joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a590
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
mov esi, eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
push 0x11
xor ebx, ebx
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
xor edx, edx
test eax, eax
setne dl
cmp ebx, 1
je 0x47a5d7
cmp edx, 1
je 0x47a5d7
mov eax, 1
jmp 0x47a5d9
xor eax, eax
cmp esi, 0x7a
jae 0x47a69d
cmp esi, 0x70
jae 0x47a66f
cmp esi, 0x21
jb 0x47a645
cmp esi, 0x28
ja 0x47a613
cmp eax, 1
je 0x47a651
cmp ebx, 1
je 0x47a651
cmp edx, 1
jne 0x47a639
add esi, 0xf
and esi, 0xf
mov esi, dword [esi*4 + 0x4bec00]
jmp 0x47a639
cmp esi, 0x2e
je 0x47a61d
cmp esi, 0x2d
jne 0x47a645
cmp eax, 1
je 0x47a660
cmp ebx, 1
je 0x47a660
cmp edx, 1
jne 0x47a639
add esi, 0xf
and esi, 0xf
mov esi, dword [esi*4 + 0x4bec00]
and esi, 0xff
or esi, 0xf000
mov ebx, dword [ebp - 8]
mov eax, esi
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
add esi, 0xf
and esi, 0xf
mov esi, dword [esi*4 + str.IQOGKHMP]
jmp 0x47a639
add esi, 0xf
and esi, 0xf
mov esi, dword [esi*4 + str.IQOGKHMP]
jmp 0x47a639
cmp esi, 0x79
ja 0x47a645
cmp eax, 1
je 0x47a698
cmp ebx, 1
je 0x47a68a
lea eax, [esi - 0x12]
cmp edx, 1
je 0x47a68d
mov eax, esi
jmp 0x47a68d
lea eax, [esi - 0x1c]
movzx esi, al
or esi, 0xe000
jmp 0x47a645
lea eax, [esi - 0x35]
jmp 0x47a68d
cmp esi, 0x7b
ja 0x47a645
cmp eax, 1
je 0x47a6c9
cmp ebx, 1
je 0x47a6b8
lea eax, [esi + 0xf]
cmp edx, 1
je 0x47a6bb
mov eax, esi
jmp 0x47a6bb
lea eax, [esi + 0xd]
movzx esi, al
or esi, 0xe000
jmp 0x47a645
lea eax, [esi + 0xb]
jmp 0x47a6bb

Function at 0x47b3d8
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x47b3e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov esi, edx
mov dword [ebp - 4], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
push 0x11
xor ebx, ebx
cmp eax, 0x8000
sete bl
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
xor edx, edx
cmp eax, 0x8000
sete dl
cmp ebx, 1
je 0x47b437
cmp edx, 1
je 0x47b437
mov ecx, 1
jmp 0x47b439
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x15c]
test edi, edi
je 0x47b4cf
cmp esi, 0x7a
jl 0x47b473
cmp esi, 0x7b
jg 0x47b4ba
cmp ecx, 1
je 0x47b5c0
cmp ebx, 1
je 0x47b46e
lea eax, [esi + 0xf]
cmp edx, 1
je 0x47b49a
mov eax, esi
jmp 0x47b49a
lea eax, [esi + 0xd]
jmp 0x47b49a
cmp esi, 0x70
jl 0x47b4ba
cmp esi, 0x79
jg 0x47b4ba
cmp ecx, 1
je 0x47b5c8
cmp ebx, 1
je 0x47b497
lea eax, [esi - 0x12]
cmp edx, 1
je 0x47b49a
mov eax, esi
jmp 0x47b49a
lea eax, [esi - 0x1c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x15c], 0
movzx eax, al
or eax, 0xe000
mov dword [edx + 0x160], eax
jmp 0x47b596
mov dword [eax + 0x160], esi
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
call fcn.0046b904
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, 1
je 0x47b5b1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1ec]
test eax, eax
je 0x47b5b1
cmp esi, 0x7a
jl 0x47b538
cmp esi, 0x7b
jg 0x47b5a8
cmp ecx, 1
je 0x47b5de
cmp ebx, 1
je 0x47b5d0
cmp edx, 1
je 0x47b52a
mov edx, dword [ebp - 4]
mov dword [edx + 0x160], esi
jmp 0x47b570
mov edx, dword [ebp - 4]
add esi, 0xf
mov dword [edx + 0x160], esi
jmp 0x47b570
cmp esi, 0x70
jl 0x47b5a8
cmp esi, 0x79
jg 0x47b5a8
cmp ecx, 1
je 0x47b5fd
cmp ebx, 1
je 0x47b5ec
cmp edx, 1
je 0x47b564
mov edx, dword [ebp - 4]
mov dword [edx + 0x160], esi
jmp 0x47b570
mov edx, dword [ebp - 4]
add esi, 0xffffffee
mov dword [edx + 0x160], esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x160]
mov dword [edx + 0x15c], 0
or eax, 0xe000
mov dword [edx + 0x160], eax
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov eax, 1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0x160], esi
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0xb]
jmp 0x47b49a
lea eax, [esi - 0x35]
jmp 0x47b49a
mov edx, dword [ebp - 4]
add esi, 0xd
mov dword [edx + 0x160], esi
jmp 0x47b570
mov edx, dword [ebp - 4]
add esi, 0xb
mov dword [edx + 0x160], esi
jmp 0x47b570
mov edx, dword [ebp - 4]
add esi, 0xffffffe4
mov dword [edx + 0x160], esi
jmp 0x47b570
mov edx, dword [ebp - 4]
add esi, 0xffffffcb
mov dword [edx + 0x160], esi
jmp 0x47b570
Function at 0x47c830
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov edi, eax
call fcn.0046b904
cmp eax, 1
je 0x47c902
mov eax, dword [0x4410058]
test eax, eax
je 0x47c85c
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call fcn.0046b904
cmp eax, 2
je 0x47c894
lea eax, [ebp - 0xc]
push eax
push 4
xor edx, edx
push edi
push 0x47939c
push edx
push edx
call fcn.0048d7c8
add esp, 0x18
mov dword [0x4410058], eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call fcn.0046b904
cmp eax, 2
je 0x47c8ba
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, 1
jmp 0x47c8bc
xor esi, esi
push 1
call fcn.0046b950
pop ecx
test eax, eax
je 0x47c8cd
call fcn.00472088
call fcn.0046b904
cmp eax, 2
je 0x47c8f6
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call dword [sym.imp.GDI32.dll_GdiFlush]
test esi, esi
je 0x47c8f6
push dword [edi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [0x4410058], 0
jmp 0x47c88a
mov edi, dword [ebp - 8]
mov dword [0x4410060], 1
mov esp, ebp
pop ebp
ret
Function at 0x47d5b4
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, eax
call fcn.0046b904
cmp eax, 1
je 0x47d7dd
mov eax, dword [0x4410058]
test eax, eax
je 0x47d739
call fcn.0046b904
cmp eax, 2
je 0x47d610
lea eax, [ebp - 0xc]
push eax
push 4
xor edx, edx
push esi
push 0x479264
push edx
push edx
call fcn.0048d7c8
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call fcn.0046b904
cmp eax, 2
je 0x47d634
mov eax, dword [0x4410058]
test eax, eax
je 0x47d634
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4410058]
test eax, eax
jne 0x47d623
push esi
call fcn.00472118
pop ecx
call fcn.00471e34
push esi
xor edx, edx
mov dword [esi + 0x1ac], edx
mov dword [esi + 0x1a8], edx
mov eax, 1
mov byte [esi + 0x219], al
mov byte [esi + 0x216], al
mov byte [esi + 0x218], dl
call fcn.00472dec
pop ecx
movsx eax, byte [esi + 0x21a]
cmp eax, 1
je 0x47d6fc
mov eax, 1
push eax
push dword [0x44d4c74]
push esi
mov byte [esi + 0x214], al
call fcn.00471eb0
mov edx, dword [esi + 0x11c]
mov eax, dword [esi + 0x120]
add edx, 0xffffffff
mov dword [esi + 0x1b0], edx
add eax, 0xffffffff
mov dword [esi + 0x1b4], eax
push eax
push edx
push dword [esi + 0x1ac]
push dword [esi + 0x1a8]
push 0
push esi
call fcn.00471064
add esp, 0x24
mov eax, dword [0x4cafd4]
test eax, eax
je 0x47d606
push 0
push 0x3ec
push dword [0x4caf68]
call dword [sym.imp.USER32.dll_EnableMenuItem]
push dword [0x4caf9c]
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x47d606
mov eax, 1
push eax
push dword [0x44d4c78]
push esi
mov byte [esi + 0x215], al
call fcn.00471eb0
push 0
push esi
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
add eax, 0xffffffff
mov dword [esi + 0x1b0], eax
add edx, 0xffffffff
mov dword [esi + 0x1b4], edx
call fcn.004705d0
add esp, 0x14
jmp 0x47d6cb
call fcn.0046b904
cmp eax, 2
je 0x47d76c
lea eax, [ebp - 0x10]
push eax
push 4
xor edx, edx
push esi
push 0x47939c
push edx
push edx
call fcn.0048d7c8
add esp, 0x18
mov dword [0x4410058], eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x47d5dd
call fcn.0046b904
cmp eax, 2
je 0x47d792
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, 1
jmp 0x47d794
xor ebx, ebx
push 1
call fcn.0046b950
pop ecx
test eax, eax
je 0x47d7a5
call fcn.00472088
call fcn.0046b904
cmp eax, 2
je 0x47d7ce
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call dword [sym.imp.GDI32.dll_GdiFlush]
test ebx, ebx
je 0x47d7ce
push dword [esi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [0x4410058], 0
jmp 0x47d5dd
mov dword [0x4410060], 1
jmp 0x47d5dd
Function at 0x47d7f0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0046b904
cmp eax, 1
je 0x47d97b
mov eax, dword [0x4410058]
test eax, eax
je 0x47d8d7
call fcn.0046b904
cmp eax, 2
je 0x47d84c
lea eax, [ebp - 0xc]
push eax
push 4
xor edx, edx
push edi
push 0x479428
push edx
push edx
call fcn.0048d7c8
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.0046b904
cmp eax, 2
je 0x47d870
mov eax, dword [0x4410058]
test eax, eax
je 0x47d870
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4410058]
test eax, eax
jne 0x47d85f
push edi
call fcn.00472118
push 1
push dword [0x44d4c70]
push edi
call fcn.00471eb0
add esp, 0x10
call fcn.00471e34
mov eax, dword [edi + 0x194]
mov edx, dword [edi + 0x198]
mov byte [edi + 0x215], 1
mov dword [edi + 0x1b0], eax
push edi
mov dword [edi + 0x1a8], eax
mov dword [edi + 0x1b4], edx
mov dword [edi + 0x1ac], edx
call fcn.00472dec
pop ecx
push 1
push 0x400
push 0x111
push dword [edi]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x47d842
call fcn.0046b904
cmp eax, 2
je 0x47d90a
lea eax, [ebp - 0x10]
push eax
push 4
xor edx, edx
push edi
push 0x47939c
push edx
push edx
call fcn.0048d7c8
add esp, 0x18
mov dword [0x4410058], eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x47d819
call fcn.0046b904
cmp eax, 2
je 0x47d930
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, 1
jmp 0x47d932
xor ebx, ebx
push 1
call fcn.0046b950
pop ecx
test eax, eax
je 0x47d943
call fcn.00472088
call fcn.0046b904
cmp eax, 2
je 0x47d96c
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call dword [sym.imp.GDI32.dll_GdiFlush]
test ebx, ebx
je 0x47d96c
push dword [edi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [0x4410058], 0
jmp 0x47d819
mov dword [0x4410060], 1
jmp 0x47d819
Function at 0x47d990
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov edi, eax
call fcn.0046b904
cmp eax, 1
je 0x47dbda
mov eax, dword [0x4410058]
test eax, eax
je 0x47db36
call fcn.0046b904
cmp eax, 2
je 0x47d9ec
lea eax, [ebp - 0xc]
push eax
push 4
xor edx, edx
push edi
push 0x4794c8
push edx
push edx
call fcn.0048d7c8
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call fcn.0046b904
cmp eax, 2
je 0x47da10
mov eax, dword [0x4410058]
test eax, eax
je 0x47da10
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4410058]
test eax, eax
jne 0x47d9ff
push edi
call fcn.00472118
push 1
push dword [0x44d4c6c]
push edi
call fcn.00471eb0
add esp, 0x10
call fcn.00471e34
mov ecx, dword [edi + 0x138]
mov eax, dword [edi + 0x194]
mov esi, dword [edi + 0x13c]
cdq
idiv ecx
mov dword [edi + 0x1b0], eax
mov byte [edi + 0x214], 1
push edi
mov dword [edi + 0x1a8], eax
mov eax, dword [edi + 0x198]
cdq
idiv esi
mov dword [edi + 0x1b4], eax
mov dword [edi + 0x1ac], eax
call fcn.00472dec
pop ecx
push 0
push 0x400
push 0x111
push dword [edi]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x404
call fcn.0048b682
pop ecx
mov esi, eax
mov dword [ebp - 0x10], ebx
mov eax, 0x300
mov word [esi], ax
mov edx, 0x100
mov word [esi + 2], dx
mov eax, 0xfffffff0
movzx edx, byte [eax*4 + 0x4cb540]
movzx ecx, byte [eax*4 + 0x4cb541]
movzx ebx, byte [eax*4 + 0x4cb542]
mov byte [esi + eax*4 + 0x44], dl
mov byte [esi + eax*4 + 0x45], cl
mov byte [esi + eax*4 + 0x47], 4
mov byte [esi + eax*4 + 0x46], bl
add eax, 1
jne 0x47daaa
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x44]
lea edx, [esi + 0x404]
mov byte [ecx + 3], 4
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 1], al
mov byte [ecx + 2], al
add ecx, 4
cmp edx, ecx
ja 0x47dae4
push esi
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [0x441005c], eax
push 0
push eax
push dword [edi + 0x1d0]
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [edi + 0x1d0]
call dword [sym.imp.GDI32.dll_RealizePalette]
mov dword [0x4cb4e0], 0
push esi
call fcn.0048b5a5
pop ecx
jmp 0x47d9e2
call fcn.0046b904
cmp eax, 2
je 0x47db69
lea eax, [ebp - 0x14]
push eax
push 4
xor edx, edx
push edi
push 0x47939c
push edx
push edx
call fcn.0048d7c8
add esp, 0x18
mov dword [0x4410058], eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x47d9b9
call fcn.0046b904
cmp eax, 2
je 0x47db8f
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, 1
jmp 0x47db91
xor esi, esi
push 1
call fcn.0046b950
pop ecx
test eax, eax
je 0x47dba2
call fcn.00472088
call fcn.0046b904
cmp eax, 2
je 0x47dbcb
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call dword [sym.imp.GDI32.dll_GdiFlush]
test esi, esi
je 0x47dbcb
push dword [edi + 0x1f0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [0x4410058], 0
jmp 0x47d9b9
mov dword [0x4410060], 1
jmp 0x47d9b9
Function at 0x48e6ea
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x48e71b
call fcn.0048ca5e
mov dword [eax], esi
call fcn.0048ca4b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00490cf5
add esp, 0x14
push 0x16
pop eax
jmp 0x48e770
test dword [ebp + 0xc], 0xfffffff9
jne 0x48e6f7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x48e748
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048ca71
pop ecx
call fcn.0048ca4b
mov eax, dword [eax]
jmp 0x48e770
test al, 0x10
jne 0x48e76e
test al, 1
je 0x48e76e
test byte [ebp + 0xc], 2
je 0x48e76e
call fcn.0048ca5e
mov dword [eax], 5
call fcn.0048ca4b
mov dword [eax], 0xd
jmp 0x48e73f
xor eax, eax
pop esi
pop ebp
ret

Function at 0x494a82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4cca20]
jne 0x494a8c
repz ret
jmp fcn.0049cdc9

Function at 0x498b28
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004900ab
and dword [ebp - 4], 0
cmp dword [0x441079c], 0
mov ebx, eax
jne 0x498bd9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x498c8a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b8ce0
push edi
call esi
test eax, eax
je 0x498c8a
push eax
call fcn.00490039
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x441079c], eax
call esi
push eax
call fcn.00490039
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44107a0], eax
call esi
push eax
call fcn.00490039
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44107a4], eax
call esi
push eax
call fcn.00490039
pop ecx
mov dword [0x44107ac], eax
test eax, eax
je 0x498bd9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00490039
pop ecx
mov dword [0x44107a8], eax
mov eax, dword [0x44107a8]
cmp eax, ebx
je 0x498c31
cmp dword [0x44107ac], ebx
je 0x498c31
push eax
call fcn.004900b4
push dword [0x44107ac]
mov esi, eax
call fcn.004900b4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x498c31
test edi, edi
je 0x498c31
call esi
test eax, eax
je 0x498c28
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x498c28
test byte [ebp - 0xc], 1
jne 0x498c31
or dword [ebp + 0x10], 0x200000
jmp 0x498c6a
mov eax, dword [0x44107a0]
cmp eax, ebx
je 0x498c6a
push eax
call fcn.004900b4
pop ecx
test eax, eax
je 0x498c6a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x498c6a
mov eax, dword [0x44107a4]
cmp eax, ebx
je 0x498c6a
push eax
call fcn.004900b4
pop ecx
test eax, eax
je 0x498c6a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x441079c]
call fcn.004900b4
pop ecx
test eax, eax
je 0x498c8a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x498c8c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x24c28dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
jmp 0x24c28fb
not ax
jmp 0x24c28c7
xor eax, eax
lea edi, [ecx*4]
mov edi, 0x81e0050
mov edi, ebx
jmp 0x24c28ed
lea esp, [esp + 4]
jbe 0x24c27bd
ja 0x24c289b
invalid
lea edi, reloc.KERNEL32.DLL_SetStdHandle
rep stosd dword es:[edi], eax
jmp 0x24c27bd
lea esp, [esp + 4]
push ebx
mov eax, 0xd1bf3a74
jmp 0x24f5e30
pushal
rdtsc
mov dword [esp + 0x14], ebp
call fcn.024f47a3
mov cs, word [edx + eax*4]
in eax, 0x14
mov al, byte [0xb25b7819]
bswap esi
lea esi, [ecx + edi*4]
push edx
jmp 0x24f4785
mov eax, dword [ebp + 8]
sub eax, ecx
push esi
jmp 0x24f479b
call fcn.024dfa9b
push dword [ebp + 0xc]
mov edx, 0x990cbd21
mov dh, 0xca
bswap edx
jmp 0x24f5e59
mov eax, esi
push esi
mov dword [esp], edx
lea esp, [esp + 4]
jmp 0x24f5e12
mov dword [esp + 0x1c], esi
popal
call fcn.024dfa85
mov cx, word [esp]
bt cx, si
jmp 0x24f5e63
mov edx, eax
pushal
setnp ah
rdtsc
jmp 0x24f5e3c
not ecx
call fcn.024f5e9f
push bp
lea esp, [esp + 2]
mov ecx, dword [esp]
sub esp, 0x1c
jmp 0x24f5e89
mov dword [ebp - 8], eax
stc
push ecx
jmp 0x24f5eda
lea esp, [esp + 0x24]
test edx, edx
call fcn.024f5ec4
cmp al, 0xb0
inc ecx
mov al, 2
and ch, byte [ebp + 0x76b7443d]
cmp al, 0xf
dec edi
js 0x24f461d
mov eax, 0xe1b1da6f
mov ax, si
jmp 0x24f47b9
Function at 0x24dfb29
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
sub esp, 0x214
clc
jmp 0x24c285b
push ebp
mov ebp, edi
mov ebp, esp
push edx
jmp 0x24c27ff
mov dword [esp + 8], eax
stc
sub esp, 0x12
lea esp, [esp + 2]
lea esp, [esp + 0x14]
jmp 0x24c2842
push esi
pushal
pushfd
mov bp, word [esp + 1]
jmp 0x24c281e
popal
mov ebx, ecx
lea ecx, [ecx + edx]
mov ecx, dword [esp]
mov cx, word [esp]
jmp 0x24c2883
push ebx
xchg bh, bl
bt bx, si
mov bx, dx
dec bl
jmp 0x24c2834
sub esp, 0x1b
push word [esp + 8]
lea esp, [esp + 1]
jmp 0x24c2890
lea ecx, [esi + esi]
push edi
mov dword [ebp - 0xc], ecx
jmp 0x24c2869
lea esp, [esp + 0x1c]
test ecx, ecx
call fcn.024c28dd
jmp 0x24e0dfd
jmp 0x24c28b1
jmp 0x24c2914
pushfd
lea esp, [esp + 4]
jmp 0x24c2816
Function at 0xae173d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae173d
ret
Function at 0x4059d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a3a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a24
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a41
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40aa94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aacd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40aad6
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aae0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab01
mov al, byte [esp]
jmp 0x40ab03
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b188
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b000
mov eax, dword [0x46ba28]
cmp byte [eax], 0
je 0x40b204
mov eax, dword [0x46b83c]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004082f4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b24c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b23a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46b7ec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46c664]
call fcn.00404ee8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret