joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54be14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005713c0
add esp, 0xc
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x1c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x54be52
xor eax, eax
jmp 0x54beaa
push esi
push str.TencentQQBrowserUser_DataDefault_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005a1b75
push 1
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push str.preferences
push eax
call fcn.0054bc68
push edi
mov esi, eax
lea eax, [ebp - 4]
push 2
push eax
lea eax, [ebp - 0x20c]
push str.bookmarks
push eax
call fcn.0054bc68
sub esi, 2
add esp, 0x34
add eax, esi
neg eax
sbb eax, eax
inc eax
pop esi
pop edi
leave
ret

Function at 0x54c13e
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x54c153
xor eax, eax
jmp 0x54c284
push ebx
push esi
push edi
lea ecx, [ebp - 0x3c]
call fcn.00408981
mov esi, 0x5e39b0
push esi
call fcn.0057bbea
pop ecx
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.004092f8
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x54c278
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 8], eax
test eax, eax
je 0x54c1b4
inc eax
push eax
mov dword [ebp + 8], eax
call fcn.005a1c68
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x54c1c0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x54c278
push dword [ebp + 8]
push esi
push ebx
call fcn.005713c0
add esp, 0xc
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x54c1ed
push ebx
call fcn.0057becd
pop ecx
jmp 0x54c1b4
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
lea ecx, [ebp - 0x24]
call fcn.0043e7a7
push ebx
call fcn.0057becd
cmp byte [ebp + 0xc], 0
pop ecx
je 0x54c214
lea eax, [ebp - 0x24]
push eax
call fcn.0054b363
pop ecx
lea eax, [ebp - 0x24]
push eax
call fcn.0045c31d
pop ecx
test al, al
je 0x54c270
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
push esi
cmovae eax, dword [ebp - 0x3c]
push esi
push 2
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x54c270
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0xc]
push esi
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
cmovae ecx, dword [ebp - 0x24]
inc eax
push eax
push ecx
push edi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x24]
call fcn.00403812
lea ecx, [ebp - 0x3c]
call fcn.00403730
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret
Function at 0x54c508
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push edi
mov edi, ecx
call fcn.0054c737
mov ecx, dword [edi + 0x5c]
test ecx, ecx
je 0x54c61a
cmp dword [ebp + 0xc], 0xffffffff
jne 0x54c53d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x54c532
mov eax, dword [eax]
push eax
call ecx
pop ecx
xor eax, eax
jmp 0x54c627
push ebx
push esi
push 0x1c
call fcn.00413631
mov ebx, eax
xor esi, esi
pop ecx
test ebx, ebx
je 0x54c55e
mov dword [ebx + 4], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], 7
jmp 0x54c560
mov ebx, esi
push dword [ebp + 8]
mov eax, dword [edi + 0x5c]
mov dword [ebx], eax
lea eax, [edi + 0x18]
push 0x613908
push eax
lea eax, [ebp - 0x48]
push 0x60a05c
push eax
call fcn.00459df8
add esp, 0xc
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044c782
add esp, 0xc
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004bd62c
add esp, 0xc
lea ecx, [ebx + 4]
push eax
call fcn.004443e3
lea ecx, [ebp - 0x18]
call fcn.00403730
lea ecx, [ebp - 0x30]
call fcn.00403730
lea ecx, [ebp - 0x48]
call fcn.00403730
push esi
push esi
push ebx
push 0x54c66a
push esi
push esi
call fcn.00592655
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x54c614
cmp ebx, 0xffffffff
je 0x54c614
cmp dword [ebp + 0xc], 0
je 0x54c609
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x54c611
cmp eax, 0x102
je 0x54c5ff
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
jmp 0x54c614
push ebx
mov ecx, edi
call fcn.0054c4de
jmp 0x54c614
push ebx
mov ecx, edi
call fcn.0054c4de
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebx
jmp 0x54c627
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0054c62c
pop edi
leave
ret 8

Function at 0x54c7e6
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x44]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x34]
cmp ebx, eax
je 0x54c82a
mov esi, eax
mov edi, dword [ebx]
push 0x1d4c0
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
add ebx, 4
cmp ebx, esi
jne 0x54c809
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x54dccb
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa78
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x54dce2
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x54dedd
push ebx
push edi
lea eax, [ebp + 8]
xor edi, edi
push eax
push 0x5e4bd4
inc edi
xor ebx, ebx
push edi
push ebx
push 0x5e93bc
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov eax, dword [ebp + 8]
js 0x54decd
test eax, eax
je 0x54decd
lea edx, [ebp - 4]
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
push edx
push 0x60a0b4
push eax
call dword [ecx]
mov ecx, dword [ebp - 4]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x54debc
cmp dword [esi + 0x14], 8
jb 0x54dd52
mov esi, dword [esi]
mov eax, dword [ecx]
push 2
push esi
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x54deb9
mov esi, 0x208
lea eax, [ebp - 0x210]
push esi
push ebx
push eax
call fcn.005713c0
push 0x250
lea eax, [ebp - 0xa78]
push ebx
push eax
call fcn.005713c0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xa78]
add esp, 0x18
mov ecx, dword [eax]
push 6
push edx
push 0x104
lea edx, [ebp - 0x210]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x54deb9
push esi
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.005713c0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x418]
add esp, 0xc
mov ecx, dword [eax]
push 0x104
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x54deb9
push esi
lea eax, [ebp - 0x620]
push ebx
push eax
call fcn.005713c0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x620]
add esp, 0xc
mov ecx, dword [eax]
push 0x104
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
js 0x54deb9
push esi
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.005713c0
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
add esp, 0xc
mov dword [ebp - 8], ebx
mov ecx, dword [eax]
push edx
push 0x104
lea edx, [ebp - 0x828]
push edx
push eax
call dword [ecx + 0x40]
test eax, eax
js 0x54deb9
lea eax, [ebp - 0x210]
push eax
call fcn.0057bbea
mov esi, dword [ebp + 0xc]
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00407684
lea eax, [ebp - 0x418]
push eax
call fcn.0057bbea
pop ecx
push eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [esi + 0x18]
call fcn.00407684
lea eax, [ebp - 0x620]
push eax
call fcn.0057bbea
pop ecx
push eax
lea eax, [ebp - 0x620]
push eax
lea ecx, [esi + 0x30]
call fcn.00407684
lea eax, [ebp - 0x828]
push eax
call fcn.0057bbea
pop ecx
push eax
lea eax, [ebp - 0x828]
push eax
lea ecx, [esi + 0x48]
call fcn.00407684
mov ecx, dword [ebp - 4]
jmp 0x54debe
mov ecx, dword [ebp - 4]
mov edi, ebx
test ecx, ecx
je 0x54dec8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp + 8]
jmp 0x54decf
mov edi, ebx
test eax, eax
je 0x54ded9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret
Function at 0x54e39f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.0054dc1c
cmp dword [ebp - 8], 0
je 0x54e3d0
cmp dword [ebp - 4], 8
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x54e3d0
xor esi, esi
inc esi
jmp 0x54e3d2
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.00403730
mov eax, esi
pop esi
leave
ret
Function at 0x54e878
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 8], eax
cmp dword [edi + 0x34], eax
je 0x54e8bc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], ebx
push eax
lea ecx, [edi + 0x3c]
call fcn.0054dc1c
cmp dword [eax + 0x10], 0
je 0x54e8b9
cmp dword [edi + 0x80], 0
mov eax, ebx
je 0x54e8bc
mov byte [ebp - 1], 0
jmp 0x54e8bf
mov eax, dword [ebp - 8]
mov byte [ebp - 1], bl
test al, 1
je 0x54e8cb
lea ecx, [ebp - 0x20]
call fcn.00403730
cmp byte [ebp - 1], 0
jne 0x54e9c5
lea esi, [edi + 0x24]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x54e8e2
mov eax, dword [esi]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push 0x208
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.005713c0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x54e907
mov esi, dword [esi]
xor ecx, ecx
lea eax, [ebp - 0x260]
push ecx
push ecx
push 0x104
push eax
push esi
push ecx
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x54e9c5
push 0
lea ecx, [ebp - 0x58]
call fcn.004cf900
lea eax, [edi + 0x3c]
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], eax
push ecx
mov ecx, eax
call fcn.0054dc1c
cmp dword [eax + 0x14], 8
jb 0x54e949
mov eax, dword [eax]
push ebx
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00408981
sub esp, 0x18
lea eax, [ebp - 0x260]
mov ecx, esp
push eax
call fcn.00408981
lea ecx, [ebp - 0x58]
call fcn.004d5a80
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00403730
test esi, esi
je 0x54e9b7
lea eax, [edi + 0x70]
mov edi, dword [ebp - 8]
push eax
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0054dc1c
push eax
call fcn.0054f1a6
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00403730
test esi, esi
jne 0x54e9b9
sub esp, 0x18
mov ecx, edi
push esp
call fcn.0054dc1c
lea ecx, [ebp - 0x58]
call fcn.004d60d0
xor ebx, ebx
lea ecx, [ebp - 0x58]
call fcn.004cf960
mov eax, ebx
jmp 0x54e9c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x54eafa
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov edi, ecx
xor esi, esi
push esi
lea eax, [edi + 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004cc510
mov ecx, eax
call fcn.004cd6a0
cmp dword [ebp - 4], 8
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x54eb75
push 1
lea eax, [edi + 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004cc510
mov ecx, eax
call fcn.004cd6a0
cmp dword [ebp - 0x20], esi
je 0x54eb6d
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x18]
cmovae ecx, dword [ebp - 0x30]
cmp dword [ebp - 4], 8
push ecx
cmovae eax, dword [ebp - 0x18]
push eax
call fcn.0045acfe
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0x30]
call fcn.00403730
lea ecx, [ebp - 0x18]
call fcn.00403730
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x54f1a6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 0x10], 0
je 0x54f21d
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x54f1c7
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x54f21d
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.005713c0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x54f1f0
mov edi, dword [edi]
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.0045bb0a
cmp dword [esi + 0x14], 8
pop ecx
pop ecx
jb 0x54f207
mov esi, dword [esi]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.00592981
pop ecx
pop ecx
test eax, eax
jne 0x54f21d
inc eax
jmp 0x54f21f
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x55079b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
xor ebx, ebx
push edi
push 0x60
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
jne 0x5507e3
push 2
push ebx
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
jne 0x5507e3
call fcn.0054fdab
mov esi, eax
jmp 0x55087b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5507fd
call fcn.0054fdab
jmp 0x55086e
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x5507f6
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x550823
mov esi, 0x8007000e
jmp 0x550870
push eax
lea ecx, [ebp - 0x40c]
call fcn.0054fc22
cmp dword [ebp - 0x40c], 0
je 0x55081c
push esi
push dword [ebp - 0x40c]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x5507f6
mov eax, dword [ebp - 0x40c]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 8]
push dword [ebp - 0x40c]
call fcn.00550686
mov esi, eax
test edi, edi
je 0x55087b
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x550894
lea ecx, [ebp - 0x40c]
call fcn.0054ffcc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x5516ec
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x605890
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.0054fdd7
pop ecx
push esi
push dword [ebp + 8]
mov edi, 0x63abf4
push esi
mov ecx, edi
call fcn.00550083
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00550f29
add esp, 0xc
mov ecx, edi
mov esi, eax
call fcn.00551194
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10

Function at 0x552332
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.0055217f
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x552349
mov eax, dword [eax]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push edi
push eax
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push edi
push eax
push edi
push 2
push edi
push dword [esi + 0x3c]
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push dword [ebp + 0xc]
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.00405d53
mov ecx, esi
call fcn.0055252f
pop edi
pop esi
pop ebp
ret 8

Function at 0x5bef29
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005be8f2

Function at 0x5bf34f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005bf223

Function at 0x5c39fd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005c35f5

Function at 0x5c3a08
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005c377f
Function at 0x40354e
Capabilities:
Terminate process

Disassembly:
jmp 0x4595b9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4595ca
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004057bd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403675
Capabilities:
Query environment variable

Disassembly:
jmp 0x4a03d0
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4a03e1
pop esi
ret
push ebx
push edi
push esi
call fcn.004a02b7
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403ef9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4a0409
push ebx
push esi
push edi
call fcn.004055b5
add esp, 0xc
push 0
call fcn.004060e1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x405673
Capabilities:
Parse pe header

Disassembly:
jmp 0x4487d0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44880f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44880f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44880f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44880f
cmp dword [ecx + 0x74], 0xe
jbe 0x44880f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4464b6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.004036d4
mov eax, dword [eax + 0x14]
test eax, eax
je 0x4464f9
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x4464f9
sub eax, 1
je 0x4464f4
sub eax, 1
je 0x4464f0
xor eax, eax
leave
ret
push 3
jmp 0x4464fb
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x496079
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401d52
mov eax, dword [0x4d1040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405d0d
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4960bb
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x496217
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00405e57
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4d4938]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004031f7
mov ecx, dword [esi*4 + 0x4d4938]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x496210
cmp eax, dword [edi + ecx + 0x24]
jne 0x496210
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x496210
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004031f7
add esp, 0x14
test edx, edx
jl 0x496210
jg 0x496186
test eax, eax
jb 0x496210
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x496210
jl 0x4961a0
cmp dword [ebp - 0x1008], eax
ja 0x496210
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4961be
test ebx, ebx
je 0x4961f7
cmp ecx, edi
jae 0x4961f7
mov al, byte [ecx]
cmp al, 0xd
jne 0x4961d8
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4961e4
cmp byte [ecx + 1], 0xa
jne 0x4961e4
inc ecx
jmp 0x4961e4
movzx eax, al
movsx eax, byte [eax + 0x4d1390]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4961be
cmp edx, ebx
jne 0x4961be
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x496215
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00402fdb
leave
ret
Function at 0x496956
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4d4938]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x496996
cmp byte [ebx], 0xa
jne 0x496996
or byte [eax + edi + 0x28], 4
jmp 0x49699b
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x496a99
mov al, byte [edx]
cmp al, 0x1a
je 0x496a7b
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4969ca
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4969ef
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4969f9
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4969ac
jmp 0x496a99
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x496a76
cmp dword [ebp - 0xc], 0
je 0x496a76
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4d4938]
test byte [eax + edi + 0x28], 0x48
je 0x496a50
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x496a3b
mov byte [esi], dl
jmp 0x496a4c
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4d4938]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x496a99
cmp byte [ebp - 1], 0xa
jne 0x496a5f
cmp esi, ebx
jne 0x496a5f
mov byte [esi], 0xa
jmp 0x496a98
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004018f2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x496a99
mov byte [esi], 0xd
jmp 0x496a98
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4d4938]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x496a95
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x496a99
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret