joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475268
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x536bbc]
cmp dword [eax + 0x30], 0
je 0x475312
cmp dword [ebx + 0x94], 0
jne 0x47530c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4751f8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47530c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4752d2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x47530c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d6c8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4752e1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x475e70
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x475ea5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404834
jmp 0x475eb2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404798
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x476ed8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x476f19
mov eax, esi
call fcn.0045cec8
test al, al
je 0x476f19
mov eax, dword [ebx + 0x84]
call fcn.0045cbc4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x476f19
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045cbc4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x478ed8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c04
xor eax, eax
push ebp
push 0x479006
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x478fd9
xor eax, eax
push ebp
push 0x478fd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a14
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x478fa7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x478f96
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a14
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404c14
mov edx, ebx
pop ecx
call fcn.00402d68
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478f9d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x535080]
mov dl, 1
mov eax, dword [0x408608]
call fcn.0040e060
call fcn.00404098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47900d
lea eax, [ebp - 4]
call fcn.00404744
ret
Function at 0x479014
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4791c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404e08
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4791dc
call fcn.00404a60
mov eax, ebx
call fcn.004269bc
mov edi, eax
dec edi
test edi, edi
jl 0x4790cc
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00426990
mov edx, dword [0x44b12c]
call fcn.00403a50
test al, al
je 0x4790c8
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00426990
lea edx, [ebp - 0x14]
call fcn.004563d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404e08
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ad4
inc esi
dec edi
jne 0x47907a
mov al, byte [0x4791e0]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4791ec
mov eax, dword [ebp - 0xc]
call fcn.0040f554
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004047dc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004563d4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4791dc
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004563d4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4791dc
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4791dc
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4791f8
call fcn.0040af5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4791cc
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404768
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404768
lea eax, [ebp - 0x14]
call fcn.00404744
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404768
ret
Function at 0x47a17c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4102f4]
call fcn.00405494
xor eax, eax
push ebp
push 0x47a2c0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5273a4], 0
jne 0x47a1cf
mov ecx, dword [0x535004]
mov dl, 1
mov eax, dword [0x408608]
call fcn.0040e060
call fcn.00404098
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403288
mov eax, ebx
call fcn.004050b4
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x47a2d0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406768
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050c4
test eax, eax
jle 0x47a267
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x47a260
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004049dc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004049c4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409538
test eax, eax
jne 0x47a260
mov ebx, 0x15
jmp 0x47a26c
mov ebx, 0x10
jmp 0x47a26c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5273a4]
call fcn.0047a078
mov eax, dword [ebp - 8]
call fcn.0047a078
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a2c7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404768
lea eax, [ebp - 0x10]
mov edx, dword [0x4102f4]
call fcn.00405564
ret

Function at 0x47c2c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00407fbc
test eax, eax
je 0x47c301
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0047c260
lea eax, [ebp - 0xc]
call fcn.0047c2a8
jmp 0x47c309
mov eax, dword [ebp - 8]
call fcn.00404744
mov esp, ebp
pop ebp
ret
Function at 0x47c750
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.00403288
cmp dword [ebp - 4], 0
je 0x47c804
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
mov ax, word [ebp + 8]
mov edx, dword [ebp - 4]
mov dx, word [edx + 8]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x47c7c0
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.0047c6bc
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xa]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.00402d68
jmp 0x47c7d0
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.00402d68
mov dx, word [ebp - 6]
dec edx
test dx, dx
jb 0x47c7ea
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x47c7e1
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 0xc]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0x14]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47c81c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x47c89e
mov dx, word [eax + 8]
mov word [esp + 4], dx
mov esi, eax
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
movzx edx, word [esp + 4]
dec edx
test edx, edx
jl 0x47c85b
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x6a
inc eax
dec edx
jne 0x47c854
mov esi, dword [ebx + 0x154]
mov eax, ebx
call dword [esi + 0xc]
mov esi, dword [ebx + 0x154]
movzx ecx, word [esp + 4]
lea edx, [ebx + 0xd4]
mov eax, ebx
call dword [esi + 0x14]
mov eax, dword [ebx + 0x154]
mov esi, eax
movzx ecx, word [eax + 0xa]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x14]
mov esi, dword [ebx + 0x154]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x47c8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47c916
mov dword [ebp - 0x10], 1
jmp 0x47ca64
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xa]
test ax, ax
jne 0x47c92e
mov dword [ebp - 0x10], 2
jmp 0x47ca64
xor edx, edx
mov dword [ebp - 0x10], edx
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 4
call fcn.00403288
movzx eax, word [ebp + 8]
dec eax
movzx edx, word [ebp - 0x14]
mov ecx, edx
cdq
idiv ecx
inc eax
test ax, ax
jbe 0x47ca64
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x20]
call fcn.0047c8dc
lea eax, [ebp - 0xa8]
xor ecx, ecx
mov edx, 0x40
call fcn.00403288
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x47ca2b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 1
mov ax, word [ebp - 0xa]
push eax
lea eax, [ebp - 0x200]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0047c750
cmp dword [ebp - 0x18], 1
jne 0x47c9e0
movzx ecx, word [ebp + 0x14]
lea eax, [ebp - 0x200]
mov edx, dword [ebp + 0x18]
call fcn.0047c80c
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x200]
mov ecx, 4
call fcn.0047c80c
jmp 0x47c9f2
movzx ecx, word [ebp - 0x14]
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.0047c80c
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.0047c81c
mov cx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x47ca1f
inc ecx
lea eax, [ebp - 0x68]
lea edx, [ebp - 0xa8]
mov bl, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec cx
jne 0x47ca14
inc dword [ebp - 0x18]
dec dword [ebp - 0x28]
jne 0x47c99d
mov cx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x47ca5a
inc ecx
lea eax, [ebp - 0xa8]
mov dx, word [ebp - 0x12]
cmp dx, word [ebp + 8]
jae 0x47ca54
mov dl, byte [eax]
mov ebx, dword [ebp - 0x1c]
mov byte [ebx], dl
inc word [ebp - 0x12]
inc dword [ebp - 0x1c]
inc eax
dec cx
jne 0x47ca3c
dec word [ebp - 0x22]
jne 0x47c96e
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x47cad4
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
add edx, 4
dec ecx
jne 0x47cadc
mov ecx, 0x40
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x47caf5
pop ebx
ret
Function at 0x47ef04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x47ef33
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x47efb2
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0047d954
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x47ef80
mov cx, word [esp]
sub cx, si
jmp 0x47ef82
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x47ef69
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x47efa8
mov cx, word [esp]
sub cx, si
jmp 0x47efaa
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x47ef91
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x47f097
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0047ec70
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x47effe
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x47f014
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x47ef0e
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x47f097
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x47f056
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x47f03b
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.0047d93c
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x47f097
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x47f097
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x47f07c
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, dword [ebx + 0x16c0]
push eax
call fcn.0047d93c
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4868ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x486931
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x48690e
mov esp, ebp
pop ebp
ret 4
Function at 0x489190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00402d68
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x48926f
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x52ce00]
mov edx, 8
call fcn.00486750
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x52ce00]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x52ce00]
mov edx, 0x10
call fcn.00486750
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x52ce00]
mov edx, 0x18
call fcn.00486750
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x4891f2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48c4e4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x48c53e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5350c8]
cmp byte [eax], 0
je 0x48c50e
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x48c528
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040497c
mov eax, dword [ebp - 4]
call fcn.00404c14
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c545
lea eax, [ebp - 4]
call fcn.00404744
ret

Function at 0x48c54c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48c5ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5350c8]
cmp byte [eax], 0
je 0x48c57a
push esi
push ebx
call sub.kernel32.dll_SetFileAttributesW
mov ebx, eax
jmp 0x48c595
push esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040497c
mov eax, dword [ebp - 4]
call fcn.00404c14
push eax
call sub.kernel32.dll_SetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c5b2
lea eax, [ebp - 4]
call fcn.00404744
ret
Function at 0x48c62c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48c6a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5350c8]
cmp byte [eax], 0
je 0x48c65c
push esi
push ebx
call sub.kernel32.dll_MoveFileW
mov ebx, eax
jmp 0x48c689
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040497c
mov eax, dword [ebp - 4]
call fcn.00404c14
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040497c
mov eax, dword [ebp - 8]
call fcn.00404c14
push eax
call sub.kernel32.dll_MoveFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c6ab
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404768
ret

Function at 0x48c95c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00407f4c
cmp ax, 0xffff
jne 0x48c97d
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x48ca09
push eax
push edi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x48ca09
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x48c9ca
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x48c9b6
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x48ca09
cmp dword [ebp + 8], 0
jle 0x48ca09
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00431230
mov esi, eax
test esi, esi
jle 0x48ca00
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407f68
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x48d554
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x48d5b8
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004049c4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409da0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d5bf
lea eax, [ebp - 0xc]
call fcn.00404744
ret