joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41183e
Capabilities:
Hide graphical window

Disassembly:
and dword [0x44cb90], 0
push 1
push dword [esp + 8]
mov byte [0x44cbb8], 1
mov byte [0x44cbb9], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.0040113d
cmp dword [0x44cba0], 0
jne 0x41187e
cmp byte [0x44cbbe], 0
je 0x411887
cmp dword [0x44cbb4], 0
jne 0x41189a
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41196d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00412910
cmp byte [0x44ebd0], 0
je 0x4119fc
cmp word [0x44ebd2], 0
je 0x4119fc
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x44ebd2
call fcn.00410625
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4119fb
push dword [ebp + 8]
call fcn.00417b93
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x411a02
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00412910
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.00406304
mov esi, eax
test esi, esi
je 0x411a5a
movzx ecx, word [esi]
push ecx
jmp 0x411a45
add esi, 2
movzx eax, word [esi]
push eax
call fcn.0040641b
test al, al
jne 0x411a3e
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6b862dde
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2f5d2bb6
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x829230
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2f5000]
push edi
jmp 0x82924a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x829251
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829240
mov eax, 1
add ebx, ebx
jne 0x829263
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x829274
jne 0x829293
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829293
dec eax
add ebx, ebx
jne 0x829280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x829258
add ebx, ebx
jne 0x82928f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8292e5
xor ecx, ecx
sub eax, 3
jb 0x8292ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x82931a
sar eax, 1
mov ebp, eax
jmp 0x8292b6
add ebx, ebx
jne 0x8292b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829284
inc ecx
add ebx, ebx
jne 0x8292c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x829284
add ebx, ebx
jne 0x8292d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8292c6
jne 0x8292e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8292c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x829304
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8292f6
jmp 0x829246
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x829304
add edi, ecx
jmp 0x829246
pop esi
mov edi, esi
mov ecx, 0x8c08
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x829322
cmp byte [edi], 0x1a
jne 0x829322
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x829327
lea edi, [esi + 0x425000]
mov eax, dword [edi]
or eax, eax
je 0x82939f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x43b0a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x43b1d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x829354
mov ecx, edi
jns 0x829383
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x43b1d4]
or eax, eax
je 0x829399
mov dword [ebx], eax
add ebx, 4
jmp 0x829371
call dword [esi + 0x43b1e4]
mov ebp, dword [esi + 0x43b1d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8293d3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4337e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5bfe90
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 0
jmp 0x433832
mov eax, dword [ebx + 4]
mov esi, dword [ebx + 8]
cmp eax, esi
jae 0x433851
mov cl, byte [eax]
cmp cl, 0x80
jae 0x433851
movzx ecx, cl
inc eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x14], ecx
mov eax, ecx
jmp 0x4338a5
mov edx, esi
sub edx, eax
cmp edx, 0xa
jge 0x43388a
cmp eax, esi
jae 0x433866
test byte [esi - 1], 0x80
je 0x43388a
cmp eax, esi
jne 0x433881
mov eax, dword [ebx + 0x20]
test eax, eax
jle 0x433881
mov ecx, dword [ebx + 0xc]
sub ecx, eax
cmp ecx, dword [ebx + 0x24]
jge 0x433881
mov byte [ebx + 0x18], 1
xor eax, eax
jmp 0x4338a2
mov eax, ebx
call fcn.004eb180
jmp 0x4338a2
lea edx, [esp + 0x28]
push edx
call fcn.004eb110
add esp, 4
test eax, eax
je 0x4338a2
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], eax
test eax, eax
je 0x433fcb
mov ecx, eax
shr ecx, 3
dec ecx
cmp ecx, 0x10
ja 0x433fed
jmp dword [ecx*4 + 0x434040]
inc ebp
mov ah, 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00433d43
cmp dword [ecx + 0x458dfa4e], 0x5fe850a8
std
invalid
test al, 0x50
call fcn.00433d53
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00433d08
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x434031
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00433d43
mov ebp, esp
scasb al, byte es:[edi]
lcall 0xc5e8, 0x50c0458d
cld
invalid
Function at 0x40fb90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x8e1410], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x8e140c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x8e1410], eax
cmp ecx, 0x26f
jl 0x40fba0
mov dword [0x7541a0], 0x270
ret

Function at 0x40fbe0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x8e0010]
cmp eax, dword [0x7538f0]
je 0x40fbf8
mov dword [0x7541a0], 0x271
cmp dword [0x7541a0], 0x270
jl 0x40fd17
cmp dword [0x7541a0], 0x271
jne 0x40fc2f
mov eax, dword [0x8e0010]
call fcn.0040fb90
mov eax, dword [0x8e0010]
not eax
mov dword [0x8e0010], eax
mov dword [0x7538f0], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x8e1414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x8e1410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x8e1a44]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x7541b0]
xor edx, eax
mov dword [ebx*4 + 0x8e1410], edx
cmp ebx, 0xe2
jl 0x40fc38
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x8e1414]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x8e1410]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x8e1084]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x7541b0]
xor edx, eax
mov dword [ebx*4 + 0x8e1410], edx
cmp ebx, 0x26e
jl 0x40fc8c
mov eax, dword [0x8e1dcc]
and eax, 0x80000000
mov edx, dword [0x8e1410]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x8e1a40]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x7541b0]
xor eax, edx
mov dword [0x8e1dcc], eax
mov dword [0x7541a0], 0
mov eax, dword [0x7541a0]
mov eax, dword [eax*4 + 0x8e1410]
add dword [0x7541a0], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x4117b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x753610]
cmp ax, 0xcb
je 0x4118ac
cmp ax, 0xcc
je 0x4118ac
mov edx, dword [0x8e2020]
test edx, edx
je 0x4117e2
mov eax, dword [0x8e1ec0]
call edx
mov ebx, eax
jmp 0x4117e7
mov ebx, 0x8e1ec4
cmp word [0x8e1eb0], 0
jle 0x41180a
mov eax, 0x8e1e90
call fcn.00411a60
mov eax, ebx
call fcn.00411390
mov eax, ebx
call fcn.00411400
mov edi, dword [ebx]
jmp 0x41182a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x411825
mov edx, edi
mov eax, ebx
call fcn.00410860
jmp 0x411828
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x411810
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x8e1eb0], 0
jle 0x4118ac
mov edx, 0x8e1dd0
mov eax, ebx
call fcn.00410990
mov edi, eax
test edi, edi
je 0x41187f
mov eax, dword [0x8e1e64]
mov dword [edi + 0xc], eax
cmp dword [0x8e1e64], 0
je 0x411874
mov eax, dword [0x8e1e64]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x8e1e64], eax
sub word [0x8e1eb0], 1
cmp word [0x8e1eb0], 0
sete bl
mov eax, 0x8e1e90
call fcn.00411a70
test bl, bl
je 0x4118ac
mov eax, 0x8e1e90
call fcn.00411a50
pop edi
pop esi
pop ebx
ret
Function at 0x413760
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x8e1250], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.00413940
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x8e1250]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403aa0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x753690], eax
mov esi, dword [0x753690]
jmp 0x413900
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x4137f0
cmp byte [esi], 0
je 0x413909
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x413865
mov al, byte [esi]
cmp al, 1
jb 0x41385b
sub al, 0x20
jbe 0x41382c
sub al, 2
je 0x41383f
jmp 0x41385b
mov al, byte [ebp - 0x10c]
test al, al
je 0x41386a
add dword [ebp - 0x110], 1
jmp 0x413862
cmp byte [esi + 1], 0x22
je 0x413856
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x413862
add esi, 1
jmp 0x413862
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x41381c
test dword [ebp - 0x114], 0xffffffff
je 0x4138f9
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.00413940
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x8e1250]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x4138f1
mov al, byte [esi]
cmp al, 1
jb 0x4138e7
sub al, 0x20
jbe 0x4138b8
sub al, 2
je 0x4138cb
jmp 0x4138e7
mov al, byte [ebp - 0x10c]
test al, al
je 0x4138f6
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x4138ee
cmp byte [esi + 1], 0x22
je 0x4138e2
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x4138ee
add esi, 1
jmp 0x4138ee
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x4138a8
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x4137f3
mov ebx, dword [ebp - 0x114]
mov dword [0x8e1240], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x8e1250
call fcn.00411610
mov eax, dword [0x8e1250]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4300c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x43015c
mov eax, dword [ebp - 0x1c]
sub eax, 2
mov dword [ebp - 0x20], 0
cmp eax, dword [ebp - 0x20]
jl 0x430178
sub dword [ebp - 0x20], 1
nop
add dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x430178
sub dx, 0x20
je 0x430155
sub dx, 0x80
je 0x430155
sub dx, 0x1f62
jb 0x430178
sub dx, 1
jbe 0x430155
sub dx, 6
je 0x430155
sub dx, 0x26
jne 0x430178
jmp 0x430155
cmp eax, dword [ebp - 0x20]
jg 0x430108
jmp 0x430178
cmp dword [ebp - 0x1c], 2
jne 0x43016c
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x430178
mov al, byte [ebp - 0xc]
call fcn.0040c1d0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x4301c6
sub ax, 0x21
je 0x4301d4
sub ax, 0x17
je 0x4301da
sub ax, 0x222
je 0x4301e0
sub ax, 0x392
je 0x4301e6
sub ax, 1
je 0x4301ec
sub ax, 0x1996
je 0x4301f2
sub ax, 1
je 0x4301f8
sub ax, 6
je 0x4301fe
sub ax, 0xb
je 0x43020a
sub ax, 0x1b
je 0x430204
sub ax, 0x367
je 0x430210
jmp 0x430216
mov ax, word [ebp - 0x24]
call fcn.0040c240
mov byte [ebp - 0x10], al
jmp 0x43021c
mov byte [ebp - 0x10], 0x20
jmp 0x43021c
mov byte [ebp - 0x10], 0x2e
jmp 0x43021c
mov byte [ebp - 0x10], 0x27
jmp 0x43021c
mov byte [ebp - 0x10], 0x2c
jmp 0x43021c
mov byte [ebp - 0x10], 0x27
jmp 0x43021c
mov byte [ebp - 0x10], 0x20
jmp 0x43021c
mov byte [ebp - 0x10], 0x20
jmp 0x43021c
mov byte [ebp - 0x10], 0x20
jmp 0x43021c
mov byte [ebp - 0x10], 0x20
jmp 0x43021c
mov byte [ebp - 0x10], 0x2d
jmp 0x43021c
mov byte [ebp - 0x10], 0x27
jmp 0x43021c
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0x10]
leave
ret

Function at 0x442620
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x44263a
mov dword [ebx + 0xc], 0
pop ebx
leave
ret
Function at 0x4590d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x4590dc
mov eax, 0x8e12e0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4590ef
and eax, 0x10
sete al
jmp 0x4590f1
mov al, 0
leave
ret

Function at 0x459100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x45910c
mov eax, 0x8e12e0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x45911f
and eax, 0x10
seta al
jmp 0x459121
mov al, 0
leave
ret

Function at 0x459220
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x45922c
mov eax, 0x8e12e0
push eax
call sub.kernel32.dll_GetFileAttributesW
leave
ret

Function at 0x459240
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
test eax, eax
jne 0x45924e
mov eax, 0x8e12e0
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x45925f
mov ebx, 0
jmp 0x459266
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret

Function at 0x459880
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x459944
mov ebx, 1
sub ebx, 1
mov esi, esi
add ebx, 1
lea eax, [ebx*4 + 0x8e2b4c]
mov edx, 0
call fcn.00409430
mov dword [ebx*4 + 0x8e2b6c], 0xffffffff
cmp ebx, 7
jl 0x4598b8
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x459944
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0xa
call fcn.00409df0
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.0044ee70
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x459944
push 4
push ebx
push esi
mov eax, 0x459740
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x4597e0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
call fcn.0040ebd0
lea eax, [ebp - 0x38]
call fcn.00404190
pop eax
test eax, eax
je 0x45995b
call fcn.0040ed00
pop esi
pop ebx
leave
ret
Function at 0x45a000
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x48]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x45a14c
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.0044e310
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00409430
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.0040abe0
mov eax, dword [ebp - 0x48]
mov edx, 0
call fcn.00409430
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x44]
jmp 0x45a13b
lea ecx, [ebp - 0x34]
mov eax, ebx
mov dx, 0
call fcn.00409d50
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 8]
call fcn.00409430
mov eax, dword [ebp - 8]
test eax, eax
je 0x45a0b3
mov eax, dword [eax - 4]
mov dword [ebp - 0x40], eax
lea esi, [ebp - 8]
mov al, 0
mov dx, 1
mov cl, al
mov eax, esi
call fcn.0040abe0
mov edx, dword [ebp - 8]
mov al, 0x3d
call fcn.0040a500
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [edi - 1]
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.0040a3d0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0044e310
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 4]
call fcn.0040a0a0
test eax, eax
jne 0x45a130
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x45a112
mov eax, dword [eax - 4]
sub eax, edi
mov ecx, eax
lea eax, [edi + 1]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040a3d0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
call fcn.00409430
jmp 0x45a144
mov edx, dword [ebp - 0x40]
lea eax, [ebx + edx]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x45a090
push dword [ebp - 0x44]
call sub.kernel32.dll_FreeEnvironmentStringsA
call fcn.0040ebd0
lea eax, [ebp - 0x3c]
call fcn.00404190
lea eax, [ebp - 0x38]
call fcn.00404190
lea eax, [ebp - 0x34]
call fcn.00404190
lea eax, [ebp - 4]
call fcn.00404190
lea eax, [ebp - 8]
call fcn.00404190
pop eax
test eax, eax
je 0x45a183
call fcn.0040ed00
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45a190
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040e950
call fcn.00410630
push eax
test eax, eax
jne 0x45a294
mov eax, dword [ebp - 0x3c]
mov edx, 0
call fcn.0040bec0
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00456c10
jmp 0x45a283
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040be20
mov edx, dword [ebp - 4]
mov al, 0x3d
call fcn.0040c880
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebx - 1]
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040c7d0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00456c10
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.0040c580
test eax, eax
jne 0x45a272
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x45a254
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea eax, [ebx + 1]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0040c7d0
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
call fcn.0040bec0
jmp 0x45a28e
mov eax, esi
call fcn.00404690
shl eax, 1
lea eax, [esi + eax]
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x45a200
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
call fcn.0040ebd0
lea eax, [ebp - 0x38]
call fcn.0040bbc0
lea eax, [ebp - 0x34]
call fcn.0040bbc0
lea eax, [ebp - 4]
call fcn.0040bbc0
lea eax, [ebp - 8]
call fcn.0040bbc0
pop eax
test eax, eax
je 0x45a2c3
call fcn.0040ed00
pop edi
pop esi
pop ebx
leave
ret