joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421eb0
Capabilities:
Encode data using xor

Disassembly:
sti
shr byte [eax - 4], 0xdf
aad 0xfa
push 0xfad5dffc
cli
xor al, dl
aam 0xdf
mov esp, 0xc02be388
das
cdq
movsb byte es:[edi], byte [esi]
push ebx
cmp esi, esp
and dh, cl
out 0x20, al
into
lodsb al, byte [esi]
inc esi
inc ebp
clc
aam 0xcb
sbb edx, dword [esi + 0x18]
sbb dword [eax], ecx
mov eax, 0x5dd430a4
push esi
sbb byte [ecx], bl
or byte [eax + 0x5dd430a4], bh
loop 0x421e78
scasd eax, dword es:[edi]
jae 0x421e49
popfd
push esp
dec edi
jp 0x421e4d
xchg ebx, eax
in al, 0x3b
sub dh, dh
add dword [eax - 0x210c053c], eax
add ah, 0xfa
fmulp st(0)
and edi, dword [edx]
adc dh, byte [edx - 0x45]
add ah, 0xfa
fmulp st(0)
and edi, dword [edx]
adc dh, byte [edx - 0x45]
cmp dword [eax], edx
pop eax
into
fisubr word [edi + 0x39]
div dh
adc eax, 0xc0d40f30
stosb byte es:[edi], al
dec edi
insd dword es:[edi], dx
or al, 0x9f
das
je 0x421e5c
pop ebx
mov al, byte gs:[0x179c30fc]
insb byte es:[edi], dx
push ebx
mov esi, 0x3fc062cf
js 0x421eab
cli
iretd
adc eax, 0x2b43f690
rol dword [eax], cl
jo 0x421ee2
xchg edx, eax
out dx, eax
inc ecx
mov bh, 0x7e
insd dword es:[edi], dx
shr dword [esi - 0x26], cl
cdq
cwde
mov bl, 0x83
add dword [ecx - 0x5316fb30], 0x62
push esi
mov bh, 0x92
sbb eax, 0xa63b04aa
jnp 0x421f53
jp 0x421ec5
jmp 0x421e67
mov word [ebx], gs
mul byte [edi + 0x30]
adc al, 0xc
int 0xc8
enter 0x17b5, 0x3b
cmpsd dword [esi], dword es:[edi]
idiv cl
nop
pop esp
enter 0xffffffffffffb5c8, 0x17
cmp esp, dword [edi + 0x5c90f9f6]
jno 0x421f37
mov dword [ebx], esp
add byte [esi - 0x10d7923b], bl
out dx, eax
sbb al, al
call ecx
xchg edx, eax
sbb bl, byte [edx - 0x7f49d6de]
and ch, byte [ecx]
mov dh, 0x80
xchg ebp, eax
pop ebp
adc edx, dword [edi]
jecxz 0x421f62
pop ds
sub byte [ebx - 0x27], 6
sbb ch, bh
mov dword [0xbfce4e57], eax
xchg esi, eax
sub dh, 0xcb
aaa
sub al, 0xde
fdiv st(3), st(0)
push ebx
xchg ebx, eax
pop ss
lds esi, [ebp + 0x70]
cld
cmp eax, 0x701060ee
aam 0x75
lodsd eax, dword [esi]
jo 0x421efd
jne 0x421ed8
iretd
loope 0x421ef5
mov fs, word [ebx]
push es
dec edx
mov esp, 0x856e13b2
movsb byte es:[edi], byte [esi]
or edi, dword [eax]
mov ah, 0xdd
loop 0x421f13
pop ss
or byte [ecx + 0x2b35cf], 0xe9
push es
adc eax, 0x2997e3a8
outsd dx, dword [esi]
in eax, dx
xor dword [0x42f7885b], ecx
push cs
aam 0xd3
dec ebp
stosd dword es:[edi], eax
ror dword [ebp - 0x55], cl
push eax
aad 0xbc
test ch, ch
add eax, 0x6ed1a8d3
add esi, dword [eax + 0x4b]
and eax, 0xeadd865f
push ss
dec edx
mov al, byte [0x781aa228]
js 0x421f27
scasb al, byte es:[edi]
loope 0x421fd2
jbe 0x421f29
test byte [eax], al
jle 0x421fe2
retf
clc
add al, 0x98
fisubr word [edx + 0x1d]
and bh, byte [edi]
mov bl, byte [edi + 0x74dbded]
test edi, edx
sal dword [eax], 0x8f
invalid
Function at 0x433e00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x433e2b
mov eax, 1
jmp 0x433eb2
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045bbad
add esp, 4
cmp eax, 0x104
jb 0x433e42
xor eax, eax
jmp 0x433eb2
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0043b190
add esp, 8
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0043b1b0
add esp, 8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x433e86
xor eax, eax
jmp 0x433eb2
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x433ea6
lea ecx, [ebp - 0x210]
push ecx
call fcn.00433e00
add esp, 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045bb9e
mov esp, ebp
pop ebp
ret

Function at 0x435cb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x435ce0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435dd9
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x490
mov dword [ebp - 0x248], 0
push 0x228
push 0
lea eax, [ebp - 0x244]
push eax
call fcn.0045bbd0
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea ecx, [ebp - 0x248]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x435d6c
push 0x4861e8
lea eax, [ebp - 0x224]
push eax
call fcn.0045f05b
add esp, 8
test eax, eax
jne 0x435d56
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x435d6a
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x435d2c
jmp 0x435d75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x435da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x435dd9
mov eax, dword [ebp + 8]
push eax
push 0xf01ff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x435dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045bb9e
mov esp, ebp
pop ebp
ret
Function at 0x435ee0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x435f01
or eax, 0xffffffff
jmp 0x435f9d
mov dword [ebp - 0x120], 0
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0045bbd0
add esp, 0xc
mov dword [ebp - 0x120], 0x114
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x435f56
cmp dword [ebp - 0x11c], 5
jne 0x435f56
cmp dword [ebp - 0x118], 0
jne 0x435f56
mov byte [ebp - 1], 1
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x435f91
mov eax, dword [ebp + 8]
push eax
call fcn.00435df0
add esp, 4
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x435f87
mov ecx, dword [ebp + 8]
push ecx
call fcn.00435cb0
add esp, 4
jmp 0x435f9d
mov eax, dword [ebp - 0x124]
jmp 0x435f9d
mov edx, dword [ebp + 8]
push edx
call fcn.00435cb0
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0045bb9e
mov esp, ebp
pop ebp
ret

Function at 0x436150
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 1
push 0
push 0
call fcn.0047e72c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4361e6
mov dword [ebp - 0x130], 0
push 0x110
push 0
lea edx, [ebp - 0x12c]
push edx
call fcn.0045bbd0
add esp, 0xc
mov dword [ebp - 0x130], 0x114
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4361d9
cmp dword [ebp - 0x12c], 6
jne 0x4361d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x436251
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
xor eax, eax
jmp 0x436251
mov dword [ebp - 4], 0x490
mov dword [ebp - 0x134], 0
jmp 0x436208
mov edx, dword [ebp - 0x134]
add edx, 1
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 8]
jae 0x436245
mov ecx, dword [ebp - 0x134]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx + 8], 0
jne 0x436243
mov eax, dword [ebp - 0x134]
imul eax, eax, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + eax]
mov dword [ecx], eax
mov dword [ebp - 4], 0
jmp 0x436245
jmp 0x4361f9
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0047e726
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045bb9e
mov esp, ebp
pop ebp
ret

Function at 0x43c340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x43c381
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045fa6c
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
push 2
push 1
push 0x486410
call fcn.0045fa6c
add esp, 0x10
mov esp, ebp
pop ebp
ret 8
Function at 0x43c3c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43c3f9
xor eax, eax
jmp 0x43c422
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x43c415
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x43c430
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esp, ebp
pop ebp
ret 8

Function at 0x43e4e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00436b70
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x43e535
jmp 0x43e5d9
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x200000
jbe 0x43e557
jmp 0x43e5d9
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00436be0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43e5a3
cmp dword [ebp - 8], 0
jne 0x43e5a7
jmp 0x43e5d9
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x20], 0
jne 0x43e57c
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00436c00
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 8
Function at 0x43fd30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x43fd4c
mov eax, dword [ebp - 4]
jmp 0x43fe27
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x43fe02
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x486508]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x486508]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x486508]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x486508]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x486508]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x486508]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x486508]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x486508]
dec ebp
jne 0x43fd6c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x43fe1e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x486508]
dec ecx
jne 0x43fe0c
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c3e4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x24], edi
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], 7
call fcn.00405700
lea eax, [ebp - 0x20]
push eax
push 3
push esi
call fcn.0044efe2
add esp, 0xc
cmp dword [ebp - 0xc], edi
je 0x44c453
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edi
jae 0x44c434
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
push esi
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.0044c37d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
push 1
lea ecx, [ebp - 0x20]
call fcn.004055b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045bb9e
leave
ret 4
Function at 0x44c8ba
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x44c8cb
mov eax, dword [eax + 4]
jmp 0x44c8ce
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebp
ret

Function at 0x44c923
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x14], ebx
je 0x44ca62
cmp byte [0x497613], bl
je 0x44ca62
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0045f538
pop ecx
pop ecx
cmp eax, ebx
je 0x44c981
xor ecx, ecx
mov word [eax + 2], cx
push 0x487504
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00461fb0
add esp, 0xc
push edi
lea ecx, [ebp - 0x240]
call fcn.004248f0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00455aed
pop ecx
pop ecx
cmp dword [ebp - 0x214], ebx
je 0x44ca53
push 0x44
pop esi
push esi
lea eax, [ebp - 0x284]
push ebx
push eax
call fcn.0045bbd0
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x284]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x284], esi
call fcn.0044c88f
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x44ca35
push 0xffffffffffffffff
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x234]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x238]
call esi
jmp 0x44ca53
push 0x40010
push 0x4874ec
push ebx
lea ecx, [ebp - 0x228]
call fcn.0044c88f
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
push 1
lea ecx, [ebp - 0x228]
call fcn.004055b0
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0045bb9e
leave
ret
Function at 0x44ce52
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x49760c], edi
je 0x44ce74
mov al, 1
jmp 0x44cffa
test byte [0x49764c], 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x44ce92
or dword [0x49764c], 1
call esi
mov dword [0x497648], eax
mov eax, dword [0x497640]
sub eax, dword [0x49763c]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 0x100
jae 0x44cec0
call esi
sub eax, dword [0x497648]
cmp eax, 0x2710
jae 0x44cec0
mov al, 1
jmp 0x44cff9
call fcn.0044c75f
mov eax, dword [0x497608]
cmp eax, edi
jne 0x44ceea
push 0x1c
call fcn.0045bae8
pop ecx
cmp eax, edi
je 0x44cee3
push eax
call fcn.0044ca98
pop ecx
jmp 0x44cee5
xor eax, eax
mov dword [0x497608], eax
mov ecx, dword [0x495440]
push ebx
cmp ecx, 1
je 0x44cefb
cmp ecx, 3
jne 0x44cf5b
cmp dword [eax + 0x18], 8
jb 0x44cf06
mov eax, dword [eax + 4]
jmp 0x44cf09
add eax, 4
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
mov ebx, 0x80
push ebx
push 4
push edi
push 3
mov edi, 0x40000000
push edi
push eax
call esi
mov dword [0x49760c], eax
cmp eax, 0xffffffff
je 0x44cf32
test eax, eax
jne 0x44cf59
push 0
push ebx
push 4
push 0
push 3
push edi
push 0x48754c
call esi
mov dword [0x49760c], eax
cmp eax, 0xffffffff
je 0x44cfea
test eax, eax
je 0x44cfea
xor edi, edi
mov eax, dword [0x497640]
sub eax, dword [0x49763c]
push 0x1c
cdq
pop ecx
idiv ecx
xor esi, esi
mov ebx, 0x497630
test eax, eax
jbe 0x44cfda
push esi
mov ecx, ebx
call fcn.00437340
push eax
lea ecx, [ebp - 0x20]
call fcn.00402e70
push 2
push edi
push edi
push dword [0x49760c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x44cfa4
lea eax, [ebp - 0x1c]
push edi
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0xc]
push eax
push dword [0x49760c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 1
lea ecx, [ebp - 0x20]
call fcn.00402fe0
mov eax, dword [0x497640]
sub eax, dword [0x49763c]
push 0x1c
cdq
pop ecx
idiv ecx
inc esi
cmp esi, eax
jb 0x44cf77
mov ecx, ebx
call fcn.0044cd38
call fcn.0044c782
mov al, 1
jmp 0x44cff8
and dword [0x49760c], 0
call fcn.0044c782
xor al, al
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0045bb9e
leave
ret
Function at 0x44f258
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x224], eax
mov ax, word [esi + 8]
mov word [ebp - 0x14], ax
mov ax, word [esi + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x12], ax
call edi
mov word [ebp - 0x10], ax
mov ax, word [esi + 0xc]
mov word [ebp - 0xe], ax
mov ax, word [esi + 8]
mov word [ebp - 0xc], ax
mov ebx, 0x4e4
mov eax, ebx
mov word [ebp - 0xa], ax
call edi
mov word [ebp - 6], bx
mov word [ebp - 8], ax
xor edi, edi
mov ebx, 0x104
movzx eax, word [ebp + edi*2 - 0x14]
movzx ecx, word [ebp + edi*2 - 0x12]
push dword [ebp - 0x228]
inc edi
movzx ecx, cx
push ecx
movzx eax, ax
push eax
push str.jefkZ
push ebx
lea eax, [ebp - 0x21c]
push ebx
push eax
inc edi
call fcn.0045de12
mov eax, dword [esi + 4]
and dword [ebp - 0x220], 0
add esp, 0x1c
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.0047e732
test eax, eax
je 0x44f32c
cmp dword [ebp - 0x220], 0
jne 0x44f344
cmp edi, 8
jb 0x44f2ca
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045bb9e
leave
ret 8
push dword [ebp - 0x220]
mov ecx, dword [ebp - 0x224]
call fcn.00409490
mov al, 1
jmp 0x44f333
Function at 0x44f689
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 3
mov esi, ecx
xor ebx, ebx
pop edi
mov dword [ebp - 0x124], ebx
mov dword [esi], ebx
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.0044f5a1
mov dword [esi + 0x24], eax
mov dword [esp], 0x118
lea eax, [ebp - 0x11c]
push ebx
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.0045bbd0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call fcn.0044f5e2
mov eax, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x114]
pop ecx
mov ecx, dword [ebp - 0x118]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp eax, 5
jne 0x44f72c
cmp ecx, ebx
jle 0x44f752
xor eax, eax
cmp ecx, 1
setne al
inc eax
mov dword [esi], eax
jmp 0x44f752
push 6
pop edx
cmp eax, edx
jne 0x44f74e
sub ecx, ebx
je 0x44f74a
dec ecx
je 0x44f742
mov dword [esi], 5
jmp 0x44f752
mov dword [esi], 4
jmp 0x44f752
mov dword [esi], edi
jmp 0x44f752
jle 0x44f752
mov dword [esi], edx
movzx eax, word [ebp - 0xc]
mov dword [esi + 0x10], eax
movzx eax, word [ebp - 0xa]
push 8
mov dword [esi + 0x14], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x148], ebx
lea edi, [ebp - 0x144]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x148]
cmp eax, ebx
je 0x44f7a7
cmp eax, 6
je 0x44f79e
cmp eax, 9
jne 0x44f7aa
mov dword [esi + 0x18], 1
jmp 0x44f7aa
mov dword [esi + 0x18], 2
jmp 0x44f7aa
mov dword [esi + 0x18], ebx
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x12c]
mov dword [esi + 0x20], eax
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045bb9e
leave
ret

Function at 0x44ff69
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x44ff7a
mov eax, dword [eax + 4]
jmp 0x44ff7d
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44ff91
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x450031
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x495780]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x4500c5
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00409420
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x264]
call fcn.0044fc22
mov ecx, eax
call fcn.0044fddd
push eax
mov ecx, esi
call fcn.0044fd28
lea ecx, [ebp - 0x248]
call fcn.0044fc18
lea ecx, [ebp - 0x264]
call fcn.0044fc18
push 0
push 1
lea ecx, [ebp - 0x22c]
call fcn.004055b0
mov al, 1
jmp 0x4500c7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045bb9e
leave
ret