joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422530
Capabilities:
Set current directory

Disassembly:
sub esp, 0x204
mov eax, dword [0x4e86e0]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
mov esi, ecx
push str.Win9x_hCreateServiceHandle_n
push esi
call fcn.00421b50
lea eax, [esi + 0xb10]
push eax
push str.._s.vxd
lea ecx, [esp + 0x20]
push 0x200
push ecx
xor ebx, ebx
call fcn.00437120
add esp, 0x18
lea edi, [esi + 0x610]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
lea edx, [esp + 0x14]
push edx
push str.Win9x_hCreateServiceHandle_service___s__path___s__n
push esi
call fcn.00421b50
add esp, 0x10
push ebx
push 0x4000000
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4225d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebx, eax
push ebx
push str.Win9x_hCreateServiceHandle_CreateFile_error___d__handle___X_n
push esi
call fcn.00421b50
add esp, 0x10
add esi, 4
push esi
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00490dce
add esp, 0x204
ret 4

Function at 0x422740
Capabilities:
Create service

Disassembly:
sub esp, 0x204
mov eax, dword [0x4e86e0]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x610]
push eax
lea ecx, [esp + 0x14]
push 0x200
push ecx
xor ebx, ebx
call fcn.004917bc
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x422783
sub eax, edx
cmp byte [esp + eax + 0xf], 0x5c
lea eax, [esp + eax + 0x10]
je 0x42279f
mov byte [eax], 0x5c
mov byte [eax + 1], bl
lea edx, [esi + 0xa10]
push edx
lea eax, [esp + 0x14]
push 0x200
push eax
call fcn.00437060
push str.WinNT_bCreateService_n
push esi
call fcn.00421b50
lea ecx, [esp + 0x24]
push ecx
push str.szDestName___s_n
push esi
call fcn.00421b50
add esp, 0x20
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 1
push 3
push 1
push 0xf01ff
lea eax, [esi + 0xb10]
push eax
push eax
mov eax, dword [esi + 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x42283b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.CreateService_failed__error_code___d_n
push esi
call fcn.00421b50
mov eax, ebx
add esp, 0xc
sub eax, 5
je 0x422830
sub eax, 0x42b
je 0x422830
sub eax, 1
je 0x422834
xor edi, edi
jmp 0x42285f
mov edi, 1
jmp 0x42285f
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x42285f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.WinNT_bCreateService_:_CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
pop esi
mov dword [ebp], ebx
pop ebp
pop ebx
xor ecx, esp
call fcn.00490dce
add esp, 0x204
ret 4
Function at 0x422880
Capabilities:
Delete service

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push str.WinNT_dwDeleteService_n
push esi
xor edi, edi
call fcn.00421b50
mov ecx, dword [esi + 0x208]
add esp, 8
push 0xf01ff
lea eax, [esi + 0xb10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x4228d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.WinNT_dwDeleteService_:_Openservice_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4228f6
call ebp
mov edi, eax
push edi
push str.WinNT_dwDeleteService_:_DeleteService_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x422914
call ebp
mov edi, eax
push edi
push str.WinNT_dwDeleteService_:_CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x422920
Capabilities:
Start service

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push str.WinNT_bStartService_n
push edi
call fcn.00421b50
mov ecx, dword [edi + 0x208]
add esp, 8
push 0xf01ff
lea eax, [edi + 0xb10]
push eax
push ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x422973
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.OpenService_failed__error_code___d_n
push edi
call fcn.00421b50
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
push ebp
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4229b2
call ebp
mov esi, eax
push esi
push str.StartService_failed__error_code___d_n
push edi
call fcn.00421b50
add esp, 0xc
cmp esi, 0x420
ja 0x4229b2
je 0x4229b2
mov eax, esi
sub eax, 2
je 0x4229b2
sub eax, 0x23f
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
test ebx, ebx
jne 0x4229d2
call ebp
mov esi, eax
push esi
push str.WinNT_bStartService_:_CloseServiceHandle_failed__errorcode___d_n
push edi
call fcn.00421b50
add esp, 0xc
mov edx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [edx], esi
pop esi
mov eax, ebx
pop ebx
ret 4
Function at 0x4229f0
Capabilities:
Continue service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
push str.WinNT_dwStopService_n
push esi
xor ebp, ebp
call fcn.00421b50
mov ecx, dword [esi + 0x208]
add esp, 8
push 0xf01ff
lea eax, [esi + 0xb10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x422a49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.WinNT_dwStopService_:_OpenService_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea edx, [esp + 0x10]
push edx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [esp + 0x14], 3
mov edi, eax
jne 0x422a96
mov eax, dword [esi + 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
mov dword [esi + 0x204], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push edi
push str.WinNT_dwStopService_:_ControlService_failed__pending__result___d_n
push esi
call fcn.00421b50
add esp, 0xc
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x422ab3
call edi
mov ebp, eax
push ebp
push str.WinNT_dwStopService_:_ControlService_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x422ad1
call edi
mov ebp, eax
push ebp
push str.WinNT_dwStopService_:_CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x422b60
Capabilities:
Get hostname

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
push str.WinNT_bInstallDriver_n
push esi
call fcn.00421b50
add esp, 8
lea eax, [esp + 0x10]
push eax
lea edi, [esi + 0x210]
push edi
xor ebx, ebx
mov dword [esp + 0x18], 0x200
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
push str.szMachineName___s_n
push esi
call fcn.00421b50
add esp, 0xc
cmp byte [edi], bl
je 0x422ba7
mov ebx, edi
push 0xf003f
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [esi + 0x208], eax
jne 0x422be7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.OpenSCManager_failed__error_code___d_n
push esi
call fcn.00421b50
mov ecx, dword [esp + 0x24]
add esp, 0xc
mov dword [ecx], edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
cmp dword [esi + 0x20c], 0
je 0x422c49
cmp dword [esi + 0xb5c], 0
je 0x422c02
mov edx, dword [esi + 0xd7c]
push edx
jmp 0x422c1b
cmp dword [esi + 0xb60], 0
je 0x422c14
mov eax, dword [esi + 0xd80]
push eax
jmp 0x422c1b
mov ecx, dword [esi + 0xd78]
push ecx
mov ecx, esi
call fcn.00423220
test eax, eax
jne 0x422c49
push str.Unable_to_extract_driver_file_n
push esi
call fcn.00421b50
mov edx, dword [esp + 0x20]
add esp, 8
pop edi
pop esi
mov dword [edx], 0x5001
xor eax, eax
pop ebx
add esp, 8
ret 4
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00422740
mov edi, eax
test edi, edi
je 0x422c74
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00422920
mov edi, eax
test edi, edi
jne 0x422c74
mov ecx, esi
call fcn.00422880
mov eax, dword [esi + 0x208]
test eax, eax
je 0x422ca4
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x422ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push str.WinNT_bInstallDriver_:_CloseServiceHandle_failed__errorcode___d_n
push esi
call fcn.00421b50
add esp, 0xc
jmp 0x422ca8
mov ebx, dword [esp + 0xc]
cmp dword [esi + 0x20c], 0
je 0x422cb8
mov ecx, esi
call fcn.00422df0
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
mov dword [edx], ebx
pop ebx
add esp, 8
ret 4

Function at 0x422df0
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x204
mov eax, dword [0x4e86e0]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push esi
push edi
mov esi, ecx
lea eax, [esi + 0xa10]
push eax
lea edi, [esi + 0x610]
push edi
push str._s_s
lea ecx, [esp + 0x18]
push 0x200
push ecx
call fcn.00437120
add esp, 0x14
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, edi
lea ebx, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x422e40
lea edx, [esi + 0x410]
sub ecx, ebx
lea esi, [edx + 1]
mov bl, byte [edx]
add edx, 1
test bl, bl
jne 0x422e54
sub edx, esi
cmp ecx, edx
jbe 0x422e6a
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00490dce
add esp, 0x204
ret
Function at 0x437880
Capabilities:
Check os version

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x4e86e0]
xor eax, esp
mov dword [esp + 0x29c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2b8]
push edi
push 0x9c
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, ecx
call fcn.00491b30
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x9c
call edi
test eax, eax
jne 0x4378f1
push 0x94
push eax
lea edx, [esp + 0x18]
push edx
call fcn.00491b30
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x94
call edi
push esi
lea ecx, [esp + 0xb0]
push 0x200
push ecx
call fcn.00437120
mov eax, dword [esp + 0x2c]
add esp, 0xc
sub eax, 1
je 0x437994
sub eax, 1
jne 0x4379ae
mov eax, dword [esp + 0x14]
cmp eax, 4
jbe 0x437965
cmp eax, 5
jne 0x437931
cmp dword [esp + 0x18], ebx
je 0x437965
push esi
push str.Global_s
lea edx, [esp + 0xb4]
push 0x200
push edx
call fcn.00437120
mov edx, dword [esp + 0x2c8]
add esp, 0x10
lea ecx, [esp + 0xac]
push ecx
push edx
mov ecx, ebp
call fcn.00436c80
jmp 0x4379b0
push esi
lea eax, [esp + 0xb0]
push 0x200
push eax
call fcn.00437120
mov edx, dword [esp + 0x2c4]
add esp, 0xc
lea ecx, [esp + 0xac]
push ecx
push edx
mov ecx, ebp
call fcn.00436c80
jmp 0x4379b0
mov ecx, dword [esp + 0x2b8]
lea eax, [esp + 0xac]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x4379b0
mov eax, ebx
mov ecx, dword [esp + 0x2ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00490dce
add esp, 0x2a0
ret 0xc
Function at 0x438030
Capabilities:
Get file version info

Disassembly:
sub esp, 0x58
mov eax, dword [0x4e86e0]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x64]
push edi
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x438186
push esi
push edi
call fcn.00482367
add esp, 4
mov esi, eax
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x43817c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x4bdd7c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x43817c
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x43815d
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 2]
movzx eax, word [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push edx
push eax
lea ecx, [esp + 0x2c]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x43810f
mov edx, dword [esp + 0x14]
push edx
lea eax, [ebx + 0x10]
push pe_nt_image_headers32
push eax
call fcn.00437120
add esp, 0xc
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x2c]
push str.StringFileInfo_04x_04xCompanyName
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x43815d
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [ebx + 0x110]
push pe_nt_image_headers32
push edx
call fcn.00437120
add esp, 0xc
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax + 0xa]
mov dword [ebx], ecx
movzx edx, word [eax + 8]
mov dword [ebx + 4], edx
movzx ecx, word [eax + 0xe]
mov dword [ebx + 8], ecx
movzx edx, word [eax + 0xc]
mov dword [ebx + 0xc], edx
push esi
call fcn.00482397
add esp, 4
pop esi
mov ecx, dword [esp + 0x60]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00490dce
add esp, 0x58
ret 8
Function at 0x441230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4aa0ef
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e86e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esi], vtable.K10_FIDVID_Control.0
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
xor edi, edi
lea ebp, [esi + 0x3c]
jmp 0x4412a0
push 0x10
call fcn.00482367
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x4412c7
lea ecx, [edi - 0x3ffeff9c]
push ecx
mov ecx, eax
call fcn.0043bab0
jmp 0x4412c9
xor eax, eax
mov dword [ebp], eax
add edi, 1
add ebp, 4
cmp edi, 5
mov byte [esp + 0x24], bl
jl 0x4412a0
push 0x10
call fcn.00482367
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 2
je 0x441300
push 0xc0010062
mov ecx, eax
call fcn.0043bab0
jmp 0x441302
xor eax, eax
push 0x10
mov byte [esp + 0x28], bl
mov dword [esi + 0x54], eax
call fcn.00482367
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 3
je 0x44132e
push 0xc0010063
mov ecx, eax
call fcn.0043bab0
jmp 0x441330
xor eax, eax
push 0x10
mov byte [esp + 0x28], bl
mov dword [esi + 0x50], eax
call fcn.00482367
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 4
je 0x44135c
push 0xc0010071
mov ecx, eax
call fcn.0043bab0
jmp 0x44135e
xor eax, eax
push 0x10
mov byte [esp + 0x28], bl
mov dword [esi + 0x2c], eax
call fcn.00482367
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 5
je 0x44138d
push 0xc0010070
mov ecx, eax
call fcn.0043bab0
mov dword [esi + 0x30], eax
jmp 0x441390
mov dword [esi + 0x30], ebx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x47f700
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
push str.rootwmi
mov ebx, ecx
call esi
push str.MSSmBios_RawSMBiosTables
mov ebp, eax
call esi
mov edi, eax
push 0x4c6cf4
mov dword [esp + 0x2c], edi
call esi
xor esi, esi
push 2
push esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x47f8aa
push esi
push 2
push esi
push 3
push 6
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, esi
jge 0x47f775
cmp eax, 0x80010119
jne 0x47f851
lea eax, [esp + 0x10]
push eax
push 0x4cb30c
push 1
push esi
push 0x4cb3cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x47f851
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push ebp
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x47f851
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push esi
push esi
push edi
push eax
mov eax, dword [ecx + 0x48]
call eax
test eax, eax
jl 0x47f851
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x20]
push edx
push 1
push 0xfa0
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [esp + 0x24], 1
jne 0x47f851
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push esi
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x2c]
push esi
push ecx
push eax
call edx
cmp word [esp + 0x30], 0x2011
jne 0x47f851
mov eax, dword [esp + 0x38]
mov edi, dword [eax + 0x10]
cmp edi, esi
je 0x47f851
cmp edi, 0x4000
jg 0x47f851
mov eax, dword [eax + 0xc]
mov ecx, dword [ebx + 0xc]
push edi
push eax
push ecx
call fcn.00492bf0
mov edx, dword [ebx + 0x10]
add esp, 0xc
mov word [edx + 6], di
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x47f865
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x47f879
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x47f88d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x28]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push eax
call esi
push ebp
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret
Function at 0x48516e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x4ae0a3
call fcn.004935ae
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00484376
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x4851b9
call fcn.00484376
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x4851ca
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x4851d7
or eax, 0xffffffff
jmp 0x485333
mov ecx, esi
call fcn.00484cc0
mov dword [ebp - 0x14], eax
call fcn.00487a03
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x485255
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x485255
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x485255
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00404d50
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x485255
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x485255
mov ecx, ebx
call fcn.00483329
test eax, eax
je 0x485255
push 0
mov ecx, ebx
call fcn.00483344
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.004893ca
push dword [ebp - 0x14]
call fcn.0048795b
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00484f76
xor edi, edi
cmp eax, edi
je 0x4852b2
test byte [esi + 0x3c], 0x10
je 0x48529c
push 4
pop edi
mov ecx, esi
call fcn.00483210
test ax, 0x100
je 0x485292
push 5
pop edi
push edi
mov ecx, esi
call fcn.00487523
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x4852b2
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004833ab
or dword [ebp - 4], 0xffffffff
jmp 0x4852dd
cmp dword [ebp - 0x28], edi
je 0x4852eb
push 1
mov ecx, ebx
call fcn.00483344
cmp dword [ebp - 0x2c], edi
je 0x4852fb
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x485314
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x485314
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00484cfa
cmp dword [esi + 0x58], edi
je 0x485330
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0049361a
ret
Function at 0x48898d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4889c6
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048447c
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00484457
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x48a4e7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x48a52a
call fcn.00484376
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x48a52a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x48a545
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0048a09e
test ebx, ebx
mov esi, eax
je 0x48a543
test edi, edi
je 0x48a543
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x48c1bf
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4e86e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x48c1ff
push 0x4c9168
push 4
push eax
call fcn.004917bc
push eax
call fcn.00414370
add esp, 0x10
jmp 0x48c211
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x48c27f
push edi
call fcn.0049371a
mov edi, dword [eax]
call fcn.0049371a
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00491bc6
add esp, 0x18
mov ebx, eax
call fcn.0049371a
cmp dword [eax], 0
je 0x48c25f
call fcn.0049371a
push dword [eax]
call fcn.00482493
pop ecx
jmp 0x48c266
call fcn.0049371a
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x48c27f
cmp ebx, esi
jae 0x48c27f
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x48c281
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00490dce
leave
ret