joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6407e2c0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x640fe3b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov bl, byte [ebp + 0xc]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x320], eax
push esi
mov esi, ecx
push edi
test bl, bl
je 0x6407e31f
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x6407e31f
call dword [sym.imp.Qt5CoreKso.dll_public:_bool___thiscall_kso_qt::QSocketNotifier::isEnabled_void_const]
test al, al
je 0x6407e31f
mov ecx, dword [esi + 0x78]
push 0
mov byte [ebp - 0x311], 1
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QSocketNotifier::setEnabled_bool_]
jmp 0x6407e326
mov byte [ebp - 0x311], 0
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test bl, bl
je 0x6407e353
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x208], eax
mov ebx, dword [esi + 0x74]
lea eax, [ebp - 0x310]
push 0x104
push 0
push eax
mov edi, ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x108], 0
cmp byte [ebp + 0x10], 0
je 0x6407e39e
mov dword [ebp - 0x310], 1
mov dword [ebp - 0x30c], edi
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x108], 1
mov ebx, dword [ebp - 0x318]
mov eax, 0x10624dd3
imul ebx
mov ecx, ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x328], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
xor ecx, ecx
test ebx, ebx
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x328]
cmovs eax, ecx
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
test edi, edi
jle 0x6407e418
lea eax, [ebp - 0x108]
push eax
push dword [esi + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x6407e418
dec edi
cmp byte [ebp - 0x311], 0
je 0x6407e42c
mov ecx, dword [esi + 0x78]
push 1
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QSocketNotifier::setEnabled_bool_]
test edi, edi
jle 0x6407e468
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
mov ecx, dword [ebp - 0x31c]
test eax, eax
setne al
mov byte [ecx], al
lea eax, [ebp - 0x310]
push eax
push dword [esi + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
mov ecx, dword [ebp - 0x320]
test eax, eax
setne al
mov byte [ecx], al
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.640ad545
mov esp, ebp
pop ebp
ret 0x14
Function at 0x6407e480
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x640fe3b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bh, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test bh, bh
je 0x6407e4c2
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x6407e4c2
call dword [sym.imp.Qt5CoreKso.dll_public:_bool___thiscall_kso_qt::QSocketNotifier::isEnabled_void_const]
test al, al
je 0x6407e4c2
mov ecx, dword [edi + 0x78]
mov bl, 1
push 0
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QSocketNotifier::setEnabled_bool_]
jmp 0x6407e4c4
xor bl, bl
push 0xfc
lea eax, [ebp - 0x100]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [edi + 0x74]
mov ecx, esi
mov dword [ebp - 0x104], eax
add esp, 0xc
mov eax, 0x10624dd3
mov dword [ebp - 0x108], 1
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x214], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
xor ecx, ecx
mov dword [ebp - 0x210], eax
test bh, bh
je 0x6407e540
test esi, esi
lea eax, [ebp - 0x214]
cmovs eax, ecx
push eax
push ecx
push ecx
lea eax, [ebp - 0x108]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
jmp 0x6407e591
mov eax, dword [edi + 0x74]
test esi, esi
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x214]
cmovs eax, ecx
mov dword [ebp - 0x20c], 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jle 0x6407e591
lea eax, [ebp - 0x20c]
push eax
push dword [edi + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x6407e591
dec esi
test bl, bl
je 0x6407e5a0
mov ecx, dword [edi + 0x78]
push 1
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QSocketNotifier::setEnabled_bool_]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.640ad545
mov esp, ebp
pop ebp
ret 8
Function at 0x6407e8b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x54]
cmp eax, 1
je 0x6407e9a4
cmp eax, 2
je 0x6407e9a4
mov esi, dword [ebp + 8]
mov ecx, esi
call sym.Qt5NetworkKso.dll_public:_bool___thiscall_kso_qt::QNetworkInterface::isValid_void_const
test al, al
je 0x6407e991
push ebx
lea eax, [ebp - 4]
mov ecx, esi
push eax
call sym.Qt5NetworkKso.dll_public:_class_kso_qt::QList_class_kso_qt::QNetworkAddressEntry____thiscall_kso_qt::QNetworkInterface::addressEntries_void_
mov eax, dword [ebp - 4]
xor esi, esi
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
sub ecx, edx
test ecx, ecx
jle 0x6407e95f
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [ebp + 8]
push ecx
lea ecx, [edx + 4]
add ecx, esi
lea ecx, [eax + ecx*4]
call sym.Qt5NetworkKso.dll_public:_class_kso_qt::QHostAddress___thiscall_kso_qt::QNetworkAddressEntry::ip_void_
lea ecx, [ebp + 8]
call sym.Qt5NetworkKso.dll_public:_enum_kso_qt::QAbstractSocket::NetworkLayerProtocol___thiscall_kso_qt::QHostAddress::protocol_void_
test eax, eax
jne 0x6407e947
lea ecx, [ebp + 8]
call sym.Qt5NetworkKso.dll_public:_enum_kso_qt::QSsl::SslProtocol___thiscall_kso_qt::QSslConfiguration::sessionProtocol_void_
push eax
call dword [sym.imp.WS2_32.dll_htonl]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 9
push 0
push dword [edi + 0x74]
call ebx
cmp eax, 0xffffffff
jne 0x6407e974
lea ecx, [ebp + 8]
call sym.Qt5NetworkKso.dll_public:_void___thiscall_kso_qt::QHostAddress::destructor_void_
mov eax, dword [ebp - 4]
inc esi
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
sub ecx, edx
cmp esi, ecx
jl 0x6407e904
lea ecx, [ebp - 4]
xor bl, bl
call fcn.6407cb40
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp + 8]
call sym.Qt5NetworkKso.dll_public:_void___thiscall_kso_qt::QHostAddress::destructor_void_
lea ecx, [ebp - 4]
mov bl, 1
call fcn.6407cb40
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 9
push 0
jmp 0x6407e9ca
mov esi, dword [ebp + 8]
mov ecx, esi
call sym.Qt5NetworkKso.dll_public:_bool___thiscall_kso_qt::QNetworkInterface::isValid_void_const
test al, al
je 0x6407e9bb
mov ecx, esi
call sym.Qt5NetworkKso.dll_public:_int___thiscall_kso_qt::QNetworkInterface::index_void_const
jmp 0x6407e9bd
xor eax, eax
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 9
push 0x29
push dword [edi + 0x74]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6407e9f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ecx + 4]
xorps xmm0, xmm0
push ebx
push esi
mov esi, dword [ebp + 0xc]
movlpd qword [ebp - 0xc], xmm0
mov ebx, dword [ebp - 8]
push edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push 0
push 0
add eax, edi
mov dword [ebp - 0x18], esi
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0
push eax
push dword [ecx + 0x74]
call dword [sym.imp.WS2_32.dll_WSASend]
add edi, dword [ebp - 8]
mov ecx, eax
mov eax, 0
adc ebx, eax
cmp ecx, 0xffffffff
je 0x6407ea5e
cmp edi, dword [ebp + 0xc]
jne 0x6407ea59
cmp ebx, dword [ebp + 0x10]
je 0x6407eac0
mov ecx, dword [ebp - 4]
jmp 0x6407ea13
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x6407eac0
cmp eax, 0x2747
jne 0x6407ea92
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, edi
sbb eax, ebx
js 0x6407ea8d
jg 0x6407ea88
cmp esi, 0xc000
jbe 0x6407ea8d
mov esi, 0xc000
mov ecx, dword [ebp - 4]
jmp 0x6407ea13
add eax, 0xffffd8bb
cmp eax, 1
ja 0x6407eac0
mov ecx, dword [ebp - 4]
push 0x14
push 7
call fcn.6407c150
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov esi, dword [eax]
call dword [esi + 0x50]
pop edi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x64086400
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp eax, 8
ja case.default.0x6408640b
jmp dword [eax*4 + 0x64086474]
push str.Organization
jmp 0x6408644f
push str.CommonName
jmp 0x6408644f
push str.CountryName
jmp 0x6408644f
push str.LocalityName
jmp 0x6408644f
push str.OrganizationalUnitName
jmp 0x6408644f
push str.StateOrProvinceName
jmp 0x6408644f
push str.DistinguishedNameQualifier
jmp 0x6408644f
push str.SerialNumber
jmp 0x6408644f
push str.EmailAddress
lea ecx, [ebp + 0xc]
call dword [sym.imp.Qt5CoreKso.dll_public:_class_kso_qt::QDebug____thiscall_kso_qt::QDebug::operator___char_const__]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
inc dword [ecx + 0xc]
mov dword [esi], ecx
lea ecx, [ebp + 0xc]
call dword [sym.imp.Qt5CoreKso.dll_public:_void___thiscall_kso_qt::QDebug::destructor_void_]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x640acb20
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x640acba0
mov eax, dword [ebp + 0x10]
cmp eax, 8
ja case.default.0x640acb36
jmp dword [eax*4 + 0x640acbfc]
mov ecx, dword [ebp + 8]
pop ebp
jmp sym.Qt5NetworkKso.dll_public:_void___thiscall_kso_qt::QHttpSocketEngine::slotSocketConnected_void_
mov ecx, dword [ebp + 8]
pop ebp
jmp sym.Qt5NetworkKso.dll_public_virtual:_void___thiscall_kso_qt::QTcpServerPrivate::configureCreatedSocket_void_
mov ecx, dword [ebp + 8]
pop ebp
jmp sym.Qt5NetworkKso.dll_public:_void___thiscall_kso_qt::QHttpSocketEngine::slotSocketReadNotification_void_
mov ecx, dword [ebp + 8]
pop ebp
jmp sym.Qt5NetworkKso.dll_public:_void___thiscall_kso_qt::QHttpSocketEngine::slotSocketBytesWritten_void_
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call sym.Qt5NetworkKso.dll_public:_void___thiscall_kso_qt::QHttpSocketEngine::slotSocketError_enum_kso_qt::QAbstractSocket::SocketError_
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call sym.Qt5NetworkKso.dll_protected_virtual:_void___thiscall_kso_qt::QNetworkReply::ignoreSslErrorsImplementation_class_kso_qt::QList_class_kso_qt::QSslError__const__
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp sym.Qt5NetworkKso.dll_private:_void___thiscall_kso_qt::QHttpSocketEngine::emitPendingReadNotification_void_
mov ecx, dword [ebp + 8]
pop ebp
jmp sym.Qt5NetworkKso.dll_private:_void___thiscall_kso_qt::QHttpSocketEngine::emitPendingWriteNotification_void_
mov ecx, dword [ebp + 8]
pop ebp
jmp sym.Qt5NetworkKso.dll_private:_void___thiscall_kso_qt::QHttpSocketEngine::emitPendingConnectionNotification_void_
cmp eax, 0xc
jne case.default.0x640acb36
mov eax, dword [ebp + 0x10]
push esi
sub eax, 4
je 0x640acbd8
sub eax, 1
je 0x640acbc1
mov eax, dword [ebp + 0x14]
pop esi
mov eax, dword [eax]
mov dword [eax], 0xffffffff
pop ebp
ret
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
cmp dword [eax], 0
jne 0x640acbe3
call fcn.64071890
mov ecx, dword [esi]
pop esi
mov dword [ecx], eax
pop ebp
ret
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
cmp dword [eax], 0
je 0x640acbee
mov eax, dword [esi]
pop esi
mov dword [eax], 0xffffffff
pop ebp
ret
call fcn.640207b0
mov ecx, dword [esi]
pop esi
mov dword [ecx], eax
pop ebp
ret
Function at 0x4fb640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x8bb020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4fb6d8
push 0x80000002
call fcn.004f9290
test eax, eax
jne 0x4fb6b8
xor eax, eax
push ebp
push 0x4fb6b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4fb6f4
mov eax, dword [ebp - 4]
push eax
call fcn.004f9298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb6b8
mov eax, dword [ebp - 4]
push eax
call fcn.004f9288
ret
mov ax, word [0x8bb020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x8bb020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4fc404
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x8cc044], 0
je 0x4fc465
cmp word [0x8cc218], 0xd7b2
jne 0x4fc42d
cmp dword [0x8cc220], 0
jbe 0x4fc42d
mov eax, 0x8cc214
call dword [fcn.008cc230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x8bb090
push 0xfffffffffffffff5
call fcn.004f91b0
push eax
call fcn.004f91e8
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4fc48c
push 0xfffffffffffffff5
call fcn.004f91b0
push eax
call fcn.004f91e8
pop edx
ret
cmp byte [0x8bb030], 0
jne 0x4fc481
push 0
push 0x8bb088
push 0x8bb090
push 0
call fcn.004f9200
pop edx
ret
Function at 0x4fd9f8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x121]
push eax
push 0
call fcn.004f9238
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4fdc3c
push 0x80000001
call fcn.004f9290
test eax, eax
je 0x4fda7a
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4fdc3c
push 0x80000002
call fcn.004f9290
test eax, eax
je 0x4fda7a
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4fdc58
push 0x80000001
call fcn.004f9290
test eax, eax
jne 0x4fdb03
xor eax, eax
push ebp
push 0x4fdafc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x121]
mov edx, 0x105
call fcn.004fd820
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004f9298
test eax, eax
je 0x4fdae1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4fdc78
mov eax, dword [ebp - 8]
push eax
call fcn.004f9298
test eax, eax
je 0x4fdae1
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdb03
mov eax, dword [ebp - 8]
push eax
call fcn.004f9288
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x121]
push eax
call fcn.004f9270
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.004f9258
push eax
call fcn.004f9230
xor ebx, ebx
cmp byte [ebp - 0x121], 0
je 0x4fdc33
cmp byte [ebp - 0xd], 0
jne 0x4fdb4a
cmp byte [ebp - 0x12], 0
je 0x4fdc33
lea eax, [ebp - 0x121]
push eax
call fcn.004f9278
lea edx, [ebp - 0x121]
add eax, edx
mov dword [ebp - 0x1c], eax
jmp 0x4fdb66
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x2e
je 0x4fdb79
lea eax, [ebp - 0x121]
cmp eax, dword [ebp - 0x1c]
jne 0x4fdb63
lea eax, [ebp - 0x121]
cmp eax, dword [ebp - 0x1c]
je 0x4fdc33
inc dword [ebp - 0x1c]
cmp byte [ebp - 0x12], 0
je 0x4fdbbd
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f9270
push 2
push 0
lea eax, [ebp - 0x121]
push eax
call fcn.004f9260
mov ebx, eax
test ebx, ebx
jne 0x4fdc33
cmp byte [ebp - 0xd], 0
je 0x4fdc33
lea eax, [ebp - 0x121]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f9270
push 2
push 0
lea eax, [ebp - 0x121]
push eax
call fcn.004f9260
mov ebx, eax
test ebx, ebx
jne 0x4fdc33
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x121]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f9270
push 2
push 0
lea eax, [ebp - 0x121]
push eax
call fcn.004f9260
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fe304
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4fe36a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call fcn.004f9230
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004fc7f8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004fb234
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4fe354
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe371
lea eax, [ebp - 0x10]
call fcn.004fc588
ret

Function at 0x502790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call fcn.004fe744
test eax, eax
jle 0x5027c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004fc678
jmp 0x5027d2
mov eax, ebx
mov edx, esi
call fcn.004fc5dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5027dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call fcn.004fe744
test eax, eax
jle 0x5027fd
mov al, byte [esp]
jmp 0x5027ff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x503c58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x503cbc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call fcn.004fe744
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004fc7f8
mov eax, dword [ebp - 0xc]
push eax
call fcn.004fe704
mov edx, eax
pop eax
call fcn.004ffc20
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503cc3
lea eax, [ebp - 0xc]
call fcn.004fc588
ret
Function at 0x504d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x8bb33c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x504e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x504dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x504e5f
dec edx
je 0x504ea0
jmp 0x504efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x504efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x504f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x504f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x50508f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x504fb0
je 0x504ffc
sub ecx, 0x2b
je 0x504ff2
sub ecx, 4
je 0x504ff7
dec ecx
sub ecx, 0xa
jb 0x504fe1
jmp 0x504fff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x504fc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x504fd0
jmp 0x504fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x504fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x504fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x504fff
mov byte [eax], 0x3e
jmp 0x504fff
mov byte [eax], 0x3f
jmp 0x504fff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x504f8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x50504f
cmp byte [esp + 3], 0xff
jne 0x50504f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x505087
cmp dl, 0xff
je 0x505087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x504f88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x50511c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x8cc7a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x505138
shr eax, 1
xor eax, 0xedb88320
jmp 0x50513a
shr eax, 1
dec edx
jne 0x50512b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x505124
pop ebx
ret