joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fc2c
Capabilities:
Reference sql statements

Disassembly:
push dword [0x9b3e20]
push 0x1fae
call fcn.004fd604
lea eax, [0x9ace48]
push eax
call fcn.00559740
push dword [0x9ace48]
mov edx, 0x6fb198
pop ecx
call fcn.0051f5d0
je 0x45fc5c
ret
mov dword [0x9ad8c0], 2
push dword [0x9b3e20]
mov edx, str.SELECT__FROM_Items_WHERE_ITEMTYPE
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9ace48]
call fcn.004e98e0
pop eax
lea eax, [0x9ac1a4]
push eax
call fcn.00559740
call fcn.004223fd
push dword [0x9af5e8]
call fcn.0055199d
push 0
push 0
mov eax, str.Searching_database_...
push eax
call fcn.004ee8a9
push 0x6fb198
push 1
push 0
call fcn.004f09d9
mov dword [0x9ad29c], 0
mov dword [0x9ae344], 0
push 1
push dword [0x9ac1a4]
call fcn.004f685a
and eax, eax
je 0x45fe13
push 1
call fcn.004f4ac4
and eax, eax
je 0x45fe09
call fcn.004e5ab5
push dword [0x9ada64]
pop dword [0x9ac598]
call fcn.0042278c
push dword [0x9b3e20]
push dword [0x9ac598]
push dword [0x9abad4]
push dword [0x9ace48]
push dword [0x9abb80]
call fcn.004d8a0c
lea eax, [0x9abf28]
push eax
call fcn.00559740
mov ebx, dword [0x9ae29c]
mov edi, dword [0x9acc0c]
inc edi
cmp ebx, edi
jg 0x45fd72
mov ebx, dword [0x9ae290]
cmp ebx, dword [0x9add88]
jg 0x45fd72
jmp 0x45fd79
mov eax, 1
jmp 0x45fd7b
xor eax, eax
and eax, eax
je 0x45fd84
jmp 0x45fcfa
mov dword [0x9accec], 0
call fcn.00429793
push dword [0x9af5e8]
call fcn.005519fb
mov edx, dword [0x9ac338]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov ebp, dword [0x9af5ec]
lea eax, [ebp + 8]
push eax
call fcn.00559740
mov ebx, dword [0x9ad29c]
inc ebx
mov dword [0x9ad29c], ebx
push dword [0x9b3e20]
push 1
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, dword [0x9ad29c]
cdq
push edx
push eax
call fcn.005565d0
mov edx, dword [0x9a36fc]
add dword [esp], edx
call fcn.004e2511
pop dword [0x9b3e20]
jmp 0x45fcfa
push 1
call fcn.004be154
push 1
call fcn.004d3586
call fcn.00505b4e
push dword [0x9af5e8]
call fcn.00551a99
mov dword [0x9ad2c4], eax
mov ebx, dword [0x9ad2c4]
and ebx, ebx
jne 0x45fe76
push 0xffffff
push 0
push 0xfa
push 0x1cc
push 0
push 0
push 0x703490
push 0x73fd4c
mov eax, str.No_items_found
push eax
mov eax, str.List_items
push eax
call fcn.004f6619
ret
mov dword [0x9ac868], 0
mov edx, str.Items
lea ecx, [0x9acdf8]
call fcn.0051f008
mov edx, str.List_of_items
lea ecx, [0x9ae300]
call fcn.0051f008
mov edx, 0x6fb198
lea ecx, [0x9ac780]
call fcn.0051f008
call fcn.00429276
mov edx, str.Number_Title_Call_number_Status_Item_type_Item_type_description
lea ecx, [0x9acf30]
call fcn.0051f008
mov edx, str.160_715_370_122_162_342
lea ecx, [0x9ac8ec]
call fcn.0051f008
mov edx, str.List_of_Items
lea ecx, [0x9ad494]
call fcn.0051f008
mov edx, str.ITEMS
lea ecx, [0x9acf00]
call fcn.0051f008
call fcn.00441c53
push dword [0x9af5e8]
call fcn.0055199d
ret
Function at 0x4691b9
Capabilities:
Reference sql statements

Disassembly:
push dword [0x9b3e20]
mov edx, str.SELECT__FROM_Borrowers_WHERE_BTYPE
push edx
call fcn.005597c0
mov edx, dword [0x9ac69c]
push edx
call fcn.005597c0
mov edx, str._ORDER_BY_BORROWERNUMBER
push edx
call fcn.005597c0
lea eax, [0x9ac1a4]
push eax
call fcn.00559740
push 0
push 0
mov eax, str.Searching_database_...
push eax
call fcn.004ee8a9
mov dword [0x9ad29c], 0
mov dword [0x9ae344], 0
mov edx, 0x6fb198
lea ecx, [0x9ad9d8]
call fcn.0051f008
push 0x6fb198
push 1
push 0
call fcn.004f09d9
push 1
push dword [0x9ac1a4]
call fcn.004f685a
and eax, eax
je 0x469395
push 1
call fcn.004f4ac4
and eax, eax
je 0x46938b
call fcn.004dcb1c
push dword [0x9ad9e0]
mov edx, 0x6fb198
pop ecx
call fcn.0051f5d0
je 0x4692ab
push dword [0x9b3e20]
push dword [0x9ab7e4]
push dword [0x9abad4]
push dword [0x9ab928]
push dword [0x9abb80]
call fcn.004d8a0c
lea eax, [0x9ad9e0]
push eax
call fcn.00559740
call fcn.0042a8f7
mov ebx, dword [0x9ab918]
cmp ebx, 2
jne 0x469315
push dword [0x9ae2dc]
mov edx, dword [0x9ad9d8]
pop ecx
call fcn.0051f5d0
jne 0x469315
mov edx, dword [0x9ae2dc]
push dword [0x9b3e20]
push edx
call fcn.005597c0
lea eax, [0x9ad9d8]
push eax
call fcn.00559740
mov ebx, dword [0x9ad29c]
and ebx, ebx
je 0x469315
push dword [0x9af5e8]
call fcn.005519fb
mov ebp, dword [0x9af5ec]
mov edx, str._PAGE_
lea ecx, [ebp + 8]
call fcn.0051f008
push dword [0x9af5e8]
call fcn.005519fb
mov edx, dword [0x9ac338]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov ebp, dword [0x9af5ec]
lea eax, [ebp + 8]
push eax
call fcn.00559740
mov ebx, dword [0x9ad29c]
inc ebx
mov dword [0x9ad29c], ebx
push dword [0x9b3e20]
push 1
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, dword [0x9ad29c]
cdq
push edx
push eax
call fcn.005565d0
mov edx, dword [0x9a36fc]
add dword [esp], edx
call fcn.004e2511
pop dword [0x9b3e20]
jmp 0x469252
push 1
call fcn.004be154
call fcn.00505b4e
push 1
call fcn.004d3586
push dword [0x9af5e8]
call fcn.00551a99
mov dword [0x9adf98], eax
mov ebx, dword [0x9adf98]
and ebx, ebx
jne 0x4693f8
push 0xffffff
push 0
push 0xfa
push 0x1cc
push 0
push 0
push 0x703490
push 0x73fd4c
mov eax, str.No_borrowers_in_this_type
push eax
mov eax, str.Notice
push eax
call fcn.004f6619
ret
mov edx, str.Borrowers
lea ecx, [0x9acdf8]
call fcn.0051f008
mov edx, str.List_of_borrowers_in_a_type
lea ecx, [0x9ae300]
call fcn.0051f008
mov edx, 0x6fb198
lea ecx, [0x9ace10]
call fcn.0051f008
mov edx, 0x6fb198
lea ecx, [0x9ac780]
call fcn.0051f008
call fcn.0042a7e0
mov edx, str.Number_Name_Class_Year_level_Type_Gender
lea ecx, [0x9acf30]
call fcn.0051f008
mov edx, str.150_800_250_250_200_200
lea ecx, [0x9ac8ec]
call fcn.0051f008
mov edx, str.2_0_0_0_2_0_0_2_0_0_0_7_0_0_7_7_0_2_4_4_2_0_0_0
lea ecx, [0x9adfbc]
call fcn.0051f008
mov dword [0x9ad8c0], 2
mov dword [0x9ac26c], 1
mov edx, str.List_of_Borrowers
lea ecx, [0x9ad494]
call fcn.0051f008
push dword [0x9adf98]
pop dword [0x9abbf8]
call fcn.0042262e
call fcn.00441c53
push dword [0x9af5e8]
call fcn.0055199d
ret
Function at 0x4784de
Capabilities:
Reference sql statements

Disassembly:
mov dword [0x9ac574], 0
push dword [0x9ae54c]
mov edx, 0x6fb198
pop ecx
call fcn.0051f5d0
je 0x4784fc
ret
push dword [0x9b3e20]
push 0
push 0
push dword [0x9ae54c]
call fcn.004e545d
lea eax, [0x9ac1c4]
push eax
call fcn.00559740
push 0x6fb198
push 1
push 0
call fcn.004f09d9
mov dword [0x9ac574], 0
push dword [0x9b3e20]
push dword [0x9ae54c]
push dword [0x9aca44]
call fcn.004ca35b
lea eax, [0x9ad974]
push eax
call fcn.00559740
push 0x6fe984
push dword [0x9ad974]
call fcn.004dfb06
mov dword [0x9ac574], eax
mov dword [0x9ac534], 1
jmp 0x478585
mov eax, dword [0x9ac574]
cmp eax, dword [0x9ac534]
jl 0x4786c7
push 0x6fe984
push dword [0x9ac534]
push dword [0x9ad974]
call fcn.0051b4d3
mov dword [0x9ac3cc], eax
push dword [0x9b3e20]
push 1
push dword [0x9b3e20]
mov edx, str.SELECT_TITLE_CALLNUMBER_FROM_Items_WHERE_ITEMKEY
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, dword [0x9ac3cc]
cdq
push edx
push eax
call fcn.005565d0
pop eax
mov edx, dword [0x9a36fc]
add dword [esp], edx
call fcn.004f685a
pop dword [0x9b3e20]
and eax, eax
je 0x47864f
push 1
call fcn.004f4ac4
and eax, eax
je 0x47864f
push dword [0x9b3e20]
push 1
push 0
call fcn.004e0dff
lea eax, [0x9ac97c]
push eax
call fcn.00559740
push dword [0x9b3e20]
push 1
push 1
call fcn.004e0dff
lea eax, [0x9ac75c]
push eax
call fcn.00559740
push 1
call fcn.004be154
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, dword [0x9ac3cc]
cdq
push edx
push eax
call fcn.005565d0
mov edx, dword [0x9ac234]
push edx
call fcn.005597c0
mov edx, dword [0x9ac97c]
push edx
call fcn.005597c0
mov edx, dword [0x9ac234]
push edx
call fcn.005597c0
mov edx, dword [0x9ac75c]
push edx
call fcn.005597c0
mov ebx, dword [0x9ac534]
mov ebp, dword [0x9aeef8]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00559740
inc dword [0x9ac534]
jno 0x478585
push 1
call fcn.004d3586
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, dword [0x9ac574]
cdq
push edx
push eax
call fcn.005565d0
mov edx, str._titles_found_for_
push edx
call fcn.005597c0
mov edx, dword [0x9ac750]
push edx
call fcn.005597c0
mov edx, str.._To_view_details__double_click_on_an_entry.
push edx
call fcn.005597c0
lea eax, [0x9ac12c]
push eax
call fcn.00559740
push dword [0x9b3e20]
push 0
push 0x1f4
push dword [0x9ac12c]
mov eax, str.70_450_100
push eax
mov eax, str.Number_Title_Call_number
push eax
push dword [0x9b3e20]
mov edx, str.Items_with_authority_entry
push edx
call fcn.005597c0
mov edx, dword [0x9ac750]
push edx
call fcn.005597c0
add dword [0x9b3e20], 2
push dword [0x9ac574]
push 0x9aeef8
mov edx, dword [0x9a36fc]
add dword [esp + 8], edx
call fcn.004f5b6d
pop dword [0x9b3e20]
ret
Function at 0x4ada17
Capabilities:
Reference sql statements

Disassembly:
push 1
mov eax, str.Updating_date...
push eax
call fcn.004e2511
mov edx, 0x6fb198
lea ecx, [0x9abd28]
call fcn.0051f008
mov edx, 0x6fb198
lea ecx, [0x9acbc0]
call fcn.0051f008
push 0x6fb198
push 1
push 0
call fcn.004f09d9
push 1
mov eax, str.SELECT_SVALUE_FROM_Settings_WHERE_SFIELDStart_of_day_date_time
push eax
call fcn.004f685a
and eax, eax
je 0x4adafa
push 1
call fcn.004f4ac4
and eax, eax
je 0x4adaf0
push dword [0x9b3e20]
push 1
push 0
call fcn.004e0dff
lea eax, [0x9ac12c]
push eax
call fcn.00559740
push dword [0x9b3e20]
push 0x6fe984
push 1
push dword [0x9ac12c]
call fcn.004d569e
lea eax, [0x9abd28]
push eax
call fcn.00559740
push dword [0x9b3e20]
push 0x6fe984
push 2
push dword [0x9ac12c]
call fcn.004d569e
lea eax, [0x9acbc0]
push eax
call fcn.00559740
push 1
call fcn.004be154
push 1
call fcn.004d3586
push dword [0x9ac2dc]
call fcn.0050ffb8
push dword [0x9abd28]
call fcn.004e9d05
push dword [0x9acbc0]
call fcn.004e9d05
call fcn.004ca5d9
ret
Function at 0x4bbc0c
Capabilities:
Download url
Receive data

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.0051f000
mov edx, dword [esp + 0x18]
lea ecx, [esp + 4]
call fcn.0051f000
push dword [esp]
call sub.WININET.dll_DeleteUrlCacheEntryW
push 0
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x4bbc62
mov eax, 1
jmp 0x4bbc64
xor eax, eax
jmp 0x4bbc68
push dword [esp + 4]
call fcn.00559820
push dword [esp]
call fcn.00559820
add esp, 0xc
pop ebx
ret 8

Function at 0x4be236
Capabilities:
Get disk information

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x20]
mov dword [0x9b3e20], eax
mov edx, dword [esp + 0x1c]
lea ecx, [esp]
call fcn.0051f000
mov edx, 0x6fb198
lea ecx, [esp + 4]
call fcn.0051f008
push dword [0x9b3e20]
push dword [0x9b3e20]
push 1
push dword [esp + 0xc]
call fcn.005567f0
add dword [0x9b3e20], 2
mov edx, 0x6ffcae
pop ecx
mov dword [0x9b3e20], ecx
add ecx, dword [0x9a36fc]
call fcn.0051f5d0
jne 0x4be2bf
mov edx, dword [esp]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, 0x6ffcae
push edx
call fcn.005597c0
lea eax, [esp + 4]
push eax
call fcn.00559740
mov eax, dword [esp]
push eax
call sub.KERNEL32.dll_GetDriveTypeW
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
cmp ebx, 4
jne 0x4be353
push dword [0x9b3e20]
push dword [0x9b3e20]
push 0x105
call fcn.00556460
lea eax, [esp + 0x10]
push eax
call fcn.00559740
push dword [0x9b3e20]
push dword [0x9b3e20]
push 0x105
call fcn.00556460
lea eax, [esp + 0x14]
push eax
call fcn.00559740
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 8]
push eax
call sub.MPR.dll_WNetGetConnectionW
mov ebx, eax
and ebx, ebx
jne 0x4be34e
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x18]
call fcn.00556580
lea eax, [esp + 8]
push eax
call fcn.00559740
jmp 0x4be403
push dword [0x9b3e20]
mov edx, 0x732574
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9b3e20]
call fcn.0054057b
pop eax
mov edx, 0x702696
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9b3e20]
call fcn.00545abd
pop eax
lea eax, [esp + 8]
push eax
call fcn.00559740
push dword [0x9b3e20]
push dword [0x9b3e20]
push 1
push dword [esp + 0x10]
call fcn.005567f0
add dword [0x9b3e20], 2
mov edx, 0x702696
pop ecx
mov dword [0x9b3e20], ecx
add ecx, dword [0x9a36fc]
call fcn.0051f5d0
je 0x4be403
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0xc]
call fcn.005565a0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x10]
call fcn.00556870
lea eax, [esp + 8]
push eax
call fcn.00559740
mov edx, dword [esp + 4]
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4be42c
push dword [esp]
call fcn.00559820
push dword [esp + 0xc]
call fcn.00559820
push dword [esp + 4]
call fcn.00559820
push dword [esp + 0x10]
call fcn.00559820
add esp, 0x14
pop ebx
ret 4
Function at 0x4c35f1
Capabilities:
Copy file

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4c35f8
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.0051f000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.0051f000
push dword [esp]
call fcn.004e2848
mov dword [esp + 0x28], eax
push dword [esp + 4]
call fcn.004e2848
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x28], 0
je 0x4c364c
cmp dword [esp + 0x2c], 0
je 0x4c364c
mov eax, 1
jmp 0x4c364e
xor eax, eax
and eax, eax
je 0x4c36ba
call sub.USER32.dll_GetForegroundWindow
push eax
lea ebp, [esp + 0xc]
pop eax
mov dword [ebp], eax
mov dword [ebp + 4], 2
push dword [esp + 0x28]
pop eax
mov dword [ebp + 8], eax
push dword [esp + 0x2c]
pop eax
mov dword [ebp + 0xc], eax
push dword [esp + 0x48]
pop eax
mov word [ebp + 0x10], ax
lea eax, [esp + 8]
push eax
call sub.SHELL32.dll_SHFileOperationW
mov dword [esp + 0x30], eax
lea ebp, [esp + 8]
cmp dword [ebp + 0x12], 0
je 0x4c36a0
mov dword [esp + 0x30], 1
push dword [esp + 0x28]
call fcn.005585f0
push dword [esp + 0x2c]
call fcn.005585f0
mov eax, dword [esp + 0x30]
jmp 0x4c36e0
cmp dword [esp + 0x28], 0
je 0x4c36ca
push dword [esp + 0x28]
call fcn.005585f0
cmp dword [esp + 0x2c], 0
je 0x4c36da
push dword [esp + 0x2c]
call fcn.005585f0
xor eax, eax
jmp 0x4c36e0
push dword [esp + 4]
call fcn.00559820
push dword [esp]
call fcn.00559820
add esp, 0x34
pop ebx
pop ebp
ret 0xc
Function at 0x4caf01
Capabilities:
Get disk size

Disassembly:
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4caf06
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0051f000
push dword [0x9b3e20]
push dword [0x9b3e20]
push 1
push dword [esp + 0xc]
call fcn.005567f0
add dword [0x9b3e20], 2
mov edx, 0x702696
pop ecx
mov dword [0x9b3e20], ecx
add ecx, dword [0x9a36fc]
call fcn.0051f5d0
jne 0x4caf7d
mov edx, dword [esp]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, 0x702696
push edx
call fcn.005597c0
lea eax, [esp + 4]
push eax
call fcn.00559740
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
jmp 0x4cafa2
push dword [esp]
call fcn.00559820
add esp, 0x20
ret 4
Function at 0x4dc38c
Capabilities:
Get disk information

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
mov eax, dword [esp + 0x18]
mov dword [0x9b3e20], eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.0051f000
push dword [esp]
call fcn.005565a0
mov ebx, eax
cmp ebx, 1
jne 0x4dc3da
mov edx, dword [esp]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, 0x72b152
push edx
call fcn.005597c0
lea eax, [esp + 4]
push eax
call fcn.00559740
push dword [0x9b3e20]
push dword [0x9b3e20]
push 1
push dword [esp + 0xc]
call fcn.005567f0
add dword [0x9b3e20], 2
mov edx, 0x702696
pop ecx
mov dword [0x9b3e20], ecx
add ecx, dword [0x9a36fc]
call fcn.0051f5d0
jne 0x4dc438
mov edx, dword [esp]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, 0x702696
push edx
call fcn.005597c0
lea eax, [esp + 4]
push eax
call fcn.00559740
push dword [0x9b3e20]
push dword [0x9b3e20]
push 0x105
call fcn.00556460
lea eax, [esp + 8]
push eax
call fcn.00559740
push 0
push 0
push 0
push 0
push 0
push 0x105
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.KERNEL32.dll_GetVolumeInformationW
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0xc]
call fcn.00556580
lea eax, [esp + 8]
push eax
call fcn.00559740
mov edx, dword [esp + 4]
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4dc4cd
push dword [esp + 4]
call fcn.00559820
push dword [esp]
call fcn.00559820
add esp, 0xc
pop ebx
ret 4
Function at 0x4eba9e
Capabilities:
Reference sql statements

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esp], 0
mov edx, 0x6fb198
lea ecx, [0x9add80]
call fcn.0051f008
push dword [0x9b3e20]
mov edx, str.SELECT__FROM_History_WHERE_HBN
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, dword [esp + 0x28]
cdq
push edx
push eax
call fcn.005565d0
pop eax
lea eax, [esp + 8]
push eax
call fcn.00559740
cmp dword [esp + 0x20], 0
je 0x4ebb71
mov ebx, dword [esp + 0x20]
mov ebp, dword [0x9aefa8]
shl ebx, 2
mov edx, dword [ebp + ebx]
push dword [0x9b3e20]
push edx
call fcn.005597c0
lea eax, [esp + 0xc]
push eax
call fcn.00559740
push dword [esp + 8]
call fcn.005565a0
and eax, eax
je 0x4ebb71
mov edx, dword [esp + 4]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, str._AND_HDATE_
push edx
call fcn.005597c0
push dword [0x9b3e20]
push 0x6fb198
push dword [esp + 0x14]
call fcn.0051b5b2
pop eax
mov edx, 0x6fe366
push edx
call fcn.005597c0
lea eax, [esp + 8]
push eax
call fcn.00559740
mov edx, dword [esp + 4]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, str._ORDER_BY_HDATE_DESC
push edx
call fcn.005597c0
lea eax, [esp + 8]
push eax
call fcn.00559740
push dword [esp + 0x24]
push dword [esp + 8]
call fcn.004f685a
and eax, eax
je 0x4ebc98
push dword [esp + 0x24]
call fcn.004f4ac4
and eax, eax
je 0x4ebbca
mov ebx, dword [esp]
cmp ebx, 0x186a0
jge 0x4ebbca
mov eax, 1
jmp 0x4ebbcc
xor eax, eax
and eax, eax
je 0x4ebc8f
push dword [esp + 0x24]
call fcn.004e0277
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, dword [0x9abaf4]
cdq
push edx
push eax
call fcn.005565d0
mov edx, 0x6fbc04
push edx
call fcn.005597c0
mov edx, dword [0x9abe38]
push edx
call fcn.005597c0
mov edx, 0x6fbc04
push edx
call fcn.005597c0
mov edx, dword [0x9acaec]
push edx
call fcn.005597c0
mov edx, 0x6fbc04
push edx
call fcn.005597c0
mov edx, dword [0x9acb74]
push edx
call fcn.005597c0
mov edx, 0x6fbc04
push edx
call fcn.005597c0
mov edx, dword [0x9ab81c]
push edx
call fcn.005597c0
lea eax, [esp + 0x10]
push eax
call fcn.00559740
mov ebx, dword [esp]
inc ebx
mov dword [esp], ebx
mov edx, dword [esp + 0xc]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov ebx, dword [esp + 4]
mov ebp, dword [0x9af008]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00559740
jmp 0x4ebbab
push dword [esp + 0x24]
call fcn.004be154
mov eax, dword [esp]
jmp 0x4ebc9f
push dword [esp + 0xc]
call fcn.00559820
push dword [esp + 8]
call fcn.00559820
push dword [esp + 4]
call fcn.00559820
add esp, 0x10
pop ebx
pop ebp
ret 0xc
Function at 0x4f9881
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebx
xor eax, eax
push eax
push eax
mov eax, dword [esp + 0x10]
mov dword [0x9b3e20], eax
mov edx, 0x6fb198
lea ecx, [0x9abef0]
call fcn.0051f008
call fcn.00540620
mov ebx, eax
cmp ebx, 0x32
jge 0x4f9931
mov dword [esp], 0x400
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 8]
call fcn.00556460
lea eax, [0x9abef0]
push eax
call fcn.00559740
mov eax, str.Win.Ini
push eax
push dword [esp + 4]
mov eax, dword [0x9abef0]
push eax
mov eax, 0x6fb198
push eax
mov eax, str.DEVICE
push eax
mov eax, str.WINDOWS
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringW
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, 0x6fe984
push eax
push 1
push dword [0x9abef0]
call fcn.00556db0
lea eax, [0x9abef0]
push eax
call fcn.00559740
jmp 0x4f99ed
mov eax, 0x73e93e
push eax
push 0xffffffff
call fcn.00529fca
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x4f99ed
mov dword [esp], 0
lea eax, [esp]
push eax
push 0
mov eax, str.GetDefaultPrinterW
push eax
push dword [esp + 0x10]
call fcn.0052a080
mov ebx, eax
and ebx, ebx
jne 0x4f9988
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x7a
jne 0x4f9988
mov eax, 1
jmp 0x4f998a
xor eax, eax
and eax, eax
je 0x4f99e4
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 8]
call fcn.00556460
lea eax, [0x9abef0]
push eax
call fcn.00559740
lea eax, [esp]
push eax
mov eax, dword [0x9abef0]
push eax
mov eax, str.GetDefaultPrinterW
push eax
push dword [esp + 0x10]
call fcn.0052a080
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
jne 0x4f99e4
mov edx, 0x6fb198
lea ecx, [0x9abef0]
call fcn.0051f008
push dword [esp + 4]
call fcn.00529f0a
mov edx, dword [0x9abef0]
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4f9a18
add esp, 8
pop ebx
ret
Function at 0x4fdcd4
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0051f000
push dword [0x9b3e20]
mov edx, str.rundll32.exe_shell32.dll__Control_RunDLL
push edx
call fcn.005597c0
mov edx, dword [esp + 4]
push edx
call fcn.005597c0
add dword [0x9b3e20], 2
lea eax, [esp + 8]
push eax
call fcn.00559740
push dword [0x9b3e20]
push 1
push dword [0x9b3e20]
mov eax, dword [esp + 0x10]
push eax
call fcn.004efd4c
mov edx, dword [0x9a36fc]
add dword [esp], edx
call sub.KERNEL32.dll_WinExec
pop dword [0x9b3e20]
jmp 0x4fdd43
push dword [esp + 4]
call fcn.00559820
push dword [esp]
call fcn.00559820
add esp, 8
ret 4
Function at 0x51229d
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push 0
push 0
call sub.WININET.dll_InternetGetConnectedState
mov dword [esp], eax
push dword [esp]
pop eax
mov dword [0x9acd44], eax
mov ebx, dword [0x9acd44]
and ebx, ebx
jne 0x5122ce
mov eax, 1
jmp 0x5122d0
xor eax, eax
mov dword [0x9ad990], eax
mov eax, dword [esp]
jmp 0x5122dc
add esp, 8
pop ebx
ret

Function at 0x51bf66
Capabilities:
Get geographical location

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x18]
mov dword [0x9b3e20], eax
mov edx, 0x6fb198
lea ecx, [esp]
call fcn.0051f008
push 0
push 0
push 0xe
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoW
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x51c00c
mov ebx, dword [esp + 4]
add ebx, ebx
push ebx
call fcn.005584b0
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x51c00c
push dword [esp + 4]
push dword [esp + 0x10]
push 0xe
push 0x400
call sub.KERNEL32.dll_GetLocaleInfoW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x51c003
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x10]
push dword [esp + 0x18]
call fcn.005588a0
lea eax, [esp + 4]
push eax
call fcn.00559740
push dword [esp + 0xc]
call fcn.005585f0
mov edx, dword [esp]
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x51c034
push dword [esp]
call fcn.00559820
add esp, 0x10
pop ebx
ret