joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6db0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4fbfdb
mov eax, dword fs:[0]
push eax
mov eax, 0x6060
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x605c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x514bc0]
xor eax, esp
push eax
lea eax, [esp + 0x6074]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6088]
mov ebp, dword [esp + 0x6084]
push eax
mov edi, ecx
call fcn.00451a10
mov ecx, edi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4c6e10
sub ecx, esi
mov edx, eax
sar ecx, 1
lea ebx, [edx + 2]
mov si, word [edx]
add edx, 2
test si, si
jne 0x4c6e24
sub edx, ebx
sar edx, 1
lea ecx, [edx + ecx + 1]
cmp ecx, 0x1000
jae 0x4c6f6c
push 0x1000
lea edx, [esp + 0x4074]
push edx
push eax
push edi
call fcn.00451550
lea ecx, [esp + 0x14]
call fcn.00467ad0
mov dword [esp + 0x607c], 0
push 0x1000
push 0x4fdab8
lea eax, [esp + 0x1078]
push eax
push str.ViewerIgnoreModifications
push str.Viewer
call fcn.00499a60
cmp word [esp + 0x1070], si
je 0x4c6eac
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x107c]
push edx
call fcn.004a1230
push 0x800
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
call fcn.00467b50
test al, al
je 0x4c6f58
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ecx]
push 0x800
lea ecx, [esp + 0x3074]
push ecx
lea edx, [esp + 0x78]
push edx
call edi
lea eax, [esp + 0x3072]
push 0x5065ac
push eax
call fcn.004e79e5
mov esi, eax
add esp, 8
test esi, esi
je 0x4c6f98
xor ecx, ecx
mov word [esi], cx
add esi, 4
cmp word [esi], cx
jne 0x4c6f15
mov esi, 0x4fe964
push 4
push ebp
lea edx, [esp + 0x3078]
push edx
call fcn.004472d0
test al, al
je 0x4c6f3d
push 4
lea eax, [esp + 0x4074]
push eax
push esi
call fcn.004472d0
test al, al
jne 0x4c6fa1
push 0x800
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00467b50
test al, al
jne 0x4c6ed0
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00429e50
xor al, al
mov ecx, dword [esp + 0x6074]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x605c]
xor ecx, esp
call fcn.004e34f4
add esp, 0x606c
ret 8
lea esi, [esp + 0x3070]
jmp 0x4c6f29
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00429e50
mov al, 1
jmp 0x4c6f6e

Function at 0x4c8120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0x538310
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4c8159
push 0x40
push 0x2bc
call fcn.00461b20
push eax
push 0x2bd
call fcn.00461b20
push eax
mov eax, dword [0x53a464]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
ret
push 0
push 0x538310
mov ecx, esi
call fcn.004c75b0
pop esi
ret
Function at 0x4c8ca0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4fc10e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x514bc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
test byte [0x57d964], 1
jne 0x4c8cf9
or dword [0x57d964], 1
mov dword [esp + 0x14], 0
mov ecx, 0x579840
call fcn.004c6400
push 0x4fcc10
call fcn.004e7930
add esp, 4
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esp + 0x1c]
push 1
push esi
mov ecx, 0x579840
call fcn.004c7490
mov bl, byte [esp + 0x20]
push 0
test bl, bl
push 0x579840
sete al
movzx ecx, al
push ecx
push 0
push 0
push esi
push 0
call fcn.004c6be0
test al, al
jne 0x4c8d78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x579848]
cmp eax, 0xffffffff
je 0x4c8d51
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x579848], 0xffffffff
mov ecx, 0x57d862
call fcn.00464cb0
cmp esi, 0x4c7
sete al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
test bl, bl
je 0x4c8d95
push 0x579840
push 0x10000
push 0x4c8170
call fcn.004e8851
add esp, 0xc
jmp 0x4c8dba
mov eax, dword [0x579848]
cmp eax, 0xffffffff
je 0x4c8db0
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x579848], 0xffffffff
mov ecx, 0x57d862
call fcn.00464cb0
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x4c8dd0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4fc13e
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov eax, dword [0x514bc0]
xor eax, esp
push eax
lea eax, [esp + 0x100c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x101c]
test esi, esi
je 0x4c8e55
push 0x506598
push esi
call fcn.00451c30
test al, al
jne 0x4c8e2f
call fcn.004c68c0
test al, al
je 0x4c8e55
push 0x30
push 0x65
call fcn.00461b20
push eax
push 0x596
call fcn.00461b20
push eax
mov eax, dword [0x53a464]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4c8f80
cmp byte [0x538309], 0
jne 0x4c8e91
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.004c6be0
test al, al
jne 0x4c8f80
push esi
push 0x201
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 8
jmp 0x4c8f80
push 1
call fcn.004ad4e0
push 1
push 0x800
push 0x54c7ae
push str.Rar_EX
call fcn.004b1590
test al, al
je 0x4c8f80
push 0x800
push 0x555ba2
mov ecx, 0x546dc0
call fcn.004790c0
mov ecx, dword [0x546dc4]
mov dword [0x552b50], ecx
push 0x4fe964
mov ecx, 0x556ba4
call fcn.00467940
push 0x800
lea edx, [esp + 0xc]
push edx
push esi
push 0x54c7ae
mov dword [0x551b40], 4
call fcn.00451550
push 0
push 0
mov ecx, 0x546dc0
call fcn.0047b380
cmp byte [0x538308], 0
jne 0x4c8f80
test byte [0x581a8c], 1
jne 0x4c8f58
or dword [0x581a8c], 1
mov dword [esp + 0x1014], 0
mov ecx, 0x57d968
call fcn.004c6400
push 0x4fcc60
call fcn.004e7930
add esp, 4
mov dword [esp + 0x1014], 0xffffffff
push 0
lea eax, [esp + 0xc]
push eax
mov ecx, 0x57d968
call fcn.004c7490
push 0x57d968
push 0x10000
push 0x4c8170
call fcn.004e8851
add esp, 0xc
mov ecx, dword [esp + 0x100c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004e34f4
add esp, 0x1010
ret 4
Function at 0x4ceda0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push 0x5a59b8
mov esi, ecx
call fcn.00439230
mov edx, dword [esp + 8]
mov dword [esi + 4], 0x12345678
mov dword [esi + 8], 0x23456789
mov dword [esi + 0xc], 0x34567890
mov cl, byte [edx]
test cl, cl
je 0x4cee1e
lea esp, [esp]
mov eax, dword [esi + 4]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5a59b8]
shr eax, 8
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 8]
mov dword [esi + 4], ecx
mov ecx, dword [esi + 0xc]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5a59b8]
inc edx
mov dword [esi + 0xc], ecx
mov cl, byte [edx]
test cl, cl
jne 0x4cedd0
pop esi
ret 4
Function at 0x4cf210
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
cmp byte [0x54f8bc], 0
je 0x4cf29e
push ebx
mov ebx, dword [esp + 0xc]
imul ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
test ebx, ebx
je 0x4cf29c
push esi
push edi
movsx edx, byte [ebp]
mov edi, dword [ecx + 4]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x5a59b8]
mov eax, dword [ecx + 0xc]
shr edi, 8
xor edx, edi
mov dword [ecx + 4], edx
movzx edx, dl
add edx, dword [ecx + 8]
mov esi, eax
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 8], edx
shr edx, 0x18
xor edx, eax
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x5a59b8]
and esi, 0xfffd
mov dword [ecx + 0xc], eax
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor byte [ebp], al
inc ebp
sub ebx, 1
jne 0x4cf232
pop edi
pop esi
pop ebp
pop ebx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0
push edx
mov edx, dword [esp + 0xc]
push eax
push edx
call fcn.004ce280
ret 0xc
Function at 0x4d78a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x4c
push esi
mov esi, dword [esp + 0x54]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d78d4
test al, 0x10
jne 0x4d78ca
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4d78d4
pop edi
mov al, 1
pop esi
add esp, 0x4c
ret 4
mov eax, dword [edi + 0x64b3fc]
lea ecx, [esp + 8]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x48], 2
call fcn.004693c0
pop edi
xor al, al
pop esi
add esp, 0x4c
ret 4
Function at 0x4dfa30
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x5b7744]
mov eax, dword [esp + 4]
mov edx, ecx
shr ecx, 8
xor edx, eax
and edx, 0xff
xor ecx, dword [edx*4 + 0x5a61c8]
mov edx, dword [0x5b774c]
mov dword [0x5b7744], ecx
movzx ecx, cl
add ecx, dword [0x5b7748]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [0x5b7748], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x5a61c8]
mov dword [0x5b774c], edx
ret 4

Function at 0x4dfa90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
push 0x5a61c8
call fcn.00439230
mov edi, dword [esp + 0xc]
mov eax, 0x12345678
mov edx, 0x23456789
mov esi, 0x34567890
mov dword [0x5b7744], eax
mov dword [0x5b7748], edx
mov dword [0x5b774c], esi
mov cl, byte [edi]
test cl, cl
je 0x4dfb20
jmp 0x4dfad0
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x5a61c8]
inc edi
movzx ecx, al
add ecx, edx
imul ecx, ecx, 0x8088405
inc ecx
mov edx, ecx
shr ecx, 0x18
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x5a61c8]
mov dword [0x5b7744], eax
mov dword [0x5b7748], edx
mov dword [0x5b774c], esi
mov cl, byte [edi]
test cl, cl
jne 0x4dfad0
pop edi
pop esi
ret 4
Function at 0x4e0370
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0xdc]
cmp eax, 0xffffffff
je 0x4e03e1
cmp eax, 0x40
jbe 0x4e0397
lea edx, [esi + 0x40]
mov al, 1
call fcn.004e02c0
mov dword [esi + 0xdc], 0x14
mov eax, dword [esi + 0xdc]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, esi
push 0
push eax
call fcn.004e4400
add esp, 0xc
xor eax, eax
xor dword [esi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x4e03b4
push edi
lea edi, [esi + 0x40]
push edi
call fcn.00466600
push 1
push 0x40
push esi
push edi
call fcn.00466640
mov dword [esi + 0xdc], 0xffffffff
pop edi
test ebx, ebx
je 0x4e03f6
mov edx, dword [esp + 8]
push 1
push ebx
push edx
add esi, 0x40
push esi
call fcn.00466640
pop esi
ret 4

Function at 0x4e0400
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x28], eax
cmp dword [edi + 0xdc], 0xffffffff
push ebx
push ebp
mov ebp, dword [esp + 0x38]
je 0x4e0428
push 0
mov eax, edi
xor ebx, ebx
call fcn.004e0370
push esi
lea ebx, [edi + 0x40]
mov al, 1
lea esi, [esp + 0x20]
mov edx, ebx
call fcn.004e02c0
xor eax, eax
pop esi
lea esp, [esp]
xor dword [edi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x4e0440
push ebx
call fcn.00466600
push 1
push 0x40
push edi
push ebx
call fcn.00466640
push 1
push 0x14
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.00466640
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
call fcn.00466700
xor eax, eax
lea esp, [esp]
mov edx, eax
and edx, 3
mov ecx, 3
sub ecx, edx
add ecx, ecx
mov edx, eax
shr edx, 2
mov edx, dword [esp + edx*4 + 8]
add ecx, ecx
add ecx, ecx
shr edx, cl
inc eax
mov byte [esp + eax + 0x1b], dl
cmp eax, 0x14
jb 0x4e0480
mov eax, dword [esp + 0x3c]
test eax, eax
jbe 0x4e04be
push eax
lea eax, [esp + 0x20]
push eax
push ebp
call fcn.004e4090
add esp, 0xc
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x2c
ret 8
Function at 0x4e04e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ec
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x2e8], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
push pe_nt_image_headers32
mov esi, ecx
lea ecx, [esp + 0x10c]
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], eax
call fcn.004e4400
mov edi, dword [ebp + 8]
add esp, 0xc
push esi
lea esi, [esp + 0x10c]
call fcn.004e0300
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, 0x38
lea edi, [esp + 0x1ec]
lea eax, [esp + 0x1ec]
rep movsd dword es:[edi], dword [esi]
call fcn.004e0370
mov edx, dword [ebp + 0x18]
dec edx
mov eax, 0xcccccccd
mul edx
shr edx, 4
add edx, 1
mov dword [esp + 0x20], edx
je 0x4e06e3
mov ebx, 1
lea eax, [esp + 0x2cc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x2d0], eax
mov dword [esp + 0x2d4], eax
mov dword [esp + 0x2d8], eax
mov dword [esp + 0x2dc], eax
mov eax, ebx
shr eax, 8
mov ecx, 0x38
lea esi, [esp + 0x1e8]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
mov byte [esp + 0x2e2], al
mov eax, dword [ebp + 0x10]
shr ecx, 0x18
mov byte [esp + 0x2e1], dl
mov byte [esp + 0x2e0], cl
mov byte [esp + 0x2e3], bl
mov edx, 4
test eax, eax
jbe 0x4e06a4
mov dword [esp + 0x18], eax
lea ebx, [ebx]
lea ecx, [esp + 0x2e0]
push ecx
lea eax, [esp + 0x2c]
mov ebx, edx
call fcn.004e0370
push 0x14
lea edx, [esp + 0x2e4]
push edx
lea edi, [esp + 0x30]
call fcn.004e0400
xor edx, edx
jmp 0x4e0630
movzx eax, byte [esp + edx + 0x2e0]
xor byte [esp + edx + 0x2cc], al
movzx ecx, byte [esp + edx + 0x2e1]
movzx eax, byte [esp + edx + 0x2e2]
xor byte [esp + edx + 0x2cd], cl
xor byte [esp + edx + 0x2ce], al
movzx ecx, byte [esp + edx + 0x2e3]
movzx eax, byte [esp + edx + 0x2e4]
xor byte [esp + edx + 0x2cf], cl
xor byte [esp + edx + 0x2d0], al
add edx, 5
cmp edx, 0x14
jb 0x4e0630
sub dword [esp + 0x18], 1
mov ecx, 0x38
lea esi, [esp + 0x108]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
jne 0x4e0600
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, dword [ebp + 0x18]
jae 0x4e06c4
mov edx, dword [esp + 0x10]
mov dl, byte [edx + eax]
mov esi, dword [esp + 0x24]
mov byte [eax + esi], dl
inc ecx
inc eax
cmp ecx, 0x14
jb 0x4e06aa
mov eax, 0x14
add dword [esp + 0x14], eax
sub dword [esp + 0x10], eax
inc ebx
lea eax, [ebx - 1]
mov dword [esp + 0x1c], ebx
cmp eax, dword [esp + 0x20]
jb 0x4e0584
mov ecx, dword [esp + 0x2f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e34f4
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4e34f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x514bc0]
jne 0x4e34fe
repz ret
jmp fcn.004ea1b1
Function at 0x4f1f27
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004e8ece
and dword [ebp - 4], 0
cmp dword [0x5ba138], 0
mov ebx, eax
jne 0x4f1fd8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4f2089
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4f2089
push eax
call fcn.004e8e5c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5ba138], eax
call esi
push eax
call fcn.004e8e5c
mov dword [esp], 0x507774
push edi
mov dword [0x5ba13c], eax
call esi
push eax
call fcn.004e8e5c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5ba140], eax
call esi
push eax
call fcn.004e8e5c
pop ecx
mov dword [0x5ba148], eax
test eax, eax
je 0x4f1fd8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004e8e5c
pop ecx
mov dword [0x5ba144], eax
mov eax, dword [0x5ba144]
cmp eax, ebx
je 0x4f2030
cmp dword [0x5ba148], ebx
je 0x4f2030
push eax
call fcn.004e8ed7
push dword [0x5ba148]
mov esi, eax
call fcn.004e8ed7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4f2030
test edi, edi
je 0x4f2030
call esi
test eax, eax
je 0x4f2027
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4f2027
test byte [ebp - 0xc], 1
jne 0x4f2030
or dword [ebp + 0x10], 0x200000
jmp 0x4f2069
mov eax, dword [0x5ba13c]
cmp eax, ebx
je 0x4f2069
push eax
call fcn.004e8ed7
pop ecx
test eax, eax
je 0x4f2069
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4f2069
mov eax, dword [0x5ba140]
cmp eax, ebx
je 0x4f2069
push eax
call fcn.004e8ed7
pop ecx
test eax, eax
je 0x4f2069
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5ba138]
call fcn.004e8ed7
pop ecx
test eax, eax
je 0x4f2089
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4f208b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402dec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043cc
test esi, esi
jne 0x402e23
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004044bc
jmp 0x402e44
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c88
mov dword [esp], eax
test esi, esi
je 0x402e44
cmp dword [ebx], 0
je 0x402e44
dec esi
jmp 0x402e2b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4034cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x454020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403564
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403544
xor eax, eax
push ebp
push 0x40353d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403580
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403544
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x454020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x454020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404248
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x456048], 0
je 0x4042a9
cmp word [0x45621c], 0xd7b2
jne 0x404271
cmp dword [0x456224], 0
jbe 0x404271
mov eax, 0x456218
call dword [0x456234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45406c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042d0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x454030], 0
jne 0x4042c5
push 0
push 0x454064
push 0x45406c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40606c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4060d2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040463c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403090
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4060bc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060d9
lea eax, [ebp - 0x10]
call fcn.004043cc
ret

Function at 0x4088d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040488c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4088ed
test al, 0x10
jne 0x4088f1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40b5a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5e1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044bc
jmp 0x40b5ea
mov eax, ebx
mov edx, esi
call fcn.00404420
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b5f4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b615
mov al, byte [esp]
jmp 0x40b617
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c5cc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c6a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404464
lea eax, [ebp - 8]
call fcn.004048dc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040488c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c68c
mov eax, ebx
call fcn.00402a28
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c685
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040488c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c66f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c6b4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c66f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c68c
mov eax, dword [ebp - 0x10]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c6a9
lea eax, [ebp - 8]
call fcn.004043cc
ret