joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e835
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44e94d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44e94d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004631da
mov esi, eax
test esi, esi
je 0x44e94d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44e94d
mov ecx, esi
call fcn.0044e7a0
cmp edi, eax
jge 0x44e94d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44e8d3
mov dword [esp + 0x34], 1
jmp 0x44e92e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44e94d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044dda0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x463b7d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463bb5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00461c34
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461c0c
jmp 0x463bc1
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465272
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4652b4
call fcn.0046ad27
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4652b4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4652ab
xor eax, eax
jmp 0x4652bc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004652c2
pop edi
pop esi
pop ebx
ret 4
Function at 0x46b257
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46b285
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46b2a3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046b1bd
jmp 0x46b2a3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46b2a3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046b1bd
test edi, edi
mov eax, edi
jne 0x46b28d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403e2a
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x47c000], 0
push ebx
push ebp
push esi
push edi
mov ebx, pe_overlay
mov edi, 0x47c000
je 0x403e49
push edi
call fcn.0040620a
jmp 0x403e4f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [0x44ba84]
mov ecx, esi
dec esi
test ecx, ecx
je 0x403ea3
mov ecx, dword [0x44ba48]
mov ecx, dword [ecx + 0x64]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x44ba80]
mov bp, word [ecx]
xor bp, ax
and ebp, ebx
test bp, bp
je 0x403e8a
mov ebp, esi
dec esi
add ecx, edx
test ebp, ebp
jne 0x403e72
jmp 0x403ea3
mov edx, dword [ecx + 2]
mov dword [0x447a20], edx
mov edx, dword [ecx + 6]
mov dword [0x44bae8], edx
lea edx, [ecx + 0xa]
test edx, edx
jne 0x403eb5
cmp bx, 0xffff
jne 0x403eb1
mov ebx, 0x3ff
jmp 0x403e4f
xor ebx, ebx
jmp 0x403e4f
mov dword [0x447a1c], edx
movzx eax, word [ecx]
push eax
push edi
call fcn.004061f1
push 0xfffffffffffffffe
push 0x447a40
call fcn.004062c3
push eax
push dword [0x4353dc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x44ba6c]
mov esi, dword [0x44ba68]
mov ecx, eax
dec eax
test ecx, ecx
je 0x403f0f
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x403f08
push eax
push ebx
call fcn.004062c3
add esi, edi
add ebx, edi
dec ebp
jne 0x403efb
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405ac4
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x43ac00], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405ae8
test al, 0x10
jne 0x405aeb
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x43ac00
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405b16
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x40659d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4065c2
mov eax, dword [0x40a8c8]
cmp eax, 0xffffffff
je 0x4065b9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8c8], 0xffffffff
jmp 0x406635
cmp dword [0x43b9a0], ebx
je 0x406635
cmp byte [0x43b5a0], bl
je 0x406601
cmp dword [0x40a8c8], 0xffffffff
jne 0x40660a
push 4
push 0x40000000
push 0x43b5a0
call fcn.00405f65
cmp eax, 0xffffffff
mov dword [0x40a8c8], eax
je 0x406635
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8c8], 0xffffffff
je 0x406635
push esi
mov esi, 0x43f9e0
push 0x40aa9c
push esi
call fcn.004062b2
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.004062a5
push eax
push esi
push dword [0x40a8c8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4066fb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x43b18c], esi
push edi
jne 0x406735
mov ecx, 0x43b188
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406711
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x43b588
jl 0x40670c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40676a
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43b188]
xor eax, esi
inc ecx
dec edx
jne 0x40674d
pop edi
pop esi
not eax
ret 0xc
Function at 0x4faad0
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x40
call fcn.004bd0a0
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x5c]
xor eax, eax
test esi, esi
push edi
je 0x4faaf5
mov eax, 1
mov dword [ebx], esi
jmp 0x4faafd
mov ecx, dword [ebx]
mov dword [esp + 0x60], ecx
mov esi, ecx
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4fac3a
mov edi, dword [esi + 0x40]
cmp edi, 0x40
jbe 0x4fab25
push 0x5582a8
push 0x52
push 0x558290
call fcn.004cb670
add esp, 0xc
mov ebp, dword [esp + 0x5c]
cmp edi, ebp
jge 0x4fab5b
mov edx, dword [esp + 0x64]
push edx
lea edi, [ebx + 4]
push esi
push edi
call fcn.004df410
mov eax, dword [esp + 0x64]
push ebp
push eax
push edi
call fcn.004df530
lea esi, [ebx + 0x34]
push esi
lea ecx, [ebx + 0x38]
push ecx
push edi
call fcn.004df540
add esp, 0x24
jmp 0x4fab90
cmp ebp, 0x40
jbe 0x4fab74
push 0x558278
push 0x5c
push 0x558290
call fcn.004cb670
add esp, 0xc
mov esi, dword [esp + 0x58]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x40
je 0x4fabb2
mov ecx, 0x40
sub ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
lea edi, [esi + ebx + 0x38]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0x60]
xor eax, eax
jmp 0x4fabc0
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x4fabc0
mov ebp, dword [esp + 0x64]
push ebp
lea edi, [ebx + 0x14]
push esi
push edi
call fcn.004df410
mov edx, dword [esi + 0x40]
push edx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004df530
add esp, 0x18
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x4fabf4
push ebp
lea edi, [ebx + 0x24]
push esi
push edi
call fcn.004df410
mov edx, dword [esi + 0x40]
push edx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004df530
add esp, 0x18
lea ecx, [ebx + 0x14]
push ecx
add ebx, 4
push ebx
call fcn.004df630
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
je 0x4fac22
jmp 0x4fabb6
Function at 0x4fab16
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x40
call fcn.004bd0a0
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x5c]
xor eax, eax
test esi, esi
push edi
je 0x4faaf5
mov eax, 1
mov dword [ebx], esi
jmp 0x4faafd
mov ecx, dword [ebx]
mov dword [esp + 0x60], ecx
mov esi, ecx
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4fac3a
mov edi, dword [esi + 0x40]
cmp edi, 0x40
jbe 0x4fab25
push 0x5582a8
push 0x52
push 0x558290
call fcn.004cb670
add esp, 0xc
mov ebp, dword [esp + 0x5c]
cmp edi, ebp
jge 0x4fab5b
mov edx, dword [esp + 0x64]
push edx
lea edi, [ebx + 4]
push esi
push edi
call fcn.004df410
mov eax, dword [esp + 0x64]
push ebp
push eax
push edi
call fcn.004df530
lea esi, [ebx + 0x34]
push esi
lea ecx, [ebx + 0x38]
push ecx
push edi
call fcn.004df540
add esp, 0x24
jmp 0x4fab90
cmp ebp, 0x40
jbe 0x4fab74
push 0x558278
push 0x5c
push 0x558290
call fcn.004cb670
add esp, 0xc
mov esi, dword [esp + 0x58]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x40
je 0x4fabb2
mov ecx, 0x40
sub ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
lea edi, [esi + ebx + 0x38]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0x60]
xor eax, eax
jmp 0x4fabc0
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x4fabc0
mov ebp, dword [esp + 0x64]
push ebp
lea edi, [ebx + 0x14]
push esi
push edi
call fcn.004df410
mov edx, dword [esi + 0x40]
push edx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004df530
add esp, 0x18
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x40
jl 0x4fabf4
push ebp
lea edi, [ebx + 0x24]
push esi
push edi
call fcn.004df410
mov edx, dword [esi + 0x40]
push edx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004df530
add esp, 0x18
lea ecx, [ebx + 0x14]
push ecx
add ebx, 4
push ebx
call fcn.004df630
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
je 0x4fac22
jmp 0x4fabb6
Function at 0x5178ee
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004bd0a0
mov eax, dword [0x57c7a0]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.004c62c8
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x517a21
push 2
push esi
push dword [ebp + 8]
call fcn.004c62c8
add esp, 0xc
cmp eax, ebx
je 0x517a21
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x5179c1
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004bdf10
push 0x8000
push dword [ebp + 8]
call fcn.00516ead
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x517977
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.004c4002
add esp, 0xc
cmp eax, 0xffffffff
je 0x517997
sub edi, eax
test edi, edi
jg 0x51796f
jmp 0x5179af
call fcn.004bea06
cmp dword [eax], 5
jne 0x5179ac
call fcn.004be9fd
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.00516ead
pop ecx
pop ecx
jmp 0x517a09
jge 0x517a09
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004c62c8
push dword [ebp + 8]
call fcn.004c7424
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x517a09
call fcn.004be9fd
mov dword [eax], 0xd
call fcn.004bea06
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.004c62c8
add esp, 0xc
mov eax, esi
pop edi
jmp 0x517a23
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004bde13
leave
ret

Function at 0x51e427
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x51e455
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x51e45a
cmp eax, 1
je 0x51e45a
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x51e45e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x57c7a0]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x51e4d6
push ebx
call fcn.0051e427
test eax, eax
pop ecx
jne 0x51e4a5
call fcn.004bea06
mov dword [eax], 0xf
call fcn.004be9fd
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.004bde13
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x51e4e8
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x51e498
inc eax
cmp eax, 0x104
ja 0x51e498
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x51e520
cmp eax, dword [ebp + 0x10]
jg 0x51e503
mov eax, dword [ebp + 0x10]
push eax
call fcn.004bab03
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x51e535
call fcn.004be9fd
mov dword [eax], 0xc
jmp 0x51e498
cmp eax, dword [ebp + 0x10]
jle 0x51e535
call fcn.004be9fd
mov dword [eax], 0x22
jmp 0x51e498
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.004c5b60
pop ecx
pop ecx
jmp 0x51e49a
Function at 0x52022b
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.004bdf10
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
mov eax, dword [edi + 4]
cmp eax, dword [0x545648]
je 0x520332
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x52029b
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x5202a2
cmp ebx, ebx
jne 0x5202a2
xor eax, eax
jmp 0x520335
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x5202af
mov byte [esi + 0x20], bl
jmp 0x5202c3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004b97c2
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.004b97c2
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.004b97c2
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x52031e
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x520332
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x520980
Capabilities:
Get disk information

Disassembly:
mov eax, 0x52ff66
call fcn.004bde24
sub esp, 0x150
mov eax, dword [0x57c7a0]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x154]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor ebx, ebx
cmp eax, ebx
jne 0x5209c8
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
jmp 0x5209cc
cmp eax, esi
jb 0x5209d3
xor eax, eax
jmp 0x520aa8
call fcn.0051ffd3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.0052093e
push dword [ebp + 8]
call dword [0x586ec8]
test eax, eax
jne 0x520a98
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x520a27
xor esi, esi
jmp 0x520a9b
test byte [ebp - 0x158], 2
jne 0x520a37
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x158], 4
jne 0x520a98
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x520a98
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x154], ebx
je 0x520a23
cmp dword [ebp - 0x154], edi
jbe 0x520a23
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlen]
sub eax, edi
add eax, dword [ebp - 0x154]
cmp eax, esi
jge 0x520a23
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_lstrcpy]
xor esi, esi
inc esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004013d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004bde13
leave
ret 8
Function at 0x521450
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x1c
xor ebx, ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
mov esi, ecx
call fcn.004bdf10
add esp, 0xc
call fcn.005299d8
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
call edi
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0xc], eax
call edi
cmp dword [ebp - 0xc], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
je 0x521520
cmp dword [ebp - 8], ebx
je 0x52151b
lea ecx, [esi + 0x2c]
push ecx
or eax, 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x521322
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.004be8bc
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x28], eax
je 0x52152a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call edi
test byte [ebp + 8], 4
je 0x5214f3
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [ebp - 4], ebx
je 0x52150d
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x28]
call edi
mov dword [esi + 0x28], ebx
jmp 0x521525
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
inc eax
jmp 0x52152c
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 8], ebx
je 0x52152a
push dword [ebp - 8]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x524634
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x524677
call fcn.005299e8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x524677
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x524692
push edi
call dword [sym.imp.KERNEL32.dll_LockResource_1]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00523799
test ebx, ebx
mov esi, eax
je 0x524690
test edi, edi
je 0x524690
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x526765
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x57c7a0]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlen]
mov esi, eax
mov eax, pe_nt_image_headers32
cmp esi, eax
ja 0x5267b4
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x5267b4
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmp]
test eax, eax
je 0x5267c0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004bde13
leave
ret 8
Function at 0x5277da
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x57c7a0]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x527827
push dword [ebp + 8]
call fcn.0052a0b0
mov esi, eax
test esi, esi
je 0x52784f
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x52784f
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x53c1b0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004bde13
leave
ret 0xc

Function at 0x528755
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x57c7a0]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x5287b3
push 0x5462c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpy]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004be947
add esp, 0x10
cmp eax, 0xffffffff
je 0x5287c7
cmp eax, esi
jae 0x5287c7
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x5287c9
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x52877e
jmp 0x5287ca
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.004bde13
leave
ret