joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405750
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406827
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [ebp - 4], 2
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x407638
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_945]
lea edx, [ebp + 0xc]
push edx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_941]
lea eax, [ebp - 0x124]
push eax
push 0x4074ec
push 1
push 0
push 0x4074fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x40590e
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
mov ecx, dword [ebp - 0x124]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [edx + 0x50]
call ecx
lea edx, [ebp - 0x128]
push edx
push 0x40750c
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x124]
push edx
mov eax, dword [ecx]
call eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x4058fa
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x338]
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x338]
call dword [sym.imp.mfc90.dll_Ordinal_4477]
push 0
push 0x40763c
lea ecx, [ebp - 0x338]
call dword [sym.imp.mfc90.dll_Ordinal_2481]
cmp eax, 0xffffffff
jne 0x405891
push str..lnk
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_945]
push 0x104
lea edx, [ebp - 0x334]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 1
lea eax, [ebp - 0x334]
push eax
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x128]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x128]
push ecx
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x338]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x124]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x33c], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00405de0
mov esp, ebp
pop ebp
ret

Function at 0x405de0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d018]
jne 0x405dea
repz ret
jmp fcn.004062dc
Function at 0x401040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0x44
push ecx
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
movups xmmword [ebp - 0x58], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4010ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.00401010
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401144
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.00401144
mov esp, ebp
pop ebp
ret

Function at 0x8902b0
Capabilities:
Check for software breakpoints

Disassembly:
jae 0x890eb7
pushal
ror al, 3
pushfd
mov dword [esp], 0x18e3d3ff
pushfd
inc al
push ecx
pushfd
clc
xor bl, al
test bh, 0x57
stc
mov ax, word [edi + eax]
stc
cmp cl, 0xcc
pushfd
sub ebp, 2
jmp 0x88f433
pushfd
pushfd
call fcn.0088fff8
mov byte [esp + 0xc], al
dec al
stc
clc
clc
call fcn.0088d7f2
add ebp, 4
pushfd
lea esp, [esp + 8]
jmp 0x89032e
mov dword [ebp], eax
pushfd
pushal
mov byte [esp + 8], 0x8c
mov word [esp + 0xc], 0x2d0b
lea esp, [esp + 0x2c]
jmp 0x890339
lea esi, [esi + 1]
mov byte [esp], cl
push 0xb90a5fe1
lea esp, [esp + 0x38]
jb 0x88e42d
mov word [ebp], ax
pushfd
pushfd
push 0x998253cd
push eax
lea esp, [esp + 0x10]
jmp 0x88d50f
bt sp, 0xd
push eax
stc
xor al, 0x83
test al, cl
pushfd
push dword [esp]
cmp bx, 0xc805
neg al
push 0x5490aa62
not al
pushal
lea esp, [esp + 0x3c]
jge 0x88d9d7
push esi
ror al, 3
pushfd
inc al
cmp ah, 0xda
cmp al, 1
call fcn.0088df6b
push 0xb6e6e44f
bt bp, cx
add ebp, 6
pushfd
pushfd
mov word [eax], dx
pushfd
push esp
lea esp, [esp + 0x14]
jmp 0x890339
call fcn.00890497
push 0x55a6e296
mov byte [esp], 0xeb
inc al
jmp 0x88f893
clc
call fcn.008900d1
pushfd
inc edx
pushal
push eax
push dword [esp + 8]
dec dword [ebp]
mov byte [esp], 0x4b
mov byte [esp], 0x43
pushfd
pushfd
lea esp, [esp + 0x38]
jne 0x890091
pushfd
pushfd
jmp 0x88f02b
Function at 0x410e00
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x57f650]
cmp ax, 0xcb
je 0x410eff
cmp ax, 0xcc
je 0x410eff
mov edx, dword [0x5ff6b0]
test edx, edx
je 0x410e32
mov eax, dword [0x5ff560]
call edx
mov ebx, eax
jmp 0x410e37
mov ebx, 0x5ff564
cmp word [0x5ff550], 0
jle 0x410e5a
mov eax, 0x5ff530
call fcn.00411070
mov eax, ebx
call fcn.004109d0
mov eax, ebx
call fcn.00410a50
mov esi, dword [ebx]
jmp 0x410e7d
mov edi, dword [esi + 4]
test byte [esi], 1
jne 0x410e78
mov edx, esi
mov eax, ebx
call fcn.0040fe50
jmp 0x410e7b
and dword [esi], 0xfffffffe
mov esi, edi
test esi, esi
jne 0x410e60
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5ff550], 0
jle 0x410eff
mov edx, 0x5ff470
mov eax, ebx
call fcn.0040ffa0
mov esi, eax
test eax, eax
je 0x410ed2
mov eax, dword [0x5ff504]
mov dword [esi + 0xc], eax
cmp dword [0x5ff504], 0
je 0x410ec7
mov eax, dword [0x5ff504]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x94]
mov dword [0x5ff504], eax
sub word [0x5ff550], 1
cmp word [0x5ff550], 0
sete bl
mov eax, 0x5ff530
call fcn.00411090
test bl, bl
je 0x410eff
mov eax, 0x5ff530
call fcn.00411060
pop edi
pop esi
pop ebx
ret
Function at 0x413720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413700
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x413850
movzx eax, byte [ebp - 0x20]
add eax, 0x40
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040bab0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x4137aa
mov eax, 0x5ff2f0
push eax
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test eax, eax
jne 0x413800
call sub.kernel32.dll_GetLastError
call fcn.00404280
lea eax, [ebp - 0x10]
call fcn.0040a500
movzx eax, byte [ebp - 0x20]
add eax, 0x40
lea edx, [ebp - 0x14]
call fcn.0040a9b0
mov edx, dword [ebp - 0x14]
mov ecx, 0x59e284
lea eax, [ebp - 0x10]
call fcn.0040a830
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b290
jmp 0x41389c
mov edi, esi
xor eax, eax
sub edi, 1
sbb eax, 0
mov edx, ebx
xor ecx, ecx
cmp eax, ecx
jne 0x413816
cmp edi, edx
je 0x413820
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040bab0
cmp byte [0x57f8e0], 0
jne 0x41389c
lea edx, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call fcn.0040c0f0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b3b0
jmp 0x41389c
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040bab0
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x413874
mov edx, 0x5ff2f0
push edx
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x57f8e0], 0
jne 0x41389c
lea edx, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call fcn.0040c0f0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b3b0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00413700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426550
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.00408c00
mov eax, dword [ebp - 8]
call fcn.00408c00
xor eax, eax
push fcn.00426530
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x426590
mov eax, 0x5ff2f0
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x42659d
mov eax, 0x5ff2f0
push eax
mov eax, str.open
push eax
push 0
call sub.shell32.dll_ShellExecuteA
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00426530
mov esp, ebp
pop ebp
ret
Function at 0x428410
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x4284c0
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x4284dc
mov dword [ebp - 0x20], 0xffffffff
nop word [eax + eax]
add dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x4284dc
sub dx, 0x20
je 0x4284b0
add dx, 0xff80
je 0x4284b0
sub dx, 0x1f62
jb 0x4284dc
sub dx, 1
jbe 0x4284b0
sub dx, 6
je 0x4284b0
sub dx, 0x26
jne 0x4284dc
nop dword [eax]
cmp eax, dword [ebp - 0x20]
jg 0x428458
jmp 0x4284dc
cmp dword [ebp - 0x1c], 2
jne 0x4284d0
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x4284dc
mov al, byte [ebp - 0xc]
call fcn.0040b6d0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x428560
sub ax, 0x21
je 0x428580
sub ax, 0x17
je 0x428590
sub ax, 0x222
je 0x4285a0
sub ax, 0x392
je 0x4285b0
sub ax, 1
je 0x4285c0
sub ax, 0x1996
je 0x4285d0
sub ax, 1
je 0x4285e0
sub ax, 6
je 0x4285f0
sub ax, 0xb
je 0x428610
sub ax, 0x1b
je 0x428600
sub ax, 0x367
je 0x428620
jmp 0x428630
mov ax, word [ebp - 0x24]
call fcn.0040b770
mov byte [ebp - 0x10], al
jmp 0x428640
mov byte [ebp - 0x10], 0x20
jmp 0x428640
mov byte [ebp - 0x10], 0x2e
jmp 0x428640
mov byte [ebp - 0x10], 0x27
jmp 0x428640
mov byte [ebp - 0x10], 0x2c
jmp 0x428640
mov byte [ebp - 0x10], 0x27
jmp 0x428640
mov byte [ebp - 0x10], 0x20
jmp 0x428640
mov byte [ebp - 0x10], 0x20
jmp 0x428640
mov byte [ebp - 0x10], 0x20
jmp 0x428640
mov byte [ebp - 0x10], 0x20
jmp 0x428640
mov byte [ebp - 0x10], 0x2d
jmp 0x428640
mov byte [ebp - 0x10], 0x27
jmp 0x428640
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
nop word [eax + eax]
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4357a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10c]
push ebx
push esi
push edi
mov esi, eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00435790
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push edi
push ebx
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x14], eax
test eax, eax
jne 0x435891
cmp byte [ebp + 8], 0
je 0x435860
push 0xff
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
mov eax, edi
call fcn.00405070
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x10c]
xor dx, dx
call fcn.00409540
lea eax, [ebp - 0xc]
xor cl, cl
xor dx, dx
call fcn.0040a380
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov eax, 0x5a56fc
mov edx, 1
call fcn.0044f9a0
mov edx, 0x4357ec
mov ecx, ebp
call fcn.00414d20
mov dword [ebp - 4], edi
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov eax, 0x5a56fc
mov edx, 1
call fcn.0044f9a0
mov edx, 0x435860
mov ecx, ebp
call fcn.00414d20
push dword [esi + 0x14]
push ebx
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x18], eax
test eax, eax
jne 0x435951
cmp byte [ebp + 8], 0
je 0x435920
push 0xff
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
mov eax, edi
call fcn.00405070
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x10c]
xor dx, dx
call fcn.00409540
lea eax, [ebp - 0xc]
xor cl, cl
xor dx, dx
call fcn.0040a380
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov eax, 0x5a56fc
mov edx, 1
call fcn.0044f9a0
mov edx, 0x4358af
mov ecx, ebp
call fcn.00414d20
mov dword [ebp - 4], edi
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov eax, 0x5a56fc
mov edx, 1
call fcn.0044f9a0
mov edx, 0x435920
mov ecx, ebp
call fcn.00414d20
push dword [esi + 0x14]
push ebx
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x18]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00435110
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00435790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x438950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x5a63b4
mov edx, dword [ebp - 4]
call fcn.0040d5b0
test al, al
je 0x438a38
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00438a50
xor eax, eax
push fcn.00438940
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x28]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408c30
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x2c]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.00437b50
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.00437650
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00438940
jmp 0x438a43
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043aeb0
mov esp, ebp
pop ebp
ret
Function at 0x445340
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.00445330
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
lea eax, [ebp - 0xc10]
mov edx, dword [ebp - 4]
call fcn.00408c30
lea eax, [ebp - 0xc10]
call fcn.00403d10
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4453a0
mov eax, 0x5ff2f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x445450
lea eax, [ebp - 0xc0c]
mov edx, dword [ebp - 0xc18]
call fcn.0040fc90
xor eax, eax
push fcn.00445320
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4453fc
mov eax, 0x5ff2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x445435
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x5ab33c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x445435
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00445320
jmp 0x4454ac
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x445472
mov eax, 0x5ff2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4454ac
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x5ab33c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4454ac
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00445330
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x451110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x270]
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0x270], cl
lea eax, [ebp - 0x268]
mov edx, 0x5ac360
call fcn.0040e940
xor eax, eax
push fcn.004510f0
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x451156
mov eax, 0x5ff2f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4511a0
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x451172
clc
jmp 0x451179
bt dword [0x5ab838], eax
jb 0x451190
mov eax, ebp
call fcn.00451260
test al, al
setne byte [ebp - 0x26c]
jmp 0x451240
mov byte [ebp - 0x26c], 0
jmp 0x451240
movzx edx, byte [ebp - 8]
mov eax, ebx
and eax, 0x10
cmp eax, dword [edx*4 + 0x581120]
sete byte [ebp - 0x26c]
mov al, byte [ebp - 0x26c]
and al, byte [ebp - 0x270]
je 0x451240
test bx, 0x400
je 0x451240
lea ebx, [ebp - 0x268]
mov edx, 0x5ac360
mov eax, ebx
call fcn.0040ea20
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.00450d20
test eax, eax
je 0x451200
sub eax, 1
je 0x451220
jmp 0x451230
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00451110
mov byte [ebp - 0x26c], al
jmp 0x451240
mov byte [ebp - 0x26c], 1
jmp 0x451240
mov byte [ebp - 0x26c], 0
nop word [eax + eax]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004510f0
mov al, byte [ebp - 0x26c]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451530
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00451520
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test eax, eax
jle 0x4515a0
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0040bab0
cmp ebx, 1
jle 0x45158a
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0040b160
jmp 0x4515ab
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00408c30
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00451520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4519a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00451990
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
nop dword [eax + eax]
lea eax, [ebx*4 + 0x60012c]
xor edx, edx
call fcn.00408c30
mov dword [ebx*4 + 0x60014c], 0xffffffff
add ebx, 1
cmp ebx, 7
jle 0x4519d0
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x451a58
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.004096c0
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.00447390
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x451a58
push 4
push ebx
push esi
mov eax, 0x451860
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x451900
push eax
call sub.kernel32.dll_EnumCalendarInfoA
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00451990
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452160
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00452130
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.0040b3b0
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0044d520
jmp 0x452236
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b2d0
mov edx, dword [ebp - 4]
mov ecx, 1
mov al, 0x3d
call fcn.0040bf60
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx - 1]
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040bd00
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0044d520
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040ba60
test eax, eax
jne 0x452228
push dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x452216
mov ecx, dword [ecx - 4]
sub ecx, ebx
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.0040bd00
jmp 0x45223d
mov eax, esi
call fcn.00404950
shl eax, 1
add eax, esi
lea esi, [eax + 2]
cmp word [esi], 0
jne 0x4521c0
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00452130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret