joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100022b0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100020f0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1000237b
mov dword [ebp - 4], 0
jmp 0x1000230c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x1000237b
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100044c1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10002379
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100044c1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10001f10
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100044c1
jmp 0x10002303
pop esi
add esp, 8
cmp ebp, esp
call fcn.100044c1
mov esp, ebp
pop ebp
ret

Function at 0x10002390
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1000243b
mov dword [ebp - 4], 0
jmp 0x100023c3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1000241e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100044c1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000241c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100044c1
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100044c1
jmp 0x100023ba
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x10008404]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100044c1
pop esi
add esp, 8
cmp ebp, esp
call fcn.100044c1
mov esp, ebp
pop ebp
ret
Function at 0x10002450
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x100087a0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100024b3
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100044c1
test eax, eax
jne 0x100024de
mov eax, 0xa
jmp 0x100025e0
cmp dword [ebp + 0xc], 0
je 0x1000252a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x10002528
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x10002566
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10002551
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x10002566
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100044c1
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100044c1
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100044c1
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10002604]
call fcn.1000446d
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100044c1
mov esp, ebp
pop ebp
ret
Function at 0x10002cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x10008790]
mov dword [ebp - 4], eax
jmp 0x10002cf7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10002d10
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10002d0e
mov eax, dword [ebp - 4]
jmp 0x10002d94
jmp 0x10002cef
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100044c1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10002d91
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x10002d53
mov edx, dword [ebp - 4]
mov eax, dword [0x10008790]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10008790], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100044c1
mov esp, ebp
pop ebp
ret

Function at 0x10003280
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100032d0
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100032d0
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100032d0
xor eax, eax
jmp 0x10003311
mov dword [ebp - 4], 1
jmp 0x100032e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000330c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1000330a
xor eax, eax
jmp 0x10003311
jmp 0x100032d9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401eb1
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x401ecd
push 0
call fcn.0040a40b
pop ecx
jmp 0x40201b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x401f24
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x401f1f
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40201b
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
push 3
mov ecx, dword [ebp - 0x18]
call fcn.00401484
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x401f7b
mov dword [ebp - 0x14], 1
jmp 0x401f7f
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jbe 0x401f90
mov dword [ebp - 0xc], 1
jmp 0x401f94
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jne 0x401fa7
mov dword [ebp - 0x10], 1
jmp 0x401fab
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx]
mov esi, eax
imul esi, dword [ebp - 0x14]
push 3
mov ecx, dword [ebp - 0x18]
call fcn.00401484
cmp esi, dword [eax]
jl 0x401fd5
mov dword [ebp - 0x1c], 1
jmp 0x401fd9
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0x9ed080c1
jbe 0x401feb
mov dword [ebp - 0x20], 1
jmp 0x401fef
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
je 0x402002
mov dword [ebp - 8], 1
jmp 0x402006
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x150790db
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40feb1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x40ff38
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x40fef4
push 0
push 0x152b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x40ff36
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
push dword [eax]
push 0x1fe7
push 0
push 0
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
push dword [eax]
call fcn.0040289a
add esp, 0x18
jmp 0x40ff52
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
xor cl, cl
call fcn.00401190
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40ff89
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41001f
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x40ffcf
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40ffcd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x41001a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x40fffd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x41001a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.00401484
mov dword [eax], 0x28ea388
jmp 0x40fff2
jmp 0x4100f0
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41006e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x410069
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x4100f0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x54]
push 0x5ba4
mov eax, dword [ebp - 0x58]
push dword [eax]
push 0x3f2
push 1
push 0x229a
push 0x6490
push 0
mov eax, dword [ebp - 0x5c]
push dword [eax]
push 0
mov eax, dword [ebp - 0x60]
push dword [eax]
push 0x5637
push 0x47c0
push 0x78c3
push 0x5c9
push 0x6718
push 0xd29
call fcn.0040f288
add esp, 0x44
mov esp, ebp
pop ebp
ret

Function at 0x411942
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x41194a
mov eax, esi
pop esi
ret
Function at 0x421692
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x18], 0
push ebx
push edi
mov ebx, edx
mov edi, ecx
je 0x421728
cmp byte [ebp + 0x10], 0
je 0x421717
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x4216d9
mov eax, dword [esi]
mov ecx, dword [esi]
add eax, 0x8068
imul ecx, eax
sub ecx, 0x478c9dff
mov dword [ebx], ecx
mov eax, dword [ebx]
mov dword [edx], 1
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [edx]
mov eax, dword [edx]
xor ecx, ecx
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [edi]
mov edx, dword [edi]
mov eax, dword [edi]
imul edx, eax
mov eax, dword [edi]
cmp edx, eax
mov eax, dword [esi]
pop esi
setl cl
xor edx, edx
cmp ecx, 0xffffffff
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x14]
setle cl
xor edx, edx
test ecx, ecx
setns dl
mov dword [eax], edx
jmp 0x421737
push 0
push 0x659
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x421737
push 0x23ff
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
pop edi
pop ebx
pop ebp
ret
Function at 0x42ac1c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x42acc5
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42ac78
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42ac76
push 0x3b36
push 0x13db
push 0x3672
push 0x4290
push 1
push 0
call fcn.00429eb4
add esp, 0x18
jmp 0x42acc3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x42aca6
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x42acc3
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.00401484
mov dword [eax], 1
jmp 0x42ac9b
jmp 0x42ad08
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42acec
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x42ad08
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42ad08
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x43421d
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4342a5
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x434274
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x434272
push 0x72d5
push 0x7886
push 0x6379
push 1
push 1
push 0x4e8a
push 0x5e1a
call fcn.004328cd
add esp, 0x1c
jmp 0x4342a3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4342a3
push 0
push 0x4941
push 0x1b35
push 0x655c
call fcn.0043f85a
add esp, 0x10
jmp 0x434313
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43430b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4342ef
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x434309
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00401484
or dword [eax], 0xffffffff
jmp 0x4342e4
jmp 0x434313
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x44f9cb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x10], 0x36173948
mov dword [ebp - 0x14], 6
push 1
lea ecx, [ebp - 0x3c]
call fcn.004113a6
mov dword [ebp - 0x18], 0x703c5764
push 3
lea ecx, [ebp - 0x30]
call fcn.004113a6
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x20], 0x36a5b5cf
mov dword [ebp - 0x24], 0x26cdee94
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jmp 0x44fa26
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x44fa3f
push dword [ebp - 8]
lea ecx, [ebp - 0x3c]
call fcn.00401484
mov dword [eax], 0x28ea388
jmp 0x44fa1f
mov dword [ebp - 8], 0
jmp 0x44fa4f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x44fa65
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
call fcn.00401484
and dword [eax], 0
jmp 0x44fa48
mov dword [ebp - 8], 0
jmp 0x44fa75
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x44fa88
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x48], 0
jmp 0x44fa6e
mov dword [ebp - 0xc], 1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44faa5
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [ebp - 0x30]
call fcn.00411478
lea ecx, [ebp - 0x3c]
call fcn.00411478
push 0
push dword [ebp + 0x14]
push 0x488f
push 0x7ac0
push 1
push dword [ebp + 8]
push 0x6748
push 0x3b4b
push dword [ebp + 0x20]
push 0x7415
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push 0x3577
push dword [ebp + 0x18]
push 0x6c48
push dword [ebp + 0xc]
call fcn.00454fc3
add esp, 0x40
mov esp, ebp
pop ebp
ret
Function at 0x45a37b
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
mov byte [ebp - 4], dl
je 0x45a3a7
test dl, dl
je 0x45a398
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
jne 0x45a3ad
jmp 0x45a3c7
mov eax, dword [ecx]
test eax, eax
jns 0x45a3c7
add eax, 0x100
js 0x45a39e
jmp 0x45a3c5
cmp byte [ebp + 0x10], 0
je 0x45a3b5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x45a3c7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
jns 0x45a3c7
add eax, 0x100
js 0x45a3be
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x45cce7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 8], 0
mov byte [ebp - 4], dl
je 0x45cd22
mov byte [ebp - 8], 1
mov byte [ebp - 0xc], 1
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x45cd45
push 1
push 0x3ef0
push 0
mov dl, 1
mov ecx, 0x1887
call fcn.0045a37b
add esp, 0xc
jmp 0x45cd45
test dl, dl
je 0x45cd3c
cmp byte [ecx], 0
je 0x45cd45
push 0x23ff
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x45cd45
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x21
mov esp, ebp
pop ebp
ret

Function at 0x45ed6b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
push esi
mov esi, ecx
je 0x45edad
cmp byte [ebp + 0x1c], 0
je 0x45ed9f
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x45edd6
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 3
jl 0x45ed8e
jmp 0x45edd6
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [eax + 0xc], 0xa9ef72d4
jmp 0x45edd6
cmp byte [ebp + 8], 0
je 0x45edc9
push 0x588
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x45edd6
mov eax, dword [edx]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x20]
add ecx, dword [eax]
mov eax, dword [esi]
mov dword [eax], ecx
pop esi
pop ebp
ret

Function at 0x45ee8b
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
mov byte [ebp - 4], cl
je 0x45eec9
test cl, cl
je 0x45eeb7
push 0
push 0x1d86
push 0x68f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x45eef7
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x45eef7
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x45eef7
cmp byte [ebp + 8], 0
je 0x45eeef
push 0x5fc
push 0x2228
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
jmp 0x45eef7
mov eax, dword [edx]
mov eax, dword [eax]
and dword [eax + 0xc], 0
mov esp, ebp
pop ebp
ret

Function at 0x45f119
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x45f136
push 0x588
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop ebp
ret
mov eax, dword [ecx]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
add ecx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax], ecx
pop ebp
ret