joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ecx, 0x9e3779b9
mov eax, edx
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0xabcdef89
cmp edx, 0xc
jb 0x42a73c
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
movsx esi, byte [esi + 7]
shl esi, 8
movsx eax, byte [edx + 6]
add esi, eax
movsx eax, byte [edx + 5]
shl esi, 8
add esi, eax
movsx eax, byte [edx + 4]
add ecx, eax
shl esi, 8
add ecx, esi
mov esi, edx
movsx edx, byte [esi + 0xb]
movsx eax, byte [esi + 0xa]
shl edx, 8
add edx, eax
movsx eax, byte [esi + 9]
shl edx, 8
add edx, eax
movsx eax, byte [esi + 8]
add edi, eax
shl edx, 8
movsx eax, byte [esi + 2]
add edi, edx
movsx edx, byte [esi + 3]
shl edx, 8
add edx, eax
movsx eax, byte [esi + 1]
shl edx, 8
add edx, eax
movsx eax, byte [esi]
shl edx, 8
add edx, eax
mov eax, edi
shr eax, 0xd
sub edx, edi
sub edx, ecx
sub ecx, edi
add ebx, edx
xor ebx, eax
sub ecx, ebx
mov eax, ebx
shl eax, 8
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 0xd
xor edi, eax
sub ebx, edi
mov eax, edi
shr eax, 0xc
sub ebx, ecx
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov eax, ebx
shl eax, 0x10
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 5
xor edi, eax
sub ebx, edi
mov eax, edi
shr eax, 3
sub ebx, ecx
xor ebx, eax
sub ecx, edi
mov eax, ebx
sub ecx, ebx
shl eax, 0xa
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 0xf
xor edi, eax
add esi, 0xc
mov eax, dword [ebp - 4]
sub eax, 0xc
mov dword [ebp + 8], esi
sub dword [ebp - 8], 1
mov dword [ebp - 4], eax
jne 0x42a656
mov edx, dword [ebp + 0xc]
dec eax
add edi, edx
cmp eax, 0xa
ja case.default.0x42a744
jmp dword [eax*4 + 0x42a814]
movsx eax, byte [esi + 0xa]
shl eax, 0x18
add edi, eax
movsx eax, byte [esi + 9]
shl eax, 0x10
add edi, eax
movsx eax, byte [esi + 8]
shl eax, 8
add edi, eax
movsx eax, byte [esi + 7]
shl eax, 0x18
add ecx, eax
movsx eax, byte [esi + 6]
shl eax, 0x10
add ecx, eax
movsx eax, byte [esi + 5]
shl eax, 8
add ecx, eax
movsx eax, byte [esi + 4]
add ecx, eax
movsx eax, byte [esi + 3]
shl eax, 0x18
add ebx, eax
movsx eax, byte [esi + 2]
shl eax, 0x10
add ebx, eax
movsx eax, byte [esi + 1]
shl eax, 8
add ebx, eax
movsx eax, byte [esi]
add ebx, eax
sub ebx, edi
mov eax, edi
sub ebx, ecx
shr eax, 0xd
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov eax, ebx
shl eax, 8
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 0xd
xor edi, eax
sub ebx, edi
mov eax, edi
sub ebx, ecx
shr eax, 0xc
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov eax, ebx
shl eax, 0x10
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 5
xor edi, eax
sub ebx, edi
mov eax, edi
sub ebx, ecx
shr eax, 3
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov edx, ebx
shl edx, 0xa
xor ecx, edx
sub edi, ecx
shr ecx, 0xf
sub edi, ebx
xor edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42cce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545955
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042db10
add esp, 8
push 0x5686c4
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.0041f390
push eax
mov byte [ebp - 4], 1
call fcn.0042ba20
mov ecx, dword [ebp - 0x2c]
add esp, 4
cmp ecx, 0x10
jb 0x42cd6e
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42cd64
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42cddd
push ecx
push edx
call fcn.004e243a
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42cd8b
xor bl, bl
jmp 0x42cd91
shr ebx, 4
and bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x42cdc1
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42cdb7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42cde2
push ecx
push edx
call fcn.004e243a
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
call fcn.004f1758
call fcn.004f1758
int3
Function at 0x430da0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54620d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5a933c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push str.Province_Launcher__CR00_
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.00401440
push 0xcb
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 0x568e80
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.00401440
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
push 0x11
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x430e56
push 5
push 0
push 0
push str.https:__vk.com_provincehelp
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x430e86
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x430e7c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430ee1
push ecx
push edx
call fcn.004e243a
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x430ec8
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x430ebe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430ee1
push ecx
push edx
call fcn.004e243a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e2448
mov esp, ebp
pop ebp
ret
call fcn.004f1758
int3
Function at 0x43f7e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548439
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x5a933c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
lea esi, [ecx - 8]
mov dword [ebp - 4], 0
push str.kWrapperType__wrapperStruct__type_
push esi
push 0x5a9148
call fcn.0043ad40
add esp, 0xc
test eax, eax
je 0x43f859
push eax
push 3
push 0x2f
push str.D:PROVINCEprovince.clientBackendVendorcef3libcef_dllctocppctocpp_ref_counted.h
lea ecx, [ebp - 0xcc]
call fcn.00439f90
lea ecx, [ebp - 0xcc]
call fcn.0043a250
mov esi, dword [esi + 4]
mov dword [ebp - 0x14], esi
cmp dword [esi], 0xcc
jb 0x43f9a7
cmp dword [esi + 0xc8], 0
je 0x43f9a7
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [eax + 4]
sub edi, dword [eax]
sar edi, 2
test edi, edi
je 0x43f93b
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e3014
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x43f8e1
push 3
push 0x3a0
push str.D:PROVINCEprovince.clientBackendVendorcef3libcef_dllctocpp_v8value_ctocpp.cc
lea ecx, [ebp - 0xcc]
call fcn.00439f50
add eax, 8
mov byte [ebp - 4], 2
push str.Check_failed:_argumentsList.
push eax
mov dword [ebp - 0x10], 2
call fcn.00401160
add esp, 8
test byte [ebp - 0x10], 2
mov dword [ebp - 4], 0
je 0x43f8f9
lea ecx, [ebp - 0xcc]
call fcn.0043a250
test ebx, ebx
je 0x43f93b
xor esi, esi
nop
mov ecx, dword [ebp + 0x10]
lea eax, [esi*4]
mov ecx, dword [ecx]
add ecx, eax
push ecx
mov eax, esp
mov ecx, dword [ecx]
mov dword [eax], ecx
test ecx, ecx
je 0x43f928
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
add eax, 4
add ecx, eax
mov eax, dword [ecx]
call dword [eax]
call fcn.00441be0
mov dword [ebx + esi*4], eax
add esp, 4
inc esi
cmp esi, edi
jb 0x43f900
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0xc8]
push ebx
push edi
push ecx
mov ecx, esp
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x43f966
mov ecx, dword [eax + 4]
lea edi, [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax]
jmp 0x43f96c
mov edi, dword [ebp - 0x18]
add edi, 4
call fcn.00441be0
add esp, 4
push eax
push esi
call dword [ebp + 0x10]
mov esi, eax
test ebx, ebx
je 0x43f988
push ebx
call fcn.004e25c9
add esp, 4
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00442160
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x43f9cc
mov edx, dword [edi]
jmp 0x43f9c1
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x43f9cc
mov edx, dword [ecx + 4]
add ecx, 4
add ecx, dword [edx + 4]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x445160
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549051
mov eax, dword fs:[0]
push eax
sub esp, 0x170
push esi
push edi
mov eax, dword [0x5a933c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
call fcn.00457250
push str.kWrapperType__wrapperStruct__type_
add esi, 0xfffffff8
push esi
push 0x5a9150
call fcn.0043ad40
add esp, 0xc
test eax, eax
je 0x4451d2
push eax
push 3
push 0x2f
push str.D:PROVINCEprovince.clientBackendVendorcef3libcef_dllctocppctocpp_ref_counted.h
lea ecx, [ebp - 0xcc]
call fcn.00439f90
lea ecx, [ebp - 0xcc]
call fcn.0043a250
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0xcc
jb 0x4452e7
cmp dword [eax + 0xc8], 0
je 0x4452e7
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [eax + 4]
sub esi, dword [eax]
sar esi, 5
mov dword [ebp - 0x14], esi
test esi, esi
je 0x4452ac
xor ecx, ecx
mov eax, esi
mov edx, 0x18
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e3014
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x44525f
push 3
push 0x37a
push str.D:PROVINCEprovince.clientBackendVendorcef3libcef_dllctocpp_browser_host_ctocpp.cc
lea ecx, [ebp - 0x17c]
call fcn.00439f50
add eax, 8
mov dword [ebp - 4], edi
push str.Check_failed:_underlinesList.
push eax
mov dword [ebp - 0x10], 1
call fcn.00401160
add esp, 8
test byte [ebp - 0x10], 1
mov dword [ebp - 4], 0xffffffff
je 0x445277
lea ecx, [ebp - 0x17c]
call fcn.0043a250
test edi, edi
je 0x4452ac
mov ecx, edi
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [edi]
lea edx, [edx + 0x20]
lea ecx, [ecx + 0x18]
movups xmm0, xmmword [eax + edx - 0x1c]
movups xmmword [ecx - 0x18], xmm0
movq xmm0, qword [eax + edx - 0xc]
movq qword [ecx - 8], xmm0
sub esi, 1
jne 0x445285
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x14]
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ebp + 8]
push ecx
push edi
push esi
push dword [eax + 4]
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [eax + 0xc8]
call eax
test edi, edi
je 0x4452e7
push edi
call fcn.004e25c9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4be3a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a2188
push fcn.004e5810
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5a933c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x4be452
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x4be452
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x4be452
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x4be452
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be8a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5b06ac], eax
je 0x4be8bd
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x5b06b0]
test eax, eax
jne 0x4be9d4
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4be8dc
lea eax, [esi + 0x57]
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4be8f9
cmp dword [ebx], 0
jne 0x4be906
mov dword [0x5b06b0], 6
mov dword [0x5b06b4], ebx
pop ebx
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
push 0x18
call fcn.004e240a
mov edi, eax
add esp, 4
test edi, edi
jne 0x4be91f
lea esi, [eax + 8]
jmp 0x4be9b4
push 0
push dword [ebx]
call fcn.004be810
push 0
push esi
mov dword [ebp + 0xc], eax
call fcn.004be810
mov esi, dword [ebp + 0xc]
mov edx, eax
movzx ecx, byte [esi + 0x36]
mov eax, dword [esi + 0x40]
sub eax, ecx
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x4be9a6
cmp ecx, 0x1e
ja 0x4be9a6
cmp dword [esi + 0x44], edx
jne 0x4be9a6
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4be975
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4be9b4
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov dword [edi + 0x10], esi
mov dword [edi + 4], 1
mov eax, dword [ebp - 4]
mov dword [edi + 0x14], eax
mov eax, dword [0x5b06bc]
mov dword [edi], eax
xor eax, eax
mov dword [0x5b06bc], edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [0x5b06a4], 0
mov esi, 9
jne 0x4be9be
mov dword [0x5b06b0], esi
test edi, edi
je 0x4be9c9
push 0x18
push edi
call fcn.004e243a
add esp, 8
pop edi
mov dword [0x5b06b4], ebx
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4beb40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5b06ac], 0
jne 0x4bebbc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x5b06ac
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4bebbc
push esi
mov esi, dword [0x5b069c]
mov dword [0x5b06bc], eax
mov dword [0x5b06b8], eax
mov dword [0x5b06b4], eax
push edi
test esi, esi
je 0x4beb9e
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x4bebab
mov esi, dword [esi + 4]
test esi, esi
jne 0x4beb85
xor eax, eax
pop edi
mov dword [0x5b06b0], eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x5b06b0], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret
Function at 0x4bf090
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5b06b0]
test eax, eax
jne 0x4bf112
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [ebp + 8]
cmp edi, eax
jne 0x4bf0b1
xor eax, eax
pop edi
pop ebp
ret 4
push esi
push 8
call fcn.004e240a
mov esi, eax
add esp, 4
test esi, esi
jne 0x4bf0c7
lea edi, [eax + 8]
jmp 0x4bf0e6
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4bf0fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 8
push esi
call fcn.004e243a
add esp, 8
pop esi
mov dword [0x5b06b0], edi
mov eax, edi
mov dword [0x5b06b4], 0
pop edi
pop ebp
ret 4
mov eax, dword [0x5b06b8]
mov dword [esi + 4], edi
mov dword [esi], eax
xor eax, eax
mov dword [0x5b06b8], esi
pop esi
pop edi
pop ebp
ret 4

Function at 0x4bf450
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a22a8
push fcn.004e5810
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5a933c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4bf493
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x4bf4ae
push 0xc1
jmp 0x4bf5a3
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov dword [ebp - 0x20], ecx
cmp dword [ecx], 0x4550
je 0x4bf4c8
push 0xbf
jmp 0x4bf5a3
movzx eax, word [ecx + 0x14]
test ax, ax
je 0x4bf59e
lea edx, [eax + ecx]
mov dword [ebp + 8], edx
lea edx, [eax + 0x18]
add edx, ecx
mov dword [ebp - 0x24], edx
xor esi, esi
mov dword [ebp - 0x1c], esi
movzx eax, word [ecx + 6]
cmp esi, eax
jae 0x4bf59e
lea edi, [esi + esi*4]
mov ecx, str..detour
lea eax, [edx + edi*8]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4bf520
test dl, dl
je 0x4bf51c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4bf520
add eax, 2
add ecx, 2
test dl, dl
jne 0x4bf500
xor eax, eax
jmp 0x4bf525
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4bf57c
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + edi*8 + 0x24]
test eax, eax
je 0x4bf59e
cmp dword [ecx + edi*8 + 0x28], 0
je 0x4bf59e
lea esi, [eax + ebx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x4bf59e
cmp dword [esi + 4], 0x727444
jne 0x4bf59e
cmp dword [esi + 8], 0
jne 0x4bf557
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc esi
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
jmp 0x4bf4e5
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bf870
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a2248
push fcn.004e5810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5a933c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4bf8b6
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [edx], ax
je 0x4bf8d1
push 0xc1
jmp 0x4bfa28
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x4bf8e7
push 0xbf
jmp 0x4bfa28
cmp word [eax + edx + 0x14], 0
je 0x4bfa23
mov eax, dword [eax + edx + 0x80]
test eax, eax
je 0x4bf903
lea ebx, [eax + edx]
jmp 0x4bf905
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4bfa23
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebx]
test ecx, ecx
je 0x4bf9d4
mov esi, dword [ebx + 0xc]
lea eax, [edx + esi]
neg esi
sbb esi, esi
and esi, eax
je 0x4bfa23
lea eax, [edx + ecx]
mov dword [ebp + 0x14], eax
mov ecx, dword [ebx + 0x10]
lea eax, [edx + ecx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x24], ecx
push dword [ecx]
call fcn.004c00b0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4bf95e
push esi
push eax
mov esi, dword [ebp + 0xc]
push esi
call ecx
test eax, eax
je 0x4bf9d7
xor esi, esi
mov dword [ebp - 0x28], esi
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4bf9c6
nop word [eax + eax]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4bf9b7
xor ecx, ecx
mov dword [ebp - 0x20], ecx
xor edx, edx
test eax, eax
jns 0x4bf98a
movzx ecx, ax
mov dword [ebp - 0x20], ecx
jmp 0x4bf998
add eax, 2
je 0x4bf996
mov edx, dword [ebp + 8]
add edx, eax
jmp 0x4bf998
xor edx, edx
test edi, edi
je 0x4bf9ae
mov eax, dword [ebp - 0x24]
lea eax, [eax + esi*4]
push eax
push edx
push ecx
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x4bf9b7
inc esi
mov dword [ebp - 0x28], esi
mov eax, dword [ebp + 0x14]
jmp 0x4bf970
test edi, edi
je 0x4bf9c6
push 0
push 0
push 0
push dword [ebp + 0xc]
call edi
add ebx, 0x14
mov dword [ebp - 0x1c], ebx
mov edx, dword [ebp + 8]
jmp 0x4bf913
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4bf9e5
push 0
push 0
push esi
call eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4bfa50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a21c8
push fcn.004e5810
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5a933c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
add esi, 0x10000
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
mov edi, 0x5a4d
push 0x1c
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4bfac9
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x24], 0x1000
jne 0x4bfb51
cmp byte [ebp - 0x20], 1
je 0x4bfb51
test dword [ebp - 0x20], 0x100
jne 0x4bfb51
mov dword [ebp - 4], 0
cmp word [esi], di
jne 0x4bfb03
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp - 0x28]
ja 0x4bfb03
cmp eax, 0x40
jb 0x4bfb03
cmp dword [eax + esi], 0x4550
je 0x4bfb12
mov dword [ebp - 4], 0xfffffffe
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x4bfaa4
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x4bfaa4
Function at 0x4c1c9d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004c1c79
pop esi
leave
ret 8

Function at 0x4e1b82
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00513d09
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x4e1bc1
sub eax, 1
je 0x4e1bbc
sub eax, 1
je 0x4e1bb8
xor eax, eax
leave
ret
push 3
jmp 0x4e1bc3
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x4e3db8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4e3df7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4e3df7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4e3df7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4e3df7
cmp dword [ecx + 0x74], 0xe
jbe 0x4e3df7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret