joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401099
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0xffffffff
je 0x4010b3
push esi
call fcn.00401023
test eax, eax
jne 0x4010bb
or eax, 0xffffffff
jmp 0x401154
and dword [ebp + 8], 0
test byte [esi + 7], 0x80
je 0x401151
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 8]
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
sub ecx, edx
mov ebx, 0x10000
sbb eax, edi
test eax, eax
jg 0x4010ee
jl 0x4010e8
cmp ecx, ebx
jae 0x4010ee
mov ebx, dword [esi + 8]
sub ebx, dword [esi + 0x10]
or dword [ebp + 8], 0xffffffff
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x18]
mov ecx, edi
mov dword [ebp - 8], eax
test ebx, ebx
mov dword [ebp - 4], ecx
jbe 0x401151
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x401125
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401151
lea eax, [ebp + 8]
push 0
push eax
lea eax, [esi + 0x34]
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401151
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x401151
lea eax, [eax + esi + 0x34]
mov dword [esi + 0x30], 1
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40115b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x10034
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x40117c
or eax, 0xffffffff
jmp 0x4011e7
mov eax, dword [ebp + 0x10]
push edi
push dword [ebp + 0x1c]
test al, 1
push dword [ebp + 0x18]
push edi
je 0x40118d
or al, 2
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4011ad
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
or esi, 0xffffffff
jmp 0x4011e5
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x18], edi
mov dword [esi + 4], ecx
lea ecx, [esi + 0x10034]
mov dword [esi + 0x2c], ecx
lea ecx, [ebp - 4]
push ecx
mov dword [esi + 0x10], edi
push eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
push esi
mov dword [esi + 0xc], eax
call fcn.00401000
mov eax, esi
pop edi
pop esi
leave
ret 0x1c
Function at 0x401a83
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
push eax
and dword [ebp - 4], 0
push 1
pop esi
push esi
push 0
push str.Control_Paneldesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401aaf
xor eax, eax
jmp 0x401add
lea eax, [ebp + 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push dword [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x401ae2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
push 0xa
pop esi
lea eax, [ebp - 0x70]
push eax
mov eax, dword [0x409878]
push 0x64
mov dword [0x409850], esi
push dword [eax + 0xb0]
lea eax, [ebp - 0x5e]
push eax
call fcn.00401940
mov eax, dword [0x409868]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 1
test eax, eax
pop ebx
jne 0x401b36
lea eax, [ebp - 0x70]
mov dword [0x409850], esi
push eax
push 0x64
push str.System
jmp 0x401bfe
cmp eax, ebx
jne 0x401b99
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 3
push eax
push ebx
push 0
push str.Control_Paneldesktopwindowmetrics
push 0x80000001
mov dword [ebp - 8], 0x32
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401cad
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.MessageFont
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401ca4
movsx eax, word [ebp - 0x70]
mov dword [0x409850], eax
jmp 0x401ca4
cmp eax, 2
jne 0x401c0c
lea eax, [ebp - 0x70]
push 4
push eax
push str.IconTitleSize
call fcn.00401a83
test eax, eax
je 0x401bc0
lea eax, [ebp - 0x70]
push eax
call fcn.00401a49
mov dword [0x409850], eax
lea eax, [ebp - 0x5e]
push 0x20
push eax
push str.IconTitleFaceName
call fcn.00401a83
mov eax, dword [0x409878]
push dword [eax + 0xb0]
lea eax, [ebp - 0x5e]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401cad
lea eax, [ebp - 0x70]
push eax
mov eax, dword [0x409878]
push 0x64
push dword [eax + 0xb4]
lea eax, [ebp - 0x5e]
push eax
call fcn.00401940
jmp 0x401cad
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 3
push eax
push ebx
push 0
push str.Control_Paneldesktopwindowmetrics
push 0x80000001
mov dword [ebp - 8], 0x5c
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401cad
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.MessageFont
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401c8d
mov eax, dword [ebp - 0x70]
test eax, eax
jl 0x401c63
mov dword [0x409850], eax
jmp 0x401c6e
push 0xfffffffffffffffd
pop ecx
sub ecx, eax
mov dword [0x409850], ecx
mov eax, dword [0x409878]
lea edx, [ebp - 0x54]
add eax, 0xb8
sub edx, eax
mov cx, word [eax + edx]
mov word [eax], cx
inc eax
inc eax
test cx, cx
jne 0x401c7d
jmp 0x401ca4
mov eax, dword [0x409878]
push 0x20
add eax, 0xb8
push eax
lea eax, [ebp - 0x5e]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x409868], 3
jge 0x401ccd
mov eax, dword [0x409878]
push 0x20
add eax, 0xb8
push eax
lea eax, [ebp - 0x5e]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call edi
mov eax, dword [0x409878]
push 8
lea ecx, [eax + 0x138]
push ecx
push 0xffffffffffffffff
push dword [eax + 0xb0]
push ebx
push ebx
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d25
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
push dword [ebp + 8]
add edi, 0x46
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 8], eax
je 0x401ec5
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0x40
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x401eb9
push 0x12
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], esi
pop eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov cl, byte [ecx]
mov byte [edx], cl
inc dword [ebp + 0xc]
inc dword [ebp - 4]
dec eax
jne 0x401d86
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401cec
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401cec
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401cec
mov eax, dword [esi]
test al, 0x40
jne 0x401dfa
mov cx, word [0x409850]
or al, 0x40
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov word [eax], cx
add dword [ebp + 0xc], 2
cmp dword [ebp + 0x10], 1
mov eax, dword [0x409878]
je 0x401ded
add eax, 0xb8
jmp 0x401df2
add eax, 0x138
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
jmp 0x401e52
cmp dword [0x409868], 0
je 0x401e4f
mov eax, dword [ebp + 0xc]
mov cx, word [0x409850]
mov word [eax], cx
add dword [ebp + 0xc], 2
add dword [ebp - 4], 2
cmp dword [ebp + 0x10], 1
mov eax, dword [0x409878]
je 0x401e2a
add eax, 0xb8
jmp 0x401e2f
add eax, 0x138
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401cec
mov eax, dword [ebp - 4]
movzx eax, word [eax]
add dword [ebp - 4], 2
test eax, eax
jne 0x401e3f
jmp 0x401e5c
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401cec
mov eax, dword [ebp + 0xc]
sub eax, esi
and eax, 3
je 0x401e6d
push 4
pop ecx
sub ecx, eax
mov eax, ecx
test eax, eax
jle 0x401e7d
mov ecx, dword [ebp + 0xc]
and byte [ecx], 0
inc dword [ebp + 0xc]
dec eax
jne 0x401e71
mov eax, dword [ebp - 4]
sub eax, ebx
and eax, 3
je 0x401e8e
push 4
pop ecx
sub ecx, eax
mov eax, ecx
test eax, eax
jle 0x401e95
add dword [ebp - 4], eax
lea eax, [edi + ebx - 0x46]
cmp dword [ebp - 4], eax
mov dword [ebp - 8], eax
ja 0x401eb9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ecx], al
inc dword [ebp + 0xc]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jbe 0x401ea1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x40216d
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, dword [0x409878]
push esi
or esi, 0xffffffff
mov ecx, dword [eax + 0x6c]
test ecx, ecx
je 0x4021b1
cmp ecx, esi
je 0x4021b1
mov eax, dword [eax + 0x37fa]
push ecx
cmp byte [eax + 5], 0x64
je 0x4021a6
call fcn.00401754
mov eax, dword [0x409878]
add eax, 0x13c90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4021ac
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x409878]
mov ecx, dword [eax + 0x68]
test ecx, ecx
je 0x4021c7
cmp ecx, esi
je 0x4021c7
push ecx
call fcn.00401754
mov eax, dword [0x409878]
mov ecx, dword [0x4098a4]
mov dword [eax + 0x6c], esi
test ecx, ecx
mov dword [eax + 0x68], esi
je 0x4021e5
push 0
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, dword [0x409878]
mov ecx, dword [eax + 0x37fa]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
test ecx, ecx
je 0x4021fd
push ecx
call esi
mov eax, dword [0x409878]
test eax, eax
je 0x402209
push eax
call esi
mov eax, dword [0x409878]
push 0x2010
push str.WinSFX32M
push dword [eax + 0x194]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 8]
call sub.CRTDLL.dll_exit
pop ecx
pop esi
ret 4

Function at 0x4022e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
mov esi, 0x80
push edi
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x84]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00401900
cmp dword [0x409868], edi
jne 0x402346
push esi
lea eax, [ebp - 0x84]
push 0x4091e4
push eax
call fcn.004019a1
push esi
lea eax, [ebp - 0x84]
push dword [ebp + 0x10]
push eax
call fcn.004019a1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
jmp 0x40235d
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x84]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402371
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.00401900
jmp 0x4023c6
cmp dword [0x409868], edi
jne 0x40238c
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
jmp 0x4023ab
lea eax, [ebp + 0x1c]
mov dword [ebp + 0xc], 1
push eax
lea eax, [ebp + 0xc]
push dword [ebp + 0x18]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4023bd
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.00401900
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 0x18
Function at 0x4029c5
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
dec ecx
test eax, eax
mov eax, dword [0x409878]
jle 0x402a10
push edi
push esi
mov esi, dword [esp + 0xc]
push ebx
lea edi, [ecx + 1]
mov cx, word [eax + 0x3a0]
movzx ebx, byte [esi]
mov edx, ecx
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, ch
mov cx, word [eax + edx*2 + 0x198]
xor cx, bx
inc esi
dec edi
mov word [eax + 0x3a0], cx
jne 0x4029df
pop ebx
pop esi
pop edi
mov ax, word [eax + 0x3a0]
ret 8

Function at 0x403980
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
push 1
pop ebx
lea eax, [ebp - 0x68]
push 0x64
push eax
push 0x409274
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4039f5
mov cl, byte [ebp - 0x68]
lea eax, [ebp - 0x68]
test cl, cl
je 0x4039cc
cmp cl, 0x2b
je 0x4039cc
cmp cl, 0x2d
je 0x4039cc
cmp cl, 0x30
jb 0x4039c6
cmp cl, 0x39
jbe 0x4039cc
mov cl, byte [eax + 1]
inc eax
jmp 0x4039ae
mov cl, byte [eax]
cmp cl, 0x2d
jne 0x4039d7
xor ebx, ebx
jmp 0x4039dc
cmp cl, 0x2b
jne 0x4039dd
inc eax
mov cl, byte [eax]
cmp cl, 0x30
jb 0x4039f5
cmp cl, 0x39
ja 0x4039f5
movzx ecx, cl
lea edx, [esi + esi*4]
lea esi, [ecx + edx*2 - 0x30]
jmp 0x4039dc
imul esi, esi, 0xe10
test ebx, ebx
je 0x403a03
sub edi, esi
jmp 0x403a05
add edi, esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4044cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
xor esi, esi
push edi
push esi
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x40452e
lea eax, [ebp - 0x54]
push eax
call fcn.004044ab
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x220
push 1
push esi
push esi
push str.PROGMAN.EXE
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xbb8
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov edi, str.PROGMAN
mov dword [0x409898], eax
push edi
call esi
push edi
mov ebx, eax
call esi
mov esi, eax
movzx eax, si
movzx ecx, bx
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
push 0x3e0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40457a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 4
je 0x404597
cmp edi, 1
jne 0x404667
cmp edi, 4
mov ebx, dword [ebp + 0x18]
jne 0x4045a5
push ebx
call fcn.00403f06
mov dword [ebp + 0x18], eax
push 0x50
lea eax, [ebp - 0x54]
push dword [ebp + 0xc]
push eax
call fcn.00401900
xor esi, esi
cmp dword [0x409868], esi
jne 0x404607
push 0x50
lea eax, [ebp - 0x54]
push 0x4091e4
push eax
call fcn.004019a1
push 0x50
lea eax, [ebp - 0x54]
push dword [ebp + 0x10]
push eax
call fcn.004019a1
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x404659
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push 1
push esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
jmp 0x404659
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x14]
push eax
mov eax, dword [0x409878]
push esi
push 0x20006
push esi
push dword [eax + 0xac]
lea eax, [ebp - 0x54]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404659
cmp edi, 1
jne 0x404645
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
push edi
jmp 0x40464c
lea eax, [ebp + 0x18]
push 4
push eax
push edi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp + 0x14], esi
je 0x404667
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x406f34
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408190
push 0x407084
push eax
mov eax, dword [0x409818]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x409814]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.0040707a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x409810]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x40b004
push section..CRT
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x406fcf
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x406fc7
cmp al, 0x22
jne 0x406fbc
cmp byte [esi], 0x22
jne 0x406fd9
inc esi
jmp 0x406fd9
cmp al, 0x20
jbe 0x406fd9
inc esi
cmp byte [esi], 0x20
ja 0x406fd3
cmp byte [esi], 0
je 0x406fe9
cmp byte [esi], 0x20
ja 0x406fe9
inc esi
cmp byte [esi], 0
jne 0x406fde
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x407009
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x407045
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424c60
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00424cdf
jae 0x424c6c
xor ecx, ecx
call fcn.00424cdf
jae 0x424c96
xor eax, eax
call fcn.00424cdf
jae 0x424ca7
mov al, 0x10
call fcn.00424cdf
adc al, al
jae 0x424c88
jne 0x424cd4
stosb byte es:[edi], al
jmp 0x424c6d
call fcn.00424ceb
dec ecx
loop 0x424cb3
mov eax, ebp
call fcn.00424ce9
jmp 0x424cd5
lodsb al, byte [esi]
shr eax, 1
je 0x424cfb
adc ecx, 2
mov ebp, eax
jmp 0x424cd5
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00424ce9
cmp eax, 0x7d00
jae 0x424cd3
cmp eax, 0x500
jae 0x424cd4
cmp eax, 0x7f
ja 0x424cd5
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x424c6d
pop ebp
ret 8
Function at 0x401da0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x401deb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401de4
test esi, esi
je 0x401de4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401dc0
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401fd0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402020
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4020f4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40205e
cmp eax, 4
jne 0x402080
test esi, esi
je 0x402072
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x402064
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x4020bf
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x4020b1
cmp ecx, 0x40
je 0x402072
cmp ecx, 4
je 0x402072
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401fd0
lea esi, [esi]
Function at 0x404270
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x4042ab
jmp 0x4042fe
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x4042a8
cmp al, 9
je 0x4042a8
cmp al, 0x22
jne 0x4042e7
lea esi, [esi]
mov edx, ebx
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 0x22
je 0x4042d5
test al, al
jne 0x4042c0
cmp al, 0x22
jne 0x4042f3
lea ebx, [edx + 2]
jmp 0x4042f3
cmp al, 9
je 0x4042f3
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x4042e0
jmp 0x4042f3
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x4042f0
cmp al, 9
je 0x4042f0
mov esi, 0xa
test byte [ebp - 0x30], 1
je 0x40430d
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x10032b90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101fe4b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x10032c7f
push 0x55
push 0x101fe4b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10032c68
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.10108310
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x101fe4b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10032c13
inc edx
cmp edx, 0x55
jl 0x10032bf0
mov byte [ebp - 8], 0
push 0x41
call fcn.1013e704
mov esi, eax
add esp, 4
test esi, esi
je 0x10032c67
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.1013e704
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x10032c5e
push 0x10032340
push 0x15
mov byte [eax + esi], 0
mov dword [0x101fe4b0], esi
mov byte [0x101fe4b4], 1
call fcn.1013e704
add esp, 8
jmp 0x10032c67
push esi
call fcn.1013e704
add esp, 4
pop esi
mov eax, dword [0x101fe4b0]
mov ecx, 0x10166518
test eax, eax
cmovne ecx, eax
mov dword [0x101fe4b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret