joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4484f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x448527
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.004485d3
add esp, 0xc
jmp 0x4485cf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4485a8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x448589
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff4
jle 0x4485a6
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0
je 0x44859b
jmp 0x4485a6
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xffffffff
jmp 0x44857e
jmp 0x4485cf
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x4485cf
push 0x1cd5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x4543d7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4544f7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x454419
push 0x414
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4544f5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, 0xe662
sub edx, dword [ecx]
cmp dword [eax], edx
jl 0x45444b
mov dword [ebp - 0xc], 1
jmp 0x45444f
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 1
jg 0x454466
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x454466
mov dword [ebp - 0x10], 1
jmp 0x45446a
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x5ccb9725
jl 0x45447c
mov dword [ebp - 0x14], 1
jmp 0x454480
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
imul ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
jg 0x454499
mov dword [ebp - 0x18], 1
jmp 0x45449d
and dword [ebp - 0x18], 0
imul eax, dword [ebp - 0x18], 0x43dd
test eax, eax
jne 0x4544b6
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4544b6
and dword [ebp - 0x1c], 0
jmp 0x4544bd
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jle 0x4544d0
mov dword [ebp - 0x20], 1
jmp 0x4544d4
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
jae 0x4544e3
mov dword [ebp - 0x24], 1
jmp 0x4544e7
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x454513
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
call fcn.00454a6a
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x454559
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4545ec
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x45459f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45459d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x4545ea
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4545cd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x4545ea
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.00420325
mov dword [eax], 0xc3203bd6
jmp 0x4545c2
jmp 0x45460d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x24]
push 0x2d69
push dword [ebp - 0x28]
call fcn.00454b15
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x45a818
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x45a840
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x4d98
push dword [ebp - 8]
push 1
call fcn.0045a8b7
add esp, 0xc
jmp 0x45a8b3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x45a8a6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x45a88a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x45a8a4
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.00420325
and dword [eax], 0
jmp 0x45a87f
jmp 0x45a8b3
push 0
push 0x18b8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret
Function at 0x460e31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x460e67
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x751b
push 0x3e3b
push 0x45f7
push 0x6b93
push 0
call fcn.0047550a
add esp, 0x18
jmp 0x460e8b
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x460e81
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x460e8b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov esp, ebp
pop ebp
ret
Function at 0x4660f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x466176
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46614c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x466174
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x466174
push 0
push 0xd
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x46618a
push 0x5115
push 0x6ab5
push 0
call fcn.00455333
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x47524d
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7617
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x475304
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4752e4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x4752c5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x4752e2
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.00420325
mov dword [eax], 1
jmp 0x4752ba
jmp 0x4752ff
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x4752ff
push 0
push 0x2075
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x4753db
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 0x7bce
mov dword [ebp - 0x48], str.msbxc_uxs_tzclvkowx_vvkxovzhq_wqjxyokg_yfbeux_sffpuv_hkebxpbx
cmp dword [ebp - 0x24], 0x7eac
jle 0x47538a
and dword [ebp - 0x1c], 0
jmp 0x475334
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x36e1
jge 0x47538a
and dword [ebp - 0x20], 0
jmp 0x47534a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2dd7
jge 0x475388
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.0040195e
pop ecx
pop ecx
mov ecx, eax
call fcn.004200e8
push eax
call fcn.004a11e7
pop ecx
lea ecx, [ebp - 0x68]
call fcn.004200de
jmp 0x475343
jmp 0x47532d
push dword [ebp - 0x40]
push 0
push dword [ebp - 0x44]
push 0x9b6
call fcn.0045480e
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7845
jge 0x4753b5
push dword [ebp - 0x48]
call fcn.004a11e7
pop ecx
jmp 0x4753d1
or dword [ebp - 4], 0xffffffff
jmp 0x4753db
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477dc2
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b763f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x5624
mov dword [ebp - 0x4c], str.oghdftpg_qupypmdf_fnep_iuv_dauv_bqx_hawf_wiejaki_iuqperi_wkjyj_elcaajla_lhvnzqiut_eqsvcthua_bdh
cmp dword [ebp - 0x20], 0x5949
jle 0x477e86
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
and dword [ebp - 0x1c], 0
jmp 0x477e14
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6a09
jge 0x477e86
and dword [ebp - 0x14], 0
jmp 0x477e2a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7bd3
jge 0x477e84
and dword [ebp - 0x18], 0
jmp 0x477e40
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3fa0
jge 0x477e82
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.0040195e
pop ecx
pop ecx
mov ecx, eax
call fcn.004200e8
push eax
call fcn.004a11e7
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.004200de
jmp 0x477e39
jmp 0x477e23
jmp 0x477e0d
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x477f03
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x477ec9
push 0
push 0x151
push 0x1071
push 0xf91
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x477f01
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov esi, dword [eax]
mov eax, dword [ebp - 0x44]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.00420325
mov dword [eax], esi
jmp 0x477f0b
push 1
call fcn.004569ac
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5336
jge 0x477f21
push dword [ebp - 0x4c]
call fcn.004a11e7
pop ecx
jmp 0x477f3d
or dword [ebp - 4], 0xffffffff
jmp 0x477f47
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47a812
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b76cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x5f89
mov dword [ebp - 0x2c], str.hengl_xiwb_qnnhb_mxttrpney_opog_zryz_hhqjfjyo_iqscjui_cppxwyyg_usfypyvsw_vvoh_lmmvzt_aomjbj
cmp dword [ebp - 0x24], 0x5fec
jle 0x47a90b
and dword [ebp - 0x1c], 0
jmp 0x47a862
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7f7f
jge 0x47a8fa
and dword [ebp - 0x14], 0
jmp 0x47a87c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7338
jge 0x47a8f5
and dword [ebp - 0x18], 0
jmp 0x47a892
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x283c
jge 0x47a8f3
and dword [ebp - 0x20], 0
jmp 0x47a8a8
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7bd5
jge 0x47a8f1
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
sar eax, cl
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.0040195e
pop ecx
pop ecx
mov ecx, eax
call fcn.004200e8
push eax
call fcn.004a11e7
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.004200de
jmp 0x47a8a1
jmp 0x47a88b
jmp 0x47a875
jmp 0x47a85b
push 0
push 0x1167
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x47a91a
call fcn.00479e8a
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5f4c
jge 0x47a930
push dword [ebp - 0x2c]
call fcn.004a11e7
pop ecx
jmp 0x47a94c
or dword [ebp - 4], 0xffffffff
jmp 0x47a956
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e911
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b76f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x47e998
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x47e969
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x47e967
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x47e993
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x47e993
push 0x18c
push 0
push 0
push 0x1502
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x47ea73
mov dword [ebp - 0x24], 0xda9
mov dword [ebp - 0x38], str.vlhfpwx_iabctyj_gcebk_ggtmgla_ownqbkw
cmp dword [ebp - 0x24], 0xf39
jle 0x47ea1a
and dword [ebp - 0x18], 0
jmp 0x47e9bc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7128
jge 0x47ea1a
and dword [ebp - 0x1c], 0
jmp 0x47e9d2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x15ce
jge 0x47ea18
and dword [ebp - 0x20], 0
jmp 0x47e9e8
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xcca
jge 0x47ea16
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
xor edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0xac67d8
call fcn.004200f3
jmp 0x47e9e1
jmp 0x47e9cb
jmp 0x47e9b5
push 0xbb2
push 1
push 0x43c1
push 0x4dea
call fcn.0045403c
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xae4
jge 0x47ea4d
mov edx, dword [ebp - 0x38]
mov ecx, 0xac67d8
call fcn.00421ea9
jmp 0x47ea69
or dword [ebp - 4], 0xffffffff
jmp 0x47ea73
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ea9b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b76fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x47ebda
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x47eaf7
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x47eaf2
push 0
push 0x18b8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x47ebd8
mov dword [ebp - 0x24], 0x7faa
mov dword [ebp - 0x2c], str.gqsbawkv_aezivs_vdvnzfzwn_xkstomcsm_yhw_ajoowx_xiqkaa_rgtisokbk_ukhrpc_lctkebo_dmenuxcu_bfyinghi_rgfsecun
cmp dword [ebp - 0x24], 0x8300
jle 0x47eb83
push 0xd88
call dword [sym.imp.USER32.dll_GetQueueStatus]
and dword [ebp - 0x18], 0
jmp 0x47eb26
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6171
jge 0x47eb83
and dword [ebp - 0x1c], 0
jmp 0x47eb3c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xdfe
jge 0x47eb81
and dword [ebp - 0x20], 0
jmp 0x47eb52
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x34f
jge 0x47eb7f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, 0xac67d8
call fcn.004200f3
jmp 0x47eb4b
jmp 0x47eb35
jmp 0x47eb1f
push 0x428
push 0xcdb
push 0x1b01
call dword [sym.imp.GDI32.dll_GetPixel]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7e4f
jge 0x47ebb2
mov edx, dword [ebp - 0x2c]
mov ecx, 0xac67d8
call fcn.00421ea9
jmp 0x47ebce
or dword [ebp - 4], 0xffffffff
jmp 0x47ebd8
jmp 0x47ec10
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push 0
push 0x14ea
push dword [ebp - 0x30]
push 0x7503
push 0x5498
push 0x1a69
push 0x2e17
push 0x3713
push 0x6876
call fcn.00480128
add esp, 0x24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f6fe
Capabilities:
Get geographical location
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b771b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x47f866
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x47f759
push 0
push 0xd
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x47f864
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x47f864
mov dword [ebp - 0x24], 0x301
mov dword [ebp - 0x3c], str.coemkvqxs_rombflnsy_yca_bziiey_zikqxewu_lavpf_iqlrb_keq_cyy_ltx_mohqgxjsb_ait_mtjzhny_kguskt
cmp dword [ebp - 0x24], 0x347
jle 0x47f813
and dword [ebp - 0x14], 0
jmp 0x47f79b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5572
jge 0x47f813
and dword [ebp - 0x18], 0
jmp 0x47f7b1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x11db
jge 0x47f811
and dword [ebp - 0x1c], 0
jmp 0x47f7c7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7261
jge 0x47f80f
and dword [ebp - 0x20], 0
jmp 0x47f7dd
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x14c0
jge 0x47f80d
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
and eax, ecx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0xac67d8
call fcn.004200f3
jmp 0x47f7d6
jmp 0x47f7c0
jmp 0x47f7aa
jmp 0x47f794
push 0x1cd5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xf7
jge 0x47f83e
mov edx, dword [ebp - 0x3c]
mov ecx, 0xac67d8
call fcn.00421ea9
jmp 0x47f85a
or dword [ebp - 4], 0xffffffff
jmp 0x47f864
jmp 0x47f8ac
lea eax, [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x47f895
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
jmp 0x47f8ac
push 0
push 0x1d2f
push 0x311
push 0x1c9
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x480592
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4805ca
push 1
push 0x275f
push 0x76c2
push 0x3856
push 0x3f74
push 0x12ff
push 0x634a
call fcn.00480617
add esp, 0x1c
jmp 0x480613
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x480606
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x480604
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x480613
push 0
push 0x18b8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret