joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460772
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x460825
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46080f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4607ec
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4607ea
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x46080d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46080d
push 0x37f
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x460823
push 0x7687
push 0x760d
push 0
call fcn.0049c014
add esp, 0xc
jmp 0x46083f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 0
push 0x6db
push 1
push dword [ebp - 0x30]
call fcn.0046da26
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x46252f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x4625a9
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46256d
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
call fcn.00462688
pop ecx
pop ecx
jmp 0x4625a4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x6674
push 0x13bf
push 0x7b62
push 0x1a03
push 1
push 0
push 0x2659
push 0x60bb
push 1
push 1
call fcn.0046046e
add esp, 0x2c
jmp 0x462684
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x46260e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x2aa9
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 1
push 0x3680
push dword [ebp - 0x30]
call fcn.004547c4
add esp, 0x18
jmp 0x462684
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x462661
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x46265f
push 0x2e54
push 0
push 0x10b1
push 1
push 0x1180
push 0
push 1
call fcn.0046387d
add esp, 0x1c
jmp 0x462684
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x462684
push 0x15dd
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x46387d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x463901
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4638e8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4638d9
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 1
push 1
push 0x244b
push 0x2800
push 1
call fcn.00460772
add esp, 0x18
jmp 0x4638e6
push 0x231e
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4638ff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 1
push 1
push 1
push dword [ebp - 0x18]
call fcn.00460df6
add esp, 0x10
jmp 0x463934
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push 0x24df
push 1
push dword [ebp - 0x1c]
push 0x4420
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
call fcn.00453c69
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x468566
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf533
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x46869e
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x74a
mov dword [ebp - 0x24], str.yanqbkndo_twnr_vvlhw_iko
cmp dword [ebp - 0x20], 0x975
jle 0x46863b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 0x1c], 0
jmp 0x4685c8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1d24
jge 0x46863b
and dword [ebp - 0x14], 0
jmp 0x4685de
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x321d
jge 0x468639
and dword [ebp - 0x18], 0
jmp 0x4685f4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4265
jge 0x468637
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.00401a1e
pop ecx
pop ecx
mov ecx, eax
call fcn.0043542e
push eax
call fcn.004a9457
pop ecx
lea ecx, [ebp - 0x54]
call fcn.00435424
jmp 0x4685ed
jmp 0x4685d7
jmp 0x4685c1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x69d
jge 0x468657
push dword [ebp - 0x24]
call fcn.004a9457
pop ecx
jmp 0x468673
or dword [ebp - 4], 0xffffffff
jmp 0x46867d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 1
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call fcn.004738e9
add esp, 0x14
jmp 0x4686b0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push 1
call fcn.00463938
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a903
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x46a93f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push 0x6b87
push 0x35ed
push 0x4cf9
push 1
push dword [ebp - 4]
push 0x2a47
push 1
call fcn.0046a9f8
add esp, 0x1c
jmp 0x46a9f4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x46a9b8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x46a990
push 0x1e6a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x46a9b6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x46a9b6
push 0x23ac
push 0x14d1
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x46a9f4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 0x497e
push 0
push 0x39b4
push 0x4525
push 0x4334
push 0x5df8
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x4a5c
push 1
call fcn.004603b0
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x46c1cb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf5a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x46c311
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x46c2e4
mov dword [ebp - 0x1c], 0x1cfe
mov dword [ebp - 0x28], str.dccgjleko_hrxpepn_dlszubvp_obxcn_prxlqey_fbn_uhn
cmp dword [ebp - 0x1c], 0x1fdb
jle 0x46c28a
and dword [ebp - 0x14], 0
jmp 0x46c23d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x211d
jge 0x46c27d
and dword [ebp - 0x18], 0
jmp 0x46c253
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x13d8
jge 0x46c27b
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov ecx, 0xab56b8
call fcn.00435439
jmp 0x46c24c
jmp 0x46c236
push 0x1769
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1b14
jge 0x46c2aa
mov edx, dword [ebp - 0x28]
mov ecx, 0xab56b8
call fcn.004371ef
jmp 0x46c2c6
or dword [ebp - 4], 0xffffffff
jmp 0x46c2d0
push 1
push 0x38f5
push dword [ebp - 0x2c]
call fcn.0046c3a2
add esp, 0xc
jmp 0x46c30c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push 0x8de
push 0x4b56
push 0
push dword [ebp - 0x34]
push 0x107e
push 1
push 1
call fcn.004762c8
add esp, 0x20
jmp 0x46c391
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x46c375
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x44]
push 0x11ea
push 0x661d
push dword [ebp - 0x48]
push 0x4918
push 1
push 0x6e3d
push 0x449e
push 0x6f03
call fcn.0045a3bd
add esp, 0x24
jmp 0x46c391
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
call fcn.0045d2fc
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46cbb6
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x46cd28
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x46cc84
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x46cc69
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x46cc4a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x46cc67
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.0043566b
mov dword [eax], 0xec1b16eb
jmp 0x46cc3f
jmp 0x46cc7f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x46cd26
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x46ccec
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0xfffffffd
jmp 0x46ccc2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 1
jne 0x46ccea
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x46cce8
push 0x22aa
push 0x136e
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
jmp 0x46ccb7
jmp 0x46cd26
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x46cd0e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jl 0x46cd26
mov dword [ebp - 0x5c], 0x3250e6da
mov dword [ebp - 0x5c], 3
jmp 0x46cd03
jmp 0x46cd30
push 1
call fcn.004596af
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4735bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf669
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x473756
mov dword [ebp - 0x24], 0x7e38
mov dword [ebp - 0x28], str.tbqs_lkyofa_gqrj_qgh_yptzclrj_ektyvubvh_rqg_hntqg_mzt_nldeup
cmp dword [ebp - 0x24], 0x8017
jle 0x4736a9
push 0x49e
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
and dword [ebp - 0x14], 0
jmp 0x47361d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x12cd
jge 0x47369c
and dword [ebp - 0x18], 0
jmp 0x473633
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x77ce
jge 0x473697
and dword [ebp - 0x1c], 0
jmp 0x473649
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x59af
jge 0x473695
and dword [ebp - 0x20], 0
jmp 0x47365f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x79d2
jge 0x473693
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
xor ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0xab56b8
call fcn.00435439
jmp 0x473658
jmp 0x473642
jmp 0x47362c
jmp 0x473616
push 0xc0e
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7d5a
jge 0x4736c9
mov edx, dword [ebp - 0x28]
mov ecx, 0xab56b8
call fcn.004371ef
jmp 0x4736e5
or dword [ebp - 4], 0xffffffff
jmp 0x4736ef
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x47370f
push 1
call fcn.004737ad
pop ecx
jmp 0x473754
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push 0x3602
push 1
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0
push 0x7883
push 0x6f16
push 0x7dab
push 0x3c17
push 1
push 0x402
push 0x5ce2
call fcn.00457d99
add esp, 0x34
jmp 0x47379c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x5c22
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
push eax
push 0x4ff3
push 0x8b1
push 0
push 0x7962
call fcn.004718ba
add esp, 0x24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4743c1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x47449f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x474470
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x474423
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x47446e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x474451
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x47446e
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0043566b
mov dword [eax], 2
jmp 0x474446
jmp 0x47449d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x474493
push 0x1e6a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x47449d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4744cd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
push 0x152c
push 1
push 0
push 0x6163
push 0x29d
push 0x1f95
push 0x2bda
push dword [ebp - 0x38]
call fcn.0045c72a
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x477ff1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf6f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x47816d
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], 0x6cde
mov dword [ebp - 0x4c], str.dcfzb_mmqcc_pmeyzsa_lmdqksik_hmjtbli
cmp dword [ebp - 0x1c], 0x6f2c
jle 0x4780c5
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [ebp - 0x14], 0
jmp 0x47806f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x79b7
jge 0x4780c5
and dword [ebp - 0x18], 0
jmp 0x478085
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1e11
jge 0x4780c3
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.00401a1e
pop ecx
pop ecx
mov ecx, eax
call fcn.0043542e
push eax
call fcn.004a9457
pop ecx
lea ecx, [ebp - 0x70]
call fcn.00435424
jmp 0x47807e
jmp 0x478068
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4780ed
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
call fcn.00478194
add esp, 0xc
jmp 0x47812f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
push 1
push dword [ebp - 0x40]
push 0x1002
push 0x500
push 0x5b78
push 1
push 0x51fe
push 0x49fe
push 1
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.0045850a
add esp, 0x2c
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6c13
jge 0x478145
push dword [ebp - 0x4c]
call fcn.004a9457
pop ecx
jmp 0x478161
or dword [ebp - 4], 0xffffffff
jmp 0x47816b
jmp 0x478183
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x50], eax
push 1
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
push eax
call fcn.0045343c
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47a080
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf731
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x47a0b7
push 1
call fcn.0047a1e8
pop ecx
jmp 0x47a1d7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x276d
mov dword [ebp - 0x24], str.pobwxtz_xabpboxeo_wvthgzcqq_bbovzz_tgj_qgqg_vobkkec_dzlkchc_yqebmg_qqtfwl_bahzassmw_mqc
cmp dword [ebp - 0x20], 0x27cc
jle 0x47a166
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
and dword [ebp - 0x14], 0
jmp 0x47a0f9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x265f
jge 0x47a154
and dword [ebp - 0x18], 0
jmp 0x47a10f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x35bf
jge 0x47a152
and dword [ebp - 0x1c], 0
jmp 0x47a125
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6047
jge 0x47a150
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0xab56b8
call fcn.00435439
jmp 0x47a11e
jmp 0x47a108
jmp 0x47a0f2
push 0xd65
push 0
push 0x18a2
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x23a4
jge 0x47a186
mov edx, dword [ebp - 0x24]
mov ecx, 0xab56b8
call fcn.004371ef
jmp 0x47a1a2
or dword [ebp - 4], 0xffffffff
jmp 0x47a1ac
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0x6ab9
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 1
call fcn.0045b6c2
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret