joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e000
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
add ebx, 0x84
movzx edx, byte [ebx - 1]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx - 4]
shl eax, 0x18
mov ecx, eax
movzx eax, byte [ebx - 3]
shl eax, 0x10
add eax, ecx
add edx, eax
movzx eax, byte [ebx - 2]
shl eax, 8
add edx, eax
mov dword [esp + 0x10], edx
je 0x45e113
xor esi, esi
jmp 0x45e070
add esi, 1
add ebx, 0xc
cmp dword [esp + 0x10], esi
je 0x45e113
movzx eax, byte [ebx]
movzx ebp, byte [ebx + 7]
shl eax, 0x18
mov ecx, eax
movzx eax, byte [ebx + 1]
shl eax, 0x10
add eax, ecx
movzx ecx, byte [ebx + 3]
add eax, ecx
movzx ecx, byte [ebx + 2]
shl ecx, 8
lea ecx, [eax + ecx]
movzx eax, byte [ebx + 4]
shl eax, 0x18
mov edx, eax
movzx eax, byte [ebx + 5]
shl eax, 0x10
add eax, edx
movzx edx, byte [ebx + 8]
add ebp, eax
movzx eax, byte [ebx + 6]
shl edx, 0x18
shl eax, 8
lea eax, [ebp + eax]
mov ebp, edx
movzx edx, byte [ebx + 9]
shl edx, 0x10
add edx, ebp
movzx ebp, byte [ebx + 0xb]
add edx, ebp
movzx ebp, byte [ebx + 0xa]
shl ebp, 8
add edx, ebp
cmp eax, edi
ja 0x45e120
mov ebp, edi
sub ebp, eax
cmp edx, ebp
ja 0x45e120
test al, 3
je 0x45e060
mov dword [esp], ecx
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], str.ICC_profile_tag_start_not_a_multiple_of_4
add esi, 1
add ebx, 0xc
call fcn.0045c0c0
cmp dword [esp + 0x10], esi
jne 0x45e070
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], str.ICC_profile_tag_outside_profile
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0045c0c0
Function at 0x460d40
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x460d66
mov edx, dword [eax + 0x40]
test edx, edx
je 0x460d66
mov eax, dword [eax + 0x44]
test eax, eax
je 0x460d66
mov ecx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x46e5e0
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
cmp byte [eax + 0x158], 0
je 0x46e60d
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x46e60d
mov ecx, dword [eax + 0x84]
cmp byte [ecx], 0
js 0x46e620
mov byte [eax + 0x158], 0
add eax, 0x84
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp fcn.00482580
mov dword [eax + 0x9c], str.invalid_window_size__libpng_
mov eax, 0xfffffffd
ret

Function at 0x46e9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
mov eax, dword [ebx + 0x74]
test al, 1
jne 0x46eb96
cmp dword [esp + 0x78], 0xd
jne 0x46eb86
lea esi, [esp + 0x43]
or eax, 1
mov dword [ebx + 0x74], eax
mov dword [esp + 8], 0xd
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0046e300
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0046e400
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0046e140
mov esi, eax
lea eax, [esp + 0x47]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0046e140
movzx ecx, byte [esp + 0x4d]
movzx edx, byte [esp + 0x4b]
mov edi, eax
movzx ebp, byte [esp + 0x4c]
mov dword [ebx + 0x100], esi
mov dword [ebx + 0x104], edi
mov dword [esp + 0x34], ecx
movzx ecx, byte [esp + 0x4e]
mov eax, edx
mov dword [esp + 0x30], edx
mov edx, ebp
mov byte [ebx + 0x150], al
cmp dl, 4
mov byte [ebx + 0x14f], dl
mov dword [esp + 0x38], ecx
movzx ecx, byte [esp + 0x4f]
mov dword [esp + 0x3c], ecx
movzx ecx, byte [esp + 0x4f]
mov byte [ebx + 0x14c], cl
movzx ecx, byte [esp + 0x4e]
mov byte [ebx + 0x254], cl
movzx ecx, byte [esp + 0x4d]
mov byte [ebx + 0x274], cl
je 0x46eb64
cmp dl, 6
je 0x46eb40
cmp dl, 2
je 0x46eb75
mov byte [ebx + 0x153], 1
mov edx, 1
imul eax, edx
cmp al, 7
mov byte [ebx + 0x152], al
ja 0x46eb59
movzx eax, al
imul eax, esi
add eax, 7
shr eax, 3
mov dword [ebx + 0x110], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
call fcn.00473870
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 4
mov byte [ebx + 0x153], 4
imul eax, edx
cmp al, 7
mov byte [ebx + 0x152], al
jbe 0x46eae5
shr al, 3
movzx eax, al
imul eax, esi
jmp 0x46eaf1
mov byte [ebx + 0x153], 2
mov edx, 2
jmp 0x46ead8
mov byte [ebx + 0x153], 3
mov edx, 3
jmp 0x46ead8
mov dword [esp + 4], str.invalid
mov dword [esp], ebx
call fcn.00460e60
mov dword [esp + 4], str.out_of_place
mov dword [esp], ebx
call fcn.00460e60
lea esi, [esi]
lea edi, [edi]
Function at 0x46ee90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov eax, dword [ebx + 0x74]
and eax, 5
cmp eax, 5
jne 0x46eed8
or dword [ebx + 0x74], 0x18
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0046e400
test esi, esi
jne 0x46eec2
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], str.invalid
add esp, 0x14
pop ebx
pop esi
jmp fcn.00460eb0
mov dword [esp + 4], str.out_of_place
mov dword [esp], ebx
call fcn.00460e60
nop
lea esi, [esi]

Function at 0x46eef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov eax, dword [ebx + 0x74]
test al, 1
je 0x46efb3
test al, 6
jne 0x46ef33
cmp edx, 4
je 0x46ef55
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0046e400
mov dword [esp + 4], str.invalid
mov dword [esp], ebx
call fcn.00460eb0
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0046e400
mov dword [esp], ebx
mov dword [esp + 4], str.out_of_place
call fcn.00460eb0
add esp, 0x24
pop ebx
pop esi
ret
lea esi, [esp + 0x1c]
mov dword [esp + 8], 4
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.0046e300
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0046e400
test eax, eax
jne 0x46ef2d
mov eax, esi
call fcn.0046e110
mov dword [esp + 8], eax
lea eax, [ebx + 0x2c4]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045d910
mov eax, dword [esp + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045da40
jmp 0x46ef2d
mov dword [esp + 4], str.missing_IHDR
mov dword [esp], ebx
call fcn.00460e60
lea esi, [esi]
lea edi, [edi]
Function at 0x46efd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov eax, dword [ebx + 0x74]
test al, 1
je 0x46f1d8
test al, 6
jne 0x46f111
test edi, edi
je 0x46f004
test byte [edi + 8], 2
jne 0x46f160
cmp byte [ebx + 0x14f], 3
je 0x46f184
movzx esi, byte [ebx + 0x153]
movzx edx, byte [ebx + 0x150]
cmp esi, ebp
jne 0x46f135
cmp ebp, 4
ja 0x46f135
lea ebp, [esp + 0x2c]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov byte [esp + 0x2f], dl
mov byte [esp + 0x2e], dl
mov dword [esp + 4], ebp
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2c], dl
mov byte [esp + 0x1f], dl
call fcn.0046e300
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0046e400
test eax, eax
jne 0x46f109
movzx eax, byte [esp + 0x2c]
test esi, esi
movzx edx, byte [esp + 0x1f]
mov byte [esp + 0x1f], al
je 0x46f0ba
test al, al
je 0x46f193
cmp dl, al
jb 0x46f193
lea eax, [esp + 0x2d]
add esi, ebp
jmp 0x46f0b6
movzx ecx, byte [eax]
add eax, 1
cmp dl, cl
jb 0x46f193
test cl, cl
je 0x46f193
cmp eax, esi
jne 0x46f0a0
test byte [ebx + 0x14f], 2
movzx eax, byte [esp + 0x1f]
je 0x46f1b0
mov byte [ebx + 0x1a4], al
movzx eax, byte [esp + 0x2d]
mov byte [ebx + 0x1a5], al
movzx eax, byte [esp + 0x2e]
mov byte [ebx + 0x1a6], al
movzx eax, byte [esp + 0x2f]
mov byte [ebx + 0x1a8], al
lea eax, [ebx + 0x1a4]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00474190
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.0046e400
mov dword [esp], ebx
mov dword [esp + 4], str.out_of_place
call fcn.00460eb0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov dword [esp + 4], str.invalid
call fcn.00460eb0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.0046e400
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.0046e400
mov dword [esp], ebx
mov dword [esp + 4], str.duplicate
call fcn.00460eb0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 8
mov esi, 3
jmp 0x46f01f
mov dword [esp + 4], str.invalid
mov dword [esp], ebx
call fcn.00460eb0
jmp 0x46f109
mov byte [ebx + 0x1a7], al
mov byte [ebx + 0x1a4], al
mov byte [ebx + 0x1a5], al
mov byte [ebx + 0x1a6], al
movzx eax, byte [esp + 0x2d]
mov byte [ebx + 0x1a8], al
jmp 0x46f0f3
mov dword [esp + 4], str.missing_IHDR
mov dword [esp], ebx
call fcn.00460e60
nop
lea esi, [esi]
Function at 0x46f1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov ebx, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
mov eax, dword [ebx + 0x74]
test al, 1
je 0x46f3fb
test al, 6
jne 0x46f240
cmp edx, 0x20
je 0x46f264
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0046e400
mov dword [esp + 4], str.invalid
mov dword [esp], ebx
call fcn.00460eb0
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0046e400
mov dword [esp], ebx
mov dword [esp + 4], str.out_of_place
call fcn.00460eb0
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x40]
mov dword [esp + 8], 0x20
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.0046e300
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0046e400
test eax, eax
jne 0x46f235
mov eax, esi
lea esi, [esp + 0x54]
call fcn.0046e110
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x44]
call fcn.0046e110
mov dword [esp + 0x3c], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x48]
call fcn.0046e110
mov ebp, eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x4c]
call fcn.0046e110
mov edi, eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x50]
call fcn.0046e110
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], eax
mov eax, esi
call fcn.0046e110
lea ecx, [esp + 0x58]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], eax
mov eax, ecx
call fcn.0046e110
lea ecx, [esp + 0x5c]
mov esi, eax
mov dword [esp + 0x30], eax
mov eax, ecx
call fcn.0046e110
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
cmp ecx, 0xffffffff
sete cl
cmp edx, 0xffffffff
sete dl
or ecx, edx
cmp ebp, 0xffffffff
sete dl
or ecx, edx
cmp edi, 0xffffffff
sete dl
or edx, ecx
cmp dword [esp + 0x10], 0xffffffff
sete cl
or edx, ecx
cmp dword [esp + 0x14], 0xffffffff
sete cl
or edx, ecx
cmp esi, 0xffffffff
sete cl
or dl, cl
jne 0x46f3a2
cmp eax, 0xffffffff
je 0x46f3a2
movzx eax, word [ebx + 0x30e]
test ax, ax
js 0x46f235
test al, 0x10
je 0x46f3b7
or ax, 0x8000
mov word [ebx + 0x30e], ax
mov eax, dword [esp + 0x84]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045da40
mov dword [esp + 4], str.duplicate
mov dword [esp], ebx
call fcn.00460eb0
jmp 0x46f235
mov dword [esp + 4], str.invalid_values
mov dword [esp], ebx
call fcn.00460eb0
jmp 0x46f235
or eax, 0x10
mov word [ebx + 0x30e], ax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], 1
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [ebx + 0x2c4]
mov dword [esp + 4], eax
call fcn.0045fdf0
mov eax, dword [esp + 0x84]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045da40
jmp 0x46f235
mov dword [esp + 4], str.missing_IHDR
mov dword [esp], ebx
call fcn.00460e60
nop
lea esi, [esi]
Function at 0x489870
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
cmp dword [eax + 0x14], 0xcc
je 0x4897ba
mov eax, dword [eax + 0x198]
mov dword [esp], ebx
call dword [eax]
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x14], 0xcc
mov eax, dword [ebx + 0x198]
cmp byte [eax + 8], 0
je 0x489841
mov eax, dword [ebx + 0x78]
lea esi, [ebx + 0x78]
jmp 0x48980e
mov edx, dword [ebx + 8]
mov edi, eax
test edx, edx
je 0x4897e7
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
mov dword [esp], ebx
call dword [edx]
mov edi, dword [ebx + 0x78]
mov eax, dword [ebx + 0x19c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [eax + 4]
mov eax, dword [ebx + 0x78]
cmp eax, edi
je 0x489860
mov ecx, dword [ebx + 0x60]
cmp ecx, eax
ja 0x4897d0
mov eax, dword [ebx + 0x198]
mov dword [esp], ebx
call dword [eax + 4]
mov eax, dword [ebx + 0x198]
mov dword [esp], ebx
call dword [eax]
mov edx, dword [ebx + 0x198]
mov dword [ebx + 0x78], 0
xor eax, eax
cmp byte [edx + 8], 0
jne 0x48980e
cmp byte [ebx + 0x41], 1
sbb eax, eax
add eax, 0xce
mov dword [ebx + 0x14], eax
mov eax, 1
jmp 0x489862
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
je 0x4898b0
cmp eax, 0xcb
je 0x4898c9
cmp eax, 0xcc
je 0x4898a3
mov edx, dword [ebx]
mov dword [edx + 0x18], eax
mov eax, dword [ebx]
mov dword [edx + 0x14], 0x15
mov dword [esp], ebx
call dword [eax]
add esp, 0x18
mov eax, ebx
pop ebx
jmp 0x489790
mov dword [esp], ebx
call fcn.0048dd00
cmp byte [ebx + 0x40], 0
jne 0x489950
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x489930
mov edx, dword [ebx + 8]
nop
lea esi, [esi]
test edx, edx
je 0x4898e9
mov dword [esp], ebx
call dword [edx]
mov eax, dword [ebx + 0x1a8]
mov dword [esp], ebx
call dword [eax]
test eax, eax
je 0x489944
cmp eax, 2
je 0x489930
mov edx, dword [ebx + 8]
test edx, edx
je 0x4898e9
and eax, 0xfffffffd
cmp eax, 1
jne 0x4898e0
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
add eax, 1
cmp eax, ecx
mov dword [edx + 4], eax
jl 0x4898e0
add ecx, dword [ebx + 0x128]
test edx, edx
mov dword [edx + 8], ecx
jne 0x4898e4
jmp 0x4898e9
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x84], eax
add esp, 0x18
mov eax, ebx
pop ebx
jmp 0x489790
xor eax, eax
add esp, 0x18
pop ebx
ret
mov dword [ebx + 0x14], 0xcf
mov eax, 1
jmp 0x489946
Function at 0x4915f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x30]
mov eax, dword [ebp + 4]
mov dword [esp + 8], 0x2c
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax]
cmp dword [ebp + 0x64], 3
mov dword [ebp + 0x1c0], eax
mov esi, eax
mov dword [eax], 0x490310
mov dword [eax + 0xc], 0x490300
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
je 0x49164b
mov eax, dword [ebp]
mov dword [eax + 0x14], 0x30
mov dword [esp], ebp
call dword [eax]
mov eax, dword [ebp + 4]
xor edi, edi
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax]
mov dword [esi + 0x18], eax
mov ebx, eax
ret
jmp 0x491673
mov ebx, dword [esi + 0x18]
mov eax, dword [ebp + 4]
add ebx, edi
add edi, 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax + 4]
cmp edi, 0x80
mov dword [ebx], eax
jne 0x491670
mov byte [esi + 0x1c], 1
cmp byte [ebp + 0x5a], 0
je 0x491704
mov ebx, dword [ebp + 0x54]
cmp ebx, 7
jle 0x491749
cmp ebx, 0x100
jle 0x4916d2
mov eax, dword [ebp]
mov dword [eax + 0x14], 0x3b
mov dword [eax + 0x18], 0x100
mov eax, dword [ebp]
mov dword [esp], ebp
call dword [eax]
mov eax, dword [ebp + 4]
mov dword [esp + 0xc], 3
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], ebp
call dword [eax + 8]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x4c]
mov dword [esi + 0x14], ebx
test eax, eax
jne 0x491712
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x4c]
mov dword [esi + 0x10], 0
test eax, eax
je 0x4916fc
mov eax, dword [ebp + 0x5c]
mov edx, dword [ebp + 4]
mov dword [ebp + 0x4c], 2
mov dword [esp], ebp
mov dword [esp + 4], 1
lea eax, [eax + eax*2]
lea eax, [eax + eax + 0xc]
mov dword [esp + 8], eax
call dword [edx + 4]
mov dword [esi + 0x20], eax
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00490240
mov eax, dword [ebp]
mov dword [eax + 0x14], 0x3a
mov dword [eax + 0x18], 8
mov eax, dword [ebp]
mov dword [esp], ebp
call dword [eax]
jmp 0x4916d2
Function at 0x4926b0
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x30]
mov dword [esi + 4], 0
mov dword [esp], esi
call fcn.00492880
mov dword [esp + 4], 0x54
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call fcn.00492810
test eax, eax
mov ebx, eax
je 0x4927e0
mov eax, dword [esp + 0x1c]
mov dword [ebx], fcn.004919f0
mov dword [ebx + 4], fcn.00492200
mov dword [ebx + 8], fcn.004923a0
mov dword [ebx + 0xc], fcn.004922d0
mov dword [ebx + 0x10], 0x491bf0
mov dword [ebx + 0x14], 0x491b70
mov dword [ebx + 0x18], 0x492470
mov dword [ebx + 0x1c], 0x492000
mov dword [ebx + 0x20], 0x491e00
mov dword [ebx + 0x24], fcn.00491c70
mov dword [ebx + 0x28], 0x491da0
mov dword [ebx + 0x30], 0x3b9aca00
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
mov dword [esp], 0x664300
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4927c6
lea edx, [esp + 0x1b]
mov dword [esp + 4], str._ld_c
mov dword [esp], eax
mov byte [esp + 0x1b], 0x78
mov dword [esp + 0xc], edx
lea edx, [esp + 0x1c]
mov dword [esp + 8], edx
call sub.msvcrt.dll_sscanf
test eax, eax
jle 0x4927c6
movzx eax, byte [esp + 0x1b]
and eax, 0xffffffdf
cmp al, 0x4d
je 0x4927d0
mov eax, dword [esp + 0x1c]
imul eax, eax, 0x3e8
mov dword [ebx + 0x2c], eax
add esp, 0x24
pop ebx
pop esi
ret
imul eax, dword [esp + 0x1c], 0x3e8
jmp 0x4927bd
mov dword [esp], esi
call fcn.00492890
mov eax, dword [esi]
mov dword [eax + 0x14], 0x38
mov dword [eax + 0x18], 0
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
jmp 0x4926e6
Function at 0x4a3720
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [esp], 0x61cc40
call fcn.004a8c20
test eax, eax
jne 0x4a371a
mov eax, dword [0x74c908]
test eax, eax
je 0x4a367b
mov dword [esp + 4], 0x74c520
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4a3700
mov dword [esp + 8], 0x1ae
mov dword [esp + 4], ebx
mov dword [esp], 0x74ca20
call sub.msvcrt.dll_strncpy
mov byte [0x74cbce], 0
mov dword [0x74cbd0], 0
mov dword [esp + 4], 2
mov dword [esp], 0x4a3720
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov eax, dword [0x74cbd0]
sub esp, 8
test eax, eax
jne 0x4a36e0
mov dword [esp], 0x61cc40
call fcn.004a8d10
test eax, eax
jne 0x4a371a
mov eax, dword [0x74cbd0]
add esp, 0x18
pop ebx
ret
mov dword [esp + 4], ebx
mov dword [esp], 0x74c520
mov dword [0x74c908], eax
call sub.msvcrt.dll_strcpy
jmp 0x4a36c5
mov dword [esp], 0x61cc40
call fcn.004a8d10
test eax, eax
jne 0x4a371a
mov eax, dword [0x74c908]
add esp, 0x18
pop ebx
ret
call sub.msvcrt.dll_abort
nop
push edi
push esi
push ebx
sub esp, 0xc0
lea eax, [esp + 0x10]
lea ebx, [esp + 0x14]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov eax, dword [esp + 0xd0]
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov dword [esp + 0xc], 0x55
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1001
mov dword [esp], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call edi
sub esp, 0x10
test eax, eax
jne 0x4a3785
mov eax, 1
add esp, 0xc0
pop ebx
pop esi
pop edi
ret 4
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4a3787
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
mov eax, 0x5f
sbb edx, 3
sub edx, ebx
mov word [ebx + edx], ax
lea eax, [ebx + edx + 1]
mov dword [esp + 0xc], 0x55
mov dword [esp + 4], 0x1002
mov dword [esp], esi
mov dword [esp + 8], eax
call edi
sub esp, 0x10
test eax, eax
je 0x4a3774
mov edi, ebx
mov edx, dword [edi]
add edi, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4a37e8
mov edx, eax
mov dword [esp + 4], 0x74ca20
mov dword [esp], ebx
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [edi + 2]
mov ecx, eax
cmove edi, edx
add cl, al
sbb edi, 3
sub edi, ebx
mov dword [esp + 8], edi
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x4a3774
movzx edx, byte [edi + 0x74ca20]
cmp dl, 0x2e
je 0x4a384a
test dl, dl
jne 0x4a3774
mov dword [0x74cbd0], esi
jmp 0x4a3779
Function at 0x4a4bc0
Capabilities:
Get geographical location
Query environment variable

Disassembly:
movzx eax, word [esp + 4]
mov dword [esp + 4], eax
jmp fcn.004a38d0

Function at 0x4a4bf0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp], str.LC_ALL
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a4c08
cmp byte [eax], 0
jne 0x4a4c38
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a4c1d
cmp byte [eax], 0
jne 0x4a4c38
mov dword [esp], str.LANG
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a4c3c
cmp byte [eax], 0
mov edx, 0
cmove eax, edx
add esp, 0x1c
ret
xor eax, eax
jmp 0x4a4c38

Function at 0x4a4c40
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
cmp ebx, 5
ja 0x4a4c6b
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.004deec0
call fcn.004a3640
test eax, eax
jne 0x4a4c90
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004a4bf0
test eax, eax
mov ebx, eax
je 0x4a4ca1
call fcn.004a3640
test eax, eax
jne 0x4a4c90
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
movzx eax, ax
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp fcn.004a38d0
xor ebx, ebx
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x4a4d10
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov edi, edx
push ebx
mov esi, ecx
mov ebx, eax
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp], 0x22
call sub.msvcrt.dll_putc
cmp edi, esi
jne 0x4a4d4d
jmp 0x4a4dc4
cmp al, 0x22
je 0x4a4da0
cmp al, 0x5c
je 0x4a4da0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_putc
cmp esi, edi
je 0x4a4dc4
add edi, 1
movsx eax, byte [edi - 1]
cmp al, 0xa
jne 0x4a4d35
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x668bc8
call sub.msvcrt.dll_fwrite
cmp esi, edi
je 0x4a4dd4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x668bcc
call sub.msvcrt.dll_fwrite
jmp 0x4a4d4d
mov dword [esp + 4], ebx
mov dword [esp], 0x5c
call sub.msvcrt.dll_putc
movsx eax, byte [edi - 1]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_putc
cmp esi, edi
jne 0x4a4d4d
mov dword [esp + 4], ebx
mov dword [esp], 0x22
call sub.msvcrt.dll_putc
add esp, 0x10
pop ebx
pop esi
pop edi
ret