joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20004f31
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x2000a708
cmp edx, dword [eax]
je 0x20004f53
add eax, 8
inc ecx
cmp eax, 0x2000a798
jl 0x20004f44
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x2000a708]
jne 0x20005081
mov eax, dword [0x2000ce68]
cmp eax, 1
je 0x2000505b
test eax, eax
jne 0x20004f84
cmp dword [0x2000a194], 1
je 0x2000505b
cmp edx, 0xfc
je 0x20005081
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x20004fbb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.20006a60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.20006b50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x20004ffe
lea eax, [ebp - 0x1a4]
push eax
call fcn.20006b50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x2000851c
push edi
call fcn.20007380
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.20006a60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.20006a70
lea eax, [ebp - 0xa0]
push 0x200084fc
push eax
call fcn.20006a70
push dword [esi + 0x2000a70c]
lea eax, [ebp - 0xa0]
push eax
call fcn.20006a70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.200072ef
add esp, 0x2c
pop edi
jmp 0x20005081
lea eax, [ebp + 8]
lea esi, [esi + 0x2000a70c]
push 0
push eax
push dword [esi]
call fcn.20006b50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x2001604d
Capabilities:
Resolve function by hash

Disassembly:
mov eax, dword fs:[0x30]
test eax, eax
js 0x20016063
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov ebx, dword [eax + 8]
jmp 0x2001606c
mov eax, dword [eax + 0x34]
mov ebx, dword [eax + 0xb8]
pop esi
add esi, 3
push ebx
mov edx, 0xec0e4e8e
call esi
push eax
mov edx, 0x7c0dfcaa
call esi
push eax
push edi
mov edx, 0x4ee4a045
call esi
xor edx, edx
push edx
push 0x6d756369
push 0x6c656167
push esp
push edx
push edx
call eax
push eax
mov edx, 0x75da1966
call esi
call eax
xchg edi, eax
mov edx, 0xffd97fb
call esi
call eax
cmp edi, 0xb7
jne 0x200160bb
mov esp, ebp
popal
ret
call fcn.200160dc
sti
xchg edi, eax
std
pcmpeqd mm5, qword [ebp - 0x50]
inc ebp
jb 0x200160c8
mov bl, 0x16
mov eax, dword [0xd2d83d6a]
invalid
Function at 0x20016717
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x20016730
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x2001673e
dec eax
jmp 0x2001673e
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x20016748
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x200167cf
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x20016786
cmp byte [ebx], 0x2e
je 0x200167b6
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.20016717
pop esi
jmp 0x200167b6
push ebx
call dword [edi + 0x30]
push eax
call 0x20016795
js 0x200167f9
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x200167b6
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.200167d1
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x20016765
push esi
call dword [edi + 0x40]
leave
ret
jae 0x20016866
jb 0x2001686b
insb byte es:[edi], dx
js 0x20016867
invalid

Function at 0x20016748
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x20016730
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x2001673e
dec eax
jmp 0x2001673e
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x20016748
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x200167cf
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x20016786
cmp byte [ebx], 0x2e
je 0x200167b6
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.20016717
pop esi
jmp 0x200167b6
push ebx
call dword [edi + 0x30]
push eax
call 0x20016795
js 0x200167f9
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x200167b6
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.200167d1
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x20016765
push esi
call dword [edi + 0x40]
leave
ret
jae 0x20016866
jb 0x2001686b
insb byte es:[edi], dx
js 0x20016867
invalid
Function at 0x200167d1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
push edx
push edx
push 3
push edx
push 1
push 0xc0000000
push eax
mov esi, eax
push esi
call dword [edi + 0x30]
lea esi, [esi + eax - 0xc]
push esi
call fcn.20016803
outsb dx, byte [esi]
je 0x20016868

Function at 0x20016803
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
call dword [edi + 0x34]
or eax, eax
jne 0x2001680c
leave
call dword [edi + 0x44]
mov ebx, eax
inc ebx
jne 0x2001681e
dec ebx
push 0x40
pop esi
sub esp, esi
mov edx, esp
push 0
push esp
push esi
push edx
push ebx
call dword [edi + 0x48]
cmp dword [esp - 4], esi
jne 0x20016814
cmp word [esp], 0x5a4d
jne 0x20016814
cmp byte [esp + 0x32], 0x56
je 0x20016814
push eax
add esp, esi
pop esi
mov dword [ebp - 0x1c], esi
push 0
push 0
push esi
push ebx
call dword [edi + 0x50]
inc eax
je 0x20016814
sub esp, 0x58
mov edx, esp
push 0
push esp
push 0x58
push edx
push ebx
call dword [edi + 0x48]
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403203
pop dword [ebp - 0x34]
mov eax, 0x619681d9
sub eax, 0x61564fd6
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x56f9f3a5
sub dword [ebp - 0x44], 0x8a7ae5a
mov dword [ebp - 0x40], 0x638d0645
add dword [ebp - 0x40], 0xcea64600
mov dword [ebp - 0x3c], 0xdba6a4cd
sub dword [ebp - 0x3c], 0x8f5a609f
mov dword [ebp - 0x38], 0xbafa1de3
add dword [ebp - 0x38], 0x4505e21d
lea eax, [ebp - 0x44]
push eax
mov eax, 0xc52afa9a
add eax, 0x3b1585f2
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xb4746b69
sub dword [ebp - 0x44], 0x40020213
mov dword [ebp - 0x40], 0x8789a00b
sub dword [ebp - 0x40], 0x461d3e96
mov dword [ebp - 0x3c], 0xe5f0917f
add dword [ebp - 0x3c], 0x7d7edaed
mov dword [ebp - 0x38], 0xa8b45b60
sub dword [ebp - 0x38], 0xa8b45b60
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x39d1a90
sub eax, 0x35c99bc
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39bb5
push 0
call eax
mov ecx, 0x548d
xor ebx, ebx
add ebx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x34]
mov edx, 0xd5950d44
add edx, 0x89a803f3
sub dword [ebp - 0x30], ecx
mov edi, dword [esi]
mov dword [ebp - 8], 0x83686710
xor edi, edx
mov dword [ebx], edi
add dword [ebp - 4], 0xcb32e00b
add ebx, 4
add esi, 4
loop 0x40331b
add eax, 0x6620217d
sub eax, 0x661edc76
xor ebx, ebx
add ebx, eax
add eax, 0x94de0919
add eax, 0x6b21f6ec
mov ecx, 0x27ade0c9
add ecx, 0xd8921f37
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x45f738
Capabilities:
Terminate process

Disassembly:
jmp 0x508b60
cmp ecx, dword [0x53dfec]
jne 0x508b69
ret
jmp fcn.00508b80

Function at 0x508430
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x508456
xor eax, eax
jmp 0x5084dd
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x508471
xor eax, eax
jmp 0x5084dd
mov edx, dword [ebp - 8]
add edx, 0x18
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x10b
je 0x508497
cmp dword [ebp - 0x14], 0x20b
je 0x5084b7
jmp 0x5084db
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x5c], 0xe
ja 0x5084a4
xor eax, eax
jmp 0x5084dd
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0xd0], 0
setne cl
mov eax, ecx
jmp 0x5084dd
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x6c], 0xe
ja 0x5084ca
xor eax, eax
jmp 0x5084dd
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ecx + 0xe0], 0
setne al
jmp 0x5084dd
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x50f450
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x53dfec]
mov dword [ebp - 4], eax
mov dword [ebp - 0xac], ecx
mov ecx, dword [ebp - 0xac]
call fcn.0045e6b2
mov eax, dword [ebp - 0xac]
mov dword [eax], 0x3c
mov ecx, dword [ebp - 0xac]
mov dword [ecx + 8], 0x400000
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax + 8]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0xac]
mov byte [edx + 0xc], 0
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.0045fd69
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x50f4f2
cmp dword [ebp - 0x9c], 5
jb 0x50f4f0
mov edx, dword [ebp - 0xac]
mov byte [edx + 0xc], 1
jmp 0x50f520
cmp dword [ebp - 0x90], 1
jne 0x50f520
cmp dword [ebp - 0x9c], 4
ja 0x50f516
cmp dword [ebp - 0x9c], 4
jne 0x50f520
cmp dword [ebp - 0x98], 0
jbe 0x50f520
mov eax, dword [ebp - 0xac]
mov byte [eax + 0xc], 1
mov ecx, dword [ebp - 0xac]
mov dword [ecx + 0x10], 0x710
mov edx, dword [ebp - 0xac]
mov dword [edx + 0x14], 0x534340
mov ecx, dword [ebp - 0xac]
add ecx, 0x18
call fcn.004607a5
test eax, eax
jge 0x50f5a2
push str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
push 0
mov ecx, 0x5723b0
call fcn.0045f495
push eax
push 0x3c
push 0x534350
lea ecx, [ebp - 0xa8]
call fcn.004611f5
push eax
call fcn.0045e577
add esp, 0x10
xor eax, eax
jne 0x50f59b
push 0x5343a4
push 0
push 0x3d
push 0x5343a8
push 2
call fcn.0045d9c4
add esp, 0x14
cmp eax, 1
jne 0x50f59b
int3
mov byte [0x5722cc], 1
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 4]
call fcn.0045f738
mov esp, ebp
pop ebp
ret
Function at 0x407338
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x465954
call fcn.00452ab4
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x473240
mov dword [edi + 4], 0x473230
mov dword [edi + 8], 0x473224
mov dword [edi + 0xc], 0x473210
and dword [ebp - 4], 0
lea ebx, [edi + 0x2cc]
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [ebp - 4], 0x14
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
cmp ecx, eax
mov dword [ebp - 0x10], ecx
je 0x4073ce
jmp 0x40738f
mov ecx, dword [ebp - 0x10]
mov esi, dword [ecx]
mov eax, dword [esi + 0x38]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x4073b6
push dword [esi + 0x3c]
push str.__offer_job__d_still_live_
push 1
call fcn.004418d2
add esp, 0xc
call fcn.00407538
push esi
call fcn.0044fdde
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x20]
pop ecx
jne 0x40738c
lea esi, [ebx + 0x18]
call fcn.00416cf1
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
and dword [0x490700], 0
lea eax, [edi + 0x3ac]
push eax
call ebx
lea eax, [edi + 0x380]
push eax
mov byte [ebp - 4], 0x11
call fcn.00415b30
lea eax, [edi + 0x358]
push eax
mov byte [ebp - 4], 0x10
call fcn.00415b30
lea ecx, [edi + 0x348]
mov byte [ebp - 4], 0xf
call fcn.00445e90
mov byte [ebp - 4], 0xe
mov eax, dword [edi + 0x344]
test eax, eax
je 0x407436
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [edi + 0x330]
call fcn.00416f48
lea esi, [edi + 0x320]
call fcn.00416f48
lea eax, [edi + 0x2f8]
push eax
mov byte [ebp - 4], 0xb
call fcn.00415b30
lea esi, [edi + 0x2e4]
call fcn.00416cf1
lea eax, [edi + 0x2cc]
push eax
call ebx
lea ecx, [edi + 0x2b8]
mov byte [ebp - 4], 9
call fcn.00445e90
lea esi, [edi + 0x280]
call fcn.00415c5b
xor esi, esi
push esi
push 1
lea ecx, [edi + 0x25c]
call fcn.0041b413
lea ecx, [edi + 0x248]
mov byte [ebp - 4], 6
call fcn.00445e90
lea ecx, [edi + 0x238]
mov byte [ebp - 4], 5
call fcn.00445e90
lea ecx, [edi + 0x228]
mov byte [ebp - 4], 4
call fcn.00445e90
lea ecx, [edi + 0x218]
mov byte [ebp - 4], 3
call fcn.00445e90
push esi
push 1
lea ecx, [edi + 0x1f4]
call fcn.0041b413
push esi
push 1
lea ecx, [edi + 0x1d8]
call fcn.0041b413
lea eax, [edi + 0x78]
push eax
mov byte [ebp - 4], 0
call fcn.004072a7
or dword [ebp - 4], 0xffffffff
lea eax, [edi + 0x10]
call fcn.00431455
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x409eb5
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [eax + 0x1b8], ebx
jne 0x409f06
cmp byte [eax + 0x1d5], bl
jne 0x409f06
lea eax, [ebp - 4]
push eax
push 0x409f0b
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 4], ebx
je 0x409f06
push dword [ebp - 4]
push str.App::DetectSameInstallerRunning_773
push str._s__hwnd0x_p
push ebx
call fcn.004418d2
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, 1
jmp 0x409f08
xor al, al
pop ebx
leave
ret
Function at 0x4120ef
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, eax
push edi
add esi, 0x2cc
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [esi + 0x1c]
jmp 0x412113
mov eax, dword [edi]
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
add edi, 4
cmp edi, dword [esi + 0x20]
jne 0x412105
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop esi
ret

Function at 0x414022
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x466758
call fcn.00452ab4
sub esp, 0x60
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
cmp byte [esi + 0x1cc], bl
mov dword [ebp - 0x10], esp
je 0x4140db
push 0x472e5a
lea ecx, [ebp - 0x24]
call fcn.00443910
lea eax, [ebp - 0x24]
push eax
push str.mobileUrl
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 0x228]
mov byte [ebp - 4], 1
call fcn.00446900
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004454e0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.00445e90
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00445e90
cmp dword [ebp - 0x3c], ebx
je 0x4140c6
lea ecx, [ebp - 0x50]
call fcn.0042c599
cmp al, bl
jne 0x4140c6
cmp dword [ebp - 0x38], 0x10
mov eax, dword [ebp - 0x4c]
jae 0x4140b5
lea eax, [ebp - 0x4c]
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 3
pop eax
mov ecx, esi
call fcn.00412ca8
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.0041b413
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41421c
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x46670a
call fcn.00452ab4
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 0xc]
xor ebx, ebx
lea esi, [ebp - 0x7c]
mov dword [ebp - 4], ebx
call fcn.00415bef
push ebx
push 0xfde9
mov eax, esi
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.0044de70
add esp, 0x10
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 3
call fcn.00416bdc
mov eax, dword [ebp - 0x40]
push 0x10
pop edi
cmp dword [ebp - 0x2c], edi
jae 0x414277
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
push str.App::OpenLinkInBrowser_3434
push str._s__app_d_link_s_
push ebx
call fcn.004418d2
add esp, 0x14
cmp dword [ebp - 0x30], ebx
je 0x4143ff
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x4142ad
dec eax
je 0x4142bd
dec eax
je 0x41436b
jmp 0x4143d0
lea ecx, [ebp - 0x44]
call fcn.0042c599
cmp al, bl
jne 0x4143ff
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
call fcn.0041acc8
push ebx
lea eax, [ebp - 0x60]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.00429af3
add esp, 0xc
cmp al, bl
je 0x414361
cmp dword [ebp - 0x4c], ebx
je 0x414361
push str.__in_new_ff_window
push ebx
call fcn.004418d2
pop ecx
pop ecx
push str._new_window__
lea ecx, [ebp - 0x7c]
call fcn.0041c1c2
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 5
call fcn.0041ae5c
push 0x473840
lea ecx, [ebp - 0x7c]
call fcn.004156e1
cmp dword [ebp - 0x64], edi
mov ecx, dword [ebp - 0x78]
jae 0x41432d
lea ecx, [ebp - 0x78]
cmp dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x5c]
jae 0x414338
lea eax, [ebp - 0x5c]
push esi
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push esi
lea ecx, [ebp - 0x7c]
call fcn.0041b413
push ebx
push esi
lea ecx, [ebp - 0x60]
call fcn.0041b413
jmp 0x4143ff
push ebx
push esi
lea ecx, [ebp - 0x60]
call fcn.0041b413
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], 0xf
call fcn.0041acc8
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 6
call fcn.00429a38
cmp al, bl
pop ecx
je 0x4143c2
push str.__in_new_gc_window
push ebx
call fcn.004418d2
cmp dword [ebp - 0x2c], edi
pop ecx
pop ecx
mov ecx, dword [ebp - 0x40]
jae 0x4143a5
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x48], edi
mov eax, dword [ebp - 0x5c]
jae 0x4143b0
lea eax, [ebp - 0x5c]
push esi
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x414352
push ebx
push esi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.0041b413
cmp dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x40]
jae 0x4143db
lea eax, [ebp - 0x40]
push esi
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4143ff
push eax
push str.__ShellExec_failed:__d
push esi
call fcn.004418d2
add esp, 0xc
push ebx
push esi
lea ecx, [ebp - 0x44]
call fcn.0041b413
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x41be23
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc
Function at 0x41de6e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov esi, str._windir_SysWOW64
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3c
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0xf2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
and eax, 0x20
pop edi
add eax, 0x20
pop esi
leave
ret

Function at 0x41dec6
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x46443e
call fcn.00452ab4
sub esp, 0x23c
push ebx
push esi
push edi
push 0x3f
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
and dword [ebp - 0x10], 0
xor eax, eax
mov byte [ebp - 0x148], 0
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
pop ecx
xor eax, eax
mov byte [ebp - 0x248], 0
lea edi, [ebp - 0x247]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0xff
push ebx
lea eax, [ebp - 0x148]
push eax
push 0x59
mov edi, 0x400
push edi
call esi
push ebx
lea eax, [ebp - 0x248]
push eax
push 0x5a
push edi
call esi
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c1c2
push 0x473fd4
push eax
lea eax, [ebp - 0x48]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00418a32
lea ecx, [ebp - 0x248]
push ecx
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00418a32
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0041b413
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041b413
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41df95
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x463c87
call fcn.00452ab4
sub esp, 0x2c
push ebx
push edi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x41dfc1
xor al, al
jmp 0x41e05c
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GetUserGeoID
push edi
call esi
push str.GetGeoInfoA
push edi
mov dword [ebp - 0x14], eax
call esi
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
je 0x41e041
cmp eax, ebx
je 0x41e041
push 0x10
call dword [ebp - 0x14]
mov esi, eax
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.0044e140
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041af25
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.0041b413
xor eax, eax
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
push eax
push 3
lea eax, [ebp - 0x10]
push eax
push 4
push esi
call dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0041bbeb
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [ebp - 0x14], ebx
pop esi
je 0x41e05a
cmp dword [ebp - 0x18], ebx
je 0x41e05a
xor eax, eax
inc eax
jmp 0x41e05c
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret