joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4727d2
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x11c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [edx], 0x30
xor eax, eax
pop ebx
add esp, 0xfc
ret
sub ebp, ecx
cmp dword [esp + 0x130], eax
je 0x472802
cmp ebp, eax
je 0x473175
movzx ecx, byte [edi]
cmp ecx, edx
jne 0x473198
cmp ebp, 0x20
jg 0x472026
mov dword [esp + 0x1c], eax
jmp 0x472883
mov esi, dword [esp + 0x12c]
mov edi, dword [esi + 0x28]
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x2c], eax
jle 0x472842
mov eax, dword [esp + 0x18]
push ebp
lea edx, [edi + 2]
push edx
push eax
call fcn.004863c1
add esp, 0xc
test eax, eax
jne 0x472831
cmp byte [edi + ebp + 2], al
je 0x472842
mov eax, dword [esp + 0x1c]
add edi, dword [esi + 0x30]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esi + 0x2c]
jl 0x472815
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esi + 0x2c]
jge 0x47285d
movzx edx, byte [edi]
movzx eax, byte [edi + 1]
shl edx, 8
or eax, edx
mov dword [esp + 0x1c], eax
jmp 0x472883
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
shr eax, 3
and eax, 1
push eax
push ebp
push ecx
push esi
call fcn.0046d680
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x4731bb
cmp dword [esp + 0x24], 0
je 0x472a39
mov eax, dword [esp + 0x11c]
mov dword [eax], 0x3e
mov eax, dword [esp + 0x118]
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xfc
ret
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x11c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [ecx], 0x2a
xor eax, eax
pop ebx
add esp, 0xfc
ret
mov eax, dword [esp + 0x11c]
mov dword [eax], 0xf
jmp 0x4731d7

Function at 0x473840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
jmp 0x473860
movzx eax, byte [edi]
movzx eax, byte [eax + 0x4b5d80]
movzx edx, byte [eax + edi]
add eax, edi
lea ecx, [edx - 4]
cmp ecx, 0x64
ja 0x4738b6
jmp 0x473880
movzx ecx, byte [ecx + 0x47396c]
jmp dword [ecx*4 + 0x47395c]
movzx ecx, byte [eax]
cmp ecx, 0x5e
je 0x473927
cmp ecx, 0x5f
jne 0x4738e2
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
mov edx, 1
cmp ecx, 0x20
jge 0x4738dc
shl edx, cl
push ebp
or edx, ebx
push edx
jmp 0x473929
cmp ecx, 0x58
je 0x473927
cmp ecx, 0x5d
je 0x473927
cmp ecx, 0x60
je 0x473927
cmp ecx, 0x39
je 0x47391b
cmp ecx, 0x3a
je 0x47391b
cmp ecx, 0x42
je 0x47391b
cmp ecx, 1
je 0x473937
cmp ecx, 2
je 0x473937
test byte [esi], 2
jne 0x473914
cmp ecx, 0x1a
je 0x473937
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp byte [eax + 1], 0xd
jne 0x473914
test ebp, ebx
jne 0x473914
jmp 0x473937
push ebp
push ebx
push esi
push eax
call fcn.00473840
add esp, 0x10
test eax, eax
je 0x473914
movzx eax, byte [edi + 1]
movzx ecx, byte [edi + 2]
shl eax, 8
or eax, ecx
add edi, eax
cmp byte [edi], 0x54
je 0x473860
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x473c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
or edi, 0xffffffff
movzx edx, byte [ebp + 3]
lea eax, [ebp + 3]
lea ecx, [edx - 4]
cmp ecx, 0x64
ja case.0x473c79.6
movzx ecx, byte [ecx + 0x473d60]
jmp dword [ecx*4 + 0x473d50]
movzx ecx, byte [eax + 1]
mov edx, dword [esi]
xor edx, ecx
test dl, 1
je 0x473c8f
mov dword [esi], ecx
add eax, 2
jmp 0x473cbf
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
add eax, ecx
cmp byte [eax], 0x54
je case.0x473c79.89
movzx ecx, byte [eax]
movzx edx, byte [ecx + 0x4b5d80]
add eax, edx
jmp 0x473cbf
movzx ecx, byte [edx + 0x4b5d80]
add eax, ecx
movzx edx, byte [eax]
lea ecx, [edx - 4]
cmp ecx, 0x64
jbe 0x473c72
movzx ecx, byte [eax]
lea edx, [ecx - 0x1c]
cmp edx, 0x44
ja case.0x473cdc.30
movzx edx, byte [edx + 0x473dd8]
jmp dword [edx*4 + 0x473dc8]
xor edx, edx
cmp ecx, 0x58
sete dl
push edx
push esi
push eax
call fcn.00473c50
add esp, 0xc
test eax, eax
js case.0x473cdc.30
test edi, edi
jns 0x473d22
mov edi, eax
jmp 0x473d26
add eax, 2
test ebx, ebx
je case.0x473cdc.30
test edi, edi
jns 0x473d1e
test byte [esi], 1
movzx edi, byte [eax + 1]
je 0x473d26
or edi, 0x100
jmp 0x473d26
movzx eax, byte [eax + 1]
cmp edi, eax
jne case.0x473cdc.30
movzx ecx, byte [ebp + 1]
movzx edx, byte [ebp + 2]
shl ecx, 8
or ecx, edx
add ebp, ecx
cmp byte [ebp], 0x54
je 0x473c63
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x473e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1088
call fcn.004932a0
mov eax, dword [esp + 0x1098]
mov edx, dword [esp + 0x109c]
mov ecx, dword [esp + 0x1094]
push ebx
mov ebx, dword [esp + 0x1090]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
mov edi, dword [esp + 0x10a0]
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
cmp eax, esi
jne 0x473e80
cmp ecx, esi
je 0x473e73
mov dword [ecx], 0x63
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
invalid
invalid
mov byte [eax], dl
Function at 0x4755e0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x144
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x15c]
mov ecx, dword [eax + 0x44]
push ebx
push ebp
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax]
push esi
push edi
cmp ecx, dword [eax + 4]
jae 0x47be4c
mov edi, dword [esp + 0x158]

Function at 0x475d39
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret

Function at 0x476688
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov dh, 0x2c
sbb al, byte [ebx - 0x1a7cf917]
aas
Function at 0x478496
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
movzx eax, byte [eax + 0x4b5e48]
and edx, dword [eax*4 + 0x4b5e2c]
lea ecx, [eax + eax*2]
add ecx, ecx
shl edx, cl
loop 0x478431
invalid
jle 0x4784c3
nop
movzx ebp, byte [edi]
sub ecx, 6
and ebp, 0x3f
shl ebp, cl
dec eax
inc edi
or edx, ebp
test eax, eax
jg 0x4784b0

Function at 0x4784aa
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
movzx eax, byte [eax + 0x4b5e48]
and edx, dword [eax*4 + 0x4b5e2c]
lea ecx, [eax + eax*2]
add ecx, ecx
shl edx, cl
loop 0x478431
invalid
jle 0x4784c3
nop
movzx ebp, byte [edi]
sub ecx, 6
and ebp, 0x3f
shl ebp, cl
dec eax
inc edi
or edx, ebp
test eax, eax
jg 0x4784b0

Function at 0x4796f3
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
dec ebx
add byte [ebx], ah
adc al, 0x85
sub al, 0x5e
dec ebx
add byte [ebp - 0x36fcbff4], cl

Function at 0x47abb0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
cmp eax, ecx
jbe 0x47abe4
mov edi, dword [edx + 0x6c]
add edi, eax
jmp 0x47b2dc

Function at 0x47abce
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0x17c]
inc ecx
mov dword [eax], ecx
cmp edx, dword [eax + 8]
jae 0x47be5e
test byte [esp + 0x178], 2
mov eax, dword [esp + 0x170]
mov dword [esp + 0x3c], eax
je 0x475656
mov ecx, dword [esp + 0x174]
lea edx, [esp + 0x68]
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ecx
mov dword [esp + 0x174], edx
mov eax, 1
mov dword [edx + 0x5c], eax
cmp dword [edx + 0x7c], eax
jg 0x47dab0
jmp 0x47b2dc

Function at 0x47ac41
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
adc ecx, dword [edi]
mov dh, 0x2c
cmp byte [ebx - 0x1a7cf917], al
aas

Function at 0x47bbd7
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
sbb byte [ecx + 0xf], ah
pushfd
ret

Function at 0x47bdae
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
je 0x47bdb1
add byte [eax], al
push eax
push ecx
add byte [eax + 0x51], dl
add edx, 3
push edx
push edi
call fcn.004755e0
add esp, 0x28
test eax, eax
jne 0x47f150
test esi, esi
jne 0x47c5bc
mov dword [esp + 0x15c], ebx
jmp 0x47be32
mov eax, dword [ebp + 0x44]
mov ecx, dword [ebp]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x16c]
cmp ecx, dword [ebp + 4]
jb 0x475614
inc dword [eax]
mov eax, 0xfffffff8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
mov edx, dword [esp + 0x17c]
invalid
invalid
Function at 0x47f670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x20]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, ecx
or ecx, 0xffffffff
add esi, edx
lea ebx, [esi - 1]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xec], ecx
xor ecx, ecx
test dword [ebp + 0x18], 0xe20f5a6f
mov dword [esp + 0xf4], ebx
mov dword [esp + 0x30], ecx
mov dword [esp + 0xf8], ecx
mov dword [esp + 0xf0], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov ebx, edi
mov dword [esp + 0xe8], edi
je 0x47f6e3
lea eax, [ecx - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, ecx
je 0x4802cf
cmp edx, ecx
je 0x4802cf
cmp dword [ebp + 0x1c], ecx
jne 0x47f700
cmp eax, ecx
jg 0x4802cf
cmp eax, ecx
jge 0x47f710
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + 0x18]
add eax, edi
mov dword [esp + 0x60], eax
movzx eax, word [edi + 0x1c]
mov dword [esp + 0x58], eax
movzx eax, word [edi + 0x1a]
mov dword [esp + 0x5c], eax
mov eax, dword [edi + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x3c], 0x989680
mov dword [esp + 0x40], 0x1770
mov dword [esp + 0xd0], ecx
cmp eax, ecx
je 0x47f7a6
mov eax, dword [eax]
test al, 1
je 0x47f765
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x18], ecx
xor ecx, ecx
test al, 2
je 0x47f775
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x3c], ecx
xor ecx, ecx
test al, 0x10
je 0x47f785
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x40], ecx
xor ecx, ecx
test al, 4
je 0x47f798
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0xd0], ecx
add byte [eax], al
mov eax, 0xfffffffe
Function at 0x480e10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x290]
call fcn.004812e6
push 0
push dword [esi + 8]
push dword [esi]
call fcn.00485bf7
add esp, 0xc
lea eax, [ebp - 0x398]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.004810f2
test eax, eax
je 0x480e54
push 6
jmp 0x480ee3
push dword [esi]
lea eax, [ebp - 1]
push 1
pop ebx
push ebx
push ebx
push eax
call fcn.00485b50
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00485b50
push dword [esi]
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
xor edi, 0x45aa
push ebx
push 4
push eax
call fcn.00485b50
mov eax, dword [ebp - 8]
push dword [esi]
xor eax, 0x45aa
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00485b50
add esp, 0x40
lea eax, [ebp - 0x18]
push dword [esi]
push ebx
push 4
push eax
call fcn.00485b50
push dword [esi]
lea eax, [ebp - 0x1c]
push ebx
push 4
push eax
call fcn.00485b50
push dword [esi]
lea eax, [ebp - 0x20]
push ebx
push 4
push eax
call fcn.00485b50
push dword [ebp - 0xc]
call fcn.00481e64
add esp, 0x34
mov dword [ebp + 8], eax
test eax, eax
jne 0x480ee9
push 8
pop eax
jmp 0x480fc0
push edi
call fcn.00481e64
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x480eff
push 8
pop esi
jmp 0x480fb5
push dword [esi]
push ebx
push edi
push eax
call fcn.00485b50
mov eax, dword [esi + 0x110]
add esp, 0x10
add eax, 0x22af
mov ecx, esi
push eax
push edi
mov edi, dword [ebp - 0x10]
push edi
call fcn.00480de2
cmp byte [ebp - 1], bl
jne 0x480f63
lea ecx, [ebp - 0x290]
call fcn.004812e6
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], eax
call fcn.00481312
push edi
call fcn.004833c5
pop ecx
jmp 0x480f6f
push dword [ebp + 8]
call fcn.004833c5
pop ecx
mov dword [ebp + 8], edi
push 0x4bc014
push dword [ebp + 0xc]
call fcn.00485dc7
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x480f8b
push 7
jmp 0x480ef9
push edi
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00484e01
push edi
call fcn.00484ee8
add esp, 0x14
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.0048123e
xor esi, esi
push dword [ebp + 8]
call fcn.004833c5
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x480fc7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
push esi
mov esi, ecx
lea ecx, [ebp - 0x278]
call fcn.004812e6
push 0
push dword [esi + 8]
push dword [esi]
call fcn.00485bf7
add esp, 0xc
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.004810f2
test eax, eax
je 0x48100a
push 6
pop eax
jmp 0x4810ed
push ebx
push edi
push dword [esi]
lea eax, [ebp - 1]
push 1
pop ebx
push ebx
push ebx
push eax
call fcn.00485b50
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00485b50
push dword [esi]
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
xor edi, 0x45aa
push ebx
push 4
push eax
call fcn.00485b50
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
xor eax, 0x45aa
push ebx
push 0x10
mov dword [ecx], eax
push dword [esi]
call fcn.00485bf7
mov eax, dword [ebp + 0x10]
push dword [eax]
call fcn.00481e64
add esp, 0x40
mov dword [ebp + 0x10], eax
push edi
call fcn.00481e64
push dword [esi]
mov dword [ebp + 8], eax
push ebx
push edi
push eax
call fcn.00485b50
mov eax, dword [esi + 0x110]
add esp, 0x14
add eax, 0x22af
mov ecx, esi
push eax
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00480de2
cmp byte [ebp - 1], bl
jne 0x4810d5
lea ecx, [ebp - 0x278]
call fcn.004812e6
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x278], eax
call fcn.00481312
push edi
call fcn.004833c5
pop ecx
jmp 0x4810e1
push dword [ebp + 0x10]
call fcn.004833c5
pop ecx
mov dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
pop edi
pop ebx
mov dword [eax], ecx
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x4810f2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call fcn.00485b50
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.00480de2
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push str.FILE
push eax
call fcn.00485de0
pop ecx
test eax, eax
pop ecx
jne 0x481223
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00485b50
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call fcn.00485b50
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00480de2
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00485b50
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call fcn.00485b50
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.00480de2
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.00485de0
pop ecx
test eax, eax
pop ecx
je 0x48123a
push ebx
push ebx
push dword [esi]
call fcn.00485bf7
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00485b50
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call fcn.00485bf7
push ebx
push 0x10
push dword [esi]
call fcn.00485bf7
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.00485bf7
add esp, 0x40
jmp 0x481227
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x481106
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x481233

Function at 0x48127e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x4812a7
add edx, edx
xor edx, 0x4c11db7
jmp 0x4812a9
shl edx, 1
dec ecx
jne 0x481295
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x48128d
pop edi
pop esi
ret

Function at 0x481431
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x481456
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00485e70
add esp, 0xc
jmp 0x481469
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.00485b50
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push str.JB01
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.00485de0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4
Function at 0x4877f3
Capabilities:
Write file on windows

Disassembly:
dec ecx
add byte [ebx + 0x74f33bf0], cl
inc esi
cmp esi, 0xffffffff
je 0x487841
xor eax, eax
mov cl, byte [edi + eax*2]
mov byte [ebp + eax - 0x1f8], cl
cmp word [edi + eax*2], bx
je 0x48781a
inc eax
cmp eax, 0x1f4
jb 0x487802
push ebx
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebp - 5], bl
call fcn.00485c80
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489ba6
leave
ret

Function at 0x487d4d
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x88], eax
jne 0x487e51
and dword [ebp - 0x8c], 0
push 0x80
lea ebx, [ebp - 0x84]
mov ecx, ebx
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call fcn.0049055f
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x487dee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x487e0f
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x88]
call fcn.0049055f
add esp, 0x14
mov dword [ebp - 0x90], eax
test eax, eax
je 0x487e0f
inc esi
push esi
push eax
call fcn.004890b4
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x487e0f
push dword [ebp - 0x90]
mov dword [ebp - 0x8c], esi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x88]
call fcn.0049055f
mov esi, eax
add esp, 0x14
test esi, esi
je 0x487e08
push 1
push esi
call fcn.004890b4
mov dword [edi], eax
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
jne 0x487e21
cmp dword [ebp - 0x8c], edi
je 0x487e0f
push ebx
call fcn.004833c5
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489ba6
leave
ret
lea ecx, [esi - 1]
push ecx
push ebx
push esi
push eax
call fcn.0048ba06
add esp, 0x10
test eax, eax
jne 0x487e47
cmp dword [ebp - 0x8c], edi
je 0x487e43
push ebx
call fcn.004833c5
pop ecx
xor eax, eax
jmp 0x487e12
push edi
push edi
push edi
push edi
push edi
call fcn.0048758e
cmp dword [ebp + 0xc], 2
jne 0x487e9f
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
push eax
push eax
push dword [ebp + 0x14]
mov dword [edi], eax
push dword [ebp + 0x10]
call esi
mov ebx, eax
test ebx, ebx
je 0x487e8f
push 2
push ebx
call fcn.004890b4
pop ecx
pop ecx
mov dword [edi], eax
test eax, eax
je 0x487e8f
push ebx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call esi
test eax, eax
jne 0x487e43
push dword [edi]
call fcn.004833c5
and dword [edi], 0
pop ecx
jmp 0x487e0f
cmp dword [ebp + 0xc], 0
jne 0x487e0f
and dword [ebp - 0x88], 0
push 2
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp + 0x14]
or eax, 0x20000000
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x487e0f
mov al, byte [ebp - 0x88]
mov byte [edi], al
jmp 0x487e43

Function at 0x489ba6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bcda0]
jne 0x489bb0
repz ret
jmp fcn.00492023
Function at 0x48e52d
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax], al
add byte [ecx + 0x4bcda0], ah
xor eax, esp
mov dword [esp + 8], eax
mov dword fs:[0], esp
Function at 0x48ea58
Capabilities:
Write file on windows

Disassembly:
mov ecx, ebx
xor esi, esi
sub ecx, dword [ebp - 0x1acc]
lea eax, [ebp - 0x1ab8]
cmp ecx, dword [ebp + 0x10]
jae 0x48ea4c
mov dl, byte [ebx]
inc ebx
inc ecx
mov dword [ebp - 0x1ae0], ebx
cmp dl, 0xa
jne 0x48ea40
inc dword [ebp - 0x1ad0]
mov byte [eax], 0xd
inc eax
inc esi
mov byte [eax], dl
inc eax
inc esi
cmp esi, 0x13ff
jb 0x48ea21
mov esi, eax
lea eax, [ebp - 0x1ab8]
sub esi, eax
push 0
lea eax, [ebp - 0x1ad8]
push eax
push esi
lea eax, [ebp - 0x1ab8]
push eax
mov eax, dword [ebp - 0x1adc]
mov eax, dword [eax]
push dword [edi + eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48ecc3
mov eax, dword [ebp - 0x1ad8]
add dword [ebp - 0x1ac8], eax
cmp eax, esi
jl 0x48eccf
mov eax, ebx
sub eax, dword [ebp - 0x1acc]
cmp eax, dword [ebp + 0x10]
jb 0x48ea11
jmp 0x48eccf

Function at 0x490265
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bcda0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00486f42
and dword [ebp - 0x14], 0
cmp dword [0x4bf4a4], 0
mov dword [ebp - 0x18], eax
jne 0x490318
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4903c0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49b818
push ebx
call edi
test eax, eax
je 0x4903c0
mov esi, dword [fcn.00480be0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4bf4a4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4bf4a8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4bf4ac], eax
call edi
push eax
call esi
mov dword [0x4bf4b4], eax
test eax, eax
je 0x490318
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4bf4b0], eax
mov eax, dword [0x4bf4b0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00480be4]
cmp eax, ecx
je 0x490371
cmp dword [0x4bf4b4], ecx
je 0x490371
push eax
call esi
push dword [0x4bf4b4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x490371
test ebx, ebx
je 0x490371
call edi
test eax, eax
je 0x490368
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x490368
test byte [ebp - 8], 1
jne 0x490371
or dword [ebp + 0x10], 0x200000
jmp 0x4903a4
mov eax, dword [0x4bf4a8]
cmp eax, dword [ebp - 0x18]
je 0x4903a4
push eax
call esi
test eax, eax
je 0x4903a4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4903a4
mov eax, dword [0x4bf4ac]
cmp eax, dword [ebp - 0x18]
je 0x4903a4
push eax
call esi
test eax, eax
je 0x4903a4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4bf4a4]
call esi
test eax, eax
je 0x4903c0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4903c2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489ba6
leave
ret