joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455000
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4be778
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x502344]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [0x505fcc], ebx
je 0x4550a5
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], ebx
call fcn.0044d5f0
add esp, 4
mov dword [esp + 0x34], ebx
cmp dword [eax + 0x18], 0x10
mov edi, dword [edi + 0x14]
jb 0x455054
mov eax, dword [eax + 4]
jmp 0x455057
add eax, 4
mov edx, dword [0x505fcc]
push ebx
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x455088
mov eax, dword [esp + 0x14]
push eax
call fcn.0049cdc0
add esp, 4
mov ecx, dword [0x505fcc]
push ecx
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret

Function at 0x455a70
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push edi
call fcn.00412bf6
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x24]
push 0x1f6
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jle 0x455ae2
mov eax, dword [edi + 0x14]
mov ecx, edi
cmp esi, eax
ja 0x455ab0
push 0xffffffffffffffff
push esi
call fcn.00401816
jmp 0x455abc
mov edx, esi
push 0
sub edx, eax
push edx
call fcn.00413bad
cmp dword [edi + 0x18], 8
jb 0x455ad5
mov edi, dword [edi + 4]
inc esi
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop edi
pop esi
pop ebx
ret 4
inc esi
push esi
add edi, 4
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop edi
pop esi
pop ebx
ret 4
Function at 0x4560e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c0d66
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x502344]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push edi
mov eax, dword [0x502344]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
mov eax, dword [esp + 0x164]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0044d6e0
add esp, 8
xor ebx, ebx
mov dword [esp + 0x15c], ebx
cmp dword [esp + 0x40], ebx
jne 0x4561ea
push 0x103
lea ecx, [esp + 0x4d]
push ebx
push ecx
mov byte [esp + 0x54], bl
call fcn.0049d850
add esp, 0xc
push 0x104
lea edx, [esp + 0x4c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x48]
push eax
call fcn.0049d510
add esp, 4
push eax
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x34]
call fcn.00404d40
lea edx, [esp + 0xc]
push edx
lea edi, [esp + 0x30]
mov byte [esp + 0x10], 0x5c
call fcn.00456790
cmp eax, 0xffffffff
je 0x4561ea
push eax
lea eax, [esp + 0x14]
push eax
xor ecx, ecx
mov edx, edi
call fcn.00456720
mov byte [esp + 0x15c], 1
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.004050e8
mov byte [esp + 0x15c], bl
cmp dword [esp + 0x28], 0x10
jb 0x4561da
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0049cdc0
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], 0x10
mov eax, dword [esp + 0x30]
jae 0x4561f9
lea eax, [esp + 0x30]
mov edx, dword [esi]
push eax
push edx
call dword [sym.imp.dbghelp.dll_SymSetSearchPath]
cmp eax, 1
sete byte [esp + 0xc]
mov dword [esp + 0x15c], 0xffffffff
cmp dword [esp + 0x44], 0x10
jb 0x45622a
mov eax, dword [esp + 0x30]
push eax
call fcn.0049cdc0
add esp, 4
mov al, byte [esp + 0xc]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0049cdcb
add esp, 0x154
ret 4

Function at 0x456a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c433e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x502344]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.004568d0
mov dword [esp + 0x30], 1
mov ecx, dword [esp + 0x3c]
mov dx, word [esp + 0x40]
mov dword [esp + 0x20], ecx
mov word [esp + 0x24], dx
test esi, esi
jne 0x456a53
xor eax, eax
jmp 0x456a5c
push esi
call fcn.0049cf74
add esp, 4
push eax
push esi
lea eax, [esp + 0x14]
call fcn.00405cb4
mov eax, dword [esp + 0x44]
mov cx, word [esp + 0x48]
mov dx, word [esp + 0x4c]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov ax, word [esp + 0x50]
mov word [esp + 0x18], cx
mov cx, word [esp + 0x54]
add esi, 0x14
lea ebx, [esp + 0xc]
mov dword [esp + 0x14], 0
mov word [esp + 0x1a], dx
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], cx
call fcn.00456ed0
mov dword [esp + 0x30], 0xffffffff
mov edx, ebx
push edx
call fcn.00456930
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 0x20
Function at 0x4579cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
xor esi, esi
inc esi
cmp byte [ebp + 0x10], 0
push edi
mov eax, esi
je 0x4579e8
mov eax, 0x101
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
or dword [ebp - 0x2c], 0xffffffff
push 0x14
pop edi
push edi
mov ebx, eax
mov dword [ebp - 0x14], esi
call fcn.0049bd19
or dword [ebp - 0x24], 0xffffffff
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], edi
call fcn.0049bd19
pop ecx
pop ecx
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], edi
call fcn.0044e8b0
push edi
call fcn.0049bd19
and dword [ebp + 0x10], 0
pop ecx
mov dword [ebp - 0x20], eax
test ebx, ebx
jne 0x457b15
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, str.InstallLanguage
mov dword [ebp - 0x10], ebx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, 0xea
jne 0x457ac2
lea esi, [ebp - 0x2c]
call fcn.0044e8b0
push dword [ebp - 0xc]
call fcn.0049bd19
pop ecx
lea esi, [ebp - 0x24]
mov dword [ebp - 0x28], eax
call fcn.0044e8b0
push dword [ebp - 8]
call fcn.0049bd19
pop ecx
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
sub esi, ebx
inc eax
mov cl, byte [esi + eax]
mov dl, byte [eax]
cmp cl, dl
jl 0x457b08
jg 0x457b08
test cl, cl
je 0x457ade
test dl, dl
jne 0x457aca
mov ebx, dword [ebp - 0x20]
or dword [ebp + 0x10], 0xffffffff
lea eax, [ebp + 0x10]
push eax
call fcn.0044e960
pop ecx
mov edi, eax
lea esi, [ebp - 0x24]
call fcn.0044e8b0
lea esi, [ebp - 0x2c]
call fcn.0044e8b0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
inc dword [ebp + 0x10]
cmp dword [ebp - 0x1c], 0
je 0x457a5a
xor edi, edi
jmp 0x457af1
Function at 0x45a197
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x502344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test byte [eax + 0x6c], 1
jne 0x45a1b4
xor al, al
jmp 0x45a22a
push edi
push eax
call fcn.0045afb9
mov edi, eax
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
cmp ecx, 3
jl 0x45a1f3
test ecx, ecx
jge 0x45a1d5
push 0x80070057
call fcn.00405c7a
cmp word [eax], 0x5c
jne 0x45a1f7
cmp ecx, 1
jl 0x45a1cb
cmp word [eax + 2], 0x5c
jne 0x45a1f7
cmp ecx, 2
jl 0x45a1cb
cmp word [eax + 4], 0x5c
je 0x45a1f7
xor al, al
jmp 0x45a229
push esi
xor esi, esi
test esi, esi
jl 0x45a1cb
mov ecx, esi
mov eax, edi
call fcn.0044de70
mov word [ebp + esi*2 - 0xc], ax
inc esi
cmp esi, 3
jl 0x45a1fa
xor eax, eax
mov word [ebp - 6], ax
pop esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
setne al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049cdcb
leave
ret 4

Function at 0x45a238
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push ebx
call fcn.0045afb9
lea esi, [ebp - 4]
mov edi, eax
call fcn.0044f1c0
push 0x5c
mov esi, edi
call fcn.00438b7f
lea edx, [eax + 1]
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.00438b9d
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00438d54
lea ecx, [ebp - 0xc]
call fcn.004058e3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45a298
push 0x80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [edi]
push 0
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x45a2b2
xor esi, esi
inc esi
mov dword [ebx + 0x10], esi
jmp 0x45a322
push edi
push 3
lea esi, [ebx + 0x18]
pop eax
mov ecx, esi
call fcn.00465761
lea ecx, [ebp - 8]
call fcn.00409513
lea eax, [ebp - 0xc]
push eax
mov edi, esi
call fcn.004657e8
push dword [eax]
lea eax, [ebp - 8]
push dword [ebp - 4]
push str.__s___s
push eax
call fcn.0043e52f
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.004058e3
lea eax, [ebx + 0x138]
call fcn.004654d3
xor esi, esi
push esi
push 0x20
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0046020e
add esp, 0x14
test al, al
jne 0x45a31a
inc esi
mov dword [ebx + 0x10], esi
lea ecx, [ebp - 8]
call fcn.004058e3
lea ecx, [ebp - 4]
call fcn.004058e3
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x45ccd8
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push edi
mov edi, eax
cmp byte [edi + 0xb4], 0
mov dword [edi], 0x4dbc54
mov dword [edi + 4], 0x4dbc58
je 0x45cd7a
lea esi, [edi + 0x80]
cmp dword [esi], 3
je 0x45cd2b
call fcn.0045decb
mov esi, dword [esi]
cmp esi, 2
je 0x45cd2b
cmp esi, 1
je 0x45cd2b
mov eax, dword [edi + 0x44]
mov ecx, eax
shr ecx, 3
test cl, 1
jne 0x45cd26
shr eax, 6
test al, 1
je 0x45cd2b
call fcn.0045d30e
push ebx
mov ebx, dword [edi + 0x9c]
xor esi, esi
test ebx, ebx
jle 0x45cd56
push ebp
lea ebp, [edi + 0x98]
mov eax, esi
mov ecx, ebp
call fcn.0045eeaa
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, ebx
jl 0x45cd3f
pop ebp
mov esi, dword [edi + 0xa8]
dec esi
js 0x45cd79
lea ebx, [edi + 0xa4]
mov eax, esi
mov ecx, ebx
call fcn.0045eeaa
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
dec esi
jns 0x45cd65
pop ebx
lea ecx, [edi + 0xcc]
call fcn.004058e3
lea ecx, [edi + 0xc8]
call fcn.004058e3
lea ecx, [edi + 0xb8]
call fcn.004058e3
lea ecx, [edi + 0xb0]
call fcn.004058e3
lea esi, [edi + 0xa4]
call fcn.00439f1d
lea esi, [edi + 0x98]
call fcn.00439f1d
lea esi, [edi + 0x8c]
call fcn.0045ef61
mov eax, dword [edi + 0x74]
test eax, eax
je 0x45cdd9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi + 0x74], 0
lea esi, [edi + 0x68]
call fcn.0045ef27
lea ecx, [edi + 0x64]
call fcn.004058e3
lea ecx, [edi + 0x60]
call fcn.004058e3
lea ecx, [edi + 0x5c]
call fcn.004058e3
lea ecx, [edi + 0x58]
call fcn.004058e3
lea ecx, [edi + 0x54]
pop edi
pop esi
jmp fcn.004058e3

Function at 0x45d30e
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [edi + 0x5c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041f0fb
mov eax, dword [edi + 0x44]
xor edx, edx
inc edx
test dl, al
jne 0x45d35f
shr eax, 3
movzx ecx, al
and al, dl
and ecx, edx
movzx eax, al
add ecx, ecx
or ecx, edx
neg eax
sbb eax, eax
and eax, 7
push ecx
push eax
mov eax, edi
call fcn.0045d94b
lea ecx, [edi + 0x68]
call fcn.0045ee15
mov esi, eax
lea eax, [ebp - 8]
add esi, 0x18
push eax
jmp 0x45d3a7
shr eax, 6
test dl, al
je 0x45d3c3
lea esi, [ebp - 8]
mov ecx, edi
call fcn.0045eca9
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00438d54
mov ecx, esi
call fcn.004058e3
lea eax, [ebp - 4]
call fcn.0044f180
push 6
mov eax, edi
call fcn.0045d98f
lea ecx, [edi + 0x8c]
call fcn.0046596a
lea ecx, [ebp - 8]
push ecx
mov esi, eax
call fcn.0044f580
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00438d54
lea ecx, [ebp - 8]
call fcn.004058e3
lea eax, [ebp - 4]
push eax
call fcn.0044f8f0
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 4]
call fcn.004058e3
xor eax, eax
pop esi
leave
ret
Function at 0x45decb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edi + 0x44]
sub esp, 0x10
test al, 1
je 0x45dee3
shr eax, 6
test al, 1
je 0x45dfa3
mov eax, dword [edi + 0x6c]
and dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x45dfa3
push ebx
push esi
mov eax, dword [ebp - 8]
lea ecx, [edi + 0x68]
call fcn.0045ee15
mov esi, eax
cmp byte [esi + 0x1c], 0
je 0x45df92
mov eax, dword [esi]
cmp eax, 1
je 0x45df2a
cmp eax, 3
je 0x45df2a
cmp eax, 0x64
jb 0x45df45
cmp dword [edi + 0x80], 2
jne 0x45df45
jmp 0x45df92
mov eax, dword [edi + 0x80]
cmp eax, 4
je 0x45df45
cmp eax, 2
je 0x45df92
cmp eax, 1
je 0x45df92
test byte [esi + 8], 1
jne 0x45df92
lea ebx, [edi + 0x5c]
push ebx
lea eax, [ebp - 4]
push eax
call fcn.0041f0fb
mov esi, dword [esi + 0x18]
push dword [esi - 0xc]
lea eax, [ebp - 4]
push esi
call fcn.00438d54
lea esi, [ebp - 4]
call fcn.0040d3d2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0044f580
pop ecx
push eax
call fcn.0044fd50
pop ecx
pop ecx
lea ecx, [ebp - 0xc]
call fcn.004058e3
mov ecx, esi
call fcn.004058e3
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jl 0x45def7
pop esi
pop ebx
leave
ret
Function at 0x45dfa5
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, 0x400
push ebx
mov esi, eax
call fcn.0049bd19
mov edi, eax
xor edx, edx
pop ecx
mov dword [esp + 0x14], edi
cmp edi, edx
jne 0x45dfd4
push edx
call fcn.0049d65c
pop ecx
push 3
jmp 0x45e15f
mov dword [esp + 0x18], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
inc dword [esp + 0x18]
add dword [esp + 0x1c], 0xa
add eax, ebx
cmp dword [esp + 0x18], 1
mov dword [esp + 0x24], eax
jle 0x45e002
sub eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x74]
push 2
push edx
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x45e13f
mov eax, dword [esi + 0x74]
push 0
lea ecx, [esp + 0x24]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45e13f
cmp dword [esp + 0x20], ebx
jne 0x45e13f
xor eax, eax
jmp 0x45e04a
mov edi, dword [esp + 0x14]
xor ecx, ecx
add edi, eax
mov dl, byte [edi]
cmp dl, byte [ecx + str.ADVINSTSFX]
jne 0x45e05f
inc ecx
inc edi
cmp ecx, 0xa
jl 0x45e04e
cmp ecx, 0xa
jne 0x45e06f
lea ecx, [eax + ebp - 0x40]
mov dword [esp + 0x28], ecx
add eax, 0xa
inc eax
cmp eax, 0x3f6
jb 0x45e046
mov edi, dword [esp + 0x28]
xor ebp, ebp
cmp edi, ebp
jne 0x45e08c
mov edi, dword [esp + 0x14]
xor edx, edx
jmp 0x45dfe4
mov eax, dword [esi + 0x74]
push ebp
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x45e0be
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x54]
push ecx
push 0x103
push esi
mov ebx, eax
call fcn.0045ece8
push dword [esp + 0x14]
jmp 0x45e157
mov eax, dword [esi + 0x74]
push ebp
lea ecx, [esp + 0x24]
push ecx
push 0x4c
lea ecx, [esi + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45e117
cmp dword [esp + 0x20], ebp
je 0x45e117
xor eax, eax
movzx ecx, byte [esi + eax + 0x48]
movsx edx, byte [eax + str.ADVINSTSFX]
cmp ecx, edx
jne 0x45e113
inc eax
cmp eax, 0xa
jl 0x45e0e0
cmp dword [esi + 0x14], 0x64
jne 0x45e113
sub edi, dword [esi + 0x18]
push dword [esp + 0x14]
mov dword [esi + 0x88], edi
call fcn.0049d65c
pop ecx
xor eax, eax
jmp 0x45e160
push 5
jmp 0x45e130
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x54]
push ecx
push 0x103
push esi
mov ebx, eax
call fcn.0045ece8
push 2
pop esi
push dword [esp + 0x14]
call fcn.0049d65c
pop ecx
mov eax, esi
jmp 0x45e160
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x54]
push ecx
push 0x103
push esi
mov ebx, eax
call fcn.0045ece8
push edi
call fcn.0049d65c
pop ecx
push 2
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x45e168
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
push edi
cmp dword [esi + 0x10], ebx
jne 0x45e17d
xor eax, eax
pop edi
pop ebx
leave
ret
mov ecx, dword [esi + 0x88]
add ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x74]
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x45e1b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x54]
push ecx
push 0x103
push esi
mov ebx, eax
call fcn.0045ece8
push 2
pop eax
jmp 0x45e179
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00409513
mov byte [ebp - 0x10], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [esi + 0x10], ebx
jbe 0x45e286
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x74]
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0x18
lea ecx, [ebp - 0x2c]
push ecx
push eax
call edi
test eax, eax
je 0x45e28f
cmp dword [ebp - 0xc], ebx
je 0x45e28f
cmp dword [ebp - 4], ebx
je 0x45e219
push dword [ebp - 4]
call fcn.0049d65c
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
inc eax
push ecx
call fcn.0045ed21
test al, al
je 0x45e28a
mov eax, dword [esi + 0x74]
push ebx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, ecx
push ecx
push dword [ebp - 4]
push eax
call edi
test eax, eax
je 0x45e28f
cmp dword [ebp - 0xc], ebx
je 0x45e28f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
xor eax, eax
mov word [edx + ecx*2], ax
lea eax, [ebp - 0x2c]
lea ebx, [esi + 0x68]
push eax
call fcn.0045ed7b
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.0045ee15
push dword [ebp - 4]
add eax, 0x18
push eax
call fcn.00405d31
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
xor ebx, ebx
cmp eax, dword [esi + 0x10]
jb 0x45e1e6
xor edi, edi
jmp 0x45e2a9
push 3
pop edi
jmp 0x45e2a9
push 2
pop edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x54]
push ecx
push 0x103
push esi
mov ebx, eax
call fcn.0045ece8
push dword [ebp - 4]
call fcn.0049d65c
pop ecx
lea ecx, [ebp - 0x14]
call fcn.004058e3
mov eax, edi
jmp 0x45e179
Function at 0x45e2c1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
cmp dword [edi + 0x90], esi
jle 0x45e2da
xor eax, eax
jmp 0x45e42e
mov ecx, dword [edi + 0x88]
add ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x74]
push esi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x45e314
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi + 0x54]
push ecx
push 0x103
push edi
mov ebx, eax
call fcn.0045ece8
push 2
pop eax
jmp 0x45e42e
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
cmp dword [edi + 8], esi
jbe 0x45e423
mov eax, dword [edi + 0x74]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 8]
push ecx
push 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call ebx
test eax, eax
je 0x45e409
cmp dword [ebp - 8], esi
je 0x45e409
lea ecx, [ebp - 0x1c]
call fcn.00409513
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 4], esi
je 0x45e370
push dword [ebp - 4]
call fcn.0049d65c
pop ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
inc eax
push ecx
call fcn.0045ed21
test al, al
je 0x45e3dc
mov eax, dword [edi + 0x74]
push esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, ecx
push ecx
push dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x45e3e8
cmp dword [ebp - 8], esi
je 0x45e3e8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
push eax
mov word [eax + edx*2], cx
lea eax, [ebp - 0x1c]
push eax
call fcn.00405d31
lea esi, [edi + 0x8c]
lea ebx, [ebp - 0x1c]
call fcn.0045ee36
mov ecx, ebx
call fcn.004058e3
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor esi, esi
cmp eax, dword [edi + 8]
jb 0x45e329
jmp 0x45e423
lea ecx, [ebp - 0x1c]
call fcn.004058e3
push 3
jmp 0x45e422
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi + 0x54]
push ecx
push 0x103
push edi
mov ebx, eax
call fcn.0045ece8
lea ecx, [ebp - 0x1c]
call fcn.004058e3
jmp 0x45e420
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi + 0x54]
push ecx
push 0x103
push edi
mov ebx, eax
call fcn.0045ece8
push 2
pop esi
push dword [ebp - 4]
call fcn.0049d65c
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45f581
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
call fcn.00409513
movzx ebx, word [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0x4d3214
push 2
push ebx
call edi
mov esi, eax
lea eax, [esi - 1]
push eax
push 0x78
pop ecx
lea edx, [ebp - 4]
call fcn.0043dc64
push esi
lea esi, [ebp - 4]
call fcn.0040d3d2
push eax
push 2
push ebx
call edi
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x4dbd50
push dword [ebp + 8]
call fcn.0043e52f
add esp, 0x10
mov ecx, esi
call fcn.004058e3
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45f9f7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x45fa7e
push esi
call fcn.0049bd19
mov edi, eax
pop ecx
test edi, edi
jne 0x45fa36
push 8
pop esi
push edi
call fcn.0049d65c
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45fa7e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4d9c10
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45fa87
cmp dword [ebp - 0x10], 0
je 0x45fa87
mov eax, dword [ebp - 8]
test ebx, ebx
je 0x45fa70
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x45fa87
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
jmp 0x45fa87
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
jmp 0x45fa29