joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a9c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00407198
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41aa2a
test ah, 4
je 0x41aa23
test bl, bl
jne 0x41a9e8
mov al, 1
jmp 0x41aa51
test al, 0x10
je 0x41a9f0
xor eax, eax
jmp 0x41aa51
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41aa14
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x41aa51
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x41aa51
test al, 0x10
sete al
jmp 0x41aa51
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x41aa4b
cmp ebx, 3
je 0x41aa4b
cmp ebx, 0x7b
je 0x41aa4b
mov eax, esi
call fcn.0041a980
test al, al
jne 0x41aa4f
xor eax, eax
jmp 0x41aa51
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x41aa58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.00407198
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x41aaff
test esi, 0x400
jne 0x41aa94
test esi, 0x10
setne bl
jmp 0x41ab1e
cmp byte [esp], 0
je 0x41aac8
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41ab1e
push eax
call sub.kernel32.dll_CloseHandle_1
test esi, 0x10
setne bl
jmp 0x41ab1e
test esi, 0x10
je 0x41aad4
mov bl, 1
jmp 0x41ab1e
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x41aafb
push eax
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x41ab1e
mov bl, 1
jmp 0x41ab1e
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x41ab18
cmp eax, 3
je 0x41ab18
cmp eax, 0x7b
je 0x41ab18
cmp eax, 0x35
jne 0x41ab1c
xor ebx, ebx
jmp 0x41ab1e
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41ad1c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41adef
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406b68
cmp byte [ebp - 9], 0
je 0x41adad
mov eax, ebx
call fcn.00407198
push eax
call sub.kernel32.dll_GetFileAttributesW
test ah, 4
je 0x41adad
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004194e4
test al, al
je 0x41adad
mov eax, dword [ebp - 8]
call fcn.0041b31c
test al, al
je 0x41ada2
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0041b09c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00421248
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.004073f4
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406b68
push edi
mov eax, dword [ebp - 4]
call fcn.00407198
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x41adc7
call sub.kernel32.dll_GetLastError_2
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41adf6
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004067d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004067d0
ret

Function at 0x41af18
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.00407198
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x41af6d
call sub.kernel32.dll_GetLastError_2
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41af67
test ah, 4
je 0x41af67
test al, 0x10
je 0x41af67
mov eax, esi
call fcn.00407198
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x41af6d
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41ef7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41efb5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004068c8
jmp 0x41efbe
mov eax, ebx
mov edx, esi
call fcn.00406b20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41efc8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41efea
movzx eax, word [esp]
jmp 0x41efec
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41fcc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41fde5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041fac8
mov esi, eax
mov eax, dword [0x4afa70]
cmp byte [eax], 0
je 0x41fd8d
mov eax, dword [0x4af7b4]
call fcn.00404a1c
call fcn.004045fc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41fc90]
call fcn.004082d4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41fe00
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41fdc9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4af734]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4b2c50]
call fcn.00408398
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fdec
lea eax, [ebp - 4]
mov edx, dword [0x41fc90]
call fcn.004082e0
ret

Function at 0x421814
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406c3c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00409e3c
mov edi, eax
cmp edi, 0x104
jbe 0x4217bb
mov eax, edi
add eax, eax
call fcn.004044a8
mov esi, eax
jmp 0x4217bd
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00409e3c
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4217f8
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4217e2
mov eax, esp
cmp esi, eax
je 0x421805
mov eax, esi
call fcn.004044c4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x421840
cmp bl, 0
je 0x42183c
cmp bl, 0x41
jl 0x421837
cmp bl, 0x5a
jg 0x421837
or bl, 0x20
xor al, bl
inc esi
jmp 0x42181b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42177c

Function at 0x422028
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407244
add esp, 0x800
pop ebx
ret
Function at 0x44ba2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x44babb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, esi
call fcn.0041aa58
test al, al
je 0x44ba6a
lea eax, [ebp - 4]
mov edx, esi
call fcn.00406b68
jmp 0x44ba72
lea eax, [ebp - 4]
call fcn.0044b9ec
lea eax, [ebp - 0x20c]
push eax
xor bl, 1
movzx eax, bl
push eax
push 0x44bacc
mov eax, dword [ebp - 4]
call fcn.00407198
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, edi
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00407244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bac2
lea eax, [ebp - 4]
call fcn.00406770
ret

Function at 0x44bb44
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x44bc00
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0041b288
mov edx, dword [ebp - 4]
mov eax, 0x44bc1c
call fcn.004490f4
test al, al
je 0x44bb8d
lea eax, [ebp - 4]
mov ecx, 8
mov edx, 1
call fcn.004075ac
jmp 0x44bbb0
mov edx, dword [ebp - 4]
mov eax, 0x44bc3c
call fcn.004490f4
test al, al
je 0x44bbb0
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.004075ac
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0041b138
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00421248
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406b68
mov eax, dword [ebp - 4]
call fcn.00407198
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bc07
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004067d0
ret

Function at 0x44cc28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x44cc53
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x4a6b40]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x44cc34
mov dword [eax], edx
pop esi
pop ebx
ret

Function at 0x44e454
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x44e47c
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov edi, dword [0x4af5f8]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x44e461
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x452fb8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x452ffe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.00451a54
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453005
lea eax, [ebp - 4]
call fcn.00406770
ret
Function at 0x45519c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4552b2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x20]
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.00404f18
inc dword [ebx + 0x10]
cmp dword [ebx + 0x2c], 0
jne 0x4551d7
cmp dword [ebx + 0x28], 0
jbe 0x455210
jmp 0x4551d9
jle 0x455210
lea eax, [ebp - 4]
mov edx, dword [ebx + 4]
call fcn.00406b68
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.00454b9c
mov eax, dword [ebp - 8]
call fcn.00407198
push eax
mov eax, dword [ebp - 4]
call fcn.00407198
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x455272
cmp word [ebx + 0x32], 0
je 0x455251
mov byte [ebp - 9], 0
lea ecx, [ebp - 9]
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
cmp byte [ebp - 9], 0
je 0x45523d
mov dl, 1
mov eax, dword [0x449a14]
call fcn.0044acd0
call fcn.00405f1c
mov eax, dword [ebx + 4]
call fcn.0044bc48
cmp edx, 0xffffffff
jne 0x45524d
cmp eax, 0xffffffff
je 0x45521b
jmp 0x455262
mov dl, 1
mov eax, dword [0x449a14]
call fcn.0044acd0
call fcn.00405f1c
mov eax, dword [ebx + 4]
call fcn.0044bad4
mov edx, dword [ebx + 0x10]
call fcn.0044ce28
push 0xff20
mov ecx, dword [ebx + 4]
mov dl, 1
mov eax, dword [0x434854]
call fcn.0043fe48
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4552b9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004067d0
ret
Function at 0x47ed42
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x47edfa
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
mov eax, dword [eax]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
shr ecx, 9
add eax, ecx
cmp eax, 0x100
jae 0x47ed92
movsx edx, byte [eax + 0x4acd44]
mov ecx, 9
sub ecx, edx
shl eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x4ace44]
shl edx, 8
add eax, edx
add ebx, eax
jmp 0x47edfa
cmp eax, 0x10000
jae 0x47edaa
mov edx, eax
shr edx, 8
movsx edx, byte [edx + 0x4acd44]
add edx, 8
jmp 0x47edd1
cmp eax, 0x1000000
jae 0x47edc2
mov ecx, eax
shr ecx, 0x10
movsx edx, byte [ecx + 0x4acd44]
add edx, 0x10
jmp 0x47edd1
mov ecx, eax
shr ecx, 0x18
movsx edx, byte [ecx + 0x4acd44]
add edx, 0x18
lea ecx, [edx - 9]
shr eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x4ace44]
mov ecx, edx
shl ecx, 8
add eax, ecx
mov edx, eax
add ebx, eax
test esi, esi
je 0x47edfa
cmp esi, edx
jg 0x47edfa
or eax, 0xffffffff
jmp 0x47ee0b
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x47ed51
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x48268c
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x4826bb
mov ecx, 0xc8
mov edx, 0x482760
mov eax, 0x482828
call fcn.00406688
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
dec esi
test esi, esi
jl 0x482730
inc esi
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
movzx edx, byte [ebx]
mov ecx, 1
xor ecx, eax
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
mov edx, dword [edi]
movzx eax, byte [ebx]
call fcn.0044cc58
mov ebp, eax
mov dword [edi], ebp
and ebp, 0xff
add dword [edi + 4], ebp
imul ebp, dword [edi + 4], 0x8088405
inc ebp
mov dword [edi + 4], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.0044cc58
mov dword [edi + 8], eax
inc ebx
dec esi
jne 0x4826db
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4828b4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x4828dc
mov ecx, 0xf8
mov edx, 0x48296c
mov eax, 0x482a34
call fcn.00406688
mov edx, esi
mov eax, ebx
call fcn.00482a9c
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, 1
xor edx, eax
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
movzx eax, byte [esi]
call fcn.0044cc58
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.0044cc58
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x4828f2
movzx eax, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x482a9c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
test eax, eax
je 0x482ac7
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x482b0f
mov edi, 1
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.0044cc58
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.0044cc58
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x482ad2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4930a8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4932a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00498b1c
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x4ae9bc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4ae9c0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4ae9c4], eax
mov eax, dword [0x4afc10]
cmp dword [eax], 2
sete byte [0x4ae19d]
push 0x4932b4
call sub.kernel32.dll_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.0049b4b8
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x4ae19d], 0
jne 0x493137
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0049b6cc
test al, al
je 0x493137
mov eax, dword [ebp - 0x4c]
mov dword [0x4b55d0], eax
jmp 0x49313e
xor eax, eax
mov dword [0x4b55d0], eax
call fcn.00492d84
and eax, 0x7f
cmp eax, 0x14
ja case.0x49314f.0
jmp dword [eax*4 + 0x493156]
mov byte [0x4ae198], 1
jmp case.0x49314f.0
mov byte [0x4ae199], 1
jmp case.0x49314f.0
mov byte [0x4ae19a], 1
jmp case.0x49314f.0
mov byte [0x4ae19b], 1
jmp case.0x49314f.0
mov byte [0x4ae19c], 1
jmp case.0x49314f.0
mov byte [0x4ae19e], 1
mov byte [0x4ae19f], 1
jmp case.0x49314f.0
mov byte [0x4ae19e], 1
mov byte [0x4ae1a0], 1
jmp case.0x49314f.0
mov byte [0x4ae19e], 1
mov byte [0x4ae1a0], 1
mov byte [0x4ae1a1], 1
jmp case.0x49314f.0
mov byte [0x4ae1a2], 1
jmp case.0x49314f.0
mov byte [0x4ae1a3], 1
jmp case.0x49314f.0
mov byte [0x4ae1a4], 1
jmp case.0x49314f.0
mov byte [0x4ae1a5], 1
jmp case.0x49314f.0
mov byte [0x4ae1a6], 1
jmp case.0x49314f.0
mov byte [0x4ae1a7], 1
jmp case.0x49314f.0
mov byte [0x4ae1a8], 1
jmp case.0x49314f.0
mov byte [0x4ae1a9], 1
jmp case.0x49314f.0
mov byte [0x4ae1aa], 1
jmp case.0x49314f.0
mov byte [0x4ae1ab], 1
jmp case.0x49314f.0
mov byte [0x4ae1ac], 1
jmp case.0x49314f.0
mov byte [0x4ae1ad], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4932af
lea eax, [ebp - 4]
call fcn.00406770
ret

Function at 0x496b60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x496bc4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00407244
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0041a360
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496bcb
lea eax, [ebp - 0x14]
call fcn.00406770
ret
Function at 0x4983e8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4983fd
add esp, 0xfffffff0
call fcn.00405510
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00404ee8
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00406b20
mov eax, esi
call fcn.00407198
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexW
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x498451
mov ecx, dword [0x4afae8]
mov dl, 1
mov eax, dword [0x497fb4]
call fcn.0048dec4
call fcn.00405f1c
call sub.kernel32.dll_GetLastError_2
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x498478
call fcn.00405568
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x49b6cc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49b782
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00407198
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x49b76c
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040731c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00407198
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x49b76c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x49b794
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x49b76c
cmp dword [ebp - 0xc], 0x34
jne 0x49b76c
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b789
lea eax, [ebp - 4]
call fcn.00406770
ret

Function at 0x49b9f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406854
mov eax, dword [ebp - 8]
call fcn.00406854
xor eax, eax
push ebp
push 0x49ba5a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0
mov eax, dword [ebp - 8]
call fcn.00407198
push eax
mov eax, dword [ebp - 4]
call fcn.00407198
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ba61
lea eax, [ebp - 8]
mov edx, 2
call fcn.004067d0
ret
Function at 0x49bb20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x49bbaa
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x20a]
push edx
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x49bb8a
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00407244
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.0049ba68
jmp 0x49bb91
mov eax, ebx
call fcn.00406770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bbb1
lea eax, [ebp - 0x210]
call fcn.00406770
ret