joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
mov esi, ecx
call fcn.0044ffe4
mov edi, dword [ebp + 0x10]
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x44d309
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
pop ebp
ret 0xc
push ebx
push 0
push eax
call fcn.0044f270
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jbe 0x44d341
jmp 0x44d320
xor edx, edx
mov eax, ecx
div dword [esi + 0x18]
mov eax, dword [esi + 0x14]
inc ecx
mov dl, byte [edx + eax]
mov eax, dword [ebp + 8]
add dl, bl
xor dl, byte [ecx + eax - 1]
mov eax, dword [edi]
mov byte [ecx + eax - 1], dl
cmp ecx, ebx
jb 0x44d320
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x44d940
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44d95f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x18], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x44d9ef
cmp dword [ebp + 8], 0
je 0x44d9ef
push edi
mov edi, dword [0x4971b4]
test edi, edi
jne 0x44d98e
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 8]
mov dword [0x4971b4], edi
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, ecx
div edi
pop edi
mov dword [esi + 0x1c], edx
cmp edx, ecx
jae 0x44d9a3
sub ecx, edx
jmp 0x44d9a8
mov dword [esi + 0x1c], ecx
xor ecx, ecx
mov edx, dword [esi + 0x1c]
mov eax, dword [ebp + 0xc]
add edx, ebx
push edx
push ecx
mov ecx, dword [ebp + 8]
push eax
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x14], eax
test eax, eax
je 0x44d9d3
mov dword [esi + 0x18], ebx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44d9f4
and eax, 0xffff
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80070057
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x44fc3c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x44fc6d
call fcn.00456054
mov dword [eax], esi
call fcn.00456041
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0044fde2
add esp, 0x14
or eax, 0xffffffff
jmp 0x44fca8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x44fc8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00456067
pop ecx
jmp 0x44fc68
test byte [ebp + 0xc], 0x80
je 0x44fc95
and eax, 0xfffffffe
jmp 0x44fc98
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x44fc7b
xor eax, eax
pop esi
pop ebp
ret

Function at 0x44fde2
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x497218]
call fcn.0045bf10
pop ecx
test eax, eax
je 0x44fdfa
pop ebp
jmp eax
push 2
call fcn.0045d6e9
dec ecx
pop ecx
jmp fcn.0044fcba
Function at 0x450718
Capabilities:
Encode data using xor

Disassembly:
retf
mov esp, 0x4b6aa5f7
jb 0x450683
mov edi, 0x8ff48d3c
push cs
shl dword [ecx - 0x26f375cd], 1
mov dl, 0xa9
stosb byte es:[edi], al
int1
mov dword [eax + edi*4], edi
mov dword [edi - 0x5a], ebp
movsb byte es:[edi], byte [esi]
cmp bl, byte [ecx]
lahf
push ss
mov ebx, 0x8a68e69c
or ch, 3
dec ebp
sub dh, ch
add ebx, dword [ebx]
in al, dx
in eax, 0x56
pop edx
or eax, 0x8fba3565
push edx
adc bl, byte [eax - 0x5e4e594]
cwde
insb byte es:[edi], dx
sbb bl, byte [ebx]
cli
sub al, 0xfe
xchg ecx, eax
or ebx, ebx
outsd dx, dword [esi]
mov ecx, 0x1cb8755e
xchg ebp, eax
add dword [edx + eax*8 + 0x5cfb507a], edx
test eax, 0xe2327b0a
xor eax, 0xa3e013b7
loopne 0x4506bd
loopne 0x4506bd
mov dl, 0x23
rcl dword [esp + edi], 0x21
pop edi
les eax, [ebx + 0x67eb8700]
pop esp
lodsb al, byte [esi]
or al, 0xea
xchg edx, eax
stosb byte es:[edi], al
imul ebp, esp, 0xfffffff6
mov cl, ch
sbb dword [eax - 0x5b], ebx
cmp edx, dword [ebx + ebx*4 - 0xd187465]
dec byte [ecx + 0x26]
insd dword es:[edi], dx
cmpsb byte [esi], byte es:[edi]
push esp
sub ecx, dword [eax + 0x3c9512d6]
outsb dx, byte [esi]
jae 0x4506f8
invalid

Function at 0x4626e5
Capabilities:
Encode data using xor

Disassembly:
pushfd
pop ebx
xchg dword [edi + 0x28ed3b4f], ebx
jl 0x46273a
xchg edi, eax
mov dl, 0x90
dec ebx
adc eax, 0xc324eff2
out dx, eax
and al, 0xc3
out dx, eax
and al, 0xc3
xchg ebp, eax
imul edx, dword [edx + 0x5c], 0x57ebbd33
shr dword [ecx - 0x6b], 0x93
xor al, 0xc1
popal
push esi
add ebx, dword [edi]
mov eax, 0xe348abf4
cld
mov byte [0x8ac38d1c], al
inc ebp
or cl, al
sub eax, 0x796ddda2
jb 0x4626d6
ja 0x462790
out dx, eax
in eax, 0x9f
inc edx
mov dh, 0xbe
cwde
adc al, 0xc5
iretd
xchg esp, eax
xchg ebx, eax
not dword [ebp - 0x720a4f50]
fdivr qword [esi + esi + 3]
adc cl, byte [ebx + edx*4 - 0x30dba17d]
les edi, [edx + ebp*8]
outsb dx, byte [esi]
int 0xe8
loope 0x46277d
push edx
and dword [esi + 0x76], esi
in al, dx
outsb dx, byte [esi]
aad 0x6b
xchg eax, eax
or dword [edi - 0x2b7d13be], ebp
sub dword [eax - 0x31b54624], ebp
mov ecx, 0x5b0ac5d1
pop ebp
cld
invalid
push esp
cmp dword [eax - 0x56], esp
jmp 0x462753
jns 0x462781
mov bl, 0x9a
lea ebp, [ebp - 0x6b]
inc esi
mov esi, 0xaaa6b941
movsd dword es:[edi], dword [esi]
mov bl, 0x6a
or eax, 0x96431dfe
mov cl, 0x8c
imul ecx, dword [edx], 0x7613fcf7
pop ss
xor eax, 0x524b2df2
in eax, dx
sub eax, 0xc07e9695
jp 0x46279d
in al, dx
sbb eax, 0xd73ece2
add dword [ecx], edx
dec eax
inc esp
ror dword [0x51a3c8c0], cl
or eax, 0x51a3c8c0
popfd
outsd dx, dword [esi]
push edi
dec esi
adc dword [esi - 0x17], ebx
sbb bh, dl
push ebx
mov dh, byte [eax - 0x77]
test dword [edi + edi*4 + 0x332b2338], esi
rol byte [ebp + 0x2d493c4a], 0xcd
mov esi, 0x29ce7dee
mov dword [esi + 0x14bccc09], ebx
inc eax
mov bh, 0x75
mov ecx, ds
rol byte [ebx + 0xa], cl
mov ecx, 0xba3cebdb
and byte gs:[edx], bl
rcr ah, 0x2a
loope 0x4627c6
add ah, dl
xchg ebx, eax
aas
movsd dword es:[edi], dword [esi]
jmp 0x462794
Function at 0x465083
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4650b4
call fcn.00456054
mov dword [eax], esi
call fcn.00456041
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0044fde2
add esp, 0x14
push 0x16
pop eax
jmp 0x465109
test dword [ebp + 0xc], 0xfffffff9
jne 0x465090
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4650e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00456067
pop ecx
call fcn.00456041
mov eax, dword [eax]
jmp 0x465109
test al, 0x10
jne 0x465107
test al, 1
je 0x465107
test byte [ebp + 0xc], 2
je 0x465107
call fcn.00456054
mov dword [eax], 5
call fcn.00456041
mov dword [eax], 0xd
jmp 0x4650d8
xor eax, eax
pop esi
pop ebp
ret

Function at 0x46732d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045bf07
and dword [ebp - 4], 0
cmp dword [0x497d2c], 0
mov ebx, eax
jne 0x4673de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46748f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x479734
push edi
call esi
test eax, eax
je 0x46748f
push eax
call fcn.0045be95
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x497d2c], eax
call esi
push eax
call fcn.0045be95
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x497d30], eax
call esi
push eax
call fcn.0045be95
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x497d34], eax
call esi
push eax
call fcn.0045be95
pop ecx
mov dword [0x497d3c], eax
test eax, eax
je 0x4673de
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045be95
pop ecx
mov dword [0x497d38], eax
mov eax, dword [0x497d38]
cmp eax, ebx
je 0x467436
cmp dword [0x497d3c], ebx
je 0x467436
push eax
call fcn.0045bf10
push dword [0x497d3c]
mov esi, eax
call fcn.0045bf10
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x467436
test edi, edi
je 0x467436
call esi
test eax, eax
je 0x46742d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46742d
test byte [ebp - 0xc], 1
jne 0x467436
or dword [ebp + 0x10], 0x200000
jmp 0x46746f
mov eax, dword [0x497d30]
cmp eax, ebx
je 0x46746f
push eax
call fcn.0045bf10
pop ecx
test eax, eax
je 0x46746f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46746f
mov eax, dword [0x497d34]
cmp eax, ebx
je 0x46746f
push eax
call fcn.0045bf10
pop ecx
test eax, eax
je 0x46746f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x497d2c]
call fcn.0045bf10
pop ecx
test eax, eax
je 0x46748f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x467491
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46e8b0
Capabilities:
Encode data using xor

Disassembly:
inc edi
inc eax
dec ebx
std
and byte [edx + 0x3b], 0x25
mov ch, 0x5b
mov eax, 0x285081c6
mov eax, 0xe0da7db3
jmp 0x46e8e6
loopne 0x46e8a8
sub byte [eax - 0xb668c3f], ah
cmp ch, byte [edx + 0x76]
call 0x9365350c
outsb dx, byte [esi]
cmc
push 0xd6bd8af8
pop ebx
mov byte [ebx], 0x6e
cmp dword [edi - 0x35], ebp
xor dword [edi + 0x37], ebp
fild word [eax]
mov eax, dword [edx + 0x51]
fdivr st(2)
xchg bh, dh
xlatb
mov ah, ch
std
push edi
sbb ah, byte [edx - 0x10]
ror esp, 0x3e
je 0x46e907
sub bl, cl
jmp 0x4acf5b61
jecxz 0x46e8bb
mov ah, 0xbb
movsb byte es:[edi], byte [esi]
loope 0x46e989
leave
call 0xdec17e1d
lea ebp, [ecx - 0x2901d89f]
rol bh, cl
mov dh, 0xc5
loop 0x46e8c3
invalid
insb byte es:[edi], dx
jns 0x46e978
pushfd
xchg esp, eax
xchg edi, eax
outsb dx, byte [esi]
mov ah, 0x52
lodsd eax, dword [esi]
test edi, esp
dec eax
pop ds
je 0x46e935
sbb cl, byte [edi + ebx*8]
test al, 0xa2
and eax, 0x80ca1fb5
je 0x46e9f6
inc ecx
or dword [edx + 0x1e], esp
fisubr word [edx + 0x10f3090e]
xor dh, byte [esp + ebp*8]
adc byte [edx], dh
xor al, 0xec
scasb al, byte es:[edi]
jle 0x46e964
invalid
invalid
mov edx, 0xcc3e3760
sub eax, 0xe995a5e1
sar byte [edx + 0x381a0512], 0xfb
xor edi, dword [ebp + edi*2 + 0x71357dce]
pop eax
sbb dh, byte [eax + ebp*8]
jecxz 0x46e9ff
jmp 0x559a4c4
in eax, dx
sti
sahf
xor dword [esp + ecx + 0x2f0121e3], ebp
int3

Function at 0x46fdc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x411266
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x411320
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4112c9
push 0x68d9
push 0x7c25
push 0x3e25
push 0x5478
push 0
push 0x680b
push 0x40ad
push 0x10d5
call fcn.0041a7fd
add esp, 0x20
jmp 0x41131e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x411307
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x411305
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x41131e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x41134d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
push 0x46a8
push 0
push 1
push dword [ebp - 0x30]
push 0x517d
push 0x4072
push dword [ebp - 0x34]
call fcn.0040fc10
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4121a8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x412293
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41227b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x412258
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x412239
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x412256
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0042ed1e
mov dword [eax], 1
jmp 0x41222e
jmp 0x412279
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x412279
push 0
push 1
call fcn.00421efc
pop ecx
pop ecx
jmp 0x41228e
push 0
push 1
push 0x1f7b
push 0
call fcn.0042aac0
add esp, 0x10
jmp 0x412355
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x412338
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x41230b
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x412309
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x412336
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
push dword [eax]
mov ecx, dword [ebp - 0x78]
call fcn.0042ed1e
mov dword [eax], 1
jmp 0x412355
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
push 0x2671
push 0
push 0x647c
push dword [ebp - 0x80]
call fcn.0040cfbb
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x415032
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x415117
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4150f4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4150e8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x38]
call fcn.0042ed1e
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x4150da
mov dword [ebp - 4], 1
jmp 0x4150de
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x4150f2
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x415115
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0
push 0x1902
call fcn.00415b8a
add esp, 0x10
jmp 0x41511f
push 0
call fcn.0041d985
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42539f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x42546e
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42543f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42540f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42540d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x42543d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0xffffffff
push 1
mov ecx, dword [ebp - 0x30]
call fcn.0042ed1e
or dword [eax], 0xffffffff
jmp 0x42546c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
push 1
push 0x4f63
push dword [ebp - 0x3c]
push 0x38e4
push 0
push 0x13c3
push dword [ebp - 0x40]
call fcn.0041e1e8
add esp, 0x1c
jmp 0x425493
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x44]
push 0
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.00409fc6
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x425ee6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x425fab
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x425f4e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0xcd9
push dword [ebp - 0x14]
push 0x26df
push 1
push dword [ebp - 0x18]
call fcn.00425fc5
add esp, 0x14
jmp 0x425fa9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x425f92
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x425f90
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x425fa9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x425fc1
push 0x4e15
push 0x35e0
push 1
push 0
call fcn.0041be39
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x426d3e
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x426dca
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x426da6
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x426d7c
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x426da4
push 0x278
push 0xe5d
push 0x1f47
push 0xa98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x426dc8
push 1
push 0x45f8
push 0x7c45
push 0
push 1
push 0x1610
push 0x7866
call fcn.0040eb63
add esp, 0x1c
jmp 0x426dd8
push 0x62ed
push 1
call fcn.00408e17
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x429d52
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x429d8b
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0x216
push 0x6340
push dword [ebp - 0xc]
push 1
call fcn.00429e5e
add esp, 0x14
jmp 0x429e5a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x429e2e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x429e1a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x429e2c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x429e2c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x429e5a
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x54]
push 0
push dword [ebp - 0x58]
push 1
push 0x151e
push 0x68c1
push 1
push 1
call fcn.0040b8d0
add esp, 0x20
mov esp, ebp
pop ebp
ret