joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e6b8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [0x519ab0]
cmp byte [eax + 0xc], 0
je 0x49e82a
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49e823
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x51d8a0], 0
jne 0x49e711
push 0x49e830
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [ebp - 4], eax
push 0x49e838
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8a0], eax
cmp dword [0x510d40], 0
jne 0x49e80c
push 0x49e848
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x510d40], eax
cmp dword [0x510d40], 0
je 0x49e80c
push 0x49e854
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8a4], eax
push 0x49e864
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8a8], eax
push 0x49e878
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8ac], eax
push 0x49e890
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8b0], eax
push 0x49e8a8
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8b4], eax
push 0x49e8bc
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8b8], eax
push 0x49e8d4
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8bc], eax
push 0x49e8ec
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8c0], eax
push 0x49e908
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8c4], eax
push 0x49e914
mov eax, dword [0x510d40]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51d8c8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e82a
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a25a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4a2729
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a2704
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x119], 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x105
lea eax, [ebp - 0x119]
push eax
lea eax, [ebp - 0x120]
mov dl, byte [ebp - 1]
call fcn.0044867c
lea eax, [ebp - 0x120]
mov edx, 0x4a273c
call fcn.0044877c
mov eax, dword [ebp - 0x120]
call fcn.00448974
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4a2668
lea eax, [ebp - 0x119]
call fcn.00435634
mov ecx, eax
lea edx, [ebp - 0x119]
mov eax, dword [ebp - 8]
call fcn.00448584
jmp 0x4a2670
mov eax, dword [ebp - 8]
call fcn.00448494
cmp byte [ebp - 1], 0x61
jae 0x4a2696
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0043a310
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.004484e8
jmp 0x4a26b4
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0043a22c
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 8]
call fcn.004484e8
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0xb
lea edx, [ebp - 0x134]
xor ecx, ecx
mov eax, 0x4a2748
call fcn.00435e98
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 8]
call fcn.004484e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a270b
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
Function at 0x4a6d4c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00448964
xor eax, eax
push ebp
push 0x4a6e3c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004a8bc0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004352dc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a72b4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0043511c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a7328
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6e43
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004484b8
ret
Function at 0x4a6e4c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00448964
xor eax, eax
push ebp
push 0x4a6f4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004a8bc0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x4a6f12
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004352dc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a72b4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0043511c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a7328
jmp 0x4a6f24
xor edx, edx
mov eax, ebx
call fcn.004a72b4
xor edx, edx
mov eax, ebx
call fcn.004a7328
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6f53
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004484b8
ret

Function at 0x4a8e1c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00448964
xor eax, eax
push ebp
push 0x4a8e80
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004a8e8c
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.004358e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8e87
lea eax, [ebp - 4]
call fcn.00448494
ret

Function at 0x4af310
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x148]
mov edx, ebx
mov eax, edi
call fcn.004af538
mov esi, eax
mov dword [edi + 0x148], esi
and esi, 0xff
add dword [edi + 0x14c], esi
imul esi, dword [edi + 0x14c], 0x8088405
inc esi
mov dword [edi + 0x14c], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x150]
mov eax, edi
call fcn.004af538
mov dword [edi + 0x150], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4af384
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4af3aa
inc esi
mov eax, edi
call fcn.004af368
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.004af310
inc ebx
dec esi
jne 0x4af393
pop edi
pop esi
pop ebx
ret
Function at 0x4af43c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00448964
xor eax, eax
push ebp
push 0x4af4b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004af3b0
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004af368
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004af310
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4af47c
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af4b9
lea eax, [ebp - 4]
call fcn.00448494
ret
Function at 0x4aff18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b00ea
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4b00a6
mov eax, dword [ebp - 4]
call fcn.004b1670
cmp ebx, eax
jge 0x4b00a6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
mov edx, ebx
call fcn.004a9548
mov edx, dword [0x4a6854]
call fcn.004477ec
mov esi, eax
mov eax, esi
call fcn.004a7248
test al, al
je 0x4b009c
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x4b0090
xor eax, eax
push ebp
push 0x4b0089
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b0490
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
call fcn.00421874
mov dword [ebp - 0x10], eax
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x3e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx edx, word [ebp - 0x22]
movzx eax, word [ebp - 0x20]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0x14]
movzx esi, word [ebp - 0x1e]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00448c48
mov eax, dword [ebp - 8]
call fcn.004489cc
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
movzx eax, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004b0278
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b00d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4b0088
mov eax, dword [ebp - 4]
call fcn.004b0514
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004358e4
jmp 0x4b00d4
mov eax, dword [ebp - 8]
call fcn.00448494
jmp 0x4b00d4
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edx, [ebp - 0x4c]
mov eax, 0xb3
call fcn.00434970
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x41b5a4]
call fcn.00439030
call fcn.00447ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b00f1
lea eax, [ebp - 0x4c]
call fcn.00448494
ret
Function at 0x4b2970
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
push 0
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004466a4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4b29f3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
cmp eax, dword [ebp - 4]
je 0x4b29d0
mov ecx, 0x4b2a0c
mov dl, 1
mov eax, dword [0x4b2914]
call fcn.00438fe8
call fcn.00447ef0
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0044868c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b29fa
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004466c0
ret

Function at 0x4b6654
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
test dl, dl
je 0x4b666b
add esp, 0xfffffff0
call fcn.004479a0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b6716
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0044760c
mov eax, dword [ebp - 4]
mov byte [eax + 0x40], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 1
mov dl, 1
mov eax, dword [0x4b6210]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x4b6194]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00448494
mov eax, dword [ebp - 4]
mov edx, dword [0x519ff8]
mov dword [eax + 0x3c], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x34], 1
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00446c2c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004b6d54
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 1
mov eax, dword [ebp - 4]
add eax, 0x30
call fcn.00448494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b671d
lea eax, [ebp - 0xc]
call fcn.00448494
ret
Function at 0x4c2c10
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov word [eax + 0x36], 0
mov ax, word [0x5117e8]
mov edx, dword [ebp - 4]
mov word [edx + 4], ax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00448494
mov eax, dword [ebp - 4]
add eax, 0x14
call fcn.00448d08
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x28], edx
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
mov word [eax + 0x34], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x3c], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x48], 0xffffffff
mov eax, dword [ebp - 4]
mov byte [eax + 0x4d], 0
pop ecx
pop ebp
ret

Function at 0x4c5be8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x4c5bfa
add esp, 0xfffffff0
call fcn.004479a0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0044760c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00448d08
mov dl, 1
mov eax, dword [0x41bd20]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov word [eax + 0x18], 0
call sub.KERNEL32.DLL_GetUserDefaultLangID
mov edx, dword [ebp - 4]
mov word [edx + 0x1a], ax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4c5c83
call fcn.004479f8
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4c80d8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
test dl, dl
je 0x4c80ea
add esp, 0xfffffff0
call fcn.004479a0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0044760c
mov dl, 1
mov eax, dword [0x4c5000]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4c5674]
call fcn.004c73a0
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4c57cc]
call fcn.004c78d4
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4c5498]
call fcn.004c7f50
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
call sub.KERNEL32.DLL_GetUserDefaultLangID
mov edx, dword [ebp - 4]
mov word [edx + 0x10], ax
mov eax, dword [ebp - 4]
mov dx, word [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.004c5bc4
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4c8181
call fcn.004479f8
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4cb164
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00448974
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
sete byte [ebp - 0xd]
cmp dword [ebp - 0xc], 1
jne 0x4cb1a7
cmp dword [ebp + 8], 0
setne byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 8

Function at 0x4cb2f8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4cb37c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00448770
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00448c48
push esi
push edi
push ebx
lea ebx, str._ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
inc ebx
mov edi, dword [ebp - 4]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov edx, dword [esi - 4]
cmp edx, 0
jle 0x4cb41a
mov al, byte [esi]
shr al, 2
xlatb
mov byte [edi], al
inc edi
mov al, byte [esi + 1]
mov ah, byte [esi]
shr ax, 4
and al, 0x3f
xlatb
mov byte [edi], al
inc edi
cmp edx, 1
jne 0x4cb3ed
mov al, 0x3d
mov byte [edi], al
inc edi
mov byte [edi], al
inc edi
jmp 0x4cb41a
mov al, byte [esi + 2]
mov ah, byte [esi + 1]
shr ax, 6
and al, 0x3f
xlatb
mov byte [edi], al
inc edi
cmp edx, 2
jne 0x4cb409
mov al, 0x3d
mov byte [edi], al
inc edi
jmp 0x4cb41a
mov al, byte [esi + 2]
and al, 0x3f
xlatb
mov byte [edi], al
inc edi
add esi, 3
sub edx, 3
jmp 0x4cb3c1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cc160
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00448964
xor eax, eax
push ebp
push 0x4cc2ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4cc304
call fcn.00448b04
test eax, eax
jne 0x4cc1a6
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4cc310
call fcn.004487c0
lea eax, [ebp - 0x4c]
mov edx, 0x3c
call fcn.004caf48
mov dword [ebp - 0x44], 0x21
mov dword [ebp - 0x38], 0x101
mov dword [ebp - 0x2c], 0x81
mov dword [ebp - 0x24], 0x81
mov dword [ebp - 0x1c], 0x801
mov dword [ebp - 0x14], 0x801
mov eax, 0x21
call fcn.004466a4
mov dword [ebp - 0x48], eax
mov eax, 0x101
call fcn.004466a4
mov dword [ebp - 0x3c], eax
mov eax, 0x81
call fcn.004466a4
mov dword [ebp - 0x30], eax
mov eax, 0x81
call fcn.004466a4
mov dword [ebp - 0x28], eax
mov eax, 0x801
call fcn.004466a4
mov dword [ebp - 0x20], eax
mov eax, 0x801
call fcn.004466a4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x4c]
push eax
push SysReAllocStringLen
mov eax, dword [ebp - 4]
call fcn.00448770
push eax
mov eax, dword [ebp - 4]
call fcn.00448974
push eax
call sub.WININET.DLL_InternetCrackUrlA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4cc2a6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x48]
call fcn.0044868c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x3c]
call fcn.0044868c
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0x20]
call fcn.0044868c
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x30]
call fcn.0044868c
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x28]
call fcn.0044868c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
call fcn.0044868c
mov eax, dword [ebp + 8]
mov dx, word [ebp - 0x34]
mov word [eax], dx
mov eax, dword [ebp - 0x18]
call fcn.004466c0
mov eax, dword [ebp - 0x20]
call fcn.004466c0
mov eax, dword [ebp - 0x28]
call fcn.004466c0
mov eax, dword [ebp - 0x30]
call fcn.004466c0
mov eax, dword [ebp - 0x3c]
call fcn.004466c0
mov eax, dword [ebp - 0x48]
call fcn.004466c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc2f3
lea eax, [ebp - 4]
call fcn.00448494
ret

Function at 0x4cd2a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x4cd2d1
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x4cd2de
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4cd2fc
cld
pop edi
pop esi
xor ecx, ecx
mov cl, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x104]
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret