joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423774
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x42383f
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42381d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4237c0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x42381b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42381b
push 0x5c3e
push 0x4e9a
push 0
push 0x2a43
push 0x6873
push 0x2f87
push 0x678f
push 0x397
push 0x70c5
push 0
push 0x7acb
push 0x235c
push 0x40aa
push 1
call fcn.0041a8c7
add esp, 0x38
jmp 0x42383d
push 0x7e98
push 0x63c3
push 0x666e
push 0x1fc4
push 1
push 1
call fcn.0041a12f
add esp, 0x18
jmp 0x423853
push 1
push 0x6388
push 0x2c90
call fcn.004092ba
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4247a8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4247c9
push 0x226
push 1
call fcn.004248f4
pop ecx
pop ecx
jmp 0x4248f0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4248de
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x424826
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x424821
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x4248dc
mov dword [ebp - 0x2c], 0xa6318529
mov dword [ebp - 0x30], 0x39beb064
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 0xe90a624c
mov dword [ebp - 0x3c], 0xaeb9ae77
mov dword [ebp - 0x40], 0xed680444
push 3
lea ecx, [ebp - 0x5c]
call fcn.004317a0
mov dword [ebp - 0x44], 0xd9e2a8d3
push 4
lea ecx, [ebp - 0x50]
call fcn.004317a0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.0041af88
add esp, 0x10
push 0x38e
push 0x56a5
push 1
push 0x4a1f
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x85
push 1
push 0x2d5e
push 0x3313
push 1
push 0
push 0x216
push 0x7718
call fcn.0040fdbb
add esp, 0x38
lea eax, [ebp - 0x50]
push eax
push 0
call fcn.00419f6b
pop ecx
pop ecx
lea ecx, [ebp - 0x50]
call fcn.00431872
lea ecx, [ebp - 0x5c]
call fcn.00431872
jmp 0x4248f0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0
call fcn.00419f6b
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4287a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4287f3
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4287d1
push 1
call fcn.00428876
pop ecx
jmp 0x4287f1
push 0
push 0x25d4
push 0x7a54
push 0x7533
push 0x3be3
push 0
call fcn.0042a1e1
add esp, 0x18
jmp 0x428872
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42884e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42883f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and dword [eax], 0
jmp 0x42884c
push 0x5a2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x428872
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x6542
push 0x9ed
push 0x34f9
push 1
push 1
call fcn.004084e8
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x42b0ce
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42b111
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push 1
push 0x7949
push 0x7793
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.0042b18c
add esp, 0x18
jmp 0x42b188
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42b164
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42b14d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x42b162
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
jmp 0x42b188
push 1
push 1
push 0xfd6
push 1
push 0x1d14
push 1
push 0x5c0e
push 0x60bf
call fcn.00417d21
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43c059
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43c139
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43c0f8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43c0ab
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x43c0f6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43c0f6
push 0x79bb
push 0x5ac6
push 0
push 0x7b7f
push 0x942
push 0x4b19
push 0x7b6a
push 0x320e
push 1
push 0
push 1
push 1
call fcn.00438b66
add esp, 0x30
jmp 0x43c137
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0x793f
push 0x1c1b
push 0x2e64
push 0
push 1
push 0x19e0
push 0x4831
push 0x3abb
push 0x62f
push 1
push dword [ebp - 0x24]
push 0x417c
call fcn.00437626
add esp, 0x30
jmp 0x43c15c
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
push 0x4fbd
push 1
call fcn.00436bf7
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43e19c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43e2a4
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43e26d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43e24f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43e230
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x43e24d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0043188e
mov dword [eax], 0x36378284
jmp 0x43e225
jmp 0x43e26b
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x43e26b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x43e2a2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0x267a
push 0x2995
push 0x77f9
push dword [ebp - 0x44]
push 1
push 0
push 1
push 0x45fa
push 0x441a
push 0x31df
call fcn.0043b08a
add esp, 0x28
jmp 0x43e2bf
push 0x17
push 0
push 0x52ca
push 0x49d
push 0x4b1b
call fcn.004369e2
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43ef58
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43f06d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43f020
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43f007
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x40]
mov eax, dword [eax + 0x18]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
jmp 0x43f01e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x43f06b
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x43f05e
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x43f05c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x43f06b
push 0x5a2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x43f0c4
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x43f0b2
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
push 1
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push 0x3187
call fcn.00437bfc
add esp, 0x10
jmp 0x43f0c4
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
push 0
push dword [ebp - 0x80]
call fcn.0043ad22
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x442d55
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x442d7a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
push 1
call fcn.0044a1da
add esp, 0xc
jmp 0x442dcf
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x442db9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x442da8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x442db7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x442dcf
push 0x4114
push 0x2581
push 1
push 1
call fcn.0043657e
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x442f21
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x442f5c
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
push 1
push 1
push 0x6cb3
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push 0x41c
push 0x26ae
call fcn.00443083
add esp, 0x18
jmp 0x44307f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x442fec
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x442fcb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x442fe7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x442fe7
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x44307f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x443034
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 1
mov ecx, dword [ebp - 0x58]
call fcn.0043188e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x44307f
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x443062
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x44307f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x6c]
call fcn.0043188e
mov dword [eax], 0xdf99ff60
jmp 0x443057
mov esp, ebp
pop ebp
ret
Function at 0x443592
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4436df
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44365a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x443641
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x44360e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jg 0x44363f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44363d
push 0x4128
push 0
push 0x1799
push 0
push 0xdeb
call fcn.0044710b
add esp, 0x14
jmp 0x443603
jmp 0x443655
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x443655
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x4436dd
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4436c0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4436a4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x4436be
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.0043188e
and dword [eax], 0
jmp 0x443699
jmp 0x4436dd
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x4436dd
push 0
push 0
push 0x1f76
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x443717
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x4c], eax
push 0x6c63
push 0x604
push 0x3f95
push 0x49c3
push dword [ebp - 0x4c]
push 0x3787
push 0x46bf
push 0
push 0x2bf3
push 1
call fcn.00435a36
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x4469da
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x446b4b
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x446a65
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x446a47
mov byte [ebp - 1], 0
push 0x1019
push 0x77c0
push 1
lea eax, [ebp - 1]
push eax
push 0x57e1
push 1
push 1
push 1
call fcn.0043ae4f
add esp, 0x20
jmp 0x446a60
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x446a60
push 0x5a2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x446b49
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x446a8a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x446b49
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x446aac
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jg 0x446b49
push 4
lea ecx, [ebp - 0x54]
call fcn.004317a0
push 0xf82
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x2224
push 0
call fcn.004474ae
add esp, 0x18
push 3
lea ecx, [ebp - 0x54]
call fcn.0043188e
and dword [eax], 0
jmp 0x446b07
push 3
lea ecx, [ebp - 0x54]
call fcn.0043188e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x54]
call fcn.0043188e
cmp dword [eax], 1
jg 0x446b3c
push 0
push 0x3ff5
push 1
push 0
push 0x1575
push 0x659e
push 0xf
push 0x1f2a
call fcn.004482e3
add esp, 0x20
jmp 0x446aef
lea ecx, [ebp - 0x54]
call fcn.00431872
jmp 0x446aa1
jmp 0x446b99
lea eax, [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 1
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
push 0x7c71
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x8b6
call fcn.004423f3
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x44ca17
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x44cadb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44cab9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44cab1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44ca95
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x44caaf
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0043188e
and dword [eax], 0
jmp 0x44ca8a
jmp 0x44cab7
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x44cad9
push 0x6292
push 1
push 1
push 0x1888
push 0x40e0
push 0x5bd0
call fcn.00436b17
add esp, 0x18
jmp 0x44cafc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push 0x1b4e
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 1
call fcn.004371f1
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4882c3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret