joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4673d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4674e0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x4674c0
mov eax, ebx
call fcn.004061f8
push eax
call sub.kernel32.dll_GetModuleHandleA
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0041adf8
mov dword [edi], eax
test esi, esi
je 0x46742e
cmp word [esi], 0x25ff
jne 0x46742e
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x467430
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x46744e
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x683694]
je 0x46744e
cmp byte [0x6836a0], 0
je 0x467465
lea eax, [ebp - 0x10]
call fcn.00436838
mov eax, dword [ebp - 0x10]
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
call fcn.00436c8c
jmp 0x467474
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x683694]
call fcn.00436bd4
test ebx, ebx
je 0x467483
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x467487
xor eax, eax
jmp 0x467489
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4674c4
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4674c4
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x4674c4
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4674e7
lea eax, [ebp - 0x10]
mov edx, dword [0x43680c]
call fcn.0040860c
ret

Function at 0x4674f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4675cf
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4675b3
test esi, esi
je 0x467535
cmp word [esi], 0x25ff
jne 0x467535
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x467537
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x467555
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x683694]
je 0x467555
cmp byte [0x6836a0], 0
je 0x46756c
lea eax, [ebp - 0xc]
call fcn.00436838
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.00436c8c
jmp 0x46757b
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x683694]
call fcn.00436bd4
test ebx, ebx
je 0x4675b3
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x4675b3
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4675b3
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4675d6
lea eax, [ebp - 0xc]
mov edx, dword [0x43680c]
call fcn.0040860c
ret
Function at 0x467dec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x41c90c]
call fcn.00407644
xor eax, eax
push ebp
push 0x467f5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x49], 0
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.00421d14
cmp byte [ebp - 0x40], 0
je 0x467f40
mov eax, dword [ebp - 0x20]
call fcn.0040832c
test eax, eax
jl 0x467f40
inc eax
xor esi, esi
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
mov ecx, dword [ebp - 0x20]
lea ebx, [ecx + edx*4]
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x44]
jne 0x467f38
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp byte [eax], 0xe8
jne 0x467eda
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x467f40
mov edx, dword [ebp + 0x14]
mov eax, dword [ebx + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
sub edx, dword [ebx + 8]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 0x18]
mov edx, dword [ebx + 0xc]
mov dword [eax], edx
mov byte [ebp - 0x49], 1
jmp 0x467f40
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + edx*4 + 4]
cmp word [eax], 0x15ff
jne 0x467f40
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x467f40
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x48]
mov dword [eax], edx
lea edx, [ebp - 0x50]
push edx
mov edx, dword [ebp - 0x50]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 0x18]
mov edx, dword [ebx + 0xc]
mov dword [eax], edx
mov byte [ebp - 0x49], 1
jmp 0x467f40
inc esi
dec eax
jne 0x467e5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467f63
lea eax, [ebp - 0x40]
mov edx, dword [0x41c90c]
call fcn.0040771c
ret
Function at 0x4681cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov byte [0x68403c], 0
cmp dword [0x684040], 0
je 0x468213
push esp
push 0x40
push 4
mov eax, dword [0x684040]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x468269
mov eax, dword [0x684040]
mov edx, dword [0x684044]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x684040]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x468269
cmp dword [0x684048], 0
je 0x468252
push esp
push 0x40
push 4
mov eax, dword [0x684048]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x468269
mov eax, dword [0x684048]
mov edx, dword [0x68404c]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x684048]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x468269
push 0
mov ecx, 0x467b04
mov eax, sub.kernel32.dll_CreateThread_1
mov edx, dword [0x684034]
call fcn.004674f4
push 0
mov ecx, 0x467dc0
mov edx, dword [0x684038]
xor eax, eax
call fcn.004674f4
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
ret

Function at 0x4688b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov esi, eax
lea eax, [ebp - 8]
mov edx, dword [0x468780]
call fcn.00407644
xor eax, eax
push ebp
push 0x46898f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x46899c
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x468966
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040dfb4
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x4689b4
call fcn.00405f80
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040f574
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00405bec
lea eax, [ebp - 4]
mov edx, 0x4689dc
call fcn.00405f04
mov eax, dword [ebp - 4]
call fcn.00405ed0
cmp eax, 0x104
jge 0x468958
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call fcn.004064dc
lea eax, [ebp - 8]
push eax
push 0x4687b8
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468996
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405b60
lea eax, [ebp - 8]
mov edx, dword [0x468780]
call fcn.0040771c
ret
Function at 0x4698b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x469a48
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, 0x469a58
mov ecx, 0x469a6c
mov eax, ebx
call fcn.0041b314
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405d4c
call fcn.00405ed0
cmp eax, 0x14
jne 0x469a32
cmp ebx, dword [0x683694]
sete al
mov edx, dword [ebp - 4]
test byte [edx + 3], 0x80
sete dl
cmp al, dl
jne 0x469a32
mov eax, ebx
call fcn.0041ab20
mov esi, eax
cmp word [esi + 0x18], 0x20b
jne 0x46999a
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x683694]
jne 0x469957
mov eax, 0x435190
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
jmp 0x469964
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xf0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x469a23
lea eax, [ebp - 8]
push eax
push 0x40
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
cmp ebx, dword [0x683694]
jne 0x4699d7
mov eax, 0x435190
mov edx, dword [ebp - 4]
sub eax, dword [edx]
sub eax, ebx
mov dword [esi + 0x2c], eax
mov eax, 0x683604
mov edx, dword [ebp - 4]
sub eax, dword [edx + 4]
sub eax, ebx
mov dword [esi + 0x30], eax
jmp 0x4699f2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and eax, 0x7fffffff
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xe0
lea eax, [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469a4f
lea eax, [ebp - 4]
call fcn.00405b3c
ret
Function at 0x469b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x469d4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x469d6c
call fcn.00405bec
mov eax, dword [ebp - 4]
call fcn.004061f8
push eax
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
jne 0x469d39
xor eax, eax
push ebp
push 0x469d2f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
jmp 0x469d10
cmp dword [ebp - 0x1c], 0x1000
jne 0x469d08
cmp dword [ebp - 0x18], 1
je 0x469d08
cmp esi, dword [ebp - 0x28]
je 0x469d08
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jne 0x469d08
push 0x104
lea eax, [ebp - 0x236]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
test eax, eax
jbe 0x469d08
mov eax, dword [ebp - 0x28]
call fcn.0043a6b8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x469d08
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x469d08
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x469d08
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x693a30]
mov esi, dword [esi]
mov eax, 0x469d7c
mov ecx, 0xe
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x469cc9
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x693a30]
mov esi, dword [esi]
mov eax, 0x469d8c
mov ecx, 0x10
mov edx, dword [ebp - 0x10]
call esi
inc eax
sete dl
mov eax, dword [ebp - 0x28]
call fcn.00469260
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
sub eax, 0x10
push eax
push 0
push 0
push 0x7fffffff
mov esi, dword [0x693a30]
mov esi, dword [esi]
mov eax, 0x469da0
mov ecx, 0xc
mov edx, dword [ebp - 0x10]
call esi
test eax, eax
jl 0x469d08
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.0046907c
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
add ebx, eax
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
je 0x469bc9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x469d39
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469d56
lea eax, [ebp - 4]
call fcn.00405b3c
ret
Function at 0x46be84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00405b3c
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.004061f8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x46bf49
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004061f8
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0xc], 0
je 0x46bf40
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46bf3a
cmp dword [ebp - 0x10], 1
jne 0x46bf2c
mov eax, ebx
mov edx, esi
mov ecx, 0
call fcn.00405df0
jmp 0x46bf3a
push 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call fcn.00405c74
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46e504
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x698dac
push 0xa
push 0x46e598
mov eax, dword [0x697b20]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x46e528
call fcn.0047b324
push ebx
mov eax, dword [0x697b20]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x46e53f
call fcn.0047b324
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x46e551
call fcn.0047b324
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x698db0], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x698db4], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x698db8], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x698dbc], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x698dc0], ecx
add edx, dword [eax + 0x14]
mov dword [0x698dc4], edx
pop esi
pop ebx
ret

Function at 0x4704fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4705a5
test eax, edx
je 0x4705a8
push 0
push 0
cmp word [eax - 0xa], 2
je 0x470525
push edx
mov edx, eax
mov eax, esp
call fcn.00406dd4
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x47053b
push eax
lea eax, [esp + 8]
call fcn.00406dd4
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x47054a
movzx eax, word [eax]
sub eax, ecx
jmp 0x470571
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x47058b
add ecx, 4
js 0x470562
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x470588
push eax
mov eax, ecx
mov edx, 2
call fcn.00405b60
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x47056f
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x470571
xor eax, eax
ret
test eax, eax
je 0x4705b8
test edx, edx
jne 0x47050c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x471a2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00406c34
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x471a4a
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x471a6b
cmp ebx, 3
je 0x471a6b
cmp ebx, 0x7b
je 0x471a6b
mov eax, esi
call fcn.004719ec
test al, al
jne 0x471a6f
xor eax, eax
jmp 0x471a71
mov al, 1
pop esi
pop ebx
ret

Function at 0x471a74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406c34
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x471a8d
test al, 0x10
jne 0x471a91
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x471bac
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406c34
push eax
call sub.kernel32.dll_GetFileAttributesW
pop ebx
ret
Function at 0x471bc0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00406c34
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x471be2
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4783cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x478405
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406ce4
jmp 0x47840e
mov eax, ebx
mov edx, esi
call fcn.00406ba8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x478418
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x47843a
movzx eax, word [esp]
jmp 0x47843c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x478cec
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffff004
push eax
add esp, 0xffffff7c
push 0x800
lea ecx, [esp + 0x88]
call fcn.00478b24
mov eax, dword [0x6940d4]
cmp byte [eax], 0
je 0x478d7e
mov eax, dword [0x69391c]
call fcn.00403a1c
call fcn.004033c8
lea eax, [esp + 0x884]
push eax
lea eax, [esp + 0x88]
push eax
call sub.user32.dll_CharToOemW
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x88c]
call fcn.00472418
push eax
lea eax, [esp + 0x890]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x478dcc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x478db7
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x693814]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x697b20]
call fcn.004086f4
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x8c]
push eax
push 0
call sub.user32.dll_MessageBoxW
add esp, 0x1084
ret
Function at 0x479a0c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x479ae2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406bfc
lea eax, [ebp - 4]
call fcn.00407528
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x479acc
mov eax, ebx
call fcn.00403230
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x479ac5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x479aaf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x479af4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x479aaf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479acc
mov eax, dword [ebp - 0x10]
call fcn.0040324c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479ae9
lea eax, [ebp - 4]
call fcn.00406b98
ret

Function at 0x47b123
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00405edc
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x47b146
mov eax, edi
add eax, eax
call fcn.00403230
mov esi, eax
jmp 0x47b148
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x47b181
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x47b16b
mov eax, esp
cmp esi, eax
je 0x47b18e
mov eax, esi
call fcn.0040324c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x47b1c8
cmp bl, 0
je 0x47b1c4
cmp bl, 0x41
jl 0x47b1bf
cmp bl, 0x5a
jg 0x47b1bf
or bl, 0x20
xor al, bl
inc esi
jmp 0x47b1a3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x47b108