joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495b5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x495b79
add esp, 0xfffffff0
call fcn.0040436c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x495d15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0048c368
test al, al
jne 0x495bb6
mov ecx, 0x495d48
mov dl, 1
mov eax, dword [0x480a64]
call fcn.0040dcd0
call fcn.00404898
xor eax, eax
push ebp
push 0x495be2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0048ae14
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0048ad00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495c02
mov eax, dword [ebp - 0x10]
mov edx, 0x495d84
call fcn.0040592c
je 0x495c1f
mov eax, esi
mov edx, 0x495d84
call fcn.0040592c
jne 0x495c43
mov eax, edi
mov edx, 0x495d94
call fcn.0040592c
je 0x495c43
mov ecx, 0x495d6c
mov dl, 1
mov eax, dword [0x480d0c]
call fcn.0040dcd0
call fcn.00404898
mov eax, edi
xor edx, edx
call fcn.0040592c
jne 0x495c70
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.0040592c
je 0x495c70
mov ecx, 0x495d6c
mov dl, 1
mov eax, dword [0x480d0c]
call fcn.0040dcd0
call fcn.00404898
mov eax, dword [ebp - 0x10]
mov edx, 0x495dd4
call fcn.0040592c
jne 0x495ca3
mov eax, edi
mov edx, 0x495de0
call fcn.0040592c
je 0x495ca3
mov ecx, 0x495d6c
mov dl, 1
mov eax, dword [0x480d0c]
call fcn.0040dcd0
call fcn.00404898
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00493c4c
lea eax, [ebx + 4]
mov edx, esi
call fcn.004056c8
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004056c8
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004056c8
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004056c8
lea eax, [ebx + 8]
call fcn.0040568c
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x495e2c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495d1c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004056a4
ret
Function at 0x497610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x49762d
add esp, 0xfffffff0
call fcn.0040436c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4977c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0048c368
test al, al
jne 0x49766a
mov ecx, 0x4977fc
mov dl, 1
mov eax, dword [0x480a64]
call fcn.0040dcd0
call fcn.00404898
xor eax, eax
push ebp
push 0x497696
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0048ae14
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0048ad00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4976b6
mov eax, edi
xor edx, edx
call fcn.0040592c
jne 0x4976e3
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.0040592c
je 0x4976e3
mov ecx, 0x497820
mov dl, 1
mov eax, dword [0x480d0c]
call fcn.0040dcd0
call fcn.00404898
mov eax, dword [ebp - 0x10]
mov edx, 0x497838
call fcn.0040592c
jne 0x497716
mov eax, edi
mov edx, 0x497844
call fcn.0040592c
je 0x497716
mov ecx, 0x497820
mov dl, 1
mov eax, dword [0x480d0c]
call fcn.0040dcd0
call fcn.00404898
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00493c4c
lea eax, [ebx + 4]
mov edx, esi
call fcn.004056c8
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004056c8
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004056c8
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004056c8
lea eax, [ebx + 8]
call fcn.0040568c
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x418f48]
call fcn.00403fc4
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x418f48]
call fcn.00403fc4
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x418f48]
call fcn.00403fc4
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x497890]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x483a88]
call fcn.00492ea4
mov dword [ebx + 0x3c], eax
mov ax, word [0x497894]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4977cf
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004056a4
ret
Function at 0x49a224
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x49a246
add esp, 0xfffffff0
call fcn.0040436c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x49a3b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0048c368
test al, al
jne 0x49a283
mov ecx, 0x49a3e4
mov dl, 1
mov eax, dword [0x480a64]
call fcn.0040dcd0
call fcn.00404898
push dword [0x55e328]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x55e328]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058e4
mov eax, dword [ebp - 0xc]
call fcn.0048ce40
test al, al
jne 0x49a355
push dword [0x55e324]
push dword [ebp + 8]
push dword [0x55e324]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004058e4
mov eax, dword [ebp - 0x14]
call fcn.0048ce40
test al, al
jne 0x49a355
push dword [0x55e328]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x55e328]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004058e4
mov eax, dword [ebp - 0x18]
call fcn.0048cf58
test al, al
jne 0x49a355
push dword [0x55e324]
push edi
push dword [0x55e324]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004058e4
mov eax, dword [ebp - 0x20]
call fcn.0048cf58
test al, al
jne 0x49a355
mov ecx, 0x49a3e4
mov dl, 1
mov eax, dword [0x480a64]
call fcn.0040dcd0
call fcn.00404898
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00493c4c
lea eax, [ebx + 4]
mov edx, esi
call fcn.004056c8
lea eax, [ebx + 8]
call fcn.0040568c
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.004056c8
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.004056c8
mov byte [ebx + 0xc], 0xc
mov ax, word [0x49a400]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a3b8
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004056a4
ret

Function at 0x4ceeb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cef2f
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4cef16
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004051b4
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00409830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cef36
lea eax, [ebp - 0x104]
call fcn.00404f44
ret
Function at 0x4d5a44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
xor eax, eax
push ebp
push 0x4d5b6c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004035ec
mov dword [ebp - 0x4c], 0x44
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], si
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.004035ec
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, 0x4d5b84
call fcn.0040520c
xor edx, edx
push ebp
push 0x4d5b4f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.0040545c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4d5b24
test bl, bl
je 0x4d5b2c
push 0x3e8
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [ebp - 8], eax
call fcn.004d5a14
cmp dword [ebp - 8], 0x102
je 0x4d5af6
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
jmp 0x4d5b2c
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5b56
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 8]
ret

Function at 0x4d63b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d646d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f44
push 0x4d647c
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4d6402
push 0x4d648c
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d63fc
call dword [ebp - 4]
mov edi, eax
push esi
call sub.kernel32.dll_FreeLibrary_1
or di, 0
movzx eax, di
mov edi, eax
push 0
push 0
push 3
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00405590
push esi
mov eax, ebx
call fcn.0040545c
push eax
push 3
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.00409a78
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004097e0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6474
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404f68
ret
Function at 0x4d694c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d69c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
lea eax, [ebp - 4]
push eax
push 0x1c
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov edx, ebx
lea eax, [ebp - 0x10d]
call fcn.0040aca8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d69c8
lea eax, [ebp - 8]
call fcn.00406de0
ret
Function at 0x4e4b58
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4e4b60
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e4d52
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4e4d68
mov eax, esi
call fcn.004e29e4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404f98
lea ecx, [ebp - 0x10]
mov edx, 0x4e4d7c
mov eax, esi
call fcn.004e29e4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404f98
lea ecx, [ebp - 0x14]
mov edx, 0x4e4d94
mov eax, esi
call fcn.004e29e4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404f98
lea ecx, [ebp - 0x18]
mov edx, 0x4e4db0
mov eax, esi
call fcn.004e29e4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404f98
lea ecx, [ebp - 0x1c]
mov edx, 0x4e4dcc
mov eax, esi
call fcn.004e29e4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404f98
lea ecx, [ebp - 0x24]
mov edx, 0x4e4de4
mov eax, esi
call fcn.004e29e4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409a78
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040a1e8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4e4dfc
mov eax, esi
call fcn.004e29e4
mov eax, dword [ebp - 0x28]
call fcn.004dc2a8
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4e4e0c
mov eax, esi
call fcn.004e29e4
mov eax, dword [ebp - 0x2c]
call fcn.004dc2a8
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4e4e24
mov eax, esi
call fcn.004e29e4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040a1e8
inc eax
je 0x4e4cf5
lea ecx, [ebp - 0x34]
mov edx, 0x4e4e24
mov eax, esi
call fcn.004e29e4
mov eax, dword [ebp - 0x34]
call fcn.0040a1ac
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040bad4
fstp qword [ebp - 0x3c]
wait
call fcn.0040be44
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4e4d10
lea ecx, [ebp - 0x40]
mov edx, 0x4e4e24
mov eax, esi
call fcn.004e29e4
mov eax, dword [ebp - 0x40]
call fcn.004dc2a8
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4e4e34
mov eax, esi
call fcn.004e29e4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4d59
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404f68
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404f68
ret
Function at 0x4ebc60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4ebcba
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004ebc50
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004daf14
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004dab14
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebcc1
lea eax, [ebp - 4]
call fcn.00404f44
ret

Function at 0x4f1c38
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.004f16d8
test byte [ebx + 0x23d], 4
jne 0x4f1ccd
mov edx, esp
mov eax, ebx
call fcn.0044c898
push esp
mov eax, ebx
call fcn.0045354c
push eax
push 0
mov eax, ebx
test eax, eax
je 0x4f1c6d
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x4f1c9e
mov ecx, dword [0x561d88]
mov dl, 1
mov eax, dword [0x46e798]
call fcn.0040dd8c
call fcn.00404898
mov eax, ebx
call fcn.004f220c
cmp byte [ebx + 0x57], 0
jne 0x4f1cd4
mov eax, ebx
call fcn.00453750
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4f1cd4
push 0
mov eax, ebx
call fcn.00453750
push eax
call sub.user32.dll_ShowWindow
jmp 0x4f1cd4
mov eax, ebx
call fcn.004506d0
add esp, 0x10
pop ebx
ret

Function at 0x505d78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x505db0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x505d8e
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x505d9d
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x505dac
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x514ce0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x514d44
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004051b4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040a1e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514d4b
lea eax, [ebp - 0xc]
call fcn.00404f44
ret
Function at 0x526320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52645a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041cd58
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x52639c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x52639c
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004097e0
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x561a24]
mov ebx, dword [ebx]
mov eax, 0x526470
call ebx
dec eax
jne 0x52639c
mov ebx, 1
jmp 0x52639e
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x52643f
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.004e7404
test al, al
jne 0x526433
mov eax, dword [ebp - 4]
call fcn.00526314
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404f98
xor edx, edx
push ebp
push 0x526421
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x526417
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00526734
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x526433
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x5263b6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x526461
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404f68
ret
Function at 0x531af8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x531b26
mov eax, ebx
call fcn.005325ac
cmp dword [ebx + 0x40], 0
je 0x531b1f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x531b97
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x531b89
cmp dword [ebx + 8], 0
je 0x531b48
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x531b5a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x531b89
cmp dword [ebx + 8], 0
je 0x531b3b
cmp eax, 3
je 0x531b6d
dec eax
jne 0x531b3b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x531b3b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x531b3b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x531bb5
cmp dword [ebx + 0x14], 0xcc
je 0x531bb5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00531bc0
pop ebx
ret

Function at 0x542244
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
mov eax, dword [ebp - 8]
call fcn.004053f4
xor eax, eax
push ebp
push 0x542318
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x14
mov dword [ebp - 0x20], 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x38], 2
mov eax, dword [ebp - 8]
call fcn.00405404
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 3
mov eax, 0x542324
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x4b
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54231f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f68
ret
Function at 0x54232c
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
mov eax, dword [ebp - 8]
call fcn.004053f4
mov eax, dword [ebp - 0xc]
call fcn.004053f4
mov eax, dword [ebp + 0xc]
call fcn.004053f4
xor eax, eax
push ebp
push 0x542445
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00405404
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 3
mov eax, 0x542454
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00405404
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405404
push eax
mov ax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetConnectA
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54244c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f68
lea eax, [ebp + 0xc]
call fcn.00404f44
ret

Function at 0x543af4
Capabilities:
Create http request

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, 0x14
mov dword [esp + 4], 0x14
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 3
mov dword [esp + 0x24], 2
mov eax, 0x543b94
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 3
mov eax, 0x543b98
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], eax
push 0
push 0
push 0
push 1
push 0x543b94
call sub.wininet.dll_InternetOpenA
mov dword [esp], eax
push ebx
lea eax, [esp + 8]
push eax
push 0x4b
mov eax, dword [esp + 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [esp + 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [esp]
push eax
call sub.wininet.dll_InternetCloseHandle
add esp, 0x3c
pop ebx
ret

Function at 0x543cf8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.004035ec
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp byte [esp], 0x31
jne 0x543d26
mov al, 1
jmp 0x543d28
xor eax, eax
add esp, 0xc
ret
Function at 0x543d10
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.004035ec
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp byte [esp], 0x31
jne 0x543d26
mov al, 1
jmp 0x543d28
xor eax, eax
add esp, 0xc
ret