joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445e60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4460ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0044472c
xor eax, eax
push ebp
push 0x446084
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00444d2c
test al, al
je 0x446068
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004862a8
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x446068
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00486e88
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044468c
test al, al
je 0x44605c
mov eax, dword [ebp - 4]
call fcn.00486e88
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00486ee0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00445778
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x44605c
xor eax, eax
push ebp
push 0x446055
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0044472c
xor eax, eax
push ebp
push 0x446037
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00486e88
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00486ee0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00444730
mov eax, dword [ebp - 4]
call fcn.00486e88
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00486ee0
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00445778
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x446014
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00445d28
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00445e60
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44601b
mov eax, dword [ebp - 0x24]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x445eeb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44608b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0044472c
ret
Function at 0x463490
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4635b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x218]
push eax
push 0x104
call sub.KERNEL32.DLL_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x463593
lea ebx, [ebp - 0x218]
lea eax, [ebx + 4]
mov word [eax], 0
push 0x104
lea eax, [ebp - 0x424]
push eax
push ebx
call sub.KERNEL32.DLL_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x46357c
lea eax, [ebp - 4]
lea edx, [ebp - 0x424]
mov ecx, 0x106
call fcn.00486f1c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004873e8
test eax, eax
jle 0x46357c
mov eax, dword [ebp - 4]
test eax, eax
je 0x463530
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edi, dword [ebp - 8]
test edi, edi
je 0x46353e
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.0048723c
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov edx, ebx
call fcn.00486ee0
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.004870cc
jmp 0x463593
add ebx, 2
cmp word [ebx], 0
jne 0x463579
add ebx, 4
test ebx, ebx
je 0x46358d
cmp word [ebx], 0
jne 0x4634e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4635c0
lea eax, [ebp - 0x42c]
mov edx, 2
call fcn.00486180
lea eax, [ebp - 4]
call fcn.00486120
ret
Function at 0x4636ac
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4638e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00486120
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
test ebx, ebx
jne 0x463783
cmp dword [ebp - 0x14], 0
jne 0x463783
xor edx, edx
mov eax, 6
call fcn.0046b748
test al, al
je 0x463783
push 2
push 0x104
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFinalPathNameByHandleW
test eax, eax
jbe 0x463783
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.00486f1c
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00463490
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 8]
call fcn.00486500
mov byte [ebp - 9], 1
jmp 0x4638cb
test ebx, ebx
jne 0x463791
cmp dword [ebp - 0x14], 0
je 0x46387f
push 0
push 1
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3ee
je 0x46387f
xor eax, eax
push ebp
push 0x463878
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x463861
xor eax, eax
push ebp
push 0x46385a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
call sub.KERNEL32.DLL_GetCurrentProcess
lea ecx, [ebp - 0x224]
mov edx, dword [ebp - 0x18]
call fcn.0041ac00
test eax, eax
jbe 0x463843
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.00486f1c
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.00463490
mov edx, dword [ebp - 0x230]
mov eax, dword [ebp - 8]
call fcn.00486500
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463861
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46387f
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
cmp byte [ebp - 9], 0
jne 0x4638cb
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 4]
call fcn.004635c8
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 8]
call fcn.00486500
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4638cb
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00463490
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 8]
call fcn.00486500
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4638f0
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.00486180
ret
Function at 0x4638fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
xor edx, edx
mov eax, 6
call fcn.0046b748
test al, al
je 0x4639c4
xor edx, edx
mov eax, ebx
call fcn.00465288
test al, al
je 0x4639c4
mov eax, ebx
call fcn.00465058
test al, 0x20
je 0x4639c4
mov eax, ebx
call fcn.00486e88
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4639c4
test ah, 4
je 0x4639c4
test al, 0x10
je 0x463963
mov edi, 0x2000000
jmp 0x463965
xor edi, edi
push 0
push edi
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00486e88
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4639c4
xor eax, eax
push ebp
push 0x4639bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov ecx, edi
mov eax, dword [ebp - 8]
call fcn.004636ac
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4639c4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x463c9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x463cf5
test eax, edx
je 0x463cf8
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x463cb3
movzx eax, word [eax]
sub eax, ecx
jmp 0x463cda
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x463cdb
add ecx, 4
js 0x463ccb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x463cd8
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x463cda
xor eax, eax
ret
test eax, eax
je 0x463d04
test edx, edx
jne 0x463ca4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x4644c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov ebp, eax
mov byte [esp], 0
mov eax, ebp
test eax, eax
je 0x4644e0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4644e8
mov al, 1
jmp 0x464505
movzx esi, word [ebp]
mov eax, esi
call fcn.00471474
test al, al
jne 0x464501
cmp si, 0x5f
je 0x464501
xor eax, eax
jmp 0x464503
mov al, 1
xor al, 1
test al, al
jne 0x464595
test bl, bl
je 0x464555
mov eax, ebp
test eax, eax
je 0x46451c
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x464591
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.00471500
test al, al
jne 0x464549
cmp di, 0x5f
je 0x464549
cmp di, 0x2e
je 0x464549
xor eax, eax
jmp 0x46454b
mov al, 1
test al, al
je 0x464595
inc esi
dec ebx
jne 0x464529
jmp 0x464591
mov eax, ebp
test eax, eax
je 0x464560
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, 2
jl 0x464591
inc ebx
mov esi, 2
movzx edi, word [ebp + esi*2 - 2]
mov eax, edi
call fcn.00471500
test al, al
jne 0x464587
cmp di, 0x5f
je 0x464587
xor eax, eax
jmp 0x464589
mov al, 1
test al, al
je 0x464595
inc esi
dec ebx
jne 0x46456d
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x465058
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46518c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx ebx, byte [0x46519c]
mov dl, 1
mov eax, esi
call fcn.00465320
test al, al
jne 0x4650a9
mov dl, 1
mov eax, esi
call fcn.00465288
test al, al
je 0x46513f
lea edx, [ebp - 0x424]
mov eax, esi
call fcn.00465860
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 4]
call fcn.0046bc64
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 4]
call fcn.00486e88
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetVolumeInformationW
test eax, eax
je 0x46513a
test byte [ebp - 0xc], 1
je 0x465105
or bl, 1
test byte [ebp - 0xc], 2
je 0x46510e
or bl, 2
test byte [ebp - 0xc], 0x80
je 0x465117
or bl, 0x20
push esi
call sub.KERNEL32.DLL_GetDriveTypeW
sub eax, 2
je 0x46512b
dec eax
je 0x465130
dec eax
je 0x465135
dec eax
jne 0x465166
or bl, 0x10
jmp 0x465166
or bl, 4
jmp 0x465166
or bl, 8
jmp 0x465166
call fcn.0046c664
lea edx, [ebp - 0x428]
mov eax, dword [0x63e310]
call fcn.00489cdc
mov ecx, dword [ebp - 0x428]
mov dl, 1
mov eax, dword [0x45eff8]
call fcn.0046a724
call fcn.00485928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465193
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00486180
lea eax, [ebp - 4]
call fcn.00486120
ret
Function at 0x465288
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00486e88
mov edi, eax
push edi
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4652f2
test ah, 4
je 0x4652eb
test bl, bl
jne 0x4652b0
mov al, 1
jmp 0x465319
test al, 0x10
je 0x4652b8
xor eax, eax
jmp 0x465319
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x4652dc
push eax
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x465319
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x465319
test al, 0x10
sete al
jmp 0x465319
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x465313
cmp ebx, 3
je 0x465313
cmp ebx, 0x7b
je 0x465313
mov eax, esi
call fcn.00465248
test al, al
jne 0x465317
xor eax, eax
jmp 0x465319
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x465320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.00486e88
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4653c7
test esi, 0x400
jne 0x46535c
test esi, 0x10
setne bl
jmp 0x4653e6
cmp byte [esp], 0
je 0x465390
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x4653e6
push eax
call sub.KERNEL32.DLL_CloseHandle
test esi, 0x10
setne bl
jmp 0x4653e6
test esi, 0x10
je 0x46539c
mov bl, 1
jmp 0x4653e6
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x4653c3
push eax
call sub.KERNEL32.DLL_CloseHandle
xor ebx, ebx
jmp 0x4653e6
mov bl, 1
jmp 0x4653e6
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x4653e0
cmp eax, 3
je 0x4653e0
cmp eax, 0x7b
je 0x4653e0
cmp eax, 0x35
jne 0x4653e4
xor ebx, ebx
jmp 0x4653e6
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4654ec
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4655bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00486548
cmp byte [ebp - 9], 0
je 0x46557d
mov eax, ebx
call fcn.00486e88
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
test ah, 4
je 0x46557d
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004638fc
test al, al
je 0x46557d
mov eax, dword [ebp - 8]
call fcn.00465a44
test al, al
je 0x465572
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00465824
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0046bc64
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.004870cc
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00486548
push edi
mov eax, dword [ebp - 4]
call fcn.00486e88
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
jne 0x465597
call sub.KERNEL32.DLL_GetLastError
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4655c6
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00486180
lea eax, [ebp - 8]
mov edx, 2
call fcn.00486180
ret

Function at 0x4656e8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.00486e88
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x46573d
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x465737
test ah, 4
je 0x465737
test al, 0x10
je 0x465737
mov eax, esi
call fcn.00486e88
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x46573d
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x469890
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x4698c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004862a8
jmp 0x4698d2
mov eax, ebx
mov edx, esi
call fcn.00486500
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4698dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x4698fe
movzx eax, word [esp]
jmp 0x469900
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x46a5d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x46a6f9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0046a3dc
mov esi, eax
mov eax, dword [0x63e5a4]
cmp byte [eax], 0
je 0x46a6a1
mov eax, dword [0x63e5b0]
call fcn.00484000
call fcn.00483bc0
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x46a5a4]
call fcn.004881b8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x46a714
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x46a6dd
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x63e408]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x63e9c0]
call fcn.004882ac
push eax
call sub.USER32.DLL_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.USER32.DLL_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a700
lea eax, [ebp - 4]
mov edx, dword [0x46a5a4]
call fcn.004881c4
ret

Function at 0x46b768
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b83e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00486548
lea eax, [ebp - 4]
call fcn.004866dc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00486e88
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x46b828
mov eax, ebx
call fcn.004839bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46b821
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00486e88
push eax
call sub.VERSION.DLL_GetFileVersionInfoW
test eax, eax
je 0x46b80b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x46b850
mov eax, dword [ebp - 0x10]
push eax
call sub.VERSION.DLL_VerQueryValueW
test eax, eax
je 0x46b80b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b828
mov eax, dword [ebp - 0x10]
call fcn.004839d8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b845
lea eax, [ebp - 4]
call fcn.00486120
ret
Function at 0x46c510
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0048661c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00489d70
mov edi, eax
cmp edi, 0x104
jbe 0x46c4b7
mov eax, edi
add eax, eax
call fcn.004839bc
mov esi, eax
jmp 0x46c4b9
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00489d70
mov eax, esi
push eax
call sub.USER32.DLL_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x46c4f4
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x46c4de
mov eax, esp
cmp esi, eax
je 0x46c501
mov eax, esi
call fcn.004839d8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x46c53c
cmp bl, 0
je 0x46c538
cmp bl, 0x41
jl 0x46c533
cmp bl, 0x5a
jg 0x46c533
or bl, 0x20
xor al, bl
inc esi
jmp 0x46c517
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x46c478

Function at 0x46cd3c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00486f1c
add esp, 0x800
pop ebx
ret

Function at 0x483bf0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x483c32
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.KERNEL32.DLL_GetCurrentDirectoryW
push esp
call sub.KERNEL32.DLL_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test bl, bl
je 0x483c52
lea eax, [esp + 0x212]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00486f1c
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x483e48
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00486120
test esi, esi
jne 0x483e7e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004862a8
jmp 0x483e9c
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00483d8c
mov edi, eax
test esi, esi
je 0x483e9c
cmp dword [ebx], 0
je 0x483e9c
dec esi
jmp 0x483e85
add esp, 0x20c
pop edi
pop esi
pop ebx
ret