joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x406e81
pop dword [ebp - 0x30]
mov eax, 0x406e81
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x5297a
push 0
mov eax, 0xdcbd4fe2
add eax, 0x238762ce
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xc7cb63c1
sub ecx, 0xc7cb11db
xor edx, edx
add edx, eax
mov ebx, 0xda72424e
add ebx, 0x25d51bb2
add ebx, dword [ebp - 0x30]
mov edi, 0x569bd9b6
add edi, 0x9f391875
sub dword [ebp - 0xc], esi
mov esi, dword [ebx]
sub dword [ebp - 0x1c], edx
xor esi, edi
xor dword [ebp - 8], ebx
mov dword [edx], esi
add edx, 4
add ebx, 0xdeef153d
sub ebx, 0xdeef1539
loop 0x406edd
add eax, 0x13a6b
xor ebx, ebx
add ebx, eax
add eax, 0xe2c64658
add eax, 0x1d39b9ad
mov ecx, 0x92998c0f
add ecx, 0x6da673f1
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x409a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x409a7f
pop dword [ebp - 0x4c]
mov eax, 0x6425be47
sub eax, 0x63e523c8
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xdd001678
sub dword [ebp - 0x5c], 0x8eadd12d
mov dword [ebp - 0x58], 0x805bdf77
sub dword [ebp - 0x58], 0x4e289332
mov dword [ebp - 0x54], 0xd69e31ce
sub dword [ebp - 0x54], 0x8a51eda0
mov dword [ebp - 0x50], 0x3d169a99
sub dword [ebp - 0x50], 0x3d169a99
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x2908ad49
sub eax, 0x28c77cb9
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xf91a0b99
sub dword [ebp - 0x5c], 0x84a7a243
mov dword [ebp - 0x58], 0x1e9eecda
sub dword [ebp - 0x58], 0xdd328b65
mov dword [ebp - 0x54], 0x2ab2da25
add dword [ebp - 0x54], 0x38bc9247
mov dword [ebp - 0x50], 0xfefd2ef9
sub dword [ebp - 0x50], 0xfefd2ef9
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x96b865da
add eax, 0x6988ca62
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x398ba
push 0
call eax
mov ecx, 0x7870307e
add ecx, 0x87901287
mov edx, eax
mov edi, 0x94931bcc
add edi, 0x6bae8434
add edi, dword [ebp - 0x4c]
mov esi, 0x41eb9526
sub esi, 0xe5da73d4
xor dword [ebp - 0x34], edx
mov ebx, dword [edi]
mov dword [ebp - 0x34], 0xa4571574
sub ebx, esi
sub dword [ebp - 0x48], 0x54fcb0f3
mov dword [edx], ebx
sub dword [ebp - 0x3c], 0x4567bd86
add edx, 0x42ce6339
add edx, 0xbd319ccb
add edi, 0x4274c5f
add edi, 0xfbd8b3a5
loop 0x409ba1
add eax, 0x10496469
add eax, 0xefb79a7e
mov ebx, eax
add eax, 0x831a8b63
add eax, 0x7ce574a2
mov ecx, 0x4a0934a8
sub ecx, 0x49c934a8
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x410280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41029c
mov dword [eax], ecx
jmp 0x41029e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410310
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x419b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x419b33
pop dword [ebp - 0x30]
mov eax, 0x419b33
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x50e2f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x4b28
xor edi, edi
add edi, eax
mov ebx, 0x475e00
add ebx, dword [ebp - 0x30]
mov esi, 0xb4a4fd55
add esi, 0x3a89af04
mov edx, dword [ebx]
mov dword [ebp - 4], 0xf1eb6ce3
sub edx, esi
xor dword [ebp - 0x1c], 0x78937443
mov dword [edi], edx
add edi, 4
add ebx, 0x802dcb43
sub ebx, 0x802dcb3f
loop 0x419b7e
add eax, 0x25ee277
sub eax, 0x25dc304
xor ebx, ebx
add ebx, eax
add eax, 0x2ed012fb
add eax, 0xd12fed0a
mov ecx, 0xd7e13c99
sub ecx, 0xd7a13c99
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x40cd96
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40cdb7
jl 0x40cdae
test edi, edi
jne 0x40cdb7
xor eax, eax
xor edx, edx
jmp 0x40ce78
cmp dword [ebx + 0x38], 0
je 0x40cdcc
push eax
push edi
push dword [ebp + 8]
call fcn.0040ce7e
jmp 0x40ce78
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40ce13
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40ce13
cmp eax, edi
jb 0x40cded
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040e510
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40ce19
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40ce6d
mov ecx, ebx
call fcn.0040c5de
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40ce58
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00419017
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40ce6d
jmp 0x40ce2b
test edx, edx
je 0x40ce6d
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00419017
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40e359
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40e398
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e398
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e398
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40e398
cmp dword [ecx + 0x74], 0xe
jbe 0x40e398
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41fe5b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x432628
push 0x432620
push str.FlsAlloc
push 0x1f
call fcn.0041fcc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41fe8f
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e130]
call esi
jmp 0x41fe95
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41fed9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x432638
push 0x432630
push str.FlsGetValue
push 0x21
call fcn.0041fcc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ff10
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41ff18
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x432640
push 0x432638
push str.FlsSetValue
push 0x22
call fcn.0041fcc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ff52
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42e130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4222f4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040e4c0
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041f6cc
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x422336
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x422492
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042c060
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43aa98]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004232f1
mov ecx, dword [esi*4 + 0x43aa98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x42248b
cmp eax, dword [ecx + edi + 0x24]
jne 0x42248b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42248b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004232f1
add esp, 0x14
test edx, edx
jl 0x42248b
jg 0x422401
test eax, eax
jb 0x42248b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x42248b
jl 0x42241b
cmp dword [ebp - 0x1008], eax
ja 0x42248b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x422439
test ebx, ebx
je 0x422472
cmp ecx, edi
jae 0x422472
mov al, byte [ecx]
cmp al, 0xd
jne 0x422453
lea eax, [edi - 1]
cmp ecx, eax
jae 0x42245f
cmp byte [ecx + 1], 0xa
jne 0x42245f
inc ecx
jmp 0x42245f
movzx eax, al
movsx eax, byte [eax + 0x439308]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x422439
cmp edx, ebx
jne 0x422439
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x422490
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040d6d4
leave
ret
Function at 0x422789
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43aa98]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4227c9
cmp byte [ebx], 0xa
jne 0x4227c9
or byte [edi + eax + 0x28], 4
jmp 0x4227ce
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4228cd
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4228b0
inc eax
cmp dl, 0xd
je 0x4227fa
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x422820
cmp eax, ecx
jae 0x42282e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4227e2
jmp 0x4228cd
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4228ab
cmp dword [ebp - 0x10], 0
je 0x4228ab
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x43aa98]
test byte [eax + edi + 0x28], 0x48
je 0x422885
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x422870
mov byte [esi], dl
jmp 0x422881
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43aa98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4228cd
cmp byte [ebp - 1], 0xa
jne 0x422894
cmp esi, ebx
jne 0x422894
mov byte [esi], 0xa
jmp 0x4228cc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042330f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4228cd
mov byte [esi], 0xd
jmp 0x4228cc
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x43aa98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4228ca
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4228cd
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4228d6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x43aa98]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42291c
cmp word [ebx], dx
jne 0x42291c
or byte [eax + edi + 0x28], 4
jmp 0x422921
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x422a84
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x422a64
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x422962
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x422998
cmp eax, edx
jae 0x4229a6
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x42293d
jmp 0x422a84
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422a5f
cmp dword [ebp - 0x18], 0
je 0x422a5f
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x43aa98]
test byte [eax + edi + 0x28], 0x48
je 0x422a35
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4229f9
mov word [esi], cx
jmp 0x422a30
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x43aa98]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x43aa98]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x43aa98]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x422a84
pop eax
cmp word [ebp - 4], ax
jne 0x422a45
cmp esi, ebx
jne 0x422a45
mov word [esi], ax
jmp 0x422a81
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0042330f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x422a84
push 0xd
pop eax
jmp 0x422a40
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x43aa98]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x422a7e
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x422a84
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x424bd2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x424c6f
push ebx
push esi
call fcn.00424b9b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042388d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x424c1c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x424c6e
push edi
push eax
call fcn.0041e888
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x424c3c
call fcn.0041e651
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x424c6d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042388d
add esp, 0x20
test eax, eax
jne 0x424c5b
push edi
call fcn.0041e651
jmp 0x424c63
push ebx
call fcn.0041e651
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42729c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041d390
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42730b
cmp esi, dword [ebp - 4]
je 0x427306
cmp dword [ebp + 0xc], 0
je 0x427306
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4272e3
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00426dee
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x42730d
xor eax, eax
inc eax
jmp 0x42730d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x427372
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0041d390
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041d390
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4273e9
cmp word [ecx], dx
je 0x4273e9
mov eax, dword [0x432aa4]
push edi
dec eax
push eax
push 0x432990
call fcn.00427311
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x42745c
cmp word [eax], dx
je 0x42745c
mov eax, dword [edi]
test eax, eax
je 0x42740d
cmp word [eax], dx
je 0x42740d
lea eax, [ebp - 0x10]
push eax
call fcn.00426cf4
jmp 0x427416
lea eax, [ebp - 0x10]
push eax
call fcn.00426d8f
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x427486
mov eax, dword [0x43298c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x432680
call fcn.00427311
add esp, 0xc
test al, al
je 0x427486
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x427451
cmp word [eax], di
je 0x427451
lea eax, [ebp - 0x10]
push eax
call fcn.00426cf4
pop ecx
jmp 0x427488
lea eax, [ebp - 0x10]
push eax
call fcn.00426d8f
jmp 0x42744e
mov eax, dword [edi]
test eax, eax
je 0x427473
cmp word [eax], dx
je 0x427473
lea eax, [ebp - 0x10]
push eax
call fcn.00426ca9
pop ecx
jmp 0x427486
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x427551
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00427196
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x427551
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x427551
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x427551
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4274de
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00420058
test ebx, ebx
je 0x42754c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00420058
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x427551
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x427551
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0042a267
add esp, 0x10
xor eax, eax
inc eax
jmp 0x427553
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d6d4
leave
ret
Function at 0x42bf60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42bf8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42bf8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret