joyce8/EMBER2024-capa huggingface dataset:
Function at 0x92e8fa
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x92e90a
xor eax, eax
jmp 0x92ead3
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x92ea8b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9519a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x92e913
cmp dword [ebp + 0x10], 0
je 0x92eacd
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x9519a4]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x92ea91
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x40503c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffcd0
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x30], SysFreeString
mov dword [esp + 0x34], eax
mov eax, dword [0x454174]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], ecx
test eax, eax
jne 0x4061df
mov edx, dword [0x4a943c]
test edx, edx
je 0x4061df
mov ecx, dword [0x454184]
test ecx, ecx
je 0x405098
push str.Phase_One_correction..._n
mov eax, dword [0x4606dc]
push eax
call fcn.0042586c
add esp, 8
push 0
mov edx, dword [0x4a9420]
push edx
mov ecx, dword [0x4a9094]
push ecx
call fcn.00425620
add esp, 0xc
call fcn.00401580
mov word [0x4a909c], ax
push 1
push 6
mov eax, dword [0x4a9094]
push eax
call fcn.00425620
add esp, 0xc
push 0
call fcn.00401608
mov edx, dword [0x4a9420]
add eax, edx
push eax
mov ecx, dword [0x4a9094]
push ecx
call fcn.00425620
add esp, 0xc
call fcn.00401608
mov dword [esp], eax
call fcn.00401608
jmp 0x405db8
Function at 0x41a430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov cx, word [0x4a909c]
xor edx, edx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov eax, dword [0x4a9094]
mov word [ebp - 0x12], cx
push 0
push ebx
push eax
call fcn.00425620
add esp, 0xc
mov edx, dword [0x4a9094]
push edx
call fcn.00448c18
pop ecx
test eax, eax
jne 0x41a60f
mov ecx, dword [0x4a9094]
push ecx
call fcn.00448c18
pop ecx
sub eax, 0x4d
jne 0x41a60f
mov eax, dword [0x4a9094]
push eax
call fcn.00448c18
pop ecx
sub eax, 0x52
jne 0x41a60f
mov edx, dword [0x4a9094]
push edx
call fcn.00448c18
pop ecx
mov ecx, eax
shl ecx, 8
add ecx, eax
mov word [0x4a909c], cx
call fcn.00401608
add eax, ebx
add eax, 8
mov dword [ebp - 8], eax
jmp 0x41a5da
xor eax, eax
mov ebx, eax
mov esi, eax
cmp ebx, 4
jge 0x41a4f3
mov eax, dword [0x4a9094]
push eax
call fcn.00448c18
shl esi, 8
inc ebx
or eax, esi
cmp ebx, 4
mov esi, eax
pop ecx
jl 0x41a4da
call fcn.00401608
mov dword [ebp - 4], eax
sub esi, 0x505244
je 0x41a51c
sub esi, 0x40213
je 0x41a5a4
sub esi, 0x2edf0
je 0x41a547
jmp 0x41a5c0
push 1
push 8
mov edx, dword [0x4a9094]
push edx
call fcn.00425620
add esp, 0xc
call fcn.00401580
movzx ecx, ax
mov dword [ebp - 0xc], ecx
call fcn.00401580
movzx eax, ax
mov dword [ebp - 0x10], eax
jmp 0x41a5c0
call fcn.00401608
mov eax, 0x4a9335
mov edx, 0x45d0ea
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x41a572
test cl, cl
je 0x41a578
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x41a572
add eax, 2
add edx, 2
test cl, cl
jne 0x41a556
je 0x41a578
xor ebx, ebx
jmp 0x41a57d
mov ebx, 3
xor esi, esi
call fcn.00401580
movzx eax, ax
mov edx, esi
mov dword [ebp - 0x18], eax
sar edx, 1
xor edx, esi
inc esi
fild dword [ebp - 0x18]
xor edx, ebx
cmp esi, 4
fstp dword [edx*4 + 0x4cb684]
jl 0x41a57f
jmp 0x41a5c0
mov ecx, dword [0x4a9094]
push ecx
call fcn.0042576c
pop ecx
push eax
call fcn.00419a78
pop ecx
mov eax, dword [ebp - 8]
mov dword [0x4a9418], eax
push 0
mov edx, dword [ebp - 4]
add edi, edx
add edi, 8
push edi
mov ecx, dword [0x4a9094]
push ecx
call fcn.00425620
add esp, 0xc
mov eax, dword [0x4a9094]
push eax
call fcn.0042576c
pop ecx
mov edi, eax
mov edx, dword [ebp - 8]
cmp eax, edx
jl 0x41a4cf
mov dx, word [ebp - 0x12]
mov ecx, dword [ebp - 0xc]
mov dword [0x4a9528], ecx
mov eax, dword [ebp - 0x10]
mov dword [0x4a952c], eax
mov word [0x4a909c], dx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b7f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x4a9094]
push edx
call fcn.00425620
add esp, 0xc
call fcn.00401608
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, 0xff
ja 0x41b9da
jmp 0x41b9b3
call fcn.00401580
movzx esi, ax
call fcn.00401580
movzx edi, ax
mov eax, dword [0x4a9094]
push eax
call fcn.0042576c
pop ecx
mov dword [ebp - 8], eax
cmp esi, 0x100
jne 0x41b87a
call fcn.00401580
movzx edx, ax
mov dword [0x4a9528], edx
call fcn.00401580
movzx ecx, ax
mov dword [0x4a952c], ecx
jmp 0x41b99d
cmp esi, 0x121
jne 0x41b8b5
call fcn.00401580
movzx eax, ax
mov dword [0x4a9530], eax
call fcn.00401580
movzx edx, ax
mov dword [0x4a9534], edx
cmp edx, 0x10bc
jne 0x41b99d
add dword [0x4a9534], 3
jmp 0x41b99d
cmp esi, 0x130
jne 0x41b8f2
mov eax, dword [0x4a9094]
push eax
call fcn.00448c18
sar eax, 7
pop ecx
mov dword [0x4a944c], eax
mov ecx, dword [0x4a9094]
push ecx
call fcn.00448c18
pop ecx
and eax, 8
cmp eax, 1
sbb eax, eax
neg eax
mov dword [0x4a954c], eax
jmp 0x41b99d
cmp esi, 0x131
jne 0x41b929
mov dword [0x4a951c], 9
xor ebx, ebx
mov eax, dword [0x4a9094]
push eax
call fcn.00448c18
mov edx, 0x23
and al, 3
sub edx, ebx
inc ebx
pop ecx
cmp ebx, 0x24
mov byte [edx + 0x4a90cc], al
jb 0x41b906
jmp 0x41b99d
cmp esi, 0x2ff0
jne 0x41b955
xor ebx, ebx
call fcn.00401580
movzx eax, ax
mov dword [ebp - 0xc], eax
mov edx, ebx
fild dword [ebp - 0xc]
xor edx, 1
inc ebx
cmp ebx, 4
fstp dword [edx*4 + 0x4cb684]
jb 0x41b933
jmp 0x41b99d
cmp esi, 0xc000
jne 0x41b99d
cmp edi, 0x4e20
jbe 0x41b99d
movsx ebx, word [0x4a909c]
mov word [0x4a909c], 0x4949
call fcn.00401608
mov esi, eax
mov edx, dword [0x4a952c]
cmp eax, edx
ja 0x41b975
mov dword [0x4a9534], esi
call fcn.00401608
mov dword [0x4a9530], eax
mov word [0x4a909c], bx
push 0
mov ecx, dword [ebp - 8]
add edi, ecx
push edi
mov eax, dword [0x4a9094]
push eax
call fcn.00425620
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test edx, edx
jne 0x41b832
mov ecx, dword [0x4a944c]
shl dword [0x4a9530], cl
mov ecx, dword [0x4a944c]
sar dword [0x4a9534], cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41cd18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov ecx, 4
lea edx, [ebp - 8]
push ebx
push esi
push edi
lea edi, [ebp - 0x2c]
mov esi, 0x459ddc
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4a9094]
mov ebx, 2
push eax
push 2
push 2
push edx
call fcn.004256d0
add esp, 0x10
sub dword [ebp + 8], 2
jmp 0x41cdf3
mov ecx, dword [0x4a9094]
mov eax, ebx
push ecx
lea edx, [ebp - 8]
push 1
add eax, eax
add eax, edx
push 2
push eax
call fcn.004256d0
lea edx, [ebp - 0x2c]
lea ecx, [ebp + ebx*2 - 8]
mov dword [ebp - 0x1c], edx
lea edx, [ebp + ebx*2 - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
add esp, 0x10
xor eax, eax
lea edx, [ebp - 8]
mov ecx, ebx
mov esi, eax
xor ecx, 2
mov edi, ebx
movzx ecx, byte [edx + ecx*2]
shl ecx, 8
cmp esi, 1
sbb esi, esi
xor edi, 2
neg esi
lea edi, [ebp + edi*2 - 8]
movzx esi, byte [edi + esi]
or ecx, esi
mov esi, eax
cmp esi, 1
mov edi, dword [ebp - 0x18]
sbb esi, esi
inc eax
neg esi
inc edx
movzx esi, byte [edi + esi]
mov edi, dword [ebp - 0x14]
movzx edi, byte [edi]
shl edi, 8
or esi, edi
sub ecx, esi
mov dword [ebp - 0x30], ecx
fild dword [ebp - 0x30]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
fadd qword [ecx]
fstp qword [ecx]
add dword [ebp - 0x1c], 8
inc dword [ebp - 0x14]
cmp eax, 2
jl 0x41cd8a
inc ebx
and ebx, 3
mov eax, dword [ebp + 8]
add dword [ebp + 8], 0xffffffff
test eax, eax
jne 0x41cd54
fld qword [ebp - 0x2c]
fcomp qword [ebp - 0x24]
fnstsw ax
sahf
jae 0x41ce13
mov ax, 0x4d4d
jmp 0x41ce17
mov ax, 0x4949
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433c90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x433cc9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00443150
jmp 0x433cd2
mov eax, ebx
mov edx, esi
call fcn.004430b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433cdc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x433cfd
mov al, byte [esp]
jmp 0x433cff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4350a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x43510c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004432c8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00431174
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435113
lea eax, [ebp - 0xc]
call fcn.00443060
ret

Function at 0x4423b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x460e44]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x442450
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x442430
xor eax, eax
push ebp
push 0x442429
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x44246c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442430
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x460e44]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x460e44], ax
mov esp, ebp
pop ebp
ret

Function at 0x442ee4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f1e3c], 0
je 0x442f45
cmp word [0x4f2010], 0xd7b2
jne 0x442f0d
cmp dword [0x4f2018], 0
jbe 0x442f0d
mov eax, 0x4f200c
call dword [0x4f2028]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x442f6c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x460e54], 0
jne 0x442f61
push 0
push 0x460eac
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x444838
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x444a68
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4448bb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x444a68
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4448bb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x444a84
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x444944
xor eax, eax
push ebp
push 0x44493d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00444680
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x444922
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x444aa4
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x444922
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444944
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x444a5e
cmp byte [ebp - 0xd], 0
jne 0x44498b
cmp byte [ebp - 0x12], 0
je 0x444a5e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4449a4
dec ebx
cmp byte [ebx], 0x2e
je 0x4449b3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4449a3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x444a5e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4449f0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x444a5e
cmp byte [ebp - 0xd], 0
je 0x444a5e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x444a5e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446100
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x448024
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x448043
mov eax, dword [0x461bb4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x448050
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x44807d
je 0x44808f
sub ecx, 0x100
je 0x44809d
sub ecx, 0x100
je 0x4480a4
sub ecx, 0x100
je 0x448096
jmp 0x4480ab
sub ecx, 0x600
je 0x4480a4
sub ecx, 0x100
je 0x44808f
jmp 0x4480ab
mov edi, 1
jmp 0x4480b0
mov edi, 2
jmp 0x4480b0
mov edi, 4
jmp 0x4480b0
mov edi, 5
jmp 0x4480b0
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4480d7
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x46162c]
test al, 0x80
je 0x4480d0
mov ebx, 0x80
jmp 0x4480e9
mov ebx, 1
jmp 0x4480e9
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4480e9
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4480fb
je 0x448104
dec eax
je 0x44810d
jmp 0x448116
mov dword [ebp - 4], SysFreeString
jmp 0x448125
mov dword [ebp - 4], 0x40000000
jmp 0x448125
mov dword [ebp - 4], 0xc0000000
jmp 0x448125
push 1
call fcn.00448ba0
pop ecx
mov ebx, eax
jmp 0x448215
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x448141
sub eax, 0x10
je 0x448148
sub eax, 0x10
je 0x448151
sub eax, 0x10
je 0x44815a
jmp 0x44815a
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x448161
mov dword [ebp - 8], 1
jmp 0x448161
mov dword [ebp - 8], 2
jmp 0x448161
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x4481ce
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4481c3
test byte [ebp + 0xd], 1
je 0x4481be
mov ebx, 0x50
jmp 0x4481c3
mov ebx, 2
push ebx
call fcn.00448ba0
pop ecx
mov ebx, eax
jmp 0x448215
mov edi, esi
push edi
call fcn.00447bfc
pop ecx
test eax, eax
je 0x4481e2
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4481ee
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004488e4
add esp, 8
mov ebx, eax
inc eax
jne 0x448215
push 4
call fcn.00448ba0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4487a4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4487e9
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x4487d8
cmp eax, dword [ebp + 0x10]
jle 0x448872
mov dword [0x462ee4], 8
xor eax, eax
jmp 0x4488dd
cmp dword [0x4f2cfc], 1
jne 0x44882e
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x448872
xor eax, eax
jmp 0x4488dd
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x44886e
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0x448872
xor eax, eax
jmp 0x4488dd
lea edx, [ebp - 0x10c]
push edx
call fcn.00446864
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x448892
mov dword [0x462ee4], 0x22
xor eax, eax
jmp 0x4488dd
test edi, edi
jne 0x4488b4
mov edx, dword [ebp + 0x10]
push edx
call fcn.004456b8
pop ecx
mov edi, eax
test eax, eax
jne 0x4488b4
mov dword [0x462ee4], 8
xor eax, eax
jmp 0x4488dd
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44a028
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
call fcn.00448f8c
pop ecx
mov edi, eax
cmp eax, 0xffffffff
jne 0x44a04a
or eax, 0xffffffff
jmp 0x44a0c1
test esi, esi
jne 0x44a072
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GetLocalTime
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_SystemTimeToFileTime
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x44a09f
lea ecx, [ebp - 8]
push ecx
mov eax, dword [esi]
push eax
call fcn.00449ec8
add esp, 8
mov ebx, eax
cmp eax, 1
jne 0x44a0b3
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [esi + 4]
push ecx
call fcn.00449ec8
add esp, 8
mov ebx, eax
cmp eax, 1
jne 0x44a0b3
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x10]
push eax
push edi
call sub.KERNEL32.DLL_SetFileTime
mov ebx, eax
cmp ebx, 1
jne 0x44a0bc
xor eax, eax
jmp 0x44a0c1
call fcn.00448c04
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret