joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478394
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47839c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47858e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4785a4
mov eax, esi
call fcn.0047621c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404c34
lea ecx, [ebp - 0x10]
mov edx, 0x4785b8
mov eax, esi
call fcn.0047621c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404c34
lea ecx, [ebp - 0x14]
mov edx, 0x4785d0
mov eax, esi
call fcn.0047621c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404c34
lea ecx, [ebp - 0x18]
mov edx, 0x4785ec
mov eax, esi
call fcn.0047621c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404c34
lea ecx, [ebp - 0x1c]
mov edx, 0x478608
mov eax, esi
call fcn.0047621c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404c34
lea ecx, [ebp - 0x24]
mov edx, 0x478620
mov eax, esi
call fcn.0047621c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040a068
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040a604
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x478638
mov eax, esi
call fcn.0047621c
mov eax, dword [ebp - 0x28]
call fcn.0046fb94
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x478648
mov eax, esi
call fcn.0047621c
mov eax, dword [ebp - 0x2c]
call fcn.0046fb94
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x478660
mov eax, esi
call fcn.0047621c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040a604
inc eax
je 0x478531
lea ecx, [ebp - 0x34]
mov edx, 0x478660
mov eax, esi
call fcn.0047621c
mov eax, dword [ebp - 0x34]
call fcn.0040a5c8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040bce8
fstp qword [ebp - 0x3c]
wait
call fcn.0040c058
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x47854c
lea ecx, [ebp - 0x40]
mov edx, 0x478660
mov eax, esi
call fcn.0047621c
mov eax, dword [ebp - 0x40]
call fcn.0046fb94
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x478670
mov eax, esi
call fcn.0047621c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404c34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478595
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404c04
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404c04
ret
Function at 0x40f1c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x665470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x66546c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x665470], edx
cmp eax, 0x26f
jl 0x40f1c8
mov dword [0x5a0010], 0x270
ret

Function at 0x40f200
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x665474]
mov ebx, dword [eax*4 + 0x665470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x665aa4]
mov dword [eax*4 + 0x665470], edx
cmp eax, 0xe2
jl 0x40f208
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x665474]
mov ebx, dword [eax*4 + 0x665470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6650e4]
mov dword [eax*4 + 0x665470], edx
cmp eax, 0x26e
jl 0x40f258
mov edx, dword [0x665470]
mov ecx, dword [0x665e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x665aa0]
mov dword [0x665e2c], eax
mov dword [0x5a0010], 0
pop ebx
ret

Function at 0x40f2e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x5a0010]
add dword [0x5a0010], 1
mov eax, dword [0x664020]
cmp eax, dword [0x59f760]
jne 0x40f303
cmp ebx, 0x271
jb 0x40f324
mov eax, dword [0x664020]
call fcn.0040f1c0
not dword [0x664020]
mov eax, dword [0x664020]
mov dword [0x59f760], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40f340
call fcn.0040f200
xor ebx, ebx
mov dword [0x5a0010], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x665470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x410e90
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x59f4a0]
cmp ax, 0xcb
je 0x410f9c
cmp ax, 0xcc
je 0x410f9c
lea esi, [esi]
mov edx, dword [0x666070]
test edx, edx
je 0x410ec5
mov eax, dword [0x665f20]
call edx
mov ebx, eax
jmp 0x410eca
mov ebx, 0x665f24
cmp word [0x665f10], 0
jle 0x410ef0
mov eax, 0x665ef0
call fcn.00411150
mov eax, ebx
call fcn.00410a50
mov eax, ebx
call fcn.00410ac0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410f12
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410f0d
mov edx, edi
mov eax, ebx
call fcn.0040fec0
jmp 0x410f10
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410ef8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x665f10], 0
jle 0x410f9c
mov edx, 0x665e30
mov eax, ebx
call fcn.00410000
mov edi, eax
test edi, edi
je 0x410f6c
mov eax, dword [0x665ec4]
mov dword [edi + 0xc], eax
cmp dword [0x665ec4], 0
je 0x410f60
mov eax, dword [0x665ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x665ec4], eax
nop
sub word [0x665f10], 1
cmp word [0x665f10], 0
sete bl
mov eax, 0x665ef0
call fcn.00411170
test bl, bl
je 0x410f9c
mov eax, 0x665ef0
call fcn.00411140
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x4137e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.004137c0
push ebp
push 0x414be0
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x41390a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040ba90
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x41386f
mov edx, 0x6652f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x4138c1
call sub.kernel32.dll_GetLastError
call fcn.004041e0
lea eax, [ebp - 0x10]
call fcn.0040a370
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a920
mov edx, dword [ebp - 0x14]
mov ecx, 0x5fd36c
lea eax, [ebp - 0x10]
call fcn.0040a6a0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b360
jmp 0x413958
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x4138da
cmp eax, ecx
je 0x4138e4
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040ba90
cmp byte [0x59f720], 0
jne 0x413958
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040c030
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b3f0
lea esi, [esi]
jmp 0x413958
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040ba90
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41392e
mov eax, 0x6652f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x59f720], 0
jne 0x413958
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040c030
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b3f0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004137c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413d70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x665260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413f50
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x665260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403750
call sub.kernel32.dll_GetCommandLineA
mov dword [0x59f520], eax
mov ebx, eax
jmp 0x413f13
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413df8
cmp byte [ebx], 0
je 0x413f1c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413e73
mov al, byte [ebx]
cmp al, 1
jb 0x413e68
sub al, 0x20
jbe 0x413e38
sub al, 2
je 0x413e4c
jmp 0x413e68
mov al, byte [ebp - 0x114]
test al, al
je 0x413e78
add dword [ebp - 0x110], 1
jmp 0x413e70
cmp byte [ebx + 1], 0x22
je 0x413e63
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413e70
add ebx, 1
jmp 0x413e70
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413e28
test dword [ebp - 0x10c], 0xffffffff
je 0x413f0c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413f50
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x665260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413f03
mov al, byte [ebx]
cmp al, 1
jb 0x413ef8
sub al, 0x20
jbe 0x413ec8
sub al, 2
je 0x413edc
jmp 0x413ef8
mov al, byte [ebp - 0x114]
test al, al
je 0x413f08
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413f00
cmp byte [ebx + 1], 0x22
je 0x413ef3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413f00
add ebx, 1
jmp 0x413f00
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413eb8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413dfb
mov ebx, dword [ebp - 0x10c]
mov dword [0x665250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x665260
call fcn.00410cd0
mov eax, dword [0x665260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449ad0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x449b7a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x449b96
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x449b96
sub dx, 0x20
je 0x449b70
sub dx, 0x80
je 0x449b70
sub dx, 0x1f62
jb 0x449b96
sub dx, 1
jbe 0x449b70
sub dx, 6
je 0x449b70
sub dx, 0x26
jne 0x449b96
nop
jmp 0x449b70
cmp eax, dword [ebp - 0x20]
jg 0x449b18
lea esi, [esi]
jmp 0x449b96
cmp dword [ebp - 0x1c], 2
jne 0x449b8a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x449b96
mov al, byte [ebp - 0xc]
call fcn.0040b6f0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x449c14
sub ax, 0x21
je 0x449c28
sub ax, 0x17
je 0x449c34
sub ax, 0x222
je 0x449c40
sub ax, 0x392
je 0x449c48
sub ax, 1
je 0x449c50
sub ax, 0x1996
je 0x449c58
sub ax, 1
je 0x449c60
sub ax, 6
je 0x449c68
sub ax, 0xb
je 0x449c78
sub ax, 0x1b
je 0x449c70
sub ax, 0x367
je 0x449c80
jmp 0x449c88
mov ax, word [ebp - 0x24]
call fcn.0040b790
mov byte [ebp - 0x10], al
jmp 0x449c90
mov byte [ebp - 0x10], 0x20
jmp 0x449c90
mov byte [ebp - 0x10], 0x2e
jmp 0x449c90
mov byte [ebp - 0x10], 0x27
jmp 0x449c90
mov byte [ebp - 0x10], 0x2c
jmp 0x449c90
mov byte [ebp - 0x10], 0x27
jmp 0x449c90
mov byte [ebp - 0x10], 0x20
jmp 0x449c90
mov byte [ebp - 0x10], 0x20
jmp 0x449c90
mov byte [ebp - 0x10], 0x20
jmp 0x449c90
mov byte [ebp - 0x10], 0x20
jmp 0x449c90
mov byte [ebp - 0x10], 0x2d
jmp 0x449c90
mov byte [ebp - 0x10], 0x27
jmp 0x449c90
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x457a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00457a10
push ebp
push 0x414be0
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x457b30
mov al, byte [ebp - 0x110]
test al, al
je 0x457af9
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fb0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409420
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a1f0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x60b100
call fcn.004721e0
mov edx, 0x457a8a
mov ecx, ebp
call fcn.00414aa0
jmp 0x457b30
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x60b100
call fcn.004721e0
mov edx, 0x457af9
mov ecx, ebp
call fcn.00414aa0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x457bf4
mov al, byte [ebp - 0x110]
test al, al
je 0x457bbd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fb0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409420
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a1f0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x60b100
call fcn.004721e0
mov edx, 0x457b4e
mov ecx, ebp
call fcn.00414aa0
jmp 0x457bf4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x60b100
call fcn.004721e0
mov edx, 0x457bbd
mov ecx, ebp
call fcn.00414aa0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00457190
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00457a10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45b5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x60bd8c
call fcn.0040d2c0
test al, al
je 0x45b6d6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0045b6f0
xor eax, eax
push fcn.0045b5e0
push ebp
push 0x414be0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408ba0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0045a800
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.00459af0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0045b5e0
jmp 0x45b6e1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0045e250
mov esp, ebp
pop ebp
ret

Function at 0x45d590
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x45d5ac
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4682d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.004682c0
push ebp
push 0x414be0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408ba0
lea eax, [ebp - 0xc10]
call fcn.00403c70
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x468330
mov eax, 0x6652f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x4683da
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040fd00
xor eax, eax
push fcn.004682b0
push ebp
push 0x414be0
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x46838c
mov eax, 0x6652f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4683c8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x6109bc
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4683c8
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004682b0
jmp 0x468438
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4683fc
mov eax, 0x6652f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x468438
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x6109bc
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x468438
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004682c0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x473730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x611900
lea eax, [ebp - 0x268]
call fcn.0040eab0
xor eax, eax
push fcn.00473710
push ebp
push 0x414be0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x473773
mov eax, 0x6652f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x4737bb
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x47378f
clc
jmp 0x473796
bt dword [0x610ed0], eax
jb 0x4737af
mov eax, ebp
call fcn.00473860
test al, al
je 0x4737af
mov byte [ebp - 0x26c], 1
jmp 0x473840
mov byte [ebp - 0x26c], 0
jmp 0x473840
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x5a0ec0]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x473840
and esi, 0x400
je 0x473840
lea ebx, [ebp - 0x268]
mov edx, 0x611900
mov eax, ebx
call fcn.0040eb70
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.004733d0
test eax, eax
je 0x473814
sub eax, 1
je 0x47382c
jmp 0x473838
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.00473730
mov byte [ebp - 0x26c], al
jmp 0x473840
mov byte [ebp - 0x26c], 1
jmp 0x473840
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00473710
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473b60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x473b6c
mov eax, 0x6652f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x473c60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00473c50
push ebp
push 0x414be0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x473cd0
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.0040ba90
cmp ebx, 1
jle 0x473cc0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.0040b240
jmp 0x473cdb
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00408ba0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00473c50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4