joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434a6c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x434a88
cmp dword [esi + 4], 0
je 0x434ab5
test byte [ebx + 0x55], 1
jne 0x434aa7
mov eax, ebx
call fcn.00433730
test eax, eax
jne 0x434aa7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x434bc5
mov edx, esi
mov eax, ebx
call fcn.0043458c
jmp 0x434bc5
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x434bbe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043683c
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043142c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00434a6c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043683c
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434bc5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43af18
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x487dc4]
cmp byte [eax + 0xc], 0
je 0x43b085
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43b07e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4887a0], 0
jne 0x43af6c
push 0x43b08c
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x43b094
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887a0], eax
cmp dword [0x4835c4], 0
jne 0x43b067
push 0x43b0a4
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x4835c4], eax
cmp dword [0x4835c4], 0
je 0x43b067
push 0x43b0b0
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887a4], eax
push 0x43b0c0
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887a8], eax
push 0x43b0d4
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887ac], eax
push 0x43b0ec
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887b0], eax
push 0x43b104
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887b4], eax
push 0x43b118
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887b8], eax
push 0x43b130
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887bc], eax
push 0x43b148
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887c0], eax
push 0x43b164
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887c4], eax
push 0x43b170
mov eax, dword [0x4835c4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4887c8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b085
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4488e4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00448768
dec esi
jne 0x448906
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x449a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4888c8
cmp dword [edi], 0
jne 0x449aac
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4888c4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x483618
mov ecx, 2
call fcn.0045b2b4
mov edx, 0x449a08
lea eax, [esi + 5]
call fcn.00449a28
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00449a28
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x449a81
mov dword [0x4888c4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x44e574
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x44e5ad
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0045ce48
jmp 0x44e5b6
mov eax, ebx
mov edx, esi
call fcn.0045cdac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x44e5c0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x44e5e1
mov al, byte [esp]
jmp 0x44e5e3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x44ec68
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x44eae0
mov eax, dword [0x487f88]
cmp byte [eax], 0
je 0x44ecd5
mov eax, dword [0x487f8c]
call fcn.0045b7bc
call fcn.0045b220
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0044c720
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x44ed1c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x44ed0b
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x487e40]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x488020]
call fcn.0045e4a4
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret
Function at 0x44f890
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x44f8f4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0045cfc0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0044c34c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f8fb
lea eax, [ebp - 0xc]
call fcn.0045cd58
ret

Function at 0x45b3e0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0045cd58
test esi, esi
jne 0x45b416
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0045ce48
jmp 0x45b434
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0045b2f4
mov edi, eax
test esi, esi
je 0x45b434
cmp dword [ebx], 0
je 0x45b434
dec esi
jmp 0x45b41d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x45be98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x483b58]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x45bf30
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x45bf10
xor eax, eax
push ebp
push 0x45bf09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x45bf4c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bf10
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x483b58]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x483b58], ax
mov esp, ebp
pop ebp
ret

Function at 0x45cb58
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x488bec], 0
je 0x45cbb9
cmp word [0x488dc0], 0xd7b2
jne 0x45cb81
cmp dword [0x488dc8], 0
jbe 0x45cb81
mov eax, 0x488dbc
call dword [0x488dd8]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x45cbe0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x483b68], 0
jne 0x45cbd5
push 0
push 0x483bc0
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x45cd0c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0045b050
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x488bed], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x45ccd4
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x45e698
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x45e8c8
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x45e71b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x45e8c8
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x45e71b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x45e8e4
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x45e7a4
xor eax, eax
push ebp
push 0x45e79d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0045e4e0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x45e782
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x45e904
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x45e782
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e7a4
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x45e8be
cmp byte [ebp - 0xd], 0
jne 0x45e7eb
cmp byte [ebp - 0x12], 0
je 0x45e8be
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x45e804
dec ebx
cmp byte [ebx], 0x2e
je 0x45e813
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x45e803
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x45e8be
inc ebx
cmp byte [ebp - 0x12], 0
je 0x45e850
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x45e8be
cmp byte [ebp - 0xd], 0
je 0x45e8be
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x45e8be
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f03c
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x489160], 1
jae 0x45f0c2
mov byte [0x483b54], 2
mov dword [0x488bb0], 0x47edc6
mov dword [0x488bb4], 0x47edde
mov byte [0x488bee], 2
mov dword [0x488b9c], 0x45dcc8
call fcn.0045be68
test al, al
je 0x45f07f
call fcn.0045be98
call fcn.0045bf5c
mov word [0x488bf4], 0xd7b0
mov word [0x488dc0], 0xd7b0
mov word [0x488f8c], 0xd7b0
call fcn.0045dba8
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x488be0], eax
call fcn.00459cec
mov dword [0x488bdc], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x488bd4], eax
ret

Function at 0x461230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x46124c
call fcn.004627c8
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x461268
test bl, 1
je 0x461268
call fcn.00466248
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4613b4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00462364
test byte [ebp + 0xd], 0xc0
jne 0x4613d8
mov eax, dword [0x484a64]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4613e5
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x461412
je 0x461424
sub ecx, 0x100
je 0x461432
sub ecx, 0x100
je 0x461439
sub ecx, 0x100
je 0x46142b
jmp 0x461440
sub ecx, 0x600
je 0x461439
sub ecx, 0x100
je 0x461424
jmp 0x461440
mov edi, 1
jmp 0x461445
mov edi, 2
jmp 0x461445
mov edi, 4
jmp 0x461445
mov edi, 5
jmp 0x461445
mov edi, 3
test byte [ebp + 0xd], 1
je 0x46146c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4844dc]
test al, 0x80
je 0x461465
mov ebx, 0x80
jmp 0x46147e
mov ebx, 1
jmp 0x46147e
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x46147e
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x461490
je 0x461499
dec eax
je 0x4614a2
jmp 0x4614ab
mov dword [ebp - 4], SysStringLen
jmp 0x4614ba
mov dword [ebp - 4], 0x40000000
jmp 0x4614ba
mov dword [ebp - 4], 0xc0000000
jmp 0x4614ba
push 1
call fcn.0046275c
pop ecx
mov ebx, eax
jmp 0x4615aa
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4614d6
sub eax, 0x10
je 0x4614dd
sub eax, 0x10
je 0x4614e6
sub eax, 0x10
je 0x4614ef
jmp 0x4614ef
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4614f6
mov dword [ebp - 8], 1
jmp 0x4614f6
mov dword [ebp - 8], 2
jmp 0x4614f6
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x461563
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x461558
test byte [ebp + 0xd], 1
je 0x461553
mov ebx, 0x50
jmp 0x461558
mov ebx, 2
push ebx
call fcn.0046275c
pop ecx
mov ebx, eax
jmp 0x4615aa
mov edi, esi
push edi
call fcn.00461318
pop ecx
test eax, eax
je 0x461577
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x461583
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00462484
add esp, 8
mov ebx, eax
inc eax
jne 0x4615aa
push 4
call fcn.0046275c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00462398
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46176c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00462364
test byte [ebp + 0xd], 0xc0
jne 0x461790
mov eax, dword [0x484a64]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x46179d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4617ca
je 0x4617dc
sub ecx, 0x100
je 0x4617ea
sub ecx, 0x100
je 0x4617f1
sub ecx, 0x100
je 0x4617e3
jmp 0x4617f8
sub ecx, 0x600
je 0x4617f1
sub ecx, 0x100
je 0x4617dc
jmp 0x4617f8
mov edi, 1
jmp 0x4617fd
mov edi, 2
jmp 0x4617fd
mov edi, 4
jmp 0x4617fd
mov edi, 5
jmp 0x4617fd
mov edi, 3
test byte [ebp + 0xd], 1
je 0x461824
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4844dc]
test al, 0x80
je 0x46181d
mov ebx, 0x80
jmp 0x461836
mov ebx, 1
jmp 0x461836
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x461836
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x461848
je 0x461851
dec eax
je 0x46185a
jmp 0x461863
mov dword [ebp - 4], SysStringLen
jmp 0x461872
mov dword [ebp - 4], 0x40000000
jmp 0x461872
mov dword [ebp - 4], 0xc0000000
jmp 0x461872
push 1
call fcn.0046275c
pop ecx
mov ebx, eax
jmp 0x461962
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x46188e
sub eax, 0x10
je 0x461895
sub eax, 0x10
je 0x46189e
sub eax, 0x10
je 0x4618a7
jmp 0x4618a7
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4618ae
mov dword [ebp - 8], 1
jmp 0x4618ae
mov dword [ebp - 8], 2
jmp 0x4618ae
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x46191b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x461910
test byte [ebp + 0xd], 1
je 0x46190b
mov ebx, 0x50
jmp 0x461910
mov ebx, 2
push ebx
call fcn.0046275c
pop ecx
mov ebx, eax
jmp 0x461962
mov edi, esi
push edi
call fcn.00461318
pop ecx
test eax, eax
je 0x46192f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x46193b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00462484
add esp, 8
mov ebx, eax
inc eax
jne 0x461962
push 4
call fcn.0046275c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00462398
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461cac
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x461cc8
call fcn.004627c8
jmp 0x461d37
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x461ce4
call fcn.004627c8
jmp 0x461d37
cmp dword [0x489aec], 1
je 0x461d35
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.004660c8
pop ecx
cmp al, 0x41
jl 0x461d35
cmp al, 0x5a
jg 0x461d35
cmp byte [ebp - 0x107], 0x3a
jne 0x461d35
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x461d35
call fcn.004627c8
jmp 0x461d37
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4661e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x466242
call fcn.00466190
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004600a8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004600a8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4662c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x485a04], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x46639a
cmp dword [0x485a00], 0
jne 0x46639a
cmp dword [0x485c0c], 0
je 0x466354
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00466070
add esp, 8
mov ebx, eax
test eax, eax
jne 0x46633a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00466070
add esp, 8
mov ebx, eax
test eax, eax
jne 0x46633a
lea ebx, [ebp - 0x84]
jmp 0x46633b
inc ebx
call fcn.0046627c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4663d5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x485a08
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004600a8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x485a0b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4663d5
cmp dword [0x485a00], 0
je 0x4663b4
cmp dword [0x485a00], 0xffffffff
je 0x4663d5
push esi
call dword [0x485a00]
pop ecx
mov eax, dword [0x485a04]
test eax, eax
je 0x4663d5
cmp dword [0x485a04], 0xffffffff
je 0x4663d5
cmp byte [eax], 0
je 0x4663d5
push esi
push eax
call fcn.004661e0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret