joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c2a0
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x40c2eb
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0040c43f
test al, al
jne 0x40c2e5
sub edx, 2
cmp edx, edi
jne 0x40c2cb
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x40c30d
lea eax, [edi + 2]
cmp edx, eax
je 0x40c30d
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040c1ec
add esp, 0x10
jmp 0x40c407
push esi
lea ecx, [ebp - 0x255]
call fcn.0040c43f
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c350
push dword [ebp - 0x25c]
jmp 0x40c2fd
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x40c38d
cmp word [ebp - 0x226], 0
je 0x40c3ae
cmp word [ebp - 0x226], ax
jne 0x40c38d
cmp word [ebp - 0x224], 0
je 0x40c3ae
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0040c1ec
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x40c3fa
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40c367
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40c3e2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40c407
push 0x40c01c
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00411240
add esp, 0x10
jmp 0x40c3d7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401e16
leave
ret

Function at 0x40ce4a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x40ce5b
pop esi
ret
push ebx
push edi
push esi
call fcn.0040ce13
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0040adc3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40ce83
push ebx
push esi
push edi
call fcn.004037a0
add esp, 0xc
push 0
call fcn.0040a07a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40d247
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040ce98
Function at 0x4144e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41450d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41450d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x40f560
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x5fe470], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5fe46c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5fe470], edx
cmp eax, 0x26f
jl 0x40f570
mov dword [0x583fb0], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x40f5b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5fe474]
mov ebx, dword [eax*4 + 0x5fe470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5feaa4]
mov dword [eax*4 + 0x5fe470], edx
cmp eax, 0xe2
jl 0x40f5c0
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5fe474]
mov ebx, dword [eax*4 + 0x5fe470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5fe0e4]
mov dword [eax*4 + 0x5fe470], edx
cmp eax, 0x26e
jl 0x40f610
mov edx, dword [0x5fe470]
mov ecx, dword [0x5fee2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5feaa0]
mov dword [0x5fee2c], eax
mov dword [0x583fb0], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f6a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x583fb0]
add dword [0x583fb0], 1
mov eax, dword [0x5fd020]
cmp eax, dword [0x583700]
jne 0x40f6c6
cmp ebx, 0x271
jb 0x40f6e8
mov eax, dword [0x5fd020]
call fcn.0040f560
not dword [0x5fd020]
mov eax, dword [0x5fd020]
mov dword [0x583700], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x40f704
call fcn.0040f5b0
xor ebx, ebx
mov dword [0x583fb0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5fe470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411330
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x583450]
cmp ax, 0xcb
je 0x41143c
cmp ax, 0xcc
je 0x41143c
mov edx, dword [0x5ff070]
test edx, edx
je 0x411365
mov eax, dword [0x5fef20]
call edx
mov ebx, eax
jmp 0x41136a
mov ebx, 0x5fef24
cmp word [0x5fef10], 0
jle 0x411390
mov eax, 0x5feef0
call fcn.004115b0
mov eax, ebx
call fcn.00410eb0
mov eax, ebx
call fcn.00410f30
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x4113b2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4113ad
mov edx, edi
mov eax, ebx
call fcn.00410300
jmp 0x4113b0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x411398
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5fef10], 0
jle 0x41143c
mov edx, 0x5fee30
mov eax, ebx
call fcn.00410450
mov edi, eax
test edi, edi
je 0x41140c
mov eax, dword [0x5feec4]
mov dword [edi + 0xc], eax
cmp dword [0x5feec4], 0
je 0x411400
mov eax, dword [0x5feec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5feec4], eax
nop
sub word [0x5fef10], 1
cmp word [0x5fef10], 0
sete bl
mov eax, 0x5feef0
call fcn.004115d0
test bl, bl
je 0x41143c
mov eax, 0x5feef0
call fcn.004115a0
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413bf0
push ebp
push 0x414ff0
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x413d3a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b9a0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x413c9f
mov edx, 0x5fe2f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413cf1
call sub.kernel32.dll_GetLastError
call fcn.004040e0
lea eax, [ebp - 0x10]
call fcn.0040a260
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a800
mov edx, dword [ebp - 0x14]
mov ecx, 0x59f314
lea eax, [ebp - 0x10]
call fcn.0040a590
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b280
jmp 0x413d88
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x413d0a
cmp eax, ecx
je 0x413d14
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b9a0
cmp byte [0x5836d0], 0
jne 0x413d88
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bf40
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b310
lea esi, [esi]
jmp 0x413d88
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b9a0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x413d5e
mov eax, 0x5fe2f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5836d0], 0
jne 0x413d88
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bf40
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b310
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413bf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414140
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5fe260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00414320
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5fe260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403660
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5834d0], eax
mov ebx, eax
jmp 0x4142e3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x4141c8
cmp byte [ebx], 0
je 0x4142ec
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x414243
mov al, byte [ebx]
cmp al, 1
jb 0x414238
sub al, 0x20
jbe 0x414208
sub al, 2
je 0x41421c
jmp 0x414238
mov al, byte [ebp - 0x114]
test al, al
je 0x414248
add dword [ebp - 0x110], 1
jmp 0x414240
cmp byte [ebx + 1], 0x22
je 0x414233
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x414240
add ebx, 1
jmp 0x414240
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4141f8
test dword [ebp - 0x10c], 0xffffffff
je 0x4142dc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00414320
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5fe260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x4142d3
mov al, byte [ebx]
cmp al, 1
jb 0x4142c8
sub al, 0x20
jbe 0x414298
sub al, 2
je 0x4142ac
jmp 0x4142c8
mov al, byte [ebp - 0x114]
test al, al
je 0x4142d8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x4142d0
cmp byte [ebx + 1], 0x22
je 0x4142c3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4142d0
add ebx, 1
jmp 0x4142d0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x414288
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x4141cb
mov ebx, dword [ebp - 0x10c]
mov dword [0x5fe250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5fe260
call fcn.00411160
mov eax, dword [0x5fe260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417a00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dx, 0xffff
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x417a31
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x417a33
shr ecx, 1
cmp bx, 8
jl 0x417a18
movzx eax, dx
mov dword [eax*4 + 0x620d00], ecx
cmp dx, 0xff
jl 0x417a08
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x620d04], 0
jne 0x417a6c
call fcn.00417a00
mov esi, esi
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x417aa4
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x620d00]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x417a80
mov esi, esi
not eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c140
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.0042c120
push ebp
push 0x414ff0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x621120]
mov eax, dword [eax + 0x4a0]
mov edx, dword [0x621120]
mov edx, dword [edx + 0x4a0]
mov edx, dword [edx]
call dword [edx + 0x4f8]
mov byte [ebp - 4], 0x40
lea esi, [esi]
add byte [ebp - 4], 1
lea eax, [ebp - 0xc]
call fcn.00403b30
push 0
mov al, byte [ebp - 4]
lea ecx, [ebp - 0x10]
xor dx, dx
call fcn.00409360
mov edx, dword [ebp - 0x10]
mov ecx, 0x5a492c
lea eax, [ebp - 0xc]
call fcn.00408b60
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x42c1d0
mov eax, 0x5fe2f0
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 8], eax
test eax, eax
je 0x42c2ac
mov eax, dword [ebp - 8]
cmp eax, 2
jl 0x42c2ac
sub eax, 2
je 0x42c1fc
sub eax, 3
je 0x42c254
jmp 0x42c2ac
lea eax, [ebp - 0x10]
call fcn.00403b30
push 0
mov al, byte [ebp - 4]
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.00409360
mov edx, dword [ebp - 0x14]
mov ecx, 0x5a492c
lea eax, [ebp - 0x10]
call fcn.00408b60
mov edx, dword [ebp - 0x10]
mov eax, dword [0x621120]
mov eax, dword [eax + 0x4a0]
mov eax, dword [eax + 0x398]
mov ecx, dword [0x621120]
mov ecx, dword [ecx + 0x4a0]
mov ecx, dword [ecx + 0x398]
mov ecx, dword [ecx]
call dword [ecx + 0xa8]
jmp 0x42c2ac
lea eax, [ebp - 0x14]
call fcn.00403b30
push 0
mov al, byte [ebp - 4]
lea ecx, [ebp - 0x10]
xor dx, dx
call fcn.00409360
mov edx, dword [ebp - 0x10]
mov ecx, 0x5a492c
lea eax, [ebp - 0x14]
call fcn.00408b60
mov edx, dword [ebp - 0x14]
mov eax, dword [0x621120]
mov eax, dword [eax + 0x4a0]
mov eax, dword [eax + 0x398]
mov ecx, dword [0x621120]
mov ecx, dword [ecx + 0x4a0]
mov ecx, dword [ecx + 0x398]
mov ecx, dword [ecx]
call dword [ecx + 0xa8]
mov esi, esi
cmp byte [ebp - 4], 0x5a
jb 0x42c198
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0042c120
mov esp, ebp
pop ebp
ret
Function at 0x42e510
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x42e5ba
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x42e5d6
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x42e5d6
sub dx, 0x20
je 0x42e5b0
sub dx, 0x80
je 0x42e5b0
sub dx, 0x1f62
jb 0x42e5d6
sub dx, 1
jbe 0x42e5b0
sub dx, 6
je 0x42e5b0
sub dx, 0x26
jne 0x42e5d6
nop
jmp 0x42e5b0
cmp eax, dword [ebp - 0x20]
jg 0x42e558
lea esi, [esi]
jmp 0x42e5d6
cmp dword [ebp - 0x1c], 2
jne 0x42e5ca
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x42e5d6
mov al, byte [ebp - 0xc]
call fcn.0040b5f0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x42e654
sub ax, 0x21
je 0x42e668
sub ax, 0x17
je 0x42e674
sub ax, 0x222
je 0x42e680
sub ax, 0x392
je 0x42e688
sub ax, 1
je 0x42e690
sub ax, 0x1996
je 0x42e698
sub ax, 1
je 0x42e6a0
sub ax, 6
je 0x42e6a8
sub ax, 0xb
je 0x42e6b8
sub ax, 0x1b
je 0x42e6b0
sub ax, 0x367
je 0x42e6c0
jmp 0x42e6c8
mov ax, word [ebp - 0x24]
call fcn.0040b690
mov byte [ebp - 0x10], al
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x20
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x2e
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x27
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x2c
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x27
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x20
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x20
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x20
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x20
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x2d
jmp 0x42e6d0
mov byte [ebp - 0x10], 0x27
jmp 0x42e6d0
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x43b920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.0043b910
push ebp
push 0x414ff0
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x43ba30
mov al, byte [ebp - 0x110]
test al, al
je 0x43b9f9
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e80
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092f0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a0e0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a74b8
call fcn.00456560
mov edx, 0x43b98a
mov ecx, ebp
call fcn.00414e90
jmp 0x43ba30
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a74b8
call fcn.00456560
mov edx, 0x43b9f9
mov ecx, ebp
call fcn.00414e90
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x43baf4
mov al, byte [ebp - 0x110]
test al, al
je 0x43babd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e80
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092f0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a0e0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a74b8
call fcn.00456560
mov edx, 0x43ba4e
mov ecx, ebp
call fcn.00414e90
jmp 0x43baf4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a74b8
call fcn.00456560
mov edx, 0x43babd
mov ecx, ebp
call fcn.00414e90
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.0043b2a0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0043b910
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43ee80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x5a8144
call fcn.0040d540
test al, al
je 0x43ef66
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0043ef80
xor eax, eax
push fcn.0043ee70
push ebp
push 0x414ff0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408a60
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0043e070
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0043db30
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0043ee70
jmp 0x43ef71
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004411b0
mov esp, ebp
pop ebp
ret