joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446c30
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x446c4c
cmp dword [esi + 4], 0
je 0x446c79
test byte [ebx + 0x55], 1
jne 0x446c6b
mov eax, ebx
call fcn.0044583c
test eax, eax
jne 0x446c6b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x446d89
mov edx, esi
mov eax, ebx
call fcn.00446754
jmp 0x446d89
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x446d82
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00448aa0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00443544
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00446c30
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00448aa0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446d89
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d1e8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x48d7bc]
cmp byte [eax + 0xc], 0
je 0x44d355
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d34e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48eb94], 0
jne 0x44d23c
push 0x44d35c
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x44d364
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eb94], eax
cmp dword [0x48cce8], 0
jne 0x44d337
push 0x44d374
call sub.kernel32.dll_LoadLibraryA
mov dword [0x48cce8], eax
cmp dword [0x48cce8], 0
je 0x44d337
push 0x44d380
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eb98], eax
push 0x44d390
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eb9c], eax
push 0x44d3a4
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eba0], eax
push 0x44d3bc
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eba4], eax
push 0x44d3d4
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eba8], eax
push 0x44d3e8
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ebac], eax
push 0x44d400
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ebb0], eax
push 0x44d418
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ebb4], eax
push 0x44d434
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ebb8], eax
push 0x44d440
mov eax, dword [0x48cce8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ebbc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d355
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44e868
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040453c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44e8b7
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004047ac
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469d50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x469da1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x469d88
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x469d78
jmp 0x469da1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x469d89
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484660
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, ecx
mov ebp, edx
mov ebx, eax
test esi, esi
jg 0x48467b
xor eax, eax
mov dword [esp], eax
jmp 0x48470d
mov eax, dword [ebx + 0x88]
mov eax, dword [eax + 0x4c]
cmp eax, esi
jae 0x48468a
mov esi, eax
cmp byte [ebx + 0x54], 0
jne 0x48469c
cmp byte [ebx + 0x4c], 0
jne 0x48469c
cmp dword [ebx + 0x5c], 0
jle 0x4846d6
mov eax, dword [ebx + 0x88]
mov edi, dword [eax + 0x54]
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 4]
lea eax, [edx + eax]
mov edx, ebp
mov ecx, esi
call fcn.00402d90
add dword [edi + 0xc], esi
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
jl 0x4846d1
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x14], eax
mov dword [esp], esi
jmp 0x484701
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x14
call fcn.00403070
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push esi
push ebp
mov eax, dword [ebx + 0x88]
mov eax, dword [eax + 0x58]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [ebx + 0x88]
mov edx, dword [esp]
sub dword [eax + 0x4c], edx
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x484a00
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov ebx, eax
mov eax, dword [ebx + 0x54]
mov ecx, dword [eax + 8]
sub ecx, dword [eax + 0x10]
mov edx, dword [ebx + 0x50]
cmp ecx, edx
jae 0x484a1e
call fcn.00483b7c
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x14
call fcn.00403070
lea edx, [esp + 4]
push edx
lea edx, [esp + 4]
push edx
mov edx, dword [ebx + 0x50]
push edx
mov eax, dword [ebx + 0x54]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 4]
add eax, edx
push eax
mov eax, dword [ebx + 0x58]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [ebx + 0x54]
mov edx, dword [esp]
add dword [eax + 0x10], edx
mov eax, dword [esp]
sub dword [ebx + 0x50], eax
mov eax, dword [ebx + 0x44]
cmp dword [eax + 0x5c], 0
jle 0x484a8f
mov eax, dword [ebx + 0x54]
mov edx, dword [eax + 0x10]
sub edx, dword [eax + 0xc]
mov dword [ebx + 0x4c], edx
push 0
push 0
push 0x408
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x40]
push eax
call sub.user32.dll_PostMessageA
jmp 0x484b64
mov eax, dword [ebx + 0x44]
cmp word [eax + 0x92], 0
je 0x484b64
cmp byte [eax + 0x54], 0
je 0x484b51
jmp 0x484b1b
mov ebp, dword [ebx + 0x54]
mov edx, dword [ebp + 4]
add edx, dword [ebp + 0x14]
mov eax, ebx
call fcn.004849bc
test al, al
je 0x484b15
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x58]
call fcn.004047fc
mov edx, dword [ebx + 0x54]
add dword [edx + 0x14], eax
mov esi, dword [ebx + 0x54]
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
mov dword [ebx + 0x4c], eax
push 0
push 0
push 0x403
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x40]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebx + 0x44]
cmp word [eax + 0x92], 0
je 0x484b64
cmp dword [ebx + 0x4c], 0
jne 0x484ad1
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0xc]
mov edx, dword [ebx + 0x54]
cmp eax, dword [edx + 0x10]
je 0x484b64
jmp 0x484b1b
mov eax, dword [ebx + 0x54]
inc dword [eax + 0x14]
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x58]
call fcn.004047fc
mov edi, dword [ebx + 0x54]
mov edx, dword [edi + 0x10]
sub edx, dword [edi + 0x14]
cmp eax, edx
jle 0x484aac
jmp 0x484b64
mov dword [ebx + 0x4c], edi
push 0
push 0
push 0x403
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x40]
push eax
call sub.user32.dll_SendMessageA
mov esi, dword [ebx + 0x54]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov edx, dword [ebx + 0x44]
mov edi, dword [edx + 0x48]
cmp eax, edi
jge 0x484b39
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48586c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
mov esi, edx
mov ebx, eax
test cl, cl
je 0x485903
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403070
mov dword [ebp - 0x3c], 0x3c
mov eax, ebx
call fcn.004049fc
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.004049fc
mov dword [ebp - 0x28], eax
mov eax, dword [0x48f054]
call fcn.004049fc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x40
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x485929
cmp dword [ebp + 8], 0
je 0x4858e0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp dword [ebp + 8], 0
je 0x4858f8
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x485929
push 1
mov eax, dword [0x48f054]
call fcn.004049fc
push eax
mov eax, esi
call fcn.004049fc
push eax
mov eax, ebx
call fcn.004049fc
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4863c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x486459
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
push eax
push 0
push 0x486468
mov eax, ebx
call fcn.004049fc
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x4863e9
mov edx, esi
lea eax, [ebp - 0x109]
call fcn.004094b4
test edi, edi
je 0x486443
mov edx, dword [esi]
lea eax, [ebp - 4]
mov ecx, edi
call fcn.00404848
mov eax, dword [ebp - 4]
call fcn.00408e78
call fcn.00408f34
mov eax, dword [esi]
call fcn.00408fb4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486460
lea eax, [ebp - 4]
call fcn.0040453c
ret
Function at 0x4197f0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x68b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x25c], ecx
cmp dword [ebp + 8], 0
je 0x41990d
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x41990d
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.engine.dll_void___cdecl_g_GetFullPath_char___unsigned_int__char_const__]
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCR80.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0x258], eax
push 0x63bfa0
lea edx, [ebp - 0x110]
push edx
call sub.MSVCR80.dll_strcat
add esp, 8
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4198ea
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x258]
lea ecx, [ebp + eax - 0x110]
push ecx
call sub.MSVCR80.dll_strcpy
add esp, 8
push 0x80
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419889
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x41990d
mov edx, dword [ebp - 0x258]
mov byte [ebp + edx - 0x111], 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612c78
mov esp, ebp
pop ebp
ret 8

Function at 0x41baa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x68b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
cmp dword [0x68d274], 0
jne 0x41bba2
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCR80.dll_strlen
add esp, 4
sub eax, 1
mov dword [ebp - 0x21c], eax
jmp 0x41bb03
mov edx, dword [ebp - 0x21c]
sub edx, 1
mov dword [ebp - 0x21c], edx
cmp dword [ebp - 0x21c], 0
jle 0x41bb31
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [ebp + eax - 0x110]
cmp ecx, 0x5c
jne 0x41bb2f
mov edx, dword [ebp - 0x21c]
mov byte [ebp + edx - 0x10f], 0
jmp 0x41bb31
jmp 0x41baf4
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCR80.dll_strcpy
add esp, 8
push 0x63c164
lea edx, [ebp - 0x218]
push edx
call sub.MSVCR80.dll_strcat
add esp, 8
mov eax, dword [0x68d274]
add eax, 1
mov dword [0x68d274], eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x63b788
push 0x63bd24
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
setne dl
mov eax, dword [ebp - 0x220]
mov byte [eax + 0x1d4], dl
mov ecx, dword [ebp - 0x220]
mov al, byte [ecx + 0x1d4]
jmp 0x41bbae
mov edx, dword [ebp - 0x220]
mov al, byte [edx + 0x1d4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612c78
mov esp, ebp
pop ebp
ret
Function at 0x498450
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
push 0
call fcn.0043af70
add esp, 4
test eax, eax
je 0x49846c
jmp 0x4985e5
mov eax, dword [ebp - 0x14]
add eax, 0x670
cmp dword [ebp + 8], eax
jne 0x498493
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1f0]
sub edx, 1
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00497f00
jmp 0x4985e5
mov eax, dword [ebp - 0x14]
add eax, 0x970
cmp dword [ebp + 8], eax
jne 0x4984ba
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1f0]
add edx, 1
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00497f00
jmp 0x4985e5
mov eax, dword [ebp - 0x14]
add eax, 0x420
cmp dword [ebp + 8], eax
jne 0x4984d1
call fcn.00497410
jmp 0x4985e5
mov ecx, dword [ebp - 0x14]
add ecx, 0xf70
cmp dword [ebp + 8], ecx
jne 0x4984fc
push 1
push 0
push 0
push 0x640d60
push 0x640d58
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4985e5
mov edx, dword [ebp - 0x14]
add edx, 0xc70
cmp dword [ebp + 8], edx
jne 0x498551
call fcn.0049bfb0
test eax, eax
je 0x49851a
call fcn.0049c0b0
jmp 0x49854c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x208]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x49854c
call fcn.0049bfe0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49854c
mov edx, dword [ebp - 0x14]
add edx, 0x1fc
push edx
mov ecx, dword [ebp - 4]
call fcn.0049c0f0
jmp 0x4985e5
mov dword [ebp - 8], 0
jmp 0x498563
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x4985e5
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0x300
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 0x1270]
cmp dword [ebp + 8], eax
jne 0x4985e0
mov ecx, dword [ebp - 0x14]
add ecx, 0x218
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x49859f
mov dword [ebp - 0x18], 0
jmp 0x4985b6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 8]
sub eax, dword [ecx + 4]
cdq
mov ecx, 0x24
idiv ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x18]
jb 0x4985c4
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push 0
mov eax, dword [ebp - 8]
imul eax, eax, 0x24
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx + 4]
push eax
push 0x70
mov ecx, dword [0x6de314]
call fcn.0053b770
jmp 0x49855a
mov esp, ebp
pop ebp
ret 8

Function at 0x49c940
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0xfb0
cmp dword [ebp + 8], eax
jne 0x49c95d
call fcn.0049c0b0
jmp 0x49c9ae
mov ecx, dword [ebp - 8]
add ecx, 0x1200
cmp dword [ebp + 8], ecx
jne 0x49c985
push 1
push 0
push 0
push 0x640d60
push 0x640d58
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x49c9ae
mov edx, dword [ebp - 8]
add edx, 0x1500
cmp dword [ebp + 8], edx
jne 0x49c9ae
call fcn.004972a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49c9a9
mov ecx, dword [ebp - 4]
call fcn.00498830
call fcn.0049c0b0
mov esp, ebp
pop ebp
ret 8
Function at 0x4acbb0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x10a]
test ecx, ecx
je 0x4acbcf
mov eax, 1
jmp 0x4acdc0
push 0x641700
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 4]
mov dword [edx + 0x110], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x110], 0
jne 0x4acbf6
xor eax, eax
jmp 0x4acdc0
push 0x6416e8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x114], eax
push 0x6416d0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x118], eax
push 0x6416c4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x11c], eax
push 0x6416b4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x120], eax
push 0x6416a8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x124], eax
push 0x641694
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x128], eax
push 0x641684
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x12c], eax
push 0x641670
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x130], eax
push 0x641658
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x134], eax
push 0x641640
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x114], 0
je 0x4acd82
mov eax, dword [ebp - 4]
cmp dword [eax + 0x11c], 0
je 0x4acd82
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x120], 0
je 0x4acd82
mov edx, dword [ebp - 4]
cmp dword [edx + 0x124], 0
je 0x4acd82
mov eax, dword [ebp - 4]
cmp dword [eax + 0x128], 0
je 0x4acd82
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x12c], 0
je 0x4acd82
mov edx, dword [ebp - 4]
cmp dword [edx + 0x130], 0
je 0x4acd82
mov eax, dword [ebp - 4]
cmp dword [eax + 0x118], 0
jne 0x4acda3
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
mov dword [eax + 0x110], 0
xor eax, eax
jmp 0x4acdc0
push 2
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043ad60
add esp, 8
mov edx, dword [ebp - 4]
mov byte [edx + 0x10a], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b3b70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xbe4], 0
je 0x4b3b9c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xbe4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xbe4]
mov edx, dword [edx]
mov eax, dword [edx + 0x24]
call eax
push 0x63b730
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3bc8
mov edx, dword [ebp - 4]
add edx, 0x1ab8
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
jmp 0x4b3cee
push 0x641c40
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3bf4
mov edx, dword [ebp - 4]
add edx, 0xe60
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
jmp 0x4b3cee
push 0x641c74
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3c20
mov edx, dword [ebp - 4]
add edx, 0xbe8
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
jmp 0x4b3cee
push 0x641c6c
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3c4c
mov edx, dword [ebp - 4]
add edx, 0x10d8
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
jmp 0x4b3cee
push 0x641c50
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3c75
mov edx, dword [ebp - 4]
add edx, 0x1d30
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
jmp 0x4b3cee
push 0x641c64
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3c9e
mov edx, dword [ebp - 4]
add edx, 0x1840
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
jmp 0x4b3cee
push 0x641c48
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3cc7
mov edx, dword [ebp - 4]
add edx, 0x15c8
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
jmp 0x4b3cee
push 0x641c5c
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR80.dll_strcmp
add esp, 8
test eax, eax
jne 0x4b3cee
mov edx, dword [ebp - 4]
add edx, 0x1350
mov eax, dword [ebp - 4]
mov dword [eax + 0xbe4], edx
mov esp, ebp
pop ebp
ret 4