joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
not ebx
not ecx
mov eax, ecx
mov dword [ebp - 8], ebx
sub edx, 1
mov edi, edx
test edi, edi
jl 0x404cbc
mov edx, 0xffffffff
lea esi, [esi]
add edx, 1
mov ecx, eax
and ecx, 0xff
mov esi, dword [ebp - 4]
movzx ebx, byte [esi]
xor ecx, ebx
mov ebx, eax
mov esi, dword [ebp - 8]
shrd ebx, esi, 8
shr esi, 8
xor ebx, dword [ecx*8 + 0x4e72b0]
xor esi, dword [ecx*8 + 0x4e72b4]
mov eax, ebx
mov dword [ebp - 8], esi
add dword [ebp - 4], 1
cmp edi, edx
jg 0x404c80
mov esi, esi
mov edx, dword [ebp - 8]
not edx
not eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
mov edi, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
mov eax, esi
sar eax, 0x1f
mov ebx, 0
add esi, ecx
adc eax, ebx
mov ecx, esi
not eax
not ecx
mov dword [ebp - 8], ecx
lea ecx, [edx - 1]
test ecx, ecx
jl 0x404d4c
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov bl, byte [edi]
movzx edx, bl
add edx, dword [ebp - 8]
and edx, 0xff
mov esi, dword [ebp - 4]
mov dl, byte [esi + edx + 4]
mov byte [edi], dl
mov dl, byte [ebp - 8]
xor dl, bl
and edx, 0xff
mov esi, dword [ebp - 8]
shr esi, 8
xor esi, dword [edx*4 + 0x4e6eb0]
mov dword [ebp - 8], esi
add edi, 1
cmp ecx, eax
jg 0x404d10
mov eax, dword [ebp - 8]
not eax
mov edx, dword [ebp - 4]
sub eax, dword [edx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x404d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
mov edi, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
mov eax, esi
sar eax, 0x1f
mov ebx, 0
add esi, ecx
adc eax, ebx
mov ecx, esi
not eax
not ecx
mov dword [ebp - 8], ecx
lea ecx, [edx - 1]
test ecx, ecx
jl 0x404de0
mov ebx, 0xffffffff
lea esi, [esi]
add ebx, 1
movzx eax, byte [edi]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax + 0x104]
movzx edx, byte [ebp - 8]
sub eax, edx
mov byte [ebp - 0xc], al
mov byte [edi], al
mov al, byte [ebp - 8]
xor al, byte [ebp - 0xc]
and eax, 0xff
mov edx, dword [ebp - 8]
shr edx, 8
xor edx, dword [eax*4 + 0x4e6eb0]
mov dword [ebp - 8], edx
add edi, 1
cmp ecx, ebx
jg 0x404da0
mov esi, esi
mov eax, dword [ebp - 8]
not eax
mov edx, dword [ebp - 4]
sub eax, dword [edx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edi, edx
mov eax, dword [ebp - 4]
mov esi, dword [eax]
mov eax, esi
sar eax, 0x1f
mov edx, 0
add esi, ebx
adc eax, edx
mov edx, esi
not eax
not edx
mov dword [ebp - 0xc], edx
sub ecx, 1
test ecx, ecx
jl 0x404e84
mov ebx, 0xffffffff
add ebx, 1
mov eax, dword [ebp - 8]
movzx esi, byte [eax]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + esi + 0x104]
movzx edx, byte [ebp - 0xc]
sub eax, edx
mov byte [ebp - 0x10], al
mov byte [edi], al
mov al, byte [ebp - 0xc]
xor al, byte [ebp - 0x10]
movzx edx, al
mov eax, dword [ebp - 0xc]
shr eax, 8
xor eax, dword [edx*4 + 0x4e6eb0]
mov dword [ebp - 0xc], eax
add dword [ebp - 8], 1
add edi, 1
cmp ecx, ebx
jg 0x404e40
nop
mov eax, dword [ebp - 0xc]
not eax
mov edx, dword [ebp - 4]
sub eax, dword [edx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405a80
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x5c], 0
lea eax, [ebx + 0x1c]
xor cl, cl
mov edx, 0x40
call fcn.00447800
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
ret
Function at 0x40f820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x40f848
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x40f946
mov esi, esi
xor eax, eax
push 0x40f927
push ebp
push 0x458ea0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push 0x400000
mov eax, dword [ebp - 0xc]
mov cl, 1
xor edx, edx
call fcn.0047ecf0
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 0x134], edx
call fcn.00402590
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x138], eax
mov dword [ecx + 0x13c], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x138]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0x13c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x130], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x13]
mov byte [edx + 0x158], al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x159], 0
mov eax, dword [ebp - 0xc]
call fcn.0047ee50
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x40f91c
cmp dword [ebp - 8], 0
je 0x40f91c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x40f946
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x452b00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4e8f80], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x4e8f7c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x4e8f80], edx
cmp eax, 0x26f
jl 0x452b08
mov dword [0x4ab2a0], 0x270
ret

Function at 0x452b40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x4e8f84]
mov ebx, dword [eax*4 + 0x4e8f80]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x4e95b4]
mov dword [eax*4 + 0x4e8f80], edx
cmp eax, 0xe2
jl 0x452b48
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x4e8f84]
mov ebx, dword [eax*4 + 0x4e8f80]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x4e8bf4]
mov dword [eax*4 + 0x4e8f80], edx
cmp eax, 0x26e
jl 0x452b98
mov edx, dword [0x4e8f80]
mov ecx, dword [0x4e993c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x4e95b0]
mov dword [0x4e993c], eax
mov dword [0x4ab2a0], 0
pop ebx
ret

Function at 0x452c20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x4ab2a0]
add dword [0x4ab2a0], 1
mov eax, dword [0x4e7b20]
cmp eax, dword [0x4aa9f0]
jne 0x452c43
cmp ebx, 0x271
jb 0x452c64
mov eax, dword [0x4e7b20]
call fcn.00452b00
not dword [0x4e7b20]
mov eax, dword [0x4e7b20]
mov dword [0x4aa9f0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x452c80
call fcn.00452b40
xor ebx, ebx
mov dword [0x4ab2a0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x4e8f80]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x454730
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x4aa730]
cmp ax, 0xcb
je 0x45483c
cmp ax, 0xcc
je 0x45483c
lea esi, [esi]
mov edx, dword [0x4e9b80]
test edx, edx
je 0x454765
mov eax, dword [0x4e9a30]
call edx
mov ebx, eax
jmp 0x45476a
mov ebx, 0x4e9a34
cmp word [0x4e9a20], 0
jle 0x454790
mov eax, 0x4e9a00
call fcn.004549f0
mov eax, ebx
call fcn.004542f0
mov eax, ebx
call fcn.00454360
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x4547b2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4547ad
mov edx, edi
mov eax, ebx
call fcn.00453760
jmp 0x4547b0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x454798
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x4e9a20], 0
jle 0x45483c
mov edx, 0x4e9940
mov eax, ebx
call fcn.004538a0
mov edi, eax
test edi, edi
je 0x45480c
mov eax, dword [0x4e99d4]
mov dword [edi + 0xc], eax
cmp dword [0x4e99d4], 0
je 0x454800
mov eax, dword [0x4e99d4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x4e99d4], eax
nop
sub word [0x4e9a20], 1
cmp word [0x4e9a20], 0
sete bl
mov eax, 0x4e9a00
call fcn.00454a10
test bl, bl
je 0x45483c
mov eax, 0x4e9a00
call fcn.004549e0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x457480
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00457470
push ebp
push 0x458b20
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, esi
test esi, esi
jne 0x4574b9
mov eax, 0x4e8e00
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
lea edx, [ebx - 1]
lea eax, [ebp - 0xc]
call fcn.0044f340
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4574dc
mov eax, 0x4e8e00
push eax
push ebx
mov eax, esi
test esi, esi
jne 0x4574e9
mov eax, 0x4e8e00
push eax
call sub.kernel32.dll_GetFullPathNameW
mov edx, eax
test edx, edx
je 0x4575ae
jmp 0x457503
sub edx, 1
cmp edx, 3
jbe 0x457514
mov eax, dword [ebp - 0xc]
cmp word [eax + edx*2 - 2], 0x5c
je 0x457500
mov eax, ebx
mov edi, 0
sub eax, 1
sbb edi, 0
mov ecx, edx
xor ebx, ebx
cmp edi, ebx
jne 0x45752d
cmp eax, ecx
je 0x457538
lea eax, [ebp - 0xc]
call fcn.0044f340
lea esi, [esi]
mov eax, 0x401200
mov edx, dword [ebp - 0xc]
call fcn.004573f0
mov edx, dword [0x4e9b80]
test edx, edx
je 0x457558
mov eax, dword [0x4e8c60]
call edx
jmp 0x45755d
mov eax, 0x4e8c64
cmp word [eax], 0
jne 0x4575ba
mov eax, esi
test esi, esi
je 0x45756d
mov eax, dword [eax - 4]
cmp eax, 2
jle 0x4575ba
cmp word [esi + 2], 0x3a
jne 0x4575ba
mov word [ebp - 8], 0x3d
mov ax, word [esi]
mov word [ebp - 6], ax
mov word [ebp - 4], 0x3a
mov word [ebp - 2], 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x45759f
mov eax, 0x4e8e00
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_SetEnvironmentVariableW
lea esi, [esi]
jmp 0x4575ba
mov eax, 0x401200
mov edx, esi
call fcn.004573f0
mov edx, dword [0x4e9b80]
test edx, edx
je 0x4575cd
mov eax, dword [0x4e8c60]
call edx
jmp 0x4575d2
mov eax, 0x4e8c64
cmp word [eax], 2
jne 0x4575f8
mov edx, dword [0x4e9b80]
test edx, edx
je 0x4575ec
mov eax, dword [0x4e8c60]
call edx
jmp 0x4575f1
mov eax, 0x4e8c64
mov word [eax], 3
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00457470
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00457610
push ebp
push 0x458b20
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x45775a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0044f340
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x4576bf
mov edx, 0x4e8e00
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x457711
call sub.kernel32.dll_GetLastError
call fcn.00448220
lea eax, [ebp - 0x10]
call fcn.0044e100
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0044e5a0
mov edx, dword [ebp - 0x14]
mov ecx, 0x4d0648
lea eax, [ebp - 0x10]
call fcn.0044e430
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0044ece0
jmp 0x4577a8
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x45772a
cmp eax, ecx
je 0x457734
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0044f340
cmp byte [0x4aa9b0], 0
jne 0x4577a8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0044f890
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0044ed20
lea esi, [esi]
jmp 0x4577a8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0044f340
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x45777e
mov eax, 0x4e8e00
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x4aa9b0], 0
jne 0x4577a8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0044f890
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0044ed20
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00457610
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457ca0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x4e8d60], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00457e80
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x4e8d60]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004477c0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4aa7b0], eax
mov ebx, eax
jmp 0x457e43
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x457d28
cmp byte [ebx], 0
je 0x457e4c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x457da3
mov al, byte [ebx]
cmp al, 1
jb 0x457d98
sub al, 0x20
jbe 0x457d68
sub al, 2
je 0x457d7c
jmp 0x457d98
mov al, byte [ebp - 0x114]
test al, al
je 0x457da8
add dword [ebp - 0x110], 1
jmp 0x457da0
cmp byte [ebx + 1], 0x22
je 0x457d93
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x457da0
add ebx, 1
jmp 0x457da0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x457d58
test dword [ebp - 0x10c], 0xffffffff
je 0x457e3c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00457e80
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x4e8d60]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x457e33
mov al, byte [ebx]
cmp al, 1
jb 0x457e28
sub al, 0x20
jbe 0x457df8
sub al, 2
je 0x457e0c
jmp 0x457e28
mov al, byte [ebp - 0x114]
test al, al
je 0x457e38
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x457e30
cmp byte [ebx + 1], 0x22
je 0x457e23
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x457e30
add ebx, 1
jmp 0x457e30
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x457de8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x457d2b
mov ebx, dword [ebp - 0x10c]
mov dword [0x4e8d50], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x4e8d60
call fcn.00454570
mov eax, dword [0x4e8d60]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x45b73b
jmp 0x45b748
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x45b750
jmp 0x45b758
jmp 0x45b806
xor eax, eax
push 0x45b7e3
push ebp
push 0x458ea0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
jne 0x45b78e
jmp 0x45b7b4
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00479290
mov esi, esi
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x45b7c3
jmp 0x45b7d8
cmp dword [ebp - 8], 0
jne 0x45b7cb
jmp 0x45b7d8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x45b806
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x472ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x4d5638
lea eax, [ebp - 0x268]
call fcn.004523f0
xor eax, eax
push fcn.00472ec0
push ebp
push 0x458b20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x472f23
mov eax, 0x4e8e00
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x472f6b
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x472f3f
clc
jmp 0x472f46
bt dword [0x4d4c68], eax
jb 0x472f5f
mov eax, ebp
call fcn.00473010
test al, al
je 0x472f5f
mov byte [ebp - 0x26c], 1
jmp 0x472ff0
mov byte [ebp - 0x26c], 0
jmp 0x472ff0
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x4abf20]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x472ff0
and esi, 0x400
je 0x472ff0
lea ebx, [ebp - 0x268]
mov edx, 0x4d5638
mov eax, ebx
call fcn.004524b0
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.00472b80
test eax, eax
je 0x472fc4
sub eax, 1
je 0x472fdc
jmp 0x472fe8
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00472ee0
mov byte [ebp - 0x26c], al
jmp 0x472ff0
mov byte [ebp - 0x26c], 1
jmp 0x472ff0
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00472ec0
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473310
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x47331c
mov eax, 0x4e8e00
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x473330
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
test eax, eax
jne 0x47333e
mov eax, 0x4e8e00
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x47334c
xor ebx, ebx
jmp 0x473353
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4733e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.004733d0
push ebp
push 0x458b20
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x473450
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0044f340
cmp ebx, 1
jle 0x473440
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0044ebc0
jmp 0x47345b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0044c930
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004733d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x473860
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00473850
push ebp
push 0x458b20
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x4ea2dc]
xor edx, edx
call fcn.0044c930
mov dword [ebx*4 + 0x4ea2fc], 0xffffffff
cmp ebx, 7
jl 0x473888
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x473914
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.0044d320
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.00469a30
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x473914
push 4
push ebx
push esi
mov eax, 0x473730
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x4737c0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00473850
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473f30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
call sub.kernel32.dll_GetEnvironmentStringsA
mov ebx, eax
mov edi, ebx
test edi, edi
je 0x473f60
jmp 0x473f59
add esi, 1
mov eax, edi
call fcn.004488f0
add eax, edi
add eax, 1
mov edi, eax
cmp byte [edi], 0
jne 0x473f48
mov esi, esi
push ebx
call sub.kernel32.dll_FreeEnvironmentStringsA
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473f70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 4], edx
mov eax, edx
xor edx, edx
call fcn.0044c930
call sub.kernel32.dll_GetEnvironmentStringsA
mov edi, eax
mov ebx, edi
test ebx, ebx
je 0x473fd4
jmp 0x473fa9
sub esi, 1
mov eax, ebx
call fcn.004488f0
add eax, ebx
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
je 0x473fb3
cmp esi, 1
jg 0x473f98
cmp byte [ebx], 0
je 0x473fd4
mov ecx, dword [ebp - 4]
mov eax, ebx
xor dx, dx
call fcn.0044d280
mov eax, dword [ebp - 4]
xor cl, cl
mov dx, 1
call fcn.0044df80
nop
mov eax, edi
push eax
call sub.kernel32.dll_FreeEnvironmentStringsA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret