joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049059
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x48
push ebp
push str.renderPickupTexts__
call fcn.10054cbb
mov eax, dword [0x101588bc]
xor ebp, ebp
pop ecx
cmp dword [eax + 0xd5cc], ebp
jne 0x10049200
mov eax, dword [0x103ec6f8]
mov eax, dword [eax + 0x3de]
cmp dword [eax + 0x10], ebp
je 0x10049200
push ebx
push ebp
push 0xffffffffffffffff
call fcn.1002b7fb
pop ecx
pop ecx
push 9
mov ebx, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100490b5
cmp dword [0x103cff5c], ebp
jne 0x100491ff
mov eax, dword [0x103ec710]
cmp dword [eax], ebp
jne 0x100491ff
test ebx, ebx
je 0x100491ff
push esi
push edi
mov edi, ebp
mov esi, ebp
mov eax, dword [0x103ec6f8]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x10]
cmp dword [eax + esi + 0xf004], ebp
je 0x100491ed
cmp dword [eax + esi + 0xf008], ebp
je 0x100491ed
lea ecx, [esp + 0x14]
add eax, 0xf00c
push ecx
add eax, esi
push eax
call fcn.100418b2
lea eax, [esp + 0x1c]
push eax
call fcn.100419a8
add esp, 0xc
test eax, eax
jne 0x100491ed
mov eax, dword [ebx + 0x14]
add eax, 0x30
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100418c2
fstp dword [esp + 0x18]
movss xmm0, dword [esp + 0x18]
comiss xmm0, dword [0x103e712d]
pop ecx
pop ecx
ja 0x100491ed
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x2c]
movss dword [esp + 0x20], xmm0
movss xmm0, dword [esp + 0x18]
push eax
movss dword [esp + 0x28], xmm0
lea eax, [esp + 0x24]
movss xmm0, dword [esp + 0x20]
push eax
movss dword [esp + 0x30], xmm0
call fcn.10003381
movss xmm0, dword [0x1007f18c]
comiss xmm0, dword [esp + 0x3c]
pop ecx
pop ecx
ja 0x100491ed
mov eax, dword [0x103ec6f8]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x10]
push dword [eax + esi + 0xf004]
lea eax, [esp + 0x3c]
push edi
push str.Pickup:__d__ModelID:__d
push 0x1f
push eax
call fcn.10045db0
movss xmm0, dword [esp + 0x44]
lea eax, [esp + 0x4c]
subss xmm0, dword [0x10085130]
add esp, 0x14
push eax
push 0xff00c800
push ecx
push ecx
mov ecx, dword [0x103f44bc]
movss dword [esp + 4], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [esp], xmm0
call fcn.100459b6
add esi, 0x14
inc edi
cmp esi, 0x14000
jl 0x100490d0
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x48
ret
Function at 0x1004a122
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call fcn.100640da
push 6
cdq
pop ecx
idiv ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x103f9ca0]
cmp eax, 0x3e8
jbe 0x1004a154
inc dword [0x103f9c9c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x103f9ca0], eax
mov ecx, dword [0x103f9c9c]
cmp ecx, 0xd
jle 0x1004a244
mov eax, dword [0x101588bc]
push ebx
xor ebx, ebx
cmp byte [eax + 0x1440], bl
je 0x1004a1c9
cmp ecx, 8
jle 0x1004a23d
cmp esi, 1
jne 0x1004a188
push str._b_evet_burdayim
jmp 0x1004a1b6
cmp esi, 2
jne 0x1004a194
push 0x1008fb18
jmp 0x1004a1b6
cmp esi, 3
jne 0x1004a1a0
push str._b_evet
jmp 0x1004a1b6
cmp esi, 4
jne 0x1004a1ac
push str._b_he
jmp 0x1004a1b6
cmp esi, 5
jne 0x1004a1bc
push str._b_burday
call fcn.10043aa4
pop ecx
mov eax, dword [0x101588bc]
mov byte [eax + 0x1440], bl
jmp 0x1004a231
mov eax, dword [0x101588bc]
cmp byte [eax + 0x1443], bl
je 0x1004a23d
cmp ecx, 8
jle 0x1004a23d
cmp esi, 1
jne 0x1004a1e7
push str._re_evet_burdayim
jmp 0x1004a215
cmp esi, 2
jne 0x1004a1f3
push 0x1008fb5c
jmp 0x1004a215
cmp esi, 3
jne 0x1004a1ff
push str._re_evet
jmp 0x1004a215
cmp esi, 4
jne 0x1004a20b
push str._re_he
jmp 0x1004a215
cmp esi, 5
jne 0x1004a21b
push str._re_burday
call fcn.10043aa4
pop ecx
mov eax, dword [0x101588bc]
mov byte [eax + 0x1443], bl
mov eax, dword [0x101588bc]
mov byte [eax + 0x1441], bl
mov eax, dword [0x101588bc]
mov byte [eax + 0x1442], 1
mov dword [0x103f9c9c], ebx
pop ebx
pop esi
ret

Function at 0x1004a246
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x103f9ca8]
cmp eax, 0x3e8
jbe 0x1004a26a
inc dword [0x103f9ca4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x103f9ca8], eax
cmp dword [0x103f9ca4], 0x4b
jle 0x1004a2b0
mov eax, dword [0x101588bc]
cmp byte [eax + 0x1442], 0
je 0x1004a2b0
push str._baliktut
call fcn.10043aa4
mov dword [esp], str.___c9c9c9Bot_tekrar_ba
call fcn.10042e02
mov eax, dword [0x101588bc]
pop ecx
mov byte [eax + 0x1444], 1
mov eax, dword [0x101588bc]
mov byte [eax + 0x1442], 0
ret
Function at 0x1004cba7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push str.getFPS__
call fcn.10054cbb
inc dword [0x103f4494]
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xf0
cmp eax, dword [0x103f9b18]
jbe 0x1004cc40
mov eax, dword [0x103f4494]
movss xmm2, dword [0x103f4488]
movss xmm3, dword [0x103f448c]
movss xmm0, dword [0x103f4484]
shl eax, 2
and dword [0x103f4494], 0
movss dword [0x103f448c], xmm2
addss xmm2, xmm3
movss dword [0x103f4490], xmm3
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [0x103f4488], xmm0
movss dword [0x103f4484], xmm1
addss xmm1, xmm0
addss xmm1, xmm2
mulss xmm1, dword [0x100850a8]
movss dword [0x103f4480], xmm1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x103f9b18], eax
fld dword [0x103f4480]
ret

Function at 0x1004ccf7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.mapMenuTeleport__
call fcn.10054cbb
cmp dword [0x103e7145], 0
pop ecx
je 0x1004cd1e
cmp byte [0xba68a5], 5
jne 0x1004cdc7
cmp dword [0xba6774], 0
je 0x1004cdc7
push dword [0x103e7141]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, 0x10000
je 0x1004cdc7
cmp dword [0x103f9f24], 0
je 0x1004cdc7
push esi
push edi
mov esi, 0xba8720
mov edi, 0xaf
mov eax, 0x1203
cmp word [esi + 0x1d], ax
jne 0x1004cdbd
push 0
call fcn.1002bb5e
movss xmm0, dword [esi]
pop ecx
mov ecx, dword [0x103f9f24]
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [esi + 4]
movss dword [ebp - 8], xmm0
mov eax, dword [ecx]
call dword [eax + 0x38]
movss xmm0, dword [ebp - 8]
push ecx
push ecx
mov edx, dword [eax]
mov ecx, eax
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 0xc]
movss dword [esp], xmm0
call dword [edx + 0x18]
fadd dword [0x10085110]
lea eax, [ebp - 0xc]
push 0
push eax
fstp dword [ebp - 4]
call fcn.10030099
pop ecx
pop ecx
add esi, 0x28
sub edi, 1
jne 0x1004cd58
pop edi
pop esi
leave
ret
Function at 0x10054a45
Capabilities:
Create process on windows

Disassembly:
push ebx
push edi
push str.init__
call fcn.10054cbb
pop ecx
push 0xe4
mov edi, 0x103f9d08
push edi
push dword [0x103f9d00]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
test eax, eax
je 0x10054a8b
push 0x5c
push edi
call fcn.1005a7c0
pop ecx
pop ecx
test eax, eax
je 0x10054a8b
push 0x5c
push edi
call fcn.1005a7c0
pop ecx
pop ecx
mov byte [eax], bl
jmp 0x10054a94
push 0x2e
pop eax
mov word [0x103f9d08], ax
push esi
push str.cleo24
push str.Initializing__s
call fcn.10054715
push 0x789
push str.Dec_24_2023_17:07:23
push str.Compiled:__s_CL:_d
call fcn.10054715
mov esi, dword [0xc9ac08]
add esp, 0x14
mov dword [0x103f9f34], esi
mov eax, dword [0xc9ac0c]
mov dword [0x103f9f38], eax
mov ecx, dword [0xc9ac10]
mov dword [0x103f9f3c], ecx
mov edx, dword [0xc9ac14]
mov dword [0x103f9f40], edx
push eax
push ecx
push edx
cmp esi, 2
jne 0x10054b00
push str.OS:_Windows_Version__d._d._d
call fcn.10054715
add esp, 0x10
jmp 0x10054b0e
push esi
push str.OS:_code__d___d._d._d_
call fcn.10054715
add esp, 0x14
call fcn.10040aa1
pop esi
cmp dword [0x101676c0], ebx
jne 0x10054b47
push ebx
push str.Youre_a_retard.
push str.Looks_like_youve_not_edited_the_.ini_file_like_you_were_told_to__n_nBefore_you_can_use_mod_sa__you_have_to_set__i_have_edited_the_ini_file__to_true._nWe_did_this_so_you_would_read_the_INI_file_to_see_the_configurability_of_mod_sa._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push edi
push str.cleo24cleo24.ini
push str.notepad
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.10043488
xor eax, eax
pop edi
inc eax
pop ebx
ret

Function at 0x1006b11a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006af90
Function at 0x40f2f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x5f6470], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5f646c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5f6470], edx
cmp eax, 0x26f
jl 0x40f300
mov dword [0x57cfe0], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x40f340
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5f6474]
mov ebx, dword [eax*4 + 0x5f6470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5f6aa4]
mov dword [eax*4 + 0x5f6470], edx
cmp eax, 0xe2
jl 0x40f350
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5f6474]
mov ebx, dword [eax*4 + 0x5f6470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5f60e4]
mov dword [eax*4 + 0x5f6470], edx
cmp eax, 0x26e
jl 0x40f3a0
mov edx, dword [0x5f6470]
mov ecx, dword [0x5f6e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5f6aa0]
mov dword [0x5f6e2c], eax
mov dword [0x57cfe0], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f430
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x57cfe0]
add dword [0x57cfe0], 1
mov eax, dword [0x5f5020]
cmp eax, dword [0x57c730]
jne 0x40f456
cmp ebx, 0x271
jb 0x40f478
mov eax, dword [0x5f5020]
call fcn.0040f2f0
not dword [0x5f5020]
mov eax, dword [0x5f5020]
mov dword [0x57c730], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x40f494
call fcn.0040f340
xor ebx, ebx
mov dword [0x57cfe0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5f6470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4110c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ax, word [0x57c480]
cmp ax, 0xcb
je 0x4111cc
cmp ax, 0xcc
je 0x4111cc
mov edx, dword [0x5f7070]
test edx, edx
je 0x4110f5
mov eax, dword [0x5f6f20]
call edx
mov ebx, eax
jmp 0x4110fa
mov ebx, 0x5f6f24
cmp word [0x5f6f10], 0
jle 0x411120
mov eax, 0x5f6ef0
call fcn.00411390
mov eax, ebx
call fcn.00410c40
mov eax, ebx
call fcn.00410cc0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x411142
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x41113d
mov edx, edi
mov eax, ebx
call fcn.00410090
jmp 0x411140
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x411128
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5f6f10], 0
jle 0x4111cc
mov edx, 0x5f6e30
mov eax, ebx
call fcn.004101e0
mov edi, eax
test edi, edi
je 0x41119c
mov eax, dword [0x5f6ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5f6ec4], 0
je 0x411190
mov eax, dword [0x5f6ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5f6ec4], eax
nop
sub word [0x5f6f10], 1
cmp word [0x5f6f10], 0
sete bl
mov eax, 0x5f6ef0
call fcn.004113b0
test bl, bl
je 0x4111cc
mov eax, 0x5f6ef0
call fcn.00411380
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4134d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.004134b0
push ebp
push 0x414930
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x4135fa
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b790
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x41355f
mov edx, 0x5f62f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x4135b1
call sub.kernel32.dll_GetLastError
call fcn.00404240
lea eax, [ebp - 0x10]
call fcn.0040a350
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a7e0
mov edx, dword [ebp - 0x14]
mov ecx, 0x59a388
lea eax, [ebp - 0x10]
call fcn.0040a680
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b070
jmp 0x413648
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x4135ca
cmp eax, ecx
je 0x4135d4
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b790
cmp byte [0x57c700], 0
jne 0x413648
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bcd0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b100
lea esi, [esi]
jmp 0x413648
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b790
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41361e
mov eax, 0x5f62f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x57c700], 0
jne 0x413648
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040bcd0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b100
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004134b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413a80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5f6260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413c60
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5f6260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004037c0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x57c500], eax
mov ebx, eax
jmp 0x413c23
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413b08
cmp byte [ebx], 0
je 0x413c2c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413b83
mov al, byte [ebx]
cmp al, 1
jb 0x413b78
sub al, 0x20
jbe 0x413b48
sub al, 2
je 0x413b5c
jmp 0x413b78
mov al, byte [ebp - 0x114]
test al, al
je 0x413b88
add dword [ebp - 0x110], 1
jmp 0x413b80
cmp byte [ebx + 1], 0x22
je 0x413b73
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413b80
add ebx, 1
jmp 0x413b80
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413b38
test dword [ebp - 0x10c], 0xffffffff
je 0x413c1c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413c60
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5f6260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413c13
mov al, byte [ebx]
cmp al, 1
jb 0x413c08
sub al, 0x20
jbe 0x413bd8
sub al, 2
je 0x413bec
jmp 0x413c08
mov al, byte [ebp - 0x114]
test al, al
je 0x413c18
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413c10
cmp byte [ebx + 1], 0x22
je 0x413c03
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413c10
add ebx, 1
jmp 0x413c10
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413bc8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x413b0b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5f6250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5f6260
call fcn.00410ef0
mov eax, dword [0x5f6260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4287f0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.00408b20
xor eax, eax
push fcn.004287e0
push ebp
push 0x414930
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00408b50
xor ecx, ecx
mov edx, 1
mov eax, 0x5edcbc
mov ebx, 0x5edcbc
call dword [ebx + 0xc4]
mov dword [ebp - 0xc], eax
mov ecx, str.Mozilla_5.0
mov edx, 0x59f99c
call fcn.0056cc80
xor eax, eax
push fcn.004287d0
push ebp
push 0x414930
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push 0x42888d
push ebp
push 0x414cb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0056fb10
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x42889f
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004287d0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004287e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429620
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x4296ca
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x4296e6
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x4296e6
sub dx, 0x20
je 0x4296c0
sub dx, 0x80
je 0x4296c0
sub dx, 0x1f62
jb 0x4296e6
sub dx, 1
jbe 0x4296c0
sub dx, 6
je 0x4296c0
sub dx, 0x26
jne 0x4296e6
nop
jmp 0x4296c0
cmp eax, dword [ebp - 0x20]
jg 0x429668
lea esi, [esi]
jmp 0x4296e6
cmp dword [ebp - 0x1c], 2
jne 0x4296da
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x4296e6
mov al, byte [ebp - 0xc]
call fcn.0040b3e0
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x429764
sub ax, 0x21
je 0x429778
sub ax, 0x17
je 0x429784
sub ax, 0x222
je 0x429790
sub ax, 0x392
je 0x429798
sub ax, 1
je 0x4297a0
sub ax, 0x1996
je 0x4297a8
sub ax, 1
je 0x4297b0
sub ax, 6
je 0x4297b8
sub ax, 0xb
je 0x4297c8
sub ax, 0x1b
je 0x4297c0
sub ax, 0x367
je 0x4297d0
jmp 0x4297d8
mov ax, word [ebp - 0x24]
call fcn.0040b480
mov byte [ebp - 0x10], al
jmp 0x4297e0
mov byte [ebp - 0x10], 0x20
jmp 0x4297e0
mov byte [ebp - 0x10], 0x2e
jmp 0x4297e0
mov byte [ebp - 0x10], 0x27
jmp 0x4297e0
mov byte [ebp - 0x10], 0x2c
jmp 0x4297e0
mov byte [ebp - 0x10], 0x27
jmp 0x4297e0
mov byte [ebp - 0x10], 0x20
jmp 0x4297e0
mov byte [ebp - 0x10], 0x20
jmp 0x4297e0
mov byte [ebp - 0x10], 0x20
jmp 0x4297e0
mov byte [ebp - 0x10], 0x20
jmp 0x4297e0
mov byte [ebp - 0x10], 0x2d
jmp 0x4297e0
mov byte [ebp - 0x10], 0x27
jmp 0x4297e0
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x437070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00437060
push ebp
push 0x414930
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x437180
mov al, byte [ebp - 0x110]
test al, al
je 0x437149
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fa0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004093e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a1d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a1a80
call fcn.00451de0
mov edx, 0x4370da
mov ecx, ebp
call fcn.004147d0
jmp 0x437180
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a1a80
call fcn.00451de0
mov edx, 0x437149
mov ecx, ebp
call fcn.004147d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x437244
mov al, byte [ebp - 0x110]
test al, al
je 0x43720d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fa0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004093e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a1d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a1a80
call fcn.00451de0
mov edx, 0x43719e
mov ecx, ebp
call fcn.004147d0
jmp 0x437244
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x5a1a80
call fcn.00451de0
mov edx, 0x43720d
mov ecx, ebp
call fcn.004147d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00436770
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00437060
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43a4c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x5a270c
call fcn.0040d2d0
test al, al
je 0x43a5a6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0043a5c0
xor eax, eax
push fcn.0043a4b0
push ebp
push 0x414930
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408b50
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.004396b0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.00439170
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0043a4b0
jmp 0x43a5b1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043d170
mov esp, ebp
pop ebp
ret

Function at 0x43c500
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x43c51c
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret