joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44684f
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401fd0
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0x1288e80]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.00401eb0
mov eax, dword [esp + 4]
test eax, eax
je 0x446834
mov eax, dword [esp + 0x1c]
lea ecx, [0x1288e80]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.004098c0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00401eb0
mov eax, dword [esp + 4]
test eax, eax
je 0x446822
mov eax, dword [esp + 0x1c]
lea ecx, [0x1288e80]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.00446c60
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
je 0x446744
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401fd0
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409ac0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x44681e
mov ecx, dword [eax + 0x10]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4467a1
mov eax, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.0045af90
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x446838
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x4467db
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00446860
movzx eax, byte [esp + 4]
test al, al
je 0x4467d7
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x4467db
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.004462d0
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x44681e
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x44681e
nop
lea eax, [0xc0272c]
mov dword [esp], eax
call fcn.0045e3f0
add esp, 0x30
ret
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409ac0
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x9fbce1]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00434780
nop
call fcn.0045e560
jmp fcn.00446650
Function at 0x44e5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e743
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44e73b
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44e61c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44e61c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44e62f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44e710
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44e702
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44e6fb
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44e686
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44e6cf
mov eax, 1
cmp eax, ecx
ja 0x44e6bd
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0045fa90
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x44e6f6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x44e6c2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44e68b
call fcn.0045fa30
xor eax, eax
call fcn.0045fa20
call fcn.0045fa90
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x44e736
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x44e707
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x44e634
call fcn.0045fa30
xor eax, eax
call fcn.0045fa20
nop
call fcn.0045e560
jmp fcn.0044e5c0
Function at 0x455a80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x455b1f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045fc47
lea ecx, [0x455b30]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045e450
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045e560
jmp fcn.00455a80
Function at 0x45f850
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x12ad280]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45e01b
je 0x45e06a
cmp ebx, 0x20
jbe 0x45e070
cmp ebx, 0x40
jbe 0x45e0ae
jmp 0x45e13f
test ebx, ebx
je 0x45e060
add eax, 0x10
test ax, 0xff0
je 0x45e04c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xcb3620]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xcb3720]
jmp 0x45e038
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45e038
pxor xmm1, xmmword [0x12ad290]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x12ad290]
pxor xmm2, xmmword [0x12ad2a0]
pxor xmm3, xmmword [0x12ad2b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x12ad290]
pxor xmm2, xmmword [0x12ad2a0]
pxor xmm3, xmmword [0x12ad2b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45e19e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x12accc7], 0
je 0x45f86a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45dfe0
jmp fcn.004080f0

Function at 0x460670
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0045f7d0
call fcn.0045e3d0
ret
Function at 0x48aeb0
Capabilities:
Reference http user-agent string
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48b000
sub esp, 0x24
mov eax, dword [esp + 0x30]
test eax, eax
je 0x48afc5
movzx ecx, byte [esp + 0x34]
test cl, cl
je 0x48aee9
test eax, 0x60
jne 0x48afad
test eax, 0x200
jne 0x48aefc
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov eax, dword [esp + 0x28]
jmp 0x48af32
lea ecx, [0x9e99a2]
mov dword [esp], ecx
mov dword [esp + 4], 9
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.00480a30
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, edx
and edx, 0x1f
cmp edx, 0x14
jne 0x48af89
mov dword [esp + 0x20], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.0048c210
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48af74
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test ecx, ecx
je 0x48af68
mov ecx, dword [ecx + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
add esp, 0x24
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.00487350
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
add esp, 0x24
ret
lea eax, [0x95cee0]
mov dword [esp], eax
lea eax, [0xc955dc]
mov dword [esp + 4], eax
call fcn.00434020
lea eax, [0x988ea0]
mov dword [esp], eax
call fcn.0040b920
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x17
lea ecx, [0x9f9486]
mov dword [eax], ecx
mov dword [eax + 8], 0
lea ecx, [0x970140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00434020
nop
call fcn.0045e560
jmp fcn.0048aeb0

Function at 0x48f1c0
Capabilities:
Reference http user-agent string
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48f285
sub esp, 0x10
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48f26c
mov eax, dword [esp + 0x14]
lea ecx, [0xcb1d7c]
cmp eax, ecx
jne 0x48f250
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004840a0
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0xf]
test cl, 0x20
je 0x48f238
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0045a840
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x16
add esp, 0x10
ret
lea eax, [0x95cee0]
mov dword [esp], eax
lea eax, [0xc9549c]
mov dword [esp + 4], eax
call fcn.00434020
mov dword [esp], eax
lea eax, [0x9da820]
mov dword [esp + 4], eax
lea eax, [0x9ce640]
mov dword [esp + 8], eax
call fcn.00408e40
lea eax, [0x95cee0]
mov dword [esp], eax
lea eax, [0xc95494]
mov dword [esp + 4], eax
call fcn.00434020
nop
call fcn.0045e560
jmp fcn.0048f1c0
Function at 0x57bf70
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57c0e3
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x57bfa3
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x57bfa3
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x57bfa9
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x57bfb7
cmp ecx, 4
jne 0x57bfe8
cmp al, 0x2c
ja 0x57bfd0
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x57bfe2
cmp al, 0x24
je 0x57bfe2
cmp al, 0x26
jae 0x57bfe2
jmp 0x57bfe8
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x57bfe2
cmp al, 0x5b
je 0x57bfe2
cmp al, 0x5d
jne 0x57bfe8
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x57c01f
cmp al, 0x26
ja 0x57c001
cmp al, 0x24
je 0x57c03e
cmp al, 0x26
je 0x57c03e
jmp 0x57c0c5
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x57c03e
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x57c0bf
cmp al, 0x2f
je 0x57c03e
jmp 0x57c0c5
cmp al, 0x3d
ja 0x57c036
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x57c03e
cmp al, 0x3d
je 0x57c03e
jmp 0x57c0c5
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x57c0b5
cmp ecx, 2
jg 0x57c079
cmp ecx, 1
je 0x57c06e
cmp ecx, 2
jne 0x57c0c5
cmp al, 0x2f
je 0x57c05c
cmp al, 0x3b
je 0x57c05c
cmp al, 0x2c
jne 0x57c063
mov eax, 1
jmp 0x57c069
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x57c09f
cmp al, 0x40
je 0x57c08d
cmp al, 0x2f
je 0x57c08d
cmp al, 0x3f
jne 0x57c094
mov eax, 1
jmp 0x57c09a
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x57c0af
cmp ecx, 7
jne 0x57c0c5
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x57c0bf
cmp al, 0x7e
jne 0x57c0c5
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x57c0dd
cmp al, 0x21
je 0x57c0d7
add eax, 0xffffffd8
cmp al, 2
ja 0x57c0dd
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.0045e560
jmp fcn.0057bf70
Function at 0x8c4850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x8c4a15
sub esp, 0x6c
lea ecx, [0xcaa174]
mov edx, dword [esp + 0x70]
mov dword [edx + 0xc], ecx
mov ecx, dword [0x12ad060]
test ecx, ecx
jne 0x8c488c
mov eax, dword [esp + 0x80]
mov dword [edx + 0x10], eax
jmp 0x8c489b
lea edi, [edx + 0x10]
mov eax, dword [esp + 0x80]
call fcn.0045f9a0
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x58], ecx
mov eax, dword [eax + 0x10]
mov dword [esp + 0x50], eax
mov ebx, dword [edx]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
call fcn.008c9180
movzx eax, byte [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test al, al
jne 0x8c4958
mov dword [esp + 0x54], ebx
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], ecx
call fcn.00409170
mov eax, dword [esp + 8]
lea ecx, [0x95cee0]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
mov dword [esp], eax
lea ecx, [0x9fd553]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1c
lea ecx, [esp + 0x64]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 1
call fcn.008c1480
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov ebx, dword [esp + 0x54]
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x40], eax
call fcn.008c5650
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
add esp, 0x6c
ret
call fcn.0045e560
jmp fcn.008c4850
Function at 0x8d41a0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x8d4211
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xe8]
mov edx, dword [eax + 0xe4]
test ecx, ecx
jne 0x8d4205
mov eax, dword [eax + 0x128]
test eax, eax
je 0x8d41ef
mov dword [esp], eax
call fcn.008d41a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
add esp, 0xc
ret
lea eax, [0xa14d8a]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x48
add esp, 0xc
ret
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
add esp, 0xc
ret
call fcn.0045e560
jmp fcn.008d41a0
Function at 0x403794
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x452020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40382c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40380c
xor eax, eax
push ebp
push 0x403805
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403848
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40380c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x452020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x452020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404510
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x454048], 0
je 0x404571
cmp word [0x45421c], 0xd7b2
jne 0x404539
cmp dword [0x454224], 0
jbe 0x404539
mov eax, 0x454218
call dword [0x454234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x452070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404598
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x452030], 0
jne 0x40458d
push 0
push 0x452068
push 0x452070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4062b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40631e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404904
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403358
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406308
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406325
lea eax, [ebp - 0x10]
call fcn.00404694
ret

Function at 0x40b578
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5b1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404784
jmp 0x40b5ba
mov eax, ebx
mov edx, esi
call fcn.004046e8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b5c4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5e5
mov al, byte [esp]
jmp 0x40b5e7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bc7c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bae4
mov eax, dword [0x453018]
cmp byte [eax], 0
je 0x40bcf8
mov eax, dword [0x452e4c]
call fcn.00403074
call fcn.00402bf4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408d2c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bd40
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bd2e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x452e00]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x454664]
call fcn.00405724
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c59c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c672
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0040472c
lea eax, [ebp - 8]
call fcn.00404ba4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b54
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c65c
mov eax, ebx
call fcn.00402a68
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c655
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b54
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c63f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c684
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c63f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c65c
mov eax, dword [ebp - 0x10]
call fcn.00402a98
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c679
lea eax, [ebp - 8]
call fcn.00404694
ret

Function at 0x40cb4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cbb0
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404904
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408830
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cbb7
lea eax, [ebp - 0xc]
call fcn.00404694
ret