joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a12e4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4a13ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c3f88]
cmp byte [eax], 0
jne 0x4a136f
cmp dword [ebp - 4], 1
jne 0x4a134a
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404ff0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00404ff0
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.0043a400
jmp 0x4a13cb
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00404ff0
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404ff0
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.0043a42c
jmp 0x4a13cb
mov eax, esi
call fcn.00405710
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.00405700
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405700
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4a13cb
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x4c4224]
call fcn.00406fe4
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43a000]
call fcn.0040e824
call fcn.004046a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a13f5
lea eax, [ebp - 0x20]
call fcn.00404d58
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404d7c
ret
Function at 0x4a269c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00405ac0
lea eax, [ebp - 8]
call fcn.00405ac0
lea eax, [ebp - 0xc]
call fcn.00405ac0
xor eax, eax
push ebp
push 0x4a28ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004054ec
xor eax, eax
push ebp
push 0x4a281b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405700
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4a2811
xor eax, eax
push ebp
push 0x4a280a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405700
mov esi, eax
push esi
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4a27f3
cmp dword [ebp - 0x10], 7
jne 0x4a27f3
mov eax, dword [ebp - 0x14]
call fcn.00402ad8
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4a27ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
push esi
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4a27d6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x4a27cd
push dword [ebx]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x18]
call fcn.00405608
push dword [ebp - 0x24]
push 0x4a28c4
mov eax, ebx
mov edx, 3
call fcn.004057e4
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_lstrlenW
inc eax
add eax, eax
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp word [eax], 0
jne 0x4a279d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a27f3
mov eax, dword [ebp - 0x1c]
call fcn.00402b08
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2811
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2876
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a28b5
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004054c8
lea eax, [ebp - 0x28]
call fcn.00404d58
lea eax, [ebp - 0x24]
call fcn.004054b0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004054c8
ret
Function at 0x4b3f3c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b4028
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c40a8]
cmp dword [eax], 5
jl 0x4b3fa1
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a78
push 0
push 0x26
mov eax, dword [ebp - 4]
call fcn.00405700
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4b3f98
mov eax, dword [ebp - 4]
call fcn.00405700
mov edx, eax
mov eax, ebx
call fcn.00405608
jmp 0x4b3fb3
mov eax, ebx
call fcn.004054b0
jmp 0x4b3fb3
lea eax, [ebp - 8]
call fcn.004b3e78
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405684
mov eax, dword [ebx]
xor edx, edx
call fcn.0040582c
jbe 0x4b3fdb
mov eax, dword [ebx]
call fcn.00405710
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b3fdb
mov eax, ebx
mov edx, 0x4b4038
call fcn.0040571c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b4040
call fcn.0040577c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404ff0
mov eax, dword [ebp - 0xc]
call fcn.004b3ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b402f
lea eax, [ebp - 0x10]
call fcn.004054b0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d7c
lea eax, [ebp - 4]
call fcn.004054b0
ret

Function at 0x4b424c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b4338
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c40a8]
cmp dword [eax], 5
jl 0x4b42b1
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a78
push 0
push 0x1c
mov eax, dword [ebp - 4]
call fcn.00405700
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4b42a8
mov eax, dword [ebp - 4]
call fcn.00405700
mov edx, eax
mov eax, ebx
call fcn.00405608
jmp 0x4b42c3
mov eax, ebx
call fcn.004054b0
jmp 0x4b42c3
lea eax, [ebp - 8]
call fcn.004b4174
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405684
mov eax, dword [ebx]
xor edx, edx
call fcn.0040582c
jbe 0x4b42eb
mov eax, dword [ebx]
call fcn.00405710
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b42eb
mov eax, ebx
mov edx, 0x4b4348
call fcn.0040571c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b4350
call fcn.0040577c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404ff0
mov eax, dword [ebp - 0xc]
call fcn.004b3ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b433f
lea eax, [ebp - 0x10]
call fcn.004054b0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d7c
lea eax, [ebp - 4]
call fcn.004054b0
ret
Function at 0x4b4458
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b4544
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c40a8]
cmp dword [eax], 5
jl 0x4b44bd
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a78
push 0
push 0x23
mov eax, dword [ebp - 4]
call fcn.00405700
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4b44b4
mov eax, dword [ebp - 4]
call fcn.00405700
mov edx, eax
mov eax, ebx
call fcn.00405608
jmp 0x4b44cf
mov eax, ebx
call fcn.004054b0
jmp 0x4b44cf
lea eax, [ebp - 8]
call fcn.004b437c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405684
mov eax, dword [ebx]
xor edx, edx
call fcn.0040582c
jbe 0x4b44f7
mov eax, dword [ebx]
call fcn.00405710
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b44f7
mov eax, ebx
mov edx, 0x4b4554
call fcn.0040571c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b455c
call fcn.0040577c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404ff0
mov eax, dword [ebp - 0xc]
call fcn.004b3ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b454b
lea eax, [ebp - 0x10]
call fcn.004054b0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d7c
lea eax, [ebp - 4]
call fcn.004054b0
ret

Function at 0x4b4700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b47d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c3f88]
cmp byte [eax], 0
je 0x4b4757
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a78
mov eax, dword [ebp - 4]
call fcn.00405700
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
call fcn.00405700
mov edx, eax
mov eax, ebx
call fcn.00405608
jmp 0x4b4769
lea eax, [ebp - 8]
call fcn.004b4698
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405684
mov eax, dword [ebx]
call fcn.00405710
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b4786
mov eax, ebx
mov edx, 0x4b47e4
call fcn.0040571c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b47ec
call fcn.0040577c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404ff0
mov eax, dword [ebp - 0xc]
call fcn.004b3ba4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b47da
lea eax, [ebp - 0x10]
call fcn.004054b0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d7c
lea eax, [ebp - 4]
call fcn.004054b0
ret
Function at 0x4b4a24
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x4c44f4]
cmp dword [eax], 2
je 0x4b4a41
mov byte [ebp - 1], 1
jmp 0x4b4c0f
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x4c3df0
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4b4c0f
xor eax, eax
push ebp
push 0x4b4c08
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x4b4aa3
push 0x4b4c18
push 0x4b4c30
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4b4aca
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x4b4bf1
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x4b4bf1
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4b4b1b
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x4b4afc
call fcn.0040474c
jmp 0x4b4c0f
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b4b1b
call fcn.0040474c
jmp 0x4b4c0f
xor eax, eax
push ebp
push 0x4b4bea
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4b4b5e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x4b4b5e
call fcn.0040474c
call fcn.0040474c
jmp 0x4b4c0f
mov eax, dword [ebp - 0x14]
call fcn.00402ad8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4b4b90
call fcn.0040474c
call fcn.0040474c
jmp 0x4b4c0f
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x4b4bcb
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4b4bc7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x4b4bc7
mov byte [ebp - 1], 1
jmp 0x4b4bcb
inc ebx
dec esi
jne 0x4b4b9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4bf1
mov eax, dword [ebp - 0x18]
call fcn.00402b08
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4c0f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b558c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4b5715
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b5728
call fcn.004b3ba4
mov eax, dword [0x4c44f4]
cmp dword [eax], 2
jne 0x4b56a7
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b5614
mov eax, 0x4b5748
call fcn.004b3ba4
push 1
push 1
lea ecx, [ebp - 0x1c]
mov eax, dword [0x4c3fdc]
mov eax, dword [eax]
mov edx, 0x4b5768
call fcn.00481078
mov eax, dword [ebp - 0x1c]
mov ecx, 0x7d5
xor edx, edx
call fcn.004a7e0c
jmp 0x4b56e5
lea eax, [ebp - 0x14]
push eax
push 0x4b5798
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b56a7
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040a004
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x4b57b4
call fcn.00405074
mov eax, dword [ebp - 0x20]
call fcn.004b3ba4
push 1
push 1
lea ecx, [ebp - 0x28]
mov eax, dword [0x4c3fdc]
mov eax, dword [eax]
mov edx, 0x4b5768
call fcn.00481078
mov eax, dword [ebp - 0x28]
mov ecx, 0x7d5
xor edx, edx
call fcn.004a7e0c
jmp 0x4b56e5
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x4b56e5
mov eax, 0x4b57e8
call fcn.004b3ba4
push 1
push 1
lea ecx, [ebp - 0x2c]
mov eax, dword [0x4c3fdc]
mov eax, dword [eax]
mov edx, 0x4b5768
call fcn.00481078
mov eax, dword [ebp - 0x2c]
mov ecx, 0x7d5
xor edx, edx
call fcn.004a7e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b571c
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004054c8
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404d7c
lea eax, [ebp - 0x1c]
call fcn.004054b0
ret
Function at 0x4b5b30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405218
xor eax, eax
push ebp
push 0x4b5bd5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405228
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, edi
call fcn.00404d58
test ebx, ebx
je 0x4b5bbf
mov eax, ebx
call fcn.00402ad8
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00405228
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b5be4
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4b5bb1
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.00404f60
jmp 0x4b5bb8
mov eax, edi
call fcn.00404d58
mov eax, esi
call fcn.00402b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5bdc
lea eax, [ebp - 4]
call fcn.00404d58
ret

Function at 0x4b5c0c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405ac0
xor eax, eax
push ebp
push 0x4b5cd6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405700
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x4b5c6e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x78
jne 0x4b5c6e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404ff0
mov eax, dword [ebp - 0x14]
mov edx, edi
call fcn.004b5b30
jmp 0x4b5cb8
mov eax, edi
call fcn.00404d58
test ebx, ebx
je 0x4b5cb8
mov eax, ebx
call fcn.00402ad8
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00405700
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b5ce4
push esi
call sub.version.dll_VerQueryValueW
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.00404f90
mov eax, esi
call fcn.00402b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5cdd
lea eax, [ebp - 0x14]
call fcn.00404d58
lea eax, [ebp - 4]
call fcn.004054b0
ret
Function at 0x4045cc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406e78
test esi, esi
jne 0x404604
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406fb4
jmp 0x404622
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404510
mov edi, eax
test esi, esi
je 0x404622
cmp dword [ebx], 0
je 0x404622
dec esi
jmp 0x40460b
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405f28
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x56e054], 0
je 0x405f89
cmp word [0x56e330], 0xd7b2
jne 0x405f51
cmp dword [0x56e338], 0
jbe 0x405f51
mov eax, 0x56e32c
call dword [0x56e348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405fb4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x568030], 0
jne 0x405fa5
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406134
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x568034], 0
je 0x40615a
mov edx, esi
mov eax, ebx
call dword [0x568034]
jmp 0x406169
mov eax, 8
call fcn.00404258
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x56e055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4060fc
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408dd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408f3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406e78
cmp si, word [0x5687dc]
jb 0x408e72
cmp si, word [0x5689dc]
ja 0x408e72
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408e72
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x5687dc]
jae 0x408e4c
mov edi, ebx
dec edi
jmp 0x408e6d
cmp si, word [ebx*8 + 0x5687dc]
jbe 0x408e5c
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408e6d
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x5687e0]
call fcn.00408ce8
jmp 0x408e72
cmp edi, dword [ebp - 0xc]
jae 0x408e36
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408f21
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408f21
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407070
push dword [ebp - 0x164]
push 0x408f5c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00407070
push dword [ebp - 0x168]
push 0x408f6c
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407070
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00407428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f46
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406e70
ret
Function at 0x4090f8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4091fd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x570b5c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x570b74]
jne 0x409144
mov eax, esi
mov edx, 0x570b78
mov ecx, 0x55
call fcn.00407070
push 0x570b5c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4091e7
push 0x570b5c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406e78
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4091b5
cmp byte [0x570b58], 0
je 0x40917a
mov edx, esi
mov eax, ebx
call fcn.00408fd8
jmp 0x4091b5
mov edx, esi
mov eax, ebx
call fcn.00408dd8
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4091b5
cmp dword [esi], 0
je 0x40919e
mov eax, esi
mov edx, 0x409218
call fcn.00407284
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408dd8
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407284
push 0x570b5c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x570b74], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406f04
push eax
push 0x570b78
call sub.kernel32.dll_lstrcpynW
push 0x570b5c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409204
lea eax, [ebp - 4]
call fcn.00406e68
ret