joyce8/EMBER2024-capa huggingface dataset:
Function at 0x561fe0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
push esi
push edi
mov eax, 0x725154
call fcn.00654e18
mov dword [ebp - 0xc], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00662930
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0xc
mov esi, 0x72475c
lea edi, [ebp - 0x828]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp + 0xc]
call fcn.0055b230
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsW
mov word [ebp - 0x18], 0x24
lea edx, [ebp - 0x828]
lea eax, [ebp - 4]
call fcn.00662a1c
inc dword [ebp - 0xc]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00662aa8
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x30
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0xc]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00662a80
pop eax
mov word [ebp - 0x18], 0x24
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5655e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov eax, 0x7261f8
call fcn.00654e18
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00662930
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0xc
push 1
push 0
push 0
lea eax, [ebp - 4]
call fcn.0055b230
push eax
push 0x725814
mov edx, dword [0x749280]
mov ecx, dword [edx]
push dword [ecx + 0x170]
call sub.SHELL32.DLL_ShellExecuteW
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x56cd78
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, 0x72ac0c
call fcn.00654e18
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00662930
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
mov word [ebp - 0x28], 0x18
mov edx, dword [ebp - 8]
add edx, 0x40
mov dword [ebp - 0x3c], edx
add esp, 0xfffffff8
push esp
call fcn.0056cef4
pop ecx
push dword [ebp - 0x3c]
call fcn.0056cf18
add esp, 0xc
push 0
push dword [ebp - 0x3c]
call fcn.0056cf4c
add esp, 8
inc dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x44aee4]
call fcn.004579d4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3c], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
push 0x80
cmp dword [ebp - 4], 0
je 0x56ce06
mov ecx, dword [ebp - 4]
jmp 0x56ce0b
mov ecx, 0x72ab24
push ecx
call sub.KERNEL32.DLL_SetFileAttributesW
mov word [ebp - 0x28], 0x24
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x1c]
lea edx, [ebp - 4]
mov eax, 0x72ab26
call fcn.00662fe8
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov edx, 2
call fcn.0048aa18
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00662a80
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0056e21c
mov ecx, dword [ebp - 8]
mov byte [ecx + 0xc], al
mov word [ebp - 0x28], 0x30
mov edx, 0x72ab30
lea eax, [ebp - 0x10]
call fcn.006628f0
inc dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 8]
call fcn.0056d1c8
mov ecx, dword [ebp - 8]
mov byte [ecx + 0xc], al
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00662a80
push 0x18
call fcn.00651b50
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x56cec9
mov word [ebp - 0x28], 0x54
mov eax, dword [ebp - 0x14]
call fcn.00424610
inc dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x3c
mov edx, dword [ebp - 0x14]
jmp 0x56cecc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + 0x60], edx
dec dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x57bf7c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov dword [ebp - 4], edx
mov dword [ebp - 0x30], eax
mov eax, 0x732e98
call fcn.00654e18
mov dword [ebp - 0x10], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00662930
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0xc
mov byte [ebp - 0x31], 1
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0048abe0
test al, al
jne 0x57c009
mov edx, dword [ebp - 0x30]
mov dword [edx + 0xc], 0x2771
mov eax, dword [ebp - 0x30]
call sym.gta.exe__TWMAction_rActionManager_qqrv
add eax, 0x58
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 4]
mov ebx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
call dword [ebx]
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x57c0eb
push 0x80
cmp dword [ebp - 4], 0
je 0x57c019
mov ecx, dword [ebp - 4]
jmp 0x57c01e
mov ecx, 0x731b5c
push ecx
call sub.KERNEL32.DLL_SetFileAttributesW
mov word [ebp - 0x1c], 0x18
xor eax, eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, 0x731b5e
call fcn.00662fe8
lea eax, [ebp - 8]
mov eax, dword [eax]
mov edx, 0x42
call fcn.0048aa18
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x494], eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00662a80
mov ecx, dword [ebp - 0x30]
cmp dword [ecx + 0x494], 0xffffffff
jne 0x57c0bc
mov eax, dword [ebp - 0x30]
mov dword [eax + 0xc], 0x2772
mov eax, dword [ebp - 0x30]
call sym.gta.exe__TWMAction_rActionManager_qqrv
add eax, 0x58
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 4]
mov ebx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
call dword [ebx]
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x57c0eb
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x30]
add eax, 0x49c
call fcn.00662aa8
mov al, byte [ebp - 0x31]
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x584480
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 4], edx
mov dword [ebp - 0x30], eax
mov eax, 0x734df4
call fcn.00654e18
mov dword [ebp - 0x10], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00662930
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0xc
mov byte [ebp - 0x31], 1
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0048abe0
test al, al
jne 0x5844e6
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x5845a2
push 0x80
cmp dword [ebp - 4], 0
je 0x5844f6
mov ecx, dword [ebp - 4]
jmp 0x5844fb
mov ecx, 0x73383e
push ecx
call sub.KERNEL32.DLL_SetFileAttributesW
mov word [ebp - 0x1c], 0x18
xor eax, eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, 0x733840
call fcn.00662fe8
lea eax, [ebp - 8]
mov eax, dword [eax]
mov edx, 0x42
call fcn.0048aa18
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x488], eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00662a80
mov ecx, dword [ebp - 0x30]
cmp dword [ecx + 0x488], 0xffffffff
jne 0x584573
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x5845a2
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x30]
add eax, 0x474
call fcn.00662aa8
mov al, byte [ebp - 0x31]
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x59ca40
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 0x40], eax
mov eax, 0x73c77c
call fcn.00654e18
mov eax, dword [ebp - 0x40]
call sym.gta.exe__TWMAction_rActionManager_qqrv
cmp dword [eax + 0x88], 0x11
jne 0x59cbb0
mov word [ebp - 0x2c], 0xc
mov eax, dword [ebp - 0x40]
call sym.gta.exe__TWMAction_rActionManager_qqrv
xor edx, edx
mov dword [ebp - 4], edx
lea edx, [ebp - 4]
inc dword [ebp - 0x20]
call sym.gta.exe__TWMActionManager_rGamePath_qqrv
lea eax, [ebp - 4]
push eax
mov edx, str.editmaterialsMafiaIIMaterialsMerger.exe
lea eax, [ebp - 8]
call fcn.006628f0
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x20]
pop eax
call fcn.00662ad0
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov dl, 1
call fcn.0048abe0
test al, al
je 0x59caca
mov ecx, dword [ebp - 0x40]
cmp byte [ecx + 0x8a2], 0
jne 0x59cace
xor eax, eax
jmp 0x59cad3
mov eax, 1
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop ecx
test cl, cl
je 0x59cbb0
mov word [ebp - 0x2c], 0x18
mov eax, dword [ebp - 0x40]
call sym.gta.exe__TWMAction_rActionManager_qqrv
xor edx, edx
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
inc dword [ebp - 0x20]
call sym.gta.exe__TWMActionManager_rGamePath_qqrv
lea eax, [ebp - 0x10]
push eax
mov edx, str.editmaterials
lea eax, [ebp - 0x14]
call fcn.006628f0
inc dword [ebp - 0x20]
lea edx, [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
pop eax
call fcn.00662ad0
cmp dword [ebp - 0x18], 0
je 0x59cb5e
mov edx, dword [ebp - 0x18]
jmp 0x59cb63
mov edx, 0x73aacc
push edx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00662a80
push 1
push 0
push 0
push str.MafiaIIMaterialsMerger.exe
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteW
mov eax, dword [ebp - 0x3c]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret
Function at 0x5a1fb8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x60], 0
jne 0x5a20a9
mov edx, dword [ebp - 4]
cmp word [edx + 0x4a], 0
je 0x5a203e
mov ecx, dword [ebp - 4]
add ecx, 0x48
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xd]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call dword [ebx]
movsx edx, byte [ebp - 0xd]
dec edx
jne 0x5a2016
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x58]
call fcn.004edfb0
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x5a20a9
movsx ecx, byte [ebp - 0xd]
cmp ecx, 3
jne 0x5a20a9
push 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.00515bf8
push eax
call sub.USER32.DLL_ShowWindow
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x5a20a9
mov ecx, dword [ebp - 4]
cmp byte [ecx + 0x54], 0
je 0x5a20a9
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x58]
xor ecx, ecx
mov cl, byte [edx + 0x341]
test ecx, ecx
jle 0x5a2061
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
jmp 0x5a2088
mov edx, dword [ebp - 0xc]
mov byte [edx], 2
mov ecx, dword [ebp - 4]
cmp word [ecx + 0x42], 0
je 0x5a2088
mov eax, dword [ebp - 4]
add eax, 0x40
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
call dword [ebx]
mov dl, 0xff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.004ee9e8
mov edx, dword [ebp - 4]
mov byte [edx + 0x55], 0
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.004f7e0c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b5e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, eax
mov ecx, edx
test ecx, ecx
je 0x5b5e4f
sub ecx, 4
mov ecx, dword [ecx]
test ecx, ecx
jle 0x5b5e70
mov ebx, 1
mov esi, eax
add esi, esi
add esi, esi
shr eax, 0x1e
or esi, eax
movzx eax, word [edx + ebx*2 - 2]
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x5b5e58
pop esi
pop ebx
ret

Function at 0x5b71c4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.004a7ae4
push eax
push 0x800
lea eax, [ebp - 0x1000]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004a7ae4
push eax
mov eax, edi
call fcn.004a7ae4
push eax
mov eax, esi
call fcn.004a7ae4
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ecx, eax
lea edx, [ebp - 0x1000]
mov eax, dword [ebp + 8]
call fcn.004a6e08
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5b7290
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5b7403
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5b73d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x8000
call fcn.004a4610
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00455838
xor eax, eax
push ebp
push 0x5b73bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi + 4]
call fcn.004a7ae4
push eax
push 0x4000
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ebx, eax
cmp ebx, 0x3ffe
jne 0x5b7375
lea edx, [ebp - 4]
mov eax, dword [esi + 4]
call fcn.00439fa8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00494520
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00494bf8
mov ebx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, eax
imul edx, ebx
lea eax, [ebp - 0x10]
call fcn.004a4644
mov eax, dword [esi + 4]
call fcn.004a7ae4
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ebx, eax
test ebx, ebx
je 0x5b73a5
mov ebx, dword [ebp - 0x10]
jmp 0x5b739f
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004a7b44
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.0048b4ac
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
jne 0x5b737e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b73c2
mov eax, dword [ebp - 8]
call fcn.00455900
ret

Function at 0x5b74d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x400
mov eax, dword [ebp - 0x1c]
add eax, eax
call fcn.004a4610
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5b755c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call fcn.004a7ae4
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.004a7ae4
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
sub eax, 2
cmp eax, dword [ebp - 8]
jle 0x5b7543
push ebp
call fcn.005b7410
pop ecx
call fcn.004a657c
jmp 0x5b7572
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b7563
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004a462c
ret
mov esp, ebp
pop ebp
ret
Function at 0x5ed084
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.004a7c70
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5ed0a9
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.004a7ae4
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x5ed0c8
mov eax, ebx
mov edx, dword [esp]
call fcn.004a7c70
pop ecx
pop edx
pop ebx
ret

Function at 0x625d18
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x625e40
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00625c04
mov eax, dword [esi]
call fcn.004a8cfc
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x6262e8]
call fcn.004a8ec4
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004a489c
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004a489c
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004a8cfc
mov dword [ebp - 0xc], eax
mov eax, dword [0x749528]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.0062ad28
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004a4ce0
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004a8cfc
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.0062ad04
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.0062aabc
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0062ad20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625e47
lea eax, [ebp - 4]
mov edx, dword [0x6262e8]
call fcn.004a8fe8
ret
Function at 0x63f804
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63f89a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x748f54]
cmp dword [eax], 2
jne 0x63f844
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ebx, eax
jmp 0x63f87c
lea eax, [ebp - 8]
mov edx, esi
call fcn.004a7808
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.004a7424
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.004a75dc
push eax
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63f8a1
lea eax, [ebp - 8]
call fcn.004a6cc8
lea eax, [ebp - 4]
call fcn.004a6ca4
ret

Function at 0x63fccc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.004a7ae4
mov edx, eax
mov eax, ebx
call fcn.0063f670
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0063f74c
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x63fd3e
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.004a7ae4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x64336c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x6433d0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.004a7b98
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0048a658
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6433d7
lea eax, [ebp - 0x14]
call fcn.004a6c80
ret
Function at 0x6440e4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64433e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.006436a0
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x7446b0], eax
mov eax, dword [ebp - 0xc]
mov dword [0x7446b4], eax
mov eax, dword [ebp - 0x24]
mov dword [0x7446b8], eax
mov eax, dword [0x748f54]
cmp dword [eax], 2
sete byte [0x743e48]
push 0x64434c
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.0064530c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x743e48], 0
jne 0x644173
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00645520
test al, al
je 0x644173
mov eax, dword [ebp - 0x4c]
mov dword [0x75106c], eax
jmp 0x64417a
xor eax, eax
mov dword [0x75106c], eax
call fcn.00643784
and eax, 0x7f
cmp eax, 0x1a
ja case.0x64418b.0
jmp dword [eax*4 + 0x644192]
mov byte [0x743e34], 1
jmp case.0x64418b.0
mov byte [0x743e38], 1
jmp case.0x64418b.0
mov byte [0x743e3c], 1
jmp case.0x64418b.0
mov byte [0x743e40], 1
jmp case.0x64418b.0
mov byte [0x743e44], 1
jmp case.0x64418b.0
mov byte [0x743e4c], 1
mov byte [0x743e50], 1
jmp case.0x64418b.0
mov byte [0x743e4c], 1
mov byte [0x743e54], 1
jmp case.0x64418b.0
mov byte [0x743e4c], 1
mov byte [0x743e54], 1
mov byte [0x743e58], 1
jmp case.0x64418b.0
mov byte [0x743e5c], 1
jmp case.0x64418b.0
mov byte [0x743e60], 1
jmp case.0x64418b.0
mov byte [0x743e64], 1
jmp case.0x64418b.0
mov byte [0x743e68], 1
jmp case.0x64418b.0
mov byte [0x743e6c], 1
jmp case.0x64418b.0
mov byte [0x743e70], 1
jmp case.0x64418b.0
mov byte [0x743e74], 1
jmp case.0x64418b.0
mov byte [0x743e78], 1
jmp case.0x64418b.0
mov byte [0x743e7c], 1
jmp case.0x64418b.0
mov byte [0x743e80], 1
jmp case.0x64418b.0
mov byte [0x743e84], 1
jmp case.0x64418b.0
mov byte [0x743e88], 1
jmp case.0x64418b.0
mov byte [0x743e8c], 1
jmp case.0x64418b.0
mov byte [0x743e90], 1
jmp case.0x64418b.0
mov byte [0x743e94], 1
jmp case.0x64418b.0
mov byte [0x743e98], 1
jmp case.0x64418b.0
mov byte [0x743e9c], 1
jmp case.0x64418b.0
mov byte [0x743ea0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644345
lea eax, [ebp - 4]
call fcn.004a6c80
ret