joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448098
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x448243
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x448224
mov dl, 1
mov eax, dword [0x46a078]
call fcn.0047efbc
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.0047fa5c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x448213
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045d050
test al, al
je 0x448206
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x448254
lea eax, [ebp - 0x254]
call fcn.00478c6c
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x448206
xor eax, eax
push ebp
push 0x4481ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44828c
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4481e8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.0047fc8c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x4481e8
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.0047fc8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448206
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x448109
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0046d0f8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44824a
lea eax, [ebp - 0x260]
call fcn.0047fa5c
ret

Function at 0x448ad8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4af11c]
cmp byte [eax + 0x95], 0
jne 0x448b49
cmp dword [0x4af138], 0
jne 0x448b0a
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x448a94
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4af138], eax
cmp dword [0x4af134], 0
jne 0x448b25
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x4af134], eax
cmp dword [0x4af13c], 0
jne 0x448b49
push esp
push 0
push 0
push 0x448a38
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4af13c], eax
pop edx
ret
Function at 0x448c40
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x448c57
add esp, 0xfffffff0
call fcn.0047f2ec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004700b4
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x469d3c]
call fcn.0047efbc
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x469d3c]
call fcn.0047efbc
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x435984]
call fcn.0043d964
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x448dcc
mov eax, dword [0x4aee38]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0043dd34
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a7f0
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4aee38]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0047b484
test eax, eax
je 0x448d4a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004785cc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0047b4ac
test eax, eax
je 0x448d5e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.0047fc8c
mov eax, dword [0x4aee3c]
cmp byte [eax], 0
jne 0x448d8f
mov eax, ebx
call fcn.00448eb8
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x448dc1
call fcn.0047f344
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449128
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4af11c]
cmp dword [eax + 0x24], 0
je 0x4491cb
cmp dword [ebx + 0x84], 0
jne 0x4491c5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4490b8
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x4491c5
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x44918e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4491c5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0046b438
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44919d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x449bd8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x449c0d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0047fb44
jmp 0x449c17
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.0047fab0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44ab64
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x44ab9c
mov eax, esi
call fcn.00458dc4
test al, al
je 0x44ab9c
mov eax, dword [ebx + 0x74]
call fcn.00458ac8
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x44ab9c
push 0
mov eax, dword [ebx + 0x74]
call fcn.00458ac8
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x450660
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x4af1b8], 0
sete dl
or al, dl
jne 0x4507a0
mov eax, dword [0x4af1bc]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4af1b8]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x45076f
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x4af1b8]
call fcn.0046b438
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x450767
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x450767
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x450767
mov eax, dword [ebp - 0x14]
call fcn.00458ac8
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x450767
push ebp
call fcn.0045061c
pop ecx
test al, al
jne 0x450767
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x450723
mov eax, dword [ebp - 0x14]
call fcn.00457370
dec eax
jle 0x450767
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.0047f1c8
cmp byte [ebp - 1], 0
je 0x450767
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x450767
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4af1bc]
call fcn.0044fe68
inc edi
dec esi
jne 0x4506b6
mov eax, dword [0x4af1bc]
cmp dword [eax + 8], 0
jle 0x450787
mov eax, dword [0x4af1bc]
call fcn.0044fef8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4507a0
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00450484
pop ecx
test al, al
jne 0x4507a0
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45637c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x4563ad
je 0x456407
sub eax, 7
je 0x4563ce
dec eax
je 0x4563f8
sub eax, 0x17
je 0x4564ac
jmp 0x4564ea
add eax, 0xffffff00
sub eax, 9
jb 0x456498
add eax, 0xffffff09
sub eax, 0xb
jb 0x456460
jmp 0x4564ea
mov eax, ebx
call fcn.00441794
mov edi, eax
test edi, edi
je 0x45654a
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x456553
jmp 0x45654a
test byte [ebx + 0x44], 0x20
jne 0x456553
jmp 0x45654a
mov edx, esi
mov eax, ebx
call fcn.00453934
cmp dword [esi + 0xc], 0xffffffff
jne 0x456553
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00473dc0
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00452468
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00456254
test eax, eax
je 0x456553
mov dword [esi + 0xc], 1
jmp 0x456553
mov edx, esi
mov eax, ebx
call fcn.004562e8
test al, al
je 0x45654a
cmp dword [esi + 0xc], 0
jne 0x456553
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00458ac8
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x456553
mov eax, ebx
call fcn.00452fd0
test al, al
jne 0x456553
jmp 0x45654a
mov eax, ebx
call fcn.00458ac8
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x45654a
cmp dword [0x4aa064], 0
je 0x45654a
mov eax, dword [0x4aa064]
cmp ebx, dword [eax + 0x24]
jne 0x45654a
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4aa064]
call fcn.00453868
jmp 0x45654a
mov eax, dword [0x4af180]
cmp byte [eax + 0x20], 0
je 0x45654a
mov eax, dword [0x4af180]
cmp dword [eax + 0x1c], 0
je 0x45654a
mov eax, dword [esi]
mov edx, dword [0x4af180]
cmp eax, dword [edx + 0x1c]
jne 0x45654a
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.004416d8
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.0047f1c8
jmp 0x456553
mov edx, esi
mov eax, ebx
call fcn.00453934
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456a14
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x456a30
cmp dword [esi + 4], 0
je 0x456a5d
test byte [ebx + 0x45], 1
jne 0x456a4f
mov eax, ebx
call fcn.0045594c
test eax, eax
jne 0x456a4f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x456b6d
mov edx, esi
mov eax, ebx
call fcn.0045668c
jmp 0x456b6d
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x456b66
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00458ac8
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00453868
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00456a14
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00458ac8
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456b6d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460a4c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x460b24
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4af204], 0
jne 0x460b08
lea eax, [ebp - 4]
mov edx, 0x460b3c
call fcn.0047faf4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0047fea0
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x460b08
mov eax, ebx
call fcn.0047e69c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x460b01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x460aeb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x460b4c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x460aeb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4af204], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460b08
mov eax, dword [ebp - 0xc]
call fcn.0047e6b4
ret
mov ebx, dword [0x4af204]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460b2b
lea eax, [ebp - 4]
call fcn.0047fa5c
ret

Function at 0x468cc4
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4af228], 0
jne 0x468ce7
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x468c48
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4af228], eax
ret
Function at 0x47511c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x474068]
call fcn.004802dc
xor eax, eax
push ebp
push 0x475263
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4aa288], 0
jne 0x47516f
mov ecx, dword [0x4aeee8]
mov dl, 1
mov eax, dword [0x476b74]
call fcn.0047a754
call fcn.0047f724
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0047ec9c
mov eax, ebx
call fcn.004801e0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x475274
lea edi, [ebp - 0x30]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00481c14
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004801f0
test eax, eax
jle 0x47520a
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x475203
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0047fca4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0047fc8c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00477900
test eax, eax
jne 0x475203
mov ebx, 0x15
jmp 0x47520f
mov ebx, 0x10
jmp 0x47520f
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4aa288]
call fcn.00475074
mov eax, dword [ebp - 8]
call fcn.00475074
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00481c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47526a
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0047fa80
lea eax, [ebp - 0x10]
mov edx, dword [0x474068]
call fcn.004803a8
ret

Function at 0x47809c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0047fea0
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
pop ebx
ret

Function at 0x4780b0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0047fea0
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x4780d2
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x479e98
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x479ed1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0047fb44
jmp 0x479eda
mov eax, ebx
mov edx, esi
call fcn.0047fab0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x479ee4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x479f05
mov al, byte [esp]
jmp 0x479f07
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x47e82c
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x47e869
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call sub.KERNEL32.DLL_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x47e889
lea eax, [esp + 0x108]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.0047fc8c
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x47ea48
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x47ea77
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0047fb44
jmp 0x47ea95
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0047e970
mov edi, eax
test ebx, ebx
je 0x47ea95
cmp dword [esi], 0
je 0x47ea95
dec ebx
jmp 0x47ea7e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x47ee60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4aa524]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x47eef8
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x47eed8
xor eax, eax
push ebp
push 0x47eed1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x47ef14
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47eed8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4aa524]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4aa524], ax
mov esp, ebp
pop ebp
ret
Function at 0x481824
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4819e0
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x481885
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4819fc
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4818f7
xor eax, eax
push ebp
push 0x4818f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0048167c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4818d9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x481a1c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4818f7
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4819d8
cmp byte [ebp - 0xd], 0
jne 0x481939
cmp byte [ebp - 0x12], 0
je 0x4819d8
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x481952
dec ebx
cmp byte [ebx], 0x2e
je 0x481961
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x481951
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4819d8
inc ebx
cmp byte [ebp - 0x12], 0
je 0x48198e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4819d8
cmp byte [ebp - 0xd], 0
je 0x4819d8
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4819d8
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret