joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4074b6
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
call fcn.00407301
mov esi, eax
test esi, esi
je 0x407633
push 0x401a1c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a28
push esi
mov dword [0x4250b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a34
push esi
mov dword [0x4250b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a40
push esi
mov dword [0x4250bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x4250b4], 0
mov dword [0x4250c0], eax
je 0x40752c
cmp dword [0x4250b8], 0
je 0x40752c
cmp dword [0x4250bc], 0
je 0x40752c
test eax, eax
jne 0x407554
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x4250b8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4250bc], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x4250b4], 0x406f70
mov dword [0x4250c0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x424648], eax
cmp eax, 0xffffffff
je 0x407638
push dword [0x4250b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x407638
call fcn.0040791b
push dword [0x4250b4]
call fcn.00407093
push dword [0x4250b8]
mov dword [0x4250b4], eax
call fcn.00407093
push dword [0x4250bc]
mov dword [0x4250b8], eax
call fcn.00407093
push dword [0x4250c0]
mov dword [0x4250bc], eax
call fcn.00407093
add esp, 0x10
mov dword [0x4250c0], eax
call fcn.0040c011
test eax, eax
je 0x407633
push fcn.00407120
push dword [0x4250b4]
call fcn.0040701e
pop ecx
mov esi, eax
mov ecx, eax
call dword [0x427188]
call esi
mov dword [0x424644], eax
cmp eax, 0xffffffff
je 0x407633
push 0x214
push 1
call fcn.0040c3dc
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x407633
push edi
push dword [0x424644]
push dword [0x4250bc]
call fcn.0040701e
pop ecx
mov esi, eax
mov ecx, eax
call dword [0x427188]
call esi
test eax, eax
jne 0x40763d
push edi
call fcn.004066e0
pop ecx
call fcn.00407650
xor eax, eax
pop edi
pop esi
ret
push 0
push edi
call fcn.004073dd
pop ecx
pop ecx
or dword [edi + 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x40763a
Function at 0x407b99
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov esi, ebx
cmp edi, dword [esi*8 + 0x401038]
je 0x407bb8
inc esi
cmp esi, 0x17
jb 0x407ba9
cmp esi, 0x17
jae 0x407cf8
push 3
call fcn.0040ea09
pop ecx
cmp eax, 1
je 0x407cc2
push 3
call fcn.0040ea09
pop ecx
test eax, eax
jne 0x407beb
cmp dword [0x424630], 1
je 0x407cc2
cmp edi, 0xfc
je 0x407cf8
push 0x402018
push 0x314
mov edi, 0x425110
push edi
call fcn.0040c078
add esp, 0xc
test eax, eax
je 0x407c20
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00409841
add esp, 0x14
push 0x104
push 0x425129
push ebx
mov byte [0x42522d], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407c63
push 0x402034
push 0x2fb
push 0x425129
call fcn.0040c078
add esp, 0xc
test eax, eax
je 0x407c63
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00409841
add esp, 0x14
push 0x40204c
push 0x314
push edi
call fcn.0040e96f
add esp, 0xc
test eax, eax
je 0x407c87
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00409841
add esp, 0x14
push dword [esi*8 + 0x40103c]
push 0x314
push edi
call fcn.0040e96f
add esp, 0xc
test eax, eax
je 0x407cad
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00409841
add esp, 0x14
push 0x12010
push 0x402050
push edi
call fcn.0040ea55
add esp, 0xc
jmp 0x407cf8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, eax
test edx, edx
je 0x407cf8
cmp edx, 0xffffffff
je 0x407cf8
mov esi, dword [esi*8 + 0x40103c]
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407ce1
push ebx
lea eax, [ebp - 4]
sub ecx, edi
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40856b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x4085fd
xor edx, edx
push esi
mov esi, edi
cmp word [edi], dx
je 0x4085a0
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40859b
add esi, 2
movzx ecx, word [esi]
test cx, cx
jne 0x408588
push ebx
push edx
push edx
push edx
sub esi, edi
push edx
sar esi, 1
inc esi
push esi
push edi
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x4085f2
push eax
call fcn.00406860
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4085f2
xor eax, eax
push eax
push eax
push dword [ebp - 4]
push ebx
push esi
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4085e7
push ebx
call fcn.004066e0
pop ecx
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x4085fb
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40e020
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40e05e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40e056
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40e060
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40e046
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40e130
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40e161
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40e161
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40e161
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40ea55
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x424674]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x18], eax
call fcn.00407108
xor esi, esi
mov ebx, eax
cmp dword [0x4256f4], esi
jne 0x40eb35
push esi
push esi
push 0x4024f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ec17
push 0x402510
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ec17
push eax
call fcn.00407093
mov dword [esp], 0x40251c
push edi
mov dword [0x4256f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00407093
mov dword [esp], 0x40252c
push edi
mov dword [0x4256f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00407093
mov dword [esp], 0x402540
push edi
mov dword [0x4256fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00407093
pop ecx
mov ecx, eax
mov dword [0x425704], ecx
test ecx, ecx
je 0x40eb2e
push 0x40255c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.00407093
pop ecx
mov dword [0x425700], eax
jmp 0x40eb3a
mov eax, dword [0x425700]
jmp 0x40eb40
mov eax, dword [0x425700]
mov ecx, dword [0x425704]
cmp eax, ebx
je 0x40eba6
cmp ecx, ebx
je 0x40eba6
push eax
call fcn.0040701e
push dword [0x425704]
mov dword [ebp - 0x14], eax
call fcn.0040701e
mov edi, eax
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
test eax, eax
je 0x40eba6
test edi, edi
je 0x40eba6
mov ecx, eax
call dword [0x427188]
mov eax, dword [ebp - 0x14]
call eax
test eax, eax
je 0x40eb9d
lea ecx, [ebp - 0x20]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
mov ecx, edi
call dword [0x427188]
call edi
test eax, eax
je 0x40eb9d
test byte [ebp - 8], 1
jne 0x40eba6
or dword [ebp + 0x10], 0x200000
jmp 0x40ebef
mov eax, dword [0x4256f8]
cmp eax, ebx
je 0x40ebef
push eax
call fcn.0040701e
mov edi, eax
pop ecx
test edi, edi
je 0x40ebef
mov ecx, edi
call dword [0x427188]
call edi
mov esi, eax
test esi, esi
je 0x40ebef
mov eax, dword [0x4256fc]
cmp eax, ebx
je 0x40ebef
push eax
call fcn.0040701e
mov edi, eax
pop ecx
test edi, edi
je 0x40ebef
push esi
mov ecx, edi
call dword [0x427188]
call edi
mov esi, eax
push dword [0x4256f4]
call fcn.0040701e
mov edi, eax
pop ecx
test edi, edi
je 0x40ec17
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push esi
call dword [0x427188]
call edi
jmp 0x40ec19
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405cfa
leave
ret
Function at 0x41cec2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x424674]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x7c]
push 0x78
push eax
mov eax, dword [ebp + 8]
and eax, 0x3ff
push 1
or eax, 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x41cf2e
lea eax, [ebp - 0x7c]
push eax
call fcn.0041cdb1
pop ecx
cmp dword [ebp + 8], eax
je 0x41cf29
cmp dword [ebp + 0xc], 0
je 0x41cf29
push esi
mov esi, dword [edi]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41cf13
push dword [edi]
sub esi, ecx
call fcn.0041caba
pop ecx
cmp eax, esi
pop esi
je 0x41cf2e
xor eax, eax
inc eax
jmp 0x41cf30
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00405cfa
leave
ret
Function at 0x41cfa1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040733d
mov edi, dword [ebp + 8]
lea esi, [eax + 0x9c]
test edi, edi
jne 0x41cfc7
or dword [esi + 8], 0x104
jmp 0x41d094
lea ecx, [edi + 0x40]
mov dword [esi], edi
lea ebx, [esi + 4]
mov eax, edi
mov dword [ebx], ecx
test ecx, ecx
je 0x41cfee
cmp byte [ecx], 0
je 0x41cfee
push ebx
push 0x16
push 0x401538
call fcn.0041cf3d
mov eax, dword [esi]
add esp, 0xc
and dword [esi + 8], 0
test eax, eax
je 0x41d04f
cmp byte [eax], 0
je 0x41d04f
mov eax, dword [ebx]
test eax, eax
je 0x41d00e
cmp byte [eax], 0
je 0x41d00e
push esi
call fcn.0041c9e4
jmp 0x41d014
push esi
call fcn.0041ca6c
cmp dword [esi + 8], 0
pop ecx
jne 0x41d0a0
push esi
push 0x41
push 0x401328
call fcn.0041cf3d
add esp, 0xc
test eax, eax
je 0x41d0a0
mov eax, dword [ebx]
test eax, eax
je 0x41d046
cmp byte [eax], 0
je 0x41d046
push esi
call fcn.0041c9e4
jmp 0x41d04c
push esi
call fcn.0041ca6c
pop ecx
jmp 0x41d0a0
mov ecx, dword [ebx]
test ecx, ecx
je 0x41d08d
cmp byte [ecx], 0
je 0x41d08d
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d05d
xor eax, eax
sub ecx, edx
cmp ecx, 3
push 1
sete al
push 0x41c8f0
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov eax, dword [esi + 8]
test al, 4
jne 0x41d0a3
and dword [esi + 8], 0
xor eax, eax
jmp 0x41d0a3
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x41d1a8
lea eax, [edi + 0x80]
neg edi
push esi
sbb edi, edi
and edi, eax
push edi
call fcn.0041cdeb
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41d1a8
cmp ebx, 0xfde8
je 0x41d1a8
mov edi, 0xfde9
cmp ebx, edi
jne 0x41d0ed
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, edi
jne 0x41d1a8
movzx edi, bx
push edi
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41d1a8
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41d1a8
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41d12c
mov ax, word [esi + 0x18]
mov word [ecx], ax
mov ax, word [esi + 0x1c]
mov word [ecx + 2], ax
mov word [ecx + 4], di
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x41d1a3
mov eax, 0x814
cmp word [ecx], ax
jne 0x41d162
push 0x403bd8
push 0x40
push edi
call fcn.0040c078
add esp, 0xc
test eax, eax
je 0x41d177
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00409841
add esp, 0x14
jmp 0x41d177
push 0x40
push edi
push 0x1001
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x41d1a8
push 0x40
lea eax, [edi + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x41d1a8
push 0xa
push 0x10
lea ecx, [edi + 0x80]
push ecx
push ebx
call fcn.00420638
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41d1aa
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41ec95
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4238b8
call fcn.0040ab2c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ecf5
cmp eax, 0xffffffff
je 0x41ecf5
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41ecee
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41ecee
cmp edx, 0x10000000
jae 0x41ecee
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41eceb
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x420301
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x424674]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x90], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
cmp eax, 1
jne 0x42043b
xor esi, esi
lea ebx, [ebp - 0x84]
push esi
push 0x80
mov eax, ebx
mov dword [ebp - 0x8c], esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
call fcn.00422036
add esp, 0x18
mov dword [ebp - 0x88], eax
test eax, eax
jne 0x4203d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4203f2
push esi
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x90]
call fcn.00422036
add esp, 0x18
mov dword [ebp - 0x88], eax
test eax, eax
je 0x4203f2
push 1
push eax
call fcn.0040ec28
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4203f2
push esi
push dword [ebp - 0x88]
mov dword [ebp - 0x8c], 1
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x90]
call fcn.00422036
add esp, 0x18
mov dword [ebp - 0x88], eax
test eax, eax
je 0x4203eb
push 1
push eax
call fcn.0040ec28
mov edx, eax
mov dword [edi], edx
pop ecx
pop ecx
test edx, edx
jne 0x420404
cmp dword [ebp - 0x8c], esi
je 0x4203f2
push ebx
call fcn.004066e0
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405cfa
leave
ret
mov ecx, dword [ebp - 0x88]
lea eax, [ecx - 1]
push eax
push ebx
push ecx
push edx
call fcn.00406014
add esp, 0x10
test eax, eax
je 0x42042a
push esi
push esi
push esi
push esi
push esi
call fcn.00409841
add esp, 0x14
cmp dword [ebp - 0x8c], esi
je 0x42047a
push ebx
call fcn.004066e0
pop ecx
jmp 0x42047a
cmp eax, 2
jne 0x420490
xor esi, esi
push esi
push esi
push dword [ebp + 0x14]
mov dword [edi], esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
test ebx, ebx
je 0x420481
push 2
push ebx
call fcn.0040ec28
mov dword [edi], eax
pop ecx
pop ecx
test eax, eax
je 0x420481
push ebx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x420481
xor eax, eax
jmp 0x4203f5
push dword [edi]
call fcn.004066e0
pop ecx
mov dword [edi], esi
jmp 0x4203f2
test eax, eax
jne 0x4203f2
and dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push 2
push eax
mov eax, dword [ebp + 0x14]
or eax, 0x20000000
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4203f2
mov al, byte [ebp - 0x88]
mov byte [edi], al
jmp 0x42047a
Function at 0x42157b
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x424674]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
xor esi, esi
pop eax
mov dword [ebp - 0xc], esi
call fcn.0041f510
mov eax, esp
lea ecx, [ebp - 0x34]
push 0x1c
push ecx
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42168a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x54]
push 0x401a68
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42160c
push 0x403fa0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42160c
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call dword [0x427188]
call edi
cmp eax, 1
jne 0x42160c
cmp dword [ebp - 0xc], esi
jbe 0x42160c
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push esi
call fcn.00408053
add esp, 0xc
test eax, eax
js 0x42168a
mov esi, dword [ebp - 8]
not edi
and esi, edi
mov dword [ebp - 8], esi
je 0x421642
lea eax, [ebp - 8]
push eax
push ebx
push esi
call fcn.00408053
add esp, 0xc
test eax, eax
js 0x42168a
mov esi, dword [ebp - 8]
lea eax, [ebx + ebx]
cmp esi, eax
jae 0x42164b
mov esi, eax
mov eax, dword [ebp - 0x14]
mov edi, ebx
neg edi
add eax, ebx
and edi, dword [ebp - 0x10]
sub edi, esi
cmp edi, eax
jb 0x42168a
push 4
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x42168a
lea ecx, [ebp - 0x18]
push ecx
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x42168a
xor eax, eax
inc eax
jmp 0x42168c
xor eax, eax
lea esp, [ebp - 0x64]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405cfa
leave
ret
Function at 0x421f51
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x424674]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0x1c], esi
jne 0x421f76
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0x1c], eax
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
test ebx, ebx
je 0x422022
jle 0x421fdf
push 0xffffffffffffffe0
xor edx, edx
pop eax
div ebx
cmp eax, 2
jb 0x421fdf
lea ecx, [ebx*2 + 8]
lea eax, [ebx + ebx]
cmp ecx, eax
jbe 0x421fdf
cmp ecx, 0x400
ja 0x421fca
mov eax, ecx
call fcn.00420a10
mov edi, esp
test edi, edi
je 0x422022
mov dword [edi], 0xcccc
add edi, 8
jmp 0x421fe1
push ecx
call fcn.00406860
mov edi, eax
pop ecx
test edi, edi
je 0x422022
mov dword [edi], 0xdddd
jmp 0x421fc5
mov edi, esi
test edi, edi
je 0x422022
push ebx
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x422017
push esi
push esi
cmp dword [ebp + 0x18], esi
jne 0x422002
push esi
push esi
jmp 0x422008
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push edi
call fcn.0041d301
pop ecx
mov eax, esi
jmp 0x422024
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405cfa
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403203
pop dword [ebp - 0x4c]
mov eax, 0x13b17a4a
add eax, 0xec8eb7b9
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xda856699
sub dword [ebp - 0x5c], 0x8c33214e
mov dword [ebp - 0x58], 0xb83ed2cb
add dword [ebp - 0x58], 0x79f4797a
mov dword [ebp - 0x54], 0xadfaffcf
sub dword [ebp - 0x54], 0x61aebba1
mov dword [ebp - 0x50], 0xb22d0716
add dword [ebp - 0x50], 0x4dd2f8ea
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x2d80fe56
add eax, 0xd2bf720e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x931f820e
sub dword [ebp - 0x5c], 0x1ead18b8
mov dword [ebp - 0x58], 0x99f03cf2
add dword [ebp - 0x58], 0xa77c2483
mov dword [ebp - 0x54], 0xa6c25df0
add dword [ebp - 0x54], 0xbcad0e7c
mov dword [ebp - 0x50], 0x388c4f5e
sub dword [ebp - 0x50], 0x388c4f5e
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b071
push 0
call eax
mov ecx, 0xe0f045f4
add ecx, 0x1f1013c8
xor ebx, ebx
add ebx, eax
mov esi, 0xead298fb
add esi, 0x156e6705
add esi, dword [ebp - 0x4c]
mov edi, 0x7f5ff529
xor dword [ebp - 0x40], edx
mov edx, dword [esi]
sub dword [ebp - 0x20], 0x5863c0a3
sub edx, edi
xor dword [ebp - 4], 0xff72187c
mov dword [ebx], edx
xor dword [ebp - 0x40], eax
add ebx, 4
add esi, 0xc3c62591
sub esi, 0xc3c6258d
loop 0x40331c
add eax, 0x320c8bd7
add eax, 0xcdf4cdec
mov ebx, eax
add eax, 0x88cd614f
sub eax, 0x88cd614a
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret