joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407bc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.0040d780
cmp eax, 1
jne 0x407c05
cmp dword [0x447244], 0
push 0
je 0x407bdc
push str.WRN:_no_initial_dark_frames
jmp 0x407be1
push str.WRN:_no_initial_dark_frames._Check_Modem_Ring
call fcn.00404200
add esp, 8
push 0xaaaa
push 0xffffffffffffffff
push 0xaaaa
push 0x15
call fcn.00404510
add esp, 0x10
mov eax, 1
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call fcn.0040d780
test eax, eax
jne 0x407c55
lea ebx, [ebx]
call fcn.00407680
test eax, eax
je 0x407c6d
call esi
sub eax, edi
cmp eax, 0x1d4c0
ja 0x407c72
call fcn.0040d8d0
test eax, eax
jne 0x407c6d
push 0xffffffffffffffff
call fcn.0040b200
add esp, 4
call fcn.00407bb0
call fcn.0040d780
test eax, eax
je 0x407c20
cmp dword [0x447260], 0
jg 0x407c86
push 0
push str...._canceled
call fcn.00404200
add esp, 8
pop edi
xor eax, eax
pop esi
ret
push 0
push str.ERR:_timeout_waiting_brigt_frame
call fcn.00404200
add esp, 8
pop edi
xor eax, eax
pop esi
ret
push 0xaaaa
push 0
push 0xaaaa
push 0x15
call fcn.00404510
add esp, 0x10
pop edi
mov eax, 1
pop esi
ret
Function at 0x4096a0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x104
mov eax, dword [0x445750]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov dword [esi + 0x41c], 1
test eax, eax
je 0x4096f4
push 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4096e5
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, dword [0x4479fc]
test eax, eax
je 0x40971c
push eax
lea edx, [esp + 8]
push str.Warning:_skipframe_d
push edx
call fcn.0041e808
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00404200
add esp, 0x14
mov eax, dword [esi + 0x404]
test eax, eax
jg 0x40972f
cmp dword [esi + 0x408], 0
je 0x409755
mov ecx, dword [esi + 0x408]
push eax
push ecx
lea edx, [esp + 0xc]
push str.WRN_ETH:_lostApp_d_lostDrv_d
push edx
call fcn.0041e808
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00404200
add esp, 0x18
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
call fcn.0041e904
add esp, 0x104
ret
Function at 0x40a0b0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
xor edi, edi
mov dword [esi + 0x418], eax
mov dword [esi + 0x414], eax
mov dword [esi + 0x410], eax
mov dword [esi + 0x40c], eax
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x40a0a0
push edi
push edi
mov dword [esi + 0x404], edi
mov dword [esi + 0x408], edi
mov dword [esi + 0x420], edi
mov dword [esi + 0x41c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi], eax
pop edi
pop esi
mov eax, ecx
pop ecx
ret
Function at 0x40b040
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x447264]
dec eax
push esi
mov dword [0x447a38], 1
mov dword [0x447a34], 0
cmp eax, 1
ja 0x40b094
mov eax, dword [0x447278]
imul eax, dword [0x447274]
lea esi, [eax*4]
push esi
call fcn.0041e962
push esi
push 0
push eax
mov dword [0x447a2c], eax
call fcn.0041e700
mov dword [0x447a30], 0
jmp 0x40b0f9
mov eax, dword [0x44739c]
imul eax, dword [0x447350]
imul eax, dword [0x447278]
cdq
idiv dword [0x447354]
mov esi, eax
add esi, esi
push esi
call fcn.0041e962
push esi
push 0
push eax
mov dword [0x447a2c], eax
call fcn.0041e700
mov esi, dword [0x447278]
imul esi, dword [0x447274]
add esi, esi
add esp, 0x10
add esi, esi
cmp dword [0x447268], 0
je 0x40b0e5
add esi, esi
push esi
call fcn.0041e962
push esi
push 0
push eax
mov dword [0x447a30], eax
call fcn.0041e700
add esp, 0x10
push 0x447a14
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00402ac0
mov eax, dword [0x447278]
imul eax, dword [0x447274]
add eax, eax
push eax
call fcn.0041e962
add esp, 4
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x40acd0
push 0
push 0
mov dword [0x447a0c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x447a10], eax
pop esi
pop ecx
ret
Function at 0x40bc60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
mov eax, dword [0x445750]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x44729c], 0
jne 0x40bc94
cmp dword [0x4472a4], 0
jne 0x40bccd
cmp dword [0x4472a0], 0
jne 0x40bccd
jmp 0x40be26
call fcn.0040bf60
test eax, eax
jne 0x40bcb2
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0041e904
add esp, 0x104
ret
call fcn.0040bf30
cmp dword [0x4472a4], 0
jne 0x40bccd
cmp dword [0x4472a0], 0
je 0x40be26
push ebx
push ebp
push esi
mov esi, dword [0x447278]
imul esi, dword [0x447274]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0040fab4
lea edi, [esi + esi]
push edi
mov ebp, eax
push 0
push ebp
call fcn.0041e700
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
cmp dword [0x4472a4], 0
je 0x40bd68
mov eax, dword [0x447278]
mov ecx, dword [0x447274]
push eax
push ecx
push 0x446ff0
lea edx, [esp + 0x1c]
push str._sCAL_dx_dbpmm.raw
push edx
call fcn.0041e808
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x40bd57
push 0
push str.WRN:_Manual_BPM_does_not_exist.
call fcn.00404200
add esp, 8
jmp 0x40bd68
push ebp
push edi
lea ecx, [esp + 0x18]
push ecx
push 0
call fcn.0040e6d0
add esp, 0x10
cmp dword [0x4472a0], 0
je 0x40be0e
mov edx, dword [0x447278]
mov eax, dword [0x447274]
push edx
push eax
push 0x446ff0
lea ecx, [esp + 0x1c]
push str._sCAL_dx_dbpm.raw
push ecx
call fcn.0041e808
add esp, 0x14
lea edx, [esp + 0x10]
push edx
call ebx
cmp eax, 0xffffffff
jne 0x40bdb6
push 0
push str.WRN:_Auto_BPM_does_not_exist.
call fcn.00404200
add esp, 8
jmp 0x40be0e
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040fab4
mov ebx, eax
push ebx
push edi
lea eax, [esp + 0x1c]
push eax
push 0
call fcn.0040e6d0
add esp, 0x14
test esi, esi
jle 0x40be05
mov ecx, ebx
mov eax, ebp
sub ecx, ebp
jmp 0x40bdf0
cmp word [eax], 0
jne 0x40bdfd
mov dx, word [ecx + eax]
mov word [eax], dx
add eax, 2
sub esi, 1
jne 0x40bdf0
push ebx
call fcn.0040faa9
add esp, 4
push ebp
call fcn.0040b9f0
push ebp
call fcn.0040faa9
add esp, 8
call fcn.0040cbb0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
mov eax, 1
call fcn.0041e904
add esp, 0x104
ret
Function at 0x40d4c0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
lea edi, [esi + 0x20]
push edi
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d52c
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
jne 0x40d557
mov edx, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 1
lea ecx, [esp + 0x28]
push ecx
push edi
push edx
call ebx
test eax, eax
jne 0x40d52a
nop
call ebp
mov ecx, dword [esi]
cmp eax, 0x3e4
jne 0x40d538
push 1
lea eax, [esp + 0x28]
push eax
push edi
push ecx
call ebx
test eax, eax
je 0x40d510
pop ebx
pop ebp
mov eax, dword [esp + 0x1c]
pop edi
pop esi
add esp, 0xc
ret 8
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x24]
pop ebx
pop ebp
pop edi
pop esi
add esp, 0xc
ret 8
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x20]
pop ebp
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x40d580
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ClearCommError]
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
test eax, eax
jbe 0x40d614
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push edi
lea edi, [esi + 0xc]
push edi
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d60f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40d637
mov edx, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 1
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
call ebx
test eax, eax
jne 0x40d60e
mov edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
cmp eax, 0x3e4
jne 0x40d61c
push 1
lea eax, [esp + 0x14]
push eax
push edi
push ecx
call ebx
test eax, eax
je 0x40d5f0
pop ebx
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call ebp
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x18], 0
call ebp
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
Function at 0x40dc30
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
push ebx
push 0x40000080
push 3
push ebx
push ebx
push 0xc0000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x40dd48
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call edi
mov ecx, dword [esi]
push 1
push ecx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov edx, dword [esi]
push 0x1000
push 0x1000
push edx
call dword [sym.imp.KERNEL32.dll_SetupComm]
mov eax, dword [esi]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov edx, dword [esi]
lea ecx, [esp + 0xc]
mov eax, 0x3e8
push ecx
push edx
mov dword [esp + 0x14], 0x32
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov ecx, dword [esi]
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x28], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [esi]
lea edx, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x2c], 0x4b00
mov byte [esp + 0x3a], 8
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
call dword [sym.imp.KERNEL32.dll_SetCommState]
pop edi
test eax, eax
je 0x40dd48
lea ecx, [esp + 0x3c]
push ecx
push ebx
push esi
push 0x40d930
push ebx
push ebx
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x40dd52
mov ecx, esi
call fcn.0040d440
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret 4
pop esi
mov eax, 1
pop ebx
add esp, 0x30
ret 4
Function at 0x40df10
Capabilities:
Delete file

Disassembly:
sub esp, 0x22c
mov eax, dword [0x445750]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [esp + 0x230]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
lea ebx, [esp + 0x134]
push edi
sub ebx, eax
nop
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x40df40
lea eax, [esp + 0x138]
push eax
call fcn.0040deb0
mov eax, esi
add esp, 4
mov edx, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40df60
lea edi, [esp + 0x138]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40df71
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x13c]
push edx
call fcn.00420f08
mov ebp, eax
add esp, 8
test ebp, ebp
jle 0x40e029
jmp 0x40dfb0
mov eax, dword [esp + 0x240]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x40dfb7
lea eax, [esp + 0x138]
push eax
call fcn.0040deb0
lea eax, [esp + 0x38]
add esp, 4
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dfd7
lea edi, [esp + 0x138]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40dfe8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x10]
push edx
push ebp
call fcn.00421038
add esp, 8
test eax, eax
je 0x40dfb0
push ebp
call fcn.00420e7a
add esp, 4
mov ecx, dword [esp + 0x238]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e904
add esp, 0x22c
ret
Function at 0x40e3d0
Capabilities:
Create directory

Disassembly:
sub esp, 0x154
mov eax, dword [0x445750]
xor eax, esp
mov dword [esp + 0x150], eax
mov eax, dword [0x447278]
mov ecx, dword [0x447274]
push esi
push eax
push ecx
lea edx, [esp + 0xc]
push str._dx_db_____A.raw
push edx
call fcn.0041e808
push 0
lea eax, [esp + 0x18]
push eax
push 0
mov ecx, str.CAL_
call fcn.0040e100
mov esi, eax
add esp, 0x1c
test esi, esi
jg 0x40e442
push 0
push str.WRN:_no_bright_frames_in_CAL
call fcn.00404200
add esp, 8
pop esi
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0041e904
add esp, 0x154
ret
xor eax, eax
mov cl, byte [eax + 0x446ff0]
mov byte [esp + eax + 0x54], cl
inc eax
test cl, cl
jne 0x40e444
lea eax, [esp + 0x54]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40e458
mov ecx, dword [str.CALBACKUP]
mov edx, dword [0x439a44]
mov dword [eax], ecx
mov cx, word [0x439a48]
mov dword [eax + 4], edx
mov dl, byte [0x439a4a]
push ebx
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
push 0
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.CALBACKUP
lea ebx, [esp + 0xc]
call fcn.0040e350
push esi
lea ecx, [esp + 0x60]
push str.Backup__d_files_from_CAL_to_CAL_BACKUP
push ecx
call fcn.0041e808
lea edx, [esp + 0x68]
push 0
push edx
call fcn.00404200
push str.CALBACKUP_
mov eax, ebx
push eax
push 1
mov ecx, str.CAL_
call fcn.0040e100
push str.CAL_
call fcn.0040e350
mov ecx, dword [0x447278]
mov edx, dword [0x447274]
push ecx
push edx
mov eax, ebx
push str._dx_dbpm.raw
push eax
call fcn.0041e808
push str.CALBACKUP_
mov ecx, ebx
push ecx
push 1
mov ecx, str.CAL_
call fcn.0040e100
add esp, 0x44
push str.CAL_
call fcn.0040e350
mov ecx, dword [esp + 0x15c]
add esp, 4
pop ebx
pop esi
xor ecx, esp
call fcn.0041e904
add esp, 0x154
ret
Function at 0x40e6d0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x445750]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
mov ebx, dword [esp + 0x118]
mov ebp, dword [esp + 0x120]
push esi
push edi
mov edi, dword [esp + 0x11c]
push 0
mov eax, edi
neg eax
sbb eax, eax
push 0x80
add eax, 3
push eax
mov ecx, edi
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xc0000000
push 0
add ecx, 0x80000000
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e772
push ebx
call fcn.0040e6a0
push eax
test edi, edi
je 0x40e74a
push str.ERR:_cant_create__s
lea edx, [esp + 0x20]
push edx
jmp 0x40e754
push str.ERR:_cant_open__s
lea eax, [esp + 0x20]
push eax
call fcn.0041e808
add esp, 0x10
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.00404200
add esp, 8
xor eax, eax
jmp 0x40e827
push 0
test edi, edi
jne 0x40e804
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [esp + 0x124]
test edi, edi
jg 0x40e7c8
mov edi, eax
push 0
lea edx, [esp + 0x14]
push edx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], edi
je 0x40e81b
push ebx
call fcn.0040e6a0
push eax
lea eax, [esp + 0x1c]
push str.ERR:_IO_file__s
push eax
call fcn.0041e808
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e75c
cmp edi, eax
je 0x40e790
push edi
push eax
push ebx
call fcn.0040e6a0
add esp, 4
push eax
lea edx, [esp + 0x20]
push str.ERR:_size_of__s___d_instead__d_
push edx
call fcn.0041e808
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00404200
add esp, 8
xor eax, eax
jmp 0x40e827
mov edi, dword [esp + 0x128]
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40e7a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e904
add esp, 0x108
ret
Function at 0x40e8b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
sub esp, 0x204
mov eax, dword [0x445750]
xor eax, esp
mov dword [esp + 0x200], eax
mov ecx, dword [0x447264]
push esi
lea eax, [ecx - 1]
push edi
mov esi, 7
mov edi, 0x4386d3
cmp eax, 3
ja case.default.0x40e8de
jmp dword [eax*4 + 0x40e9b4]
mov edi, 0x439b64
jmp 0x40e8f1
mov edi, 0x439b60
mov esi, 9
dec ecx
cmp ecx, 3
ja 0x40e971
lea edx, [esp + 8]
mov ecx, edi
mov eax, esi
call fcn.0040e050
test esi, esi
jle 0x40e983
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40e920
xor eax, eax
mov cl, byte [esp + eax + 0x10]
mov byte [esp + eax + 0x110], cl
inc eax
test cl, cl
jne 0x40e922
dec esi
lea edx, [esp + 0x10]
mov ecx, edi
mov eax, esi
call fcn.0040e050
lea eax, [esp + 0x10]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40e969
lea ecx, [esp + 0x110]
push ecx
call ebp
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test esi, esi
jg 0x40e920
pop ebp
pop ebx
jmp 0x40e983
lea esi, [esp + 8]
call fcn.0040e840
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 8]
push 0x4395a0
push edx
call fcn.004203ff
mov ecx, dword [esp + 0x210]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov dword [0x4484a0], eax
call fcn.0041e904
add esp, 0x204
ret
Function at 0x410057
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x445750]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x4100f5
push 0x439de4
push 4
push eax
call fcn.004228ac
push eax
call fcn.0040ff99
add esp, 0x10
push ebx
push edi
call fcn.00422cd8
mov edi, dword [eax]
call fcn.00422cd8
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0041e8a3
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00422cd8
cmp dword [eax], ebx
je 0x41010c
call fcn.00422cd8
push dword [eax]
call fcn.0040ffc5
pop ecx
jmp 0x410113
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41009d
jmp 0x41019a
call fcn.00422cd8
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x410196
cmp dword [ebp - 0x11c], esi
jae 0x410196
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.0041e700
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x410185
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x410185
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x410185
push ebx
push ebx
push esi
jmp 0x41018e
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x410198
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041e904
leave
ret

Function at 0x412adf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x412b03
cmp dword [edi + 0x54], 0
jne 0x412b03
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00413d78
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00412aa0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4195d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41961b
call fcn.00413d78
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41961b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x419637
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041914e
mov esi, eax
test edi, edi
je 0x419635
test ebx, ebx
je 0x419635
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41e904
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445750]
jne 0x41e90e
repz ret
jmp fcn.00428172

Function at 0x43080e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00429077
and dword [ebp - 4], 0
cmp dword [0x44ad1c], 0
mov ebx, eax
jne 0x4308bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x430970
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43c45c
push edi
call esi
test eax, eax
je 0x430970
push eax
call fcn.00429005
mov dword [esp], 0x43c44c
push edi
mov dword [0x44ad1c], eax
call esi
push eax
call fcn.00429005
mov dword [esp], 0x43c438
push edi
mov dword [0x44ad20], eax
call esi
push eax
call fcn.00429005
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44ad24], eax
call esi
push eax
call fcn.00429005
pop ecx
mov dword [0x44ad2c], eax
test eax, eax
je 0x4308bf
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00429005
pop ecx
mov dword [0x44ad28], eax
mov eax, dword [0x44ad28]
cmp eax, ebx
je 0x430917
cmp dword [0x44ad2c], ebx
je 0x430917
push eax
call fcn.00429080
push dword [0x44ad2c]
mov esi, eax
call fcn.00429080
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x430917
test edi, edi
je 0x430917
call esi
test eax, eax
je 0x43090e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43090e
test byte [ebp - 0xc], 1
jne 0x430917
or dword [ebp + 0x10], 0x200000
jmp 0x430950
mov eax, dword [0x44ad20]
cmp eax, ebx
je 0x430950
push eax
call fcn.00429080
pop ecx
test eax, eax
je 0x430950
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x430950
mov eax, dword [0x44ad24]
cmp eax, ebx
je 0x430950
push eax
call fcn.00429080
pop ecx
test eax, eax
je 0x430950
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44ad1c]
call fcn.00429080
pop ecx
test eax, eax
je 0x430970
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x430972
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret