joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431540
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push esi
push eax
push 0x4aa9a0
push 1
push 0
push 0x4aa990
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x4315f0
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x218]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x220]
test eax, eax
je 0x431592
mov ecx, dword [esp + 4]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x4aa9f0
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x4315e6
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
add esp, 0x210
ret

Function at 0x4329f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov dword [edi], method.streambuf.virtual_28
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x432a1f
mov ecx, dword [edi + 0x10]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 0x10]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x432a2d
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [edi + 0x2c]
mov esi, dword [sym.imp.USER32.dll_DestroyCursor]
test eax, eax
je 0x432a3d
push eax
call esi
mov eax, dword [edi + 0x30]
test eax, eax
je 0x432a47
push eax
call esi
mov eax, dword [edi + 0x74]
push eax
call fcn.00498600
mov ecx, dword [edi + 0x9c]
add esp, 4
push ecx
call fcn.00498600
mov edx, dword [edi + 0x78]
add esp, 4
push edx
call fcn.00498600
mov eax, dword [edi + 0x54]
add esp, 4
test eax, eax
mov dword [edi + 0x44], 0x4aa96c
je 0x432ab3
mov eax, dword [edi + 0x4c]
xor esi, esi
test eax, eax
jle 0x432ab3
cmp esi, eax
jge 0x432a95
test esi, esi
jl 0x432a95
mov eax, dword [edi + 0x48]
mov ebx, dword [eax + esi*4]
jmp 0x432a97
xor ebx, ebx
test ebx, ebx
je 0x432aab
mov ecx, ebx
call fcn.00443ff0
push ebx
call fcn.00498600
add esp, 4
mov eax, dword [edi + 0x4c]
inc esi
cmp esi, eax
jl 0x432a89
mov ecx, dword [edi + 0x48]
push ecx
call fcn.00498600
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x437ab0
Capabilities:
Log keystrokes via polling

Disassembly:
mov al, byte [0x4caba4]
sub esp, 0x1c
test al, al
push ebx
push ebp
push esi
push edi
mov edi, ecx
jne 0x437ca7
mov eax, dword [esp + 0x30]
cmp eax, 0x4f28
jne 0x437af7
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
test al, 0x80
je 0x437ae6
mov eax, 0x4f2b
jmp 0x437af7
push 0x10
call esi
and al, 0x80
neg al
sbb eax, eax
neg eax
add eax, 0x4f29
cmp eax, 0x4f2b
jne 0x437b10
push 0
push 0x3ff00000
push 0
push 0
push 0
jmp 0x437c87
mov ecx, dword [edi + 0x70]
mov edx, dword [edi + 0x4c]
cmp ecx, edx
jge 0x437b26
test ecx, ecx
jl 0x437b26
mov edx, dword [edi + 0x48]
mov esi, dword [edx + ecx*4]
jmp 0x437b28
xor esi, esi
test esi, esi
je 0x437ca7
xor ecx, ecx
cmp eax, 0x4f2a
lea ebx, [edi + 0xc4]
mov dword [esp + 0x30], 0
sete cl
push ebx
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x437c3d
lea edx, [esp + 0x1c]
push 0x2710
push 0xffffffffffffffff
mov ecx, esi
mov dword [esp + 0x38], edx
call fcn.00444db0
push eax
mov eax, dword [ebx]
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
call ebx
push 0x2710
push 0xffffffffffffffff
mov ecx, esi
mov dword [esp + 0x24], eax
call fcn.00444e10
mov ecx, dword [edi + 0xc8]
push eax
push ecx
call ebx
push 0x2710
push 0xffffffffffffffff
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.00444db0
mov edx, dword [edi + 0xcc]
push eax
push edx
call ebx
push 0xffffffffffffffff
mov ecx, esi
mov ebp, eax
call fcn.00444db0
dec eax
cmp eax, ebp
jge 0x437bd1
push 0xffffffffffffffff
mov ecx, esi
call fcn.00444db0
dec eax
jmp 0x437be9
push 0x2710
push 0xffffffffffffffff
mov ecx, esi
call fcn.00444db0
push eax
mov eax, dword [edi + 0xcc]
push eax
call ebx
push 0x2710
push 0xffffffffffffffff
mov ecx, esi
mov dword [esp + 0x2c], eax
call fcn.00444e10
mov ecx, dword [edi + 0xd0]
push eax
push ecx
call ebx
push 0xffffffffffffffff
mov ecx, esi
mov ebp, eax
call fcn.00444e10
dec eax
cmp eax, ebp
jge 0x437c21
push 0xffffffffffffffff
mov ecx, esi
call fcn.00444e10
dec eax
jmp 0x437c39
push 0x2710
push 0xffffffffffffffff
mov ecx, esi
call fcn.00444e10
mov edx, dword [edi + 0xd0]
push eax
push edx
call ebx
mov dword [esp + 0x28], eax
mov eax, dword [0x4caec8]
test eax, eax
je 0x437c5b
mov eax, dword [0x4caed0]
mov ecx, dword [0x4caed4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jmp 0x437c6b
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x3ff00000
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00445190
push eax
mov eax, dword [str.ACDSee_32]
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 8]
push eax
push ecx
push edx
call fcn.0043fff0
mov eax, dword [edi + 0x10]
add esp, 0x20
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x437cc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov al, byte [0x4caba3]
sub esp, 0x134
test al, al
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x437e6e
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x4c]
cmp eax, ecx
jge 0x437cef
test eax, eax
jl 0x437cef
mov ecx, dword [esi + 0x48]
mov ebx, dword [ecx + eax*4]
jmp 0x437cf1
xor ebx, ebx
test ebx, ebx
je 0x437e6e
mov eax, dword [0x4caa64]
mov edx, dword [esi + 0x40]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp + 0x14], edx
test eax, eax
je 0x437d20
push 0x11
call edi
test ah, 0x80
mov dword [esp + 0x10], 1
je 0x437d28
mov dword [esp + 0x10], 0
mov eax, dword [0x4caa68]
test eax, eax
jne 0x437d41
push 0x10
call edi
test ah, 0x80
jne 0x437d41
mov ebp, 1
jmp 0x437d43
xor ebp, ebp
mov ecx, ebx
call fcn.00444ee0
mov edi, eax
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x18], edi
je 0x437d5f
mov ecx, esi
call fcn.00435fd0
test edi, edi
je 0x437d6c
push 1
mov ecx, ebx
call fcn.004448d0
mov ecx, ebx
call fcn.00445190
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [esp + eax + 0x3d], 0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edx, dword [esi + 0x10]
stosw word es:[edi], ax
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], edx
test ebp, ebp
mov dword [esp + 0x20], 3
mov dword [esp + 0x24], eax
je 0x437dbe
or byte [esp + 0x2c], 0x40
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x437dcb
or byte [esp + 0x2c], 0x10
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push 0
mov ecx, ebx
call fcn.00445190
push eax
call fcn.00498c50
add esp, 8
xor edx, edx
cmp eax, 0xffffffff
sete dl
mov eax, edx
test eax, eax
je 0x437e4a
mov edi, dword [esi]
mov ecx, ebx
call fcn.00445190
push eax
mov ecx, esi
call dword [edi]
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x437e41
mov eax, dword [esi + 0x34]
test eax, eax
je 0x437e2f
cmp dword [esi + 0x4c], 1
jne 0x437e41
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
mov ecx, esi
call fcn.00435e10
jmp 0x437e59
mov eax, dword [esp + 0x18]
test eax, eax
je 0x437e59
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x437e6e
cmp dword [esi + 0x4c], 1
jle 0x437e6e
mov ecx, esi
call fcn.00435f50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret
Function at 0x438a60
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push edi
push 0x7f02
mov ebp, ecx
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call edi
push 1
push 0
push 0
push str.http:__www.acdsystems.com
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x7f00
push 0
mov ebx, eax
call esi
push eax
call edi
cmp ebx, 0x1f
jg 0x438ac0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push 0x20c
push eax
push ecx
call fcn.0043cfa0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x438bd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x4c]
cmp eax, ecx
jge 0x438bf1
test eax, eax
jl 0x438bf1
mov ecx, dword [edi + 0x48]
mov esi, dword [ecx + eax*4]
jmp 0x438bf3
xor esi, esi
test esi, esi
je 0x438cdc
mov ecx, esi
call fcn.00445190
test eax, eax
je 0x438cdc
mov ecx, esi
call fcn.00445190
mov edx, dword [edi + 0x10]
mov ebp, eax
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x438c3c
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push 0xa6
push eax
push ecx
call fcn.0043cfa0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
call ebx
add eax, 0x15
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
xor eax, eax
push ebp
mov dword [esi], 0x14
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea esi, [esi + eax + 1]
push edi
mov byte [esi], 0
call ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SetClipboardData]
push 0xf
call edi
push 4
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [eax], 2
call ebx
push esi
push str.Preferred_DropEffect
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push eax
call edi
mov ecx, dword [esp + 0x10]
call fcn.00435e10
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x438ea0
Capabilities:
List drag and drop files
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x138
push ebp
mov ebp, ecx
mov dword [esp + 0x24], ebp
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43909c
push edi
push esi
push ebx
push 0xf
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
xor esi, esi
cmp ebx, esi
mov dword [esp + 0x3c], ebx
je 0x439093
push esi
push esi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
mov edi, eax
cmp edi, esi
mov dword [esp + 0x38], edi
je 0x439093
cmp edi, 0x64
jle 0x438f0f
push 0x7f02
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x34], eax
push 0x80
mov dword [esp + 0x14], 0x4aa684
call fcn.004985f0
add esp, 4
mov dword [esp + 0x14], eax
test edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x1f
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], esi
jle 0x439026
mov cl, byte [0x4caf4c]
lea edx, [esp + 0x40]
mov byte [esp + 0x40], cl
push 0x105
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x45]
push edx
push esi
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
lea eax, [esp + 0x40]
push eax
call fcn.0043c610
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x439011
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [eax + 1]
cmp edx, ecx
jne 0x438ffd
mov edx, dword [esp + 0x24]
add eax, edx
lea eax, [eax*4 + 4]
push eax
call fcn.004985f0
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov ebx, eax
add esp, 4
lea ecx, [ecx*4 + 4]
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
push eax
call fcn.00498600
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add esp, 4
add eax, ecx
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edx + eax*4], ebp
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
inc esi
cmp esi, eax
mov dword [esp + 0x2c], esi
jl 0x438f50
mov ebp, dword [esp + 0x30]
push 0
push 2
lea ecx, [esp + 0x18]
push 0
push ecx
mov ecx, ebp
call fcn.00434490
mov eax, dword [esp + 0x34]
test eax, eax
je 0x439047
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0x4aa684
test eax, eax
je 0x439086
mov eax, dword [esp + 0x18]
xor esi, esi
test eax, eax
jle 0x439086
cmp esi, eax
jge 0x439072
test esi, esi
jl 0x439072
mov edx, dword [esp + 0x14]
mov eax, dword [edx + esi*4]
jmp 0x439074
xor eax, eax
push eax
call fcn.00498600
mov eax, dword [esp + 0x1c]
add esp, 4
inc esi
cmp esi, eax
jl 0x439065
mov eax, dword [esp + 0x14]
push eax
call fcn.00498600
add esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x138
ret
Function at 0x439770
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x160
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x50
push eax
push 0xa5
mov ecx, dword [edi + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov edx, dword [esp + 0x174]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4397d9
mov ecx, dword [edi + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0043cf40
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x160
ret 4
mov eax, dword [edi + 0x4c]
xor esi, esi
test eax, eax
jle 0x439846
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
cmp esi, eax
jge 0x4397f8
test esi, esi
jl 0x4397f8
mov edx, dword [edi + 0x48]
mov ecx, dword [edx + esi*4]
jmp 0x4397fa
xor ecx, ecx
call fcn.00445190
test eax, eax
je 0x43983e
push eax
lea eax, [esp + 0x68]
push str.__s__r_n
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x64]
mov dword [esp + 0x10], 0
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43985f
mov eax, dword [edi + 0x4c]
inc esi
cmp esi, eax
jl 0x4397ec
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x160
ret 4
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0043cf40
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x160
ret 4
Function at 0x43c200
Capabilities:
Set registry value

Disassembly:
sub esp, 0x30
mov edx, dword [esp + 0x34]
lea eax, [esp]
lea ecx, [esp + 0x34]
push eax
push ecx
push 0
push 0x20006
push 0
push 0x4caf4c
push 0
push edx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43c26f
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 4]
push eax
push ecx
mov dword [esp + 0xc], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 4]
push 0x2c
push edx
push 3
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x30
ret

Function at 0x43c280
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x34
lea eax, [esp + 0x38]
push esi
push edi
push eax
push 0x20019
push 0
push ecx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43c2bd
mov esi, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push esi
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop edi
pop esi
add esp, 0x34
ret
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, 0x2c
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x40]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43c321
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop edi
pop esi
add esp, 0x34
ret
mov eax, dword [esp + 0x18]
cmp eax, 6
mov esi, eax
je 0x43c331
cmp eax, 2
jne 0x43c339
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x4c]
cmp eax, 0xa
je 0x43c346
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowPlacement]
mov eax, esi
pop edi
pop esi
add esp, 0x34
ret
Function at 0x43c470
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x4cb0b0]
sub esp, 0x114
test eax, eax
jne 0x43c550
push edi
mov ecx, 6
xor eax, eax
mov edi, 0x4cb098
rep stosd dword es:[edi], eax
mov dword [0x4cb098], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp + 0x1c]
push 0x100
push eax
push 0x12
push 0x400
call esi
lea ecx, [esp + 0x1c]
push ecx
call fcn.00498b80
add esp, 4
lea edx, [esp + 0x1c]
mov dword [0x4cb09c], eax
push 0x100
push edx
push 0x10
push 0x400
call esi
lea eax, [esp + 0x1c]
push eax
call fcn.00498b80
add esp, 4
mov dword [0x4cb0a0], eax
push 0xa
push 0x4cb088
push 0xe
push 0x400
call esi
push 0xa
push 0x4cb078
push 0xf
push 0x400
mov dword [0x4cb0a4], 0x4cb088
call esi
lea ecx, [esp + 0x1c]
push 0x100
push ecx
push 0x1010
push 0x400
mov dword [0x4cb0a8], 0x4cb078
call esi
lea edx, [esp + 0x1c]
push edx
call fcn.00498b80
add esp, 4
mov dword [0x4cb0ac], eax
mov dword [0x4cb0b0], 1
pop esi
pop edi
mov eax, dword [esp + 0x118]
lea ecx, [esp]
push eax
push 0x4bfefc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
add esp, 0xc
lea ecx, [esp]
push edx
push eax
push 0x4cb098
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
add esp, 0x114
ret
Function at 0x43ccf0
Capabilities:
Get geographical location

Disassembly:
mov al, byte [0x4cb0b8]
sub esp, 0x58
test al, al
push esi
push edi
jne 0x43cd12
push 0xa
push 0x4cb0b8
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [esp + 0x64]
cmp eax, 0x3e8
jae 0x43cd3a
push eax
lea eax, [esp + 0x14]
push 0x4bfefc
push eax
call fcn.00498ca0
add esp, 0xc
mov edi, str._bytes
jmp 0x43cde5
cmp eax, 0xfa000
jae 0x43cd76
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
fild qword [esp + 8]
sub esp, 8
lea ecx, [esp + 0x18]
fmul dword [0x4aaa00]
fstp qword [esp]
push str._.1f
push ecx
call fcn.00498ca0
add esp, 0x10
mov edi, 0x4bff0c
jmp 0x43cde5
cmp eax, 0x3e800000
jae 0x43cdb2
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
fild qword [esp + 8]
sub esp, 8
lea edx, [esp + 0x18]
fmul dword [0x4aaa04]
fstp qword [esp]
push str._.1f
push edx
call fcn.00498ca0
add esp, 0x10
mov edi, 0x4bff08
jmp 0x43cde5
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
fild qword [esp + 8]
sub esp, 8
lea eax, [esp + 0x18]
fmul dword [0x4aaa08]
fstp qword [esp]
push str._.1f
push eax
call fcn.00498ca0
add esp, 0x10
mov edi, 0x4bff04
mov cl, byte [0x4cb0b8]
test cl, cl
je 0x43ce0f
cmp cl, 0x2e
je 0x43ce0f
mov dl, byte [esp + 0x10]
lea eax, [esp + 0x10]
test dl, dl
je 0x43ce0f
cmp byte [eax], 0x2e
jne 0x43ce07
mov byte [eax], cl
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x43ce00
mov esi, dword [esp + 0x68]
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
add esp, 0x58
ret

Function at 0x43d170
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x114
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x10]
push edx
call fcn.0043d0a0
add esp, 4
lea eax, [esp + 8]
lea ecx, [esp]
lea edx, [esp + 4]
push eax
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43d1f1
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x11c]
imul eax, dword [esp + 0xc]
test ecx, ecx
je 0x43d1d3
mov edx, eax
imul edx, dword [esp]
mov dword [ecx], edx
mov ecx, dword [esp + 0x120]
test ecx, ecx
je 0x43d1e5
imul eax, dword [esp + 8]
mov dword [ecx], eax
mov eax, 1
add esp, 0x114
ret
xor eax, eax
add esp, 0x114
ret
Function at 0x43e100
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
add eax, 0x41
lea ecx, [esp + 4]
push eax
push str._c:_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [esp + 0x14]
lea eax, [esp]
push 0
push 0
push edx
push eax
push ecx
push 0
lea edx, [esp + 0x1c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add esp, 0x10
ret
Function at 0x4422f0
Capabilities:
Hide graphical window

Disassembly:
fld qword [0x4c0430]
mov eax, dword [0x4cb0f0]
push ebx
push esi
push edi
fstp qword [eax + 0x60]
mov ecx, dword [0x4cb0f0]
push 0
push 1
push 1
push 0
call fcn.00449910
mov eax, dword [0x4cb0ec]
mov esi, dword [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x44238b
push 0x73
push esi
call ebx
test eax, eax
je 0x44238b
mov ecx, dword [0x4cb0ec]
push 0
push 1
push 1
push ecx
mov ecx, dword [0x4cb0f0]
call fcn.00449910
mov edx, dword [0x4cb104]
mov eax, dword [0x4cb100]
mov ecx, dword [0x4cb0f0]
push edx
push eax
call fcn.0044a330
mov ecx, dword [0x4cb0f0]
push 1
push 1
call fcn.00449ab0
mov ecx, dword [0x4cb0f0]
mov edx, dword [0x4cb108]
push 0
mov dword [ecx + 0x6c], edx
mov ecx, dword [0x4cb0f0]
call fcn.0044a450
push 0x6b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [0x4cb0ec]
mov edi, eax
test ecx, ecx
je 0x44240a
push 0xffffffffffffffff
call fcn.00444cb0
test eax, eax
je 0x44240a
push 0x73
push esi
call ebx
test eax, eax
je 0x44240a
mov ecx, dword [0x4cb0ec]
push 0xffffffffffffffff
call fcn.00444cb0
mov ecx, dword [0x4cb0ec]
push 0xffffffffffffffff
mov esi, eax
call fcn.00444d30
mov ecx, dword [0x4cb0fc]
push 0x44
push eax
push esi
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, esi
cdq
sub eax, edx
mov edx, dword [0x4cb0f8]
sar eax, 1
sub edx, eax
push ecx
push edx
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x4cb0f0]
call fcn.00449df0
pop edi
pop esi
pop ebx
ret
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
ret