joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004a13d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004a13d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10029020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1002902f
pop dword [ebp - 0x10]
mov eax, 0x4a075d2e
add eax, 0xc5fb3301
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x78cb0171
add dword [ebp - 0x20], 0xd58743da
mov dword [ebp - 0x1c], 0x3632b46e
sub dword [ebp - 0x1c], 0x3ff6829
mov dword [ebp - 0x18], 0x79795a0d
add dword [ebp - 0x18], 0xd2d2ea21
mov dword [ebp - 0x14], 0x1aadc99d
add dword [ebp - 0x14], 0xe5523663
lea eax, [ebp - 0x20]
push eax
mov eax, 0xef7a0c38
sub eax, 0xdf747b2c
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xfa9d1be6
add dword [ebp - 0x20], 0x79d54d70
mov dword [ebp - 0x1c], 0xd2fcc076
add dword [ebp - 0x1c], 0x6e6fa0ff
mov dword [ebp - 0x18], 0xa4d13c18
add dword [ebp - 0x18], 0xbe9e3054
mov dword [ebp - 0x14], 0xa25a9cfa
add dword [ebp - 0x14], 0x5da56306
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x5bac8
push 0
call eax
mov ecx, 0x4a6f710e
sub ecx, 0x4a6f3059
xor edi, edi
add edi, eax
mov ebx, 0x3ff6be75
add ebx, 0xd00fd58b
add ebx, dword [ebp - 0x10]
mov esi, 0xde040d89
sub esi, 0x529a3705
mov dword [ebp - 8], 0x1e4aa667
mov edx, dword [ebx]
xor dword [ebp - 0xc], esi
add edx, esi
xor dword [ebp - 8], esi
mov dword [edi], edx
add dword [ebp - 0xc], 0x36ab349c
add edi, 0xc0780002
sub edi, 0xc077fffe
add ebx, 0xb90a905
add ebx, 0xf46f56ff
loop 0x1002914e
add eax, 0xeb9c1605
add eax, 0x1464dfa2
xor ebx, ebx
add ebx, eax
add eax, 0x20074d4f
sub eax, 0x20074d4a
mov ecx, 0x8361d33a
add ecx, 0x8c9e2cc6
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040c850
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040c850
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0040c850
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x40c850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c85f
pop dword [ebp - 0x30]
mov eax, 0x1177a3e1
sub eax, 0x1136db82
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe9c7849
add dword [ebp - 0x40], 0x3fb5cd02
mov dword [ebp - 0x3c], 0x3382e3ce
add dword [ebp - 0x3c], 0xfeb06877
mov dword [ebp - 0x38], 0xce47e9a4
add dword [ebp - 0x38], 0x7e045a8a
mov dword [ebp - 0x34], 0xf814e97b
add dword [ebp - 0x34], 0x7eb1685
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x675420
sub dword [ebp - 0x40], 0x8bf4eaca
mov dword [ebp - 0x3c], 0xa6abb3d9
sub dword [ebp - 0x3c], 0x653f5264
mov dword [ebp - 0x38], 0x328a9b85
sub dword [ebp - 0x38], 0xcf1b2f19
mov dword [ebp - 0x34], 0x8319d431
sub dword [ebp - 0x34], 0x8319d431
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x62c3690f
add eax, 0x9d7e573d
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38de6
push 0
call eax
mov ecx, 0xc8f4fc13
sub ecx, 0xc8f4bec8
xor ebx, ebx
add ebx, eax
mov edx, 0xe9c450ab
add edx, 0x167ed955
add edx, dword [ebp - 0x30]
mov edi, 0xa3fc8e83
add edi, 0x1256ef58
add dword [ebp - 0x18], ebx
mov esi, dword [edx]
sub dword [ebp - 4], edi
xor esi, edi
add dword [ebp - 0x1c], edx
mov dword [ebx], esi
mov dword [ebp - 0x18], 0x2cda1085
add ebx, 0xb9d5bb73
sub ebx, 0xb9d5bb6f
add edx, 0x67df81d8
sub edx, 0x67df81d4
loop 0x40c97e
add eax, 0xe7ff
mov ebx, eax
add eax, 0x999bf652
add eax, 0x666409b3
mov ecx, 0x32a39993
add ecx, 0xcd9c666d
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x407850
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
cmp edx, 0x1388
jne 0x407869
push str.Edit_or_Create_New
jmp 0x407951
cmp edx, 0x13ec
jne 0x40787b
push str.English
jmp 0x407951
jle 0x4078a5
mov eax, dword [ecx + 0x190]
add eax, 0x13ed
cmp edx, eax
jge 0x4078a5
imul edx, edx, 0x19e
lea esi, [ecx + 0x2a02]
lea ecx, [edx + ecx - 0x20364a]
push ecx
jmp 0x407957
cmp edx, 0x4c
jne 0x4078b1
mov edx, 0x45
jmp 0x40792a
cmp edx, 0x22
jne 0x4078bd
mov edx, 0x11
jmp 0x40792a
cmp edx, 0x23
jne 0x4078c9
mov edx, 0x12
jmp 0x40792a
cmp edx, 0x24
jne 0x4078d5
mov edx, 0x13
jmp 0x40792a
cmp edx, 0xc5
jne 0x4078e4
mov edx, 0x33
jmp 0x40792a
cmp edx, 0xc8
jne 0x4078f3
mov edx, 0x34
jmp 0x40792a
cmp edx, 0x7a
jne 0x4078ff
mov edx, 0x79
jmp 0x40792a
cmp edx, 0x16d
jne 0x40790e
mov edx, 0x73
jmp 0x40792a
cmp edx, 0xae
jne 0x40791d
mov edx, 0xac
jmp 0x40792a
cmp edx, 0xaf
jne 0x40792a
mov edx, 0xad
mov esi, dword [0x5aa1e0]
xor eax, eax
cmp esi, 0xffffffff
je 0x40794c
cmp esi, edx
je 0x40796c
inc eax
mov esi, eax
imul esi, esi, 0x70
mov esi, dword [esi + 0x5aa1e0]
cmp esi, 0xffffffff
jne 0x407937
push 0x5603ba
lea esi, [ecx + 0x2a02]
push 0xdc
push esi
call fcn.005363ab
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret 4
imul eax, eax, 0x70
cmp byte [0x5b9e71], 0
lea esi, [ecx + 0x2a02]
je 0x407986
add eax, str.Start_a_New_Empty_Project
push eax
jmp 0x407957
add eax, 0x5aa207
push eax
jmp 0x407957

Function at 0x4082f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5b88c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 8], ebx
je 0x408394
push 0x5c9cd5
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005363ab
lea ecx, [esi + 0x145]
push ecx
lea edx, [ebp - 0x108]
push 0x104
push edx
call fcn.005364ca
push 0x56059c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005364ca
push str..lng
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.005364ca
add esp, 0x30
lea eax, [esi + 4]
push eax
lea edx, [ebp - 0x108]
push edx
mov dword [eax], 0x80
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4083f5
mov ebx, 1
jmp 0x4083a7
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebx, eax
test ebx, ebx
je 0x4083f5
push edi
push 0x5c9cd5
lea edi, [esi + 0x2ade]
push 0x104
push edi
call fcn.005363ab
push 0x560598
push 0x104
push edi
call fcn.005364ca
add esi, 0x30
push esi
push 0x104
push edi
call fcn.005364ca
add esp, 0x24
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00535a9b
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00535a9b
mov esp, ebp
pop ebp
ret 4
Function at 0x411360
Capabilities:
Open clipboard

Disassembly:
mov eax, dword [0x5b9e5c]
mov ecx, dword [eax + 0x20]
push edi
push ecx
xor edi, edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x411378
pop edi
ret
push esi
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 8
call esi
test eax, eax
jne 0x411397
push 2
call esi
test eax, eax
jne 0x411397
push 0xe
call esi
test eax, eax
je 0x41139c
mov edi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
ret

Function at 0x412120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41213b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x412172
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x41216e
jmp 0x412160
cmp esi, eax
jae 0x412172
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x412160
cmp esi, eax
jb 0x412179
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418b30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ecx + 0xc], 0
mov dword [ebp - 4], 0
jle 0x418c27
push ebx
push esi
push edi
lea ebx, [ebx]
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ecx + 8], edi
jle 0x418c14
mov edi, edi
mov esi, dword [ecx + 0x10]
imul esi, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
add esi, edi
movzx edx, byte [eax + esi + 2]
movzx ebx, byte [eax + esi + 1]
movzx eax, byte [eax + esi]
add edx, ebx
add edx, eax
mov eax, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 0xff
cmp eax, 0xcc
jg 0x418b9b
lea edx, [eax + 0x33]
mov ebx, dword [ecx + 0x18]
mov byte [ebx + esi + 2], dl
mov edx, 0xff
cmp eax, 0xed
jg 0x418bb1
lea edx, [eax + 0x12]
mov ebx, dword [ecx + 0x18]
mov byte [ebx + esi + 1], dl
cmp eax, 0x1f
jge 0x418bc1
xor eax, eax
jmp 0x418bc4
add eax, 0xffffffe1
mov edx, dword [ecx + 0x18]
mov byte [esi + edx], al
mov eax, dword [ecx + 0x18]
cmp byte [eax + esi + 1], 0x1e
jae 0x418bdb
mov eax, 0x1e
jmp 0x418be0
movzx eax, byte [eax + esi + 1]
mov edx, dword [ecx + 0x18]
mov byte [edx + esi + 1], al
mov eax, dword [ecx + 0x18]
cmp byte [esi + eax], 0x1e
jae 0x418bf7
mov eax, 0x1e
jmp 0x418bfb
movzx eax, byte [eax + esi]
mov edx, dword [ecx + 0x18]
mov byte [esi + edx], al
mov eax, dword [ebp - 8]
inc eax
add edi, 3
mov dword [ebp - 8], eax
cmp eax, dword [ecx + 8]
jl 0x418b60
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ecx + 0xc]
jl 0x418b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419240
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0xff
cdq
idiv esi
push edi
push 0x100
mov dword [ebp - 0xc], ecx
mov edi, eax
call fcn.00432ae2
add esp, 4
mov ebx, eax
cmp esi, 1
jl 0x419366
push 0x100
push 0
push ebx
call fcn.00536200
xor eax, eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp esi, eax
jle 0x419308
mov dword [ebp - 8], eax
mov eax, 1
sub eax, edi
mov esi, edi
mov dword [ebp - 0x10], eax
jmp 0x4192a3
mov eax, dword [ebp - 0x10]
test byte [ebp - 4], 1
mov dword [ebp - 0x2c], esi
je 0x4192c4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov eax, 0xff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
xor eax, eax
jmp 0x4192d9
add eax, esi
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov eax, 0xff
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0xc]
mov byte [ebx + 0xff], al
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
call fcn.004190c0
mov eax, dword [ebp - 4]
add dword [ebp - 8], edi
inc eax
add esi, edi
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 8]
jl 0x4192a0
push 0x100
call fcn.00432ae2
mov ecx, 0x40
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
mov esi, eax
add esp, 4
mov dword [ebp + 8], eax
sub esi, ecx
mov edi, 0x100
nop
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov dl, byte [esi + ecx]
and eax, 0xff
inc ecx
dec edi
mov byte [eax + ebx], dl
jne 0x419330
mov eax, dword [ebp + 8]
push eax
call fcn.00432ad7
mov ecx, dword [ebp - 0xc]
add esp, 4
push ebx
push ebx
push ebx
call fcn.00419040
push ebx
call fcn.00432ad7
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41fd00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
test eax, eax
jne 0x41fd0d
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.005380ea
add esp, 0x10
pop ebp
ret 0xc

Function at 0x41fd30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
test eax, eax
jne 0x41fd3d
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.005383ae
add esp, 0x10
pop ebp
ret 0xc
Function at 0x434d4c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0043e6c0
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x434d85
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0043498e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x434de3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x434e07
cmp dword [edi + 0x74], 0
jne 0x434e07
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0043e6c0
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00434da4
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43be31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x43be78
call fcn.0043e6c0
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43be78
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43be94
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043b936
mov esi, eax
test edi, edi
je 0x43be92
test ebx, ebx
je 0x43be92
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43d152
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x551c4b
call fcn.00538b8a
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x43d177
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x43d1c9
call fcn.0043d57d
push eax
lea ecx, [ebp - 0x10]
call fcn.00413290
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00538c94
push eax
call fcn.004113b0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404860
mov eax, esi
call fcn.00538c62
ret 8
Function at 0x43dd0a
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0043d9c9
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x43dd54
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00439df9
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00438494
jmp 0x43dd5f
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0044a543
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x43dd65
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0043ca44
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x43dda2
call fcn.0043d9c9
mov dword [esi + 0xc], 1
jmp 0x43dda7
call fcn.0043d9c9
cmp dword [esi], 0
je 0x43ddf0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x43ddc8
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00439df9
jmp 0x43ddda
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00404cc0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00438494
jmp 0x43de14
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x43de14
push dword [esi]
push dword [ebp + 8]
call fcn.0044a543
pop esi
pop ebp
ret 0xc

Function at 0x44002e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5b88c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x440076
push 0x565118
push 4
push eax
call fcn.005363ab
push eax
call fcn.004113b0
add esp, 0x10
jmp 0x44008c
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x44010f
push edi
call fcn.00538e79
mov edi, dword [eax]
call fcn.00538e79
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00539057
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00538e79
cmp dword [eax], 0
je 0x4400e3
call fcn.00538e79
push dword [eax]
call fcn.004351d6
pop ecx
jmp 0x4400ea
call fcn.00538e79
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x44010f
cmp dword [ebp - 0x11c], esi
jae 0x44010f
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x440111
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00535a9b
leave
ret
Function at 0x44011e
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5b88c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.0043727c
pop ecx
cmp eax, esi
je 0x440208
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x440208
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.00536200
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x440208
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x440208
cmp esi, 0x14
jge 0x440208
push 0x10
push 0
push edi
call fcn.0053ad0d
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4401f7
call fcn.00538e79
cmp dword [eax], 0x22
je 0x4401f7
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.00538cb1
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x4401cd
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x5cb9b0], 0
jne 0x440293
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x4402bc
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.0044002e
pop ecx
pop ecx
test eax, eax
jne 0x4402be
inc edi
cmp edi, esi
jl 0x440299
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00535a9b
leave
ret 8