joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a004]
jne 0x40100a
repz ret
jmp fcn.004017ef

Function at 0x405e2a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004035e9
and dword [ebp - 0x14], 0
cmp dword [0x43cc8c], 0
mov dword [ebp - 0x18], eax
jne 0x405edd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405f85
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405f85
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43cc8c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43cc90], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43cc94], eax
call edi
push eax
call esi
mov dword [0x43cc9c], eax
test eax, eax
je 0x405edd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43cc98], eax
mov eax, dword [0x43cc98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405f36
cmp dword [0x43cc9c], ecx
je 0x405f36
push eax
call esi
push dword [0x43cc9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405f36
test ebx, ebx
je 0x405f36
call edi
test eax, eax
je 0x405f2d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405f2d
test byte [ebp - 8], 1
jne 0x405f36
or dword [ebp + 0x10], 0x200000
jmp 0x405f69
mov eax, dword [0x43cc90]
cmp eax, dword [ebp - 0x18]
je 0x405f69
push eax
call esi
test eax, eax
je 0x405f69
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405f69
mov eax, dword [0x43cc94]
cmp eax, dword [ebp - 0x18]
je 0x405f69
push eax
call esi
test eax, eax
je 0x405f69
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43cc8c]
call esi
test eax, eax
je 0x405f85
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405f87
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x40f090
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5d9470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5d946c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5d9470], edx
cmp eax, 0x26f
jl 0x40f098
mov dword [0x563fb0], 0x270
ret

Function at 0x40f0d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5d9474]
mov ebx, dword [eax*4 + 0x5d9470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d9aa4]
mov dword [eax*4 + 0x5d9470], edx
cmp eax, 0xe2
jl 0x40f0d8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5d9474]
mov ebx, dword [eax*4 + 0x5d9470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d90e4]
mov dword [eax*4 + 0x5d9470], edx
cmp eax, 0x26e
jl 0x40f128
mov edx, dword [0x5d9470]
mov ecx, dword [0x5d9e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5d9aa0]
mov dword [0x5d9e2c], eax
mov dword [0x563fb0], 0
pop ebx
ret

Function at 0x40f1b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x563fb0]
add dword [0x563fb0], 1
mov eax, dword [0x5d8020]
cmp eax, dword [0x563700]
jne 0x40f1d3
cmp ebx, 0x271
jb 0x40f1f4
mov eax, dword [0x5d8020]
call fcn.0040f090
not dword [0x5d8020]
mov eax, dword [0x5d8020]
mov dword [0x563700], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40f210
call fcn.0040f0d0
xor ebx, ebx
mov dword [0x563fb0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5d9470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410d60
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x563440]
cmp ax, 0xcb
je 0x410e6c
cmp ax, 0xcc
je 0x410e6c
lea esi, [esi]
mov edx, dword [0x5da070]
test edx, edx
je 0x410d95
mov eax, dword [0x5d9f20]
call edx
mov ebx, eax
jmp 0x410d9a
mov ebx, 0x5d9f24
cmp word [0x5d9f10], 0
jle 0x410dc0
mov eax, 0x5d9ef0
call fcn.00410fd0
mov eax, ebx
call fcn.00410920
mov eax, ebx
call fcn.00410990
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410de2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410ddd
mov edx, edi
mov eax, ebx
call fcn.0040fd90
jmp 0x410de0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410dc8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5d9f10], 0
jle 0x410e6c
mov edx, 0x5d9e30
mov eax, ebx
call fcn.0040fed0
mov edi, eax
test edi, edi
je 0x410e3c
mov eax, dword [0x5d9ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5d9ec4], 0
je 0x410e30
mov eax, dword [0x5d9ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5d9ec4], eax
nop
sub word [0x5d9f10], 1
cmp word [0x5d9f10], 0
sete bl
mov eax, 0x5d9ef0
call fcn.00410ff0
test bl, bl
je 0x410e6c
mov eax, 0x5d9ef0
call fcn.00410fc0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x413500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.004134e0
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x41362a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b910
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x41358f
mov edx, 0x5d92f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x4135e1
call sub.kernel32.dll_GetLastError
call fcn.004040e0
lea eax, [ebp - 0x10]
call fcn.0040a1f0
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a7a0
mov edx, dword [ebp - 0x14]
mov ecx, 0x57f314
lea eax, [ebp - 0x10]
call fcn.0040a520
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b1e0
jmp 0x413678
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x4135fa
cmp eax, ecx
je 0x413604
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b910
cmp byte [0x5636c0], 0
jne 0x413678
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040beb0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b270
lea esi, [esi]
jmp 0x413678
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b910
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41364e
mov eax, 0x5d92f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5636c0], 0
jne 0x413678
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040beb0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b270
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004134e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413a90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5d9260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413c70
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5d9260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403650
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5634c0], eax
mov ebx, eax
jmp 0x413c33
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413b18
cmp byte [ebx], 0
je 0x413c3c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413b93
mov al, byte [ebx]
cmp al, 1
jb 0x413b88
sub al, 0x20
jbe 0x413b58
sub al, 2
je 0x413b6c
jmp 0x413b88
mov al, byte [ebp - 0x114]
test al, al
je 0x413b98
add dword [ebp - 0x110], 1
jmp 0x413b90
cmp byte [ebx + 1], 0x22
je 0x413b83
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413b90
add ebx, 1
jmp 0x413b90
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413b48
test dword [ebp - 0x10c], 0xffffffff
je 0x413c2c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413c70
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5d9260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413c23
mov al, byte [ebx]
cmp al, 1
jb 0x413c18
sub al, 0x20
jbe 0x413be8
sub al, 2
je 0x413bfc
jmp 0x413c18
mov al, byte [ebp - 0x114]
test al, al
je 0x413c28
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413c20
cmp byte [ebx + 1], 0x22
je 0x413c13
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413c20
add ebx, 1
jmp 0x413c20
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413bd8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413b1b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5d9250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5d9260
call fcn.00410ba0
mov eax, dword [0x5d9260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427a30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x427ada
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x427af6
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x427af6
sub dx, 0x20
je 0x427ad0
sub dx, 0x80
je 0x427ad0
sub dx, 0x1f62
jb 0x427af6
sub dx, 1
jbe 0x427ad0
sub dx, 6
je 0x427ad0
sub dx, 0x26
jne 0x427af6
nop
jmp 0x427ad0
cmp eax, dword [ebp - 0x20]
jg 0x427a78
lea esi, [esi]
jmp 0x427af6
cmp dword [ebp - 0x1c], 2
jne 0x427aea
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x427af6
mov al, byte [ebp - 0xc]
call fcn.0040b570
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x427b74
sub ax, 0x21
je 0x427b88
sub ax, 0x17
je 0x427b94
sub ax, 0x222
je 0x427ba0
sub ax, 0x392
je 0x427ba8
sub ax, 1
je 0x427bb0
sub ax, 0x1996
je 0x427bb8
sub ax, 1
je 0x427bc0
sub ax, 6
je 0x427bc8
sub ax, 0xb
je 0x427bd8
sub ax, 0x1b
je 0x427bd0
sub ax, 0x367
je 0x427be0
jmp 0x427be8
mov ax, word [ebp - 0x24]
call fcn.0040b610
mov byte [ebp - 0x10], al
jmp 0x427bf0
mov byte [ebp - 0x10], 0x20
jmp 0x427bf0
mov byte [ebp - 0x10], 0x2e
jmp 0x427bf0
mov byte [ebp - 0x10], 0x27
jmp 0x427bf0
mov byte [ebp - 0x10], 0x2c
jmp 0x427bf0
mov byte [ebp - 0x10], 0x27
jmp 0x427bf0
mov byte [ebp - 0x10], 0x20
jmp 0x427bf0
mov byte [ebp - 0x10], 0x20
jmp 0x427bf0
mov byte [ebp - 0x10], 0x20
jmp 0x427bf0
mov byte [ebp - 0x10], 0x20
jmp 0x427bf0
mov byte [ebp - 0x10], 0x2d
jmp 0x427bf0
mov byte [ebp - 0x10], 0x27
jmp 0x427bf0
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x434980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00434970
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x434a90
mov al, byte [ebp - 0x110]
test al, al
je 0x434a59
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e30
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092a0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a070
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x585de0
call fcn.0044e1c0
mov edx, 0x4349ea
mov ecx, ebp
call fcn.004147c0
jmp 0x434a90
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x585de0
call fcn.0044e1c0
mov edx, 0x434a59
mov ecx, ebp
call fcn.004147c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x434b54
mov al, byte [ebp - 0x110]
test al, al
je 0x434b1d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404e30
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004092a0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a070
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x585de0
call fcn.0044e1c0
mov edx, 0x434aae
mov ecx, ebp
call fcn.004147c0
jmp 0x434b54
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x585de0
call fcn.0044e1c0
mov edx, 0x434b1d
mov ecx, ebp
call fcn.004147c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00434310
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00434970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x437c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x586a6c
call fcn.0040d140
test al, al
je 0x437cf6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00437d10
xor eax, eax
push fcn.00437c00
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408a20
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.00436e20
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.00436970
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00437c00
jmp 0x437d01
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043a1a0
mov esp, ebp
pop ebp
ret
Function at 0x444150
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.00444140
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408a20
lea eax, [ebp - 0xc10]
call fcn.00403b70
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4441b0
mov eax, 0x5d92f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x44425a
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040fbd0
xor eax, eax
push fcn.00444130
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x44420c
mov eax, 0x5d92f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x444248
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x58b58c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x444248
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00444130
jmp 0x4442b8
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x44427c
mov eax, 0x5d92f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4442b8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x58b58c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4442b8
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00444140
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x44f770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x58c510
lea eax, [ebp - 0x268]
call fcn.0040e980
xor eax, eax
push fcn.0044f750
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x44f7b3
mov eax, 0x5d92f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x44f7fb
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x44f7cf
clc
jmp 0x44f7d6
bt dword [0x58bae0], eax
jb 0x44f7ef
mov eax, ebp
call fcn.0044f8a0
test al, al
je 0x44f7ef
mov byte [ebp - 0x26c], 1
jmp 0x44f880
mov byte [ebp - 0x26c], 0
jmp 0x44f880
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x564e40]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x44f880
and esi, 0x400
je 0x44f880
lea ebx, [ebp - 0x268]
mov edx, 0x58c510
mov eax, ebx
call fcn.0040ea40
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.0044f410
test eax, eax
je 0x44f854
sub eax, 1
je 0x44f86c
jmp 0x44f878
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.0044f770
mov byte [ebp - 0x26c], al
jmp 0x44f880
mov byte [ebp - 0x26c], 1
jmp 0x44f880
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044f750
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44fbe0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x44fbec
mov eax, 0x5d92f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x44fcb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.0044fca0
push ebp
push 0x414900
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x44fd20
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0040b910
cmp ebx, 1
jle 0x44fd10
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0040b0c0
jmp 0x44fd2b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00408a20
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0044fca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4