecx
lea eax, [edx + eax*2]
mov dword [eax - 2], 0x2d
push eax
push 0x5a
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41378d
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x214], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x210], 7
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4136d0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.00402bd0
push 0
push 0x480554
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
jne 0x41370f
mov ecx, str.___Dell_Inc._R_2019
jmp 0x413730
push 0
push 0x48055c
lea ecx, [ebp - 0x224]
call fcn.004137c0
test eax, eax
mov ecx, 0x481b40
mov edx, str.___Dell_Inc.
cmovne ecx, edx
push ecx
push 0x104
push edi
call fcn.00436fc5
mov edx, dword [ebp - 0x210]
add esp, 0xc
cmp edx, 8
jb 0x4137a0
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x413771
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4137b2
push edx
push ecx
call fcn.00428a50
add esp, 8
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push str.___Dell_Inc.
push 0x104
push edi
call fcn.00436fc5
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret
call fcn.00435e90
int3

Function at 0x413ea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413ebc
test al, 0x10
je 0x413ebc
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x4145a2
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x414590
pop edi
mov eax, edx
pop esi
pop ebp
ret