joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f840
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44f8a6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44f8a6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44f887
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x44fc30
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x44fc68
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x450940
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x450989
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x450e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472e10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004509b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00450a30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00450a30
lea ecx, [esi + 0xc]
call fcn.00464878
lea ecx, [esi + 0x10]
call fcn.00464878
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00451fc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00451fc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00451fc0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004648ed
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004648ed
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x455261
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x455281
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00457a05
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4552a4
test byte [esp + 8], 2
je 0x4552a4
call fcn.00457a78
mov dword [eax], 0xd
call fcn.00457a81
mov dword [eax], 5
jmp 0x45527d
xor eax, eax
ret

Function at 0x466c91
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x466cc9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00464d48
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00464d20
jmp 0x466cd5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x468386
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4683c8
call fcn.0046e0fc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4683c8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4683bf
xor eax, eax
jmp 0x4683d0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004683d6
pop edi
pop esi
pop ebx
ret 4

Function at 0x46e62c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46e65a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46e678
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046e592
jmp 0x46e678
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46e678
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046e592
test edi, edi
mov eax, edi
jne 0x46e662
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call fcn.1001abe4
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.1001abe4
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call fcn.1001abe4
pop ecx
jmp 0x10018771
push esi
call fcn.1001abe4
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
Function at 0x1001abe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1001abf3
pop dword [ebp - 0x34]
mov eax, 0x1001abf3
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x75f99
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x8b2a2ef7
sub ecx, 0x8b29d657
xor esi, esi
add esi, eax
mov edx, 0x10191000
add edx, dword [ebp - 0x34]
mov edi, 0x85485535
add edi, 0xe80eec5a
xor dword [ebp - 0x2c], 0x727d94ef
mov ebx, dword [edx]
mov dword [ebp - 0x20], 0xf0113df9
sub ebx, edi
sub dword [ebp - 0x20], 0xa0a582b6
mov dword [esi], ebx
mov dword [ebp - 8], 0x6a149b56
add esi, 4
add edx, 0x213b21d8
sub edx, 0x213b21d4
loop 0x1001ac44
add eax, 0xc0148611
add eax, 0x3feccf42
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xcd8a66d0
add ecx, 0x42759930
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x41a9c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x41a9d7
pop dword [ebp - 0x38]
mov eax, 0x7416ad2b
add eax, 0x8c2afcac
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3e53f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4fb3
xor esi, esi
add esi, eax
mov edx, 0x432e00
add edx, dword [ebp - 0x38]
mov edi, 0xebbd6be3
sub edi, 0x8345b294
mov ebx, dword [edx]
xor dword [ebp - 0x1c], 0x89e852fc
sub ebx, edi
add dword [ebp - 0x18], edx
mov dword [esi], ebx
sub dword [ebp - 8], edi
add esi, 4
add edx, 0x4449f1a3
sub edx, 0x4449f19f
loop 0x41aa27
add eax, 0x8194137a
sub eax, 0x8192e1db
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x627d1803
sub ecx, 0x623d1803
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x40124f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.construct
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x403100], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x40136e
push 1
push dword [0x403100]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.displayed
push str.construct
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x403108], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x403108]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x40136e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401351
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404b14
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
and dword [esp + 4], 0
push ebx
push esi
push edi
pushal
xor eax, eax
dec eax
xor ebx, eax
mov dword [esp + 0x30], ebx
popal
push str.V3.5_n
call dword [sym.imp.MSVCR90.dll_printf]
cmp dword [0x4093a8], 0
pop ecx
jne 0x404b4d
call fcn.0040435c
cmp dword [0x4093a4], 0
jne 0x404b5b
call fcn.0040429c
call fcn.0040459d
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi]
call fcn.00404144
lea eax, [esp + 0x14]
push eax
call fcn.00403faf
mov dword [0x4093ac], eax
lea eax, [esp + 0x38]
push eax
call fcn.00403f65
push dword [esp + 0xc]
push dword [esi]
call fcn.00404033
push eax
mov dword [0x4093b0], eax
call dword [sym.imp.MSVCR90.dll__msize]
pop ecx
mov esi, eax
push esi
call fcn.00403fe4
mov eax, esi
imul eax, eax, 3
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0040327f
test edi, edi
je 0x404bf3
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x10]
push edi
call fcn.004043b2
lea eax, [esp + 0x38]
push eax
call dword [0x409398]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00404267
int3

Function at 0x60620764
Capabilities:
Encode data using xor

Disassembly:
jmp 0x6062076e
pushal
call 0x60620774
pop ebp
sub ebp, 0x10
sub ebp, 0x3b0764
mov al, byte [esp + 0x28]
cmp al, 1
je 0x60620798
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x606207a1
mov eax, 0x3b0764
add eax, ebp
add eax, 0x63
mov ecx, 0x61b
mov edx, 0x61c560d2
xor byte [eax], dl
inc eax
dec ecx
jne 0x606207b8
jmp 0x606207cb
pop ecx
pop ds
pop ecx
pop ebx
out dx, al
rcl dl, cl
rcl byte [ebx + 0x13], cl
sub dl, dl
rcl dl, cl
rcr dword [edi], 1
push 0xffffffffffffffd6
rcl dl, cl
shr byte [eax - 6], cl
rcl dl, cl
shl byte [0x591ad130], cl
push ebx
invalid
Function at 0x416660
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x6326ec], 0
push esi
mov esi, 1
jne 0x41667d
call fcn.00566590
mov dword [0x6326ec], eax
test eax, eax
je 0x4166ba
call fcn.00566590
mov ecx, eax
mov eax, dword [0x6326ec]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xbb8
jl 0x4166a7
mov dword [0x6326f0], esi
mov eax, esi
mov dword [0x6326ec], ecx
pop esi
ret
cmp dword [0x6326f0], 3
jl 0x4166b4
xor eax, eax
pop esi
ret
add dword [0x6326f0], esi
mov eax, esi
pop esi
ret
Function at 0x442290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
movsx eax, byte [ebx]
push esi
push edi
push eax
call fcn.005533e4
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x19
ja 0x442302
push ebx
call fcn.00567fb0
add esp, 4
test eax, eax
je 0x442302
push ebx
mov dword [ebp + 8], 0x14
call fcn.00568000
add esp, 4
test eax, eax
je 0x442302
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 5
je 0x442324
call edi
mov esi, eax
lea ecx, [ecx]
call fcn.00568280
call edi
sub eax, esi
cmp eax, 0x3e8
jb 0x4422e0
dec dword [ebp + 8]
js 0x442302
push ebx
call fcn.00568000
add esp, 4
test eax, eax
jne 0x4422d4
push 0
push ebx
call fcn.00588e20
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x44231d
push esi
call fcn.00588e70
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x442370
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
jne 0x4423ac
push 0x56
xor esi, esi
call fcn.00569ea0
add esp, 4
test eax, eax
je 0x4423b3
push 0xa2
call fcn.00569e7d
add esp, 4
test eax, eax
jne 0x4423ac
push 0xa3
call fcn.00569e7d
add esp, 4
test eax, eax
je 0x4423b3
pop esi
pop ebp
jmp 0x5667f0
mov eax, esi
pop esi
pop ebp
ret
mov eax, dword [0x69f968]
push esi
push eax
xor esi, esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x566813
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
ret
Function at 0x4652e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call fcn.00566590
mov esi, dword [ebp + 8]
cmp eax, dword [esi]
jl 0x465428
call fcn.00566590
add eax, 0x3e8
mov dword [esi], eax
call fcn.0040e810
mov dword [ebp - 8], eax
mov eax, dword [eax + 0x364]
push eax
call fcn.00582ef0
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x465428
mov esi, dword [eax + 0x124]
push ebx
mov ebx, dword [eax + 0x128]
mov eax, dword [0x5c18bc]
push edi
mov edi, dword [0x5c18b8]
push 0x280
push eax
push edi
push ebx
push esi
mov dword [ebp + 8], eax
call fcn.0048b780
add esp, 0x14
test eax, eax
je 0x46536f
mov ecx, dword [ebp + 8]
push ecx
push edi
call fcn.0046d840
add esp, 8
call fcn.004652d0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x1900
jle 0x4653a4
mov edx, dword [ebp + 8]
push 0x1900
push edx
push edi
push ebx
push esi
call fcn.0048b780
add esp, 0x14
test eax, eax
jne 0x4653a4
cmp esi, edi
setle al
dec eax
and eax, 0x80
jmp 0x4653b3
mov eax, dword [ebp + 8]
push eax
push edi
push ebx
push esi
call fcn.00583540
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
push 0x5000000
call fcn.00583850
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add ecx, ebx
add eax, esi
mov dword [ebp - 0xc], ecx
push 0
mov dword [ebp - 0x10], eax
sar ecx, 6
push ecx
sar eax, 6
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004039e0
add esp, 0x20
cmp eax, 0xffffffff
je 0x465426
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push ecx
movzx ecx, byte [edx + 0x330]
movzx edx, ax
sar eax, 0x10
movzx eax, ax
push ecx
shl edx, 6
push edx
shl eax, 6
push eax
call fcn.00403540
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
call fcn.0046d840
add esp, 0x18
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47d980
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x5c53dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00584e80
add esp, 4
test eax, eax
je 0x47dbd8
mov eax, dword [0x642874]
test eax, eax
je 0x47d9b9
push eax
call fcn.00567830
add esp, 4
push ebx
push esi
push 0x9d02
call fcn.00567760
mov esi, eax
push 0x9d02
push 0
push esi
mov dword [ebp - 0xd0], esi
mov dword [0x642874], esi
call fcn.00551e50
push 1
push str.city_guard
call fcn.00584bd0
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x47dbd1
push edi
jmp 0x47da06
mov esi, dword [ebp - 0xd0]
push 0
push ebx
push 1
push str.city
call fcn.004846d0
add esp, 0x10
test eax, eax
je 0x47dbb8
mov ecx, eax
imul ecx, ecx, 0x9a
push 0x69ef3c
push ebx
lea esi, [ecx + esi - 0x9a]
push 1
push str.select_role
mov word [esi], ax
call fcn.00584c90
add esp, 0x10
test eax, eax
je 0x47da95
push 0xc8
lea edx, [ebp - 0xcc]
push 0
push edx
call fcn.00551e50
push 8
lea eax, [ebp - 0xcc]
push eax
push 0x69ef3c
call fcn.004848d0
add esp, 0x18
cmp eax, 8
jg 0x47da95
xor ecx, ecx
test eax, eax
jle 0x47da95
lea edx, [esi + 2]
mov di, word [ebp + ecx*4 - 0xcc]
mov word [edx], di
inc ecx
add edx, 2
cmp ecx, eax
jl 0x47da82
push 0x69ef3c
push ebx
push 1
push str.select_role2
call fcn.00584c90
add esp, 0x10
test eax, eax
je 0x47db03
push 0xc8
lea ecx, [ebp - 0xcc]
push 0
push ecx
call fcn.00551e50
push 8
lea edx, [ebp - 0xcc]
push edx
push 0x69ef3c
call fcn.004848d0
add esp, 0x18
cmp eax, 8
jg 0x47db03
xor ecx, ecx
test eax, eax
jle 0x47db03
lea edx, [esi + 0x12]
jmp 0x47daf0
mov di, word [ebp + ecx*4 - 0xcc]
mov word [edx], di
inc ecx
add edx, 2
cmp ecx, eax
jl 0x47daf0
push 0x69ef3c
push ebx
push 1
push str.guard_data
xor edi, edi
call fcn.00584c90
add esp, 0x10
test eax, eax
je 0x47dbb8
add esi, 0x24
cmp edi, 6
jge 0x47dbb8
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00551e50
push 6
lea ecx, [ebp - 0xcc]
push ecx
push 0x69ef3c
call fcn.004848d0
add esp, 0x18
cmp eax, 6
jne 0x47dbb8
mov dx, word [ebp - 0xcc]
mov word [esi - 2], dx
mov ax, word [ebp - 0xc8]
mov word [esi], ax
mov ecx, dword [ebp - 0xc4]
mov dword [esi + 2], ecx
mov edx, dword [ebp - 0xc0]
mov dword [esi + 6], edx
mov eax, dword [ebp - 0xbc]
push 0x69ef3c
inc edi
mov dword [esi + 0xa], eax
mov ecx, dword [ebp - 0xb8]
push ebx
lea edx, [edi + 1]
push edx
mov dword [esi + 0xe], ecx
push str.guard_data
add esi, 0x14
call fcn.00584c90
add esp, 0x10
test eax, eax
jne 0x47db25
push ebx
push str.city_guard
call fcn.00584c30
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x47da00
pop edi
call fcn.00585070
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551e40
mov esp, ebp
pop ebp
ret
Function at 0x4f01c0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x5c53dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.004f9a40
test eax, eax
je 0x4f02f0
push ebx
push edi
push 4
push 1
push 2
push 9
push 0
push 0
push 0x1e
push 0xb5
push 0x1c
push 0x8b
push 0x4e61
call fcn.00486120
add esp, 4
push eax
push esi
call fcn.004fbb60
call fcn.004f9c60
push eax
lea eax, [ebp - 0x84]
push 0x5a5660
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 4
push 2
push 2
push 1
push 0
push 1
push 0x11
push 0x50
push 0x1e0
push 0x9b
lea ecx, [ebp - 0x84]
push ecx
push esi
call fcn.004fbb60
add esp, 0x6c
xor ebx, ebx
xor edi, edi
lea ebx, [ebx]
push edi
push 1
call fcn.004fbee0
add esp, 8
test ax, ax
je 0x4f0271
inc ebx
inc edi
cmp edi, 0xc8
jl 0x4f0260
push 4
push 0
push 2
push 1
push 0
push 1
push 0x13
push 0x24
push 0x4b
push 0xa7
push 0x4e8e
call fcn.00486120
add esp, 4
push eax
push esi
call fcn.004fbb60
call fcn.004f9a20
push eax
call fcn.0047f950
push eax
push ebx
lea edx, [ebp - 0x84]
push str._d__d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x44
push 4
push 2
push 2
push 1
push 0
push 1
push 0x13
push 0x58
push 0x4b
push 0xcb
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004fbb60
add esp, 0x30
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00551e40
mov esp, ebp
pop ebp
ret

Function at 0x51fc80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x5c53dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx + 0x38]
sub ebx, dword [ecx + 0x34]
xor eax, eax
sar ebx, 2
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], eax
test ebx, ebx
jle 0x51fd8a
push esi
push edi
mov edx, dword [ecx + 0x38]
sub edx, dword [ecx + 0x34]
sar edx, 2
cmp edx, eax
jle 0x51fcca
mov edx, dword [ecx + 0x34]
mov edi, dword [edx + eax*4]
jmp 0x51fccc
xor edi, edi
mov edx, dword [edi + 1]
cmp edx, dword [ebp + 8]
jne 0x51fd79
mov esi, dword [ebp + 0xc]
cmp dword [edi + 5], esi
jne 0x51fd79
push str.hTemp_Mail_Backup
call fcn.0059c56e
mov eax, dword [ebp + 8]
push esi
push eax
call fcn.0051f380
lea edx, [ebp - 0x84]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x51fd03
lea ecx, [ebp - 0x84]
push 0x5ae7e8
push ecx
call fcn.00555ad3
mov esi, eax
add esp, 8
test esi, esi
je 0x51fd6d
push esi
push 1
xor eax, eax
lea edx, [ebp - 0x94]
push 0x10
push edx
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
call fcn.00555434
push esi
push 1
push 0x119
push edi
call fcn.00555434
push esi
call fcn.00555563
add esp, 0x24
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x98], eax
cmp eax, ebx
jl 0x51fcb5
pop edi
pop esi
mov eax, dword [ecx]
mov edx, dword [ecx + 0x61]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00551e40
mov esp, ebp
pop ebp
ret 8