joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2e84
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x4e2ea9
cmp dword [ebx + 4], 0xfffffffe
jne 0x4e2ea9
or eax, 0xffffffff
jmp 0x4e2fe1
test byte [ebx + 8], 8
je 0x4e2f16
cmp dword [ebx + 4], 0xffffffff
jne 0x4e2f16
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.004e2d58
pop ecx
mov edi, eax
test edi, edi
je 0x4e2efe
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x4e2fe1
call fcn.004e3bd4
test eax, eax
jne 0x4e2f0e
xor eax, eax
jmp 0x4e2fe1
or eax, 0xffffffff
jmp 0x4e2fe1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x4e2f23
cmp eax, 0xfffffffe
jne 0x4e2f4a
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x4e2f5a
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4e2f70
call fcn.004e3bd4
test eax, eax
jne 0x4e2f6b
xor eax, eax
jmp 0x4e2fe1
or eax, 0xffffffff
jmp 0x4e2fe1
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x4e2f84
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x4e2f16
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e3674
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.004e099c
pop ecx
mov ebx, eax
test eax, eax
jne 0x4e3698
xor eax, eax
jmp 0x4e3741
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x4e36b9
cmp esi, 0x104
jb 0x4e36c4
push ebx
call fcn.004e09ac
pop ecx
xor eax, eax
jmp 0x4e3741
cmp byte [ebx + 1], 0x3a
jne 0x4e36f4
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x4e36f4
push ebx
call fcn.004e09ac
pop ecx
xor eax, eax
jmp 0x4e3741
inc esi
test edi, edi
je 0x4e3737
cmp esi, dword [ebp + 0x10]
jbe 0x4e3709
push ebx
call fcn.004e09ac
pop ecx
xor eax, eax
jmp 0x4e3741
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.004e09ac
pop ecx
mov eax, edi
jmp 0x4e3741
push esi
push ebx
call fcn.004e09bc
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4e4ecc
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x26
push 0
push ebx
call fcn.004e0e7c
add esp, 0xc
mov word [ebx + 6], 1
lea eax, [ebp - 0x144]
push eax
push edi
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4e4fd9
push 0x509184
push edi
call fcn.004ea77c
add esp, 8
test eax, eax
je 0x4e4f7b
push 0
push edi
push 0
call fcn.004e3674
add esp, 0xc
mov esi, eax
test eax, eax
je 0x4e4f7b
push esi
call fcn.004e0fe0
pop ecx
cmp eax, 3
jne 0x4e4f7b
push esi
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x4e4f52
call fcn.004e3bf4
jmp 0x4e50d1
mov word [ebx + 4], 0x4000
movsx edx, byte [esi]
push edx
call fcn.004ea840
add ax, 0xffc0
pop ecx
mov word [ebx + 0x10], ax
mov word [ebx], ax
push esi
call fcn.004e09ac
pop ecx
xor eax, eax
jmp 0x4e50d1
test esi, esi
je 0x4e4f86
push esi
call fcn.004e09ac
pop ecx
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push edi
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4e4fad
call fcn.004e3bf4
jmp 0x4e50d1
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_GetFileType
cmp eax, 3
jne 0x4e4fc1
mov cx, 0x1000
jmp 0x4e4fc5
mov cx, 0x2000
mov word [ebx + 4], cx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4e50d1
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_FindClose
mov ecx, dword [ebp - 0x124]
lea edx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x138]
mov eax, dword [ebp - 0x128]
push eax
push edx
push ecx
lea eax, [ebp - 0x140]
push eax
mov edx, dword [ebp - 0x144]
push edx
push ebx
call fcn.004ec714
add esp, 0x1c
test byte [ebx + 5], 0x40
jne 0x4e5079
push 0x2e
push edi
call fcn.004ea7e8
add esp, 8
mov esi, eax
test eax, eax
je 0x4e5079
push str..bat
push esi
call fcn.004ea5cc
add esp, 8
test eax, eax
je 0x4e5074
push str..cmd
push esi
call fcn.004ea5cc
add esp, 8
test eax, eax
je 0x4e5074
push str..com
push esi
call fcn.004ea5cc
add esp, 8
test eax, eax
je 0x4e5074
push str..exe
push esi
call fcn.004ea5cc
add esp, 8
test eax, eax
jne 0x4e5079
or word [ebx + 4], 0x40
cmp byte [edi + 1], 0x3a
jne 0x4e5083
mov al, byte [edi]
jmp 0x4e50a2
lea edx, [ebp - 0x248]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x4e509c
mov al, 0x41
jmp 0x4e50a2
mov al, byte [ebp - 0x248]
cmp al, 0x61
jl 0x4e50b6
cmp al, 0x7a
jg 0x4e50b6
movsx edx, al
add dx, 0xff9f
mov word [ebx], dx
jmp 0x4e50c8
cmp al, 0x41
jl 0x4e50c8
cmp al, 0x5a
jg 0x4e50c8
movsx ecx, al
add cx, 0xffbf
mov word [ebx], cx
mov ax, word [ebx]
mov word [ebx + 0x10], ax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6a0c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
mov ecx, 0x10
push ebx
push esi
push edi
xor edi, edi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], eax
push esi
push edi
lea edi, [ebp - 0x64]
mov esi, str.none
mov ebx, 1
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x509754]
mov dword [ebp - 0x14], eax
push esi
call fcn.004e7e54
pop ecx
jmp 0x4e6ac9
mov edx, ebx
lea eax, [ebp - 0x64]
or dx, 0x400
movzx ecx, dx
or ecx, 0
mov dword [ebp - 4], ecx
push 0x40
push eax
push 0x1001
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 4
lea ecx, [ebp - 0x14]
push ecx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea edx, [ebp - 0x64]
push edx
call fcn.004e7e54
pop ecx
lea ecx, [ebp - 0x14]
push ecx
call fcn.004e7e54
pop ecx
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.004e121c
add esp, 8
test eax, eax
je 0x4e6ab0
mov edi, 1
jmp 0x4e6ac9
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.004e121c
add esp, 8
cmp esi, eax
jne 0x4e6ac8
mov edi, 1
jmp 0x4e6ac9
inc ebx
test edi, edi
jne 0x4e6ad6
cmp ebx, 0x38
jle 0x4e6a4f
test edi, edi
jne 0x4e6b09
push 0x5f
push esi
call fcn.004e0f5c
add esp, 8
test eax, eax
jne 0x4e6b09
push 0x2e
push esi
call fcn.004e0f5c
add esp, 8
test eax, eax
jne 0x4e6b09
push 0x20000101
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x4e6c5b
test edi, edi
jne 0x4e6b2c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x4e6b20
call sub.KERNEL32.DLL_GetSystemDefaultLangID
movzx ebx, ax
jmp 0x4e6b2c
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
and ebx, 0x3ff
push 0x5f
push esi
call fcn.004e0f5c
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4e6c04
inc dword [ebp - 0x18]
push 0x2e
mov edx, dword [ebp - 0x18]
push edx
call fcn.004e0f5c
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4e6b60
mov edx, dword [ebp - 0x1c]
mov byte [edx], 0
mov dword [ebp - 8], 1
xor edi, edi
jmp 0x4e6bda
or bx, 0x400
movzx ecx, bx
or ecx, 0
mov dword [ebp - 0x10], ecx
Function at 0x4e7400
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x50981b
lea ecx, [ebp - 0x200]
push ecx
call fcn.004e0f20
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004e0fe0
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004e0fe0
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x50981d
lea ecx, [ebp - 0x200]
push ecx
call fcn.004e0f20
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004e0fe0
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004e85f0
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4e7511
push esi
call fcn.004e0fe0
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004e0fe0
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004e099c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4e74e8
xor eax, eax
jmp 0x4e7598
push esi
call fcn.004e0fe0
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004e0fe0
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004e0e7c
add esp, 0xc
jmp 0x4e7551
mov edi, dword [ebx + 0x24]
push edi
call fcn.004e0fe0
pop ecx
push eax
push esi
call fcn.004e0fe0
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004e0fe0
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004e09bc
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4e7551
xor eax, eax
jmp 0x4e7598
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004e0f20
add esp, 8
push 0x50981f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004e0f20
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004e0f20
add esp, 8
push 0x509821
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004e0f20
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ea958
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4ea9ba
call fcn.004ea908
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004e0fe0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004e0fe0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4eaa38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x509e2c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4eab12
cmp dword [0x509e28], 0
jne 0x4eab12
cmp dword [0x50a00c], 0
je 0x4eaacc
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004ea7e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4eaab2
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004ea7e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4eaab2
lea ebx, [ebp - 0x84]
jmp 0x4eaab3
inc ebx
call fcn.004ea9f4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4eab4d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x509e30
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004e0fe0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x509e33
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4eab4d
cmp dword [0x509e28], 0
je 0x4eab2c
cmp dword [0x509e28], 0xffffffff
je 0x4eab4d
push esi
call dword [0x509e28]
pop ecx
mov eax, dword [0x509e2c]
test eax, eax
je 0x4eab4d
cmp dword [0x509e2c], 0xffffffff
je 0x4eab4d
cmp byte [eax], 0
je 0x4eab4d
push esi
push eax
call fcn.004ea958
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eb348
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x531bd8], 0
jne 0x4eb3c9
cmp dword [0x531bf8], 0
jne 0x4eb378
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x531bf8], eax
test eax, eax
jne 0x4eb378
push str.GetEnvironmentStrings_failed
call fcn.004eab64
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x531bf8]
jmp 0x4eb38c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004e0fe0
pop ecx
mov edi, eax
test eax, eax
jne 0x4eb384
lea edi, [ebp + 1]
push edi
call fcn.004e099c
pop ecx
mov ebx, eax
mov dword [0x531bdc], ebx
test ebx, ebx
jne 0x4eb3b6
xor eax, eax
jmp 0x4eb48c
push edi
mov edx, dword [0x531bf8]
push edx
push ebx
call fcn.004e0e0c
add esp, 0xc
jmp 0x4eb3e9
xor esi, esi
mov ebx, dword [0x531bd8]
jmp 0x4eb3e3
push eax
call fcn.004e0fe0
pop ecx
test eax, eax
jne 0x4eb3df
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4eb3d3
lea ebx, [esi + 4]
push 4
mov dword [0x531be0], ebx
inc ebx
push ebx
call fcn.004e0158
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4eb40c
xor eax, eax
jmp 0x4eb48c
cmp dword [0x531bd8], 0
jne 0x4eb43d
xor esi, esi
mov ebx, dword [0x531bdc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4eb42e
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004e0fe0
pop ecx
mov edi, eax
test eax, eax
jne 0x4eb424
jmp 0x4eb46e
xor esi, esi
mov ebx, dword [0x531bd8]
mov eax, dword [esp]
mov edi, eax
jmp 0x4eb468
push eax
call fcn.004e0fe0
pop ecx
test eax, eax
je 0x4eb45d
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4eb461
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4eb44c
mov eax, dword [0x531bd8]
test eax, eax
je 0x4eb47e
push eax
call fcn.004e09ac
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x531bd8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ec808
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
inc edx
xor eax, eax
mov al, byte [edx]
and eax, 0xff
test eax, eax
jne 0x4ec833
mov ecx, dword [ebp + 0xc]
mov dword [ecx], str._at_end_of_pattern
jmp 0x4ec9a1
cmp eax, 0x30
jl 0x4ec9a1
cmp eax, 0x7a
jg 0x4ec9a1
movsx ebx, word [eax*2 + 0x50a208]
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4ec85c
mov eax, dword [ebp - 4]
jmp 0x4ec9a1
mov ebx, eax
sub ebx, 0x30
je 0x4ec8d1
dec ebx
sub ebx, 9
jb 0x4ec880
sub ebx, 0x29
je 0x4ec964
sub ebx, 0x15
je 0x4ec919
jmp 0x4ec990
cmp dword [ebp + 0x18], 0
jne 0x4ec8c0
mov esi, edx
sub eax, 0x30
jmp 0x4ec89c
inc edx
add eax, eax
xor ebx, ebx
mov bl, byte [edx]
lea eax, [eax + eax*4]
add eax, ebx
add eax, 0xffffffd0
xor ebx, ebx
mov bl, byte [edx + 1]
mov edi, dword [ecx + 0xc]
test byte [edi + ebx], 4
jne 0x4ec88d
cmp eax, 0xa
jl 0x4ec8b4
cmp eax, dword [ebp + 0x10]
jg 0x4ec8be
add eax, 0xc
neg eax
jmp 0x4ec9a1
mov edx, esi
xor eax, eax
mov al, byte [edx]
cmp eax, 0x38
jl 0x4ec8d1
dec edx
xor eax, eax
jmp 0x4ec9a1
sub eax, 0x30
jmp 0x4ec8e3
inc edx
shl eax, 3
xor ebx, ebx
mov bl, byte [edx]
add eax, ebx
add eax, 0xffffffd0
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x4ec9a1
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 4
je 0x4ec9a1
cmp byte [edx + 1], 0x38
je 0x4ec9a1
cmp byte [edx + 1], 0x39
jne 0x4ec8d6
jmp 0x4ec9a1
xor eax, eax
jmp 0x4ec949
inc edx
xor ebx, ebx
mov bl, byte [edx]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 4
je 0x4ec932
mov ebx, 0x30
jmp 0x4ec937
mov ebx, 0x57
movzx esi, byte [edx]
mov edi, dword [ecx]
shl eax, 4
movzx esi, byte [edi + esi]
add esi, eax
sub esi, ebx
mov eax, esi
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x4ec9a1
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 8
jne 0x4ec91d
jmp 0x4ec9a1
inc edx
xor eax, eax
mov al, byte [edx]
test eax, eax
jne 0x4ec97a
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [edx], str.c_at_end_of_pattern
jmp 0x4ec9a6
cmp eax, 0x61
jl 0x4ec98b
cmp eax, 0x7a
jg 0x4ec98b
mov ecx, dword [ecx + 4]
movzx eax, byte [ecx + eax]
xor eax, 0x40
jmp 0x4ec9a1
test byte [ebp + 0x14], 0x40
je 0x4ec9a1
mov ecx, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], str.unrecognized_character_follows__
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x404548
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406804
test esi, esi
jne 0x404580
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406940
jmp 0x40459e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040448c
mov edi, eax
test esi, esi
je 0x40459e
cmp dword [ebx], 0
je 0x40459e
dec esi
jmp 0x404587
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405dc8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b6050], 0
je 0x405e29
cmp word [0x4b632c], 0xd7b2
jne 0x405df1
cmp dword [0x4b6334], 0
jbe 0x405df1
mov eax, 0x4b6328
call dword [0x4b6344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405e54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b3030], 0
jne 0x405e45
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405fb4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4b3034], 0
je 0x405fda
mov edx, esi
mov eax, ebx
call dword [0x4b3034]
jmp 0x405fe9
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4b6051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405f7c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4085cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408733
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406804
cmp si, word [0x4b37dc]
jb 0x408666
cmp si, word [0x4b39dc]
ja 0x408666
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408666
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4b37dc]
jae 0x408640
mov edi, ebx
dec edi
jmp 0x408661
cmp si, word [ebx*8 + 0x4b37dc]
jbe 0x408650
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408661
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4b37e0]
call fcn.004084dc
jmp 0x408666
cmp edi, dword [ebp - 0xc]
jae 0x40862a
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408715
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408715
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004069ec
push dword [ebp - 0x164]
push 0x408750
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.004069ec
push dword [ebp - 0x168]
push 0x408760
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004069ec
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40873a
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004067fc
ret
Function at 0x4088ec
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4089f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b8b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4b8b70]
jne 0x408938
mov eax, esi
mov edx, 0x4b8b74
mov ecx, 0x55
call fcn.004069ec
push 0x4b8b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4089db
push 0x4b8b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406804
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4089a9
cmp byte [0x4b8b54], 0
je 0x40896e
mov edx, esi
mov eax, ebx
call fcn.004087cc
jmp 0x4089a9
mov edx, esi
mov eax, ebx
call fcn.004085cc
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4089a9
cmp dword [esi], 0
je 0x408992
mov eax, esi
mov edx, 0x408a0c
call fcn.00406c00
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004085cc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406c00
push 0x4b8b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4b8b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406890
push eax
push 0x4b8b74
call sub.kernel32.dll_lstrcpynW
push 0x4b8b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4089f8
lea eax, [ebp - 4]
call fcn.004067f4
ret