joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4484f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x48fa3c]
cmp byte [eax + 0xc], 0
je 0x448661
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44865a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x490b68], 0
jne 0x448548
push 0x448668
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x448670
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b68], eax
cmp dword [0x48cc2c], 0
jne 0x448643
push 0x448680
call sub.kernel32.dll_LoadLibraryA
mov dword [0x48cc2c], eax
cmp dword [0x48cc2c], 0
je 0x448643
push 0x44868c
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b6c], eax
push 0x44869c
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b70], eax
push 0x4486b0
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b74], eax
push 0x4486c8
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b78], eax
push 0x4486e0
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b7c], eax
push 0x4486f4
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b80], eax
push 0x44870c
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b84], eax
push 0x448724
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b88], eax
push 0x448740
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b8c], eax
push 0x44874c
mov eax, dword [0x48cc2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490b90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448661
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44c9a4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404a9c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44c9f3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404d0c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45426c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4542bc]
test si, 4
je 0x454280
or bl, 1
test si, 8
je 0x45428a
or bl, 4
test si, 1
je 0x454294
or bl, 8
test si, 2
je 0x45429e
or bl, 0x10
test si, 0x10
je 0x4542a8
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4542b7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4542c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4542f8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4542d9
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4542e8
or bl, 4
test esi, 0x20000000
je 0x4542f3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45a9bc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45a9ce
add esp, 0xfffffff0
call fcn.0040402c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e984
mov eax, dword [0x48f584]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ad60
mov eax, dword [0x48f598]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ad6c
mov eax, ebx
call fcn.0045ad78
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x416910]
call fcn.00403cc4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x416910]
call fcn.00403cc4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x416910]
call fcn.00403cc4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x416910]
call fcn.00403cc4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x416910]
call fcn.00403cc4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x457190
push eax
push 0
push 0
mov eax, dword [0x48f764]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x420400]
call fcn.00421c38
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x420400]
call fcn.00421c38
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x420400]
call fcn.00421c38
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045b1c8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b090
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b090
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b090
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45ab0b
call fcn.00404084
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45ae74
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b01f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45b000
mov dl, 1
mov eax, dword [0x416d2c]
call fcn.00403cc4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404a9c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45afef
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00448854
test al, al
je 0x45afe2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45b030
lea eax, [ebp - 0x254]
call fcn.0040a2dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45afe2
xor eax, eax
push ebp
push 0x45afdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45b068
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45afc4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d0c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45afc4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45afe2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45aee5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041aa70
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b026
lea eax, [ebp - 0x260]
call fcn.00404a9c
ret

Function at 0x45b968
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x490bb4]
cmp byte [eax + 0xa5], 0
jne 0x45b9d9
cmp dword [0x490bcc], 0
jne 0x45b99a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45b924
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x490bcc], eax
cmp dword [0x490bc8], 0
jne 0x45b9b5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x490bc8], eax
cmp dword [0x490bd0], 0
jne 0x45b9d9
push esp
push 0
push 0
push 0x45b8c8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x490bd0], eax
pop edx
ret
Function at 0x45c06c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x490bb4]
cmp dword [eax + 0x30], 0
je 0x45c116
cmp dword [ebx + 0x94], 0
jne 0x45c110
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45bffc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c110
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c0d6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c110
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418ec0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c0e5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45cc74
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45cca9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b8c
jmp 0x45ccb6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404af0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45ddf0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45de31
mov eax, esi
call fcn.00443e3c
test al, al
je 0x45de31
mov eax, dword [ebx + 0x84]
call fcn.00443b38
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45de31
push 0
mov eax, dword [ebx + 0x84]
call fcn.00443b38
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45eb14
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415eb8]
call fcn.00405500
xor eax, eax
push ebp
push 0x45ec58
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48ce60], 0
jne 0x45eb67
mov ecx, dword [0x48f470]
mov dl, 1
mov eax, dword [0x40811c]
call fcn.0040ce9c
call fcn.00404494
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403528
mov eax, ebx
call fcn.004052fc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45ec68
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406640
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0040530c
test eax, eax
jle 0x45ebff
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45ebf8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404d24
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404d0c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409000
test eax, eax
jne 0x45ebf8
mov ebx, 0x15
jmp 0x45ec04
mov ebx, 0x10
jmp 0x45ec04
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x48ce60]
call fcn.0045ea6c
mov eax, dword [ebp - 8]
call fcn.0045ea6c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ec5f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404ac0
lea eax, [ebp - 0x10]
mov edx, dword [0x415eb8]
call fcn.004055d0
ret

Function at 0x45fdc4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x45fdd9
or edx, 0x200
test eax, 0x20000000
je 0x45fe0c
test eax, 0x40000000
je 0x45fdf8
test eax, 0x80000000
je 0x45fdf3
or edx, 0x40
jmp 0x45fe33
or edx, 0x20
jmp 0x45fe33
test eax, 0x80000000
je 0x45fe07
or edx, 0x80
jmp 0x45fe33
or edx, 0x10
jmp 0x45fe33
test eax, 0x40000000
je 0x45fe24
test eax, 0x80000000
je 0x45fe1f
or edx, 4
jmp 0x45fe33
or edx, 2
jmp 0x45fe33
test eax, 0x80000000
je 0x45fe30
or edx, 8
jmp 0x45fe33
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x461ad8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004052fc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x461af1
test al, 0x10
jne 0x461af5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x461e20
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004054e0
xor eax, eax
push ebp
push 0x461f66
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004053c8
jne 0x461e77
mov ecx, 0x461f80
mov dl, 1
mov eax, dword [0x408290]
call fcn.0040cde0
mov edx, eax
mov dword [edx + 0xc], 3
mov eax, edx
call fcn.00404494
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00461a6c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004051dc
mov eax, dword [ebp - 4]
call fcn.00461ad8
test al, al
jne 0x461f36
mov eax, dword [ebp - 4]
call fcn.0040530c
cmp eax, 3
jl 0x461f36
mov eax, dword [ebp - 4]
call fcn.00461ad8
test al, al
jne 0x461f36
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404d24
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004099f8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004052ec
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004053c8
je 0x461f36
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004619f0
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00461e20
test al, al
je 0x461f15
push 0
mov eax, dword [ebp - 4]
call fcn.004052fc
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x461f19
xor ebx, ebx
jmp 0x461f1b
mov bl, 1
test bl, bl
je 0x461f36
test si, si
jbe 0x461f36
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.004052fc
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461f6d
lea eax, [ebp - 0x18]
call fcn.0040517c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404ac0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405194
ret
Function at 0x463ee4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x463ef6
add esp, 0xfffffff0
call fcn.0040402c
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.004054e0
xor eax, eax
push ebp
push 0x463fa1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403cc4
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.004051b8
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov al, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x460bc8]
call fcn.00405ee0
add esp, 4
mov eax, edi
call fcn.00463d38
test al, al
jne 0x463f8b
call fcn.0040cdb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463fa8
lea eax, [ebp + 0x1c]
call fcn.0040517c
ret
Function at 0x4645fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x464605
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.004054e0
xor eax, eax
push ebp
push 0x46481d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.00461c64
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.00461f9c
mov eax, dword [ebp - 0x14018]
mov edx, 0x464838
call fcn.004053c8
jne 0x4647f4
mov dword [ebx + 0xa8], 0
mov dword [ebx + 0xac], 0
mov byte [ebx + 0xa0], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.004052fc
mov ecx, 1
mov edx, 0x80000000
call fcn.00462060
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4647ed
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004620f4
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004620f4
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x464763
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.004645c4
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x46475f
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
jmp 0x464763
inc esi
dec edi
jne 0x46472a
cmp byte [ebx + 0xa0], 0
jne 0x4647d7
push ebp
call fcn.004644d4
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x4647d7
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004620f4
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.004645c4
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4647d7
mov eax, esi
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4647f4
mov eax, dword [ebp - 4]
call fcn.0040963c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464824
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.00405194
lea eax, [ebp - 0x14008]
call fcn.0040517c
ret
Function at 0x4678d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467ab0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.0046ba2c
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x48e068], eax
mov eax, dword [ebp - 0xc]
mov dword [0x48e06c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x48e070], eax
mov eax, dword [0x48fa2c]
cmp dword [eax], 2
sete byte [0x48d94c]
push 0x467abc
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.0046cdd4
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x48d94c], 0
jne 0x46795f
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0046cf18
test al, al
je 0x46795f
mov eax, dword [ebp - 0x4c]
mov dword [0x490c40], eax
jmp 0x467966
xor eax, eax
mov dword [0x490c40], eax
call fcn.00467608
and eax, 0x7f
cmp eax, 0x12
ja case.0x467977.0
jmp dword [eax*4 + 0x46797e]
mov byte [0x48d938], 1
jmp case.0x467977.0
mov byte [0x48d93c], 1
jmp case.0x467977.0
mov byte [0x48d940], 1
jmp case.0x467977.0
mov byte [0x48d944], 1
jmp case.0x467977.0
mov byte [0x48d948], 1
jmp case.0x467977.0
mov byte [0x48d950], 1
mov byte [0x48d954], 1
jmp case.0x467977.0
mov byte [0x48d950], 1
mov byte [0x48d958], 1
jmp case.0x467977.0
mov byte [0x48d950], 1
mov byte [0x48d958], 1
mov byte [0x48d95c], 1
jmp case.0x467977.0
mov byte [0x48d960], 1
jmp case.0x467977.0
mov byte [0x48d964], 1
jmp case.0x467977.0
mov byte [0x48d968], 1
jmp case.0x467977.0
mov byte [0x48d96c], 1
jmp case.0x467977.0
mov byte [0x48d970], 1
jmp case.0x467977.0
mov byte [0x48d974], 1
jmp case.0x467977.0
mov byte [0x48d978], 1
jmp case.0x467977.0
mov byte [0x48d97c], 1
jmp case.0x467977.0
mov byte [0x48d980], 1
jmp case.0x467977.0
mov byte [0x48d984], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467ab7
lea eax, [ebp - 4]
call fcn.00404a9c
ret

Function at 0x4696f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x469758
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404d0c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004092e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46975f
lea eax, [ebp - 0xc]
call fcn.00404a9c
ret
Function at 0x46a3b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x46a3c5
add esp, 0xfffffff0
call fcn.0040402c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00403cc4
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00404af0
mov eax, esi
call fcn.00404f5c
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x46a41a
mov ecx, dword [0x48f8f8]
mov dl, 1
mov eax, dword [0x46a178]
call fcn.0046556c
call fcn.00404494
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46a441
call fcn.00404084
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x46b27c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b2ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26]
mov edx, 0x1e
call fcn.0046ba2c
mov dword [ebp - 0x26], ebx
mov dword [ebp - 0x22], 3
lea eax, [ebp - 8]
mov ecx, 0x46b318
mov edx, esi
call fcn.00404da8
mov eax, dword [ebp - 8]
call fcn.00404f5c
mov dword [ebp - 0x1e], eax
mov al, byte [ebp - 1]
call fcn.0046b254
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b306
lea eax, [ebp - 8]
call fcn.00404a9c
ret