joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c6629
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5c664b
cmp dword [edi + 0x3c], 0
jne 0x5c664b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005dbae6
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005c6678
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c66c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.005dbae6
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5c66f7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.005c670a
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c7d23
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5c7d5b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005c5686
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005c565e
jmp 0x5c7d67
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5c98b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5c98fa
call fcn.005dbae6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5c98fa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5c98f1
xor eax, eax
jmp 0x5c9902
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005c9908
pop edi
pop esi
pop ebx
ret 4

Function at 0x5da29d
Capabilities:
Create http request

Disassembly:
mov eax, 0x5feac0
call fcn.004b0d40
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x5da2d5
call fcn.005dbae6
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x5da2fa
push eax
push dword [esi + 4]
call fcn.005db12c
jmp 0x5da306
push esi
push eax
mov ecx, 0x1c7ab50
call fcn.005da317
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x5da613
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x5fe9d7
call fcn.004b0d40
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005cc261
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x1c1de58]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.005c5368
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.005c5368
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x5dc016
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5dc044
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5dc062
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005dbf7c
jmp 0x5dc062
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5dc062
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005dbf7c
test edi, edi
mov eax, edi
jne 0x5dc04c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1006908
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x1006945
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1006922
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1006961
dec esi
je 0x100695a
dec esi
jne 0x1006966
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x531901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x531941
mov cl, byte [ebp + 0x14]
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
mov byte [edx + eax], cl
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x531913
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x531947
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x531984
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
xor cl, byte [ebp + 0x14]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x531959
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2e502a5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1a6e7eec
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret

Function at 0x40b500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xe60
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0xe5c], eax
push ebx
xor ebx, ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
cmp byte [edi + 0x734], bl
jne 0x40b542
test dword [edi + 0x328], 0xfffffffc
je 0x40b542
lea eax, [edi + 0x318]
push ecx
call fcn.00404cb0
jmp 0x40b70a
lea eax, [esp + 0x842]
push eax
lea ecx, [esp + 0x745]
push ecx
lea edx, [esp + 0x648]
push edx
lea eax, [esp + 0x648]
push eax
push str.runtime_flux.preset.json
mov dword [esp + 0x958], ebx
mov byte [esp + 0x448], bl
mov byte [esp + 0x650], bl
mov byte [esp + 0x654], bl
mov byte [esp + 0x755], bl
mov byte [esp + 0x856], bl
call fcn.004a00bc
add esp, 0x14
lea ecx, [esp + 0x434]
push ebx
push ecx
call fcn.00447600
add esp, 8
lea ecx, [esp + 0x94c]
call fcn.004016b0
lea edx, [esp + 0x94c]
push edx
mov ecx, str.https:__justgetflux.com_windows_preset.json
call fcn.004321f0
lea eax, [esp + 0xd5a]
push eax
lea ecx, [esp + 0xc5d]
push ecx
lea edx, [esp + 0xb60]
push edx
lea eax, [esp + 0xb60]
push eax
lea ecx, [esp + 0x95c]
push 0x208
push ecx
call fcn.004a0108
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x18
lea edx, [esp + 0x94c]
push edx
call esi
cmp eax, 0xffffffff
je 0x40b626
lea eax, [esp + 0x434]
push eax
lea eax, [esp + 0x950]
call fcn.00401700
lea ecx, [esp + 0x842]
push ecx
lea edx, [esp + 0x745]
push edx
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x648]
push ecx
lea edx, [esp + 0x444]
push 0x208
push edx
call fcn.004a0108
add esp, 0x18
lea eax, [esp + 0x434]
push eax
call esi
cmp eax, 0xffffffff
jne 0x40b69d
lea ecx, [esp + 0x94c]
call fcn.00403870
lea ecx, [esp + 0x434]
call fcn.00403870
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe5c]
xor ecx, esp
call fcn.0049ca20
add esp, 0xe60
ret
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x438]
mov dword [esp + 0x14], ebx
call fcn.00454de0
add esp, 4
lea edx, [esp + 0x10]
push edx
lea esi, [esp + 0x1c]
lea ebp, [edi + 0x318]
call fcn.00403e50
push ebp
call fcn.00404cb0
mov eax, esi
push eax
call fcn.00404120
mov ecx, dword [esp + 0x14]
push ecx
mov eax, ebp
call fcn.00404cb0
lea ecx, [esp + 0x10]
mov byte [edi + 0x734], bl
call fcn.00401420
lea ecx, [esp + 0x94c]
call fcn.00403870
lea ecx, [esp + 0x434]
call fcn.00403870
mov ecx, dword [esp + 0xe68]
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0049ca20
add esp, 0xe60
ret
Function at 0x410f43
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 0x300], 0
je 0x410f65
mov eax, dword [esi + 0xf08]
push eax
call fcn.004052e0
test al, al
jne 0x410f65
push esi
call fcn.0041a810
movsd xmm0, qword [esp + 0x14]
comisd xmm0, xmmword [esi + 0x2f8]
jbe 0x41106c
push edi
call fcn.0044a7c0
fmul qword [0x4d34f0]
fnstcw word [esp + 0xa]
movzx eax, word [esp + 0xa]
or eax, 0xc00
mov dword [esp + 0xc], eax
fldcw word [esp + 0xc]
fistp qword [esp + 0xc]
mov ecx, dword [esp + 0xc]
push ecx
fldcw word [esp + 0xe]
call fcn.0049d0e9
add esp, 4
call fcn.0049d0fb
mov edx, dword [esi + 0xf08]
add eax, 0x3f8000
shl eax, 8
mov dword [esp + 0xc], eax
movss xmm0, dword [esp + 0xc]
cvtps2pd xmm0, xmm0
subsd xmm0, qword [0x4bab50]
cvtpd2ps xmm0, xmm0
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x4c88e8]
addsd xmm0, qword [0x4d33a8]
mulsd xmm0, qword [0x4c8938]
addsd xmm0, qword [esp + 0x18]
movsd qword [esi + 0x2f8], xmm0
cmp byte [edx + 0xf0e], 0
je 0x411022
lea eax, [esi + 0x73c]
push eax
mov edx, str.matrix1
call 0x403000
jmp 0x41103a
lea ecx, [esp + 0x18]
push ecx
lea edi, [esi + 0x770]
mov dword [esp + 0x1c], 0
call fcn.00401250
add esi, 0x73c
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x43cce0
call fcn.0049d7be
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 8
Function at 0x412610
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push 0x2c
lea ecx, [esp + 0x28]
push ecx
push edi
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov ecx, dword [esp + 0x4c]
xor eax, eax
xor ebx, ebx
cmp eax, dword [esi + 0x1b84]
jb 0x41265f
ja 0x412653
cmp ecx, dword [esi + 0x1b80]
jbe 0x41265f
mov dword [esi + 0x1b80], ecx
mov dword [esi + 0x1b84], eax
mov edx, dword [esp + 0x18]
cmp edx, dword [esi + 0x1b88]
jbe 0x412671
mov dword [esi + 0x1b88], edx
mov dword [esi + 0x1b70], ecx
mov dword [esi + 0x1b74], eax
mov dword [esi + 0x1b78], edx
cmp eax, ebx
ja 0x41269d
jb 0x412691
cmp ecx, 0x8000000
ja 0x41269d
cmp edx, 0x800
jbe 0x41278a
call fcn.0044a7c0
fld qword [0x4d3c28]
fcompi st(1)
fstp st(0)
jbe 0x4126b8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x48
ret
push 0x2d
push str.https:__justgetflux.com_windows_watchdog.html
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
call fcn.0043c200
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0x73c]
push ecx
call fcn.00431a80
mov eax, dword [eax]
cmp eax, ebx
je 0x4126eb
add eax, 4
jmp 0x4126ed
xor eax, eax
push eax
lea eax, [esp + 0x14]
call fcn.0043c000
lea ecx, [esp + 0x14]
call fcn.00401420
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.00460d10
mov eax, 0x561880
mov dword [esp + 0x14], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412721
sub eax, edx
push eax
push 0x561880
lea edx, [esp + 0x1c]
push edx
call fcn.0043c200
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x412747
add eax, 4
jmp 0x412749
xor eax, eax
push 5
push ebx
push str._crash
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, esi
call fcn.00416640
lea ecx, [esp + 0x14]
call fcn.00401420
cmp dword [esp + 0x1c], ebx
je 0x412781
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x412781
call fcn.0045f130
lea ecx, [esp + 0x10]
call fcn.00401420
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x48
ret
Function at 0x419410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xfc]
push edi
mov ebx, ecx
cmp eax, 6
je 0x419431
cmp eax, 7
jne 0x419456
mov ecx, dword [ebx + 0x58]
test ecx, ecx
je 0x41943d
add ecx, 4
jmp 0x41943f
xor ecx, ecx
cmp eax, 7
sete al
movzx edx, al
push edx
push ecx
lea eax, [ebx - 0xfc]
push eax
call fcn.0041b2e0
cmp dword [esi + 0xfc], 2
jne 0x419463
mov byte [ebx + 0x12], 0
cmp dword [esi + 0xfc], 9
jne 0x419476
push 0
call fcn.0041cd90
add esp, 4
cmp dword [esi + 0xfc], 0xa
jne 0x4194c9
lea ecx, [esp + 0xc]
push ecx
mov eax, 1
push str.Preferences
lea edx, [esp + 0x1c]
push edx
mov ecx, str.autorun
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call fcn.0041e5f0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 1
call fcn.004027a0
lea edi, [esp + 0x14]
call fcn.00402a90
mov eax, dword [esi + 0xfc]
test eax, eax
je 0x4194d8
cmp eax, 5
jne 0x4194e6
lea esi, [ebx - 0xfc]
call fcn.00419c50
mov esi, dword [ebp + 8]
cmp dword [esi + 0xfc], 8
jne 0x419566
mov ebx, dword [ebx + 0x54]
test ebx, ebx
je 0x4194fb
add ebx, 4
jmp 0x4194fd
xor ebx, ebx
push 4
push str.http
push ebx
call fcn.0049ca2f
add esp, 0xc
test eax, eax
jne 0x419566
push 0x566aa8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, 0x30
call fcn.0045eff0
mov esi, eax
test esi, esi
je 0x419539
push 0
mov eax, ebx
call fcn.004482f0
mov esi, eax
jmp 0x41953b
xor esi, esi
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x43cce0
call fcn.0049d7be
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419b10
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x84
push esi
push edi
mov esi, eax
lea eax, [esp + 0xc]
push eax
push str.Preferences
lea ecx, [esp + 0x6c]
push ecx
mov ecx, str.Latitude
mov dword [esp + 0x18], 0xe10
call fcn.0041e5f0
lea edx, [esp + 0xc]
push edx
push str.Preferences
lea eax, [esp + 0x48]
xor edi, edi
push eax
mov ecx, str.Longitude
mov dword [esp + 0x8c], edi
mov byte [esp + 0x90], 1
mov dword [esp + 0x18], edi
call fcn.0041e5f0
lea ecx, [esp + 0xc]
push ecx
push str.Preferences
lea edx, [esp + 0x24]
push edx
mov ecx, str.ZipCode
mov dword [esp + 0x68], edi
mov byte [esp + 0x6c], 1
mov dword [esp + 0x18], edi
call fcn.0041e5f0
fld dword [esi + 0x140]
fmul qword [0x4d3508]
lea ecx, [esp + 0x10]
fnstcw word [esp + 0xc]
movzx eax, word [esp + 0xc]
or eax, 0xc00
mov dword [esp + 0x10], eax
push ecx
fldcw word [esp + 0x14]
mov dword [esp + 0x3c], edi
mov byte [esp + 0x40], 1
fistp qword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x68]
fldcw word [esp + 0x10]
call fcn.004027a0
fld dword [esi + 0x144]
fmul qword [0x4d3508]
fnstcw word [esp + 0xc]
movzx eax, word [esp + 0xc]
or eax, 0xc00
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
fldcw word [esp + 0x10]
push eax
lea eax, [esp + 0x44]
fistp qword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x14], edx
fldcw word [esp + 0x10]
call fcn.004027a0
add esi, 0x13c
push esi
lea eax, [esp + 0x20]
call fcn.004027a0
lea edi, [esp + 0x1c]
call fcn.00402a90
lea edi, [esp + 0x40]
call fcn.00402a90
lea edi, [esp + 0x64]
call fcn.00402a90
pop edi
xor eax, eax
pop esi
add esp, 0x84
ret
Function at 0x41b2e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
lea ebp, [edi + 0x7f0]
push eax
mov ecx, ebp
mov dword [esp + 0x1c], 0
mov ebx, 1
call fcn.00403250
mov eax, dword [eax]
test eax, eax
je 0x41b340
add eax, 4
je 0x41b340
cmp byte [eax], 0
je 0x41b340
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
mov ebx, 3
call fcn.00403250
mov ecx, eax
mov eax, 0x4ccf34
call fcn.00401310
mov byte [esp + 0x13], 0
test al, al
je 0x41b345
mov byte [esp + 0x13], 1
test bl, 2
je 0x41b388
mov eax, dword [esp + 0x14]
and ebx, 0xfffffffd
test eax, eax
je 0x41b388
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x41b373
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x41b380
test eax, eax
jne 0x41b380
mov esi, dword [esp + 0x14]
call fcn.0045f130
mov dword [esp + 0x14], 0
test bl, 1
je 0x41b3c0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41b3c0
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x41b3b3
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x41b3c0
test eax, eax
jne 0x41b3c0
mov esi, dword [esp + 0x18]
call fcn.0045f130
cmp byte [esp + 0x13], 0
je 0x41b4e9
mov ebx, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x14], esi
test ebx, ebx
je 0x41b416
mov eax, ebx
mov dword [esp + 0x30], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b3e2
sub eax, edx
push eax
push ebx
lea edx, [esp + 0x38]
push edx
call fcn.0043c200
lea eax, [esp + 0x30]
push eax
lea edi, [esp + 0x18]
call fcn.00401250
lea ecx, [esp + 0x30]
call fcn.00401420
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x2c]
movss xmm0, dword [edi + 0x140]
mov cl, byte [esp + 0x34]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
movss xmm0, dword [edi + 0x144]
lea edx, [esp + 0x14]
cvtps2pd xmm0, xmm0
push edx
lea edi, [ebp + 0x8c]
movsd qword [esp + 0x24], xmm0
mov byte [ebp + 0xa0], cl
call fcn.00401250
movsd xmm0, qword [esp + 0x18]
mov edi, dword [esp + 0x2c]
movsd qword [ebp + 0x90], xmm0
movsd xmm0, qword [esp + 0x20]
movsd qword [ebp + 0x98], xmm0
mov byte [ebp + 0xa2], 1
add edi, 0x788
lea ebp, [edi + 0x10]
push ebp
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
push 0
push 0x43cce0
call fcn.0049d7be
add esp, 0xc
push ebp
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x41b508
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x41b4d4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
test eax, eax
jne 0x41b508
call fcn.0045f130
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
cmp byte [edi + 0xb18], 0
je 0x41b508
lea eax, [edi + 0x100]
push eax
add edi, 0xb14
push edi
call fcn.00421a80
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0xc
Function at 0x41cd90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
call fcn.00448b00
test al, al
jne 0x41cf51
call fcn.004276a0
test al, al
je 0x41cdbf
call fcn.00427b50
test al, al
je 0x41cf2e
call fcn.004489f0
test al, al
je 0x41cde7
call fcn.00448940
test al, al
jne 0x41cde7
push 0
push str._unlockwingamma
call fcn.004481b0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
push 0xf003f
xor eax, eax
xor ebx, ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICM_
mov dword [esp + 0x28], eax
push reloc.WSOCK32.dll_bind
lea eax, [esp + 0x34]
push eax
mov edx, str.GdiICMGammaRange
mov dword [esp + 0x20], 0x100
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
call fcn.00455250
push 0xf013f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICM_
push reloc.WSOCK32.dll_bind
lea ecx, [esp + 0x24]
push ecx
mov edx, str.GdiICMGammaRange
mov esi, eax
call fcn.00455250
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x41ce6c
add eax, 4
jmp 0x41ce6e
xor eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push ebx
push eax
mov eax, dword [esp + 0x3c]
push eax
call edi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x41ce93
add eax, 4
jmp 0x41ce95
xor eax, eax
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push ebx
push eax
push edx
call edi
call fcn.00427cb0
cmp byte [ebp + 8], bl
je 0x41cecc
lea edi, [esp + 0x18]
call fcn.004551d0
lea edi, [esp + 0x28]
call fcn.004551d0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], 0x70
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x50], ebx
mov byte [esp + 0x54], 1
mov dword [esp + 0x3c], vtable.RebootDlg.0
mov byte [esp + 0x58], bl
call fcn.0046ed00
cmp byte [esp + 0x54], bl
je 0x41cf0a
call fcn.004274f0
cmp esi, ebx
jne 0x41cf37
cmp dword [esp + 0x14], ebx
jne 0x41cf37
lea edi, [esp + 0x18]
mov dword [esp + 0x38], vtable.ytBaseDialog.0
call fcn.004551d0
lea edi, [esp + 0x28]
call fcn.004551d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [esp + 0x18]
mov dword [esp + 0x38], vtable.ytBaseDialog.0
call fcn.004551d0
lea edi, [esp + 0x28]
call fcn.004551d0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret