joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54a5b8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, 0x602314
call fcn.005d0a3c
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005de500
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
mov word [ebp - 0x28], 0x18
mov edx, dword [ebp - 8]
add edx, 0x40
mov dword [ebp - 0x3c], edx
add esp, 0xfffffff8
push esp
call fcn.0054a734
pop ecx
push dword [ebp - 0x3c]
call fcn.0054a758
add esp, 0xc
push 0
push dword [ebp - 0x3c]
call fcn.0054a78c
add esp, 8
inc dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x429314]
call fcn.00435e04
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3c], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
push 0x80
cmp dword [ebp - 4], 0
je 0x54a646
mov ecx, dword [ebp - 4]
jmp 0x54a64b
mov ecx, 0x60222c
push ecx
call sub.KERNEL32.DLL_SetFileAttributesW
mov word [ebp - 0x28], 0x24
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x1c]
lea edx, [ebp - 4]
mov eax, 0x60222e
call fcn.005debac
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov edx, 2
call fcn.00468d74
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005de650
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0054ba5c
mov ecx, dword [ebp - 8]
mov byte [ecx + 0xc], al
mov word [ebp - 0x28], 0x30
mov edx, 0x602238
lea eax, [ebp - 0x10]
call fcn.005de4c0
inc dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 8]
call fcn.0054aa08
mov ecx, dword [ebp - 8]
mov byte [ecx + 0xc], al
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005de650
push 0x18
call fcn.005cd274
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x54a709
mov word [ebp - 0x28], 0x54
mov eax, dword [ebp - 0x14]
call fcn.004058d8
inc dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x3c
mov edx, dword [ebp - 0x14]
jmp 0x54a70c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + 0x60], edx
dec dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x55a728
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov dword [ebp - 4], edx
mov dword [ebp - 0x30], eax
mov eax, 0x60a7c8
call fcn.005d0a3c
mov dword [ebp - 0x10], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005de500
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0xc
mov byte [ebp - 0x31], 1
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00468f3c
test al, al
jne 0x55a7b5
mov edx, dword [ebp - 0x30]
mov dword [edx + 0xc], 0x2771
mov eax, dword [ebp - 0x30]
call sym.gta.exe__TWMAction_rActionManager_qqrv
add eax, 0x58
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 4]
mov ebx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
call dword [ebx]
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x55a897
push 0x80
cmp dword [ebp - 4], 0
je 0x55a7c5
mov ecx, dword [ebp - 4]
jmp 0x55a7ca
mov ecx, 0x60948c
push ecx
call sub.KERNEL32.DLL_SetFileAttributesW
mov word [ebp - 0x1c], 0x18
xor eax, eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, 0x60948e
call fcn.005debac
lea eax, [ebp - 8]
mov eax, dword [eax]
mov edx, 0x42
call fcn.00468d74
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x494], eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005de650
mov ecx, dword [ebp - 0x30]
cmp dword [ecx + 0x494], 0xffffffff
jne 0x55a868
mov eax, dword [ebp - 0x30]
mov dword [eax + 0xc], 0x2772
mov eax, dword [ebp - 0x30]
call sym.gta.exe__TWMAction_rActionManager_qqrv
add eax, 0x58
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 4]
mov ebx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
call dword [ebx]
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x55a897
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x30]
add eax, 0x49c
call fcn.005de678
mov al, byte [ebp - 0x31]
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x562c2c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 4], edx
mov dword [ebp - 0x30], eax
mov eax, 0x60c724
call fcn.005d0a3c
mov dword [ebp - 0x10], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005de500
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0xc
mov byte [ebp - 0x31], 1
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00468f3c
test al, al
jne 0x562c92
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x562d4e
push 0x80
cmp dword [ebp - 4], 0
je 0x562ca2
mov ecx, dword [ebp - 4]
jmp 0x562ca7
mov ecx, 0x60b16e
push ecx
call sub.KERNEL32.DLL_SetFileAttributesW
mov word [ebp - 0x1c], 0x18
xor eax, eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, 0x60b170
call fcn.005debac
lea eax, [ebp - 8]
mov eax, dword [eax]
mov edx, 0x42
call fcn.00468d74
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x488], eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005de650
mov ecx, dword [ebp - 0x30]
cmp dword [ecx + 0x488], 0xffffffff
jne 0x562d1f
xor eax, eax
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x562d4e
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x30]
add eax, 0x474
call fcn.005de678
mov al, byte [ebp - 0x31]
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x57b1ec
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 0x40], eax
mov eax, 0x6140ac
call fcn.005d0a3c
mov eax, dword [ebp - 0x40]
call sym.gta.exe__TWMAction_rActionManager_qqrv
cmp dword [eax + 0x88], 0x11
jne 0x57b35c
mov word [ebp - 0x2c], 0xc
mov eax, dword [ebp - 0x40]
call sym.gta.exe__TWMAction_rActionManager_qqrv
xor edx, edx
mov dword [ebp - 4], edx
lea edx, [ebp - 4]
inc dword [ebp - 0x20]
call sym.gta.exe__TWMActionManager_rGamePath_qqrv
lea eax, [ebp - 4]
push eax
mov edx, str.editmaterialsMafiaIIMaterialsMerger.exe
lea eax, [ebp - 8]
call fcn.005de4c0
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x20]
pop eax
call fcn.005de6a0
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov dl, 1
call fcn.00468f3c
test al, al
je 0x57b276
mov ecx, dword [ebp - 0x40]
cmp byte [ecx + 0x8a2], 0
jne 0x57b27a
xor eax, eax
jmp 0x57b27f
mov eax, 1
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005de650
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005de650
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005de650
pop ecx
test cl, cl
je 0x57b35c
mov word [ebp - 0x2c], 0x18
mov eax, dword [ebp - 0x40]
call sym.gta.exe__TWMAction_rActionManager_qqrv
xor edx, edx
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
inc dword [ebp - 0x20]
call sym.gta.exe__TWMActionManager_rGamePath_qqrv
lea eax, [ebp - 0x10]
push eax
mov edx, str.editmaterials
lea eax, [ebp - 0x14]
call fcn.005de4c0
inc dword [ebp - 0x20]
lea edx, [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
pop eax
call fcn.005de6a0
cmp dword [ebp - 0x18], 0
je 0x57b30a
mov edx, dword [ebp - 0x18]
jmp 0x57b30f
mov edx, 0x6123fc
push edx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.005de650
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.005de650
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005de650
push 1
push 0
push 0
push str.MafiaIIMaterialsMerger.exe
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteW
mov eax, dword [ebp - 0x3c]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret
Function at 0x580764
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x60], 0
jne 0x580855
mov edx, dword [ebp - 4]
cmp word [edx + 0x4a], 0
je 0x5807ea
mov ecx, dword [ebp - 4]
add ecx, 0x48
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xd]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call dword [ebx]
movsx edx, byte [ebp - 0xd]
dec edx
jne 0x5807c2
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x58]
call fcn.004cbf7c
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x580855
movsx ecx, byte [ebp - 0xd]
cmp ecx, 3
jne 0x580855
push 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.004f2214
push eax
call sub.USER32.DLL_ShowWindow
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x580855
mov ecx, dword [ebp - 4]
cmp byte [ecx + 0x54], 0
je 0x580855
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x58]
xor ecx, ecx
mov cl, byte [edx + 0x341]
test ecx, ecx
jle 0x58080d
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
jmp 0x580834
mov edx, dword [ebp - 0xc]
mov byte [edx], 2
mov ecx, dword [ebp - 4]
cmp word [ecx + 0x42], 0
je 0x580834
mov eax, dword [ebp - 4]
add eax, 0x40
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
call dword [ebx]
mov dl, 0xff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.004cc9b4
mov edx, dword [ebp - 4]
mov byte [edx + 0x55], 0
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.004d4b9c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5945ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, eax
mov ecx, edx
test ecx, ecx
je 0x5945fb
sub ecx, 4
mov ecx, dword [ecx]
test ecx, ecx
jle 0x59461c
mov ebx, 1
mov esi, eax
add esi, esi
add esi, esi
shr eax, 0x1e
or esi, eax
movzx eax, word [edx + ebx*2 - 2]
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x594604
pop esi
pop ebx
ret

Function at 0x595970
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.00485b20
push eax
push 0x800
lea eax, [ebp - 0x1000]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00485b20
push eax
mov eax, edi
call fcn.00485b20
push eax
mov eax, esi
call fcn.00485b20
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ecx, eax
lea edx, [ebp - 0x1000]
mov eax, dword [ebp + 8]
call fcn.00484e44
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x595a3c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x595baf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x595b84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x8000
call fcn.00482668
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00433c68
xor eax, eax
push ebp
push 0x595b67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi + 4]
call fcn.00485b20
push eax
push 0x4000
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ebx, eax
cmp ebx, 0x3ffe
jne 0x595b21
lea edx, [ebp - 4]
mov eax, dword [esi + 4]
call fcn.0041852c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0047275c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00472e34
mov ebx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, eax
imul edx, ebx
lea eax, [ebp - 0x10]
call fcn.0048269c
mov eax, dword [esi + 4]
call fcn.00485b20
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ebx, eax
test ebx, ebx
je 0x595b51
mov ebx, dword [ebp - 0x10]
jmp 0x595b4b
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00485b70
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.00469808
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
jne 0x595b2a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x595b6e
mov eax, dword [ebp - 8]
call fcn.00433d30
ret

Function at 0x595c7c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x400
mov eax, dword [ebp - 0x1c]
add eax, eax
call fcn.00482668
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x595d08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call fcn.00485b20
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00485b20
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
sub eax, 2
cmp eax, dword [ebp - 8]
jle 0x595cef
push ebp
call fcn.00595bbc
pop ecx
call fcn.004845b8
jmp 0x595d1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x595d0f
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00482684
ret
mov esp, ebp
pop ebp
ret
Function at 0x5af36c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5af494
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.005af258
mov eax, dword [esi]
call fcn.00486cc8
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5af93c]
call fcn.00486e90
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004828f4
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004828f4
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00486cc8
mov dword [ebp - 0xc], eax
mov eax, dword [0x61fc38]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.005b3a78
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00482d1c
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00486cc8
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.005b3a54
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.005b398c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.005b3a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5af49b
lea eax, [ebp - 4]
mov edx, dword [0x5af93c]
call fcn.00486fb4
ret

Function at 0x5c46a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c4736
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x61f7b8]
cmp dword [eax], 2
jne 0x5c46e0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ebx, eax
jmp 0x5c4718
lea eax, [ebp - 8]
mov edx, esi
call fcn.00485844
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00485460
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.00485618
push eax
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c473d
lea eax, [ebp - 8]
call fcn.00484d04
lea eax, [ebp - 4]
call fcn.00484ce0
ret
Function at 0x5c4b68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00485b20
mov edx, eax
mov eax, ebx
call fcn.005c450c
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.005c45e8
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x5c4bda
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00485b20
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x5c8208
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x5c826c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00485bc4
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004689e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c8273
lea eax, [ebp - 0x14]
call fcn.00484cbc
ret
Function at 0x5c8f80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c91da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.005c853c
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x61af7c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x61af80], eax
mov eax, dword [ebp - 0x24]
mov dword [0x61af84], eax
mov eax, dword [0x61f7b8]
cmp dword [eax], 2
sete byte [0x61a714]
push 0x5c91e8
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.005ca1a8
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x61a714], 0
jne 0x5c900f
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.005ca3bc
test al, al
je 0x5c900f
mov eax, dword [ebp - 0x4c]
mov dword [0x6271e4], eax
jmp 0x5c9016
xor eax, eax
mov dword [0x6271e4], eax
call fcn.005c8620
and eax, 0x7f
cmp eax, 0x1a
ja case.0x5c9027.0
jmp dword [eax*4 + 0x5c902e]
mov byte [0x61a700], 1
jmp case.0x5c9027.0
mov byte [0x61a704], 1
jmp case.0x5c9027.0
mov byte [0x61a708], 1
jmp case.0x5c9027.0
mov byte [0x61a70c], 1
jmp case.0x5c9027.0
mov byte [0x61a710], 1
jmp case.0x5c9027.0
mov byte [0x61a718], 1
mov byte [0x61a71c], 1
jmp case.0x5c9027.0
mov byte [0x61a718], 1
mov byte [0x61a720], 1
jmp case.0x5c9027.0
mov byte [0x61a718], 1
mov byte [0x61a720], 1
mov byte [0x61a724], 1
jmp case.0x5c9027.0
mov byte [0x61a728], 1
jmp case.0x5c9027.0
mov byte [0x61a72c], 1
jmp case.0x5c9027.0
mov byte [0x61a730], 1
jmp case.0x5c9027.0
mov byte [0x61a734], 1
jmp case.0x5c9027.0
mov byte [0x61a738], 1
jmp case.0x5c9027.0
mov byte [0x61a73c], 1
jmp case.0x5c9027.0
mov byte [0x61a740], 1
jmp case.0x5c9027.0
mov byte [0x61a744], 1
jmp case.0x5c9027.0
mov byte [0x61a748], 1
jmp case.0x5c9027.0
mov byte [0x61a74c], 1
jmp case.0x5c9027.0
mov byte [0x61a750], 1
jmp case.0x5c9027.0
mov byte [0x61a754], 1
jmp case.0x5c9027.0
mov byte [0x61a758], 1
jmp case.0x5c9027.0
mov byte [0x61a75c], 1
jmp case.0x5c9027.0
mov byte [0x61a760], 1
jmp case.0x5c9027.0
mov byte [0x61a764], 1
jmp case.0x5c9027.0
mov byte [0x61a768], 1
jmp case.0x5c9027.0
mov byte [0x61a76c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c91e1
lea eax, [ebp - 4]
call fcn.00484cbc
ret
Function at 0x5ca3bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ca472
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00485b20
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5ca45c
lea eax, [ebp - 4]
mov edx, edi
call fcn.00485c9c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00485b20
push eax
call sub.VERSION.DLL_GetFileVersionInfoW
test eax, eax
je 0x5ca45c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5ca484
mov eax, dword [ebp - 4]
push eax
call sub.VERSION.DLL_VerQueryValueW
test eax, eax
je 0x5ca45c
cmp dword [ebp - 0xc], 0x34
jne 0x5ca45c
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ca479
lea eax, [ebp - 4]
call fcn.00484cbc
ret

Function at 0x5d18d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5d18f4
call fcn.005d2cbc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x5d1913
test bl, 1
je 0x5d1913
call fcn.005d9a8c
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret