joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4595e0
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x459618
mov eax, ebx
mov edx, esp
mov ecx, 0x105
push 0
call fcn.0040747c
jmp 0x45961f
mov eax, ebx
call fcn.00406de8
add esp, 0x108
pop ebx
ret

Function at 0x459928
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x459a22
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x459a30
push 0x459a5c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040ba0c
test eax, eax
je 0x45996f
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x459995
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.004086b0
push edx
push eax
lea ecx, [ebp - 0x64]
mov dl, 0x30
mov eax, 1
call fcn.0040f2e8
push dword [ebp - 0x64]
push 0x459a84
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.004086b0
push edx
push eax
lea ecx, [ebp - 0x68]
mov dl, 0x30
mov eax, 1
call fcn.0040f2e8
push dword [ebp - 0x68]
push 0x459a94
mov eax, ebx
mov edx, 4
call fcn.004075b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459a29
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00406e54
ret
Function at 0x459de8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x459f27
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
call fcn.00406de8
xor eax, eax
push ebp
push 0x459f02
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, esi
call fcn.00406f80
push 0
mov edx, edi
lea eax, [ebp - 8]
mov ecx, ebx
call fcn.00406f80
mov eax, dword [ebp - 4]
call fcn.004072a0
cmp ebx, eax
jne 0x459ef8
mov eax, dword [ebp - 8]
call fcn.004072a0
cmp ebx, eax
jne 0x459ef8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040767c
je 0x459ef8
lea eax, [ebp - 0x10]
push eax
push 0x40
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x459ef8
mov edx, esi
mov eax, edi
mov ecx, ebx
call fcn.004044e8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0x4bddfc]
call fcn.00408a50
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, 0x4bddfc
mov ecx, 1
mov edx, dword [0x459dbc]
call fcn.00408c18
add esp, 4
lea edi, [ebx + ebx*2]
mov eax, dword [0x4bddfc]
mov dword [eax + edi*4], esi
mov eax, dword [0x4bddfc]
lea eax, [eax + edi*4 + 4]
mov edx, dword [ebp - 4]
call fcn.00407220
mov eax, dword [0x4bddfc]
lea eax, [eax + edi*4 + 8]
mov edx, dword [ebp - 8]
call fcn.00407220
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459f2e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406e54
ret
Function at 0x459f3c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a042
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bddfc]
call fcn.00408a58
test eax, eax
jl 0x45a01d
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
lea eax, [eax + eax*2]
mov edx, dword [0x4bddfc]
lea ebx, [edx + eax*4]
xor eax, eax
push ebp
push 0x45a007
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebx + 8]
call fcn.004072a0
mov ecx, eax
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.00406f80
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 8]
call fcn.0040767c
jne 0x459ffd
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebx + 4]
call fcn.004072a0
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x459ffd
mov eax, dword [ebx + 4]
call fcn.004072a0
mov ecx, eax
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
call fcn.004044e8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.004072a0
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a011
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x459f75
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a049
lea eax, [ebp - 4]
call fcn.00406de8
ret
Function at 0x45cf74
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId_1
cmp esi, eax
je 0x45cf9e
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
cmp esi, 0xffffffff
je 0x45cf9e
push edi
call sub.kernel32.dll_ResumeThread
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x460e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406eb8
mov eax, dword [ebp - 8]
call fcn.00406eb8
xor eax, eax
push ebp
push 0x460fa9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x460f7c
mov eax, dword [ebp - 4]
call fcn.004076c4
push eax
call sub.kernel32.dll_GetModuleHandleA
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00411b5c
mov dword [edi], eax
test esi, esi
je 0x460ef0
cmp word [esi], 0x25ff
jne 0x460ef0
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x460ef2
xor ebx, ebx
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x4bcc30]
je 0x460f0a
cmp byte [0x4b86f0], 0
je 0x460f21
lea eax, [ebp - 0x14]
call fcn.0043520c
mov eax, dword [ebp - 0x14]
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
call fcn.004354dc
jmp 0x460f30
mov edx, dword [edi]
mov ecx, dword [ebp + 8]
mov eax, dword [0x4bcc30]
call fcn.00435444
test ebx, ebx
je 0x460f3f
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x460f43
xor eax, eax
jmp 0x460f45
mov al, 1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x460f80
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x460f80
mov eax, dword [ebp + 8]
mov dword [ebx], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x460f80
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460fb0
lea eax, [ebp - 0x14]
mov edx, dword [0x4351dc]
call fcn.00408d3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406e54
ret
Function at 0x460fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x461095
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x461079
test esi, esi
je 0x461001
cmp word [esi], 0x25ff
jne 0x461001
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x461003
xor ebx, ebx
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x4bcc30]
je 0x46101b
cmp byte [0x4b86f0], 0
je 0x461032
lea eax, [ebp - 0xc]
call fcn.0043520c
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.004354dc
jmp 0x461041
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x4bcc30]
call fcn.00435444
test ebx, ebx
je 0x461079
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x461079
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x461079
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46109c
lea eax, [ebp - 0xc]
mov edx, dword [0x4351dc]
call fcn.00408d3c
ret
Function at 0x46186c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x4126d8]
call fcn.004081ac
xor eax, eax
push ebp
push 0x46192c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x45], 0
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.00417b0c
cmp byte [ebp - 0x40], 0
je 0x461910
mov eax, dword [ebp - 0x20]
call fcn.00408a58
test eax, eax
jl 0x461910
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
cmp byte [ebx + 0x10], 0
je 0x46190c
cmp edi, dword [ebx + 0xc]
jne 0x46190c
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x461910
mov edx, dword [ebp - 0x44]
sub edx, dword [ebx + 8]
mov eax, dword [ebx + 0x14]
mov dword [eax], edx
lea edx, [ebp - 0x4c]
push edx
mov edx, dword [ebp - 0x4c]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov byte [ebp - 0x45], 1
jmp 0x461910
inc esi
dec eax
jne 0x4618bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461933
lea eax, [ebp - 0x40]
mov edx, dword [0x4126d8]
call fcn.00408284
ret

Function at 0x4620d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406eb8
lea eax, [ebp - 0xc]
mov edx, dword [0x4621d8]
call fcn.004081ac
xor eax, eax
push ebp
push 0x46218a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x462198
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
je 0x46215e
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040f32c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x4621bc
call fcn.00407530
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407268
lea eax, [ebp - 0xc]
push eax
push 0x461fe4
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462191
lea eax, [ebp - 0x10]
call fcn.00406de8
lea eax, [ebp - 0xc]
mov edx, dword [0x4621d8]
call fcn.00408284
lea eax, [ebp - 4]
call fcn.00406de8
ret
Function at 0x46225c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x46232a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040f32c
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x462344
call fcn.00407530
mov eax, dword [ebp - 4]
call fcn.004076c4
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x46230f
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x462309
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4622f1
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x4b8728
lea eax, [esi + 8]
mov ecx, 0x50
call fcn.004044e8
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462331
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406e54
ret
Function at 0x462434
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4625e6
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
push 0x104
lea edx, [ebp - 0x119]
push edx
push eax
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x119]
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x462545
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov edi, eax
test edi, edi
je 0x46253f
push 0
push 0
push 0
push 4
push edi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x462539
mov eax, dword [ebp - 8]
call fcn.00411888
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x462530
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x58], 0
je 0x462530
mov eax, dword [ebp - 0xc]
add eax, 0x58
mov dword [ebp - 0x10], eax
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004623d8
mov ecx, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
sub edx, eax
sub edx, 4
mov eax, dword [ebp - 0x10]
add eax, 4
call fcn.004623d8
add eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0x58]
je 0x462530
mov bl, 1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push edi
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4625ba
push 0x10
push 0
lea edx, [ebp - 0x120]
mov eax, dword [0x4b8e2c]
mov ecx, dword [eax]
call dword [ecx + 0x248]
mov eax, dword [ebp - 0x120]
call fcn.004076c4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x4bcc30]
je 0x4625b3
mov eax, 0x4b8e2c
call fcn.0040a2b8
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 4]
call fcn.00407b04
mov ecx, dword [ebp - 0x124]
mov dl, 1
mov eax, dword [0x40c4c4]
call fcn.0040c5ec
call fcn.004064c8
jmp 0x4625ba
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4625ed
lea eax, [ebp - 0x124]
call fcn.00406dc4
lea eax, [ebp - 0x120]
call fcn.00406de8
lea eax, [ebp - 4]
call fcn.00406de8
ret
Function at 0x462770
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46287a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x462888
mov edx, 0x462894
mov eax, esi
call fcn.00411f00
mov eax, dword [ebp - 4]
call fcn.004072a0
cmp eax, 0x14
jne 0x462864
cmp esi, dword [0x4bcc30]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x462864
mov eax, esi
call fcn.00411888
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [ebx + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp esi, dword [0x4bcc30]
jne 0x462811
mov edx, 0x433ff8
mov eax, dword [ebp - 4]
sub edx, dword [eax]
sub edx, esi
mov dword [ebx + 0x2c], edx
mov edx, 0x4b8688
sub edx, dword [eax + 4]
sub edx, esi
mov dword [ebx + 0x30], edx
jmp 0x46282a
mov eax, dword [ebp - 4]
mov edx, dword [eax]
and edx, 0x7fffffff
mov dword [ebx + 0x2c], edx
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [ebx + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x20], edx
mov eax, dword [eax + 0x10]
mov dword [ebx + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [ebx + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462881
lea eax, [ebp - 4]
call fcn.00406de8
ret
Function at 0x4743e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x474441
test eax, edx
je 0x474444
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4743ff
movzx eax, word [eax]
sub eax, ecx
jmp 0x474426
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x474427
add ecx, 4
js 0x474417
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x474424
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x474426
xor eax, eax
ret
test eax, eax
je 0x474450
test edx, edx
jne 0x4743f0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x478390
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4783c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406f2c
jmp 0x4783d2
mov eax, ebx
mov edx, esi
call fcn.00407184
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4783dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4783fe
movzx eax, word [esp]
jmp 0x478400
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4790bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4791e1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00478ecc
mov esi, eax
mov eax, dword [0x4b97f8]
cmp byte [eax], 0
je 0x479189
mov eax, dword [0x4b9688]
call fcn.00404a9c
call fcn.00404498
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x479094]
call fcn.00408c18
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4791fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4791c5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4b9650]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4bcc30]
call fcn.00408df4
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4791e8
lea eax, [ebp - 4]
mov edx, dword [0x479094]
call fcn.00408d3c
ret

Function at 0x47aa00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004072ac
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a92c
mov edi, eax
cmp edi, 0x104
jbe 0x47a9ab
mov eax, edi
add eax, eax
call fcn.0040433c
mov esi, eax
jmp 0x47a9ad
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a92c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x47a9e6
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x47a9d0
mov eax, esp
cmp esi, eax
je 0x47a9f3
mov eax, esi
call fcn.00404358
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x47aa2c
cmp bl, 0
je 0x47aa28
cmp bl, 0x41
jl 0x47aa23
cmp bl, 0x5a
jg 0x47aa23
or bl, 0x20
xor al, bl
inc esi
jmp 0x47aa07
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x47a96c

Function at 0x47b1ac
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407ae8
add esp, 0x800
pop ebx
ret
Function at 0x49dd10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x49ddae
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x49dd72
cmp byte [ebx + 0x10], 0
jne 0x49dd72
cmp byte [ebx + 0x3c], 0
jne 0x49dd72
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x49dd93
lea edx, [ebp - 4]
mov eax, dword [0x4b97b8]
call fcn.0040a898
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48e74c]
call fcn.00479200
call fcn.004064c8
jmp 0x49dd93
lea edx, [ebp - 8]
mov eax, dword [0x4b97b8]
call fcn.0040a898
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48e74c]
call fcn.00479200
call fcn.004064c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ddb5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406e24
ret

Function at 0x49e6bc
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x49e70a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0049dc5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e723
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret