joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a210
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47a2e8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x576908], 0
jne 0x47a2cc
lea eax, [ebp - 4]
mov edx, 0x47a300
call fcn.00490e00
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004911a8
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47a2cc
mov eax, ebx
call fcn.0048fb94
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47a2c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x47a2af
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x47a310
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x47a2af
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x576908], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a2cc
mov eax, dword [ebp - 0xc]
call fcn.0048fbac
ret
mov ebx, dword [0x576908]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a2ef
lea eax, [ebp - 4]
call fcn.00490d68
ret

Function at 0x47fa80
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x576930], 0
jne 0x47faa3
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x47fa04
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x576930], eax
ret

Function at 0x48b918
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x48b951
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00490e4c
jmp 0x48b95a
mov eax, ebx
mov edx, esi
call fcn.00490e00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48b964
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x48b985
mov al, byte [esp]
jmp 0x48b987
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x48fe38
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x48fe67
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00490e4c
jmp 0x48fe85
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0048fd60
mov edi, eax
test ebx, ebx
je 0x48fe85
cmp dword [esi], 0
je 0x48fe85
dec ebx
jmp 0x48fe6e
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x49021c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4f9498]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4902b4
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x490294
xor eax, eax
push ebp
push 0x49028d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4902d0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490294
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4f9498]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4f9498], ax
mov esp, ebp
pop ebp
ret
Function at 0x4920b4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x49226c
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x492115
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x492288
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x492182
xor eax, eax
push ebp
push 0x49217b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x492164
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4922a8
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492182
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x492263
cmp byte [ebp - 0xd], 0
jne 0x4921c4
cmp byte [ebp - 0x12], 0
je 0x492263
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4921dd
dec ebx
cmp byte [ebx], 0x2e
je 0x4921ec
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4921dc
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x492263
inc ebx
cmp byte [ebp - 0x12], 0
je 0x492219
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x492263
cmp byte [ebp - 0xd], 0
je 0x492263
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x492263
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49262c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x492714
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x576f80], 1
jae 0x492706
xor eax, eax
mov dword [0x576b8c], eax
xor eax, eax
mov dword [0x576b94], eax
xor eax, eax
mov dword [0x576b98], eax
mov byte [0x576b9e], 2
mov byte [0x576b9f], 2
mov byte [0x576ba0], 3
mov word [0x576f48], 0
mov word [0x576f58], 1
mov word [0x576f68], 0xa
mov dword [0x576f70], 0x80020004
mov dword [0x576f3c], 0x491a08
mov dword [0x576f40], 0x491a00
mov dword [0x576f44], 0x491a08
call fcn.004901ec
test al, al
je 0x4926c5
call fcn.0049021c
call fcn.004902e0
mov eax, 0x576ba4
mov edx, 0x492720
call fcn.0048d8ea
mov eax, 0x576d70
mov edx, 0x492720
call fcn.0048d8ea
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x576b84], eax
call fcn.0048e850
mov dword [0x576b80], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x576b78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49271b
ret
Function at 0x494680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00495cbc
test byte [ebp + 0xd], 0xc0
jne 0x4946a4
mov eax, dword [0x4fa230]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4946b1
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4946de
je 0x4946f0
sub ecx, 0x100
je 0x4946fe
sub ecx, 0x100
je 0x494705
sub ecx, 0x100
je 0x4946f7
jmp 0x49470c
sub ecx, 0x600
je 0x494705
sub ecx, 0x100
je 0x4946f0
jmp 0x49470c
mov edi, 1
jmp 0x494711
mov edi, 2
jmp 0x494711
mov edi, 4
jmp 0x494711
mov edi, 5
jmp 0x494711
mov edi, 3
test byte [ebp + 0xd], 1
je 0x494738
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4f9c8c]
test al, 0x80
je 0x494731
mov ebx, 0x80
jmp 0x49474a
mov ebx, 1
jmp 0x49474a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x49474a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x49475c
je 0x494765
dec eax
je 0x49476e
jmp 0x494777
mov dword [ebp - 4], 0x80000000
jmp 0x494786
mov dword [ebp - 4], 0x40000000
jmp 0x494786
mov dword [ebp - 4], 0xc0000000
jmp 0x494786
push 1
call fcn.0049607c
pop ecx
mov ebx, eax
jmp 0x494872
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4947a2
sub eax, 0x10
je 0x4947a9
sub eax, 0x10
je 0x4947b2
sub eax, 0x10
je 0x4947bb
jmp 0x4947bb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4947c2
mov dword [ebp - 8], 1
jmp 0x4947c2
mov dword [ebp - 8], 2
jmp 0x4947c2
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x49482b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x494820
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x494820
add ebx, 0xffffffb2
push ebx
call fcn.0049607c
pop ecx
mov ebx, eax
jmp 0x494872
mov edi, esi
push edi
call fcn.004945e4
pop ecx
test eax, eax
je 0x49483f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x49484b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00495dbc
add esp, 8
mov ebx, eax
inc eax
jne 0x494872
push 4
call fcn.0049607c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00495cf0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495110
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x57763c
call fcn.00495a20
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x57763c
call fcn.00495414
add esp, 0x14
push 0x4fa228
lea ecx, [ebp - 8]
push ecx
call fcn.00493160
add esp, 8
mov byte [0x57763c], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x57763c
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x495183
mov eax, 0x57763c
jmp 0x495185
xor eax, eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x49523c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x495261
cmp dword [ebx + 4], 0xfffffffe
jne 0x495261
or eax, 0xffffffff
jmp 0x495399
test byte [ebx + 8], 8
je 0x4952ce
cmp dword [ebx + 4], 0xffffffff
jne 0x4952ce
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.00495110
pop ecx
mov edi, eax
test edi, edi
je 0x4952b6
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x495399
call fcn.004960c8
test eax, eax
jne 0x4952c6
xor eax, eax
jmp 0x495399
or eax, 0xffffffff
jmp 0x495399
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x4952db
cmp eax, 0xfffffffe
jne 0x495302
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x495312
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x495328
call fcn.004960c8
test eax, eax
jne 0x495323
xor eax, eax
jmp 0x495399
or eax, 0xffffffff
jmp 0x495399
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x49533c
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x4952ce
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495a20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.00492be4
pop ecx
mov ebx, eax
test eax, eax
jne 0x495a44
xor eax, eax
jmp 0x495aed
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x495a65
cmp esi, 0x104
jb 0x495a70
push ebx
call fcn.00492bf4
pop ecx
xor eax, eax
jmp 0x495aed
cmp byte [ebx + 1], 0x3a
jne 0x495aa0
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x495aa0
push ebx
call fcn.00492bf4
pop ecx
xor eax, eax
jmp 0x495aed
inc esi
test edi, edi
je 0x495ae3
cmp esi, dword [ebp + 0x10]
jbe 0x495ab5
push ebx
call fcn.00492bf4
pop ecx
xor eax, eax
jmp 0x495aed
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.00492bf4
pop ecx
mov eax, edi
jmp 0x495aed
push esi
push ebx
call fcn.00492c04
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x495b3c
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x495b82
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x495b70
cmp eax, dword [ebp + 0x10]
jle 0x495c0b
call fcn.0049d050
mov dword [eax], 8
xor eax, eax
jmp 0x495c78
cmp dword [0x57787c], 1
jne 0x495bc7
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x495c0b
xor eax, eax
jmp 0x495c78
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x495c07
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0x495c0b
xor eax, eax
jmp 0x495c78
lea edx, [ebp - 0x10c]
push edx
call fcn.0049326c
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x495c2c
call fcn.0049d050
mov dword [eax], 0x22
xor eax, eax
jmp 0x495c78
test edi, edi
jne 0x495c4f
mov edx, dword [ebp + 0x10]
push edx
call fcn.00492be4
pop ecx
mov edi, eax
test eax, eax
jne 0x495c4f
call fcn.0049d050
mov dword [eax], 8
xor eax, eax
jmp 0x495c78
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4995d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00493160
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0049326c
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0049326c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4fae2d
lea ecx, [ebp - 0x200]
push ecx
call fcn.00493160
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0049326c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0049a7dc
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4996e1
push esi
call fcn.0049326c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0049326c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00492be4
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4996b8
xor eax, eax
jmp 0x499768
push esi
call fcn.0049326c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0049326c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004930bc
add esp, 0xc
jmp 0x499721
mov edi, dword [ebx + 0x24]
push edi
call fcn.0049326c
pop ecx
push eax
push esi
call fcn.0049326c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0049326c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00492c04
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x499721
xor eax, eax
jmp 0x499768
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00493160
add esp, 8
push 0x4fae2f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00493160
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00493160
add esp, 8
push 0x4fae31
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00493160
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49cd5c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x4fb478], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x49ce14
cmp byte [0x4a4407], 0
je 0x49cdce
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.0049cca8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49cdb7
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.0049cca8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49cdb7
lea ebx, [ebp - 0x54]
jmp 0x49cdb8
inc ebx
call fcn.0049cd14
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x49ce35
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4fb47c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0049326c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4fb47f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x49ce35
cmp dword [0x4fb478], 0xffffffff
je 0x49ce35
mov eax, dword [0x4fb478]
test eax, eax
je 0x49ce35
cmp byte [eax], 0
je 0x49ce35
push esi
push eax
call fcn.0049ceb4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ceb4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x49cf16
call fcn.0049ce64
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0049326c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0049326c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x49df0c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x57798c], 0
jne 0x49df8d
cmp dword [0x5779a8], 0
jne 0x49df3c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x5779a8], eax
test eax, eax
jne 0x49df3c
push str.GetEnvironmentStrings_failed
call fcn.0049ce4c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x5779a8]
jmp 0x49df50
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0049326c
pop ecx
mov edi, eax
test eax, eax
jne 0x49df48
lea edi, [ebp + 1]
push edi
call fcn.00492be4
pop ecx
mov ebx, eax
mov dword [0x577990], ebx
test ebx, ebx
jne 0x49df7a
xor eax, eax
jmp 0x49e050
push edi
mov edx, dword [0x5779a8]
push edx
push ebx
call fcn.0049304c
add esp, 0xc
jmp 0x49dfad
xor esi, esi
mov ebx, dword [0x57798c]
jmp 0x49dfa7
push eax
call fcn.0049326c
pop ecx
test eax, eax
jne 0x49dfa3
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x49df97
lea ebx, [esi + 4]
push 4
mov dword [0x577994], ebx
inc ebx
push ebx
call fcn.00492724
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x49dfd0
xor eax, eax
jmp 0x49e050
cmp dword [0x57798c], 0
jne 0x49e001
xor esi, esi
mov ebx, dword [0x577990]
mov eax, dword [esp]
mov ebp, eax
jmp 0x49dff2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0049326c
pop ecx
mov edi, eax
test eax, eax
jne 0x49dfe8
jmp 0x49e032
xor esi, esi
mov ebx, dword [0x57798c]
mov eax, dword [esp]
mov edi, eax
jmp 0x49e02c
push eax
call fcn.0049326c
pop ecx
test eax, eax
je 0x49e021
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x49e025
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x49e010
mov eax, dword [0x57798c]
test eax, eax
je 0x49e042
push eax
call fcn.00492bf4
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x57798c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret