joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592140
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b71f8
push 0x6b71d8
push 0x6b71c4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b7124
push 0x6b7100
push 0x6b70ec
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b700c
push 0x6b716c
push 0x6b7158
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b7154
push 0x6b7128
push 0x6b72dc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xa4
call fcn.004465b0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x8c
call fcn.004465b0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esp, ebp
pop ebp
ret
Function at 0x595170
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp - 0x418]
mov ecx, dword [ecx + 0x24]
call fcn.00467e80
jmp 0x5951b4
push 0
lea edx, [ebp - 0x430]
push edx
lea ecx, [ebp - 0x424]
call fcn.00470080
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x418]
mov ecx, dword [ecx + 0x24]
call fcn.00467cb0
push eax
lea ecx, [ebp - 0x424]
call fcn.00467bd0
movzx edx, al
test edx, edx
je 0x595311
lea ecx, [ebp - 0x424]
call fcn.00467bb0
mov eax, dword [eax + 4]
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x428], edx
mov eax, dword [ebp - 0x420]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x42c], ecx
mov edx, dword [ebp - 0x428]
mov al, byte [edx]
mov byte [ebp - 0x419], al
movzx ecx, byte [ebp - 0x419]
test ecx, ecx
je 0x595246
push 0x6b731c
push 0x6b7368
lea edx, [ebp - 0x20c]
push edx
call fcn.0045c670
add esp, 0xc
jmp 0x59525f
push 0x6b7364
push 0x6b735c
lea eax, [ebp - 0x20c]
push eax
call fcn.0045c670
add esp, 0xc
mov ecx, dword [ebp - 0x420]
add ecx, 0xc
push ecx
push 0x6b7350
lea edx, [ebp - 0x414]
push edx
call fcn.0045c670
add esp, 0xc
mov ecx, dword [ebp - 0x418]
add ecx, 0x8c
call fcn.004465b0
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
push str.HotKey
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x420]
add edx, 0xc
push edx
push str.Use_s
lea eax, [ebp - 0x414]
push eax
call fcn.0045c670
add esp, 0xc
mov ecx, dword [ebp - 0x42c]
push ecx
push 0x6b74ac
lea edx, [ebp - 0x20c]
push edx
call fcn.0045c670
add esp, 0xc
mov ecx, dword [ebp - 0x418]
add ecx, 0x8c
call fcn.004465b0
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 0x6b749c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x5951a0
mov ecx, dword [ebp - 0x418]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b7504
push str.ModifyHotKey
push 0x6b74d4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x418]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b74d0
push str.ModifyHotKey64
push 0x6b7414
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x418]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b7410
push str.TempModifyHotKey
push 0x6b7488
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x418]
add ecx, 0xbc
call fcn.004465b0
push eax
push 0x6b7484
push str.TempModifyHotKey64
push str.SetModify
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
mov ecx, dword [ebp - 0x418]
add ecx, 0xa4
call fcn.004465b0
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x8c
call fcn.004465b0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495c0c
mov esp, ebp
pop ebp
ret
Function at 0x595e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3b60
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x70c0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CShareVariableManager.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.0044ee30
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x74
call fcn.0044ee30
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.0044ee30
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0044ee30
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xbc
call fcn.0044ee30
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0xd4
call fcn.0044ee30
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x50], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x54], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x58], 0
push 0x6b5b34
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.0044c0b0
push 0x6b5b30
mov ecx, dword [ebp - 0x10]
add ecx, 0x74
call fcn.0044c0b0
push 0x6b5b2c
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.0044c0b0
push 0x6b5b28
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.0044c0b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x59bb80
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4176
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x48]
call fcn.0059bee0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.0044ec90
movzx ecx, al
test ecx, ecx
je 0x59bbf0
lea ecx, [ebp - 0x28]
call fcn.004465b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00446610
jmp 0x59bc74
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea ecx, [ebp - 0x28]
call fcn.004465b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffff
je 0x59bc65
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.004db8c9
add esp, 8
mov dword [ebp - 0x4c], 0
push 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0045a6c0
push eax
lea ecx, [ebp - 0x40]
call fcn.004466d0
push eax
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00446710
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00446610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00495c0c
mov esp, ebp
pop ebp
ret 4
Function at 0x59e140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d45c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x70c0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x6bc6a0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x604]
call fcn.004ad625
push 0x6bc618
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x600]
call fcn.004ad625
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x600]
mov dword [edx + 0x604], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0059c7a0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x528], 0
je 0x59e1c6
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x528]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x60c], 0
jne 0x59e216
push 0x3e4
call fcn.00495c22
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.005c1d40
mov dword [ebp - 0x14], eax
jmp 0x59e1fd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x60c], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x60c], 0
je 0x59e268
push 0x7ea
push 0
push str.SHELLNORIFY
call fcn.00447430
mov ecx, eax
call fcn.004a74e9
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0x6bcb28
push 0x7eb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x60c]
call fcn.005c1c00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5b1f60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call fcn.004e1330
add esp, 0xc
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.004e1330
add esp, 0xc
call fcn.00447430
mov ecx, eax
call fcn.004d6324
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e67ab
add esp, 8
push 0x6c83b4
lea edx, [ebp - 0x20c]
push edx
call fcn.004eb8ca
add esp, 8
push 0x6c83c4
lea eax, [ebp - 0x20c]
push eax
call fcn.004eb8ca
add esp, 8
push 0x6c83c8
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004eb8ca
add esp, 8
lea edx, [ebp - 0x20c]
push edx
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x6c833c
push 0x6c834c
push 0x6c8374
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x41c], 0
push 0x6c8384
mov ecx, dword [ebp - 0x418]
add ecx, 0x38
call fcn.00498856
mov dword [ebp - 0x41c], eax
push 0
mov ecx, dword [ebp - 0x418]
mov ecx, dword [ecx + 0x550]
call fcn.004ac385
mov edx, dword [ebp - 0x418]
cmp dword [edx + 0x530], 0
je 0x5b20b6
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax + 0x530]
mov edx, dword [ebp - 0x418]
mov eax, dword [edx + 0x530]
add eax, 0x4fc
mov edx, dword [ecx + 0x4fc]
mov ecx, eax
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x418]
mov ecx, dword [ecx + 0x530]
call fcn.005a8380
cmp dword [ebp - 0x41c], 0
je 0x5b20d9
push 1
push 1
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x41c]
mov edx, dword [eax + 0x158]
call edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495c0c
mov esp, ebp
pop ebp
ret
Function at 0x5bdd30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6e33
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x70c0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.00447430
mov ecx, eax
call fcn.004a74e9
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.0049b80e
add esp, 4
push 0x6d2934
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x18], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x4c]
call fcn.00473f70
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0
lea ecx, [ebp - 0x4c]
call fcn.004779e0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x5bddd5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00473fa0
jmp 0x5bde3d
lea ecx, [ebp - 0xc8]
call fcn.005bea40
mov byte [ebp - 4], 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
lea ecx, [ebp - 0xc8]
call fcn.005bdfb0
call fcn.0049bc2d
lea ecx, [ebp - 0x4c]
call fcn.00477a90
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc8]
call fcn.005bea00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00473fa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5bf370
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7152
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x70c0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
call fcn.00447430
mov ecx, eax
call fcn.004a74e9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0049b80e
add esp, 4
push 0x6d9784
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x34], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x88]
call fcn.00473f70
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x88]
call fcn.004779e0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jge 0x5bf41e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00473fa0
jmp 0x5bf521
push 0x50
call fcn.00495c22
add esp, 4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
call fcn.0046c350
mov dword [ebp - 0x1c], eax
jmp 0x5bf443
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x58]
call fcn.0046cce0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
call fcn.0044a500
cmp dword [ebp - 0x14], 0
je 0x5bf47c
mov edx, dword [ebp - 0x14]
add edx, 4
mov dword [ebp - 0x20], edx
jmp 0x5bf483
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x54]
call fcn.0044a500
lea ecx, [ebp - 0x24]
call fcn.00447970
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x24]
call fcn.0045f590
lea ecx, [ebp - 0xd]
call fcn.005bfc50
mov byte [ebp - 4], 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edx, dword [ebp - 0x14]
push edx
push 0
lea ecx, [ebp - 0xd]
call fcn.005bf590
lea ecx, [ebp - 0x88]
call fcn.00477a90
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd]
call fcn.005bfc40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0046c300
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0046c850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00473fa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5c0730
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d73a2
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x70c0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
call fcn.00447430
mov ecx, eax
call fcn.004a74e9
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.0049b80e
add esp, 4
push 0x6dd1bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x30], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x90]
call fcn.00473f70
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp - 0x90]
call fcn.004779e0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x5c07e1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.00473fa0
jmp 0x5c08e9
push 0x50
call fcn.00495c22
add esp, 4
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
call fcn.0046c350
mov dword [ebp - 0x18], eax
jmp 0x5c0806
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x60]
call fcn.0046cce0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x60]
call fcn.0044a500
cmp dword [ebp - 0x10], 0
je 0x5c083f
mov edx, dword [ebp - 0x10]
add edx, 4
mov dword [ebp - 0x1c], edx
jmp 0x5c0846
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0044a500
lea ecx, [ebp - 0x20]
call fcn.00447970
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0045f590
lea ecx, [ebp - 0x40]
call fcn.005c12a0
mov byte [ebp - 4], 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edx, dword [ebp - 0x10]
push edx
push 0
lea ecx, [ebp - 0x40]
call fcn.005c0960
call fcn.0049bc2d
lea ecx, [ebp - 0x90]
call fcn.00477a90
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.005c1280
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0046c300
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.0046c850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.00473fa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x402a24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404628
test esi, esi
jne 0x402a5a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404718
jmp 0x402a78
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402938
mov edi, eax
test esi, esi
je 0x402a78
cmp dword [ebx], 0
je 0x402a78
dec esi
jmp 0x402a61
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403768
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45a020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403800
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4037e0
xor eax, eax
push ebp
push 0x4037d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40381c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4037e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45a020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45a020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044ac
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45c048], 0
je 0x40450d
cmp word [0x45c21c], 0xd7b2
jne 0x4044d5
cmp dword [0x45c224], 0
jbe 0x4044d5
mov eax, 0x45c218
call dword [0x45c234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45a070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404534
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45a030], 0
jne 0x404529
push 0
push 0x45a068
push 0x45a070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4061a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40620e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404898
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004031d0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4061f8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406215
lea eax, [ebp - 0x10]
call fcn.00404628
ret

Function at 0x40b248
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b281
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404718
jmp 0x40b28a
mov eax, ebx
mov edx, esi
call fcn.0040467c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b294
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b2b5
mov al, byte [esp]
jmp 0x40b2b7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c254
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c32a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004046c0
lea eax, [ebp - 8]
call fcn.00404b38
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ae8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c314
mov eax, ebx
call fcn.004026fc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c30d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ae8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c2f7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c33c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c2f7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c314
mov eax, dword [ebp - 0x10]
call fcn.0040271c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c331
lea eax, [ebp - 8]
call fcn.00404628
ret