joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43069c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x430847
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x430828
mov dl, 1
mov eax, dword [0x44f658]
call fcn.00460bb4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00461654
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x430817
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00445654
test al, al
je 0x43080a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x430858
lea eax, [ebp - 0x254]
call fcn.0045bf28
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x43080a
xor eax, eax
push ebp
push 0x430803
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x430890
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4307ec
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00461884
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x4307ec
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00461884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43080a
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x43070d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00452690
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43084e
lea eax, [ebp - 0x260]
call fcn.00461654
ret

Function at 0x431094
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x48f9f0]
cmp byte [eax + 0x95], 0
jne 0x431105
cmp dword [0x48fa0c], 0
jne 0x4310c6
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x431050
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x48fa0c], eax
cmp dword [0x48fa08], 0
jne 0x4310e1
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x48fa08], eax
cmp dword [0x48fa10], 0
jne 0x431105
push esp
push 0
push 0
push 0x430ff4
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x48fa10], eax
pop edx
ret
Function at 0x4311fc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x431213
add esp, 0xfffffff0
call fcn.00460ee4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004555fc
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x44f31c]
call fcn.00460bb4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x44f31c]
call fcn.00460bb4
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x41e9c0]
call fcn.00425fb0
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x431388
mov eax, dword [0x48d57c]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00426380
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x432dac
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48d57c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0045d2e0
test eax, eax
je 0x431306
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0045b8dc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0045d308
test eax, eax
je 0x43131a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00461884
mov eax, dword [0x48d580]
cmp byte [eax], 0
jne 0x43134b
mov eax, ebx
call fcn.00431474
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43137d
call fcn.00460f3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4316e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48f9f0]
cmp dword [eax + 0x24], 0
je 0x431787
cmp dword [ebx + 0x84], 0
jne 0x431781
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x431674
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x431781
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x43174a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x431781
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.004509d0
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x431759
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x432194
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4321c9
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0046173c
jmp 0x4321d3
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.004616a8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x433120
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x433158
mov eax, esi
call fcn.004413c8
test al, al
je 0x433158
mov eax, dword [ebx + 0x74]
call fcn.004410cc
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x433158
push 0
mov eax, dword [ebx + 0x74]
call fcn.004410cc
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x438d90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x48fa8c], 0
sete dl
or al, dl
jne 0x438ed0
mov eax, dword [0x48fa90]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x48fa8c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x438e9f
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x48fa8c]
call fcn.004509d0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x438e97
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x438e97
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x438e97
mov eax, dword [ebp - 0x14]
call fcn.004410cc
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x438e97
push ebp
call fcn.00438d4c
pop ecx
test al, al
jne 0x438e97
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x438e53
mov eax, dword [ebp - 0x14]
call fcn.0043fa58
dec eax
jle 0x438e97
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00460dc0
cmp byte [ebp - 1], 0
je 0x438e97
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x438e97
mov edx, dword [ebp - 0x14]
mov eax, dword [0x48fa90]
call fcn.00438598
inc edi
dec esi
jne 0x438de6
mov eax, dword [0x48fa90]
cmp dword [eax + 8], 0
jle 0x438eb7
mov eax, dword [0x48fa90]
call fcn.00438628
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x438ed0
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00438bb4
pop ecx
test al, al
jne 0x438ed0
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ea64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x43ea95
je 0x43eaef
sub eax, 7
je 0x43eab6
dec eax
je 0x43eae0
sub eax, 0x17
je 0x43eb94
jmp 0x43ebd2
add eax, 0xffffff00
sub eax, 9
jb 0x43eb80
add eax, 0xffffff09
sub eax, 0xb
jb 0x43eb48
jmp 0x43ebd2
mov eax, ebx
call fcn.00429de0
mov edi, eax
test edi, edi
je 0x43ec32
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x43ec3b
jmp 0x43ec32
test byte [ebx + 0x44], 0x20
jne 0x43ec3b
jmp 0x43ec32
mov edx, esi
mov eax, ebx
call fcn.0043c064
cmp dword [esi + 0xc], 0xffffffff
jne 0x43ec3b
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00459408
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0043ab98
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0043e93c
test eax, eax
je 0x43ec3b
mov dword [esi + 0xc], 1
jmp 0x43ec3b
mov edx, esi
mov eax, ebx
call fcn.0043e9d0
test al, al
je 0x43ec32
cmp dword [esi + 0xc], 0
jne 0x43ec3b
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.004410cc
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x43ec3b
mov eax, ebx
call fcn.0043b700
test al, al
jne 0x43ec3b
jmp 0x43ec32
mov eax, ebx
call fcn.004410cc
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x43ec32
cmp dword [0x489068], 0
je 0x43ec32
mov eax, dword [0x489068]
cmp ebx, dword [eax + 0x24]
jne 0x43ec32
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x489068]
call fcn.0043bf98
jmp 0x43ec32
mov eax, dword [0x48fa54]
cmp byte [eax + 0x20], 0
je 0x43ec32
mov eax, dword [0x48fa54]
cmp dword [eax + 0x1c], 0
je 0x43ec32
mov eax, dword [esi]
mov edx, dword [0x48fa54]
cmp eax, dword [edx + 0x1c]
jne 0x43ec32
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00429d24
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00460dc0
jmp 0x43ec3b
mov edx, esi
mov eax, ebx
call fcn.0043c064
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f0fc
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x43f118
cmp dword [esi + 4], 0
je 0x43f145
test byte [ebx + 0x45], 1
jne 0x43f137
mov eax, ebx
call fcn.0043e034
test eax, eax
jne 0x43f137
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43f255
mov edx, esi
mov eax, ebx
call fcn.0043ed74
jmp 0x43f255
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43f24e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004410cc
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043bf98
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043f0fc
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004410cc
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f255
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4481f8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4482d0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48fad8], 0
jne 0x4482b4
lea eax, [ebp - 4]
mov edx, 0x4482e8
call fcn.004616ec
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00461a98
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4482b4
mov eax, ebx
call fcn.004604a8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4482ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x448297
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4482f8
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x448297
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x48fad8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4482b4
mov eax, dword [ebp - 0xc]
call fcn.004604c0
ret
mov ebx, dword [0x48fad8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4482d7
lea eax, [ebp - 4]
call fcn.00461654
ret

Function at 0x44e2a4
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x48fafc], 0
jne 0x44e2c7
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x44e228
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x48fafc], eax
ret

Function at 0x45c0b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x45c0f1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0046173c
jmp 0x45c0fa
mov eax, ebx
mov edx, esi
call fcn.004616a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45c104
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x45c125
mov al, byte [esp]
jmp 0x45c127
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4606ec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x46071b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0046173c
jmp 0x460739
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00460674
mov edi, eax
test ebx, ebx
je 0x460739
cmp dword [esi], 0
je 0x460739
dec ebx
jmp 0x460722
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x460a5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x489424]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x460af4
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x460ad4
xor eax, eax
push ebp
push 0x460acd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x460b10
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460ad4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x489424]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x489424], ax
mov esp, ebp
pop ebp
ret
Function at 0x462b84
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x462d40
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x462be5
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x462d5c
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x462c57
xor eax, eax
push ebp
push 0x462c50
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004629dc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x462c39
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x462d7c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462c57
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x462d38
cmp byte [ebp - 0xd], 0
jne 0x462c99
cmp byte [ebp - 0x12], 0
je 0x462d38
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x462cb2
dec ebx
cmp byte [ebx], 0x2e
je 0x462cc1
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x462cb1
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x462d38
inc ebx
cmp byte [ebp - 0x12], 0
je 0x462cee
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x462d38
cmp byte [ebp - 0xd], 0
je 0x462d38
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x462d38
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46312c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x463214
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x490170], 1
jae 0x463206
xor eax, eax
mov dword [0x48fd7c], eax
xor eax, eax
mov dword [0x48fd84], eax
xor eax, eax
mov dword [0x48fd88], eax
mov byte [0x48fd8e], 2
mov byte [0x48fd8f], 2
mov byte [0x48fd90], 3
mov word [0x490138], 0
mov word [0x490148], 1
mov word [0x490158], 0xa
mov dword [0x490160], 0x80020004
mov dword [0x49012c], 0x462318
mov dword [0x490130], 0x462310
mov dword [0x490134], 0x462318
call fcn.00460a2c
test al, al
je 0x4631c5
call fcn.00460a5c
call fcn.00460b20
mov eax, 0x48fd94
mov edx, 0x463220
call fcn.0045e1fe
mov eax, 0x48ff60
mov edx, 0x463220
call fcn.0045e1fe
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x48fd74], eax
call fcn.0045f164
mov dword [0x48fd70], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x48fd68], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46321b
ret

Function at 0x464e14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x464e30
call fcn.004662bc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x464e4c
test bl, 1
je 0x464e4c
call fcn.00469e00
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x465030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00465e58
test byte [ebp + 0xd], 0xc0
jne 0x465054
mov eax, dword [0x48a1f4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x465061
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x46508e
je 0x4650a0
sub ecx, 0x100
je 0x4650ae
sub ecx, 0x100
je 0x4650b5
sub ecx, 0x100
je 0x4650a7
jmp 0x4650bc
sub ecx, 0x600
je 0x4650b5
sub ecx, 0x100
je 0x4650a0
jmp 0x4650bc
mov edi, 1
jmp 0x4650c1
mov edi, 2
jmp 0x4650c1
mov edi, 4
jmp 0x4650c1
mov edi, 5
jmp 0x4650c1
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4650e8
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x489c6c]
test al, 0x80
je 0x4650e1
mov ebx, 0x80
jmp 0x4650fa
mov ebx, 1
jmp 0x4650fa
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4650fa
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x46510c
je 0x465115
dec eax
je 0x46511e
jmp 0x465127
mov dword [ebp - 4], 0x80000000
jmp 0x465136
mov dword [ebp - 4], 0x40000000
jmp 0x465136
mov dword [ebp - 4], 0xc0000000
jmp 0x465136
push 1
call fcn.00466250
pop ecx
mov ebx, eax
jmp 0x465226
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x465152
sub eax, 0x10
je 0x465159
sub eax, 0x10
je 0x465162
sub eax, 0x10
je 0x46516b
jmp 0x46516b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x465172
mov dword [ebp - 8], 1
jmp 0x465172
mov dword [ebp - 8], 2
jmp 0x465172
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4651df
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4651d4
test byte [ebp + 0xd], 1
je 0x4651cf
mov ebx, 0x50
jmp 0x4651d4
mov ebx, 2
push ebx
call fcn.00466250
pop ecx
mov ebx, eax
jmp 0x465226
mov edi, esi
push edi
call fcn.00464f94
pop ecx
test eax, eax
je 0x4651f3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4651ff
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00465f78
add esp, 8
mov ebx, eax
inc eax
jne 0x465226
push 4
call fcn.00466250
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00465e8c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret