joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a040
Capabilities:
Set console window title

Disassembly:
sub esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.PureBasic_Console_Debugger__press_CtrlC_to_stop_program_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [esp + 4]
push eax
push 0xfffffffffffffff5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov eax, 0x1f4
mov word [esp + 6], ax
push dword [esp + 4]
push 0xfffffffffffffff5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0x4adf18
push 0x4000
push 0xfffffffffffffff6
call esi
push eax
call fcn.00458532
add esp, 8
push eax
call fcn.00457e03
push 0
push 4
push 0
push eax
mov dword [0x4ec19c], eax
call fcn.00458274
add esp, 0x18
push 0x4abe88
push 0x4000
push 0xfffffffffffffff5
call esi
push eax
call fcn.00458532
add esp, 8
push eax
call fcn.00457e03
push 0
push 4
push 0
push eax
mov dword [0x4ec1a0], eax
call fcn.00458274
add esp, 0x18
push 0x4abe88
push 0x4000
push 0xfffffffffffffff4
call esi
push eax
call fcn.00458532
add esp, 8
push eax
call fcn.00457e03
push 0
push 4
push 0
push eax
mov dword [0x4ec1a4], eax
call fcn.00458274
mov eax, dword [0x4ec1a0]
add esp, 0x18
mov dword [0x4ec3a4], eax
call fcn.0042b4e0
pop esi
add esp, 0x18
ret

Function at 0x42f7d6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49a288
push 0x49a280
push str.FlsAlloc
push 0x1f
call fcn.0042fbed
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f80a
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c0158]
call esi
jmp 0x42f810
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42f854
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49a298
push 0x49a290
push str.FlsGetValue
push 0x21
call fcn.0042fbed
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f88b
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c0158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42f893
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49a2a0
push 0x49a298
push str.FlsSetValue
push 0x22
call fcn.0042fbed
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f8cd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4c0158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43e240
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x43e2f8
lea eax, [esp + 0x18]
push eax
push esi
push 2
call fcn.0046ebf0
add esp, 0xc
test eax, eax
jne 0x43e2f8
lea eax, [esp + 4]
push eax
push esi
push 0x17
call fcn.0046ebf0
add esp, 0xc
test eax, eax
jne 0x43e2f8
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x43e285
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0046ebc0
add esp, 0xc
test eax, eax
je 0x43e2b9
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0046ebc0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x43e2bb
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x43e2ee
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0044b010
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x43e2d0
pop edi
movzx eax, bl
pop ebx
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x43e660
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2f0], 2
je fcn.0043e610
mov al, 1
ret
Function at 0x4478c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x80
xor eax, eax
push ebx
mov ebx, dword [esp + 0x88]
push ebp
push esi
mov esi, 0x1e4
mov ecx, dword [ebx + 0x1c4]
cmp edx, ecx
push edi
sete al
lea eax, [eax*4 + 0x1c0]
mov ebp, dword [eax + ebx]
mov eax, 0x1f4
cmove esi, eax
mov eax, dword [ebx + 0x2e8]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x4479a0
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1d4]
cmp dword [eax + ebx], 0x447560
jne 0x4479a0
cmp dword [esi], 0
je 0x447931
test edi, edi
je 0x4479a0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.0044a020
add esp, 0x14
cmp eax, 0xffffffff
je 0x4479a0
test al, 1
je 0x4479a0
cmp dword [esi], 0
jne 0x44797a
mov eax, dword [ebx]
mov eax, dword [eax + 0x8fc]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x4d6800]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x447999
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4479a0
add dword [esi + 8], eax
jmp 0x4479a0
mov dword [esi + 4], 0
push 0
push dword [esp + 0xa4]
push dword [esp + 0xa4]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x447a2a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4479e9
mov ecx, dword [esp + 0xa4]
lea eax, [edi + 0x52]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 0x80
ret
push 0x80
lea eax, [esp + 0x14]
push eax
push esi
call fcn.0047dfb0
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.004473f0
mov eax, dword [ebx]
add esp, 0x18
mov ecx, dword [esp + 0xa4]
mov dword [eax + 0xd04], esi
mov eax, 0x37
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
Function at 0x449a80
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub esp, 0x190
test byte [esp + 0x194], 2
je 0x449ac3
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x449ab7
mov eax, dword [esp]
cmp al, 2
jne 0x449ab1
shr eax, 8
cmp al, 2
je 0x449ac3
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
call fcn.00481e90
test eax, eax
jne 0x449cc5
push esi
push edi
push 0x4b2fb4
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x449af0
mov dword [0x4ee714], esi
jmp 0x449c28
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryExA
push edi
call ebp
push 0x4b330c
push str.iphlpapi.dll
mov ebx, eax
call fcn.00481e50
add esp, 8
test eax, eax
je 0x449b40
test ebx, ebx
je 0x449b2e
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x449c03
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x449c03
test ebx, ebx
je 0x449b65
push str.AddDllDirectory
push edi
call ebp
test eax, eax
je 0x449b65
push 0x800
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x449c03
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x449bfd
lea ecx, [ebp + 0xd]
push ecx
call dword [0x4d6800]
mov edi, eax
add esp, 4
test edi, edi
je 0x449bf3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x449bf3
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449ba0
sub ecx, edx
mov eax, 0x5c
mov word [ecx + edi], ax
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449bb7
sub ecx, edx
mov edx, str.iphlpapi.dll
sub ecx, edx
add ecx, edi
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x449bd0
test ebx, ebx
je 0x449bea
push 8
push 0
push edi
call ebx
jmp 0x449bf1
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x4d6804]
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4ee714], esi
test esi, esi
je 0x449c26
push str.if_nametoindex
push esi
call ebp
mov ecx, dword [0x4ee710]
test eax, eax
cmovne ecx, eax
mov dword [0x4ee710], ecx
pop ebp
pop ebx
push 0x9c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00401510
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 8], 0x9c
mov dword [esp + 0xc], 6
mov dword [esp + 0x10], 0
push 3
push 2
push 0
push 0
mov dword [esp + 0x28], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop edi
pop esi
test eax, eax
je 0x449cbc
push 0x4ee718
mov byte [0x4ee720], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x190
ret
mov byte [0x4ee720], 0
xor eax, eax
add esp, 0x190
ret
Function at 0x449e00
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x4b2fb4
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x449e1a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x4b330c
push esi
call fcn.00481e50
add esp, 8
test eax, eax
je 0x449e62
test ebp, ebp
je 0x449e53
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x449e88
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x449e88
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x449f3f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449ea5
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x4d6800]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x449f35
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x449f35
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449ed7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449ef0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x449f00
test ebp, ebp
je 0x449f2c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4d6804]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4d6804]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x44bfe0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 4], 0
je 0x44c007
push 1
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0041ad50
mov dword [esp + 4], eax
jmp 0x44c021
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x44c0d8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x44c046
mov eax, dword [esp + 0x10]
pop esi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push edi
cmp al, 0xc0
jne 0x44c056
mov edi, 2
jmp 0x44c072
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x44c065
mov edi, 3
jmp 0x44c072
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x44c0c4
mov edi, 4
mov eax, dword [esp + 0x14]
push ebx
lea ebx, [edi - 1]
mov byte [eax], cl
inc eax
cmp dword [esi + 4], 0
je 0x44c09e
push ebx
push eax
push esi
call fcn.0041ad50
mov ecx, eax
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x44e8f0
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
sub esp, 0x8c
lea eax, [esp]
push 0xf0000040
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x44e940
push esi
lea eax, [esp + 8]
push eax
push 0x20
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
neg eax
push 0
push dword [esp + 8]
sbb esi, esi
not esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, 1
pop esi
je 0x44e9c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 4], eax
call fcn.00456e90
mov dword [esp + 8], eax
xor edx, edx
mov eax, dword [0x4ee934]
mov dword [esp + 0xc], eax
mov eax, dword [0x4d7230]
mov dword [esp + 0x14], eax
mov eax, dword [0x4d7234]
mov dword [esp + 0x18], eax
mov eax, dword [0x4d7238]
mov dword [esp + 0x1c], eax
mov eax, dword [0x4d723c]
mov dword [esp + 0x20], eax
mov al, byte [esp + edx + 4]
xor al, byte [esp + edx + 5]
mov cl, byte [esp + edx + 6]
xor cl, al
mov byte [esp + edx + 5], al
mov al, byte [esp + edx + 7]
xor al, cl
mov byte [esp + edx + 6], cl
mov cl, byte [esp + edx + 8]
xor cl, al
mov byte [esp + edx + 7], al
mov al, byte [esp + edx + 9]
xor al, cl
mov byte [esp + edx + 8], cl
xor byte [esp + edx + 0xa], al
mov byte [esp + edx + 9], al
add edx, 6
cmp edx, 0x1e
jl 0x44e982
lea eax, [esp + 0x34]
push eax
call fcn.004850b3
push 0x20
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004850db
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00485176
add esp, 0x18
xor edx, edx
movzx ecx, byte [esp + edx + 0x24]
mov eax, ecx
and ecx, 0xf
shr eax, 4
movzx eax, byte [eax + str.0123456789abcdef0123456789abcdef]
mov byte [edx*2 + 0x4eeb20], al
movzx eax, byte [ecx + str.0123456789abcdef0123456789abcdef]
movzx ecx, byte [esp + edx + 0x25]
mov byte [edx*2 + 0x4eeb21], al
mov eax, ecx
shr eax, 4
and ecx, 0xf
movzx eax, byte [eax + str.0123456789abcdef0123456789abcdef]
mov byte [edx*2 + 0x4eeb22], al
movzx eax, byte [ecx + str.0123456789abcdef0123456789abcdef]
movzx ecx, byte [esp + edx + 0x26]
mov byte [edx*2 + 0x4eeb23], al
mov eax, ecx
shr eax, 4
and ecx, 0xf
movzx eax, byte [eax + str.0123456789abcdef0123456789abcdef]
mov byte [edx*2 + 0x4eeb24], al
movzx eax, byte [ecx + str.0123456789abcdef0123456789abcdef]
movzx ecx, byte [esp + edx + 0x27]
mov byte [edx*2 + 0x4eeb25], al
mov eax, ecx
shr eax, 4
and ecx, 0xf
movzx eax, byte [eax + str.0123456789abcdef0123456789abcdef]
mov byte [edx*2 + 0x4eeb26], al
movzx eax, byte [ecx + str.0123456789abcdef0123456789abcdef]
mov byte [edx*2 + 0x4eeb27], al
add edx, 4
cmp edx, 0x10
jl 0x44e9f1
push 0x20
push 0x4eebac
lea eax, [esp + 0xc]
push eax
push 0x4ee938
call fcn.00484700
add esp, 0x9c
ret
Function at 0x44eac0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
test edi, edi
jle 0x44eb19
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [esp + 0x1c]
add eax, esi
push eax
push dword [0x4ee904]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44eb13
call ebp
cmp eax, 0x2745
je 0x44eb23
cmp eax, 0x2746
je 0x44eb23
cmp eax, 0x2749
je 0x44eb23
cmp eax, 0x274a
je 0x44eb23
add esi, ebx
cmp esi, edi
jl 0x44ead4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x44ee00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
test edi, edi
jle 0x44ee59
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [esp + 0x1c]
add eax, esi
push eax
push dword [0x4ee904]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44ee53
call ebp
cmp eax, 0x2745
je 0x44ee63
cmp eax, 0x2746
je 0x44ee63
cmp eax, 0x2749
je 0x44ee63
cmp eax, 0x274a
je 0x44ee63
add esi, ebx
cmp esi, edi
jl 0x44ee14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x458bbc
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4d70a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x458bff
call fcn.004317c5
mov dword [eax], 0xf
call fcn.004317b2
mov dword [eax], 0xd
call fcn.0042e60b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00432bea
leave
ret
test eax, eax
jne 0x458c06
inc eax
jmp 0x458bf3
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x458bf1
xor eax, eax
cmp ecx, 1
setne al
jmp 0x458bf3
Function at 0x45c9e4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4d70a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0042f039
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0042f039
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x45ca5b
cmp word [ecx], dx
je 0x45ca5b
mov eax, dword [0x49d724]
push edi
dec eax
push eax
push 0x49d610
call fcn.0045cbd4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x45cace
cmp word [eax], dx
je 0x45cace
mov eax, dword [edi]
test eax, eax
je 0x45ca7f
cmp word [eax], dx
je 0x45ca7f
lea eax, [ebp - 0x10]
push eax
call fcn.0045cc35
jmp 0x45ca88
lea eax, [ebp - 0x10]
push eax
call fcn.0045cf23
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x45caf8
mov eax, dword [0x49d60c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x49d300
call fcn.0045cbd4
add esp, 0xc
test al, al
je 0x45caf8
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x45cac3
cmp word [eax], di
je 0x45cac3
lea eax, [ebp - 0x10]
push eax
call fcn.0045cc35
pop ecx
jmp 0x45cafa
lea eax, [ebp - 0x10]
push eax
call fcn.0045cf23
jmp 0x45cac0
mov eax, dword [edi]
test eax, eax
je 0x45cae5
cmp word [eax], dx
je 0x45cae5
lea eax, [ebp - 0x10]
push eax
call fcn.0045d057
pop ecx
jmp 0x45caf8
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x45cbc3
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0045d149
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45cbc3
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x45cbc3
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x45cbc3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45cb50
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0042fa30
test ebx, ebx
je 0x45cbbe
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0042fa30
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45cbc3
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45cbc3
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00487a4c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x45cbc5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00432bea
leave
ret
Function at 0x45d24f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042f039
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45d2be
cmp esi, dword [ebp - 4]
je 0x45d2b9
cmp dword [ebp + 0xc], 0
je 0x45d2b9
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45d296
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0045d318
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x45d2c0
xor eax, eax
inc eax
jmp 0x45d2c0
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x45d350
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45d37d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45d37d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret