joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471a50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x471b1c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x471a71
cmp al, 0x6b
jne 0x471b1c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x471add
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x471a91
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x471a91
cmp al, 0xbb
jne 0x471aba
inc ecx
cmp ecx, esi
jl 0x471a81
sub esi, ecx
test ecx, ecx
jne 0x471ae0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00462eb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00462eb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x471b09
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00462eb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.004b7d40
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00462eb0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x47a060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.004b8440
mov eax, dword [0x52ad60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x47a090
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x47a090
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x47a108
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x47a0ea
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x47a108
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x47a19a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x47a188
lea eax, [esi + esi]
call fcn.004b8840
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x47a19a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47a133
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x47a19a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004b6de8
mov esi, eax
add esp, 8
test esi, esi
jne 0x47a23e
call fcn.004b4dda
cmp dword [eax], 2
je 0x47a180
call fcn.004b4dda
cmp dword [eax], 9
jne 0x47a192
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.004b5b71
mov esi, eax
add esp, 8
test esi, esi
jne 0x47a23e
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00462eb0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x4effe0
push eax
push 0x4effdc
push ecx
push str.fopen_
push 5
call fcn.00462a90
add esp, 0x2c
call fcn.004b4dda
cmp dword [eax], 2
jne 0x47a210
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00462eb0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3a11
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00462eb0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3a11
mov esp, ebp
pop ebp
ret
push 0x529b94
call fcn.00461a40
mov edi, eax
add esp, 4
test edi, edi
jne 0x47a270
push esi
call fcn.004b5eb4
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3a11
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.004614d0
push esi
push 1
push 0x6a
push edi
call fcn.00461830
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3a11
mov esp, ebp
pop ebp
ret
Function at 0x47ad10
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x47adf3
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x47ad8e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x4f0168]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x4f0168]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x4f0168]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + 0x4f0168]
mov byte [ecx], dl
jmp 0x47ade0
shl edx, 0x10
cmp edi, 2
jne 0x47ad9f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x4f0168]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x4f0168]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x47adcd
lea edx, [edi + 0x3c]
jmp 0x47adda
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x4f0168]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x47ad30
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x495180
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x495199
mov esi, edi
mov edi, eax
jmp 0x49519b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4951ab
mov eax, ebx
jmp 0x4951b5
push eax
push ebx
call fcn.00466020
add esp, 8
test eax, eax
jne 0x4951bd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4951d9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4951c4
cmp eax, dword [esi + 4]
jge 0x4951f0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4951e0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x495211
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x49520e
dec eax
test eax, eax
jg 0x495200
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x499820
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.004b8440
mov eax, dword [0x52ad60]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.0047bfa0
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x499883
xor eax, eax
jmp 0x499a0d
lea ecx, [esp + 0x2c]
push ecx
call fcn.004ab2a0
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x4998a8
mov dword [esp + 0x148], edi
jmp 0x4998d2
cmp dword [esp + 0x148], 0xffffffff
jne 0x4998d2
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x4998c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4998c0
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x4999fb
jmp 0x4998e8
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x4998ee
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.004aafe0
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.004ab1e0
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.004ab1e0
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.004ab1f0
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.004b7d40
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x4999e6
dec eax
mov dword [esp + 0x10], eax
jmp 0x499990
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.004ab3b0
add esp, 0x1c
test esi, esi
jle 0x4999df
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x4999d0
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x499990
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4998e0
lea eax, [esp + 0x2c]
push eax
call fcn.004ab340
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b3a11
add esp, 0x130
ret
Function at 0x4aafe0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.004b8440
mov eax, dword [0x52ad60]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x4ab02f
mov eax, 1
mov dword [esi], ebp
jmp 0x4ab031
mov ebp, dword [esi]
test ecx, ecx
je 0x4ab114
push ebp
call fcn.00480a00
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x4ab060
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.00466b60
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x4ab0b7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.004852a0
add esp, 0xc
test eax, eax
je 0x4ab1b6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.00485450
add esp, 0xc
test eax, eax
je 0x4ab1b6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.00485460
add esp, 0xc
test eax, eax
je 0x4ab1b6
jmp 0x4ab0f1
cmp edi, 0x80
jbe 0x4ab0d3
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.00466b60
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.004b7d40
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x4ab11c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.004b84f0
add esp, 0xc
jmp 0x4ab11c
test eax, eax
je 0x4ab1a2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4ab120
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.004852a0
add esp, 0xc
test eax, eax
je 0x4ab1b6
push ebp
call fcn.00480a00
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00485450
add esp, 0x10
test eax, eax
je 0x4ab1b6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4ab164
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.004852a0
add esp, 0xc
test eax, eax
je 0x4ab1b6
push ebp
call fcn.00480a00
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00485450
add esp, 0x10
test eax, eax
je 0x4ab1b6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.004855c0
add esp, 8
test eax, eax
jne 0x4ab1ba
xor eax, eax
jmp 0x4ab1bf
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b3a11
add esp, 0x8c
ret
Function at 0x4ade60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.004b8440
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.0047bfa0
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x4ae0a1
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x4adf27
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.00465de0
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.004610e0
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x4aded9
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x4adf5b
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x4adf99
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.00465780
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x4adf87
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.00462eb0
add esp, 0x14
jmp 0x4ae084
cmp esi, 0xfffffffe
jne 0x4adf31
jmp 0x4ade9d
jge 0x4ade9d
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.00462eb0
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x4adee5
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.00462eb0
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.00468ac0
add esp, 8
test eax, eax
jle 0x4ae080
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.00485250
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.004852a0
push 8
lea eax, [esp + 0x34]
push 0x509950
push eax
call fcn.00485450
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00485450
add esp, 0x28
test esi, esi
je 0x4adff4
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00485450
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00485590
lea ecx, [esp + 0x2c]
push ecx
call fcn.004854e0
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.004710e0
add esp, 0x24
test eax, eax
jne 0x4ae080
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x4ae056
xor ecx, ecx
test esi, esi
jle 0x4ae056
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x4ae047
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4ae06f
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4adf7b
push ebp
call fcn.00465920
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x4c5939
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52ad60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004bcfdc
mov dword [ebp - 0x14], eax
cmp dword [0x52f09c], edi
jne 0x4c5a2a
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4c59b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4c5b0a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4c5b0a
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c5b0a
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x52f09c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x52f0a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x510374
push esi
mov dword [0x52f0a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x52f0ac], eax
test eax, eax
je 0x4c5a27
push 0x510390
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x52f0a8], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4c5a4f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c5a42
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4c5a64
push 4
pop eax
jmp 0x4c5b0c
cmp dword [ebp - 0x14], edi
je 0x4c5a64
push dword [0x52f09c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4c5a49
mov eax, dword [0x52f0a8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4c5ac2
cmp dword [0x52f0ac], esi
je 0x4c5ac2
push eax
call ebx
push dword [0x52f0ac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4c5ac2
test eax, eax
je 0x4c5ac2
call ecx
test eax, eax
je 0x4c5ab7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4c5ab7
test byte [ebp - 8], 1
jne 0x4c5ac2
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4c5af2
mov eax, dword [0x52f0a0]
cmp eax, esi
je 0x4c5aef
push eax
call ebx
test eax, eax
je 0x4c5aef
call eax
mov edi, eax
test edi, edi
je 0x4c5aef
mov eax, dword [0x52f0a4]
cmp eax, esi
je 0x4c5aef
push eax
call ebx
test eax, eax
je 0x4c5aef
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x52f09c]
call ebx
test eax, eax
je 0x4c5b0a
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4c5b0c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3a11
leave
ret
Function at 0x4ce8eb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004c083d
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4ce923
xor eax, eax
jmp 0x4ce94f
cmp esi, dword [ebp - 4]
je 0x4ce94c
cmp dword [ebp + 0xc], 0
je 0x4ce94c
push dword [edi + 0x9c]
call fcn.004ce4f9
push dword [edi + 0x9c]
mov esi, eax
call fcn.004bd2f4
pop ecx
pop ecx
cmp esi, eax
je 0x4ce91f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x402540
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4183c8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x41e404]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41e404]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x98]
mov ebx, dword [esp + 0x9c]
xor esi, esi
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], esi
mov word [esp + 0x6c], si
xor eax, eax
push 0x44
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push esi
push eax
mov dword [esp + 0x9c], esi
call fcn.00406ef0
mov eax, dword [ebx + 0x14]
add esp, 0xc
xor edi, edi
cmp eax, esi
mov dword [esp + 0x24], 0x44
je 0x40266b
lea esi, [eax + 0x208]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406936
push 0x41929c
mov edi, eax
push esi
push edi
call fcn.00407d32
add esp, 0x10
cmp dword [ebp + 0x18], 8
jb 0x402611
mov ebp, dword [ebp + 4]
jmp 0x402614
add ebp, 4
push ebp
push esi
push edi
call fcn.00407cb8
push 0x419294
push esi
push edi
call fcn.00407cb8
mov ebp, 8
add esp, 0x18
cmp dword [ebx + 0x18], ebp
jb 0x40263a
mov ebx, dword [ebx + 4]
jmp 0x40263d
add ebx, 4
push ebx
push esi
push edi
call fcn.00407cb8
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor esi, esi
jmp 0x402697
cmp dword [ebp + 0x18], 8
jb 0x402676
mov ebp, dword [ebp + 4]
jmp 0x402679
add ebp, 4
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 8
cmp eax, esi
jne 0x4026b5
cmp dword [esp + 0x80], ebp
jb 0x4026b1
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.00406e10
add esp, 4
xor al, al
jmp 0x402711
mov eax, dword [esp + 0x18]
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4026ca
push eax
call ebx
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4026ec
cmp byte [esp + 0xa0], 0
je 0x4026e9
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x14]
push eax
call ebx
cmp edi, esi
je 0x4026f9
push edi
call fcn.00406f6a
add esp, 4
cmp dword [esp + 0x80], ebp
jb 0x40270f
mov edx, dword [esp + 0x6c]
push edx
call fcn.00406e10
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004075cb
add esp, 0x80
ret