joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451c4d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x451d50
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x451cce
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x451cbc
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x451cba
push 0
push 0
push 1
push 1
push 0x2ce4
push 1
call fcn.00458a8c
add esp, 0x18
jmp 0x451cc9
push 0x26cb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x451d4e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x451d2e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x451d0c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffeb
jge 0x451d2c
push 0x30e2
push 1
push 0
push 0x79dc
call fcn.0045589e
add esp, 0x10
jmp 0x451d01
jmp 0x451d4e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x451d4e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x451d6f
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
push 0x326d
push 0
push dword [ebp - 0x3c]
push 0x62f2
push 1
call fcn.0044e6bb
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4527dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x45288c
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x452835
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
push dword [ebp - 0x10]
push 0x1fd
push 0x13dc
call fcn.00453788
add esp, 0x10
jmp 0x45288a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x452880
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax + 0x18]
sub eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0x18], eax
jmp 0x45288a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x4528c4
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x4528bc
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push 0x20a8
push 1
push dword [ebp - 0x40]
call fcn.0044e7d8
add esp, 0xc
jmp 0x4528c4
push 0
call fcn.004574aa
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x453601
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4536fc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4536e0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x453688
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x453686
push 0
push 0x19bc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4536de
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4536aa
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe3
jge 0x4536de
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4536dc
push 0x2204
push 0
push 0x131b
push 0
push 0xd7a
push 0x8ef
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x45369f
jmp 0x4536fa
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
push dword [ebp - 0x38]
push 1
push 0x3baf
call fcn.00450f22
add esp, 0x10
jmp 0x453769
lea eax, [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x453732
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0x153b
push dword [ebp - 0x44]
push 0
call fcn.00456574
add esp, 0xc
jmp 0x453769
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0
push 1
push 1
push 0x447c
push 0x6da3
push 0x2dba
push dword [ebp - 0x4c]
push 0
push 0x1a2c
push 0x7a48
push 0x4de3
call fcn.0045266d
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x45402f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4540eb
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4540d8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4540a6
mov byte [ebp - 1], 0
push 0x2e88
push 0
push 0
push 0x2242
push 0x3248
push 1
lea eax, [ebp - 1]
push eax
call fcn.0045738d
add esp, 0x1c
jmp 0x4540d6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 0xf
push 5
call fcn.00449d86
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x4540e6
push 0
push 0x7d6c
call fcn.0045aad4
pop ecx
pop ecx
jmp 0x454174
lea eax, [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x454160
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x45413b
mov byte [ebp - 2], 0
push 0x6498
lea eax, [ebp - 2]
push eax
push 0
push 0x60ba
call fcn.004561f6
add esp, 0x10
jmp 0x45415e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x45415e
push 0x2387
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x454174
push 0
push 0x28e0
push 0x24de
call fcn.00453f1c
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x454226
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x45431c
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4542c3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4542a1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4542c1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4542c1
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x45431a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4542fa
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x45431a
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x45431a
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x454332
lea eax, [ebp + 0x14]
mov dword [ebp - 0x58], eax
push 0
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
push eax
call fcn.0045c7b2
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4569f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x456af1
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x456ab3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x456a5c
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
call fcn.0045d763
pop ecx
pop ecx
jmp 0x456ab1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x456a7e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jle 0x456ab1
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x456aaf
push 0
push 0
push 0
push 0
push 0x19b4
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x456a73
jmp 0x456aef
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x456ad1
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x456aef
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x456aef
push 0
call fcn.0045947f
pop ecx
jmp 0x456b28
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x3c]
push 0x7fd5
push 0xd9d
push dword [ebp - 0x40]
push 0x42fd
push 0x2490
push 1
push 1
push 0x5d04
call fcn.00451295
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x456b49
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x456be1
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x456b87
push 0x501e
push 1
call fcn.00456bfd
pop ecx
pop ecx
jmp 0x456bdf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x456bc4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x456bc2
push 0x143d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x456bdf
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x456bdf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x456bf9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0
push 0x5bee
call fcn.0044d218
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x456cb8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x456e22
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x456d7e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x456d48
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x456d46
push 0x49ed
push 0x7ab1
push 0x7695
push 0
push 0x1c32
push 0
call fcn.0045b7f9
add esp, 0x18
jmp 0x456d79
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x456d79
push 0xf03
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x456e20
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x456dfb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x456e20
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x456e20
push 0x1ab6
push 0x1450
push 0
push 0xd7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x456e30
push 0x1312
push 0
call fcn.0045570c
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x458315
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4583e3
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x458394
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x458375
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x2c64
push 1
push 0
push 0x107e
call fcn.00450a3a
add esp, 0x18
jmp 0x458392
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x458392
push 0xdcc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4583e1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4583bf
mov byte [ebp - 3], 0
push 0
push 0xebb
lea eax, [ebp - 3]
push eax
push 1
call fcn.0044d00c
add esp, 0x10
jmp 0x4583e1
mov byte [ebp - 4], 0
movzx eax, byte [ebp - 4]
test eax, eax
je 0x4583e1
push 0
push 0x241b
push 0x11c8
push 0
call fcn.0045143a
add esp, 0x10
jmp 0x4583eb
push 0
call fcn.0045810b
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x458903
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x458927
push 0x5565
push 1
push 1
call fcn.00458a36
add esp, 0xc
jmp 0x458a32
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x458a19
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4589ab
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4589a9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x458a17
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4589f1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 9
jg 0x458a17
mov eax, dword [ebp - 0x54]
mov dword [eax], 0xfffffffd
mov eax, dword [ebp - 0x58]
mov dword [eax], 0xfffffffd
mov eax, dword [ebp - 0x5c]
cmp dword [eax], 0
je 0x458a15
jmp 0x4589e6
jmp 0x4589e6
jmp 0x458a32
push 0x26a3
push 0
push 0x1614
push 0x4844
call fcn.00458d1b
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x45907e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4590ae
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
call fcn.00459121
add esp, 0xc
jmp 0x45911d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4590e4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
call fcn.0045801e
pop ecx
pop ecx
jmp 0x45911d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x459113
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x45911d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esp, ebp
pop ebp
ret
Function at 0x45d21e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 8]
test eax, eax
je 0x45d2a3
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45d262
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 1
call fcn.0045d329
pop ecx
pop ecx
jmp 0x45d29e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x45d291
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x45d29e
push 0x12e5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x45d325
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x45d30b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
push 0x17fb
push dword [ebp - 0x3c]
push 0
push 0x523d
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.0044f990
add esp, 0x1c
jmp 0x45d325
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 0
push 0x7a76
push dword [ebp - 0x50]
push 1
call fcn.0044d00c
add esp, 0x10
mov esp, ebp
pop ebp
ret