joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df412
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x6c2008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x14]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
shl eax, 8
push esi
add eax, 0x20019
cmp dword [ecx + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x4c380b
mov ecx, dword [ecx]
lea esi, [ebp - 0x830]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x82c], 0x820
test eax, eax
cmovle esi, eax
and dword [ebp - 0x828], 0
test esi, esi
js 0x4c38b3
cmp dword [edi + 0x14], 8
jb 0x4c3848
mov edi, dword [edi]
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push edi
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4c38a7
cmp dword [ebp - 0x828], 1
je 0x4c3897
cmp dword [ebp - 0x828], 2
je 0x4c3897
mov esi, 0x8007065d
jmp 0x4c38a7
lea eax, [ebp - 0x824]
mov ecx, ebx
push eax
xor esi, esi
call fcn.00411bb5
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004297f5
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x4c37d3
Function at 0x4df432
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push 0x34
mov eax, 0x620259
call fcn.00429868
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x4c39e3
mov dword [esi + 4], eax
xor ebx, ebx
mov dword [ebp - 0x28], 7
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], ebx
push eax
call fcn.004c38ee
mov edi, eax
test edi, edi
js 0x4c3afa
push 0xf0000040
push 0x18
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
setne cl
test eax, eax
je 0x4c3a4c
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x800c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
setne cl
test cl, cl
je 0x4c3ada
push 4
pop ecx
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push eax
lea eax, [ebp - 0x20]
push eax
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4c3ada
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x3c]
add eax, eax
push ebx
push eax
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
setne bl
test eax, eax
je 0x4c3ad4
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3d]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x18], eax
call fcn.00421885
push 0
lea eax, [ebp - 0x18]
push eax
push dword [esi]
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x14]
test eax, eax
setne bl
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x4c3afa
jmp 0x4c3af0
push dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x4c3afa
mov dword [esi + 4], eax
mov eax, dword [esi]
mov ecx, 0x80004005
cmp eax, dword [esi + 4]
mov eax, dword [ebp - 0x28]
cmove edi, ecx
cmp eax, 8
jb 0x4c3b42
mov ecx, dword [ebp - 0x3c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x4c3b39
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00413cba
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.00429588
pop ecx
pop ecx
mov eax, edi
call fcn.00429817
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x4c39ca

Function at 0x4df4b2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c41a4

Function at 0x4df4f2
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
pop ebp
jmp 0x4c469a

Function at 0x4df512
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c4877
Function at 0x4df5b2
Capabilities:
Decode data using base64 via winapi
Encode data using base64 via winapi

Disassembly:
push 0xa4
mov eax, 0x620565
call fcn.00429868
xor eax, eax
lea edi, [ebp - 0x88]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
xor eax, eax
mov dword [ebp - 0xac], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], 7
mov word [ebp - 0xac], ax
mov byte [ebp - 4], 1
call fcn.004bdebb
mov edi, eax
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [edi]
mov esi, dword [ecx + 0x158]
mov ecx, esi
call dword [0x6317ac]
mov ecx, edi
call esi
push 0x64
pop esi
test eax, eax
js 0x4c5627
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x78]
sub eax, dword [ebp - 0x88]
push ecx
push ebx
push 0x40000001
push eax
push dword [ebp - 0x88]
mov dword [ebp - 0x78], ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
push dword [ebp - 0x78]
mov esi, eax
lea edi, [ebp - 0x94]
test esi, esi
lea ecx, [ebp - 0x94]
setne byte [ebp - 0xad]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.004bffaa
mov ebx, dword [ebp - 0x94]
mov byte [ebp - 4], 2
test esi, esi
je 0x4c55b5
mov eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x78]
sub eax, dword [ebp - 0x88]
push ecx
push ebx
push 0x40000001
push eax
push dword [ebp - 0x88]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
setne byte [ebp - 0xad]
push 0x64
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.0042a970
add esp, 0xc
cmp byte [ebp - 0xad], 0
je 0x4c5611
push edi
push edi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], esi
push eax
lea eax, [ebp - 0x74]
push eax
push 1
push dword [ebp - 0x78]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x4c5611
call fcn.004bdebb
push dword [ebp + 8]
mov edi, eax
push dword [ebp - 0x74]
mov ecx, dword [edi]
mov esi, dword [ecx + 0x98]
mov ecx, esi
call dword [0x6317ac]
mov ecx, edi
call esi
mov esi, eax
test ebx, ebx
je 0x4c5627
mov ecx, dword [ebp - 0x8c]
sub ecx, ebx
and ecx, 0xfffffffe
push ecx
push ebx
call fcn.00413ce3
mov ecx, dword [ebp - 0x88]
test ecx, ecx
je 0x4c565f
mov eax, dword [ebp - 0x80]
sub eax, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], eax
cmp eax, 0x1000
jb 0x4c5656
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00413cba
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x7c]
push eax
push ecx
call fcn.00429588
pop ecx
pop ecx
mov eax, esi
call fcn.00429817
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x4c54a1
Function at 0x4df6d2
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6c2008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 4
xor ebx, ebx
cmp dword [eax + 0x14], 8
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
jb 0x4c6b4c
mov eax, dword [eax]
push eax
push str.SoftwareMicrosoftOneDriveAccounts
lea eax, [ebp - 0x28]
push eax
call fcn.004beac2
cmp dword [eax + 0x14], 8
jb 0x4c6b63
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x10
push str.IsGoSov
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00413b5a
test esi, esi
pop esi
jne 0x4c6b99
cmp dword [ebp - 8], 1
sete bl
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004297f5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x4c6b20

Function at 0x4df832
Capabilities:
Enumerate gui resources

Disassembly:
push 0x6c
mov eax, 0x620a7b
call fcn.00429868
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x78], eax
and dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x70]
call fcn.00477ccd
xor ebx, ebx
lea ecx, [ebp - 0x48]
inc ebx
push esi
mov dword [ebp - 4], ebx
call fcn.00411a2e
push edi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00411a2e
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x78]
push eax
push 0x4c80b0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x4c8379
cmp dword [ebp - 0x18], 0
ja 0x4c837b
xor bl, bl
lea ecx, [ebp - 0x78]
call 0x4c078e
mov al, bl
call fcn.00429817
ret 0x10
push ebp
mov ebp, esp
pop ebp
jmp 0x4c8314

Function at 0x4df942
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x6c2008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x4c8e04
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4c8e46
cmp dword [esi + 0x10], eax
jne 0x4c8e22
xor esi, esi
jmp 0x4c8e2a
cmp dword [esi + 0x14], 8
jb 0x4c8e2a
mov esi, dword [esi]
push 4
push ebx
push 4
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004297f5
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x4c8dcb
Function at 0x4df962
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x6c2008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x4c906b
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4c90c3
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
lea ecx, [eax*2 + 2]
jb 0x4c9092
mov ebx, dword [ebx]
movzx eax, byte [ebp + 0x1c]
inc eax
cmp dword [esi + 0x10], 0
jne 0x4c90a1
xor esi, esi
jmp 0x4c90a9
cmp dword [esi + 0x14], 8
jb 0x4c90a9
mov esi, dword [esi]
push ecx
push ebx
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004297f5
leave
ret 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x4c9032

Function at 0x4df972
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
lea edx, [eax*2 + 2]
jb 0x4c90fb
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4c9106
mov eax, dword [eax]
push edx
push ecx
push 2
push eax
push 0x682e5c
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movzx ecx, ax
mov edx, 0x80070000
or ecx, edx
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovle edx, ecx
shr edx, 0x1f
xor dl, 1
mov al, dl
pop ebp
ret 0xc
push ebp
mov ebp, esp
pop ebp
jmp 0x4c90e1
Function at 0x4df9e2
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x6c2008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
push 0x682614
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x240], eax
call fcn.00411bb5
mov eax, dword [ebp - 0x240]
xor ecx, ecx
push 0x118
push ecx
mov dword [eax], ecx
lea eax, [ebp - 0x238]
mov dword [ebx], ecx
mov bl, cl
push eax
mov dword [edi], ecx
call fcn.0042a970
add esp, 0xc
mov dword [ebp - 0x23c], 0x11c
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4c98f3
mov ecx, dword [ebp - 0x120]
mov bl, 1
mov eax, dword [ebp - 0x238]
mov dword [edi], eax
mov eax, dword [ebp - 0x234]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x120], 0x118
mov dword [ecx], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 2
push str.BuildLab
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push dword [0x6c2b70]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
js 0x4c98f3
push esi
lea eax, [ebp - 0x11c]
push eax
call fcn.004c9498
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004297f5
leave
ret 0x10
push ebp
mov ebp, esp
pop ebp
jmp 0x4c980e

Function at 0x4e3eb1
Capabilities:
Accept command line arguments

Disassembly:
push 0x230
mov eax, 0x62429f
call fcn.00429868
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x23c], ebx
xor eax, eax
mov dword [ebp - 0x238], ecx
mov dword [ebx], ecx
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x238], 1
call fcn.004bdebb
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax + 0x1a8]
mov ecx, esi
call dword [0x6317ac]
mov ecx, edi
call esi
mov byte [ebp - 0x234], al
test al, al
jne 0x4e3f91
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0042a970
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4e3f91
lea eax, [ebp - 0x218]
push 0x6692bc
push eax
call fcn.005fa18d
pop ecx
pop ecx
test eax, eax
je 0x4e3f91
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040ad69
push esi
push str._allusers
lea ecx, [ebp - 0x230]
call fcn.00457b9f
cmp eax, 0xffffffff
lea ecx, [ebp - 0x230]
setne byte [ebp - 0x234]
call fcn.00413b5a
push ebx
push dword [ebp - 0x234]
call fcn.004c4130
push 0x681040
mov ecx, ebx
call fcn.00411c2b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004e40fb
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.004843fb
mov dword [ebp - 0x238], 3
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.00416b36
lea ecx, [ebp - 0x230]
call fcn.00413b5a
mov eax, ebx
call fcn.00429817
ret 0xc
Function at 0x4e9e52
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x4e9fbb
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 8], eax
inc ebx
mov edx, dword [ebp + 0x1c]
mov ecx, eax
cmp dword [esi], edx
je 0x4e9fbb
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edi, word [edx]
cmp bx, di
jae 0x4e9ed1
lea eax, [ecx + 0x2400]
mov edx, 0x3ff
cmp ax, dx
ja 0x4e9fca
mov eax, edi
lea edx, [ecx - 0xdc00]
shl eax, 0xa
or edx, eax
mov cl, byte [ebp - 1]
cmp edx, 0x80
jae 0x4e9ef3
mov bl, dl
xor edi, edi
jmp 0x4e9f23
mov edx, eax
lea eax, [ecx + 0x2800]
mov ecx, 0x3ff
cmp ax, cx
ja 0x4e9ec0
add edx, 0xffff2840
mov cl, bl
shl edx, 0xa
mov byte [ebp - 1], cl
jmp 0x4e9ec3
mov ebx, edx
cmp edx, 0x800
jae 0x4e9f08
shr ebx, 6
xor edi, edi
or bl, 0xc0
inc edi
jmp 0x4e9f23
cmp edx, 0x10000
jae 0x4e9f1a
shr ebx, 0xc
or bl, 0xe0
push 2
jmp 0x4e9f22
shr ebx, 0x12
or bl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 8]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 0xc]
jl 0x4e9fbb
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x4e9f5f
cmp edi, 3
jb 0x4e9f5f
mov ebx, dword [ebp - 0xc]
jmp 0x4e9f68
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
mov ebx, dword [ebp - 0x10]
mov eax, dword [esi]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4e9f90
imul ecx, edi, 6
mov edi, dword [ebp - 8]
sub ecx, 6
mov eax, edx
dec ebx
shr eax, cl
and al, 0x3f
or al, 0x80
mov byte [edi], al
inc dword [esi]
mov eax, dword [esi]
mov dword [ebp - 8], eax
test ebx, ebx
jg 0x4e9f74
xor ebx, ebx
shr edx, 0xa
inc ebx
movzx eax, dx
cmp byte [ebp - 1], 0
mov ecx, ebx
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 8], eax
cmp ecx, dword [ebp + 0x10]
jne 0x4e9e7e
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x4e9fc3

Function at 0x4ef295
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004ef271
pop esi
leave
ret 8
Function at 0x4fdfb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4fdfdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4fdfdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x507b1e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x6c2008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6dd178], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x507c1f
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0042a970
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movsx eax, byte [esi + str._EWID]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
movzx eax, word [ebp - 0x806]
push eax
movzx eax, word [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x80a]
push eax
movzx eax, word [ebp - 0x80c]
push eax
movzx eax, word [ebp - 0x80e]
push eax
movzx eax, word [ebp - 0x812]
push eax
movzx eax, word [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push str._04u__02u__02u__02u:_02u:_02u._03u_T_u___c____s_
push eax
call fcn.0050746b
mov esi, eax
mov edi, 0x800
lea eax, [ebp + 0x14]
mov ecx, edi
push eax
push 0
push dword [ebp + 0x10]
sub ecx, esi
push ecx
lea ecx, [ebp - 0x804]
add ecx, esi
push ecx
call fcn.00420280
add esi, eax
lea ecx, [edi - 2]
add esp, 0x44
mov eax, esi
cmp esi, ecx
cmova eax, ecx
inc esi
mov byte [ebp + eax - 0x804], 0xa
lea eax, [edi - 1]
cmp esi, eax
ja 0x507c0a
mov eax, esi
cmp esi, edi
jae 0x507c2d
mov byte [ebp + eax - 0x804], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004297f5
leave
ret
call fcn.0042a102
int3

Function at 0x50a398
Capabilities:
Get common file path

Disassembly:
push 0x248
mov eax, 0x626f92
call fcn.00429868
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x254], esi
mov ecx, esi
push 0x6825d0
mov dword [ebp - 4], edi
mov dword [ebp - 0x250], edi
call fcn.00420965
push 0x20a
xor ebx, ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 0x21c]
inc ebx
push edi
push eax
mov dword [ebp - 0x250], ebx
call fcn.0042a970
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x50a446
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.0040ad69
lea eax, [ebp - 0x234]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0051c5d0
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.0045934d
lea ecx, [ebp - 0x24c]
call fcn.005031b2
lea ecx, [ebp - 0x234]
call fcn.0050a485
mov eax, esi
call fcn.00429817
ret
Function at 0x5195cc
Capabilities:
Get file version info

Disassembly:
push 0x10c
mov eax, 0x629130
call fcn.00429868
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
call fcn.0051936b
pop ecx
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x114]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x519638
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
jmp 0x5197bf
lea eax, [ebp - 0x110]
push eax
push edi
mov ecx, eax
call fcn.00518a91
push dword [ebp - 0x110]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x519627
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x682610
push dword [ebp - 0x110]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x519627
mov eax, dword [ebp - 0x104]
movzx eax, word [eax + 0x14]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.005073d2
mov eax, dword [ebp - 0x104]
mov byte [ebp - 4], 2
movzx eax, word [eax + 0x16]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.005073d2
mov eax, dword [ebp - 0x104]
mov byte [ebp - 4], 3
movzx eax, word [eax + 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.005073d2
mov eax, dword [ebp - 0x104]
mov byte [ebp - 4], 4
movzx eax, word [eax + 0x12]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.005073d2
mov edi, 0x68345c
mov byte [ebp - 4], 5
push edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0050c472
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
push ecx
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0050c427
push edi
push eax
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 7
push eax
call fcn.0050c472
add esp, 0x44
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 8
push ecx
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0050c427
push edi
push eax
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 9
push eax
call fcn.0050c472
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xa
push ecx
push eax
push esi
call fcn.0050c427
add esp, 0x24
lea ecx, [ebp - 0xa0]
call fcn.005031b2
lea ecx, [ebp - 0xb8]
call fcn.005031b2
lea ecx, [ebp - 0xd0]
call fcn.005031b2
lea ecx, [ebp - 0xe8]
call fcn.005031b2
lea ecx, [ebp - 0x100]
call fcn.005031b2
lea ecx, [ebp - 0x40]
call fcn.005031b2
lea ecx, [ebp - 0x58]
call fcn.005031b2
lea ecx, [ebp - 0x70]
call fcn.005031b2
lea ecx, [ebp - 0x88]
call fcn.005031b2
lea ecx, [ebp - 0x28]
call fcn.0050a485
lea ecx, [ebp - 0x110]
call fcn.00421862
mov eax, esi
call fcn.00429817
ret