joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b6ed
mov eax, dword fs:[0]
push eax
sub esp, 0x4dc
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x4e0]
push eax
push edi
mov bl, 1
call esi
cmp eax, 0xffffffff
je 0x401bf6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x4e0]
shr eax, 4
test bl, al
je 0x401bf6
push edi
lea ecx, [ebp - 0x40]
call fcn.00402d30
push 0x433e48
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004037a0
add esp, 4
cmp dword [eax + 0x14], 7
jbe 0x401aee
mov eax, dword [eax]
lea ecx, [ebp - 0x290]
push ecx
push eax
call esi
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp ecx, 7
jbe 0x401b34
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401b2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c14
push ecx
push edx
call fcn.0040fafb
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x401b51
mov bl, 1
jmp 0x401bc0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
lea ecx, [ebp - 0x264]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401b70
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jne 0x401b8e
cmp word [ebp - 0x264], 0x2e
jmp 0x401ba5
cmp ecx, 2
jne 0x401bb7
cmp word [ebp - 0x264], 0x2e
jne 0x401bb7
cmp word [ebp - 0x262], 0x2e
jne 0x401bb7
lea eax, [ebp - 0x290]
push eax
push esi
call edi
test eax, eax
jne 0x401b60
jmp 0x401bb9
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x401bf6
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401bec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c19
push ecx
push edx
call fcn.0040fafb
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret
call fcn.00414ba0
call fcn.00414ba0
int3
Function at 0x403e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403e5b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403e5b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403e48
cmp esi, edx
jae 0x403e5b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403e36
cmp esi, edx
jae 0x403e5b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x404150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4041c1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40418f
cmp eax, 2
jne 0x4041ab
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x4041bb
test ecx, ecx
je 0x4041b6
test cl, 1
jne 0x4041ab
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4041bb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x404e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba65
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0xe], 0
mov ecx, dword [ebp + 0xc]
je 0x404f4f
push ecx
lea ecx, [ebp - 0x30]
call fcn.004031f0
lea edx, [ebp - 0x30]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401200
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push dword [eax]
call fcn.00404fa0
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x2c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404ec4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x404ee3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edx, 0xf
mov esi, dword [esi + 8]
cmova eax, ecx
cmp esi, 0xffffffff
jne 0x404efe
xor bl, bl
jmp 0x404f21
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push ecx
push dword [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
test eax, eax
mov ecx, dword [ebp - 0x28]
setg bl
cmp edx, 0xf
jbe 0x404f4b
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404f41
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404f96
push edx
push ecx
call fcn.0040fafb
add esp, 8
mov al, bl
jmp 0x404f78
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x404f5b
xor al, al
jmp 0x404f78
push 0
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push edx
push dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setg al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret 8
call fcn.00414ba0
int3

Function at 0x4057e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x438aa4]
cmp ecx, 0xffffffff
jne 0x4057f7
xor al, al
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
push 0
lea eax, [ebp - 4]
push eax
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x40583b
cmp eax, 0xea
je 0x40583e
cmp esi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 8
add esi, dword [ebp - 4]
cmp esi, edi
jae 0x40582f
test ebx, ebx
je 0x40582d
mov ecx, dword [0x438aa4]
jmp 0x405802
Function at 0x405d20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba9d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.004031f0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00405880
mov ecx, dword [ebp - 0x10]
call fcn.00405930
test al, al
je 0x405d7c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x405d7c
mov esi, 1
jmp 0x405d7e
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x405da0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4072a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bdd0
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov esi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x4072e8
xor al, al
jmp 0x4073db
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov dword [ebp - 0x228], eax
test eax, eax
js 0x4073f7
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
js 0x40740e
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00411790
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x407425
mov eax, dword [ebp - 0x224]
push dword [ebp - 0x220]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x21c]
lea edi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407390
sub edx, edi
lea eax, [ebp - 0x21c]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00403530
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x4073d0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4073d0
call dword [sym.imp.ole32.dll_CoUninitialize]
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x22c]
push 0x436a70
push eax
call fcn.004118ea
push 0x436a70
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], esi
push eax
call fcn.004118ea
push 0x436a70
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x80004005
push eax
call fcn.004118ea
int3
Function at 0x408af0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.00429e30
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1210]
mov dword [ebp - 0x1218], ecx
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x408b3a
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x1210]
push esi
push edi
shr ebx, 2
xor edi, edi
test ebx, ebx
je 0x408c0d
mov eax, dword [0x4341bc]
movups xmm0, xmmword [str._unknown_]
push 0x1f4
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0x1f8]
push 0
push eax
movups xmmword [ebp - 0x20c], xmm0
call fcn.00411790
add esp, 0xc
push dword [ebp + edi*4 - 0x120c]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x408bfd
lea eax, [ebp - 0x121c]
push eax
push 4
lea eax, [ebp - 0x1214]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x408bfd
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1214]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x1218]
push dword [eax]
call fcn.00418c0e
add esp, 8
test eax, eax
jne 0x408bfd
cmp dword [ebp + edi*4 - 0x120c], eax
je 0x408bfd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x408c20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, ebx
jb 0x408b50
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret

Function at 0x408d10
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x435dd8
push 0x411000
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x438040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov word [ebp - 0x20], 0x500
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x408d92
push edi
push dword [ebp - 0x28]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov esi, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.00408dbf
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret
Function at 0x408fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x439838]
mov ecx, dword [0x438aa0]
inc eax
mov dword [0x439838], eax
test ecx, ecx
jle 0x409061
imul eax, eax, 0x64
push esi
cdq
idiv ecx
imul ecx, eax, 0x62
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
inc esi
add esi, edx
cmp dword [0x439834], esi
je 0x409060
mov dword [0x439834], esi
cmp esi, 1
jge 0x40901b
mov esi, 1
jmp 0x409025
mov eax, 0x63
cmp esi, eax
cmovg esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x409047
test edx, edx
je 0x409047
test esi, esi
je 0x409047
cmp esi, 0x64
jne 0x409060
push esi
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
pop esi
ret
Function at 0x40eb20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x438040]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0xc], 2
jne 0x40ec2f
push dword [eax + 4]
lea ecx, [esp + 8]
call fcn.004031f0
lea edx, [esp + 4]
lea ecx, [esp + 0x10]
call fcn.00401200
lea ecx, [esp + 0x14]
push dword [eax]
call fcn.00404fa0
mov edx, dword [esp + 0x10]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40eb94
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40ebad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x28], 0xf
lea eax, [esp + 0x14]
cmova eax, dword [esp + 0x14]
push eax
call fcn.00419982
add esp, 4
mov dword [0x43982c], eax
lea ecx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00408d10
cmp dword [esp + 8], 0
jne 0x40ebf8
push 0
push 0
push 0x916
push dword [0x43982c]
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
jmp 0x40ebfd
call fcn.0040dfe0
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x40ec2f
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ec25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec43
push ecx
push edx
call fcn.0040fafb
add esp, 8
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret 0x10
call fcn.00414ba0
int3

Function at 0x41044d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41048c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41048c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41048c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41048c
cmp dword [ecx + 0x74], 0xe
jbe 0x41048c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41e02f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041e633
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41e09e
cmp esi, dword [ebp - 4]
je 0x41e099
cmp dword [ebp + 0xc], 0
je 0x41e099
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41e076
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0041db81
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x41e0a0
xor eax, eax
inc eax
jmp 0x41e0a0
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x41e105
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0041e633
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041e633
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41e17c
cmp word [ecx], dx
je 0x41e17c
mov eax, dword [0x42f634]
push edi
dec eax
push eax
push 0x42f520
call fcn.0041e0a4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x41e1ef
cmp word [eax], dx
je 0x41e1ef
mov eax, dword [edi]
test eax, eax
je 0x41e1a0
cmp word [eax], dx
je 0x41e1a0
lea eax, [ebp - 0x10]
push eax
call fcn.0041da87
jmp 0x41e1a9
lea eax, [ebp - 0x10]
push eax
call fcn.0041db22
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x41e219
mov eax, dword [0x42f51c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x42f210
call fcn.0041e0a4
add esp, 0xc
test al, al
je 0x41e219
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x41e1e4
cmp word [eax], di
je 0x41e1e4
lea eax, [ebp - 0x10]
push eax
call fcn.0041da87
pop ecx
jmp 0x41e21b
lea eax, [ebp - 0x10]
push eax
call fcn.0041db22
jmp 0x41e1e1
mov eax, dword [edi]
test eax, eax
je 0x41e206
cmp word [eax], dx
je 0x41e206
lea eax, [ebp - 0x10]
push eax
call fcn.0041da3c
pop ecx
jmp 0x41e219
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x41e2e4
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0041df29
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41e2e4
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41e2e4
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41e2e4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41e271
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0041efc1
test ebx, ebx
je 0x41e2df
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0041efc1
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41e2e4
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41e2e4
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0042376d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41e2e6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f7c4
leave
ret
Function at 0x41edc4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430618
push 0x430610
push str.FlsAlloc
push 0x1f
call fcn.0041ec2f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41edf8
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d230]
call esi
jmp 0x41edfe
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41ee42
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430628
push 0x430620
push str.FlsGetValue
push 0x21
call fcn.0041ec2f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ee79
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d230]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41ee81
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430630
push 0x430628
push str.FlsSetValue
push 0x22
call fcn.0041ec2f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41eebb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42d230]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x421e7f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x421f1c
push ebx
push esi
call fcn.00421e48
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00421ddc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x421ec9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x421f1b
push edi
push eax
call fcn.0041bfa4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x421ee9
call fcn.0041bf6a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x421f1a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00421ddc
add esp, 0x20
test eax, eax
jne 0x421f08
push edi
call fcn.0041bf6a
jmp 0x421f10
push ebx
call fcn.0041bf6a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x421f1f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x421f30
pop esi
ret
push ebx
push edi
push esi
call fcn.00421e48
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0041bfa4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x421f58
push ebx
push esi
push edi
call fcn.00411210
add esp, 0xc
push 0
call fcn.0041bf6a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x422328
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421f6d
Function at 0x4299e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x429a0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x429a0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret