joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461564
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46157b
add esp, 0xfffffff0
call fcn.00403d94
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424d8c
mov eax, dword [0x56b924]
cmp word [eax + 2], 0
jne 0x4615a3
mov eax, dword [0x56b924]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462c3c
mov eax, dword [0x56bad0]
cmp word [eax + 2], 0
jne 0x4615bd
mov eax, dword [0x56bad0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462e34
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41b1c4]
call fcn.00403a38
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41b1c4]
call fcn.00403a38
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4272ec]
call fcn.0042ec4c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x461744
mov eax, dword [0x56b71c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042f01c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4633d4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x56b71c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040deec
test eax, eax
je 0x4616b2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409fe0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040df14
test eax, eax
je 0x4616c6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404bb4
mov eax, dword [0x56b430]
cmp byte [eax], 0
jne 0x4616fa
mov eax, ebx
call fcn.0046186c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004635b0
mov eax, ebx
call fcn.00463f74
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46173a
call fcn.00403dec
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461aec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x56cbb8]
cmp dword [eax + 0x30], 0
je 0x461b96
cmp dword [ebx + 0x94], 0
jne 0x461b90
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x461a7c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x461b90
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x461b56
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461b90
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041dab8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x461b65
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4626f8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46272d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a34
jmp 0x46273a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404998
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46378c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4637cd
mov eax, esi
call fcn.00449a14
test al, al
je 0x4637cd
mov eax, dword [ebx + 0x84]
call fcn.00449710
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4637cd
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449710
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x466e94
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x466ec2
mov eax, ebx
call fcn.00467948
cmp dword [ebx + 0x40], 0
je 0x466ebb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x466f33
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x466f25
cmp dword [ebx + 8], 0
je 0x466ee4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x466ef6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x466f25
cmp dword [ebx + 8], 0
je 0x466ed7
cmp eax, 3
je 0x466f09
dec eax
jne 0x466ed7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x466ed7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x466ed7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x466f51
cmp dword [ebx + 0x14], 0xcc
je 0x466f51
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00466f5c
pop ebx
ret
Function at 0x478120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x47814a
cmp dword [ebx + 0x64], 0
jne 0x47814a
cmp dword [ebx + 0x6c], 0
jne 0x47814a
mov edi, esi
jmp 0x4781d1
cmp edi, 0xffffffff
jne 0x478152
dec edi
jmp 0x4781d1
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4781d1
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0047751c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x47819f
mov cx, word [esp]
sub cx, si
jmp 0x4781a1
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x478188
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4781c7
mov cx, word [esp]
sub cx, si
jmp 0x4781c9
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4781b0
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x47822e
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.00477ebc
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x478219
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x47822e
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x47812a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47e484
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x56cbf0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x47e4a6
shr eax, 1
xor eax, 0xedb88320
jmp 0x47e4a8
shr eax, 1
dec edx
jne 0x47e494
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x47e48d
mov byte [0x56cff0], 1
pop esi
pop ebx
ret

Function at 0x47e4c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x56cff0], 0
jne 0x47e4db
call fcn.0047e484
mov eax, edi
dec eax
test eax, eax
jl 0x47e504
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x56cbf0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x47e4e5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x480a54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x480a85
dec al
je 0x480ac1
dec al
je 0x480b05
dec al
je 0x480b70
jmp 0x480bfa
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x480bfa
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x480a95
jmp 0x480bfa
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x480bfa
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x480ad1
jmp 0x480bfa
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x480bfa
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x480b33
xor ebp, ebp
jmp 0x480b44
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x480b4d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x480b15
jmp 0x480bfa
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x480bfa
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x480bc8
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0047e50c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x480b84
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e08ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4e08c9
add esp, 0xfffffff0
call fcn.00403d94
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4e0a65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004d70b8
test al, al
jne 0x4e0906
mov ecx, 0x4e0a98
mov dl, 1
mov eax, dword [0x4cb7b4]
call fcn.0040d068
call fcn.004042c0
xor eax, eax
push ebp
push 0x4e0932
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004d5b64
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004d5a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e0952
mov eax, dword [ebp - 0x10]
mov edx, 0x4e0ad4
call fcn.0040539c
je 0x4e096f
mov eax, esi
mov edx, 0x4e0ad4
call fcn.0040539c
jne 0x4e0993
mov eax, edi
mov edx, 0x4e0ae4
call fcn.0040539c
je 0x4e0993
mov ecx, 0x4e0abc
mov dl, 1
mov eax, dword [0x4cba5c]
call fcn.0040d068
call fcn.004042c0
mov eax, edi
xor edx, edx
call fcn.0040539c
jne 0x4e09c0
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.0040539c
je 0x4e09c0
mov ecx, 0x4e0abc
mov dl, 1
mov eax, dword [0x4cba5c]
call fcn.0040d068
call fcn.004042c0
mov eax, dword [ebp - 0x10]
mov edx, 0x4e0b24
call fcn.0040539c
jne 0x4e09f3
mov eax, edi
mov edx, 0x4e0b30
call fcn.0040539c
je 0x4e09f3
mov ecx, 0x4e0abc
mov dl, 1
mov eax, dword [0x4cba5c]
call fcn.0040d068
call fcn.004042c0
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004de99c
lea eax, [ebx + 4]
mov edx, esi
call fcn.004050b4
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004050b4
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004050b4
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004050b4
lea eax, [ebx + 8]
call fcn.00405078
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x4e0b7c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0a6c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405090
ret
Function at 0x4e2360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4e237d
add esp, 0xfffffff0
call fcn.00403d94
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4e2518
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004d70b8
test al, al
jne 0x4e23ba
mov ecx, 0x4e254c
mov dl, 1
mov eax, dword [0x4cb7b4]
call fcn.0040d068
call fcn.004042c0
xor eax, eax
push ebp
push 0x4e23e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004d5b64
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004d5a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2406
mov eax, edi
xor edx, edx
call fcn.0040539c
jne 0x4e2433
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.0040539c
je 0x4e2433
mov ecx, 0x4e2570
mov dl, 1
mov eax, dword [0x4cba5c]
call fcn.0040d068
call fcn.004042c0
mov eax, dword [ebp - 0x10]
mov edx, 0x4e2588
call fcn.0040539c
jne 0x4e2466
mov eax, edi
mov edx, 0x4e2594
call fcn.0040539c
je 0x4e2466
mov ecx, 0x4e2570
mov dl, 1
mov eax, dword [0x4cba5c]
call fcn.0040d068
call fcn.004042c0
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004de99c
lea eax, [ebx + 4]
mov edx, esi
call fcn.004050b4
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004050b4
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004050b4
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004050b4
lea eax, [ebx + 8]
call fcn.00405078
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x41b1c4]
call fcn.00403a38
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x41b1c4]
call fcn.00403a38
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x41b1c4]
call fcn.00403a38
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x4e25e0]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4ce7d8]
call fcn.004ddbf4
mov dword [ebx + 0x3c], eax
mov ax, word [0x4e25e4]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e251f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405090
ret
Function at 0x4e4f74
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4e4f96
add esp, 0xfffffff0
call fcn.00403d94
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4e5101
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004d70b8
test al, al
jne 0x4e4fd3
mov ecx, 0x4e5134
mov dl, 1
mov eax, dword [0x4cb7b4]
call fcn.0040d068
call fcn.004042c0
push dword [0x56ac60]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x56ac60]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405354
mov eax, dword [ebp - 0xc]
call fcn.004d7b90
test al, al
jne 0x4e50a5
push dword [0x56ac5c]
push dword [ebp + 8]
push dword [0x56ac5c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405354
mov eax, dword [ebp - 0x14]
call fcn.004d7b90
test al, al
jne 0x4e50a5
push dword [0x56ac60]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x56ac60]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405354
mov eax, dword [ebp - 0x18]
call fcn.004d7ca8
test al, al
jne 0x4e50a5
push dword [0x56ac5c]
push edi
push dword [0x56ac5c]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405354
mov eax, dword [ebp - 0x20]
call fcn.004d7ca8
test al, al
jne 0x4e50a5
mov ecx, 0x4e5134
mov dl, 1
mov eax, dword [0x4cb7b4]
call fcn.0040d068
call fcn.004042c0
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004de99c
lea eax, [ebx + 4]
mov edx, esi
call fcn.004050b4
lea eax, [ebx + 8]
call fcn.00405078
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.004050b4
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.004050b4
mov byte [ebx + 0xc], 0xc
mov ax, word [0x4e5150]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5108
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00405090
ret

Function at 0x519c04
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x519c7f
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x519c66
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404bb4
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00409348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519c86
lea eax, [ebp - 0x104]
call fcn.00404944
ret
Function at 0x526e94
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x526faa
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x526f70
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403298
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xc], 1
mov eax, esi
call fcn.00404e04
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffd
sub eax, 2
jb 0x526f39
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], 0xb
lea eax, [ebp - 0x44]
push eax
push 0
push 0
lea edx, [ebp - 0x48]
mov eax, dword [0x56b5ac]
call fcn.00406e94
mov ecx, dword [ebp - 0x48]
mov dl, 1
mov eax, dword [0x526424]
call fcn.00526af8
call fcn.004042c0
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x64], eax
movzx eax, word [ebp - 0x24]
mov dword [ebx + 0x60], eax
lea eax, [ebx + 0x58]
push eax
mov edx, dword [ebp - 0x2c]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0x28]
mov eax, esi
call fcn.00404e64
lea eax, [ebx + 0x5c]
push eax
mov edx, dword [ebp - 0x10]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404e64
jmp 0x526f8a
xor eax, eax
mov dword [ebx + 0x60], eax
lea eax, [ebx + 0x58]
call fcn.00404944
lea eax, [ebx + 0x5c]
call fcn.00404944
xor eax, eax
mov dword [ebx + 0x64], eax
lea eax, [ebx + 0x3c]
mov edx, esi
call fcn.00404998
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x526fb1
lea eax, [ebp - 0x48]
call fcn.00404944
ret
Function at 0x5271a8
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
test dl, dl
je 0x5272d3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39], 0
jne 0x52730a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00404c04
test eax, eax
jle 0x5271dd
mov ebx, 3
jmp 0x5271df
xor ebx, ebx
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x5271ef
call fcn.0040d048
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00404e04
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00404e04
push eax
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00404e04
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x70], esi
test esi, esi
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00526c9c
xor eax, eax
push ebp
push 0x5272ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
call fcn.00404e04
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.00404e04
push eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x60]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.00404e04
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
push eax
call sub.wininet.dll_InternetConnectA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], ebx
test ebx, ebx
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00526c9c
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52730a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
test eax, eax
je 0x5272e3
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x74], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
test eax, eax
je 0x5272fb
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x70], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x53c6d8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret