joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4445a2
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x2c]
mov ebp, dword [ebx + 0x24]
cmp edi, 4
mov dword [esp + 0x1c], edi
lea esi, [ebx + 0xc4]
je 0x4445c4
push 5
jmp 0x4445c6
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebx + 0xc0]
push 4
neg eax
sbb eax, eax
mov dword [ebx + 0x164], edi
and eax, esi
pop esi
cmp edi, esi
mov ecx, ebx
mov eax, dword [eax]
mov dword [ebx + 0x3358], eax
jne 0x44461d
call fcn.00443ed3
add eax, esi
push 5
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.00443ed3
mov ecx, eax
add eax, esi
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [ebx + 0x3358], eax
jmp 0x44462e
call fcn.00443ed3
add eax, esi
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, esi
mov dword [esp + 0x14], 1
jne 0x44463f
and dword [esp + 0x14], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x418
push ebp
call esi
push 4
mov dword [esp + 0x1c], eax
pop ecx
cmp eax, ecx
mov dword [esp + 0x10], ecx
jle 0x4446ab
movzx eax, word [esp + 0x14]
mov dword [esp + 0x14], eax
and dword [esp + 0x20], 0
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push 0x417
push ebp
call esi
push dword [esp + 0x14]
push dword [esp + 0x28]
push 0x401
push ebp
call esi
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jl 0x444669
mov edi, dword [esp + 0x1c]
xor eax, eax
cmp edi, 3
setne al
movzx eax, ax
push eax
push 0x8585
push 0x404
push ebp
call esi
xor eax, eax
cmp edi, 4
sete al
movzx eax, ax
push eax
push 0x8113
push 0x404
push ebp
call esi
mov eax, 0xb3b6
cmp edi, 1
mov dword [esp + 0x10], eax
jne 0x4446ef
mov dword [esp + 0x10], eax
cmp edi, 2
jne 0x4446fc
mov dword [esp + 0x10], 0xb3b8
cmp edi, 3
jne 0x444709
mov dword [esp + 0x10], 0xbd80
cmp edi, 4
jne 0x444716
mov dword [esp + 0x10], 0xb3b7
push 0
mov edi, 0x403
push eax
push edi
push ebp
call esi
push 0
push 0xb3b8
push edi
push ebp
call esi
push 0
push 0xbd80
push edi
push ebp
call esi
push 0
push 0xb3b7
push edi
push ebp
call esi
push 1
push dword [esp + 0x14]
push edi
push ebp
call esi
mov ecx, ebx
call fcn.004442ea
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x444881
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x2c], 4
jne 0x4448a2
call fcn.00443ed3
mov ecx, eax
call fcn.0041cc12
jmp 0x444962
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [0x48fd14]
call edi
push 0x482ccc
lea ecx, [ebp - 8]
mov dword [esi + 0xe0], 1
call fcn.004013c8
push 0x482cc8
lea ecx, [ebp - 4]
call fcn.004013c8
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x6f0]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004015b6
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004015b6
lea ecx, [ebp - 0x10]
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0
push 0x1026
push dword [esi + 0xc4]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esi + 4]
lea eax, [ebp - 0xc]
push ecx
mov ecx, esp
push eax
call fcn.00401356
push dword [esi + 0xc4]
call fcn.004561f2
and dword [esi + 0xe0], 0
add esp, 0xc
push 9
push dword [0x48fd14]
call edi
lea ecx, [ebp - 0xc]
call fcn.0040139c
push 1
pop eax
pop edi
pop esi
leave
ret 0x10

Function at 0x4454a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xd7060
call fcn.0046aab0
push ebx
push esi
push edi
lea ecx, [ebp - 0x6b830]
call fcn.00445386
lea ecx, [ebp - 0xd7060]
call fcn.00445386
mov esi, dword [0x4930bc]
push 0x483088
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [ebp - 0xd704c]
push esi
push ebx
push eax
call fcn.0046ab30
add esp, 0xc
mov dword [ebp - 0xd7054], esi
mov dword [ebp - 0x6b824], 0x6b800
push dword [0x482ce4]
call fcn.004377a9
push 0
lea eax, [ebp - 0xd7060]
push dword [0x482ce0]
push eax
lea eax, [ebp - 0x6b830]
push eax
call fcn.00438daa
call fcn.0043778c
mov eax, dword [ebp - 0x6b830]
push 0
lea ecx, [ebp - 0x6b830]
call dword [eax + 4]
push dword [ebp + 8]
lea ecx, [ebp - 0x6b830]
call fcn.00445472
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
call fcn.0040173c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x6b848]
call fcn.0040139c
lea ecx, [ebp - 0x6b84c]
call fcn.0040139c
lea ecx, [ebp - 0x18]
call fcn.0040139c
lea ecx, [ebp - 0x1c]
call fcn.0040139c
lea ecx, [ebp + 0xc]
call fcn.0040139c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445c97
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [0x491c10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov eax, dword [0x47e520]
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0x47f820
push eax
call fcn.004017cc
push dword [ebp - 4]
lea eax, [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00445d42
push dword [ebp - 8]
call fcn.0046af6b
add esp, 0x20
cmp dword [ebp + 0x18], 0xffffffff
mov esi, eax
je 0x445d06
cmp dword [ebp + 0x14], 0xffffffff
je 0x445d06
cmp esi, dword [ebp + 0x18]
jle 0x445cfe
mov esi, dword [ebp + 0x18]
cmp esi, dword [ebp + 0x14]
jge 0x445d06
mov esi, dword [ebp + 0x14]
lea ecx, [ebp - 8]
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
mov eax, esi
pop esi
leave
ret

Function at 0x445db6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x491c20], esi
jne 0x445e65
lea eax, [ebp - 0xc]
push edi
push eax
mov dword [ebp - 8], esi
call fcn.00446299
mov eax, dword [eax]
push 0x20019
push eax
push SHChangeNotifyDeregister
lea ecx, [ebp - 8]
call fcn.00403829
lea ecx, [ebp - 0xc]
call fcn.0040139c
mov ecx, dword [0x47e520]
mov edi, dword [ebp + 8]
mov eax, 0x400
mov dword [ebp - 4], ecx
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
call fcn.004016d4
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], esi
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
mov edi, eax
call fcn.0040173c
mov eax, dword [ebp - 4]
cmp dword [eax - 8], esi
je 0x445e49
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00401522
lea ecx, [ebp - 4]
call fcn.0040139c
cmp dword [ebp - 8], esi
je 0x445e62
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], esi
mov esi, edi
pop edi
lea ecx, [ebp + 8]
call fcn.0040139c
mov eax, esi
pop esi
leave
ret 8
Function at 0x445e74
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x491c20], esi
jne 0x445ef7
push ebx
lea eax, [ebp - 8]
push edi
push eax
xor ebx, ebx
call fcn.00446299
lea ecx, [ebp - 0xc]
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 4]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push SHChangeNotifyDeregister
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x445ebb
mov ebx, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0040139c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp ebx, esi
mov edi, eax
je 0x445ef3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
pop edi
pop ebx
lea ecx, [ebp + 8]
call fcn.0040139c
lea ecx, [ebp + 0xc]
call fcn.0040139c
mov eax, esi
pop esi
leave
ret 8

Function at 0x4461ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x47e520]
push ebx
push esi
push edi
push 0x20004
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.004016d4
push dword [ebp + 0x10]
mov edi, eax
mov eax, dword [0x47e520]
push 0x10000
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov esi, eax
mov eax, dword [0x47e520]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
lea eax, [esi + esi + 4]
push eax
call fcn.004016d4
test esi, esi
mov ebx, eax
jle 0x44625d
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 0x47ea4c
mov ecx, dword [ebp - 8]
mov cx, word [ecx]
test cx, cx
je 0x446226
mov word [eax], cx
inc eax
inc eax
jmp 0x446254
and word [eax], 0
test ebx, ebx
jne 0x446232
xor eax, eax
jmp 0x446235
push ebx
call esi
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.00401658
mov eax, edi
test eax, eax
je 0x446248
push edi
call esi
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00401658
mov eax, ebx
add dword [ebp - 8], 2
dec dword [ebp - 0xc]
jne 0x446214
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00401356
lea ecx, [ebp - 0x10]
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp - 0x14]
call fcn.0040139c
lea ecx, [ebp + 0xc]
call fcn.0040139c
lea ecx, [ebp + 0x10]
call fcn.0040139c
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x449b95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x47e520]
and byte [ebp - 7], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 4]
mov byte [ebp - 0x1c], 0x68
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x3a
mov byte [ebp - 0x17], 0x2f
mov byte [ebp - 0x16], 0x2f
mov byte [ebp - 0x15], 0x77
mov byte [ebp - 0x14], 0x77
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x2f
call fcn.00401572
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00401356
lea ecx, [ebp - 4]
call fcn.0040139c
mov eax, dword [ebp + 8]
leave
ret

Function at 0x44ad7d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push 0
push eax
call fcn.0044a4e0
pop ecx
lea eax, [ebp + 8]
pop ecx
push eax
lea eax, [ebp - 8]
push str._help
push eax
call fcn.004085b5
mov eax, dword [eax]
push 3
push 0
push eax
push dword [ebp - 4]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 8]
call fcn.0040139c
lea ecx, [ebp - 4]
call fcn.0040139c
lea ecx, [ebp + 8]
call fcn.0040139c
leave
ret

Function at 0x44b011
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44b03e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x44b03a
call esi
cmp eax, 3
je 0x44b03a
or esi, 0xffffffff
jmp 0x44b049
xor esi, esi
jmp 0x44b049
test al, 0x10
je 0x44b046
push 2
jmp 0x44b048
push 1
pop esi
lea ecx, [esp + 8]
call fcn.0040139c
mov eax, esi
pop esi
ret
Function at 0x44d39b
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
movzx ebx, word [ebp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov esi, ecx
push ebx
push 0x403
push dword [esi + 0x238]
call edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0
push ebx
push 0x419
mov dword [ebp - 4], eax
push dword [esi + 0x238]
call edi
lea ecx, [ebp - 0x20]
push ecx
push eax
push 0x41d
push dword [esi + 0x238]
call edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x238]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 8]
push 0x3ff
push eax
call fcn.0044bfce
pop ecx
mov ebx, 0x3e8
pop ecx
push dword [eax]
push ebx
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [ebp - 8]
call fcn.0040139c
mov eax, dword [esi + 0x1d4]
neg eax
sbb eax, eax
and eax, 8
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor ebx, ebx
push ebx
push dword [esi + 4]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x102
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
test eax, eax
je 0x44d4a9
xor eax, eax
cmp dword [esi + 0x1d4], ebx
mov ecx, esi
sete al
mov dword [esi + 0x1d4], eax
call fcn.0044d13c
push ebx
push dword [esi + 0x1d4]
push 0x4837c4
push str.Search
call fcn.00445c56
mov ecx, dword [esi + 0x18c]
add esp, 0x10
cmp ecx, ebx
je 0x44d4a9
call fcn.004442ea
movzx eax, word [ebp + 0xc]
push ebx
push eax
push 0x403
push dword [esi + 0x238]
call edi
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x44d4cd
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
leave
ret 0x10
Function at 0x44d4d3
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, 0x400
mov dword [eax], 1
lea ebp, [esi + 0x22c]
push edi
mov ecx, ebp
call fcn.004016d4
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
push eax
push dword [esi + 0x268]
call ebx
lea ecx, [esi + 0x230]
push edi
call fcn.004016d4
push edi
push eax
push dword [esi + 0x26c]
call ebx
lea ecx, [esi + 0x234]
push edi
call fcn.004016d4
push edi
push eax
push dword [esi + 0x270]
call ebx
push 0xffffffffffffffff
lea ecx, [esi + 0x234]
call fcn.0040173c
lea ebx, [esi + 0x230]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.0040173c
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0040173c
push ecx
mov ecx, esp
push ebp
call fcn.00401356
push ecx
mov ecx, esp
push str.include
call fcn.004013c8
push ecx
mov edi, str.FindFile
mov ecx, esp
push edi
call fcn.004013c8
call fcn.0042dcb7
pop ecx
pop ecx
mov ecx, esp
push ebx
call fcn.00401356
push ecx
mov ecx, esp
push str.exclude
call fcn.004013c8
push ecx
mov ecx, esp
push edi
call fcn.004013c8
call fcn.0042dcb7
pop ecx
lea eax, [esi + 0x234]
pop ecx
mov ecx, esp
push eax
call fcn.00401356
push ecx
mov ecx, esp
push str.exclude_folder
call fcn.004013c8
push ecx
mov ecx, esp
push edi
call fcn.004013c8
call fcn.0042dcb7
mov ecx, dword [esi + 0x188]
add esp, 0xc
test ecx, ecx
je 0x44d5e3
push ebp
call fcn.0044d627
mov ecx, dword [esi + 0x220]
test ecx, ecx
je 0x44d5f3
push ebx
call fcn.0044d627
mov ecx, dword [esi + 0x224]
test ecx, ecx
je 0x44d609
lea eax, [esi + 0x234]
push eax
call fcn.0044d627
mov ecx, dword [esi + 0x228]
test ecx, ecx
je 0x44d61e
push dword [ecx + 0x3258]
call fcn.0043b423
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x450266
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0xb0
push ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp dword [ebp - 8], eax
mov dword [ebp + 8], eax
jne 0x4502f5
cmp dword [ebp - 4], edi
jne 0x4502f5
mov eax, dword [0x488b6c]
mov ecx, 0x1ff
mov dword [ebp - 0x808], eax
xor eax, eax
lea edi, [ebp - 0x804]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x808]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push 0x2e
push eax
call fcn.0046bb02
pop ecx
test eax, eax
pop ecx
je 0x450359
lea ecx, [ebp - 0x808]
sub eax, ecx
sar eax, 1
push eax
jmp 0x45034f
mov eax, dword [0x488b6c]
mov ecx, 0x1ff
mov dword [ebp - 0x808], eax
xor eax, eax
lea edi, [ebp - 0x804]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x808]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push 0x2e
push eax
call fcn.0046bb02
cmp dword [ebp - 4], 0
pop ecx
pop ecx
jne 0x45034d
test eax, eax
je 0x450359
push dword [ebp + 8]
lea ecx, [ebp - 0x808]
sub eax, ecx
sar eax, 1
inc eax
push eax
jmp 0x450351
push 0xffffffffffffffff
push 0
push 0xb1
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4505a7
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
lea ecx, [ebp - 4]
push dword [ebp + 0xc]
call fcn.0040811c
push 0x18
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0046aa50
mov eax, dword [0x47e618]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x47ee8c]
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov esi, 0x400
stosd dword es:[edi], eax
push 0x13
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
pop ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
push 0xe
push esi
call edi
cmp dword [ebp + 0x14], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0x488b6c
je 0x450628
lea eax, [ebp - 0x40]
push ebx
push eax
push 0xf
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x18]
push ebx
push eax
push 0x12
push esi
call edi
lea eax, [ebp - 0x18]
push eax
call fcn.0046af6b
pop ecx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x18]
push ebx
push eax
push 0x10
push esi
call edi
lea eax, [ebp - 0x18]
push eax
call fcn.0046af6b
pop ecx
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x18]
push ebx
push eax
push 0x1010
push esi
call edi
lea eax, [ebp - 0x18]
push eax
call fcn.0046af6b
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, 0xffffffff
mov dword [ebp - 0x44], eax
jne 0x4506ae
lea eax, [ebp - 0x2c]
lea ecx, [ebp + 0x14]
push eax
call fcn.0040811c
xor edi, edi
lea eax, [ebp - 0x2c]
push edi
push eax
lea ecx, [ebp - 4]
call fcn.0040179a
cmp eax, 0xffffffff
je 0x4506a6
mov ecx, dword [ebp - 4]
mov edi, dword [ecx - 8]
mov ecx, dword [ebp + 0x14]
sub edi, dword [ecx - 8]
sub edi, eax
lea ecx, [ebp + 0x14]
call fcn.0040139c
push dword [ebp + 0xc]
mov dword [ebp - 0x58], edi
call fcn.0046b7a1
lea edi, [eax + eax*2 + 0x64]
lea eax, [edi + edi]
push eax
call fcn.0046af94
pop ecx
dec edi
pop ecx
mov ebx, eax
push edi
lea eax, [ebp - 0x58]
push ebx
push eax
push dword [ebp + 0xc]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
je 0x4506fa
test ebx, ebx
jne 0x4506e9
xor eax, eax
jmp 0x4506f0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push eax
lea ecx, [ebp - 4]
call fcn.0040148d
test ebx, ebx
je 0x450705
push ebx
call fcn.0046aa36
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00401356
lea ecx, [ebp - 4]
call fcn.0040139c
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x455469
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 0x100
xor edi, edi
lea ebx, [ecx + 0x16]
push esi
push edi
push ebx
call fcn.0046aa50
add esp, 0xc
cmp dword [ebp + 8], edi
je 0x4554c0
push edi
push edi
push 3
push edi
push edi
push SHChangeNotifyDeregister
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4554c0
lea ecx, [ebp + 8]
push edi
push ecx
push esi
push ebx
push eax
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x456574
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0xaffe
push dword [esi + 4]
mov dword [esi], 0x479b08
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret

Function at 0x45679d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x492fb0]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [edx + 0x20], esi
lea edx, [ebp - 4]
push edx
push eax
push ecx
push 0x456780
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x492fb0]
pop esi
mov dword [ecx + 4], eax
leave
ret 4

Function at 0x4567e4
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0xaffe
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret
Function at 0x458054
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x488b98
lea ecx, [ebp - 8]
call fcn.004013c8
push dword [0x4819a8]
push ecx
mov ecx, esp
push 0x47e7d4
call fcn.004013c8
mov ecx, 0x493234
call fcn.00445f28
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push str.m_lang_id
push 0x47e854
mov dword [0x4819a8], eax
call fcn.00445c97
add esp, 0x14
xor ebx, ebx
cmp eax, ebx
mov dword [0x4819a8], eax
push ecx
mov ecx, esp
jne 0x4580d7
push str.DE_HELP
call fcn.004013c8
lea eax, [ebp - 4]
push eax
call fcn.004457f3
pop ecx
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.00401522
lea ecx, [ebp - 4]
jmp 0x4580f8
push str.EN_HELP
call fcn.004013c8
lea eax, [ebp - 4]
push eax
call fcn.004457f3
pop ecx
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.00401522
lea ecx, [ebp - 4]
call fcn.0040139c
mov eax, dword [0x488b6c]
mov ecx, 0x81
mov dword [ebp - 0x214], eax
xor eax, eax
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0xc]
push eax
call fcn.0040811c
push str.tmp_htm__q_dir_hlp_z.html
lea ecx, [ebp - 4]
call fcn.004013c8
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push eax
push dword [eax - 8]
call fcn.00401658
lea ecx, [ebp - 4]
call fcn.0040139c
push 0x47e654
push dword [ebp - 0xc]
call fcn.0046ba30
pop ecx
mov dword [ebp - 4], eax
pop ecx
push ebx
lea ecx, [ebp - 8]
call fcn.004016d4
mov edi, eax
cmp edi, ebx
jne 0x458181
xor esi, esi
jmp 0x4581a5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.0046aab0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.004581f9
mov esi, eax
push dword [ebp - 4]
push esi
call fcn.0046c2c0
pop ecx
push eax
push 1
push esi
call fcn.0046b8c6
push dword [ebp - 4]
call fcn.0046b849
add esp, 0x14
push 3
push ebx
push ebx
push dword [ebp - 0xc]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xc]
call fcn.0040139c
lea ecx, [ebp - 8]
call fcn.0040139c
lea ecx, [ebp + 8]
call fcn.0040139c
lea esp, [ebp - 0x220]
pop edi
pop esi
pop ebx
leave
ret