joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4124b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x61a270], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00412690
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x61a270]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402930
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5a3ca0], eax
mov ebx, eax
jmp 0x412653
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x412538
cmp byte [ebx], 0
je 0x41265c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x4125b3
mov al, byte [ebx]
cmp al, 1
jb 0x4125a8
sub al, 0x20
jbe 0x412578
sub al, 2
je 0x41258c
jmp 0x4125a8
mov al, byte [ebp - 0x114]
test al, al
je 0x4125b8
add dword [ebp - 0x110], 1
jmp 0x4125b0
cmp byte [ebx + 1], 0x22
je 0x4125a3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4125b0
add ebx, 1
jmp 0x4125b0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x412568
test dword [ebp - 0x10c], 0xffffffff
je 0x41264c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00412690
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x61a270]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x412643
mov al, byte [ebx]
cmp al, 1
jb 0x412638
sub al, 0x20
jbe 0x412608
sub al, 2
je 0x41261c
jmp 0x412638
mov al, byte [ebp - 0x114]
test al, al
je 0x412648
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x412640
cmp byte [ebx + 1], 0x22
je 0x412633
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x412640
add ebx, 1
jmp 0x412640
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4125f8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41253b
mov ebx, dword [ebp - 0x10c]
mov dword [0x61a260], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x61a270
call fcn.0040fb50
mov eax, dword [0x61a270]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0xc], cl
mov eax, dword [ebp - 4]
test eax, eax
jne 0x420fee
mov eax, 0x61a300
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x421026
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x42100a
clc
jmp 0x421011
bt dword [0x5ca028], eax
jb 0x421022
mov eax, ebp
call fcn.00421110
test al, al
je 0x421022
mov bl, 1
jmp 0x421054
xor bl, bl
jmp 0x421054
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x5a5160]
sete bl
mov al, byte [ebp - 0xc]
and al, bl
je 0x421054
and esi, 0x400
je 0x421054
mov eax, ebp
call fcn.00421080
mov bl, al
lea esi, [esi]
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421340
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x42134c
mov eax, 0x61a300
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret

Function at 0x4217c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.004217b0
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x61b7cc]
xor edx, edx
call fcn.00407d00
mov dword [ebx*4 + 0x61b7ec], 0xffffffff
cmp ebx, 7
jl 0x4217e8
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x421874
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.004086f0
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.00416af0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x421874
push 4
push ebx
push esi
mov eax, 0x421690
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x421720
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004217b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421fc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push fcn.00421f90
push ebp
push 0x413330
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
call fcn.00416580
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00407d00
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.00409510
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00407d00
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x1c], eax
mov ebx, eax
jmp 0x4220cc
lea ecx, [ebp - 8]
mov eax, ebx
xor dx, dx
call fcn.00408650
mov eax, dword [ebp - 8]
test eax, eax
je 0x422057
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.00409510
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.00408eb0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00408cb0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00416580
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00408a50
test eax, eax
jne 0x4220c4
push dword [ebp - 0x18]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4220b3
mov eax, dword [eax - 4]
sub eax, esi
mov ecx, eax
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.00408cb0
jmp 0x4220d5
lea eax, [ebx + edi]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x422040
push dword [ebp - 0x1c]
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00421f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x61b830], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x61b690], eax
mov eax, dword [ebp - 0x90]
mov dword [0x61b6a0], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x61b6b0], eax
mov eax, dword [ebp - 0x88]
mov dword [0x61b6c0], eax
mov edx, 0x61b6d1
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00402930
lea eax, [ebp - 0x80]
call fcn.00403a80
mov byte [0x61b6d0], al
mov eax, 0x5ca0d8
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x61b840], eax
test eax, eax
je 0x4221b0
mov eax, 0x5ca0e4
push eax
push dword [0x61b840]
call sub.kernel32.dll_GetProcAddress
mov dword [0x61b830], eax
nop
cmp dword [0x61b6a0], 6
jae 0x4221c4
mov dword [0x5a4a20], 0
nop
cmp dword [0x61b6a0], 6
jb 0x4221e0
cmp dword [0x61b6b0], 1
jb 0x4221e0
mov dword [0x5a4a30], 2
mov esp, ebp
pop ebp
ret
Function at 0x423d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00423d80
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x423ea8
mov al, byte [ebp - 0x110]
test al, al
je 0x423e71
lea eax, [ebp - 0xc]
call fcn.00402e00
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.004041c0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00408580
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.00409510
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5cb068
call fcn.0041fb10
mov edx, 0x423dfa
mov ecx, ebp
call fcn.004131f0
jmp 0x423ea8
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5cb068
call fcn.0041fb10
mov edx, 0x423e71
mov ecx, ebp
call fcn.004131f0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x423f74
mov al, byte [ebp - 0x110]
test al, al
je 0x423f3d
lea eax, [ebp - 0xc]
call fcn.00402e00
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.004041c0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00408580
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.00409510
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5cb068
call fcn.0041fb10
mov edx, 0x423ec6
mov ecx, ebp
call fcn.004131f0
jmp 0x423f74
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5cb068
call fcn.0041fb10
mov edx, 0x423f3d
mov ecx, ebp
call fcn.004131f0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00423810
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00423d80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x426c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x5cb9e0
call fcn.0040c1a0
test al, al
je 0x426d16
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00426d30
xor eax, eax
push fcn.00426c20
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00407d00
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.00425e60
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.004254c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00426c20
jmp 0x426d21
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00428e80
mov esp, ebp
pop ebp
ret

Function at 0x43f920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov ebx, eax
mov esi, edx
lea eax, [ebp - 0x10]
call fcn.0040d0e0
test esi, esi
jle 0x43f940
mov eax, ebx
mov edx, dword [ebx]
call dword [edx + 0x48]
xor eax, eax
push fcn.0043f910
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040d300
lea edx, [ebp - 0x10]
lea eax, [ebx + 0x30]
call fcn.0040d130
mov eax, ebx
xor edx, edx
call fcn.0043f510
lea eax, [ebx + 0xc]
call fcn.0041f9c0
mov eax, ebx
xor edx, edx
call fcn.0040c3b0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0043f910
test ebx, ebx
je 0x43f9a4
test esi, esi
je 0x43f9a4
mov eax, ebx
mov edx, dword [ebx]
call dword [edx + 0x38]
lea esi, [esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4423e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
cmp dword [eax + 0x14], 0
je 0x442438
lea esi, [esi]
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0x18]
cmp ebx, 1
jl 0x442410
xor edi, edi
lea esi, [esi]
add edi, 1
xor byte [esi], 0xff
add esi, 1
cmp ebx, edi
jg 0x442400
lea esi, [esi]
test dl, dl
je 0x442438
cmp dword [eax + 0x1c], 0
je 0x442438
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
cmp edx, 1
jl 0x442438
xor edi, edi
nop
add edi, 1
xor byte [esi], 0xff
add esi, 1
cmp edx, edi
jg 0x442428
lea esi, [esi]
pop edi
pop esi
pop ebx
ret

Function at 0x45d890
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x100]
push ebx
xor ebx, ebx
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov al, byte [ebp - 0xf0]
and al, 0x80
je 0x45d8b8
or ebx, 1
mov esi, esi
mov al, byte [ebp - 0xee]
and al, 0x80
je 0x45d8c8
or ebx, 2
lea esi, [esi]
mov al, byte [ebp - 0xef]
and al, 0x80
je 0x45d8d8
or ebx, 4
lea esi, [esi]
mov al, byte [ebp - 0xff]
and al, 0x80
je 0x45d8e8
or ebx, 8
lea esi, [esi]
mov al, byte [ebp - 0xfe]
and al, 0x80
je 0x45d8f8
or ebx, 0x10
lea esi, [esi]
mov al, byte [ebp - 0xfc]
and al, 0x80
je 0x45d908
or ebx, 0x20
lea esi, [esi]
mov ax, word [ebp - 0xec]
and ax, 1
je 0x45d91c
or ebx, 0x800
nop
mov ax, word [ebp - 0x70]
and ax, 1
je 0x45d92c
or ebx, 0x1000
mov ax, word [ebp - 0x6f]
and ax, 1
je 0x45d93c
or ebx, 0x2000
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45ddc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45ddd8
or ebx, 2
lea esi, [esi]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45dde8
or ebx, 1
nop
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45ddf8
or ebx, 4
nop
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fa10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
mov esi, eax
mov byte [ebp - 4], dl
mov byte [ebp - 8], cl
mov al, byte [ebp - 4]
cmp al, byte [esi + 0xb4]
je 0x45fbcd
mov al, byte [ebp - 4]
test al, al
je 0x45fb45
mov eax, dword [esi + 0xc0]
mov dword [esi + 0xb0], eax
mov eax, esi
call fcn.00440480
push eax
mov eax, esi
call fcn.00440450
push eax
mov eax, esi
call fcn.00440470
mov ebx, eax
mov eax, esi
call fcn.00440460
mov edx, eax
lea eax, [esi + 0xa0]
mov ecx, ebx
call fcn.004400b0
cmp dword [esi + 0xa4], 0
jge 0x45fa8c
mov dword [esi + 0xa4], 0
lea esi, [esi]
cmp dword [esi + 0xa0], 0
jge 0x45faa0
mov dword [esi + 0xa0], 0
nop
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov eax, dword [0x61c300]
mov edx, dword [0x61c300]
mov edx, dword [edx]
call dword [edx + 0xf8]
mov dword [esi + 0x74], eax
mov eax, dword [0x61c300]
mov edx, dword [0x61c300]
mov edx, dword [edx]
call dword [edx + 0xfc]
mov dword [esi + 0x78], eax
mov al, byte [ebp - 8]
test al, al
je 0x45fae8
mov eax, esi
call fcn.00440ba0
mov eax, 0x80080000
mov dword [esi + 0xc0], eax
and eax, 0xff3bffff
mov dword [esi + 0xc0], eax
mov al, byte [ebp - 8]
test al, al
je 0x45fbc4
push dword [esi + 0xc0]
push 0xfffffffffffffff0
push dword [esi + 0xb8]
call sub.user32.dll_SetWindowLongA
push 0x70
mov eax, esi
call fcn.00440450
push eax
mov eax, esi
call fcn.00440480
push eax
push 0
push 0
push 0
push dword [esi + 0xb8]
call sub.user32.dll_SetWindowPos
nop
jmp 0x45fbc4
mov eax, dword [esi + 0xb0]
mov dword [esi + 0xc0], eax
mov al, byte [ebp - 8]
test al, al
je 0x45fb90
push dword [esi + 0xc0]
push 0xfffffffffffffff0
push dword [esi + 0xb8]
call sub.user32.dll_SetWindowLongA
push 0x27
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0xb8]
call sub.user32.dll_SetWindowPos
push 5
push dword [esi + 0xb8]
call sub.user32.dll_ShowWindow
nop
mov eax, dword [esi + 0xa4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0xa0]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0xa8]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0xac]
mov dword [esi + 0x78], eax
mov al, byte [ebp - 8]
test al, al
je 0x45fbc4
mov eax, esi
call fcn.00440ba0
mov esi, esi
mov al, byte [ebp - 4]
mov byte [esi + 0xb4], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ffd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30c]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x30c], 0
xor eax, eax
push fcn.0046ffb0
push ebp
push 0x413330
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.00407d00
mov eax, esi
xor edx, edx
call fcn.00407d00
call sub.kernel32.dll_GetUserDefaultLCID
mov ebx, eax
push 4
lea eax, [ebp - 4]
push eax
push 3
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x470084
lea eax, [ebp - 0x208]
push eax
push 3
push 0
lea ecx, [ebp - 4]
mov edx, 0xff
lea eax, [ebp - 0x308]
call fcn.00403a10
lea eax, [ebp - 0x308]
mov ecx, 2
mov edx, 1
call fcn.00403fc0
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x108]
call fcn.00404060
lea eax, [ebp - 0x108]
mov ecx, esi
xor dx, dx
call fcn.00408580
push 4
lea eax, [ebp - 4]
push eax
push 7
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x47013c
lea eax, [ebp - 0x108]
push eax
push 3
push 0
lea ecx, [ebp - 4]
mov edx, 0xff
lea eax, [ebp - 0x208]
call fcn.00403a10
lea eax, [ebp - 0x208]
mov ecx, 2
mov edx, 1
call fcn.00403fc0
lea eax, [ebp - 0x108]
lea ecx, [ebp - 8]
xor dx, dx
call fcn.00408580
push 0
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 4]
xor cx, cx
mov edx, 3
call fcn.004086f0
mov eax, dword [ebp - 0x30c]
mov edx, 0x5e04bc
call fcn.00408a50
test eax, eax
jne 0x470118
lea eax, [ebp - 8]
mov edx, 0x5e04cc
call fcn.00407d00
push 0
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, 0x5e04dc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, edi
mov ecx, 2
call fcn.00408090
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0046ffb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x486320
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x486354
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x61c590]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x486330
pop edi
pop esi
pop ebx
ret
Function at 0x4c9d50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4c9d74
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4c9e3a
mov esi, esi
xor eax, eax
push 0x4c9e1b
push ebp
push 0x4136b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040c310
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x5cb75c
call fcn.00424e80
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004c9fd0
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004ca040
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004ca0b0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4c9e10
cmp dword [ebp - 4], 0
je 0x4c9e10
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4c9e3a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db2e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4db314
mov eax, esi
call fcn.004df3b0
cmp byte [esi + 0x40], 0
je 0x4db30c
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4db3c5
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4db3a4
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4db39c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4db348
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4db360
xor bl, bl
jmp 0x4db3c5
cmp edi, 2
je 0x4db39a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4db338
cmp edi, 3
je 0x4db378
cmp edi, 1
jne 0x4db338
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4db338
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4db338
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4db3bc
cmp dword [esi + 0x14], 0xcc
je 0x4db3bc
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004da890
lea esi, [esi]
mov eax, esi
call fcn.004db3d0
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x529810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x529838
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x52998e
mov esi, esi
xor eax, eax
push 0x52996f
push ebp
push 0x4136b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x28], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
fldz
fstp dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0xa0]
mov ebx, eax
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0052ad80
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x9c]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x54]
mov dword [edx + 0x30], eax
mov eax, dword [edx + 0x58]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 0xc]
add eax, 0x30
call fcn.00491920
test al, al
je 0x5298f8
mov ecx, str.Path_does_not_has_a_starting_coordinate
mov edx, 1
mov eax, 0x5c7644
call fcn.0041fa40
mov edx, 0x5298d6
mov ecx, ebp
call fcn.004131f0
mov esi, esi
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0xa0]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov dword [ecx + 0x38], edx
mov eax, dword [eax + 0x2c]
mov dword [ecx + 0x3c], eax
mov eax, dword [ebp - 0xc]
add eax, 0x38
call fcn.00491920
test al, al
je 0x529944
mov ecx, str.Path_does_not_has_an_ending_coordinate
mov edx, 1
mov eax, 0x5c7644
call fcn.0041fa40
mov edx, 0x529924
mov ecx, ebp
call fcn.004131f0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x529964
cmp dword [ebp - 8], 0
je 0x529964
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x52998e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4