joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403510
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x4f2f7c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x4036bd
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x403564
test ebp, ebp
je 0x40361d
dec ebp
cmp dword [ebx + 4], 0
je 0x40357d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00403260
mov dword [esp + 0x14], eax
jmp 0x403597
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x40361d
test ax, ax
je 0x4035b1
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x4035f8
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x4f2f7c]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x40361d
cmp dword [esp + 0x30], 0
jne 0x403556
cmp ax, 0xd
je 0x403624
cmp ax, 0xa
jne 0x403556
sub edi, 2
jmp 0x40369c
cmp dword [esp + 0x30], 0
jne 0x40369c
cmp ax, 0xa
jne 0x40362f
sub edi, 2
jmp 0x40369c
cmp ax, 0xd
jne 0x40369c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x403651
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00403260
mov dword [esp + 0x14], eax
jmp 0x403667
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x40369c
cmp dword [ebx + 4], 0
je 0x40367b
add dword [ebx + 0xc], 2
jmp 0x40369c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x4036d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x4f2f7c]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x403820
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x40371c
test edi, edi
je 0x40378d
dec edi
push esi
push ebp
call fcn.00403940
mov dword [esp + 0x20], eax
test eax, eax
jne 0x40372f
xor cl, cl
jmp 0x403731
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x403774
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x4f2f7c]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x40378d
test eax, eax
jne 0x403712
cmp cl, 0xd
je 0x403791
cmp cl, 0xa
jne 0x403712
dec esi
jmp 0x403803
test eax, eax
jne 0x403803
cmp cl, 0xa
jne 0x403799
dec esi
jmp 0x403803
cmp cl, 0xd
jne 0x403803
dec esi
cmp dword [ebp + 4], 0
je 0x4037b8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00403260
mov dword [esp + 0x20], eax
jmp 0x4037cf
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x403803
cmp dword [ebp + 4], 0
je 0x4037e1
inc dword [ebp + 0xc]
jmp 0x403803
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x403830
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x403938
cmp word [edx], 0
je 0x403938
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x40385e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x4038bd
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x403890
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403870
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00403150
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403890
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00403a50
mov edi, eax
test edi, edi
je 0x4038b3
cmp dword [esi + 4], 0
je 0x40390b
push dword [esp + 0x14]
push edi
push esi
call fcn.00403150
push edi
push 0
push dword [0x4f2f7c]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x4f2f7c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x403940
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x403967
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00403260
mov dword [esp + 4], eax
jmp 0x403981
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x40398d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x4039a9
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x4039b9
mov esi, 2
jmp 0x4039d5
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x4039c8
mov esi, 3
jmp 0x4039d5
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x403a32
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x403a04
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.00403260
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
Function at 0x40cf9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40cfaa
pop dword [ebp - 0x3c]
mov eax, 0xd3444360
add eax, 0x2cfc8c4a
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3c546
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x424b
xor esi, esi
add esi, eax
mov edx, 0xe3c68bd5
sub edx, 0xe38337d5
add edx, dword [ebp - 0x3c]
mov ebx, 0xed491dfd
add dword [ebp - 0xc], 0x867b389f
mov edi, dword [edx]
xor dword [ebp - 0x28], ebx
sub edi, ebx
mov dword [ebp - 0x20], 0x2a5c493d
mov dword [esi], edi
mov dword [ebp - 0x38], 0xc40431d2
add esi, 0x7f7b335a
add esi, 0x8084ccaa
add edx, 0x894ff776
add edx, 0x76b0088e
loop 0x40cffa
add eax, 0xfbff
mov ebx, eax
add eax, 0xf0e836bd
sub eax, 0xf0e836b8
mov ecx, 0x32559923
add ecx, 0xcdea66dd
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40fbd0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb210
push 0x412f28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4e3e7c], eax
mov eax, dword [0x4e3e7c]
shr eax, 8
and eax, 0xff
mov dword [0x4e3e88], eax
mov ecx, dword [0x4e3e7c]
and ecx, 0xff
mov dword [0x4e3e84], ecx
mov edx, dword [0x4e3e84]
shl edx, 8
add edx, dword [0x4e3e88]
mov dword [0x4e3e80], edx
mov eax, dword [0x4e3e7c]
shr eax, 0x10
and eax, 0xffff
mov dword [0x4e3e7c], eax
call fcn.00417900
test eax, eax
jne 0x40fc5f
push 0x1c
call fcn.0040fe10
add esp, 4
call fcn.00415e10
test eax, eax
jne 0x40fc72
push 0x10
call fcn.0040fe10
add esp, 4
mov dword [ebp - 4], 0
call fcn.00419970
call fcn.00410ea0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4e5890], eax
call fcn.00419750
mov dword [0x4e3e6c], eax
cmp dword [0x4e3e6c], 0
je 0x40fcaa
cmp dword [0x4e5890], 0
jne 0x40fcb4
push 0xffffffffffffffff
call fcn.00410020
add esp, 4
call fcn.00418fd0
call fcn.00418e90
call fcn.0040ffe0
mov ecx, dword [0x4e5890]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x64]
xor eax, eax
mov al, byte [edx]
cmp eax, 0x22
jne 0x40fd2e
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x64]
xor eax, eax
mov al, byte [edx]
cmp eax, 0x22
je 0x40fd17
mov ecx, dword [ebp - 0x64]
xor edx, edx
mov dl, byte [ecx]
test edx, edx
je 0x40fd17
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov cl, byte [eax]
push ecx
call fcn.00418da0
add esp, 4
test eax, eax
je 0x40fd15
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
jmp 0x40fcd8
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x22
jne 0x40fd2c
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
jmp 0x40fd45
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x20
jle 0x40fd45
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
jmp 0x40fd2e
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x40fd67
mov edx, dword [ebp - 0x64]
xor eax, eax
mov al, byte [edx]
cmp eax, 0x20
jg 0x40fd67
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
jmp 0x40fd45
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebp - 0x30]
and eax, 1
test eax, eax
je 0x40fd90
mov ecx, dword [ebp - 0x2c]
and ecx, 0xffff
mov dword [ebp - 0x6c], ecx
jmp 0x40fd97
mov dword [ebp - 0x6c], 0xa
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.00410020
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x40fdf8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4dc780], 0xffffffff
je 0x416078
cmp dword [ebp + 8], 0
jne 0x415fb5
mov eax, dword [0x4dc780]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x416069
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x24], 0
je 0x415fd9
push 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call fcn.0040e580
add esp, 8
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x28], 0
je 0x415ff3
push 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
push eax
call fcn.0040e580
add esp, 8
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x30], 0
je 0x41600d
push 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
push eax
call fcn.0040e580
add esp, 8
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x38], 0
je 0x416027
push 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x38]
push eax
call fcn.0040e580
add esp, 8
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x40], 0
je 0x416041
push 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x40]
push eax
call fcn.0040e580
add esp, 8
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x44], 0
je 0x41605b
push 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
call fcn.0040e580
add esp, 8
push 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e580
add esp, 8
push 0
mov edx, dword [0x4dc780]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
ret
Function at 0x419d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
push esi
push edi
mov dword [ebp - 8], 0
jmp 0x419dae
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jae 0x419dc7
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx*8 + 0x4deb40]
jne 0x419dc5
jmp 0x419dc7
jmp 0x419da5
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax*8 + 0x4deb40]
jne 0x419f7a
cmp dword [ebp + 8], 0xfc
je 0x419e04
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x4deb44]
push eax
push 0
push 0
push 0
push 1
call fcn.00412540
add esp, 0x14
cmp eax, 1
jne 0x419e04
int3
cmp dword [0x4e3e74], 1
je 0x419e1f
cmp dword [0x4e3e74], 0
jne 0x419e8a
cmp dword [0x4dc3f4], 1
jne 0x419e8a
cmp dword [0x4e5720], 0
je 0x419e45
mov ecx, dword [0x4e5720]
cmp dword [ecx + 0x48], 0xffffffff
je 0x419e45
mov edx, dword [0x4e5720]
mov eax, dword [edx + 0x48]
mov dword [ebp - 0x1b4], eax
jmp 0x419e53
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x1b4], eax
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x4deb44]
push eax
call fcn.0040fb50
add esp, 4
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*8 + 0x4deb44]
push edx
mov eax, dword [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x419f7a
cmp dword [ebp + 8], 0xfc
je 0x419f7a
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x419ec3
push str._program_name_unknown_
lea edx, [ebp - 0x110]
push edx
call fcn.0040fa60
add esp, 8
lea eax, [ebp - 0x110]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040fb50
add esp, 4
add eax, 1
cmp eax, 0x3c
jbe 0x419f0c
lea edx, [ebp - 0x110]
push edx
call fcn.0040fb50
add esp, 4
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax - 0x3b]
mov dword [ebp - 0xc], edx
push 3
push 0x4cb48c
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041d630
add esp, 0xc
push str.Runtime_Error__n_nProgram:
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.0040fa60
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x1b0]
push eax
call fcn.0040fa70
add esp, 8
push 0x4cb400
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.0040fa70
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x4deb44]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.0040fa70
add esp, 8
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
lea edx, [ebp - 0x1b0]
push edx
call fcn.0041d570
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425520
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4e435c], 0
jne 0x425572
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42554d
mov dword [0x4e435c], 1
jmp 0x425572
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x42556b
mov dword [0x4e435c], 2
jmp 0x425572
xor eax, eax
jmp 0x42568d
cmp dword [0x4e435c], 1
jne 0x425596
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x42568d
cmp dword [0x4e435c], 2
jne 0x42568d
mov dword [ebp - 8], 0
cmp dword [ebp + 0x18], 0
jne 0x4255b9
mov ecx, dword [0x4e41e8]
mov dword [ebp + 0x18], ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4255db
xor eax, eax
jmp 0x42568d
push 0x64
push str.aw_loc.c
push 2
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040daf0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x425600
xor eax, eax
jmp 0x42568d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42561c
jmp 0x42567d
cmp dword [ebp + 0x14], 0
jne 0x425645
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x425643
jmp 0x42567d
jmp 0x42566a
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42566a
jmp 0x42567d
push 2
mov eax, dword [ebp - 8]
push eax
call fcn.0040e580
add esp, 8
mov eax, dword [ebp - 0xc]
jmp 0x42568d
push 2
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040e580
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4256a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4e4360], 0
jne 0x4256f2
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4256cd
mov dword [0x4e4360], 2
jmp 0x4256f2
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4256eb
mov dword [0x4e4360], 1
jmp 0x4256f2
xor eax, eax
jmp 0x425820
cmp dword [0x4e4360], 2
jne 0x425716
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x425820
cmp dword [0x4e4360], 1
jne 0x425820
mov dword [ebp - 8], 0
cmp dword [ebp + 0x18], 0
jne 0x425739
mov ecx, dword [0x4e41e8]
mov dword [ebp + 0x18], ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42575b
xor eax, eax
jmp 0x425820
push 0xd2
push str.aw_loc.c
push 2
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
call fcn.0040daf0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x425785
xor eax, eax
jmp 0x425820
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4257a1
jmp 0x425810
cmp dword [ebp + 0x14], 0
jne 0x4257d1
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0x220
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4257cf
jmp 0x425810
jmp 0x4257fd
push 0
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
push 0x220
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4257fd
jmp 0x425810
push 2
mov eax, dword [ebp - 8]
push eax
call fcn.0040e580
add esp, 8
mov eax, dword [ebp - 0xc]
jmp 0x425820
push 2
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040e580
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x44dcc2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x44dd2d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x70
jne 0x44dd2d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x4000
test eax, eax
jne 0x44dd2d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x44dd2d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x44dd2d
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x44dd2d
mov dword [ebp - 4], 1
jmp 0x44dd34
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x44fbbd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.004ab732
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44fc16
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x44fc30
push 0xea
push str.dlgcore.cpp
call fcn.004a24f0
test eax, eax
je 0x44fc30
int3
xor edx, edx
test edx, edx
jne 0x44fc16
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0044fc8b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00402aa0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8