joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414d56
Capabilities:
Copy file
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x47a460], edi
mov ebx, ecx
jne 0x414d7a
cmp dword [0x47a46c], edi
je 0x414ec6
test byte [0x47a0b4], 0x40
je 0x414d8f
mov ecx, ebx
call fcn.004194d9
jmp 0x414e35
lea eax, [ebp - 4]
mov ecx, 0x47a460
push eax
push 0x20019
push edi
call fcn.0041ab9e
push eax
push dword [0x47a45c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x414e1b
lea eax, [ebp - 0x108]
mov ecx, 0x47a660
push eax
call fcn.0041fc62
lea eax, [ebp - 0x108]
push eax
call fcn.0040d9bb
test al, al
pop ecx
je 0x414ec6
lea eax, [ebp - 0x108]
mov esi, 0x47a528
push eax
mov ecx, esi
call fcn.00419db1
push edi
push str..bak
mov ecx, esi
call fcn.00419ee6
push edi
mov ecx, esi
call fcn.0041ab9e
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x108]
jmp 0x414ebf
cmp dword [0x47a46c], edi
jne 0x414e3a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
mov ecx, ebx
call fcn.00414a46
pop edi
pop esi
pop ebx
leave
ret
push edi
push edi
push edi
push edi
mov ecx, 0x47a46c
call fcn.0041ab9e
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x414e2c
lea eax, [ebp - 0x108]
mov ecx, 0x47a660
push eax
call fcn.0041fc62
lea eax, [ebp - 0x108]
push eax
call fcn.0040d9bb
test al, al
pop ecx
je 0x414ec6
lea eax, [ebp - 0x108]
mov esi, 0x47a528
push eax
mov ecx, esi
call fcn.00419db1
push edi
push str..bak
mov ecx, esi
call fcn.00419ee6
push edi
mov ecx, esi
call fcn.0041ab9e
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
jmp 0x414e35
Function at 0x418006
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x94
push 0x47a108
mov dword [0x47a4f0], esi
mov dword [0x47a4f4], esi
mov dword [0x47a4fc], 2
mov dword [0x47a378], esi
mov byte [0x47a42c], 1
mov dword [0x47a0a4], eax
mov dword [0x47a0ac], esi
mov dword [0x47a0a8], esi
mov dword [0x47a0a0], esi
mov dword [0x47a108], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x38
push esi
push 0x47a1a0
mov dword [0x47a724], esi
call fcn.00421740
push 0x44
push esi
push 0x47a048
call fcn.00421740
push 0xc
push esi
push 0x47a618
call fcn.00421740
push 0x38
push esi
push 0x47a208
call fcn.00421740
mov edi, 0x104
mov dword [0x47a21c], 0x4214ac
push edi
mov dword [0x47a208], 0x421480
mov dword [0x47a20c], 0x4214d8
mov dword [0x47a214], 0x421559
mov dword [0x47a210], 0x4215ed
mov dword [0x47a218], 0x42168d
mov dword [0x47a234], 0x41b681
mov dword [0x47a23c], 0x41b579
mov dword [0x47a230], 0x41b2db
mov dword [0x47a238], 0x41af7d
mov dword [0x47a22c], 0x47a0b8
call fcn.0042200e
add esp, 0x34
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x418135
mov ecx, 0x47a7fc
call fcn.0041ab9e
push eax
call fcn.0041b6d2
pop ecx
push edi
push esi
push dword [ebp + 8]
call fcn.00421740
add esp, 0xc
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov ecx, 0x47a560
call fcn.00419db1
push dword [ebp + 8]
call fcn.0042201c
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0xc]
call fcn.00419cd4
lea ecx, [ebp - 0xc]
call fcn.0041abe8
push 1
lea ecx, [ebp - 0xc]
pop edi
push edi
push esi
push str._SILENT
call fcn.0041a578
or ecx, 0xffffffff
cmp eax, ecx
je 0x41819a
mov byte [0x47b0a0], 1
push ebx
lea eax, [ebp - 0xa0]
push esi
push eax
mov dword [0x47a570], ecx
mov dword [0x47a574], ecx
mov dword [0x47a578], ecx
mov dword [0x47a57c], ecx
mov dword [0x47a580], ecx
mov dword [0x47a584], ecx
mov dword [0x47a588], ecx
mov dword [0x47a58c], ecx
call fcn.00421740
add esp, 0xc
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x4181ff
mov dword [0x47a0c8], edi
jmp 0x41821e
mov eax, dword [ebp - 0x94]
mov dword [0x47a0c8], esi
and eax, 0xffff
cmp eax, 0x3e8
ja 0x41821e
mov byte [0x47a1a1], 1
lea ecx, [ebp - 0xc]
call fcn.00419d9a
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41822f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, 0x47a1f8
push edi
push 0x2c
mov ecx, esi
call fcn.0041a7a5
push 0x28
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0041a7a5
xor edi, edi
mov dword [ebp - 0x18], eax
cmp eax, edi
mov dword [ebp - 8], edi
jle 0x41839c
mov esi, 0x47a444
mov ebx, 0x427c50
lea ecx, [ebp - 0x14]
call fcn.00419c64
push 4
mov ecx, 0x47a560
push dword [ebp - 4]
call fcn.0041ab9e
push eax
lea ecx, [ebp - 0x14]
call fcn.0041a96d
add dword [ebp - 4], 4
lea eax, [ebp - 0x11c]
push str..TTF
push eax
call fcn.0041ba38
pop ecx
pop ecx
push 1
pop eax
mov dword [0x47b044], eax
mov dword [0x47a19c], eax
mov eax, dword [0x47b0b0]
cmp eax, edi
je 0x4182c3
push eax
call fcn.0042201c
pop ecx
push 4
call fcn.0042200e
pop ecx
mov dword [0x47b0b0], eax
push edi
lea ecx, [ebp - 0x14]
call fcn.0041a7a5
add eax, dword [ebp - 4]
mov ecx, dword [0x47b0b0]
push edi
mov dword [ecx], eax
lea ecx, [ebp - 0x14]
call fcn.0041a7a5
push eax
lea eax, [ebp - 0x11c]
push dword [ebp - 4]
mov ecx, 0x47a560
push eax
call fcn.0041ab9e
push eax
call fcn.00401ac0
add esp, 0x10
test eax, eax
jne 0x4183a3
push edi
lea ecx, [ebp - 0x14]
call fcn.0041a7a5
add dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push str..FOT
push eax
call fcn.0041ba38
pop ecx
lea eax, [ebp - 0x11c]
pop ecx
push edi
push eax
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateScalableFontResourceA]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
lea eax, [ebp - 0x220]
push edi
push eax
mov ecx, esi
call fcn.00419ee6
push edi
push ebx
mov ecx, esi
call fcn.00419ee6
lea eax, [ebp - 0x11c]
push edi
push eax
mov ecx, esi
call fcn.00419ee6
push edi
push ebx
mov ecx, esi
call fcn.00419ee6
lea ecx, [ebp - 0x14]
call fcn.00419d9a
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x41826f
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
call fcn.00419d9a
xor al, al
jmp 0x41839e

Function at 0x4183bc
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x47a258
lea ecx, [ebp - 0xc]
call fcn.00419d38
xor ebx, ebx
lea ecx, [ebp - 0xc]
push ebx
push str.mutex
call fcn.00419ee6
lea ecx, [ebp - 0xc]
call fcn.0041ab9e
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x418439
mov ecx, 0x47a728
call fcn.0041ab9e
push eax
push str.AstrumInstaller
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
je 0x418439
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x418430
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov bl, 1
lea ecx, [ebp - 0xc]
call fcn.00419d9a
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x4186a9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
mov ecx, 0x47a560
call fcn.0041ab9e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
mov dword [ebp - 0xc], ebx
je 0x41883f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0xfffffffffffffffc
push ebx
mov esi, eax
call edi
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebp - 4]
push 4
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebx
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x41878d
cmp eax, 0x3e8
jbe 0x418730
push 0
push dword [0x428484]
push 0
jmp 0x41882e
mov ecx, esi
push eax
sub ecx, eax
sub ecx, 4
push ecx
mov ecx, 0x47a560
call fcn.0041ab9e
push eax
mov ecx, 0x479e98
call fcn.0041a96d
push 0x479e98
lea ecx, [ebp - 0x1c]
call fcn.00419d38
lea ecx, [ebp - 0x1c]
call fcn.0041a17f
test al, al
je 0x41877c
lea ecx, [ebp - 0x1c]
call fcn.0041a17f
test al, al
je 0x41877c
and byte [0x47a044], 0
jmp 0x418783
mov byte [0x47a044], 1
lea ecx, [ebp - 0x1c]
call fcn.00419d9a
jmp 0x418798
and dword [ebp - 4], 0
mov byte [0x47a044], 1
push 2
push 0
push 0xfffffffffffffff8
pop eax
sub eax, dword [ebp - 4]
push eax
push dword [ebp - 0xc]
call edi
xor edi, edi
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 8]
push 4
push eax
mov dword [ebp - 8], edi
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x4187ce
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffe
jmp 0x41883e
mov eax, esi
sub eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
sub eax, 8
cmp eax, 0x3e8
ja 0x418826
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esi, dword [ebp - 8]
mov ecx, 0x47a560
sub esi, dword [ebp - 4]
sub esi, 8
push esi
push dword [ebp - 8]
call fcn.0041ab9e
mov esi, 0x47a1f8
push eax
mov ecx, esi
call fcn.0041a96d
test eax, eax
jge 0x418815
push 0xfffffffffffffffd
jmp 0x41883e
push 0xe4
mov ecx, esi
call fcn.0041a7a5
cmp eax, dword [ebp - 8]
je 0x41883c
push edi
push dword [0x428484]
push edi
mov ecx, 0x479ee8
call fcn.0041916b
push 0xfffffffffffffffc
jmp 0x41883e
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4189c2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 8]
push esi
push edi
mov esi, dword [ecx]
call fcn.0041ab9e
xor edi, edi
xor ecx, ecx
cmp esi, edi
jbe 0x418bc6
cmp byte [ecx + eax], 0x3c
je 0x4189f0
inc ecx
cmp ecx, esi
jb 0x4189e0
jmp 0x418bc6
mov ecx, 0x47a240
call fcn.0041ab9e
push eax
lea ecx, [ebp - 0x20]
call fcn.00419cd4
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
dec eax
push eax
call fcn.00419e82
cmp al, 0x5c
jne 0x418a23
mov eax, dword [ebp - 0x20]
push 1
dec eax
lea ecx, [ebp - 0x20]
push eax
call fcn.0041a248
mov esi, 0x104
push ebx
push esi
call fcn.0042200e
mov ebx, eax
pop ecx
cmp ebx, edi
mov dword [ebp - 8], ebx
jne 0x418a4a
mov ecx, 0x47a7fc
call fcn.0041ab9e
push eax
call fcn.0041b6d2
pop ecx
push esi
call fcn.0042200e
cmp eax, edi
pop ecx
mov dword [ebp - 4], eax
jne 0x418a69
mov ecx, 0x47a7fc
call fcn.0041ab9e
push eax
call fcn.0041b6d2
pop ecx
push esi
push edi
push ebx
call fcn.00421740
push esi
push edi
push dword [ebp - 4]
call fcn.00421740
add esp, 0x18
lea ecx, [ebp - 0x20]
push esi
push ebx
call fcn.0041ab9e
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push eax
call ebx
mov ecx, 0x47a758
call fcn.00410ec6
push eax
lea ecx, [ebp - 0x14]
call fcn.00419cd4
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
dec eax
push eax
call fcn.00419e82
cmp al, 0x5c
jne 0x418ac4
mov eax, dword [ebp - 0x14]
push 1
dec eax
lea ecx, [ebp - 0x14]
push eax
call fcn.0041a248
lea ecx, [ebp - 0x14]
call fcn.0041ab9e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418ae9
push esi
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.0041ab9e
push eax
call ebx
jmp 0x418afb
lea ecx, [ebp - 0x14]
call fcn.0041ab9e
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
mov ecx, 0x47a0e4
pop ebx
push ebx
push edi
push edi
call fcn.0041ab9e
mov esi, dword [ebp + 8]
push eax
push str._UserName_
mov ecx, esi
call fcn.0041aa75
push ebx
push edi
push edi
mov ecx, 0x47a0f0
call fcn.0041ab9e
push eax
push str._UserCompany_
mov ecx, esi
call fcn.0041aa75
push ebx
push edi
push edi
mov ecx, 0x47a0fc
call fcn.0041ab9e
push eax
push str._UserSerial_
mov ecx, esi
call fcn.0041aa75
push ebx
push edi
push edi
mov ecx, esi
push dword [ebp - 8]
push str._ShortInstallDir_
call fcn.0041aa75
push ebx
push edi
push edi
mov ecx, esi
push dword [ebp - 4]
push str._ShortShortcutDir_
call fcn.0041aa75
push ebx
push edi
push edi
lea ecx, [ebp - 0x20]
call fcn.0041ab9e
push eax
push str._InstallDir_
mov ecx, esi
call fcn.0041aa75
push ebx
push edi
push edi
lea ecx, [ebp - 0x14]
call fcn.0041ab9e
push eax
push str._ShortcutDir_
mov ecx, esi
call fcn.0041aa75
push dword [ebp - 8]
call fcn.0042201c
push dword [ebp - 4]
call fcn.0042201c
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00419d9a
lea ecx, [ebp - 0x20]
call fcn.00419d9a
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x41931b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea esi, [ecx + 0x158]
xor ebx, ebx
push edi
mov ecx, dword [esi]
cmp ecx, ebx
je 0x419338
push ebx
call fcn.0040767b
mov dword [esi], ebx
push dword [0x47a0ac]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [0x47a608], ebx
je 0x41937b
cmp byte [0x47b0ad], 0
je 0x41935f
push ebx
call dword [0x47a5ac]
pop ecx
cmp byte [0x47b0ac], 0
je 0x419371
push 1
call dword [0x47a5ac]
pop ecx
mov ecx, 0x47a5a8
call fcn.0041c27f
mov ecx, 0x47a1d8
call fcn.00419bcc
cmp byte [ebp + 8], 0
je 0x4193a1
mov eax, dword [0x47b090]
cmp eax, ebx
je 0x4193a1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x47b090], ebx
cmp dword [0x47a620], ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 8], ebx
jle 0x4193da
xor edi, edi
mov eax, dword [0x47a618]
cmp dword [edi + eax], ebx
lea ecx, [edi + eax]
jbe 0x4193c9
call fcn.0041ab9e
push eax
call esi
inc dword [ebp + 8]
add edi, 0xc
mov eax, dword [ebp + 8]
cmp eax, dword [0x47a620]
jl 0x4193b4
cmp dword [0x47a414], ebx
mov dword [ebp + 8], ebx
mov edi, 0x47a408
jle 0x419424
push dword [ebp + 8]
mov ecx, edi
call fcn.0041c45e
mov ebx, eax
lea ecx, [ebx + 4]
call fcn.0041ab9e
push eax
call esi
test ebx, ebx
je 0x419414
lea ecx, [ebx + 4]
call fcn.00419d9a
push ebx
call fcn.0042201c
pop ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [0x47a414]
jl 0x4193ea
xor ebx, ebx
mov ecx, edi
call fcn.0041c51f
lea ecx, [ebp - 0x10]
call fcn.00419c64
mov dword [ebp - 4], ebx
push ebx
mov edi, 0x47a444
mov ecx, edi
call fcn.0041a87a
test al, al
je 0x41947b
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
inc ebx
call fcn.0041a7d7
test bl, 1
je 0x41946b
lea ecx, [ebp - 0x10]
call fcn.0041ab9e
push eax
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
lea ecx, [ebp - 0x10]
call fcn.0041ab9e
push eax
call esi
push dword [ebp - 4]
jmp 0x41943c
push 0x429ff8
mov ecx, edi
call fcn.00419db1
mov ecx, 0x479ecc
call fcn.0041ab9e
push eax
call esi
mov ecx, 0x479ed8
call fcn.0041ab9e
push eax
call esi
mov ecx, 0x479ec0
call fcn.0041ab9e
push eax
call esi
mov ecx, 0x47a660
call fcn.0041ab9e
push eax
call esi
push dword [0x47a0a8]
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [ebp - 0x10]
call fcn.00419d9a
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4194d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.00419c64
mov ecx, 0x47a258
call fcn.0041ab9e
push eax
lea eax, [ebp - 0x14]
push str._s_installation_couldnt_be_found._Try_re_installing_the_application_before_running_update.
push eax
call fcn.0041a30f
add esp, 0xc
lea eax, [ebp - 4]
xor ebx, ebx
mov ecx, 0x47a460
push eax
push 0x20019
push ebx
call fcn.0041ab9e
push eax
push dword [0x47a45c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419597
cmp dword [0x47a46c], ebx
jne 0x41954c
cmp dword [0x47a478], ebx
jne 0x41954c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4195b6
mov eax, 0x104
push esi
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.00421740
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x47a46c
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
call fcn.0041ab9e
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
je 0x4195ae
push ebx
lea ecx, [ebp - 0x14]
call fcn.0041ab9e
push eax
push ebx
mov ecx, 0x479ee8
call fcn.0041916b
jmp 0x4195da
cmp dword [0x47a478], ebx
jne 0x4195ba
mov bl, 1
jmp 0x4195da
test byte [0x47a0b9], 0x20
lea eax, [ebp - 0x118]
mov ecx, edi
push eax
je 0x4195d3
call fcn.004195e8
jmp 0x4195d8
call fcn.00419789
mov bl, al
lea ecx, [ebp - 0x14]
call fcn.00419d9a
mov al, bl
pop edi
pop ebx
leave
ret

Function at 0x41a96d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x41a9a0
push 0xfffffffffffffffd
pop eax
jmp 0x41aa3f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebx
push ebx
push eax
call edi
sub eax, dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [esi], eax
push dword [ebp + 8]
call edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 0x10]
pop edi
cmp dword [esi], eax
jbe 0x41a9dd
cmp eax, ebx
jbe 0x41a9dd
mov dword [esi], eax
push dword [esi]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi], ebx
mov dword [esi + 8], eax
jne 0x41a9fc
xor eax, eax
jmp 0x41aa3f
cmp dword [esi + 4], ebx
jne 0x41aa12
mov ecx, 0x47a7fc
call fcn.0041ab9e
push eax
call fcn.0041b6d2
pop ecx
lea eax, [ebp - 4]
push ebx
push eax
mov dword [ebp - 4], ebx
push dword [esi]
push dword [esi + 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, dword [esi]
sete al
dec eax
and al, 0xfe
inc eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x41ac8e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41acbc
push 0xfffffffffffffffd
pop eax
jmp 0x41ace5
lea eax, [ebp + 8]
push edi
push eax
mov dword [ebp + 8], edi
push dword [esi]
push dword [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, dword [esi]
sete al
dec eax
and al, 0xfd
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41b7af
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x429ff8
call fcn.00419db1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, 0xfffffc00
mov ecx, edx
and eax, esi
test ecx, ecx
ja 0x41b802
jb 0x41b7e1
cmp eax, 0x100000
jae 0x41b802
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.004222a0
push eax
push str._d_KB
push dword [ebp + 0x10]
call fcn.0041a30f
add esp, 0xc
jmp 0x41b91b
mov eax, dword [ebp + 8]
push 0xa
pop ecx
call fcn.004222a0
and byte [ebp - 0xc], 0
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push 0xa
push eax
push 0xe
push 0x400
mov dword [ebp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41b844
lea eax, [ebp - 0xc]
push 0x428024
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp + 0xc]
mov eax, ebx
mov ecx, edi
and eax, esi
test ecx, ecx
ja 0x41b88b
jb 0x41b85a
cmp eax, 0x100000
jae 0x41b88b
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.004222a0
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub ebx, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push ebx
call fcn.00422490
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_MB
jmp 0x41b910
push 0xa
mov eax, ebx
pop ecx
mov edx, edi
call fcn.004222a0
mov edi, eax
mov ebx, edx
and eax, esi
test ebx, ebx
ja 0x41b8d8
jb 0x41b8aa
cmp eax, 0x100000
jae 0x41b8d8
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.004222a0
mov esi, eax
xor ecx, ecx
shl eax, 0xa
sub edi, eax
push ecx
sbb ebx, ecx
push 0x64
push ebx
push edi
call fcn.00422490
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str._d_s_d_GB
jmp 0x41b910
push 0xa
mov eax, edi
pop ecx
mov edx, ebx
call fcn.004222a0
push 0xa
mov esi, eax
pop ecx
mov edi, edx
call fcn.004222a0
mov ebx, eax
xor ecx, ecx
shl eax, 0xa
sub esi, eax
push ecx
sbb edi, ecx
push 0x64
push edi
push esi
call fcn.00422490
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str._d_s_d_TB
push dword [ebp + 0x10]
call fcn.0041a30f
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
jne 0x41b937
or eax, 0xffffffff
jmp 0x41b9d8
mov dword [eax], esi
lea eax, [ebp + 8]
push eax
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41b9d5
lea eax, [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp + 8]
call edi
test eax, eax
jne 0x41b9d1
mov eax, dword [ebp + 0xc]
inc eax
push eax
call fcn.0042200e
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x41b992
mov ecx, 0x47a7fc
call fcn.0041ab9e
push eax
call fcn.0041b6d2
pop ecx
mov eax, dword [ebp + 0xc]
inc eax
push eax
push esi
push ebx
call fcn.00421740
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x41b9c6
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
mov dword [eax], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
jmp 0x41b9d7
push ebx
call fcn.0042201c
pop ecx
push 0xfffffffffffffffe
jmp 0x41b9d7
push 0xfffffffffffffffd
jmp 0x41b9d7
push 0xfffffffffffffffc
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41ba38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, 0x104
push edi
push esi
push 0
push dword [ebp + 8]
call fcn.00421740
push esi
call fcn.0042200e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x41ba71
mov ecx, 0x47a7fc
call fcn.0041ab9e
push eax
call fcn.0041b6d2
pop ecx
push esi
push 0
push edi
call fcn.00421740
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x41ba99
push 0x429584
push edi
call esi
jmp 0x41baa8
add eax, edi
cmp byte [eax - 1], 0x5c
je 0x41baa8
mov byte [eax], 0x5c
and byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea ebx, [eax + edi]
mov eax, dword [ebp - 4]
and byte [ebx], 0
inc dword [ebp - 4]
lea ecx, [ebp - 0x14]
push 0xa
push ecx
push eax
call fcn.00424aff
add esp, 0xc
push 0x429580
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push dword [ebp + 0xc]
push edi
call esi
push edi
call fcn.0040d9bb
test al, al
pop ecx
jne 0x41babc
push edi
push dword [ebp + 8]
call esi
push edi
call fcn.0042201c
mov eax, dword [ebp + 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret