joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d9d0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0046a330
push 0x24c
lea eax, [ebp - 0x458]
mov dword [ebp - 0x45c], 0
push 0
push eax
call fcn.0046a330
add esp, 0x18
test edi, edi
je 0x45dbe4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45dbe4
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x45dbe4
push edi
push str._s.
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046982e
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x460], eax
cmp eax, 0xffffffff
je 0x45dbe4
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 2
je 0x45db8b
lea esp, [esp]
mov cx, word [ebp - 0x42e]
mov ax, word [ebp - 0x430]
test cx, cx
jne 0x45dabd
cmp ax, 0x2e
je 0x45db6a
cmp word [ebp - 0x42c], 0
jne 0x45dad6
cmp ax, 0x2e
jne 0x45dad6
cmp cx, ax
je 0x45db6a
lea eax, [ebp - 0x430]
push eax
push edi
push str._s_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046982e
mov eax, dword [ebp - 0x45c]
add esp, 0x14
test al, 1
je 0x45db14
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov eax, dword [ebp - 0x45c]
test al, 0x10
lea eax, [ebp - 0x20c]
je 0x45db2a
push ebx
push eax
call fcn.0045d9d0
add esp, 8
jmp 0x45db6a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
lea eax, [ebp - 0x20c]
push esi
push eax
push str.DeleteFile__s____d
call fcn.0045f4c0
add esp, 0xc
test esi, esi
jne 0x45db64
test ebx, 0x100
je 0x45db64
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045e5d0
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45daa0
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x45c]
test al, 1
je 0x45dba3
and eax, 0xfffffffe
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
push esi
push edi
push str.RemoveDirectory__s____d
call fcn.0045f4c0
add esp, 0xc
test esi, esi
jne 0x45dbd1
test ebx, 0x100
je 0x45dbd1
push esi
push edi
call fcn.0045e5d0
add esp, 8
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046984a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0046984a
mov esp, ebp
pop ebp
ret
Function at 0x45deb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046befa
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push esi
mov edi, eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [eax], 0
jne 0x45df26
push edi
lea eax, [ebp - 0x20c]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0046982e
add esp, 0x14
jmp 0x45df5f
push str..LNK
push eax
call fcn.0046cd59
add esp, 8
test eax, eax
je 0x45df4a
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046984a
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0046befa
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046984a
mov esp, ebp
pop ebp
ret

Function at 0x45df80
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046f1c0
Function at 0x45e190
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x45e262
push 0x20
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x45e239
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x45e20d
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call fcn.0045e4d0
add esp, 0xc
mov edi, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046984a
mov esp, ebp
pop ebp
ret
push str.StopService____ControlService_failed
call fcn.0045f4c0
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046984a
mov esp, ebp
pop ebp
ret
push str.StopService____OpenService_failed
call fcn.0045f4c0
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046984a
mov esp, ebp
pop ebp
ret
push str.StopService____OpenSCManager_failed
call fcn.0045f4c0
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046984a
mov esp, ebp
pop ebp
ret

Function at 0x45e290
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x45e2c7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046984a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45e2b7
push eax
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0046984a
mov esp, ebp
pop ebp
ret
Function at 0x45e4d0
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 0x18]
cmp ebx, 0x3e8
mov dword [ebp + 0x10], eax
mov eax, 0x1388
cmovb ebx, eax
cmp dword [esi + 4], ecx
je 0x45e590
mov eax, 0xcccccccd
mov ecx, 0x2710
mul ebx
push edi
mov edi, edx
shr edi, 3
cmp edi, 0x3e8
jae 0x45e526
mov eax, 0x3e8
jmp 0x45e531
cmp edi, 0x2710
mov eax, edi
cmova eax, ecx
push eax
call fcn.0045d750
add esp, 4
push esi
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45e58c
mov eax, dword [ebp + 0x10]
cmp dword [esi + 0x14], eax
jbe 0x45e56d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x14]
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], ecx
jmp 0x45e57f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
lea eax, [ebx + ebx*2]
sub ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x45e58c
mov eax, dword [ebp + 0xc]
mov ecx, 0x2710
cmp dword [esi + 4], eax
jne 0x45e517
mov ecx, dword [ebp + 0xc]
pop edi
mov eax, dword [esi + 4]
pop esi
pop ebx
cmp eax, ecx
jne 0x45e5af
push str.WaitForServiceToReachState____Success
call fcn.0045f4c0
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
push eax
push str.WaitForServiceToReachState____Failed___CurrentState_d
call fcn.0045f4c0
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x45fb60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45fbb7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x45fbb0
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x45fbb0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0045fbd0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x487854
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0046befa
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret

Function at 0x460190
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x46029a
movzx eax, word [ebx]
test ax, ax
je 0x46029a
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x4601d0
cmp ax, 0x5c
jne 0x4601d2
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4601c4
cmp edi, ebx
je 0x46023a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0046a330
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call fcn.0046f684
add edi, edi
add esp, 0x18
cmp edi, 0x208
jae 0x4602aa
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00460190
add esp, 8
lea ecx, [ebp - 0x414]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x460242
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x460254
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x460270
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046984a
mov esp, ebp
pop ebp
ret
call fcn.0046be1e
int3
Function at 0x460920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4609b9
cmp dword [esi + 4], 0xffffffff
jne 0x4609b9
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x460950
cmp dword [ebp + 0x10], 1
mov eax, dword [0x488db8]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x460983
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x460983
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00463500
add esp, 0x10
test eax, eax
jne 0x4609a3
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00463ab0
add esp, 4
mov dword [esi], eax
mov eax, dword [0x4c423c]
pop edi
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x463640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x46367e
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x463672
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x46368f
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00469ce0
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x463730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x46373e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x463813
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
dec edi
jne 0x463756
pop edi
test esi, esi
je 0x463832
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x497220]
dec esi
jne 0x463817
not eax
pop esi
pop ebp
ret
Function at 0x464340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x18
push edi
mov edi, dword [ebp + 8]
cmp byte [edi], 0
je 0x464375
cmp byte [edi + 1], 0
je 0x46436e
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x46437b
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x4643a0
cmp byte [edi + 1], 0
je 0x464399
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x4643a3
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x4643b2
mov ebx, dword [edi + 0x18]
mov eax, 0xffff
mov dword [ebp - 4], ebx
mov dword [ebp + 8], eax
cmp ebx, eax
jae 0x4643b5
mov dword [ebp + 8], ebx
push esi
push 0x404
call fcn.0046a57b
mov esi, eax
add esp, 4
test esi, esi
jne 0x4643d0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, 4
mov dword [ebp - 0xc], 0
cmp ecx, eax
jbe 0x4644d0
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x18], edx
sub ebx, ecx
mov dword [ebp - 0x14], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x464431
cmp byte [edi + 1], 0
je 0x4644d0
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x464434
mov dword [edi + 0x18], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 8], ebx
je 0x46445c
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x464457
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x10]
jmp 0x464485
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x46446f
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 8], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.00469ce0
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x4644d0
lea eax, [ebx - 3]
test eax, eax
jle 0x4644bf
dec eax
cmp byte [eax + esi], 0x50
jne 0x4644b1
cmp byte [eax + esi + 1], 0x4b
jne 0x4644b1
cmp byte [eax + esi + 2], 5
jne 0x4644b1
cmp byte [eax + esi + 3], 6
je 0x4644b7
test eax, eax
jg 0x464495
jmp 0x4644bf
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jne 0x4644d0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
cmp eax, ecx
jb 0x4643e7
push esi
call fcn.00469753
mov eax, dword [ebp - 0xc]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x47f2e5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a86f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00471721
mov dword [ebp - 0x14], eax
cmp dword [0x4c53d4], esi
jne 0x47f3d8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47f365
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x47f4b8
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x47f4b8
push 0x49d870
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47f4b8
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4c53d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4c53d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4c53dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c53e4], eax
test eax, eax
je 0x47f3d5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c53e0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x47f3fd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47f3f0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x47f412
push 4
pop eax
jmp 0x47f4ba
cmp dword [ebp - 0x14], esi
je 0x47f412
push dword [0x4c53d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x47f3f7
mov eax, dword [0x4c53e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47f470
cmp dword [0x4c53e4], edi
je 0x47f470
push eax
call ebx
push dword [0x4c53e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47f470
test eax, eax
je 0x47f470
call ecx
test eax, eax
je 0x47f465
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x47f465
test byte [ebp - 8], 1
jne 0x47f470
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47f4a0
mov eax, dword [0x4c53d8]
cmp eax, edi
je 0x47f49d
push eax
call ebx
test eax, eax
je 0x47f49d
call eax
mov esi, eax
test esi, esi
je 0x47f49d
mov eax, dword [0x4c53dc]
cmp eax, edi
je 0x47f49d
push eax
call ebx
test eax, eax
je 0x47f49d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c53d4]
call ebx
test eax, eax
je 0x47f4b8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x47f4ba
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046984a
mov esp, ebp
pop ebp
ret
Function at 0x4026bc
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4026f9
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402719
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.0040324c
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x4027e0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40280f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004031e0
jmp 0x40282d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402774
mov edi, eax
test ebx, ebx
je 0x40282d
cmp dword [esi], 0
je 0x40282d
dec ebx
jmp 0x402816
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x405030
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405069
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004031e0
jmp 0x405072
mov eax, ebx
mov edx, esi
call fcn.00403194
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40507c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x40509d
mov al, byte [esp]
jmp 0x40509f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406c44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x406c8c
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.00404c04
jmp 0x406cc0
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.00404c04
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0x406cf0
call fcn.004032b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ce0
lea eax, [ebp - 0x10c]
call fcn.00403100
ret