joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417d31
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x487070]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417d71
cmp byte [ebx], 0xa
jne 0x417d71
or byte [eax + edi + 0x28], 4
jmp 0x417d76
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x417e74
mov al, byte [edx]
cmp al, 0x1a
je 0x417e56
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x417da5
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x417dca
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x417dd4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x417d87
jmp 0x417e74
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417e51
cmp dword [ebp - 0xc], 0
je 0x417e51
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x487070]
test byte [eax + edi + 0x28], 0x48
je 0x417e2b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x417e16
mov byte [esi], dl
jmp 0x417e27
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x487070]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x417e74
cmp byte [ebp - 1], 0xa
jne 0x417e3a
cmp esi, ebx
jne 0x417e3a
mov byte [esi], 0xa
jmp 0x417e73
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004188b1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x417e74
mov byte [esi], 0xd
jmp 0x417e73
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x487070]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x417e70
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x417e74
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x417e7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x487070]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417ec0
cmp word [esi], dx
jne 0x417ec0
or byte [edi + eax + 0x28], 4
jmp 0x417ec5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x418018
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x417ff8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x417f07
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x417f3d
cmp eax, edx
jae 0x417f49
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x417edf
jmp 0x418018
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417ff4
cmp dword [ebp - 0x14], 0
je 0x417ff4
mov eax, dword [ebx*4 + 0x487070]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x417fcc
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x417f95
mov word [esi], cx
jmp 0x417fc8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x487070]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x487070]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x487070]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x418018
pop ebx
cmp word [ebp - 4], bx
jne 0x417fdd
cmp esi, dword [ebp + 0xc]
jne 0x417fdd
mov word [esi], bx
jmp 0x418015
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004188b1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x418018
push 0xd
jmp 0x418011
mov ecx, dword [ebx*4 + 0x487070]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41800f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418018
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40b492
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x424], 0x400
mov al, byte [0x5200a4]
mov byte [ebp - 0x418], al
xor ecx, ecx
mov dword [ebp - 0x417], ecx
mov dword [ebp - 0x413], ecx
mov byte [ebp - 0x40f], cl
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x420], 0
push 4
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x424]
push eax
push 0
lea ecx, [ebp - 0x404]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 4
jl 0x40b69c
mov ecx, dword [ebp - 0x408]
sub ecx, 4
mov dword [ebp - 0x408], ecx
mov edx, dword [ebp - 0x408]
lea eax, [ebp + edx - 0x404]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov byte [ebp + eax - 0x419], 0
movsx ecx, byte [ebp - 0x418]
cmp ecx, 0x61
je 0x40b5a8
movsx edx, byte [ebp - 0x418]
cmp edx, 0x41
je 0x40b5a8
movsx eax, byte [ebp - 0x418]
cmp eax, 0x62
je 0x40b5a8
movsx ecx, byte [ebp - 0x418]
cmp ecx, 0x42
jne 0x40b5ad
jmp 0x40b520
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x40b5e2
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
je 0x40b5e2
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
jne 0x40b5e7
jmp 0x40b520
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x428], eax
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x41c], 0x158
jne 0x40b63d
cmp dword [ebp - 0x430], 1
je 0x40b642
jmp 0x40b520
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp - 0x434]
call fcn.0040b337
test eax, eax
jne 0x40b697
movsx eax, word [ebp + 8]
cmp eax, dword [ebp - 0x420]
jne 0x40b688
push 0x4564b0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
jmp 0x40b6a1
mov ecx, dword [ebp - 0x420]
add ecx, 1
mov dword [ebp - 0x420], ecx
jmp 0x40b520
mov eax, 0xffffffa4
mov esp, ebp
pop ebp
ret 8
Function at 0x40e3e3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push edi
mov dword [ebp - 0x1a8], ecx
mov al, byte [0x5200cc]
mov byte [ebp - 0x1a4], al
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x1a3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x5200d0]
mov byte [ebp - 0x14], cl
xor edx, edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov dword [ebp - 7], edx
mov word [ebp - 3], dx
mov byte [ebp - 1], dl
mov al, byte [0x5200d4]
mov byte [ebp - 0x140], al
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x13f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x1a4]
push edx
push str.127.0.0.1
push str.ServerName
push 0x4565b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp + 8]
push eax
push 0x14
lea ecx, [ebp - 0x14]
push ecx
push 0x4565c4
push str.PORT
push 0x4565d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp + 8]
push edx
push 0x12c
lea eax, [ebp - 0x140]
push eax
push str.3001
push str.mMsg
push 0x4565f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x14]
push ecx
call sub.MSVCRT.dll_atol
add esp, 4
push eax
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x1a4]
push eax
call dword [0x52008c]
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x410470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x410735
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov byte [ebp - 0x224], 0x12
mov byte [ebp - 0x223], 0x34
mov byte [ebp - 0x222], 0x56
mov byte [ebp - 0x221], 0x78
mov byte [ebp - 0x220], 0x87
mov byte [ebp - 0x21f], 0x65
mov byte [ebp - 0x21e], 0x34
mov byte [ebp - 0x21d], 0x21
mov byte [ebp - 0x234], 0x12
mov byte [ebp - 0x233], 0x34
mov byte [ebp - 0x232], 0x56
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x97
mov byte [ebp - 0x22f], 0x65
mov byte [ebp - 0x22e], 0x34
mov byte [ebp - 0x22d], 0x21
mov dword [0x51d4b8], 1
push 0x208
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
je 0x410963
push 0
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x22c], eax
push 2
push 0
push 0xfffffffffffffff8
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x218]
push ecx
push 8
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x410862
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x410965
push 8
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x410882
xor eax, eax
jmp 0x410965
push 2
push 0
push 0xfffffffffffffff4
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x218]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4108d4
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x410965
push 4
push 0x1000
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x51fe34], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
sub eax, dword [edx]
sub eax, 0xc
mov dword [ebp - 0x21c], eax
push 0
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [0x51fe34]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x41095c
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x410965
mov eax, 1
jmp 0x410965
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x412130
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
cmp dword [ebp + 0xc], 0
je 0x412156
lea eax, [ebp - 0x45c]
push eax
call fcn.004124b7
add esp, 4
test eax, eax
jne 0x412253
push 0x400
push 0
lea ecx, [ebp - 0x45c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x45c]
push edx
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.YShow3D.exe
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0
push 4
push 0x4ea854
lea ecx, [ebp - 0x460]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x1000
mov edx, dword [ebp - 0x460]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4121e0
xor eax, eax
jmp 0x4122eb
push 0x293af
push 0x4ea858
lea eax, [ebp - 0x460]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004183f0
add esp, 0x10
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0xffffffff
je 0x412253
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x468]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
push 0
lea ecx, [ebp - 0x5c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 1
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x45c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4122c3
xor eax, eax
jmp 0x4122eb
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jne 0x4122da
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, 1
jmp 0x4122eb
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x44484c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453f30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x52201c], 0xffffffff
or dword [0x522020], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x522018]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x522014]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x522024], eax
call fcn.00444c81
cmp dword [0x51d4b0], 0
jne 0x4448cf
push 0x444c7e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00444c6c
push 0x45500c
push 0x455008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x522010]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x52200c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x455004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00401458
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4228d7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x4229e7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4229b3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42298a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42296b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x422988
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00434ffd
mov dword [eax], 0x60edac7a
jmp 0x422960
jmp 0x4229b1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x4229b1
push 0
push 0x1f61
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x4229e5
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0
push 0x105a
push 1
push 0x1484
push 0x4b44
push 0x6366
push 0
push 0x524
push dword [ebp - 0x44]
push 1
call fcn.00414f82
add esp, 0x28
jmp 0x422a30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x58], eax
push 0
push dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x50]
push 0x3a8f
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
call fcn.0040e5e8
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x431043
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x4310df
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4310be
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4310ab
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.00434ffd
mov dword [eax], 0xfffffffc
jmp 0x4310bc
push 0x12b9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x4310dd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x67f8
push 0x66ba
push 0
push 1
call fcn.0042146f
add esp, 0x14
jmp 0x43110e
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x28]
push 1
push 0x685a
push 0x2919
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.004093fe
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x43b93e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43b9c8
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43b97c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0
call fcn.0043d701
pop ecx
pop ecx
jmp 0x43b9c6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43b9ae
mov byte [ebp - 1], 0
push 0
push 0x129a
lea eax, [ebp - 1]
push eax
push 1
push 0x5581
push 1
call fcn.0043ebac
add esp, 0x18
jmp 0x43b9c6
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43b9c6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x43ba12
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x24]
push 0x37b4
push 0x11bf
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
push 0x3011
call fcn.0044d1c0
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x443742
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x443825
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4437eb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4437d4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4437d2
push 0x6c74
push 0x141a
push 0
push 0x60ef
push 0x47fc
call fcn.004480ca
add esp, 0x14
jmp 0x4437e9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 1
jmp 0x443820
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push 0
push 0x34ee
push 0x6694
push dword [ebp - 0x38]
push 0x1469
push dword [ebp - 0x3c]
push 0x513b
push 0x7f60
call fcn.00444fa6
add esp, 0x20
jmp 0x4438b4
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x443870
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x44385d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x44386e
push 0x12b9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x4438b4
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 0x7da5
push dword [ebp - 0x50]
push 0x799c
push 0xc58
push 1
push 0
push 0x1564
push 0x4fc
push 1
push 0x3bc1
push 0x5ea3
push 0x6a9f
push 0xd39
call fcn.00449d24
add esp, 0x34
mov esp, ebp
pop ebp
ret