joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42af8c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b090
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040eb68
lea eax, [ebp - 4]
call fcn.0040ec84
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040f13c
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x42b078
mov eax, ebx
call fcn.0040b84c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x42b071
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040f13c
push eax
call sub.VERSION.DLL_GetFileVersionInfoW
test eax, eax
je 0x42b059
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42b0a4
mov eax, dword [ebp - 0x10]
push eax
call sub.VERSION.DLL_VerQueryValueW
test eax, eax
je 0x42b059
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b078
mov eax, dword [ebp - 0x10]
call fcn.0040b868
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b097
lea eax, [ebp - 4]
call fcn.0040e740
pop eax
jmp eax

Function at 0x42bfd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040ec10
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00414178
mov edi, eax
cmp edi, 0x104
jbe 0x42bf7f
mov eax, edi
add eax, eax
call fcn.0040b84c
mov esi, eax
jmp 0x42bf81
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00414178
push esi
call sub.USER32.DLL_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42bfba
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42bfa4
mov eax, esp
cmp esi, eax
je 0x42bfc7
mov eax, esi
call fcn.0040b868
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42c000
cmp bl, 0
je 0x42bffc
cmp bl, 0x41
jl 0x42bff7
cmp bl, 0x5a
jg 0x42bff7
or bl, 0x20
xor al, bl
inc esi
jmp 0x42bfdb
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42bf40

Function at 0x42c8f0
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040f1dc
add esp, 0x800
pop ebx
ret
Function at 0x48bdfc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x48be04
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4ca3f4
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4ca437
cmp byte [ebx + 0x11], 0
jne 0x4ca437
cmp byte [ebx + 0x24], 0
jne 0x4ca437
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
je 0x4ca44e
mov ecx, dword [0x5233bc]
mov dl, 1
mov eax, dword [0x49d700]
call fcn.00429edc
call fcn.0040df0c
pop ebx
ret
mov ecx, dword [0x5233bc]
mov dl, 1
mov eax, dword [0x49d700]
call fcn.00429edc
call fcn.0040df0c
pop ebx
ret

Function at 0x4cacb8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4cad06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004ca2a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cad1f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4cad28
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004ca2a0
dec esi
jne 0x4cad4a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x503c58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov byte [ebp - 5], al
mov al, byte [edx]
mov bl, al
xor bl, byte [ebp + 0xc]
lock cmpxchg byte [edx], bl
jne 0x503c6d
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
movzx eax, al
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x5041e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ax, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov word [ebp - 6], ax
mov ax, word [edx]
mov bx, ax
xor bx, word [ebp + 0xc]
lock cmpxchg word [edx], bx
jne 0x504200
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
movzx eax, ax
add esp, 0xc
pop ebx
pop ebp
ret
Function at 0x504748
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx]
mov ebx, eax
xor ebx, dword [ebp + 0xc]
lock cmpxchg dword [edx], ebx
jne 0x50475d
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x505a08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov edi, dword [ebp - 0x1c]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, edx
mov ebx, eax
xor ebx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x14]
lock cmpxchg8b qword [edi]
jne 0x505a31
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x506c4c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
test edi, edi
je 0x506d7e
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x506d7e
cmp dword [esp + 0x28], 0
je 0x506d7e
mov dword [esp], str.borlndmm
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
test esi, esi
je 0x506d7e
mov ebp, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysGetMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [edi], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysFreeMem_qqrpv
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysReallocMem_qqrpvi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysAllocMem_qqri
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [ebp], eax
mov dword [esp], esi
mov dword [esp + 4], str._Borlndmm_SysRegisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [esp], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 4], str._Borlndmm_SysUnregisterExpectedMemoryLeak_qqrpi
call sub.KERNEL32.DLL_GetProcAddress
sub esp, 8
mov dword [esi], eax
mov eax, dword [edi]
mov dword [0x52a690], eax
cmp dword [ebp], 0
jne 0x506d32
mov dword [ebp], 0x506c1c
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jne 0x506d41
mov dword [eax], 0x506c0c
mov ecx, dword [esi]
test ecx, ecx
je 0x506d6e
cmp dword [edi], 0
je 0x506d7e
cmp dword [ebx], 0
je 0x506d7e
mov esi, dword [esp + 0x28]
cmp dword [esi], 0
je 0x506d7e
cmp dword [ebp], 0
je 0x506d7e
cmp dword [eax], 0
je 0x506d7e
xor eax, eax
test ecx, ecx
setne al
jmp 0x506d80
mov dword [esi], 0x506c0c
mov ecx, 0x506c0c
cmp dword [edi], 0
jne 0x506d4c
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5084e8
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x521474], eax
jbe 0x508525
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x52a798]
call sub.KERNEL32.DLL_ReadFile
add esp, 0xc
cmp eax, 1
jne 0x50852c
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
jmp 0x508542
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
jne 0x50853e
add esp, 0xc
ret
sub esp, 0xc
push ecx
call fcn.005093d8
add esp, 0x10
add esp, 0xc
ret

Function at 0x508560
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x521474], eax
jbe 0x50859d
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x52a798]
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
cmp eax, 1
jne 0x5085ae
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
call fcn.005093d8
add esp, 0x10
add esp, 0xc
ret
call fcn.00509478
add esp, 0xc
ret
Function at 0x508c50
Capabilities:
Get disk information

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov dword [esp], 0x104
call fcn.00507010
mov esi, eax
test esi, esi
je 0x508cda
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x104
call sub.KERNEL32.DLL_GetFullPathNameA
sub esp, 0x10
mov ebx, eax
lea eax, [ebx - 1]
cmp eax, 0x103
jae 0x508cd2
cmp byte [esi + 1], 0x3a
jne 0x508cc3
mov al, byte [esi]
mov byte [esp + 0x18], al
mov word [esp + 0x19], 0x5c3a
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetDriveTypeA
sub esp, 4
cmp eax, 1
jbe 0x508cd2
mov edi, dword [esp + 0x30]
inc ebx
test edi, edi
je 0x508ce5
cmp ebx, dword [esp + 0x38]
jbe 0x508cf5
mov dword [esp], esi
call fcn.00507020
xor edi, edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00507028
mov edi, eax
jmp 0x508cdc
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00507aa0
mov dword [esp], esi
call fcn.00507020
jmp 0x508cdc

Function at 0x508d5c
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebx
push edi
push esi
sub esp, 0x110
mov edi, dword [esp + 0x128]
mov ebx, dword [esp + 0x120]
test ebx, ebx
je 0x508db6
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
bt eax, ecx
jae 0x508e2b
add ebx, 0x40
mov byte [esp + 4], bl
mov word [esp + 5], 0x2e3a
mov byte [esp + 7], 0
lea eax, [esp + 8]
lea ecx, [esp + 0xd]
lea edx, [esp + 4]
push eax
push ecx
push 0x103
push edx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0x508dd3
sub esp, 8
lea eax, [esp + 0x15]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
add esp, 8
test eax, eax
je 0x508e20
cmp eax, edi
jg 0x508e20
sub esp, 0xc
lea ebx, [esp + 0x19]
push ebx
call fcn.00507aec
add esp, 0x10
cmp eax, edi
jge 0x508e13
mov esi, dword [esp + 0x124]
test esi, esi
jne 0x508e04
sub esp, 0xc
push edi
call fcn.00507010
add esp, 0x10
mov esi, eax
test esi, esi
je 0x508e20
sub esp, 8
push ebx
push esi
call fcn.00507aa0
add esp, 0x10
jmp 0x508e2d
call fcn.0051257c
mov dword [eax], 0x22
jmp 0x508e2b
call fcn.0051257c
mov dword [eax], 8
xor esi, esi
mov eax, esi
add esp, 0x110
pop esi
pop edi
pop ebx
ret

Function at 0x50a0ac
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
cmp eax, 1
jne 0x50a0c9
xor eax, eax
add esp, 0xc
ret
add esp, 0xc
jmp fcn.00509478

Function at 0x50b3dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
mov ecx, eax
cmp ecx, 0xffffffff
je 0x507d5f
xor eax, eax
test bl, 2
je 0x507d5a
and ecx, 1
je 0x507d5a
call fcn.0051257c
mov dword [eax], 5
mov eax, 0xffffffff
add esp, 8
pop ebx
ret
add esp, 8
pop ebx
jmp fcn.00509478
jmp 0x507d20
Function at 0x50c9bc
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov dword [esp + 0x18], edx
mov esi, ecx
mov eax, dword [esi + 4]
lea ebp, [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], eax
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], 0x1001
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.00507aec
mov word [esp + eax + 0x1c], 0x5f
mov edi, dword [esi + 4]
mov dword [esp], ebp
call fcn.00507aec
lea ecx, [esp + eax + 0x1c]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], 0x1002
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.00507aec
mov word [esp + eax + 0x1c], 0x2e
mov edi, dword [esi]
mov dword [esp], ebp
call fcn.00507aec
lea eax, [esp + eax + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 0xa
call fcn.0050fd88
mov edi, dword [esi + 0x24]
test edi, edi
je 0x50cab0
mov dword [esp], edi
call fcn.00507aec
mov ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00507aec
mov ecx, ebp
mov ebp, eax
mov dword [esp], ecx
call fcn.00507aec
add ebp, ebx
lea eax, [eax + ebp + 3]
lea ebp, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00507028
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
jne 0x50cb05
jmp 0x50cb4d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00507aec
mov ebx, eax
mov edi, ebp
mov dword [esp], ebp
call fcn.00507aec
mov ebp, eax
lea eax, [ebx + ebp + 3]
mov dword [esp], eax
call fcn.00507010
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x50cb4d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00507aec
lea eax, [ebp + eax + 3]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.00507987
mov ebp, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.005079a0
mov edi, dword [esi + 0x24]
mov dword [esp], edi
call fcn.00507aec
mov word [edi + eax], 0x3d
mov eax, dword [esi + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.005079a0
mov esi, dword [esi + 0x24]
mov dword [esp], esi
call fcn.00507aec
mov word [esi + eax], 0xa
mov eax, 1
jmp 0x50cb4f
xor eax, eax
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x50e5a8
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push 0
push dword [edi + 4]
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00507010
add esp, 0x10
mov dword [edi + 4], eax
push esi
push eax
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi]
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00507010
add esp, 0x10
mov dword [edi], eax
test edi, edi
je 0x50e61b
push esi
push eax
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
jmp 0x50e62a
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
xor ecx, ecx
and ecx, ebx
mov dword [esp + 8], ecx
push 0
push dword [edi + 8]
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00507010
add esp, 0x10
mov dword [edi + 8], eax
push esi
push eax
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi + 0xc]
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00507010
add esp, 0x10
mov dword [edi + 0xc], eax
push esi
push eax
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
and ecx, ebx
mov ebx, ebp
mov ebp, ecx
push 0
push dword [edi + 0x10]
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00507010
add esp, 0x10
mov dword [edi + 0x10], eax
push esi
push eax
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, ebp
and ebx, dword [esp + 8]
sub esp, 0xc
push 4
call fcn.00507010
add esp, 0x10
mov esi, eax
test esi, esi
je 0x50e714
push 4
push esi
push 0x11
push dword [esp + 0x2c]
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0xc
test eax, eax
je 0x50e723
push esi
call fcn.0050f73c
add esp, 0x10
mov word [edi + 0x14], ax
sub esp, 0xc
push esi
call fcn.00507020
add esp, 0x10
mov eax, 1
jmp 0x50e72e
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
jmp 0x50e72c
push esi
call fcn.00507020
add esp, 0x10
xor eax, eax
and ebx, eax
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5124ac
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x4c]
call sub.KERNEL32.DLL_CreateFileA
add esp, 4
mov edi, eax
test edi, edi
je 0x512572
sub esp, 0xc
lea eax, [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocalTime
add esp, 0xc
movzx eax, word [esp + 0xa]
mov dword [esp + 0x18], eax
movzx ecx, word [esp + 0xe]
movzx edx, word [esp + 8]
movzx ebp, word [esp + 0x10]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x14]
movzx ebx, word [esp + 0x16]
sub esp, 0xc
push ebx
push esi
push eax
push ebp
push edx
push ecx
push dword [esp + 0x3c]
push str._02d__02d__04d__02d:_02d:_02d._03d
push 0x52aaa0
call sub.USER32.DLL_wsprintfA
add esp, 0x24
push 0x52aaa0
call fcn.00507aec
add esp, 4
push 0
lea ebx, [esp + 0x18]
push ebx
push eax
push 0x52aaa0
push edi
call sub.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x40]
push esi
call fcn.00507aec
add esp, 4
push 0
push ebx
push eax
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5125a4
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa0]
mov eax, dword [0x52aac0]
test eax, eax
mov ecx, dword [0x52aabc]
jne 0x512669
test ecx, ecx
jne 0x512669
cmp dword [0x5228f4], 0
je 0x51269f
sub esp, 4
lea esi, [esp + 0x14]
push 0x80
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 4
push 0x5c
push esi
call fcn.00511d48
add esp, 0x10
test eax, eax
jne 0x512614
sub esp, 8
push 0x3a
push esi
call fcn.00511d48
add esp, 0x10
test eax, eax
je 0x512617
inc eax
mov esi, eax
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x51265a
call fcn.00519f4e
sub esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0x512734
push eax
call sub.USER32.DLL_EnumThreadWindows
add esp, 4
cmp dword [esp + 0xc], 0
mov eax, 0x11010
mov ecx, 0x12010
cmove ecx, eax
push ecx
push esi
push edi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x5126ec
cmp ecx, 0xffffffff
je 0x5126ec
test ecx, ecx
je 0x512680
sub esp, 0xc
push edi
call ecx
add esp, 0x10
mov eax, dword [0x52aac0]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x5126ec
cmp byte [eax], 0
je 0x5126ec
sub esp, 8
push edi
push eax
call fcn.005124ac
add esp, 0xa0
jmp 0x5126f2
sub esp, 0xc
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
add esp, 0xc
mov esi, eax
sub esp, 0xc
lea ebx, [esp + 0x1c]
push 0
push ebx
push 2
push 0x522690
push esi
call sub.KERNEL32.DLL_WriteFile
push edi
call fcn.00507aec
add esp, 4
push 0
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
push ebx
push 2
push 0x522690
push esi
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
add esp, 0x90
pop esi
pop edi
pop ebx
ret
Function at 0x514100
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x52eaf4]
test eax, eax
je 0x514135
mov ecx, dword [eax]
test ecx, ecx
je 0x514198
add eax, 4
xor edi, edi
nop
cmp byte [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x514120
jmp 0x5141c4
mov esi, dword [0x52eb2c]
test esi, esi
jne 0x514162
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x52eb2c], esi
test esi, esi
jne 0x514162
mov dword [esp], str.GetEnvironmentStrings_failed
call fcn.00512714
mov esi, dword [0x52eb2c]
mov dword [esp], esi
call fcn.00507aec
test eax, eax
je 0x51419c
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop word cs:[eax + eax]
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
call fcn.00507aec
test eax, eax
jne 0x514180
inc ebx
jmp 0x5141a3
xor edi, edi
jmp 0x5141c4
mov ebx, 1
xor edi, edi
mov dword [esp], ebx
call fcn.00507010
mov dword [0x52eaf0], eax
test eax, eax
je 0x51421d
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.005077bc
lea eax, [edi + 4]
mov dword [0x52eaf8], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.00506ff4
mov esi, eax
test esi, esi
je 0x51421d
mov edi, dword [0x52eaf4]
test edi, edi
je 0x514221
mov edx, dword [edi]
test edx, edx
je 0x51425a
lea eax, [edi + 4]
xor ecx, ecx
nop word [eax + eax]
cmp byte [edx], 0
je 0x514210
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x514211
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x514200
jmp 0x514256
xor eax, eax
jmp 0x51426d
mov ebx, dword [0x52eaf0]
mov dword [esp], ebx
call fcn.00507aec
test eax, eax
je 0x514262
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [ebx + eax + 1]
mov dword [esp], ebx
call fcn.00507aec
add ebp, 4
test eax, eax
jne 0x514240
test edi, edi
je 0x514262
mov dword [esp], edi
call fcn.00507020
mov dword [0x52eaf4], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5150b4
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, edx
mov ebx, ecx
cmp edi, 0xf
jg 0x5150dd
test edi, edi
je 0x5150dd
call fcn.0051257c
mov dword [eax], 0x13
mov eax, 0xffffffff
jmp 0x515163
call fcn.00514d80
mov esi, eax
test esi, esi
je 0x515131
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esi + 4], ebp
mov dword [esi + 0x14], ebx
mov dword [esi + 0x58], eax
sub esp, 8
lea eax, [esp + 0x10]
push eax
push ecx
push esi
push 0x515254
push edi
push edx
call sub.KERNEL32.DLL_CreateThread
add esp, 8
test eax, eax
je 0x515143
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], eax
test ecx, ecx
je 0x515163
mov edx, dword [esp + 8]
mov dword [ecx], edx
jmp 0x515163
call fcn.0051257c
mov dword [eax], 8
mov eax, 0xffffffff
jmp 0x515163
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x51515e
sub esp, 0xc
push 0x59
call fcn.005093d8
add esp, 0x10
jmp 0x515163
call fcn.00509478
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret