joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4923e4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x125]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x4925bc
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x492443
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x4925d8
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4924b7
xor eax, eax
push ebp
push 0x4924b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 5
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x16]
push eax
push 0
push 0
push ebp
lea eax, [ebp - 0x125]
call fcn.004921fc
pop ecx
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x492499
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x16]
push eax
push 0
push 0
push 0x4925f8
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4924b7
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x125]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0x11]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov dword [ebp - 8], eax
cmp byte [ebp - 0x125], 0
je 0x4925b5
cmp byte [ebp - 0x11], 0
jne 0x4924fc
cmp byte [ebp - 0x16], 0
je 0x4925b5
lea eax, [ebp - 0x125]
push eax
call sub.KERNEL32.DLL_lstrlenA
lea edx, [ebp - 0x125]
add eax, edx
mov dword [ebp - 0x20], eax
jmp 0x492518
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0x2e
je 0x49252b
lea eax, [ebp - 0x125]
cmp eax, dword [ebp - 0x20]
jne 0x492515
lea eax, [ebp - 0x125]
cmp eax, dword [ebp - 0x20]
je 0x4925b5
inc dword [ebp - 0x20]
cmp byte [ebp - 0x16], 0
je 0x49255f
lea eax, [ebp - 0x16]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x125]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4925b5
cmp byte [ebp - 0x11], 0
je 0x4925b5
lea eax, [ebp - 0x11]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x125]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4925b5
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x11]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x125]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x492ae8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x492bd0
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x4f8018], 1
jae 0x492bc2
xor eax, eax
mov dword [0x4f7c24], eax
xor eax, eax
mov dword [0x4f7c2c], eax
xor eax, eax
mov dword [0x4f7c30], eax
mov byte [0x4f7c36], 2
mov byte [0x4f7c37], 2
mov byte [0x4f7c38], 3
mov word [0x4f7fe0], 0
mov word [0x4f7ff0], 1
mov word [0x4f8000], 0xa
mov dword [0x4f8008], 0x80020004
mov dword [0x4f7fd4], 0x491090
mov dword [fcn.004f7fd8], fcn.00491088
mov dword [0x4f7fdc], 0x491090
call fcn.0048f364
test al, al
je 0x492b81
call fcn.0048f3a8
call fcn.0048f46c
mov eax, 0x4f7c3c
mov edx, 0x492bdc
call fcn.0048c046
mov eax, 0x4f7e08
mov edx, 0x492bdc
call fcn.0048c046
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4f7c1c], eax
call fcn.0048cffc
mov dword [0x4f7c18], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4f7c10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492bd7
ret

Function at 0x494ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x494aec
call fcn.00495cd8
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x494b08
test bl, 1
je 0x494b08
call fcn.00499938
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x494cec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00495874
test byte [ebp + 0xd], 0xc0
jne 0x494d10
mov eax, dword [0x4f3bfc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x494d1d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x494d4a
je 0x494d5c
sub ecx, 0x100
je 0x494d6a
sub ecx, 0x100
je 0x494d71
sub ecx, 0x100
je 0x494d63
jmp 0x494d78
sub ecx, 0x600
je 0x494d71
sub ecx, 0x100
je 0x494d5c
jmp 0x494d78
mov edi, 1
jmp 0x494d7d
mov edi, 2
jmp 0x494d7d
mov edi, 4
jmp 0x494d7d
mov edi, 5
jmp 0x494d7d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x494da4
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4f3674]
test al, 0x80
je 0x494d9d
mov ebx, 0x80
jmp 0x494db6
mov ebx, 1
jmp 0x494db6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x494db6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x494dc8
je 0x494dd1
dec eax
je 0x494dda
jmp 0x494de3
mov dword [ebp - 4], 0x80000000
jmp 0x494df2
mov dword [ebp - 4], 0x40000000
jmp 0x494df2
mov dword [ebp - 4], 0xc0000000
jmp 0x494df2
push 1
call fcn.00495c6c
pop ecx
mov ebx, eax
jmp 0x494ede
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x494e0e
sub eax, 0x10
je 0x494e15
sub eax, 0x10
je 0x494e1e
sub eax, 0x10
je 0x494e27
jmp 0x494e27
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x494e2e
mov dword [ebp - 8], 1
jmp 0x494e2e
mov dword [ebp - 8], 2
jmp 0x494e2e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x494e97
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x494e8c
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x494e8c
add ebx, 0xffffffb2
push ebx
call fcn.00495c6c
pop ecx
mov ebx, eax
jmp 0x494ede
mov edi, esi
push edi
call fcn.00494c50
pop ecx
test eax, eax
je 0x494eab
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x494eb7
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00495994
add esp, 8
mov ebx, eax
inc eax
jne 0x494ede
push 4
call fcn.00495c6c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004958a8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4998d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x499932
call fcn.00499880
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004939e0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004939e0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4999b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4f4b9c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x499a8a
cmp dword [0x4f4b98], 0
jne 0x499a8a
cmp dword [0x4f4d7c], 0
je 0x499a44
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00499780
add esp, 8
mov ebx, eax
test eax, eax
jne 0x499a2a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00499780
add esp, 8
mov ebx, eax
test eax, eax
jne 0x499a2a
lea ebx, [ebp - 0x84]
jmp 0x499a2b
inc ebx
call fcn.0049996c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x499ac5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4f4ba0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004939e0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4f4ba3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x499ac5
cmp dword [0x4f4b98], 0
je 0x499aa4
cmp dword [0x4f4b98], 0xffffffff
je 0x499ac5
push esi
call dword [0x4f4b98]
pop ecx
mov eax, dword [0x4f4b9c]
test eax, eax
je 0x499ac5
cmp dword [0x4f4b9c], 0xffffffff
je 0x499ac5
cmp byte [eax], 0
je 0x499ac5
push esi
push eax
call fcn.004998d0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7640
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4a766e
mov eax, ebx
call fcn.004a80e4
cmp dword [ebx + 0x3c], 0
je 0x4a7667
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4a76df
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4a76d1
cmp dword [ebx + 8], 0
je 0x4a7690
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4a76a2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a76d1
cmp dword [ebx + 8], 0
je 0x4a7683
cmp eax, 3
je 0x4a76b5
dec eax
jne 0x4a7683
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a7683
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4a7683
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4a76fd
cmp dword [ebx + 0x10], 0xcc
je 0x4a76fd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a7708
pop ebx
ret
Function at 0x4c5ad4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 0
jne 0x4c5bd9
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x4c5bd9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x150], 0
je 0x4c5b1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x150]
cmp byte [eax + 0x51], 0
jne 0x4c5bd9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x138], 0
jne 0x4c5b3b
mov eax, dword [ebp - 4]
mov byte [eax + 0x178], 2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x78]
xor eax, eax
push ebp
push 0x4c5bd2
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0x14
jge 0x4c5b6c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x4c5b51
mov eax, dword [ebp - 4]
cmp dword [eax + 0x128], 0
jne 0x4c5b84
mov eax, dword [ebp - 4]
mov bx, 0xffec
call fcn.0048f760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5bd9
mov eax, dword [ebp - 4]
mov byte [eax + 0x178], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x128], 0
jne 0x4c5bb1
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x78]
jmp 0x4c5bd1
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x138]
xor dl, 1
mov eax, dword [ebp - 4]
call sym.chemax.exe__Rxctrls_TRxSpeedButton_SetDown_qqro
mov eax, dword [ebp - 4]
mov bx, 0xffec
call fcn.0048f760
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c82b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0048f090
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jbe 0x4c8318
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
jle 0x4c8318
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
dec eax
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
mov ecx, edx
cdq
idiv ecx
inc edx
mov eax, dword [ebp - 4]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
xor al, dl
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4c82e6
mov esp, ebp
pop ebp
ret
Function at 0x4c8774
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004c8664
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c892d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x475228]
call fcn.0048f500
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c8910
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
xor eax, eax
mov dword [ebp - 0x1c], eax
call fcn.0047425c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
call fcn.00473d64
xor eax, eax
push ebp
push 0x4c88f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
call fcn.00473cb0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x16]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x16]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x1c], 0
je 0x4c8823
mov eax, dword [ebp - 0x1c]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
mov eax, dword [ebp - 0x10]
call fcn.00479344
push eax
mov eax, dword [0x4f7578]
movzx eax, word [eax]
push eax
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4c88c5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14], 0
je 0x4c88bb
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4c88b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00479344
mov ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x14]
push eax
movzx eax, word [sym.chemax.exe__Clipicon_CF_ICON]
push eax
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c88bb
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c88dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c88fa
mov eax, dword [ebp - 0x24]
call fcn.00473d20
ret
Function at 0x4c893c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 4], eax
call fcn.0047425c
mov dx, word [sym.chemax.exe__Clipicon_CF_ICON]
call fcn.00474218
test al, al
je 0x4c8a49
call fcn.0047425c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00473d64
xor eax, eax
push ebp
push 0x4c8a42
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [sym.chemax.exe__Clipicon_CF_ICON]
push eax
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c8a25
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x475228]
call fcn.0048f500
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c8a07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalSize
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8a0e
mov eax, dword [ebp - 8]
call fcn.0048f55c
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cb234
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
mov eax, dword [0x4f71d4]
mov eax, dword [eax]
call fcn.0044b630
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x4cb26c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x4cb245
mov esp, ebp
pop ebp
ret

Function at 0x4cb8c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.004cb858
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4cb8e1
xor eax, eax
call fcn.004cb890
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_ShowWindow
cmp byte [ebp - 9], 0
je 0x4cb8fb
mov al, 1
call fcn.004cb890
mov esp, ebp
pop ebp
ret

Function at 0x4cc38c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x800
lea eax, [ebp - 0x809]
push eax
mov eax, dword [ebp - 4]
call fcn.00490734
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jbe 0x4cc3c9
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x809]
call fcn.00486d2c
jmp 0x4cc3d1
mov eax, dword [ebp - 8]
call fcn.004902c8
mov esp, ebp
pop ebp
ret
Function at 0x4cc7f8
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
xor ecx, ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cc9c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x15
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4cc9b0
lea eax, [ebp - 0x121]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
setne al
neg al
sbb eax, eax
call fcn.0048b558
lea eax, [ebp - 0x226]
push eax
push 0
push 0x4cc9d8
lea eax, [ebp - 0x121]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
setne al
neg al
sbb eax, eax
call fcn.0048b558
xor eax, eax
push ebp
push 0x4cc9a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4cc988
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4cc971
xor eax, eax
push ebp
push 0x4cc96a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
lea edx, [ebp - 0x22c]
lea eax, [ebp - 0x226]
call fcn.00486d2c
mov ecx, dword [ebp - 0x22c]
mov dl, 1
mov eax, dword [0x475150]
call fcn.00479624
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cc93e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.004793e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc945
mov eax, dword [ebp - 0x10]
call fcn.0048f55c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc98f
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc9d0
lea eax, [ebp - 0x22c]
call fcn.004902c8
ret
Function at 0x4cd2a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff34
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cd3de
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov eax, dword [ebp - 0x90]
sub eax, 1
jb 0x4cd2ec
je 0x4cd2f5
dec eax
je 0x4cd334
jmp 0x4cd33f
mov dword [ebp - 9], 0x73323303
jmp 0x4cd33f
and dword [ebp - 0x94], 0xffff
cmp dword [ebp - 0x9c], 4
ja 0x4cd31a
cmp dword [ebp - 0x9c], 4
jne 0x4cd327
cmp dword [ebp - 0x98], 0xa
jb 0x4cd327
mov esi, 0x4cd3ec
lea edi, [ebp - 9]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4cd33f
mov esi, 0x4cd3f0
lea edi, [ebp - 9]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4cd33f
mov esi, 0x4cd3f4
lea edi, [ebp - 9]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 9]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 4
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea eax, [ebp - 0x8c]
mov dword [ebp - 0xac], eax
mov byte [ebp - 0xa8], 6
lea edx, [ebp - 0xcc]
mov ecx, 4
mov eax, 0x4cd400
call fcn.0048731c
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 4]
call fcn.00485a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd3e5
lea eax, [ebp - 0xa4]
call fcn.004902c8
ret

Function at 0x4ce900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
dec eax
shl eax, 2
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x4ce97a
xor eax, eax
push ebp
push 0x4ce973
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce97a
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 4
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_VirtualProtect
ret
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret