joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ba8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407c0c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404290
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405e0c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407c13
lea eax, [ebp - 0xc]
call fcn.00404048
ret

Function at 0x40c470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c488
mov eax, 1
add ebx, ebx
jne 0x40c4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c4a0
jne 0x40c4bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4a0
xor ecx, ecx
sub eax, 3
jb 0x40c4d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c542
mov ebp, eax
add ebx, ebx
jne 0x40c4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c50c
inc ecx
add ebx, ebx
jne 0x40c4f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c4ed
jne 0x40c509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c51d
jmp 0x40c48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c52c
add edi, ecx
jmp 0x40c48e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c54a
cmp byte [edi], 1
jne 0x40c54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40c54f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c5c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd70c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c57c
mov ecx, edi
jns 0x40c5ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd74c]
or eax, eax
je 0x40c5c1
mov dword [ebx], eax
add ebx, 4
jmp 0x40c599
call dword [esi + 0xd750]
popal
jmp 0x401128
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x42ff6b6a
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2b040995
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1248781c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2250530e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x2015b0
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x201592], 0x100
jne 0x2015cb
jmp 0x201b94
jmp fcn.00201980
call fcn.002017f7
mov dword [ebx + 0x600], 1
mov dword [ebx + 0x5dc], 0
lea eax, [ebx + 0x8e4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov cx, word [0x201592]
mov edx, dword [ebx + 0x8f4]
test cx, 0x20
jne 0x201c09
cmp edx, 2
je 0x201c18
test cx, 0x40
jne 0x201c09
push 0x12000
push 0
call 0x201bf7
push edi
imul ebp, dword [esi + 0x39], 0x6f4e2038
and byte [ebx + 0x75], dl
jo 0x201c63
outsd dx, dword [esi]
jb 0x201c6a
add byte [edx], ch
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0xff
jmp 0x201cf5
call fcn.00201980
or dword [ebx + 0x5dc], 0x80
call fcn.002015d0
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test dword [esp + 0x2c], 0x100
je 0x201c5e
mov ecx, dword [esp + 0x40]
mov dword [ebx + 0x990], ecx
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x994], ecx
mov ecx, dword [esp + 0x3c]
mov dword [ebx + 0x998], ecx
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x201c72
add byte [ebp + eax + 0xf], dh
mov bh, 0x44
and al, 0x30
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x5f4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
call fcn.002018b3
mov dword [ebx + 0x5f0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [ebx + 0x5fc], eax
call fcn.002016e2
push 0xff
jb 0x201cf5
pop eax
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.00201743
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0x988]
call fcn.00201cfb
mov ecx, dword [ebx + 0xdc]
call fcn.00201cfb
mov ecx, dword [ebx + 0xb8]
jecxz 0x201cdf
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x638]
call fcn.00201748
call fcn.0020172f
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x2016e2
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x20172e
mov dword [ebx + 0x5e0], eax
mov dword [ebx + 0x5e8], 0
call fcn.00201a73
jb 0x20172e
mov dword [ebx + 0x5e4], eax
mov dword [eax + 0x68], 1
mov dword [eax + 0x6c], 1
mov dword [eax + 0x70], 2
mov dword [eax + 0x74], 3
mov dword [eax + 0x78], 0
ret
Function at 0x201d74
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x400
mov ebx, section..data
push esi
push edx
mov eax, dword [ebx + 0x3e8]
shl eax, 4
or eax, dword [ebx + 0x3e4]
shl eax, 0x10
push eax
call fcn.00201f71
push eax
call fcn.00201f06
push dx
push ax
mov eax, dword [ebp - 0x40c]
movzx ecx, word [ebp - 0x414]
sub cx, word [ebp - 0x410]
mov edx, dword [ebp - 0x408]
mov esi, dword [ebp - 0x404]
lea edi, [ebp - 0x400]
test edx, edx
je 0x201e8f
test byte [ebx + 0x3e1], 0xff
je 0x201dee
mov byte [ebx + 0x3e1], 0
call fcn.00201eb9
cld
and ecx, 0xff
push ecx
lodsw ax, word [esi]
stosd dword es:[edi], eax
dec edx
loopne 0x201df6
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x404], esi
pop edx
sub edx, ecx
movzx ecx, word [ebp - 0x410]
add word [ebp - 0x410], dx
mov ax, word [ebp - 0x40e]
push ax
add cx, dx
dec ecx
push cx
push ax
inc ecx
sub cx, dx
push cx
push esp
push 0
or edx, 0x10000
push edx
lea eax, [ebp - 0x400]
push eax
push dword [ebx + 0x98c]
call dword [sym.imp.KERNEL32.DLL_WriteConsoleOutputW]
pop eax
pop eax
mov ax, word [ebp - 0x410]
cmp ax, word [ebp - 0x414]
jb 0x201e8a
mov word [ebp - 0x410], 0
mov ax, word [ebp - 0x40e]
inc ax
cmp ax, word [ebp - 0x412]
je 0x201e83
mov word [ebp - 0x40e], ax
jmp 0x201e8a
mov byte [ebx + 0x3e1], 0xff
jmp 0x201dab
movzx eax, word [ebp - 0x410]
movzx ecx, word [ebp - 0x40e]
inc eax
inc ecx
mov dl, byte [ebx + 0x3e1]
call fcn.00201f96
mov byte [ebx + 0x3e1], dl
mov esp, ebp
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x201f96
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
push edx
push esi
push edi
mov ebx, eax
call fcn.00201f06
mov esi, eax
mov edi, edx
call fcn.00201f71
add eax, 0x10001
cmp ebx, 1
jl 0x201fb8
cmp ebx, esi
jle 0x201fbb
movzx ebx, ax
cmp ecx, 1
jl 0x201fc4
cmp ecx, edi
jle 0x201fcd
rol eax, 0x10
movzx ecx, ax
rol eax, 0x10
push eax
push ecx
dec ebx
dec ecx
push cx
push bx
push dword [0x20a98c]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
xor al, al
mov byte [0x20a3e1], al
pop ecx
pop eax
pop edi
pop esi
pop edx
pop ebx
ret

Function at 0x201ff0
Capabilities:
Set console window title

Disassembly:
push ebx
push ecx
push esi
mov esi, section..data
mov eax, dword [esi + 0x3dc]
test eax, eax
jne 0x202068
sub esp, 0x220
mov eax, esp
push 0x100
push eax
call dword [sym.imp.KERNEL32.DLL_GetConsoleTitleW]
mov ebx, eax
mov eax, 0x200020
mov dword [esp + ebx*2], eax
mov dword [esp + ebx*2 + 4], eax
mov dword [esp + ebx*2 + 8], eax
mov eax, 0x20
mov dword [esp + ebx*2 + 0xc], eax
push esp
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleW]
mov eax, 0xc8
call fcn.002020b8
push esp
push 0
call dword [sym.imp.USER32.DLL_FindWindowW]
mov word [esp + ebx*2], 0
mov ebx, eax
push esp
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleW]
mov eax, ebx
mov dword [esi + 0x3dc], eax
add esp, 0x220
pop esi
pop ecx
pop ebx
ret
Function at 0x2021d2
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
push ecx
push edx
mov ebx, section..data
cmp esi, 0xffff
ja 0x20224b
cmp edi, 0xffff
ja 0x20224b
call fcn.002020c4
push ebx
push esi
push edi
dec esi
dec edi
push di
push si
push 0
push esp
push 1
push dword [ebx + 0x98c]
call dword [sym.imp.KERNEL32.DLL_SetConsoleWindowInfo]
add esp, 8
inc esi
inc edi
pop edi
pop esi
pop ebx
cmp dword [ebx + 0x8f4], 2
je 0x202245
push ebx
push esi
push edi
call fcn.002020c4
push 0
push dword [ebx + 0x98c]
call dword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
call fcn.002020c4
call fcn.00201f25
pop edi
pop esi
pop ebx
cmp eax, esi
jne 0x20224b
cmp edx, edi
jne 0x20224b
pop edx
pop ecx
pop ebx
xor eax, eax
ret
pop edx
pop ecx
pop ebx
xor eax, eax
dec eax
ret

Function at 0x203ec9
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x203ee9
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.00203488
call fcn.0020342c
jb 0x203f0e
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.00201997

Function at 0x204033
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x204053
and esi, 0xfffffffe
jne 0x20405d
xchg dword [ebx], esi
call fcn.00203460
pop edi
pop esi
ret
call fcn.00203488
mov edi, dword [ebx]
or edi, edi
je 0x20406d
cmp ecx, dword [edi - 4]
je 0x20408d
call fcn.0020342c
jb 0x20409d
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00203460
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00203460
pop edi
pop esi
jmp fcn.00201997

Function at 0x205074
Capabilities:
Terminate process

Disassembly:
call fcn.00209a5f
call fcn.00201a73
mov dword [eax + 0x30], 0
jecxz 0x2050a7
cmp dword [ecx + 0xf4], 0x1a
jne 0x205096
or edx, 0x200
and dword [ecx + 0xc], 0xfffffdff
xor dword [ecx + 0xc], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x30], edx
ret
mov al, 5
jmp fcn.00201997
Function at 0x205665
Capabilities:
Create thread

Disassembly:
mov edx, esi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00203bb0
mov dword [esp + 0x24], esi
mov esi, edx
call 0x205681
pop eax
add eax, 0x59
lea ecx, [esp + 0x28]
lea edx, [esp + 4]
push ecx
push 0
push edx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esp + 0x28], eax
call fcn.002044e2
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x2056a5
mov ecx, eax
jecxz 0x2056cb
call fcn.00201a73
test dword [eax + 0x30], 0xffffffff
jne 0x2056cb
push ecx
xor eax, eax
xor edx, edx
call fcn.00205074
pop ecx
push ecx
mov eax, 0x32
call fcn.00204e58
pop eax
ret 0x2c
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x34260af8
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, str.CO
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4f0328cb
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402704
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004038a4
test esi, esi
jne 0x40273a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403924
jmp 0x402758
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402618
mov edi, eax
test esi, esi
je 0x402758
cmp dword [ebx], 0
je 0x402758
dec esi
jmp 0x402741
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c28
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x402c3e
sub ecx, 2
jne 0x402c60
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x402c67
cmp edx, dword [ebx + 8]
je 0x402c71
mov eax, 0x64
jmp 0x402c6c
mov eax, 0x67
jmp 0x402c6c
call sub.kernel32.dll_GetLastError
call fcn.0040259c
pop ebx
ret

Function at 0x403048
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030e0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030c0
xor eax, eax
push ebp
push 0x4030b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403728
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x403789
cmp word [0x406208], 0xd7b2
jne 0x403751
cmp dword [0x406210], 0
jbe 0x403751
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405078
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4037b0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405018], 0
jne 0x4037a5
push 0
push 0x405070
push 0x405078
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x403b20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403b86
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403960
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d98
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403b70
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b8d
lea eax, [ebp - 0x10]
call fcn.004038a4
ret
Function at 0x100291d
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x1001178
call fcn.010037c4
mov edi, 0x94
mov eax, edi
call fcn.01003810
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x10078d4], ecx
mov eax, dword [esi + 4]
mov dword [0x10078e0], eax
mov edx, dword [esi + 8]
mov dword [0x10078e4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10078d8], esi
cmp ecx, 2
je 0x100297d
or esi, 0x8000
mov dword [0x10078d8], esi
shl eax, 8
add eax, edx
mov dword [0x10078dc], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10029b8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10029b8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10029d0
cmp eax, 0x20b
je 0x10029bd
mov dword [ebp - 0x1c], esi
jmp 0x10029e4
cmp dword [ecx + 0x84], 0xe
jbe 0x10029b8
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x10029de
cmp dword [ecx + 0x74], 0xe
jbe 0x10029b8
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.01003772
pop ecx
test eax, eax
jne 0x10029f8
push 0x1c
call fcn.010028f9
pop ecx
call fcn.010036e9
test eax, eax
jne 0x1002a09
push 0x10
call fcn.010028f9
pop ecx
mov dword [ebp - 4], esi
call fcn.0100345c
test eax, eax
jge 0x1002a1d
push 0x1b
call fcn.010028d4
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1008094], eax
call fcn.01003336
mov dword [0x10078c4], eax
call fcn.01003294
test eax, eax
jge 0x1002a43
push 8
call fcn.010028d4
pop ecx
call fcn.01003048
test eax, eax
jge 0x1002a54
push 9
call fcn.010028d4
pop ecx
call fcn.01002b1a
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x1002a67
push eax
call fcn.010028d4
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.01002fdf
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x1002a88
movzx eax, word [ebp - 0x34]
jmp 0x1002a8b
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.01002870
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x1002aa9
push edi
call fcn.01002c39
call fcn.01002c5b
jmp 0x1002adb
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.010037fd
ret
Function at 0x1002c79
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x1007008]
je 0x1002c99
inc eax
cmp eax, 0x12
jb 0x1002c8a
shl eax, 3
cmp edx, dword [eax + 0x1007008]
mov dword [ebp + 8], eax
jne 0x1002e37
mov ecx, dword [0x10078cc]
cmp ecx, 1
je 0x1002e0c
test ecx, ecx
jne 0x1002ccb
cmp dword [0x1007004], 1
je 0x1002e0c
cmp edx, 0xfc
je 0x1002e37
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1002d06
push 5
pop ecx
mov esi, 0x10014ec
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002d15
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1002d4d
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002d2d
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x10014e8
push ebx
call fcn.01003aa0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002d52
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100700c]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002d69
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01003810
mov edx, esp
push 6
pop ecx
mov esi, 0x10014cc
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002d95
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1002da1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002dba
mov eax, dword [ebp + 8]
mov esi, 0x10014c8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x100700c]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002dd5
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1002de1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x10014a0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.010039a6
add esp, 0xc
jmp 0x1002e37
mov ecx, dword [eax + 0x100700c]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002e17
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret