joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446e18
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x446e4e
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404d8c
jmp 0x446e55
mov eax, ebx
call fcn.00404b1c
add esp, 0x108
pop ebx
ret

Function at 0x447144
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44723e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44724c
push 0x447264
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x44718b
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x4471b1
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.00405a70
push edx
push eax
lea ecx, [ebp - 0x64]
mov dl, 0x30
mov eax, 1
call fcn.0040a498
push dword [ebp - 0x64]
push 0x44727c
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.00405a70
push edx
push eax
lea ecx, [ebp - 0x68]
mov dl, 0x30
mov eax, 1
call fcn.0040a498
push dword [ebp - 0x68]
push 0x447288
mov eax, ebx
mov edx, 4
call fcn.00404e9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447245
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00404b40
ret
Function at 0x447580
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4476bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
call fcn.00404b1c
xor eax, eax
push ebp
push 0x447696
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, esi
call fcn.00404c0c
mov edx, edi
lea eax, [ebp - 0xc]
mov ecx, ebx
call fcn.00404c0c
mov eax, dword [ebp - 8]
call fcn.00404ddc
cmp ebx, eax
jne 0x44768c
mov eax, dword [ebp - 0xc]
call fcn.00404ddc
cmp ebx, eax
jne 0x44768c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404f28
je 0x44768c
lea eax, [ebp - 0x10]
push eax
push 0x40
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x44768c
mov edx, esi
mov eax, edi
mov ecx, ebx
call fcn.00402d24
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0x4ee86c]
call fcn.00405dac
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, 0x4ee86c
mov ecx, 1
mov edx, dword [0x44755c]
call fcn.00405f88
add esp, 4
lea edi, [ebx + ebx*2]
mov eax, dword [0x4ee86c]
mov dword [eax + edi*4], esi
mov eax, dword [0x4ee86c]
lea eax, [eax + edi*4 + 4]
mov edx, dword [ebp - 8]
call fcn.00404b70
mov eax, dword [0x4ee86c]
lea eax, [eax + edi*4 + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404b70
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4476a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4476c2
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404b40
ret
Function at 0x4476cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4477c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4ee86c]
call fcn.00405db4
test eax, eax
jl 0x4477ab
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2]
mov edx, dword [0x4ee86c]
lea ebx, [edx + eax*4]
xor eax, eax
push ebp
push 0x447795
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
call fcn.00404ddc
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.00404c0c
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.00404f28
jne 0x44778b
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 4]
call fcn.00404ddc
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x44778b
mov eax, dword [ebx + 4]
call fcn.00404ddc
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
call fcn.00402d24
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.00404ddc
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44779f
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x447705
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4477c8
lea eax, [ebp - 8]
call fcn.00404b1c
ret
Function at 0x447a94
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x447bbd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 0x5c
je 0x447ba2
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x447b07
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00404d04
lea eax, [ebp - 0x2c]
mov edx, 0x447bd4
call fcn.00404de4
mov eax, dword [ebp - 0x2c]
call fcn.00404fdc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call eax
jmp 0x447b63
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.00404d04
lea eax, [ebp - 0x30]
mov edx, 0x447bd4
call fcn.00404de4
mov eax, dword [ebp - 0x30]
call fcn.00404fdc
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x447b63
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00405a4c
call fcn.00405a4c
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x447be0
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.00404d04
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.004098e0
push dword [ebp - 0x34]
push 0x447bec
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.0040ab80
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call fcn.00404e9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447bc4
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.00404b40
ret
Function at 0x44a2bc
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId_1
cmp esi, eax
je 0x44a2e6
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
cmp esi, 0xffffffff
je 0x44a2e6
push edi
call sub.kernel32.dll_ResumeThread
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x44d9ac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 8]
call fcn.00404fcc
xor eax, eax
push ebp
push 0x44dad5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x44daa8
mov eax, dword [ebp - 4]
call fcn.00404fdc
push eax
call sub.kernel32.dll_GetModuleHandleA_2
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0040c5d8
mov dword [edi], eax
test esi, esi
je 0x44da1c
cmp word [esi], 0x25ff
jne 0x44da1c
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x44da1e
xor ebx, ebx
push 0
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, dword [0x4ed668]
je 0x44da36
cmp byte [0x4e9cfc], 0
je 0x44da4d
lea eax, [ebp - 0x14]
call fcn.0042bd3c
mov eax, dword [ebp - 0x14]
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
call fcn.0042c004
jmp 0x44da5c
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
mov eax, dword [0x4ed668]
call fcn.0042bf6c
test ebx, ebx
je 0x44da6b
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x44da6f
xor eax, eax
jmp 0x44da71
mov al, 1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x44daac
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x44daac
mov eax, dword [ebp + 8]
mov dword [ebx], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x44daac
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dadc
lea eax, [ebp - 0x14]
mov edx, dword [0x42bd10]
call fcn.004060b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b40
ret
Function at 0x44dae8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x44dbbd
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x44dba1
test esi, esi
je 0x44db29
cmp word [esi], 0x25ff
jne 0x44db29
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x44db2b
xor ebx, ebx
push 0
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, dword [0x4ed668]
je 0x44db43
cmp byte [0x4e9cfc], 0
je 0x44db5a
lea eax, [ebp - 0xc]
call fcn.0042bd3c
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.0042c004
jmp 0x44db69
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x4ed668]
call fcn.0042bf6c
test ebx, ebx
je 0x44dba1
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x44dba1
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x44dba1
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dbc4
lea eax, [ebp - 0xc]
mov edx, dword [0x42bd10]
call fcn.004060b4
ret
Function at 0x44e36c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x4c]
mov edx, dword [0x40ce8c]
call fcn.00405590
xor eax, eax
push ebp
push 0x44e429
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x4c]
mov eax, ebx
call fcn.00411f18
cmp byte [ebp - 0x4c], 0
je 0x44e40d
mov eax, dword [ebp - 0x2c]
call fcn.00405db4
test eax, eax
jl 0x44e40d
inc eax
xor esi, esi
mov edx, esi
shl edx, 3
sub edx, esi
mov ecx, dword [ebp - 0x2c]
lea ebx, [ecx + edx*4]
cmp byte [ebx + 0x10], 0
je 0x44e409
cmp edi, dword [ebx + 0xc]
jne 0x44e409
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x44e40d
mov edx, dword [ebp - 4]
sub edx, dword [ebx + 8]
mov eax, dword [ebx + 0x14]
mov dword [eax], edx
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 0xc]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov byte [ebp - 5], 1
jmp 0x44e40d
inc esi
dec eax
jne 0x44e3bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e430
lea eax, [ebp - 0x4c]
mov edx, dword [0x40ce8c]
call fcn.00405660
ret

Function at 0x44eae0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fcc
lea eax, [ebp - 0xc]
mov edx, dword [0x44e9dc]
call fcn.00405590
xor eax, eax
push ebp
push 0x44eb92
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x44eba0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x44eb66
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040a4dc
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x44ebb4
call fcn.00404e28
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404bb4
lea eax, [ebp - 0xc]
push eax
push 0x44ea08
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44eb99
lea eax, [ebp - 0x10]
call fcn.00404b1c
lea eax, [ebp - 0xc]
mov edx, dword [0x44e9dc]
call fcn.00405660
lea eax, [ebp - 4]
call fcn.00404b1c
ret
Function at 0x44ebf0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x44ecbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040a4dc
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x44ecd4
call fcn.00404e28
mov eax, dword [ebp - 4]
call fcn.00404fdc
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x44eca3
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x44ec9d
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x44ec85
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x4e9d30
lea eax, [esi + 8]
mov ecx, 0x50
call fcn.00402d24
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ecc5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b40
ret
Function at 0x44edc4
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x44ef54
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
push 0x104
lea edx, [ebp - 0x119]
push edx
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x119]
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x44eecf
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
je 0x44eec9
push 0
push 0
push 0
push 4
push edi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44eec3
mov eax, dword [ebp - 4]
call fcn.0040c318
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44eeba
mov eax, dword [ebp - 8]
cmp dword [eax + 0x58], 0
je 0x44eeba
mov eax, dword [ebp - 8]
add eax, 0x58
mov dword [ebp - 0xc], eax
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0044ed68
mov ecx, eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
sub edx, eax
sub edx, 4
mov eax, dword [ebp - 0xc]
add eax, 4
call fcn.0044ed68
add eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x58]
je 0x44eeba
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push edi
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x44ef33
push 0x10
push 0
lea edx, [ebp - 0x120]
mov eax, dword [0x4ea424]
mov ecx, dword [eax]
call dword [ecx + 0x248]
mov eax, dword [ebp - 0x120]
call fcn.00404fdc
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 0
call sub.kernel32.dll_GetModuleHandleA_2
cmp eax, dword [0x4ed668]
je 0x44ef2c
mov eax, 0x4ea424
call fcn.00406814
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x40829c]
call fcn.00408308
call fcn.00404490
jmp 0x44ef33
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ef5b
lea eax, [ebp - 0x120]
call fcn.00404b1c
lea eax, [ebp - 0x14]
call fcn.00404b1c
ret
Function at 0x44f0d8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44f1d3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x44f1e0
mov edx, 0x44f1ec
mov eax, esi
call fcn.0040c968
mov eax, dword [ebp - 4]
call fcn.00404ddc
cmp eax, 0x14
jne 0x44f1bd
cmp esi, dword [0x4ed668]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x44f1bd
mov eax, esi
call fcn.0040c318
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [ebx + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp esi, dword [0x4ed668]
jne 0x44f179
mov edx, 0x42ad5c
mov eax, dword [ebp - 4]
sub edx, dword [eax]
sub edx, esi
mov dword [ebx + 0x2c], edx
mov edx, 0x4e9cb0
sub edx, dword [eax + 4]
sub edx, esi
mov dword [ebx + 0x30], edx
jmp 0x44f192
mov eax, dword [ebp - 4]
mov edx, dword [eax]
and edx, 0x7fffffff
mov dword [ebx + 0x2c], edx
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [ebx + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [ebx + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [ebx + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f1da
lea eax, [ebp - 4]
call fcn.00404b1c
ret
Function at 0x4519d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 8], eax
lea ebx, [ebp - 4]
xor eax, eax
push ebp
push 0x451c21
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ea564], 0
jne 0x451a21
push 0x451c30
push 0x451c4c
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ea564], eax
cmp dword [0x4ea568], 0
jne 0x451a44
push 0x451c58
push 0x451c70
call sub.kernel32.dll_LoadLibraryA
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ea568], eax
xor eax, eax
mov dword [ebx], eax
push ebx
push 0
push 0
push 5
call dword [0x4ea564]
xor esi, esi
cmp dword [ebx], 0
jne 0x451a96
mov dword [ebx], 0x10000
mov eax, dword [ebx]
add eax, eax
mov dword [ebx], eax
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebx]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov esi, eax
push 0
mov eax, dword [ebx]
push eax
push esi
push 5
call dword [0x4ea564]
test eax, eax
je 0x451ab6
cmp dword [ebx], 0x400000
jne 0x451a62
jmp 0x451ab6
mov eax, dword [ebx]
add eax, eax
mov dword [ebx], eax
mov eax, dword [ebx]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov esi, eax
push 0
mov eax, dword [ebx]
push eax
push esi
push 5
call dword [0x4ea564]
test eax, eax
jne 0x451bf5
mov ebx, esi
mov edi, dword [ebx + 0x3c]
test edi, edi
je 0x451bd3
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404d44
cmp dword [0x4ea568], 0
je 0x451bbe
mov eax, dword [ebx + 0x44]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x451bbe
push 0x104
lea eax, [ebp - 0x10d]
push eax
push 0
push edi
call dword [0x4ea568]
test eax, eax
jbe 0x451bb8
lea eax, [ebp - 8]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404d8c
mov edx, dword [ebp - 8]
mov eax, 0x451c84
call fcn.00409e18
test al, al
je 0x451b95
push 0x104
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x7fffffff
mov edx, 0x15
mov eax, dword [ebp - 8]
call fcn.0040503c
mov eax, dword [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404d8c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
pop ecx
call fcn.00404e28
jmp 0x451bb8
mov edx, dword [ebp - 8]
mov eax, 0x451ca4
call fcn.00409da8
test al, al
je 0x451bb8
lea eax, [ebp - 8]
mov ecx, 4
mov edx, 1
call fcn.0040507c
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x44]
mov eax, dword [ebp - 8]
call fcn.004516f8
pop ecx
jmp 0x451be8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x44]
mov eax, 0x451cb4
call fcn.004516f8
pop ecx
mov eax, dword [ebx]
test eax, eax
je 0x451bf5
add ebx, eax
jmp 0x451ac0
push esi
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451c28
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00404b40
lea eax, [ebp - 8]
call fcn.00404b1c
ret
Function at 0x453bd8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x453c09
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x453c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x453c41
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x453d28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x453d4e
test byte [ebp - 0xc], 0x10
jne 0x453d52
xor eax, eax
jmp 0x453d54
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x453e60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4541f8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404fdc
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x456e60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x456ea8
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.00404c0c
jmp 0x456eb3
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404b70
mov esp, ebp
pop ebp
ret 4