joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4559c2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push ebx
push esi
mov esi, ecx
mov ebx, eax
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0xdc], eax
jle 0x455a09
mov byte [ebp + 0xb], al
lea edx, [ebp + 0xb]
mov eax, dword [esi + 0xd8]
push edx
push dword [ebp + 0x10]
mov ecx, dword [eax + ebx*4]
push dword [ebp + 0xc]
push edi
mov eax, dword [ecx]
call dword [eax]
cmp byte [ebp + 0xb], 0
jne 0x455a65
inc ebx
push 0
pop eax
cmp ebx, dword [esi + 0xdc]
jl 0x4559dc
sub edi, 0x100
je 0x455abb
sub edi, 4
je 0x455a69
dec edi
sub edi, 1
jne 0x455ab2
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
mov ecx, dword [esi + 0x58]
lea edx, [ebp + 8]
push 0x80000012
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x459625
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x455ab2
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x455ab4
cmp dword [esi + 0x5c], eax
je 0x455ab2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.004552bd
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x5c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x455ab2
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x455b07
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x455b07
mov edx, dword [esi + 0x5c]
mov ecx, edx
call fcn.0045a983
test al, al
je 0x455b07
mov eax, dword [edx]
mov ecx, edx
push str.RichEditUI
call dword [eax + 0xc]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x455b07
mov eax, dword [esi + 0x5c]
cmp byte [eax + 0x229], 0
jne 0x455ab2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.00457539
jmp 0x455a65
Function at 0x4571bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [edi + 4]
je 0x4571e9
cmp esi, dword [edi + 0x5c]
je 0x4572c3
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, dword [edi + 0x5c]
je 0x4572c3
xor eax, eax
cmp dword [edi + 0x5c], eax
je 0x457248
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x5c]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
push 0
push 0
push 8
push dword [edi + 0x5c]
mov ecx, edi
call fcn.0045764a
and dword [edi + 0x5c], 0
test esi, esi
je 0x4572c3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x4572c3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x4572c3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x4572c3
xor eax, eax
mov dword [edi + 0x5c], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x5c]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
push 0
push 0
push 7
push dword [edi + 0x5c]
mov ecx, edi
call fcn.0045764a
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46cb54
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x46cbb3
cmp dword [esi + 0x10], 0
je 0x46cbb3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00484420
mov ebx, esp
test ebx, ebx
je 0x46cbb3
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0xcc
call fcn.0044e4f3
mov ecx, dword [esi + 0x10]
push ecx
push 0
push 0
mov eax, dword [ecx]
push 0x11
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0045764a
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x470c1e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
lea eax, [ebp - 0x25e]
push ebx
push esi
push edi
mov esi, 0x493ebc
lea edi, [ebp - 0x268]
push 0x1fe
mov ebx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x260]
push 0x100
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push esi
push 3
push esi
push 7
push 0x80000000
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x470ccf
push 8
push 0x40
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x470ccf
mov edi, ebx
lea esi, [ebp - 0x60]
xor eax, eax
push 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memcmp]
add esp, 0xc
test eax, eax
jne 0x470d3c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
push ebx
push ecx
push ecx
call fcn.0044cda9
add esp, 0x10
test eax, eax
je 0x470d3c
push ebx
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x10
push ebx
push 3
push str.WorkGUID
mov edx, str.SYSTEMSetup
mov ecx, 0x80000002
call fcn.0044ce32
add esp, 0x10
test eax, eax
je 0x470d3c
push eax
lea eax, [ebp - 8]
push 0x49cb64
push eax
call fcn.00449eea
add esp, 0xc
push dword [eax]
push str.ClientGuid
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x470d43
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0x2c]
push esi
mov esi, ecx
mov edx, dword [eax]
mov eax, dword [0x4ab72c]
cmp eax, dword [edx + 4]
jle 0x470d94
push edi
mov edi, 0x4ab72c
push edi
call fcn.00483140
cmp dword [0x4ab72c], 0xffffffff
pop ecx
jne 0x470d93
mov ecx, str.wdc.dll
call fcn.00481afc
push str.WdcRunTaskAsInteractiveUser
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov dword [0x4ab730], eax
call fcn.004830e0
pop ecx
pop edi
mov eax, dword [0x4ab730]
test eax, eax
je 0x470da6
push 0x27
push 0
push esi
call eax
pop esi
ret
push 1
xor eax, eax
push eax
push eax
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x470dc2
xor eax, eax
pop esi
ret
test eax, eax
jne 0x470dcb
mov eax, 0x8007000e
pop esi
ret
Function at 0x471eea
Capabilities:
Inspect section memory permissions

Disassembly:
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x472110
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x471f09
mov dword [ebp + 0x10], edi
jmp 0x471f0e
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.00471921
inc ecx
lahf
or al, 0x6f
Function at 0x473be3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
mov esi, ecx
mov edx, str.SystemComponent
push edi
push eax
mov ecx, ebx
mov dword [ebp - 0x14], esi
call fcn.0044cc98
pop ecx
test eax, eax
jne 0x473c12
cmp dword [ebp - 8], eax
jne 0x473d86
xor edi, edi
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push edi
push str.ParentKeyName
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x473d86
lea eax, [esi + 4]
mov edx, str.DisplayName
push eax
mov ecx, ebx
call fcn.0044cd14
pop ecx
test eax, eax
jne 0x473d86
lea eax, [esi + 0x28]
mov edx, str.NoModify
push eax
mov ecx, ebx
mov dword [eax], edi
call fcn.0044cc98
lea eax, [esi + 0x2c]
mov edx, str.NoRepair
push eax
mov ecx, ebx
mov dword [eax], edi
call fcn.0044cc98
lea eax, [esi + 0x30]
mov edx, str.NoRemove
push eax
mov ecx, ebx
mov dword [eax], edi
call fcn.0044cc98
lea eax, [esi + 8]
mov edx, str.Publisher
push eax
mov ecx, ebx
call fcn.0044cd14
lea edi, [esi + 0xc]
mov edx, str.UninstallString
push edi
mov ecx, ebx
call fcn.0044cd14
add esp, 0x14
test eax, eax
jne 0x473cb1
mov ecx, dword [edi]
mov edx, edi
call fcn.0044bbac
lea edi, [esi + 0x10]
mov edx, str.ModifyPath
push edi
mov ecx, ebx
call fcn.0044cd14
pop ecx
test eax, eax
jne 0x473ccf
mov ecx, dword [edi]
mov edx, edi
call fcn.0044bbac
call fcn.0043c5cd
push eax
lea ecx, [ebp + 8]
call fcn.0043ac50
and dword [esi + 0x18], 0
lea eax, [ebp + 8]
lea edi, [esi + 0x14]
mov edx, str.InstallDate
and dword [edi], 0
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edi
call fcn.0044cd14
mov esi, dword [ebp + 8]
pop ecx
test eax, eax
jne 0x473d35
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1e]
push eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x24]
push eax
push str._4hu_2hu_2hu
push esi
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
lea eax, [ebp - 0x24]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x473d49
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, dword [ebp - 0x14]
mov edx, str.EstimatedSize
add edi, 0x20
mov ecx, ebx
push edi
and dword [edi], 0
and dword [edi + 4], 0
call fcn.0044cc98
pop ecx
test eax, eax
jne 0x473d79
mov eax, dword [edi]
mov ecx, dword [edi + 4]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [edi], eax
mov dword [edi + 4], ecx
lea ecx, [esi - 0x10]
call fcn.0043c924
xor eax, eax
inc eax
jmp 0x473d88
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x473e79
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x40], 0x4a2630
mov ebx, ecx
call fcn.0043c5cd
push eax
lea ecx, [ebp - 0x3c]
call fcn.0043ac50
call fcn.0043c5cd
push eax
lea ecx, [ebp - 0x38]
call fcn.0043ac50
call fcn.0043c5cd
push eax
lea ecx, [ebp - 0x34]
call fcn.0043ac50
call fcn.0043c5cd
push eax
lea ecx, [ebp - 0x30]
call fcn.0043ac50
push 0x104
lea eax, [ebp - 0x248]
xor edi, edi
push eax
push edi
jmp 0x473f5e
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [0x4ab220]
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x473f50
push dword [ebp - 4]
lea ecx, [ebp - 0x40]
call fcn.00473be3
test eax, eax
je 0x473f47
push 0x38
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x473f26
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.00473b1d
jmp 0x473f28
xor eax, eax
mov ecx, dword [esi + 4]
mov dword [ebp - 8], eax
cmp ecx, dword [esi + 8]
je 0x473f3b
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x473f47
lea eax, [ebp - 8]
push eax
push ecx
mov ecx, esi
call fcn.00432d85
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x248]
inc edi
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x473edc
lea ecx, [ebp - 0x40]
call fcn.00473f9e
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4749f3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x23c]
test esi, esi
je 0x474aa0
lea ecx, [esi + 0x248]
mov esi, dword [esi + 0x1f0]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [edi + 0x23c]
push eax
add ecx, 0x1f0
call dword [esi]
test eax, eax
je 0x474aa0
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0xb8]
mov ebx, eax
test ebx, ebx
je 0x474a9f
mov ecx, dword [ebp + 8]
push 0x4a361c
mov ecx, dword [ecx + 8]
mov edx, dword [ecx]
call dword [edx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
mov ecx, dword [edi + 0x230]
neg eax
push 1
sbb esi, esi
inc esi
call fcn.0047dbc3
push 0xc
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x474a7f
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
jmp 0x474a81
mov eax, ecx
push ecx
push ecx
push eax
push 0x47e854
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x474a9f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x474c33
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x238], edi
je 0x474c7f
mov ecx, dword [esi + 0x230]
push 1
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x474c5f
mov dword [eax], esi
jmp 0x474c61
mov eax, edi
push edi
push edi
push eax
push 0x47e8b2
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x474c7f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x4754c9
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x23c], edi
je 0x475515
mov ecx, dword [esi + 0x230]
push 1
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x4754f5
mov dword [eax], esi
jmp 0x4754f7
mov eax, edi
push edi
push edi
push eax
push 0x47e91a
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x475515
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x4756b1
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x4a3768
push 0x4a36c8
push 3
mov esi, ecx
call dword [sym.imp.CBSHost.dll_DismWriteLog]
xor edi, edi
cmp dword [esi + 0x238], edi
je 0x47571d
call fcn.0043ac79
push str.ck_W
call sym.Dismx86.exe_DismMultiLanguage
mov ecx, dword [esi + 0x230]
push eax
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x4756fd
mov dword [eax], esi
jmp 0x4756ff
mov eax, edi
push edi
push edi
push eax
push 0x47e948
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x47571d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x4763a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push ebx
mov ecx, dword [edi + 0x238]
add ecx, 0x1f0
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
test esi, esi
je 0x476427
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xb8]
test eax, eax
jne 0x476427
mov ecx, dword [edi + 0x234]
push 1
call fcn.0047dbc3
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0xbc]
push 8
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x476407
mov dword [eax], edi
mov dword [eax + 4], ebx
jmp 0x476409
mov eax, ecx
push ecx
push ecx
push eax
push 0x47ea52
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x476427
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x476eb9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 0xb8]
mov esi, eax
test esi, esi
je 0x476f0f
call fcn.0043ac79
push 8
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x476eef
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x476ef1
mov eax, ecx
push ecx
push ecx
push eax
push 0x47eb9b
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x476f0f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x4774b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x23c], edi
je 0x4774fc
mov ecx, dword [esi + 0x230]
push 1
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x4774dc
mov dword [eax], esi
jmp 0x4774de
mov eax, edi
push edi
push edi
push eax
push 0x47ec44
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x4774fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret

Function at 0x477723
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x234], edi
je 0x47777d
push 0x49fdc4
call sym.Dismx86.exe_DismMultiLanguage
mov ecx, dword [esi + 0x230]
push eax
call fcn.0047dbc3
call fcn.0043ac79
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x47775d
mov dword [eax], esi
jmp 0x47775f
mov eax, edi
push edi
push edi
push eax
push 0x47ece4
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x47777d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x477a01
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x238], edi
je 0x477a56
push 0x49fdc4
call sym.Dismx86.exe_DismMultiLanguage
mov ecx, dword [esi + 0x230]
push eax
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x477a36
mov dword [eax], esi
jmp 0x477a38
mov eax, edi
push edi
push edi
push eax
push 0x47ed01
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x477a56
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x478d21
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 1
mov ecx, dword [esi + 0x234]
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x478d44
mov dword [eax], esi
jmp 0x478d46
mov eax, ecx
push ecx
push ecx
push eax
push 0x47ee17
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
pop esi
test eax, eax
je 0x478d65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret 8

Function at 0x478d6a
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, 0x4a0444
mov esi, ecx
push edi
push 0x49fe38
push 3
call dword [sym.imp.CBSHost.dll_DismWriteLog]
push edi
call sym.Dismx86.exe_DismMultiLanguage
mov ecx, dword [esi + 0x234]
push eax
call fcn.0047dbc3
call fcn.0043ac79
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x478dab
mov dword [eax], esi
jmp 0x478dad
mov eax, ecx
push ecx
push ecx
push eax
push 0x47ee45
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
pop edi
pop esi
test eax, eax
je 0x478dcd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret 8
Function at 0x47994d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [ebx + 8]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
mov esi, eax
test esi, esi
je 0x479aa0
xor ecx, ecx
cmp dword [ebx + 0x1c], ecx
je 0x479987
cmp dword [ebx + 0x18], ecx
jne 0x479aa0
mov eax, dword [ebx + 8]
cmp dword [eax + 0x4dc], ecx
je 0x479aa0
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0xb8]
mov edx, dword [esi]
mov ecx, esi
mov dword [ebp - 4], eax
call dword [edx + 0xc0]
cmp dword [ebp - 4], 0
mov edi, eax
je 0x479a9f
test edi, edi
je 0x479a9f
push 0
push 0x55
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
push 0
push 0
lea eax, [ebp - 0xb4]
mov ecx, edi
push eax
call fcn.0043a80d
mov esi, eax
test esi, esi
jne 0x479a17
push 0x55
lea eax, [ebp - 0xb4]
push eax
push 0x6d
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
cmp eax, 1
jg 0x4799dd
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x479a9f
mov ecx, dword [ebp - 4]
lea edx, [ebp + 8]
and dword [ebp + 8], 0
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [esi + 4]
test eax, eax
jne 0x479a34
mov eax, 0x491414
push eax
push dword [ebp + 8]
push 0x4a065c
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea eax, [ebp - 4]
push eax
call fcn.00449eea
mov edi, dword [ebp - 8]
add esp, 0x10
mov esi, eax
push 0x31
push 0x486080
call sym.Dismx86.exe_DismMultiLanguage
push eax
mov eax, dword [edi + 0x10]
lea ecx, [edi + 0x10]
push dword [esi]
call dword [eax + 0x1c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043c924
cmp esi, 1
je 0x479a96
mov ecx, dword [ebx + 8]
push 0
push 0
mov eax, dword [ecx]
call dword [eax + 0x138]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x479aa8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x4a06b8
push 0x49fe38
push 3
mov ebx, ecx
call dword [sym.imp.CBSHost.dll_DismWriteLog]
call fcn.0043ac79
mov ecx, dword [ebx + 0x234]
push 1
call fcn.0047dbc3
push 0x49ff78
lea ecx, [ebx + 0x10]
call fcn.0045d768
mov dword [ebp - 4], eax
lea edi, [eax + 0x1f0]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax - 1]
jmp 0x479b11
mov edx, dword [edi]
push esi
call dword [edx]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xb8]
test eax, eax
je 0x479b10
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
dec esi
mov ecx, edi
cmp esi, 0xffffffff
jne 0x479af7
mov eax, dword [edi]
call dword [eax + 0x20]
push 8
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
xor edx, edx
pop ecx
test eax, eax
je 0x479b36
mov ecx, dword [ebp - 4]
mov dword [eax], ebx
mov dword [eax + 4], ecx
jmp 0x479b38
mov eax, edx
push edx
push edx
push eax
push 0x47ef0b
push edx
push edx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
pop edi
pop esi
pop ebx
test eax, eax
je 0x479b59
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret 8
Function at 0x47a330
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, 0x4a0498
mov esi, ecx
push edi
push 0x49fe38
push 3
call dword [sym.imp.CBSHost.dll_DismWriteLog]
call fcn.0043ac79
push edi
call sym.Dismx86.exe_DismMultiLanguage
mov ecx, dword [esi + 0x234]
push eax
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x47a371
mov dword [eax], esi
jmp 0x47a373
mov eax, ecx
push ecx
push ecx
push eax
push 0x47ef28
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
pop edi
pop esi
test eax, eax
je 0x47a393
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret 8