joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cfa8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d07e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 4]
call fcn.0040555c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x42d068
mov eax, ebx
call fcn.0040309c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42d061
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x42d04b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42d090
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x42d04b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d068
mov eax, dword [ebp - 0x10]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d085
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x42e6d0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.0040502c
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040550c
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x42e715
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040511c
jmp 0x42e72e
mov edx, ebx
dec edx
mov eax, esi
call fcn.00405794
push ebx
mov eax, dword [esi]
call fcn.0040550c
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x444dd8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00444ae8
dec esi
jne 0x444dfa
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x445f6c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x686ed4
cmp dword [edi], 0
jne 0x445fe8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x686ed0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x57a790
mov ecx, 2
call fcn.00403348
mov edx, 0x445f44
lea eax, [esi + 5]
call fcn.00445f64
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00445f64
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x445fbd
mov dword [0x686ed0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4461f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x446214
test al, 0x10
sete al
jmp 0x44623b
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x446235
cmp ebx, 3
je 0x446235
cmp ebx, 0x7b
je 0x446235
mov eax, esi
call fcn.004461b4
test al, al
jne 0x446239
xor eax, eax
jmp 0x44623b
mov al, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x44626c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x446288
test al, 0x10
jne 0x44628d
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x447e18
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
add eax, 0x10
test eax, eax
jns 0x447e28
call fcn.00403edc
push eax
push 8
mov eax, dword [0x68701c]
push eax
call sub.kernel32.dll_HeapAlloc
mov ebx, eax
test ebx, ebx
jne 0x447e57
mov eax, 0x447e70
call fcn.004471c0
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [str.PLEH]
mov dword [ebx], eax
add ebx, 0x10
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4480a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0
push 0x500000
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x68701c], eax
cmp dword [0x68701c], 0
jne 0x4480d2
push 0
push 0
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x68701c], eax
cmp dword [0x68701c], 0
jne 0x4480f6
mov eax, 0x448134
call fcn.004471c0
call sub.kernel32.dll_GetLastError_1
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x18], fcn.00447e18
mov dword [ebp - 0x14], 0x447e90
mov dword [ebp - 0x10], 0x447ef8
mov dword [ebp - 0xc], 0x448028
mov dword [ebp - 8], 0x448098
mov dword [ebp - 4], 0x44809c
lea eax, [ebp - 0x18]
call fcn.00403134
mov esp, ebp
pop ebp
ret
Function at 0x44aa94
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.004038b8
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x44ab08
inc dword [ebp - 0x5c]
test ebx, ebx
jbe 0x44ab84
mov edi, 0x40
sub edi, dword [ebp - 0x54]
cmp ebx, edi
jb 0x44ab58
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44ab25
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, edi
test ecx, ecx
jns 0x44ab34
call fcn.00403edc
mov eax, esi
call fcn.00403348
mov eax, 0x40
sub eax, dword [ebp - 0x54]
sub ebx, eax
mov eax, 0x40
sub eax, dword [ebp - 0x54]
add esi, eax
push ebp
call fcn.0044a1d8
pop ecx
jmp 0x44ab80
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44ab65
call fcn.00403edc
lea edx, [ebp + eax - 0x40]
mov ecx, ebx
test ecx, ecx
jns 0x44ab74
call fcn.00403edc
mov eax, esi
call fcn.00403348
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x44ab0c
mov eax, dword [ebp - 0x54]
cmp eax, 0x3f
jbe 0x44ab91
call fcn.00403edc
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x44aba3
push ebp
call fcn.0044a1d8
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.0044a1d8
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.00403348
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b32c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44b51a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004050c4
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405a08
call sub.kernel32.dll_GetUserDefaultLCID
mov dword [ebp - 0x10], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x44b4ef
xor edx, edx
push ebp
push 0x44b4e8
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
test ebx, ebx
je 0x44b3dc
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x44b3b2
mov eax, dword [ebp - 8]
call fcn.00405a28
inc eax
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, 0xd
call fcn.0044b26c
mov eax, dword [ebp - 4]
call fcn.00405308
inc eax
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, 1
call fcn.0044b26c
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, 0x10
call fcn.0044b26c
test esi, esi
je 0x44b4d5
lea eax, [ebp - 0x18]
mov ecx, 0x44b530
mov edx, esi
call fcn.00405358
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00405a08
mov eax, dword [ebp - 0xc]
call fcn.00405a28
add eax, eax
add eax, 0x14
test eax, eax
jns 0x44b414
call fcn.00403edc
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44b4d5
xor edx, edx
push ebp
push 0x44b4ce
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
je 0x44b4b1
xor edx, edx
push ebp
push 0x44b4aa
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov dword [eax], 0x14
mov dword [eax + 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.00405a28
mov ecx, eax
add ecx, ecx
mov edx, ebx
add edx, 0x14
mov eax, dword [ebp - 0xc]
call fcn.00403348
mov eax, dword [ebp - 0x14]
push eax
push 0xf
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x44b493
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b4b1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b4d5
cmp dword [ebp - 0x14], 0
je 0x44b4cd
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b4ef
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b521
lea eax, [ebp - 0x18]
call fcn.0040502c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040586c
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x44b824
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004038b8
mov dword [ebp - 0x3c], 0x3c
call fcn.0041bd94
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
test edi, edi
jns 0x44b867
call fcn.00403edc
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
and eax, 0x7f
cmp eax, 1
jbe 0x44b886
call fcn.00403edc
call fcn.00446ea4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44bd44
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44bf3a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
mov ebx, eax
mov eax, dword [0x58253c]
cmp dword [eax], 0
jne 0x44bd94
mov eax, dword [0x58253c]
mov dword [eax], ebx
lea eax, [ebp - 4]
mov edx, 0x44bf50
call fcn.004050c4
jmp 0x44bdb6
mov eax, dword [0x58253c]
cmp ebx, dword [eax]
jne 0x44bdac
lea eax, [ebp - 4]
mov edx, 0x44bf50
call fcn.004050c4
jmp 0x44bdb6
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0044bce0
cmp dword [0x687454], 0
jne 0x44be0f
cmp dword [0x687450], 0
jne 0x44be0f
call fcn.004667f0
push edx
push eax
mov eax, 0x687450
call fcn.0044bcc8
mov eax, dword [0x687450]
mov dword [0x687458], eax
mov eax, dword [0x687454]
mov dword [0x68745c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x44be78
call fcn.004667f0
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0044bcc8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x687450]
sbb edx, dword [0x687454]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x687458]
sbb edx, dword [0x68745c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [0x687458], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x68745c], eax
push 0x44bf60
push dword [ebp - 4]
push 0x44bf6c
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x34]
call fcn.0044bd10
push dword [ebp - 0x34]
push 0x44bf78
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x38]
call fcn.0044bd10
push dword [ebp - 0x38]
push 0x44bf84
lea eax, [ebp - 8]
mov edx, 7
call fcn.004053cc
mov eax, dword [ebp - 8]
call fcn.00405308
cmp eax, 0x19
jge 0x44befa
push dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.00405308
mov edx, 0x19
sub edx, eax
lea ecx, [ebp - 0x3c]
mov al, 0x20
call fcn.004057f8
push dword [ebp - 0x3c]
push esi
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
jmp 0x44bf04
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405314
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf41
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x457870
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edx, 0x40
mov eax, esi
call fcn.0040ea5c
test al, al
je 0x4578e6
xor edx, edx
push ebp
push 0x4578da
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x4578a7
cmp dword [eax + 0x3c], 0
jne 0x4578b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4578e6
mov ebx, dword [eax + 0x3c]
add ebx, esi
mov edx, 0xf8
mov eax, ebx
call fcn.0040ea5c
test al, al
je 0x4578ce
cmp dword [ebx], 0x4550
je 0x4578d0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4578e6
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4578f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edx, 0x40
mov eax, esi
call fcn.0040ea5c
test al, al
je 0x457966
xor edx, edx
push ebp
push 0x45795a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x457927
cmp dword [eax + 0x3c], 0
jne 0x457931
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x457966
mov ebx, dword [eax + 0x3c]
add ebx, esi
mov edx, 0x108
mov eax, ebx
call fcn.0040ea5c
test al, al
je 0x45794e
cmp dword [ebx], 0x4550
je 0x457950
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x457966
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x457a14
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x457ab3
push 0
push 0
mov eax, ebx
call fcn.0043e488
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.0043e694
cmp word [ebp - 0x44], 0x5a4d
jne 0x457ab3
cmp dword [ebp - 8], 0
je 0x457ab3
mov eax, pe_nt_image_headers32
call fcn.0040304c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.0043e488
mov edx, dword [ebp - 4]
mov ecx, 0xf8
mov eax, ebx
call fcn.0043e694
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x457aa1
lea eax, [ebp - 4]
xor edx, edx
call fcn.00446b9c
jmp 0x457ab3
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0xf8
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457abc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x457b5b
push 0
push 0
mov eax, ebx
call fcn.0043e488
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.0043e694
cmp word [ebp - 0x44], 0x5a4d
jne 0x457b5b
cmp dword [ebp - 8], 0
je 0x457b5b
mov eax, 0x110
call fcn.0040304c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.0043e488
mov edx, dword [ebp - 4]
mov ecx, 0x108
mov eax, ebx
call fcn.0043e694
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x457b49
lea eax, [ebp - 4]
xor edx, edx
call fcn.00446b9c
jmp 0x457b5b
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0x108
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45bc88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45bce0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x58254c]
mov dl, 1
mov eax, dword [0x45b7ac]
call fcn.0042c810
call fcn.00404984
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045b8b4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45de34
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054fc
xor eax, eax
push ebp
push 0x45df94
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, 0x45dfac
call fcn.00446420
mov ebx, eax
lea ecx, [ebx + 1]
mov edx, dword [ebp - 4]
mov eax, 0x45dfac
call fcn.00446420
mov ebx, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405308
mov ecx, eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040556c
mov eax, dword [ebp - 4]
call fcn.00405308
mov ecx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004055ac
mov bl, 0x41
lea eax, [ebp - 8]
mov edx, 0x2800
call fcn.00405794
mov eax, dword [ebp - 8]
call fcn.00405308
test eax, eax
jns 0x45ded1
call fcn.00403edc
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405214
lea eax, [ebp - 0xc]
mov edx, 0x45dfb8
call fcn.00405314
mov eax, dword [ebp - 0xc]
call fcn.0040550c
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
je 0x45df68
mov eax, dword [ebp - 8]
call fcn.0040550c
call fcn.00429320
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405794
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00427f04
test al, al
je 0x45df68
lea eax, [ebp - 0x14]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.0040379c
mov edx, 0x45dfbc
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.0040376c
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00405290
mov edx, dword [ebp - 0x10]
mov ecx, dword [esi]
mov eax, esi
call fcn.00405358
jmp 0x45df79
inc ebx
cmp bl, 0x5b
jne 0x45deb3
mov eax, esi
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45df9b
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405050
ret
Function at 0x45eb00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x45ebea
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405990
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042809c
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004052d0
cmp dword [edi], 0
je 0x45ebc2
mov eax, 1
mov edx, dword [edi]
dec eax
test edx, edx
je 0x45eb56
cmp eax, dword [edx - 4]
jb 0x45eb5b
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x22
jne 0x45eb79
push edi
mov eax, dword [edi]
mov ecx, 0x7fffffff
mov edx, 2
call fcn.0040556c
mov bl, 0x22
jmp 0x45eb7b
mov bl, 0x20
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405214
mov eax, dword [ebp - 0xc]
mov edx, dword [edi]
call fcn.00405650
mov esi, eax
test esi, esi
jle 0x45eba7
push edi
lea edx, [esi + 1]
mov eax, dword [edi]
mov ecx, 0x7fffffff
call fcn.0040556c
jmp 0x45ebae
mov eax, edi
call fcn.0040502c
lea edx, [ebp - 0x10]
mov eax, dword [edi]
call fcn.00428048
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ebf1
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040586c
ret

Function at 0x45f20c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f2a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x400
call fcn.00405bfc
mov eax, dword [ebp - 4]
call fcn.00405a28
mov edx, eax
add edx, edx
mov eax, 1
mov ecx, dword [ebp - 4]
dec eax
test ecx, ecx
je 0x45f253
cmp eax, dword [ecx - 4]
jb 0x45f258
call fcn.00403edc
inc eax
lea eax, [ecx + eax*2 - 2]
xor ecx, ecx
call fcn.004038b8
mov eax, dword [ebp - 4]
call fcn.00405a28
sar eax, 1
jns 0x45f273
adc eax, 0
push eax
mov eax, dword [ebp - 4]
call fcn.00405a18
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f2ab
lea eax, [ebp - 4]
call fcn.00405854
ret