joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466204
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46621b
add esp, 0xfffffff0
call fcn.004c1be8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004ad134
mov eax, dword [0x517f54]
cmp word [eax + 2], 0
jne 0x466243
mov eax, dword [0x517f54]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00467850
mov eax, dword [0x517f58]
cmp word [eax + 2], 0
jne 0x46625d
mov eax, dword [0x517f58]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00467a48
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4a293c]
call fcn.004c1854
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4a293c]
call fcn.004c1854
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], SafeArrayCopy
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x453068]
call fcn.0045a8fc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4663e4
mov eax, dword [0x518194]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0045accc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x467fc8
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x518194]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004b4e80
test eax, eax
je 0x466352
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004b126c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004b4ea8
test eax, eax
je 0x466366
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.004c2638
mov eax, dword [0x51819c]
cmp byte [eax], 0
jne 0x46639a
mov eax, ebx
call fcn.0046650c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004681a4
mov eax, ebx
call fcn.00468b54
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4663da
call fcn.004c1c40
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466780
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x60e888]
cmp dword [eax + 0x30], 0
je 0x46682a
cmp dword [ebx + 0x94], 0
jne 0x466824
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x466710
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x466824
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x4667ea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x466824
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004a50a8
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4667f9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x467308
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46733d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004c24c0
jmp 0x46734a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004c2424
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x468380
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4683c1
mov eax, esi
call fcn.0047b930
test al, al
je 0x4683c1
mov eax, dword [ebx + 0x84]
call fcn.0047b62c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4683c1
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047b62c
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret
Function at 0x46e974
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004c2870
xor eax, eax
push ebp
push 0x46eaa2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x46ea75
xor eax, eax
push ebp
push 0x46ea6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c2688
inc eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46ea43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x46ea32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c2688
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004c2880
mov edx, ebx
pop ecx
call fcn.004c0a58
call sub.USER32.DLL_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ea39
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x517ef4]
mov dl, 1
mov eax, dword [0x4afa04]
call fcn.004b420c
call fcn.004c2030
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46eaa9
lea eax, [ebp - 4]
call fcn.004c23d0
ret
Function at 0x46eab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ec61
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004c2a70
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x46ec78
call fcn.004c26d4
mov eax, ebx
call fcn.004ad758
mov edi, eax
dec edi
test edi, edi
jl 0x46eb68
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004ad72c
mov edx, dword [0x440abc]
call fcn.004c1a10
test al, al
je 0x46eb64
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004ad72c
lea edx, [ebp - 0x14]
call fcn.00474e70
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004c2a70
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004c2748
inc esi
dec edi
jne 0x46eb16
mov al, byte [0x46ec7c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x46ec88
mov eax, dword [ebp - 0xc]
call fcn.004b54c0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004c2468
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00474e70
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x46ec78
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.00474e70
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x46ec78
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x46ec78
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x46ec94
call fcn.004b19a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ec68
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004c23f4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004c23f4
lea eax, [ebp - 0x14]
call fcn.004c23d0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004c23f4
ret
Function at 0x4729b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x60e92c], 0
je 0x472aff
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x517da8]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x472aff
mov eax, dword [0x60e930]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x60e92c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x472ace
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x60e92c]
call fcn.004a50a8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x472ac6
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x472ac6
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x472ac6
mov eax, dword [ebp - 0x14]
call fcn.0047b62c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x472ac6
push ebp
call fcn.0047296c
pop ecx
test al, al
jne 0x472ac6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x472a82
mov eax, dword [ebp - 0x14]
call fcn.0047a1c0
dec eax
jle 0x472ac6
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004c1a80
cmp byte [ebp - 1], 0
je 0x472ac6
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x472ac6
mov edx, dword [ebp - 0x14]
mov eax, dword [0x60e930]
call fcn.00472134
inc edi
dec ebx
jne 0x472a15
mov eax, dword [0x60e930]
cmp dword [eax + 8], 0
jle 0x472ae6
mov eax, dword [0x60e930]
call fcn.004721c4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x472aff
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004727d4
pop ecx
test al, al
jne 0x472aff
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476108
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x476154
mov eax, esi
call fcn.0045e82c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x476154
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x476154
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x476293
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x476194
cmp eax, 0x108
ja 0x476194
mov eax, esi
call fcn.0045e82c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47628a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x476293
jmp 0x47628a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x476273
cmp eax, 0x20a
ja 0x476273
test byte [esi + 0x50], 0x80
jne 0x4761c6
sub eax, 0x203
je 0x4761c3
sub eax, 3
je 0x4761c3
sub eax, 3
jne 0x4761c6
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4761da
dec eax
je 0x4761ef
dec eax
je 0x47620c
dec eax
je 0x4761ef
jmp 0x476213
mov ecx, ebx
mov eax, dword [0x517da8]
mov eax, dword [eax]
mov edx, esi
call fcn.00468238
jmp 0x47628a
cmp byte [esi + 0x5d], 1
jne 0x476205
mov eax, esi
mov si, 0xffed
call fcn.004c1a80
jmp 0x476293
or word [esi + 0x54], 1
jmp 0x47628a
and word [esi + 0x54], 0xfffe
jmp 0x47628a
mov eax, dword [0x60e8e8]
cmp byte [eax + 0x20], 0
je 0x47628a
mov eax, dword [0x60e8e8]
cmp dword [eax + 0x1c], 0
je 0x47628a
mov eax, dword [ebx]
mov edx, dword [0x60e8e8]
cmp eax, dword [edx + 0x1c]
jne 0x47628a
lea eax, [ebp - 0x114]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0045e750
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004c1a80
jmp 0x476293
cmp eax, 0xb00b
jne 0x47628a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00474a10
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47985c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x479878
cmp dword [esi + 4], 0
je 0x4798a5
test byte [ebx + 0x55], 1
jne 0x479897
mov eax, ebx
call fcn.004784b4
test eax, eax
jne 0x479897
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4799b5
mov edx, esi
mov eax, ebx
call fcn.0047937c
jmp 0x4799b5
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4799ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0047b62c
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0047603c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0047985c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0047b62c
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4799b5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fed8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x517ff4]
cmp byte [eax + 0xc], 0
je 0x480045
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48003e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x60e93c], 0
jne 0x47ff2c
push 0x48004c
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x480054
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e93c], eax
cmp dword [0x511da0], 0
jne 0x480027
push 0x480064
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x511da0], eax
cmp dword [0x511da0], 0
je 0x480027
push 0x480070
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e940], eax
push 0x480080
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e944], eax
push 0x480094
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e948], eax
push 0x4800ac
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e94c], eax
push 0x4800c4
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e950], eax
push 0x4800d8
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e954], eax
push 0x4800f0
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e958], eax
push 0x480108
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e95c], eax
push 0x480124
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e960], eax
push 0x480130
mov eax, dword [0x511da0]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x60e964], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480045
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4866fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4867d4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x60e978], 0
jne 0x4867b8
lea eax, [ebp - 4]
mov edx, 0x4867ec
call fcn.004c2468
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004c2880
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4867b8
mov eax, ebx
call fcn.004c07f4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4867b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x48679b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4867fc
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x48679b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x60e978], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4867b8
mov eax, dword [ebp - 0xc]
call fcn.004c0814
ret
mov ebx, dword [0x60e978]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4867db
lea eax, [ebp - 4]
call fcn.004c23d0
ret

Function at 0x4ae1cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x60eae4
cmp dword [edi], 0
jne 0x4ae248
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x60eae0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x513614
mov ecx, 2
call fcn.004c0a58
mov edx, 0x4ae1a4
lea eax, [esi + 5]
call fcn.004ae1c4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004ae1c4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4ae21d
mov dword [0x60eae0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b0f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004c2880
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4b0f19
test al, 0x10
jne 0x4b0f1d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4b39a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4b39dd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004c24c0
jmp 0x4b39e6
mov eax, ebx
mov edx, esi
call fcn.004c2424
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b39f0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4b3a11
mov al, byte [esp]
jmp 0x4b3a13
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4b4ee8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4b4f4c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004c2638
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004b0cd4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4f53
lea eax, [ebp - 0xc]
call fcn.004c23d0
ret

Function at 0x4c0be4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004c23d0
test esi, esi
jne 0x4c0c1a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004c24c0
jmp 0x4c0c38
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004c0a98
mov edi, eax
test esi, esi
je 0x4c0c38
cmp dword [ebx], 0
je 0x4c0c38
dec esi
jmp 0x4c0c21
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4c16f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x513b58]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4c178c
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4c176c
xor eax, eax
push ebp
push 0x4c1765
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4c17a8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c176c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x513b58]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x513b58], ax
mov esp, ebp
pop ebp
ret

Function at 0x4c2254
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x60ee08], 0
je 0x4c22b5
cmp word [0x60efdc], 0xd7b2
jne 0x4c227d
cmp dword [0x60efe4], 0
jbe 0x4c227d
mov eax, 0x60efd8
call dword [0x60eff4]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4c22dc
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x513b68], 0
jne 0x4c22d1
push 0
push 0x513bc0
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret