joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4704da
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x470b10
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x47052b
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x28], eax
lea esi, [ebp - 0x4c]
mov ecx, esi
push 0x677bc8
call fcn.00406642
mov dword [ebp - 0x10], 0
mov ecx, 0x7c5b18
push 2
push esi
call fcn.0044527c
mov ebx, eax
lea esi, [ebp - 0x4c]
mov ecx, esi
call fcn.0043fda0
test bl, bl
je 0x470516
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x470516
mov eax, dword [ebp - 0x28]
mov dword [0x7c5b1c], eax
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push str.GetConsoleCommandHistory
call fcn.00401278
mov dword [ebp - 0x10], 1
mov ecx, 0x7c5b18
push esi
call fcn.004707f0
mov dword [0x7c5b34], eax
lea esi, [ebp - 0x4c]
mov ecx, esi
call fcn.0043fda0
cmp dword [0x7c5b34], 0
je 0x470516
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push str.GetConsoleCommandHistoryLength
call fcn.00401278
mov dword [ebp - 0x10], 2
mov ecx, 0x7c5b18
push esi
call fcn.004707f0
mov dword [0x7c5b38], eax
lea esi, [ebp - 0x4c]
mov ecx, esi
call fcn.0043fda0
cmp dword [0x7c5b38], 0
je 0x470516
mov dword [ebp - 0x10], 0xffffffff
mov ecx, 0x7c5b20
call fcn.00470802
mov dword [0x7c5b24], eax
mov ecx, 0x7c5b20
call fcn.004420be
test eax, eax
je 0x470516
push esi
push dword [0x7c5b1c]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x4706f1
movzx ecx, word [ebp - 0x46]
lea ebx, [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov edi, ecx
mov word [ebp - 0x24], 0
mov word [ebp - 0x22], cx
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push ecx
push eax
push 4
push ebx
push dword [0x7c5b1c]
call esi
test eax, eax
je 0x4706f1
push 4
push ebx
push 0x67185e
call fcn.0047083c
add esp, 0xc
lea ecx, [edi - 1]
test eax, eax
jne 0x470641
movsx eax, word [ebp - 0x46]
movsx ecx, di
sub eax, ecx
mov dword [0x7c5b30], eax
movsx ecx, word [ebp - 0x3a]
imul ecx, eax
movsx eax, word [ebp - 0x48]
mov bl, 1
add eax, ecx
mov dword [0x7c5b2c], eax
jle 0x470518
mov dword [ebp - 0x10], 0xffffffff
mov ecx, 0x7c5b28
push eax
call fcn.0044820c
mov word [ebp - 0x20], 0
mov word [ebp - 0x1e], di
mov esi, dword [0x7c5b2c]
mov ecx, 0x7c5b28
call fcn.0044210a
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x2c]
push edx
push ecx
push esi
push eax
push dword [0x7c5b1c]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
jne 0x470518
call fcn.00401cb0
jmp 0x470516
Function at 0x47703d
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, edx
push ecx
call fcn.004a6f02
add esp, 4
mov dword [0x7c3860], esi
mov ecx, 0x7c5cdc
pop esi
jmp 0x47707c
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esi + 4], eax
pop esi
ret

Function at 0x481296
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x84
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x4868e0
mov eax, dword fs:[0]
mov dword [edx], eax
mov dword fs:[0], edx
and byte [ecx + 0x144], 0xfe
call fcn.0047f2cb
movzx edi, al
lea ebx, [edi*4]
call fcn.0047f2c0
lea edi, [edi*4 + 8]
test al, al
cmove edi, ebx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
shr esi, 0xf
lea ebx, [edi + esi]
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
lea esi, [edi + esi + 0x10]
cmovns esi, ebx
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
lea edi, [esi + 2]
test ax, ax
cmovns edi, esi
lea eax, [ebp - 0x28]
push eax
call fcn.0047bebd
add esp, 4
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.00401abc
lea ebx, [ebp - 0x38]
push eax
push ebx
call fcn.00474c54
add esp, 8
mov eax, dword [ebx]
lea ecx, [ebp - 0x28]
sub dword [ecx], eax
mov eax, dword [ebx + 4]
sub dword [ecx + 4], eax
mov ecx, 0x7c5630
call fcn.00401ac4
lea ebx, [ebp - 0x90]
mov ecx, ebx
push dword [eax]
call fcn.0045e588
lea ecx, [ebp - 0x28]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
lea ecx, [ebp - 0x18]
mov dword [ecx + 8], 0
mov ecx, esi
push edi
push edx
push eax
push ebx
call fcn.00484c4c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x90]
push eax
call fcn.0046a336
lea ecx, [ebp - 0x90]
call fcn.0044075a
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x84
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48199e
Capabilities:
Log keystrokes

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
movzx edx, word [esp + 0x10]
movzx edi, dx
mov eax, 0xfffffd98
cmp dword [eax + 0x622cc8], edi
je 0x481a1d
add eax, 8
jne 0x4819b6
movsx eax, dx
cmp eax, 0xb9
jle 0x481a3e
lea eax, [edx - 0xba]
cmp ax, 7
jb 0x4819f7
lea eax, [edx - 0xdb]
cmp ax, 7
ja case.0x481a4a.8
mov ecx, 0x9f
bt ecx, eax
jae case.0x481a4a.8
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ecx, ecx
test eax, eax
cmovs eax, ecx
test esi, esi
je 0x481a0e
mov word [esi], ax
cmp eax, 0xff
cmovle ecx, eax
mov eax, ecx
jmp 0x481aec
mov eax, dword [eax + 0x622ccc]
test esi, esi
je 0x481aec
cmp eax, 0x12b
jg 0x481aec
mov word [esi], ax
jmp 0x481aec
lea eax, [edx - 0x21]
cmp ax, 0xd
ja case.default.0x481a4a
movzx eax, ax
jmp dword [eax*4 + 0x62329c]
mov edx, 0x17c
push 0x16e
jmp 0x481ae4
cmp dx, 0xd
jne case.0x481a4a.8
bt ecx, 0x18
mov ecx, 0xd
mov eax, 0x172
cmovae eax, ecx
test esi, esi
je 0x481aec
mov word [esi], 0xd
jmp 0x481aec
mov edx, 0x17d
push 0x16f
jmp 0x481ae4
mov edx, 0x17e
push 0x138
jmp 0x481ae4
mov edx, 0x177
push 0x139
jmp 0x481ae4
mov edx, 0x178
push 0x13a
jmp 0x481ae4
mov edx, 0x179
push 0x13b
jmp 0x481ae4
mov edx, 0x17a
push 0x13c
jmp 0x481ae4
mov edx, 0x17b
push 0x13d
jmp 0x481ae4
mov edx, 0x180
push 0x142
call fcn.004851a4
add esp, 4
pop esi
pop edi
pop ebx
ret
mov edx, 0x181
push 0x7f
call fcn.004851a4
add esp, 4
test esi, esi
je 0x481aec
mov word [esi], 0x7f
jmp 0x481aec
lea ecx, [edx - 0x30]
lea ebx, [edx - 0x41]
xor eax, eax
cmp bx, 0x1a
cmovb eax, edi
cmp cx, 0xa
cmovb eax, edi
test esi, esi
je 0x481aec
mov word [esi], dx
jmp 0x481aec

Function at 0x4851b5
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push esi
mov eax, 0xfffffd98
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
cmp dword [eax + 0x622ccc], edi
je 0x4851f0
add eax, 8
jne 0x4851c4
lea edx, [edi - 0x16e]
cmp edx, 0x13
ja case.default.0x4851e2
mov ax, 0x21
xor ecx, ecx
jmp dword [edx*4 + 0x62336c]
mov cl, 1
jmp case.0x4851e2.380
test esi, esi
je 0x4851f7
mov byte [esi], 0
movzx eax, word [eax + 0x622cc8]
jmp 0x48527d
lea eax, [edi - 0x138]
cmp eax, 0xa
ja case.default.0x48520b
jmp dword [eax*4 + 0x623340]
mov cl, 1
mov ax, 0x23
jmp case.0x4851e2.380
cmp edi, 0x7f
jne case.0x48520b.318
mov cl, 1
mov ax, 0x2e
jmp case.0x4851e2.380
movzx eax, di
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov ecx, 0xff
and eax, ecx
cmp eax, ecx
cmove eax, edi
xor ecx, ecx
jmp case.0x4851e2.380
mov cl, 1
mov ax, 0x22
jmp case.0x4851e2.380
mov cl, 1
mov ax, 0x24
jmp case.0x4851e2.380
mov cl, 1
mov ax, 0x25
jmp case.0x4851e2.380
mov cl, 1
mov ax, 0x26
jmp case.0x4851e2.380
mov cl, 1
mov ax, 0x27
jmp case.0x4851e2.380
mov cl, 1
mov ax, 0x28
jmp case.0x4851e2.380
mov cl, 1
mov ax, 0x2d
test esi, esi
je 0x48527d
mov byte [esi], cl
pop esi
pop edi
ret
Function at 0x485280
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push esi
call fcn.004851b5
add esp, 8
lea ecx, [esi - 0x16c]
cmp ecx, 2
jb 0x4852a3
cmp esi, 0x137
jne 0x4852b5
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
pop esi
ret
movzx ecx, ax
pop esi
jmp fcn.004852be

Function at 0x4852be
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, ecx
dec eax
cmp ax, 1
ja 0x4852e2
xor ebx, ebx
cmp si, 1
sete bl
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
inc ebx
test eax, eax
cmovne esi, ebx
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
shr eax, 0xf
pop esi
pop ebx
ret

Function at 0x4855fa
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp byte [esp + 4], 0
je 0x485621
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x485488
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x7c62b0], eax
test eax, eax
je 0x485632
ret
mov eax, dword [0x7c62b0]
test eax, eax
je 0x485620
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
ret
jmp fcn.00401cb0
Function at 0x496dec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x497520
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.00445ec4
mov dword [edi], 0x614dac
mov dword [ebp - 0x20], edi
lea ecx, [edi + 0xc]
mov dword [esi + 8], 0
mov dword [ebp - 0x28], ecx
call fcn.0043fd32
mov esi, dword [ebp - 0x20]
lea ecx, [esi + 0x2c]
call fcn.00444498
lea ecx, [esi + 0x30]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], ecx
push 0
call fcn.004523c8
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
lea ecx, [esi + 0x38]
call fcn.00444498
mov dword [ebp - 0x10], 2
mov ecx, esi
push dword [ebp + 0x10]
push edi
push ebx
call fcn.00496ed0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x49b7bc
Capabilities:
Get session user name
Query environment variable

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 4], eax
mov eax, esp
mov dword [eax], edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x49b7f6
push edi
push esi
push str.username
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x49b80c
mov bl, 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.005db451
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
ret
xor ebx, ebx
jmp 0x49b7f8

Function at 0x49ba90
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.00443c3a
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test ebp, ebp
je 0x49bae6
test esi, esi
je 0x49bae6
mov ebx, esp
mov ecx, ebx
push esi
push ebp
call fcn.0044a5d6
mov ecx, ebx
call fcn.0044a5dc
mov ebp, eax
mov ecx, edi
call fcn.00443c3a
push esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, ebx
call fcn.0044a5e4
test esi, esi
setne al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49baf3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x49ca40
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor eax, eax
test ebx, ebx
je 0x49bc9f
cmp dword [ebp + 0xc], 0
je 0x49bc9f
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
call fcn.00443c3a
push edi
push eax
push esi
call fcn.0049bd27
add esp, 0xc
test eax, eax
je 0x49bc9d
mov edi, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49bb8d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx], eax
test eax, eax
je 0x49bbfa
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov al, 1
jmp 0x49bc9f
mov dword [ebp - 0x28], esp
push eax
sub esp, 0x20
mov eax, esp
mov dword [ebp - 0x24], eax
lea ecx, [eax + 4]
mov dword [ebp - 0x20], ecx
push dword [ebp + 0x10]
call fcn.004028e6
lea ecx, [ebp - 0x88]
call fcn.0043fd32
lea ecx, [ebp - 0x68]
call fcn.0043fd32
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x48]
push str.Failed_to_load_resource___s_.
call fcn.00401278
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0x9c]
push eax
call fcn.00447d20
jmp 0x49bc65
mov dword [ebp - 0x28], esp
push eax
sub esp, 0x20
mov eax, esp
mov dword [ebp - 0x24], eax
lea ecx, [eax + 4]
mov dword [ebp - 0x20], ecx
push dword [ebp + 0x10]
call fcn.004028e6
lea ecx, [ebp - 0x88]
call fcn.0043fd32
lea ecx, [ebp - 0x68]
call fcn.0043fd32
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x48]
push str.Failed_to_lock_resource___s_.
call fcn.00401278
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0x9c]
push eax
call fcn.00447d20
mov eax, dword [ebp - 0x24]
lea esi, [ebp - 0x9c]
mov dword [eax], esi
call fcn.00447d16
add esp, 0x24
mov esp, dword [ebp - 0x28]
mov ecx, esi
call fcn.00440f8a
lea ecx, [ebp - 0x48]
call fcn.0043fda0
lea ecx, [ebp - 0x68]
call fcn.0043fda0
lea ecx, [ebp - 0x88]
call fcn.0043fda0
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49c610
Capabilities:
Get system information on windows

Disassembly:
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x34]
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0x24], eax
mov edi, esp
push edi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [edi]
lea ecx, [eax - 5]
cmp cx, 7
ja case.default.0x49c63b
movzx eax, cx
jmp dword [eax*4 + 0x625ed0]
mov ecx, esi
push 0x666c8a
jmp 0x49c67b
test ax, ax
jne case.0x49c63b.2
mov ecx, esi
push 0x669785
jmp 0x49c67b
mov ecx, esi
call fcn.0043fd32
jmp 0x49c680
mov ecx, esi
push str.Itanium
jmp 0x49c67b
mov ecx, esi
push 0x669d8b
jmp 0x49c67b
mov ecx, esi
push str.ARM64
call fcn.00401278
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005db451
mov eax, esi
add esp, 0x28
pop esi
pop edi
ret
Function at 0x4a0560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x98
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4a1210
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x4a06d9
mov ecx, edi
call fcn.004454c4
test al, al
je 0x4a06d9
mov ecx, edi
call fcn.004a0794
test edx, edx
js 0x4a06d9
mov ecx, edi
call fcn.004a0794
mov ebx, eax
mov ecx, edi
call fcn.004a0794
xor eax, ebx
or eax, edx
jne 0x4a06d9
push dword [edi]
call fcn.005fcd2e
add esp, 4
lea esi, [ebp - 0x20]
mov ecx, esi
mov dword [ebp - 0x28], ebx
push ebx
call fcn.004520ec
mov dword [ebp - 0x2c], edi
mov eax, dword [edi]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
mov ecx, esi
call fcn.0044210a
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push eax
call fcn.005fd6df
add esp, 0x10
mov esi, eax
mov edi, dword [ebp - 0x2c]
mov ecx, edi
call fcn.004a07f0
mov dword [ebp - 0x28], eax
test al, al
je 0x4a06f0
mov dword [ebp - 0x24], esp
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x30], eax
add eax, 4
add edi, 4
mov ecx, edi
mov dword [ebp - 0x2c], eax
push eax
call fcn.004415d4
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x50]
call fcn.0043fd32
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x90]
call fcn.0043fd32
mov dword [ebp - 0x10], 3
lea ecx, [ebp - 0x70]
push str.Read_error_on_file__s
call fcn.00401278
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0xa4]
push eax
call fcn.00447d20
mov eax, dword [ebp - 0x30]
lea esi, [ebp - 0xa4]
mov dword [eax], esi
call fcn.00449048
add esp, 0x10
mov esp, dword [ebp - 0x24]
mov ecx, esi
call fcn.00440f8a
lea ecx, [ebp - 0x70]
call fcn.0043fda0
lea ecx, [ebp - 0x90]
call fcn.0043fda0
lea ecx, [ebp - 0x50]
jmp 0x4a0716
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [ebp - 0x20]
push esi
call fcn.00448420
lea ecx, [ebp - 0x50]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.004a0812
mov ecx, dword [ebp + 8]
lea esi, [ebp - 0x50]
push esi
call fcn.00455ad0
mov ecx, esi
call fcn.0043fda0
mov ebx, dword [ebp - 0x28]
xor bl, 1
lea ecx, [ebp - 0x20]
call fcn.004423a8
jmp 0x4a06db
Function at 0x4a089a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x94
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4a1220
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor ecx, ecx
test edi, edi
je 0x4a09d4
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4a09d4
mov ecx, esi
call fcn.004454c4
xor ecx, ecx
test al, al
je 0x4a09d4
push dword [esi]
push ebx
push 1
push edi
call fcn.005fd6df
add esp, 0x10
mov ecx, eax
cmp eax, ebx
jae 0x4a09d4
mov dword [ebp - 0x20], ecx
mov ecx, esi
call fcn.004a07f0
test al, al
je 0x4a09d1
mov dword [ebp - 0x2c], esp
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x28], eax
add eax, 4
add esi, 4
mov ecx, esi
mov dword [ebp - 0x24], eax
push eax
call fcn.004415d4
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x8c]
call fcn.0043fd32
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x6c]
call fcn.0043fd32
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x4c]
push str.Read_error_on_file__s
call fcn.00401278
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0xa0]
push eax
call fcn.00447d20
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0xa0]
mov dword [eax], esi
call fcn.00449048
add esp, 0x10
mov esp, dword [ebp - 0x2c]
mov ecx, esi
call fcn.00440f8a
lea ecx, [ebp - 0x4c]
call fcn.0043fda0
lea ecx, [ebp - 0x6c]
call fcn.0043fda0
lea ecx, [ebp - 0x8c]
call fcn.0043fda0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4a0a3e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x94
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4a1230
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor ecx, ecx
test edi, edi
je 0x4a0b6a
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4a0b6a
mov ecx, esi
call fcn.004454c4
xor ecx, ecx
test al, al
je 0x4a0b6a
push dword [esi]
push ebx
push 1
push edi
call fcn.005fd8f2
add esp, 0x10
mov ecx, eax
cmp eax, ebx
jae 0x4a0b6a
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], esp
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x24], eax
add eax, 4
add esi, 4
mov ecx, esi
mov dword [ebp - 0x20], eax
push eax
call fcn.004415d4
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x8c]
call fcn.0043fd32
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x6c]
call fcn.0043fd32
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x4c]
push str.Write_error_on_file__s
call fcn.00401278
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0xa0]
push eax
call fcn.00447d20
mov eax, dword [ebp - 0x24]
lea esi, [ebp - 0xa0]
mov dword [eax], esi
call fcn.00449048
add esp, 0x10
mov esp, dword [ebp - 0x28]
mov ecx, esi
call fcn.00440f8a
lea ecx, [ebp - 0x4c]
call fcn.0043fda0
lea ecx, [ebp - 0x6c]
call fcn.0043fda0
lea ecx, [ebp - 0x8c]
call fcn.0043fda0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4a3b28
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
push edi
push esi
call fcn.004a3a0e
mov ecx, dword [0x7c6c5c]
call fcn.00444006
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
xor ebx, ebx
cmp edi, 0x1400
je 0x4a3b8b
test esi, esi
je 0x4a3b8b
mov ebp, edi
and ebp, 0x3ff
shr edi, 0xa
xor ebx, ebx
mov ecx, dword [0x7c6c5c]
push ebx
call fcn.00475a1c
cmp dword [eax + 0x24], ebp
jne 0x4a3b84
mov ecx, dword [0x7c6c5c]
push ebx
call fcn.00475a1c
cmp dword [eax + 0x28], edi
je 0x4a3b8b
inc ebx
cmp esi, ebx
jne 0x4a3b62
jmp 0x4a3b9f
cmp ebx, esi
jae 0x4a3b9f
mov ecx, dword [0x7c6c5c]
push ebx
call fcn.00475a1c
mov eax, dword [eax]
jmp 0x4a3ba2
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a4278
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x278
mov ebx, edx
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4a46e0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea edi, [ebp - 0x44]
mov ecx, edi
call fcn.0043fd32
mov word [ebp - 0x284], 0
cmp esi, 5
ja case.default.0x4a42cb
jmp dword [esi*4 + 0x628384]
mov ecx, esi
call fcn.004a457c
lea esi, [ebp - 0x284]
push 0x100
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je case.default.0x4a42cb
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x64]
push esi
call fcn.00406642
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x20]
call fcn.004a3cc4
add esp, 8
lea ecx, [ebp - 0x64]
call fcn.0043fda0
jmp 0x4a444f
lea esi, [ebp - 0x284]
push 0x100
push esi
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je case.default.0x4a42cb
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x44]
push esi
call fcn.0044a480
lea edi, [ebp - 0x44]
jmp case.default.0x4a42cb
xor eax, eax
cmp dword [ebp + 0xc], 2
sete al
lea eax, [eax*8 + 0xe]
lea esi, [ebp - 0x284]
push 0x100
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je case.default.0x4a42cb
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x44]
push esi
call fcn.0044a480
lea edi, [ebp - 0x44]
jmp case.default.0x4a42cb
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x64]
mov edx, ebx
push 3
push 2
mov dword [ebp - 0x24], ebx
call fcn.004a4278
mov esi, dword [ebp - 0x24]
lea edi, [ebp - 0x44]
add esp, 8
lea ecx, [ebp - 0x64]
call fcn.004400ba
test al, al
jne 0x4a4430
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x84]
mov edx, esi
push 3
push 5
call fcn.004a4278
add esp, 8
lea ecx, [ebp - 0x84]
call fcn.004400ba
test al, al
lea eax, [ebp - 0x64]
jne 0x4a4422
mov dword [ebp - 0x10], 2
lea ecx, [ebp - 0x44]
push eax
call fcn.004455e8
mov ecx, eax
push 0x20
call fcn.004a4590
mov ecx, eax
lea eax, [ebp - 0x84]
push eax
call fcn.004455e8
lea ecx, [ebp - 0x84]
call fcn.0043fda0
lea edi, [ebp - 0x44]
lea ecx, [ebp - 0x64]
call fcn.0043fda0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x20]
push edi
call fcn.004028e6
lea ecx, [ebp - 0x44]
call fcn.0043fda0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x278
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4a471c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
jmp 0x4a4725
push esi
movzx edx, word [ecx]
test dx, dx
je 0x4a4756
add ecx, 2
xor eax, eax
movzx edx, dx
add edx, eax
mov esi, edx
shl esi, 0xa
add esi, edx
mov eax, esi
shr eax, 6
xor eax, esi
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4a4733
lea eax, [eax + eax*8]
jmp 0x4a4758
xor eax, eax
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
pop esi
ret