joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bd48
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x42bd6a
movzx eax, byte [esp]
jmp 0x42bd6c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42c3fc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x42c274
mov eax, dword [0x55caf8]
cmp byte [eax], 0
je 0x42c478
mov eax, dword [0x55c738]
call fcn.00403708
call fcn.00403230
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004290f0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x42c4c0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x42c4ae
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x55c6a8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x55f7f8]
call fcn.00406a50
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x42cd78
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42ce4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 4]
call fcn.0040555c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x42ce38
mov eax, ebx
call fcn.0040309c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42ce31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x42ce1b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42ce60
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42ce1b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ce38
mov eax, dword [ebp - 0x10]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ce55
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x42e4a0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.0040502c
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040550c
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x42e4e5
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040511c
jmp 0x42e4fe
mov edx, ebx
dec edx
mov eax, esi
call fcn.00405794
push ebx
mov eax, dword [esi]
call fcn.0040550c
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x444b50
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00444860
dec esi
jne 0x444b72
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x445ce4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x660ed4
cmp dword [edi], 0
jne 0x445d60
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x660ed0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x555790
mov ecx, 2
call fcn.00403348
mov edx, 0x445cbc
lea eax, [esi + 5]
call fcn.00445cdc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00445cdc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x445d35
mov dword [0x660ed0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x445f6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x445f8c
test al, 0x10
sete al
jmp 0x445fb3
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x445fad
cmp ebx, 3
je 0x445fad
cmp ebx, 0x7b
je 0x445fad
mov eax, esi
call fcn.00445f2c
test al, al
jne 0x445fb1
xor eax, eax
jmp 0x445fb3
mov al, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x445fe4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x446000
test al, 0x10
jne 0x446005
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x447b90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
add eax, 0x10
test eax, eax
jns 0x447ba0
call fcn.00403edc
push eax
push 8
mov eax, dword [0x66101c]
push eax
call sub.kernel32.dll_HeapAlloc
mov ebx, eax
test ebx, ebx
jne 0x447bcf
mov eax, 0x447be8
call fcn.00446f38
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [str.PLEH]
mov dword [ebx], eax
add ebx, 0x10
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x447e18
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0
push 0x500000
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x66101c], eax
cmp dword [0x66101c], 0
jne 0x447e4a
push 0
push 0
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x66101c], eax
cmp dword [0x66101c], 0
jne 0x447e6e
mov eax, 0x447eac
call fcn.00446f38
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x18], fcn.00447b90
mov dword [ebp - 0x14], 0x447c08
mov dword [ebp - 0x10], 0x447c70
mov dword [ebp - 0xc], 0x447da0
mov dword [ebp - 8], 0x447e10
mov dword [ebp - 4], 0x447e14
lea eax, [ebp - 0x18]
call fcn.00403134
mov esp, ebp
pop ebp
ret
Function at 0x44a80c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.004038b8
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x44a880
inc dword [ebp - 0x5c]
test ebx, ebx
jbe 0x44a8fc
mov edi, 0x40
sub edi, dword [ebp - 0x54]
cmp ebx, edi
jb 0x44a8d0
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44a89d
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, edi
test ecx, ecx
jns 0x44a8ac
call fcn.00403edc
mov eax, esi
call fcn.00403348
mov eax, 0x40
sub eax, dword [ebp - 0x54]
sub ebx, eax
mov eax, 0x40
sub eax, dword [ebp - 0x54]
add esi, eax
push ebp
call fcn.00449f50
pop ecx
jmp 0x44a8f8
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44a8dd
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, ebx
test ecx, ecx
jns 0x44a8ec
call fcn.00403edc
mov eax, esi
call fcn.00403348
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x44a884
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44a909
call fcn.00403edc
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x44a91b
push ebp
call fcn.00449f50
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.00449f50
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.00403348
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b070
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44b25e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405a08
call sub.kernel32.dll_GetUserDefaultLCID
mov dword [ebp - 0x10], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x44b233
xor edx, edx
push ebp
push 0x44b22c
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
test ebx, ebx
je 0x44b120
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x44b0f6
mov eax, dword [ebp - 8]
call fcn.00405a28
inc eax
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, 0xd
call fcn.0044afb0
mov eax, dword [ebp - 4]
call fcn.00405308
inc eax
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 1
call fcn.0044afb0
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, 0x10
call fcn.0044afb0
test esi, esi
je 0x44b219
lea eax, [ebp - 0x18]
mov ecx, 0x44b274
mov edx, esi
call fcn.00405358
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00405a08
mov eax, dword [ebp - 0xc]
call fcn.00405a28
add eax, eax
add eax, 0x14
test eax, eax
jns 0x44b158
call fcn.00403edc
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44b219
xor edx, edx
push ebp
push 0x44b212
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
je 0x44b1f5
xor edx, edx
push ebp
push 0x44b1ee
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov dword [eax], 0x14
mov dword [eax + 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.00405a28
mov ecx, eax
add ecx, ecx
mov edx, ebx
add edx, 0x14
mov eax, dword [ebp - 0xc]
call fcn.00403348
mov eax, dword [ebp - 0x14]
push eax
push 0xf
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x44b1d7
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b1f5
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b219
cmp dword [ebp - 0x14], 0
je 0x44b211
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b233
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b265
lea eax, [ebp - 0x18]
call fcn.0040502c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040586c
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x44b568
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004038b8
mov dword [ebp - 0x3c], 0x3c
call fcn.0041bc88
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
test edi, edi
jns 0x44b5ab
call fcn.00403edc
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
and eax, 0x7f
cmp eax, 1
jbe 0x44b5ca
call fcn.00403edc
call fcn.00446c1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ba88
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44bc7e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
mov ebx, eax
mov eax, dword [0x55cd0c]
cmp dword [eax], 0
jne 0x44bad8
mov eax, dword [0x55cd0c]
mov dword [eax], ebx
lea eax, [ebp - 4]
mov edx, 0x44bc94
call fcn.004050c4
jmp 0x44bafa
mov eax, dword [0x55cd0c]
cmp ebx, dword [eax]
jne 0x44baf0
lea eax, [ebp - 4]
mov edx, 0x44bc94
call fcn.004050c4
jmp 0x44bafa
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0044ba24
cmp dword [0x661454], 0
jne 0x44bb53
cmp dword [0x661450], 0
jne 0x44bb53
call fcn.00465f30
push edx
push eax
mov eax, 0x661450
call fcn.0044ba0c
mov eax, dword [0x661450]
mov dword [0x661458], eax
mov eax, dword [0x661454]
mov dword [0x66145c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x44bbbc
call fcn.00465f30
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0044ba0c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x661450]
sbb edx, dword [0x661454]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x661458]
sbb edx, dword [0x66145c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [0x661458], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x66145c], eax
push 0x44bca4
push dword [ebp - 4]
push 0x44bcb0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x34]
call fcn.0044ba54
push dword [ebp - 0x34]
push 0x44bcbc
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x38]
call fcn.0044ba54
push dword [ebp - 0x38]
push 0x44bcc8
lea eax, [ebp - 8]
mov edx, 7
call fcn.004053cc
mov eax, dword [ebp - 8]
call fcn.00405308
cmp eax, 0x19
jge 0x44bc3e
push dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.00405308
mov edx, 0x19
sub edx, eax
lea ecx, [ebp - 0x3c]
mov al, 0x20
call fcn.004057f8
push dword [ebp - 0x3c]
push esi
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
jmp 0x44bc48
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405314
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bc85
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x4575b4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edx, 0x40
mov eax, esi
call fcn.0040e950
test al, al
je 0x45762a
xor edx, edx
push ebp
push 0x45761e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x4575eb
cmp dword [eax + 0x3c], 0
jne 0x4575f5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45762a
mov ebx, dword [eax + 0x3c]
add ebx, esi
mov edx, 0xf8
mov eax, ebx
call fcn.0040e950
test al, al
je 0x457612
cmp dword [ebx], 0x4550
je 0x457614
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45762a
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x457634
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edx, 0x40
mov eax, esi
call fcn.0040e950
test al, al
je 0x4576aa
xor edx, edx
push ebp
push 0x45769e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x45766b
cmp dword [eax + 0x3c], 0
jne 0x457675
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4576aa
mov ebx, dword [eax + 0x3c]
add ebx, esi
mov edx, 0x108
mov eax, ebx
call fcn.0040e950
test al, al
je 0x457692
cmp dword [ebx], 0x4550
je 0x457694
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4576aa
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x457758
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4577f7
push 0
push 0
mov eax, ebx
call fcn.0043e200
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.0043e40c
cmp word [ebp - 0x44], 0x5a4d
jne 0x4577f7
cmp dword [ebp - 8], 0
je 0x4577f7
mov eax, pe_nt_image_headers32
call fcn.0040304c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.0043e200
mov edx, dword [ebp - 4]
mov ecx, 0xf8
mov eax, ebx
call fcn.0043e40c
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x4577e5
lea eax, [ebp - 4]
xor edx, edx
call fcn.00446914
jmp 0x4577f7
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0xf8
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457800
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x45789f
push 0
push 0
mov eax, ebx
call fcn.0043e200
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.0043e40c
cmp word [ebp - 0x44], 0x5a4d
jne 0x45789f
cmp dword [ebp - 8], 0
je 0x45789f
mov eax, 0x110
call fcn.0040304c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.0043e200
mov edx, dword [ebp - 4]
mov ecx, 0x108
mov eax, ebx
call fcn.0043e40c
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x45788d
lea eax, [ebp - 4]
xor edx, edx
call fcn.00446914
jmp 0x45789f
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0x108
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45b3c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45b420
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x55cd1c]
mov dl, 1
mov eax, dword [0x45aeec]
call fcn.0042c5e0
call fcn.00404984
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045aff4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d574
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054fc
xor eax, eax
push ebp
push 0x45d6d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, 0x45d6ec
call fcn.00446198
mov ebx, eax
lea ecx, [ebx + 1]
mov edx, dword [ebp - 4]
mov eax, 0x45d6ec
call fcn.00446198
mov ebx, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405308
mov ecx, eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040556c
mov eax, dword [ebp - 4]
call fcn.00405308
mov ecx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004055ac
mov bl, 0x41
lea eax, [ebp - 8]
mov edx, 0x2800
call fcn.00405794
mov eax, dword [ebp - 8]
call fcn.00405308
test eax, eax
jns 0x45d611
call fcn.00403edc
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405214
lea eax, [ebp - 0xc]
mov edx, 0x45d6f8
call fcn.00405314
mov eax, dword [ebp - 0xc]
call fcn.0040550c
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
je 0x45d6a8
mov eax, dword [ebp - 8]
call fcn.0040550c
call fcn.004290f0
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405794
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00427df0
test al, al
je 0x45d6a8
lea eax, [ebp - 0x14]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.0040379c
mov edx, 0x45d6fc
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.0040376c
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00405290
mov edx, dword [ebp - 0x10]
mov ecx, dword [esi]
mov eax, esi
call fcn.00405358
jmp 0x45d6b9
inc ebx
cmp bl, 0x5b
jne 0x45d5f3
mov eax, esi
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d6db
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405050
ret
Function at 0x45e240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x45e32a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405990
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00427f88
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004052d0
cmp dword [edi], 0
je 0x45e302
mov eax, 1
mov edx, dword [edi]
dec eax
test edx, edx
je 0x45e296
cmp eax, dword [edx - 4]
jb 0x45e29b
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x22
jne 0x45e2b9
push edi
mov eax, dword [edi]
mov ecx, 0x7fffffff
mov edx, 2
call fcn.0040556c
mov bl, 0x22
jmp 0x45e2bb
mov bl, 0x20
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405214
mov eax, dword [ebp - 0xc]
mov edx, dword [edi]
call fcn.00405650
mov esi, eax
test esi, esi
jle 0x45e2e7
push edi
lea edx, [esi + 1]
mov eax, dword [edi]
mov ecx, 0x7fffffff
call fcn.0040556c
jmp 0x45e2ee
mov eax, edi
call fcn.0040502c
lea edx, [ebp - 0x10]
mov eax, dword [edi]
call fcn.00427f34
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e331
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040586c
ret

Function at 0x45e94c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45e9e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x400
call fcn.00405bfc
mov eax, dword [ebp - 4]
call fcn.00405a28
mov edx, eax
add edx, edx
mov eax, 1
mov ecx, dword [ebp - 4]
dec eax
test ecx, ecx
je 0x45e993
cmp eax, dword [ecx - 4]
jb 0x45e998
call fcn.00403edc
inc eax
lea eax, [ecx + eax*2 - 2]
xor ecx, ecx
call fcn.004038b8
mov eax, dword [ebp - 4]
call fcn.00405a28
sar eax, 1
jns 0x45e9b3
adc eax, 0
push eax
mov eax, dword [ebp - 4]
call fcn.00405a18
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e9eb
lea eax, [ebp - 4]
call fcn.00405854
ret