joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062ae
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [0x408114]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x45ede8], 0x55004e
mov dword [0x45edec], 0x4c
mov edi, 0x400
mov ebp, 0x45ede8
je 0x406304
push 1
push 0
push esi
call fcn.00406158
push eax
call dword [0x408124]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406423
cmp eax, edi
jg 0x406423
mov esi, 0x45f5e8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406423
cmp eax, edi
jg 0x406423
push esi
push ebp
push 0x40a5c0
push 0x45e9e8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x470270]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.004066a5
push 4
push 0xc0000000
push esi
call fcn.00406158
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x406423
push 0
push ebp
call dword [0x4080f0]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [0x408138]
mov esi, eax
test esi, esi
je 0x40641c
push edi
push esi
push ebp
call fcn.004061db
test eax, eax
je 0x40641c
push 0x40a5b4
push esi
call fcn.004060bd
test eax, eax
jne 0x4063ba
lea eax, [esi + edi]
push 0x40a5b4
push eax
call dword [0x40808c]
add edi, 0xa
jmp 0x4063ef
add eax, 0xa
push 0x40a5b0
push eax
call fcn.004060bd
mov ebp, eax
test ebp, ebp
je 0x4063eb
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4063dc
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4063d6
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x4063f1
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x45e9e8
push eax
call fcn.00406113
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [0x408160]
add edi, ebx
push edi
push esi
push ebp
call fcn.0040620a
push esi
call dword [0x408134]
push ebp
call dword [0x408124]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x406536
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x4000
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004064d5
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x4065a6
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and word [esi + 0x3ffe], 0
test edi, edi
pop edi
jne 0x4065a6
cmp dword [ebp + 0xc], 1
je 0x4065aa
cmp dword [ebp + 0xc], 2
je 0x4065aa
and word [esi], 0
pop esi
leave
ret 0x14
Function at 0x409650
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x409683
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x409683
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x409683
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x409683
mov al, 1
ret
xor al, al
ret

Function at 0x40a5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov edx, dword [eax + 0x3c]
add edx, eax
cmp dword [edx + 0x74], 0
jbe 0x40a713
cmp word [edx + 0x14], 0x68
jb 0x40a713
add edx, 0x78
je 0x40a713
mov eax, dword [edi]
push dword [edx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40a713
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x3c]
add edx, ecx
cmp dword [edx + 0x74], 0
jbe 0x40a713
cmp word [edx + 0x14], 0x68
jb 0x40a713
add edx, 0x78
je 0x40a713
mov eax, dword [edi]
push dword [edx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x40a713
mov ecx, dword [ebp + 8]
cmp ecx, 0xffff
ja 0x40a678
movzx ebx, cx
jmp 0x40a749
mov eax, dword [edi]
push dword [ebx + 0x20]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov ecx, dword [ebx + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edx
lea ebx, [eax + ecx*4]
cmp eax, ebx
je 0x40a713
nop
mov eax, ebx
sub eax, edx
sar eax, 2
mov eax, eax
test eax, eax
jns 0x40a6b0
add eax, 1
sar eax, 1
push dword [edx + eax*4]
lea ecx, [edx + eax*4]
mov eax, dword [edi]
mov dword [ebp - 8], ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
mov dl, byte [esi]
test dl, dl
je 0x40a6f1
mov cl, dl
sub esi, eax
nop dword [eax]
mov dl, cl
cmp cl, byte [eax]
jne 0x40a6f1
mov cl, byte [esi + eax + 1]
inc eax
mov dl, cl
test cl, cl
jne 0x40a6e0
movzx eax, byte [eax]
movzx ecx, dl
sub ecx, eax
je 0x40a71e
mov edx, dword [ebp - 8]
test ecx, ecx
cmovle ebx, edx
add edx, 4
test ecx, ecx
cmovle edx, dword [ebp - 4]
mov dword [ebp - 4], edx
cmp edx, ebx
jne 0x40a6a0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ebx, dword [ebp - 0x10]
mov esi, dword [eax + 4]
mov ecx, esi
push dword [ebx + 0x24]
call dword [0x5c689c]
mov ecx, edi
call esi
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x14]
sar edx, 2
mov ax, word [eax + edx*2]
add ax, word [ebx + 0x10]
movzx ebx, ax
mov eax, dword [edi]
mov ecx, dword [ebp - 0xc]
mov esi, dword [eax + 4]
push dword [ecx + 0x1c]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov edx, dword [ebp - 0xc]
movzx ecx, bx
pop edi
pop esi
sub ecx, dword [edx + 0x10]
pop ebx
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4066c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UriUvQCq
lea edi, [esi - 0x5000]
push edi
or ebp, 0xffffffff
jmp 0x4066e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4066e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4066d8
mov eax, 1
add ebx, ebx
jne 0x4066fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4066f0
jne 0x40670c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4066f0
xor ecx, ecx
sub eax, 3
jb 0x406720
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x406792
mov ebp, eax
add ebx, ebx
jne 0x40672b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x406738
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40675c
inc ecx
add ebx, ebx
jne 0x406748
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40673d
jne 0x406759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40673d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40677c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40676d
jmp 0x4066de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40677c
add edi, ecx
jmp 0x4066de
pop esi
lea edi, [esi + 0x4000]
mov eax, dword [edi]
or eax, eax
je 0x4067db
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x406799
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x606c]
or eax, eax
je 0x4067d5
mov dword [ebx], eax
add ebx, 4
jmp 0x4067b6
call dword [esi + 0x6068]
mov ebp, dword [esi + 0x6070]
lea edi, [esi - 0x1000]
mov ebx, pe_overlay
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40680f
sub esp, 0xffffff80
jmp section.DBsumPAo
Function at 0x40a6f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4414d0], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x4414cc]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x4414d0], edx
cmp eax, 0x26f
jl 0x40a6f8
mov dword [0x432970], 0x270
ret

Function at 0x40a730
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x4414d4]
mov ebx, dword [eax*4 + 0x4414d0]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x441b04]
mov dword [eax*4 + 0x4414d0], edx
cmp eax, 0xe2
jl 0x40a738
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x4414d4]
mov ebx, dword [eax*4 + 0x4414d0]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x441144]
mov dword [eax*4 + 0x4414d0], edx
cmp eax, 0x26e
jl 0x40a788
mov edx, dword [0x4414d0]
mov ecx, dword [0x441e8c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x441b00]
mov dword [0x441e8c], eax
mov dword [0x432970], 0
pop ebx
ret

Function at 0x40a810
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x432970]
add dword [0x432970], 1
mov eax, dword [0x440070]
cmp eax, dword [0x432490]
jne 0x40a833
cmp ebx, 0x271
jb 0x40a854
mov eax, dword [0x440070]
call fcn.0040a6f0
not dword [0x440070]
mov eax, dword [0x440070]
mov dword [0x432490], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40a870
call fcn.0040a730
xor ebx, ebx
mov dword [0x432970], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x4414d0]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x40c310
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x432220]
cmp ax, 0xcb
je 0x40c41c
cmp ax, 0xcc
je 0x40c41c
lea esi, [esi]
mov edx, dword [0x4420d0]
test edx, edx
je 0x40c345
mov eax, dword [0x441f80]
call edx
mov ebx, eax
jmp 0x40c34a
mov ebx, 0x441f84
cmp word [0x441f70], 0
jle 0x40c370
mov eax, 0x441f50
call fcn.0040c580
mov eax, ebx
call fcn.0040bed0
mov eax, ebx
call fcn.0040bf40
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40c392
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40c38d
mov edx, edi
mov eax, ebx
call fcn.0040b340
jmp 0x40c390
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40c378
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x441f70], 0
jle 0x40c41c
mov edx, 0x441e90
mov eax, ebx
call fcn.0040b480
mov edi, eax
test edi, edi
je 0x40c3ec
mov eax, dword [0x441f24]
mov dword [edi + 0xc], eax
cmp dword [0x441f24], 0
je 0x40c3e0
mov eax, dword [0x441f24]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x441f24], eax
nop
sub word [0x441f70], 1
cmp word [0x441f70], 0
sete bl
mov eax, 0x441f50
call fcn.0040c5a0
test bl, bl
je 0x40c41c
mov eax, 0x441f50
call fcn.0040c570
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x40eba0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x4412b0], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.0040ed80
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x4412b0]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402490
call sub.kernel32.dll_GetCommandLineA
mov dword [0x432290], eax
mov ebx, eax
jmp 0x40ed43
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x40ec28
cmp byte [ebx], 0
je 0x40ed4c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x40eca3
mov al, byte [ebx]
cmp al, 1
jb 0x40ec98
sub al, 0x20
jbe 0x40ec68
sub al, 2
je 0x40ec7c
jmp 0x40ec98
mov al, byte [ebp - 0x114]
test al, al
je 0x40eca8
add dword [ebp - 0x110], 1
jmp 0x40eca0
cmp byte [ebx + 1], 0x22
je 0x40ec93
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40eca0
add ebx, 1
jmp 0x40eca0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40ec58
test dword [ebp - 0x10c], 0xffffffff
je 0x40ed3c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.0040ed80
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x4412b0]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x40ed33
mov al, byte [ebx]
cmp al, 1
jb 0x40ed28
sub al, 0x20
jbe 0x40ecf8
sub al, 2
je 0x40ed0c
jmp 0x40ed28
mov al, byte [ebp - 0x114]
test al, al
je 0x40ed38
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x40ed30
cmp byte [ebx + 1], 0x22
je 0x40ed23
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40ed30
add ebx, 1
jmp 0x40ed30
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40ece8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x40ec2b
mov ebx, dword [ebp - 0x10c]
mov dword [0x4412a0], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x4412b0
call fcn.0040c150
mov eax, dword [0x4412b0]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410c20
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov dx, 0xffff
lea esi, [esi]
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x410c51
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x410c53
shr ecx, 1
cmp bx, 8
jl 0x410c38
movzx eax, dx
mov dword [eax*4 + 0x444080], ecx
cmp dx, 0xff
jl 0x410c28
pop ebx
ret

Function at 0x410c70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x444084], 0
jne 0x410c88
call fcn.00410c20
nop
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x410cbc
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x444080]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x410c98
mov esi, esi
not eax
pop edi
pop esi
pop ebx
ret
Function at 0x411e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00411e20
push ebp
push 0x40fa10
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x411f40
mov al, byte [ebp - 0x110]
test al, al
je 0x411f09
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403880
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00406ba0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004076d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x434a28
call fcn.0042b020
mov edx, 0x411e9a
mov ecx, ebp
call fcn.0040f8d0
jmp 0x411f40
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x434a28
call fcn.0042b020
mov edx, 0x411f09
mov ecx, ebp
call fcn.0040f8d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x412004
mov al, byte [ebp - 0x110]
test al, al
je 0x411fcd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403880
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00406ba0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004076d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x434a28
call fcn.0042b020
mov edx, 0x411f5e
mov ecx, ebp
call fcn.0040f8d0
jmp 0x412004
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x434a28
call fcn.0042b020
mov edx, 0x411fcd
mov ecx, ebp
call fcn.0040f8d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00411b60
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00411e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42bca0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.0042bc90
push ebp
push 0x40fa10
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x42bd10
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.004081e0
cmp ebx, 1
jle 0x42bd00
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.00407da0
jmp 0x42bd1b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00406320
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0042bc90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42beb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0042bea0
push ebp
push 0x40fa10
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x44499c]
xor edx, edx
call fcn.00406320
mov dword [ebx*4 + 0x4449bc], 0xffffffff
cmp ebx, 7
jl 0x42bed8
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x42bf64
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00406d10
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.00426910
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x42bf64
push 4
push ebx
push esi
mov eax, 0x42bd80
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x42be10
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042bea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c5a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x444a00], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x444860], eax
mov eax, dword [ebp - 0x90]
mov dword [0x444870], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x444880], eax
mov eax, dword [ebp - 0x88]
mov dword [0x444890], eax
mov edx, 0x4448a1
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00402490
lea eax, [ebp - 0x80]
call fcn.00403290
mov byte [0x4448a0], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x444a10], eax
test eax, eax
je 0x42c640
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x444a10]
call sub.kernel32.dll_GetProcAddress
mov dword [0x444a00], eax
nop
cmp dword [0x444870], 6
jae 0x42c654
mov dword [0x432e90], 0
nop
cmp dword [0x444870], 6
jb 0x42c670
cmp dword [0x444880], 1
jb 0x42c670
mov dword [0x432ea0], 2
mov esp, ebp
pop ebp
ret
Function at 0x1000d630
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x4c]
mov edi, dword [esi + 0x40]
push 0
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
mov dword [esp + 0x28], edi
call fcn.10009df0
add esp, 0x14
test eax, eax
jne 0x1000d786
mov ecx, dword [esi + 0x44]
movzx eax, byte [esi + 8]
add eax, ecx
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov ch, byte [eax + 5]
push ebx
movzx ebx, word [edi + 0x1e]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x44]
mov cl, byte [eax + 6]
push ebp
mov dword [esp + 0x10], edx
movzx edx, word [esi + 0xe]
mov ebp, ecx
movzx ecx, word [esi + 0x14]
lea edx, [edx + ecx*2]
movzx ecx, byte [esi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.1012b770
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
sub ebx, ebp
push ebx
lea edx, [ecx + ebp]
push edx
add eax, ebp
push eax
call fcn.1012b770
push esi
push edi
call fcn.100081e0
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x1000d776
movzx ecx, byte [esi + 2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
lea edx, [esi + 0x18]
push edx
lea eax, [edi + 0x18]
push eax
call fcn.1012b770
mov al, byte [esi + 2]
add esp, 0xc
test al, al
mov byte [edi + 2], al
je 0x1000d6f8
mov word [edi + 0x12], bx
mov ecx, dword [edi + 0x44]
movzx edx, byte [ecx]
and edx, 0xfffffff7
push edx
call fcn.10008350
movzx ecx, byte [esi + 8]
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x44]
push eax
lea eax, [ecx + edx + 8]
push eax
call fcn.100056d0
mov ecx, dword [esp + 0x28]
add esp, 0xc
cmp byte [ecx + 0x16], 0
je 0x1000d76b
mov edx, dword [esi + 0x4c]
mov eax, dword [edi + 0x4c]
push edx
mov bl, 5
call fcn.100079a0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1000d776
xor esi, esi
cmp word [edi + 0x14], si
jbe 0x1000d76b
lea esp, [esp]
mov eax, esi
call fcn.10007b90
call fcn.10007d30
test eax, eax
jne 0x1000d784
movzx eax, word [edi + 0x14]
add esi, 1
cmp esi, eax
jl 0x1000d750
push edi
call fcn.1000ca60
add esp, 4
mov ebx, eax
mov ecx, dword [edi + 0x48]
push ecx
call fcn.1001da70
add esp, 4
mov eax, ebx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret