joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d020
Capabilities:
Delete directory

Disassembly:
cmp dword [0x10075adc], 0
je 0x1001c564
push eax
push 0x1001ac19
push 0x10002
call fcn.10019068
add esp, 0xc
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1001c575
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
jmp fcn.1001d149
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
push ebx
mov dword [ebp - 0x14], eax
jl 0x1001d136
mov edi, dword [fcn.10028046]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x1001e9a3
mov eax, dword [ebp - 0x10]
and dword [ebp + 8], 0
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push dword [ebp - 0x14]
push eax
call dword [ecx + 0x20]
test eax, eax
mov dword [ebp - 0x1c], eax
jl 0x1001c548
push 0x1001a8f3
call esi
push eax
push dword [ebp + 8]
push 0x1001a8f3
call edi
add esp, 0xc
test eax, eax
jne 0x1001d095
mov eax, dword [ebp + 0xc]
jmp 0x1001d116
push fcn.10019068
call esi
push eax
push dword [ebp + 8]
push fcn.10019068
call edi
add esp, 0xc
test eax, eax
jne 0x1001d0b3
mov eax, dword [ebp + 0x10]
jmp 0x1001d116
push ebx
call esi
push eax
push dword [ebp + 8]
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x1001d0e6
push ebx
call esi
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*2]
push eax
call dword [0x10028216]
cmp eax, 0xc8
pop ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jbe 0x1001d11c
and dword [ecx], 0
jmp 0x1001d11c
push 0x1001bdce
call esi
push eax
push dword [ebp + 8]
push 0x1001bdce
call edi
add esp, 0xc
test eax, eax
jne 0x1001d11c
push 0x1001be53
push dword [ebp + 8]
call dword [0x10028b96]
test eax, eax
pop ecx
pop ecx
je 0x1001d11c
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jle 0x1001d055
xor esi, esi
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, esi
je 0x1001d147
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax

Function at 0x1001dd2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10070ad0]
jne fcn.10019fb8
ret
Function at 0x1001df7c
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1001c118
call fcn.1001cf48
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp + 8], edi
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0x1001daf8
push edi
push edi
push eax
mov dword [ebp - 4], edi
call dword [ecx + 0x24]
mov esi, eax
cmp esi, edi
jge 0x1001df20
cmp dword [0x10075adc], edi
je 0x1001df08
push esi
push 0x1001889f
push 0x10002
call fcn.10019068
add esp, 0xc
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x1001df19
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x1001dff6
mov esi, dword [0x100283de]
push ebx
lea eax, [ebp - 0x1c]
push eax
call esi
mov eax, dword [ebp + 8]
push edi
lea edx, [ebp - 0x1c]
push edx
push 0x1001c7fd
mov word [ebp - 0x1c], 8
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, eax
cmp ebx, edi
jge 0x1001df7c
cmp dword [0x10075adc], edi
je 0x1001df67
push ebx
push 0x1001bfd5
push 0x10002
call fcn.10019068
add esp, 0xc
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x1001df78
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
jmp 0x1001dff5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0x1c]
push eax
call esi
mov eax, dword [ebp + 8]
push edi
lea edx, [ebp - 0x1c]
push edx
push fcn.10017dc0
mov word [ebp - 0x1c], 3
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
je 0x1001dfba
cmp dword [0x10075adc], edi
je 0x1001dfe2
push esi
push 0x1001a965
jmp 0x1001dfd5
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1001dfe2
cmp dword [0x10075adc], edi
mov eax, 0x80004005
mov esi, eax
je 0x1001dfe2
push eax
push 0x1001ba9c
push 0x20002
call fcn.10019068
add esp, 0xc
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x1001dff3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1001e1c8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
or eax, 0xffffffff
xor ebx, ebx
cmp dword [edi + 0x58], 0xfa0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], esi
jl 0x1001e329
mov eax, dword [edi]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x24]
cmp eax, esi
jge fcn.1001e2e0
cmp dword [0x10075adc], esi
je 0x1001e233
push eax
push 0x1001dd17
push 0x10019702
push 0x10002
call fcn.10019068
add esp, 0x10
or eax, 0xffffffff
jmp 0x1001e329
Function at 0x1001e2e0
Capabilities:
Delete directory

Disassembly:
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [ebp - 0xc]
test dword [ebp + 0xc], eax
jne 0x100193c2
cmp dword [0x10075adc], ebx
je 0x10019454
push 0x1001b6b4
push 0x40002
call fcn.10019068
pop ecx
pop ecx
jmp 0x10019454
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [eax + 0x24]
mov ebx, eax
test ebx, ebx
jge 0x100193e3
cmp dword [0x10075adc], 0
je 0x10019413
push ebx
push 0x1001c04f
jmp 0x10019406
mov eax, dword [esi]
and dword [ebp + 8], 0
lea ecx, [ebp + 8]
push ecx
push esi
call dword [eax + 0x2c]
mov ebx, eax
test ebx, ebx
jge 0x1001941a
cmp dword [0x10075adc], 0
je 0x10019413
push ebx
push 0x1001aef8
push 0x10002
call fcn.10019068
add esp, 0xc
mov eax, ebx
jmp 0x100195e0
push 3
push dword [ebp + 8]
push 0x10017b4d
call edi
add esp, 0xc
test eax, eax
je fcn.1001945c
cmp dword [0x10075adc], 0
je 0x1001944b
push dword [ebp + 8]
push 0x100188d9
push 0x10002
call fcn.10019068
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
inc eax
jmp 0x100195e0
pop edi
pop esi
pop ebx
leave
ret 0x18
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push 1
push edi
push 8
push esi
call dword [eax + 0x34]
mov esi, eax
test esi, esi
jge 0x1001e18f
cmp dword [0x10075adc], 0
je 0x1001e18f
push esi
push 0x1001d604
push 0x1001b88d
jmp 0x1001e182
push 0x10002
call fcn.10019068
add esp, 0x10
mov eax, esi
pop edi
pop esi
leave
ret 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.10019244
cmp eax, esi
jl fcn.1001ebc0
test byte [ebp - 0x18], 8
je 0x1001e2a4
cmp dword [ebp - 0x1c], esi
jne 0x1001e2a4
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push sym.imp.KERNEL32.dll_GetSystemTime
push eax
call dword [ecx]
cmp eax, esi
jl 0x1001938f
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x14]
push edx
push 1
push eax
call dword [ecx + 0x10]
cmp eax, esi
jl 0x1001e12d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add ebx, dword [ebp - 0x14]
mov dword [ebp - 8], esi
mov dword [ebp - 0x24], ebx
test byte [ebp - 0x17], 0x80
je 0x1001e2d4
cmp dword [ebp - 0x1c], 1
jne 0x1001e2d4
push esi
push 0x10059190
push 0x10070ae0
push esi
push dword [ebp - 4]
call fcn.1001cf94
add esp, 0x14
cmp eax, esi
je 0x1001e2d4
mov eax, dword [eax + 0x13c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 4]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x1001e23b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
fild dword [edi + 0x58]
fild dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x28], eax
fmul qword [fcn.10018b94]
fsubp st(1)
fild dword [ebp - 0x28]
fdivp st(1)
call fcn.10018b04
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002a06b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10073730]
jne 0x1002a075
repz ret
jmp fcn.10045f68

Function at 0x1002bf8a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1002bfbb
call fcn.1002bde4
mov dword [eax], esi
call fcn.1002bdd1
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1002bd4e
add esp, 0x14
push 0x16
pop eax
jmp 0x1002c010
test dword [ebp + 0xc], 0xfffffff9
jne 0x1002bf97
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002bfe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1002bdf7
pop ecx
call fcn.1002bdd1
mov eax, dword [eax]
jmp 0x1002c010
test al, 0x10
jne 0x1002c00e
test al, 1
je 0x1002c00e
test byte [ebp + 0xc], 2
je 0x1002c00e
call fcn.1002bde4
mov dword [eax], 5
call fcn.1002bdd1
mov dword [eax], 0xd
jmp 0x1002bfdf
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10048282
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10028ed1
and dword [ebp - 4], 0
cmp dword [0x100765d0], 0
mov ebx, eax
jne 0x10048333
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100483e4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100483e4
push eax
call fcn.10028e5f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100765d0], eax
call esi
push eax
call fcn.10028e5f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100765d4], eax
call esi
push eax
call fcn.10028e5f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100765d8], eax
call esi
push eax
call fcn.10028e5f
pop ecx
mov dword [0x100765e0], eax
test eax, eax
je 0x10048333
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10028e5f
pop ecx
mov dword [0x100765dc], eax
mov eax, dword [0x100765dc]
cmp eax, ebx
je 0x1004838b
cmp dword [0x100765e0], ebx
je 0x1004838b
push eax
call fcn.10028eda
push dword [0x100765e0]
mov esi, eax
call fcn.10028eda
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1004838b
test edi, edi
je 0x1004838b
call esi
test eax, eax
je 0x10048382
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10048382
test byte [ebp - 0xc], 1
jne 0x1004838b
or dword [ebp + 0x10], 0x200000
jmp 0x100483c4
mov eax, dword [0x100765d4]
cmp eax, ebx
je 0x100483c4
push eax
call fcn.10028eda
pop ecx
test eax, eax
je 0x100483c4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100483c4
mov eax, dword [0x100765d8]
cmp eax, ebx
je 0x100483c4
push eax
call fcn.10028eda
pop ecx
test eax, eax
je 0x100483c4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100765d0]
call fcn.10028eda
pop ecx
test eax, eax
je 0x100483e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100483e6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100057d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x100057f5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x10005868
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x1000582a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x1000585d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x1000585b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x10005821
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x100057ec
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a200
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x461040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401e17
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401e17
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401df7
cmp esi, edx
jae 0x401e17
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401de5
cmp esi, edx
jae 0x401e17
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x40604a
mov edx, dword [esp + 0xc]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x406034
pop edi
mov eax, edx
pop esi
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
ret

Function at 0x406160
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x210]
sub esp, 0x210
push 0xffffffffffffffff
push 0x44aa0d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x461040]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebx], 0x457308
mov dword [ebx + 4], 0
mov dword [ebp - 4], 0
lea eax, [ebp]
push 0x105
push eax
mov dword [ebx + 8], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x406258
cmp eax, 0x105
jae 0x406258
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401fe0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 1
push 0x45932c
call fcn.00402890
push 9
push str.ntdll.dll
lea ecx, [ebp - 0x10]
call fcn.00402890
mov esi, dword [ebp - 0x10]
push 0x5c
push esi
call fcn.0042a8aa
add esp, 8
test eax, eax
je 0x406225
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x406253
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x44e26c]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
jmp 0x40625a
xor edi, edi
mov eax, dword [ebx + 4]
cmp edi, eax
je 0x406277
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x44e26c]
mov ecx, ebx
call esi
mov dword [ebx + 4], edi
mov eax, edi
test eax, eax
jne 0x406284
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.00429557
lea esp, [ebp + 0x210]
pop ebp
ret 8
Function at 0x40c480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b99f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x461040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.004168b7
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x40c531
push eax
push esi
call fcn.00416772
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.00412727
int3
Function at 0x4119b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c52d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x461040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], 0x457750
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
mov eax, edi
cmp word [edi], cx
je 0x411a2a
nop dword [eax + eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x411a20
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ecx + ecx]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x457750
test esi, esi
je 0x411a63
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411fe0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c727
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x461040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x270]
mov esi, eax
call fcn.00404d00
mov dword [ebp - 4], 0
push 0x1000
call fcn.00404f60
lea ecx, [ebp - 0x270]
call fcn.00404380
mov edi, eax
mov edx, 0x4598e8
push 0
push esi
mov ecx, edi
mov dword [ebp - 0x268], edi
call fcn.00408870
add esp, 8
mov ecx, esi
call fcn.00408960
xor ecx, ecx
cmp word [eax], 0x22
sete cl
lea ecx, [ecx*2 + 0x20]
movzx edx, cx
lea ecx, [eax + 2]
call fcn.00408840
lea ecx, [eax + 2]
call fcn.00408960
mov esi, eax
mov ecx, esi
call fcn.00408de0
test al, al
je 0x41209d
mov edx, edi
mov ecx, esi
call fcn.004089d0
mov esi, eax
jmp 0x4121e6
push ecx
lea ecx, [ebp - 0x28c]
call fcn.00411130
mov byte [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x28c]
mov ecx, esi
call fcn.00411450
add esp, 4
lea ecx, [ebp - 0x230]
push dword [ebp - 0x28c]
call fcn.00402af0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00409380
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x230]
call fcn.00403dd0
lea eax, [ebp - 0x294]
mov ecx, 0x4637f4
push eax
call fcn.00404540
lea ecx, [ebp - 0x248]
mov edi, dword [eax]
mov esi, dword [eax + 4]
lea eax, [ebp - 0x260]
push eax
call fcn.00409810
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x29c]
push ecx
mov ecx, eax
call fcn.00404540
push esi
push edi
xor cl, cl
push dword [eax + 4]
push dword [eax]
call fcn.0040ae80
add esp, 0x10
mov byte [ebp - 0x261], al
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x260]
call fcn.00403dd0
cmp byte [ebp - 0x261], 0
je 0x41219c
push dword [ebp - 0x288]
lea ecx, [ebp - 0x230]
call fcn.00402af0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x230]
call fcn.00411d00
mov esi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x230]
call fcn.00403dd0
cmp esi, 0xffff
je 0x4121c8
mov edi, dword [ebp - 0x268]
lea ecx, [ebp - 0x28c]
mov edx, edi
call fcn.00409060
cmp word [ebp - 0x218], 0
mov esi, eax
je 0x4121c8
lea edx, [ebp - 0x218]
mov ecx, edi
call fcn.004119b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.004040e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28c]
call fcn.004121f0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4127c1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4127e8
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4127eb
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0041279d
pop esi
leave
ret 8
Function at 0x429007
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00438efe
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x429046
sub eax, 1
je 0x429041
sub eax, 1
je 0x42903d
xor eax, eax
leave
ret
push 3
jmp 0x429048
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x43e5c4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x453770
push 0x453768
push str.FlsAlloc
push 0x1e
call fcn.0043e431
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43e5f8
push dword [ebp + 8]
mov ecx, esi
call dword [0x44e26c]
call esi
jmp 0x43e5fe
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43e642
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x453780
push 0x453778
push str.FlsGetValue
push 0x20
call fcn.0043e431
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43e679
push dword [ebp + 8]
mov ecx, esi
call dword [0x44e26c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]