joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c554
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x46c566
add esp, 0xfffffff0
call fcn.00403df0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042564c
mov eax, dword [0x49929c]
mov dword [eax + 4], ebx
mov dword [eax], 0x46c8f8
mov eax, dword [0x4992ac]
mov dword [eax + 4], ebx
mov dword [eax], 0x46c904
mov eax, ebx
call fcn.0046c910
push 0
call fcn.00407738
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41a93c]
call fcn.00403a48
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41a93c]
call fcn.00403a48
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41a93c]
call fcn.00403a48
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41a93c]
call fcn.00403a48
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41a93c]
call fcn.00403a48
mov dword [ebx + 0x7c], eax
push 0
call fcn.004076f0
mov esi, eax
push 0x5a
push esi
call fcn.00407368
mov dword [ebx + 0x40], eax
push esi
push 0
call fcn.004079a0
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x468d28
push eax
push 0
push 0
mov eax, dword [0x4994a4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4270d8]
call fcn.00428894
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4270d8]
call fcn.00428894
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4270d8]
call fcn.00428894
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0046cd60
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46cc28
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46cc28
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46cc28
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46c6a3
call fcn.00403e48
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46ca0c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46cbb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46cb98
mov dl, 1
mov eax, dword [0x41afa0]
call fcn.00403a48
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404888
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.00407740
dec eax
test eax, eax
jl 0x46cb87
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00459f94
test al, al
je 0x46cb7a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46cbc8
lea eax, [ebp - 0x254]
call fcn.0040c7ac
push eax
push 0x80000002
call fcn.00406f88
test eax, eax
jne 0x46cb7a
xor eax, eax
push ebp
push 0x46cb73
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46cc00
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406f90
test eax, eax
jne 0x46cb5c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b08
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46cb5c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cb7a
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406f70
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46ca7d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041f5b8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cbbe
lea eax, [ebp - 0x260]
call fcn.00404888
ret

Function at 0x46d500
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x49cdd8]
cmp byte [eax + 0xa5], 0
jne 0x46d571
cmp dword [0x49cdf0], 0
jne 0x46d532
call fcn.00407090
push eax
push 0
mov eax, 0x46d4bc
push eax
push 3
call fcn.00407aa0
mov dword [0x49cdf0], eax
cmp dword [0x49cdec], 0
jne 0x46d54d
push 0
push 0
push 0
push 0
call fcn.00406fc0
mov dword [0x49cdec], eax
cmp dword [0x49cdf4], 0
jne 0x46d571
push esp
push 0
push 0
push 0x46d460
push 0x3e8
push 0
call fcn.00407008
mov dword [0x49cdf4], eax
pop edx
ret
Function at 0x46dc04
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49cdd8]
cmp dword [eax + 0x30], 0
je 0x46dcae
cmp dword [ebx + 0x94], 0
jne 0x46dca8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46db94
call fcn.00407678
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46dca8
push 3
mov eax, dword [esp + 4]
push eax
call fcn.00407800
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.00407810
test al, 8
je 0x46dc6e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46dca8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d18c
push eax
call fcn.00407a80
dec esi
cmp esi, 0xffffffff
jne 0x46dc7d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46e80c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46e841
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call fcn.00407830
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404978
jmp 0x46e84e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004048dc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46f884
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46f8c5
mov eax, esi
call fcn.00455610
test al, al
je 0x46f8c5
mov eax, dword [ebx + 0x84]
call fcn.00455338
push eax
call fcn.004078c8
test eax, eax
je 0x46f8c5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00455338
push eax
call fcn.00407ac8
pop esi
pop ebx
ret

Function at 0x47086c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d48
xor eax, eax
push ebp
push 0x47099a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.00407940
test eax, eax
je 0x47096d
xor eax, eax
push ebp
push 0x470966
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b58
inc eax
push eax
push 0x2002
call fcn.00407148
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47093b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call fcn.00407168
mov ebx, eax
xor eax, eax
push ebp
push 0x47092a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b58
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404d58
mov edx, ebx
pop ecx
call fcn.00402ff0
call fcn.00407640
mov eax, dword [ebp - 8]
push eax
push 1
call fcn.004079f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470931
mov eax, dword [ebp - 8]
push eax
call fcn.00407180
ret
mov ecx, dword [0x4991e8]
mov dl, 1
mov eax, dword [0x40a504]
call fcn.0040f960
call fcn.00404258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4709a1
lea eax, [ebp - 4]
call fcn.00404888
ret
Function at 0x4709a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x470b59
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404f48
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x470b70
call fcn.00404ba4
mov eax, ebx
call fcn.00425c70
mov edi, eax
dec edi
test edi, edi
jl 0x470a60
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00425c44
mov edx, dword [0x4462a8]
call fcn.00403c10
test al, al
je 0x470a5c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00425c44
lea edx, [ebp - 0x14]
call fcn.0044eb50
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404f48
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c18
inc esi
dec edi
jne 0x470a0e
mov al, byte [0x470b74]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x470b80
mov eax, dword [ebp - 0xc]
call fcn.00410da8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404920
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044eb50
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x470b70
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0044eb50
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x470b70
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x470b70
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x470b8c
call fcn.0040c844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470b60
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004048ac
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004048ac
lea eax, [ebp - 0x14]
call fcn.00404888
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004048ac
ret
Function at 0x479570
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x499220]
cmp byte [eax], 0
jne 0x47959e
mov ecx, 0xaf
mov edx, 0x4795ec
mov eax, 0x479628
call fcn.00404860
mov eax, ebx
call fcn.00404fa4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call fcn.00407910
shl eax, 0x10
test eax, eax
je 0x4795dd
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call fcn.00407728
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405138
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47963c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x499220]
cmp byte [eax], 0
jne 0x47965f
mov ecx, 0xbd
mov edx, 0x4796a0
mov eax, 0x4796dc
call fcn.00404860
push 2
movzx eax, bx
push eax
call fcn.00407910
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x479692
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x479692
push esi
call fcn.00407b10
cmp al, bl
jne 0x479692
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x47d788
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x47d7ec
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call fcn.004070d0
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b08
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407078
mov edx, eax
pop eax
call fcn.0040b9c4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d7f3
lea eax, [ebp - 0xc]
call fcn.00404888
ret

Function at 0x47d868
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x47d8c4
push esp
push 0x40
push 6
push ebx
call fcn.00407240
test eax, eax
jne 0x47d893
call fcn.00410ee4
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402ff0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call fcn.00407240
test eax, eax
jne 0x47d8c4
call fcn.00410ee4
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x47f864
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x47fa3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x47fa21
mov eax, dword [edi + 0x30]
call fcn.00404b58
test eax, eax
jne 0x47f8ba
mov eax, dword [edi + 0x34]
call fcn.00404b58
test eax, eax
jne 0x47f8ba
mov eax, edi
call fcn.0047fad8
jmp 0x47fa21
cmp dword [edi + 0xa0], 0
jne 0x47f8f1
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040c1bc
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49d268]
mov eax, dword [eax + 0x44]
push eax
call fcn.0047e034
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x47f928
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040c1bc
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49d268]
mov eax, dword [eax + 0x44]
push eax
call fcn.0047e034
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0047fb18
mov ebx, eax
test bl, bl
jne 0x47f9d6
mov eax, dword [edi + 0x30]
call fcn.00404b58
test eax, eax
jne 0x47f960
mov eax, dword [edi + 0xc0]
call fcn.00404b58
test eax, eax
je 0x47f9d6
mov eax, dword [edi + 0xc0]
call fcn.00404b58
test eax, eax
je 0x47f982
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040c1bc
jmp 0x47f9ae
push dword [edi + 0x30]
push 0x47fa54
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404c18
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040c1bc
push 7
lea eax, [ebp - 0x101]
push eax
call fcn.00407260
cmp eax, 0x20
jb 0x47f9d6
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0047fb18
mov ebx, eax
test bl, bl
jne 0x47f9e3
mov eax, edi
call fcn.0047fad8
jmp 0x47fa21
mov eax, dword [edi + 0x58]
test eax, eax
je 0x47f9f2
mov dword [edi + 0xa8], eax
jmp 0x47f9fc
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.0047fb90
test al, al
je 0x47fa21
mov eax, edi
mov si, 0xffee
call fcn.00403c80
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0047fcc8
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fa41
lea eax, [ebp - 0x108]
call fcn.00404888
ret
Function at 0x48144c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
mov dword [esp + 4], edx
mov dword [esp], eax
lea edi, [esp + 0xc]
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x18]
push eax
call fcn.00407118
mov esi, dword [esp + 0x1c]
call fcn.00407088
mov ebp, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov eax, dword [edi]
and eax, 0xffff0000
mov dword [edi], eax
mov eax, ebx
shl eax, 0x10
sub dword [edi], eax
mov eax, esi
not eax
inc eax
and eax, dword [edi]
mov dword [edi], eax
push 4
push 0x3000
push esi
mov eax, dword [edi]
push eax
call fcn.00407230
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x4814de
mov eax, dword [edi]
cmp eax, dword [esp + 0x10]
je 0x4814de
push 0x8000
push 0
mov eax, dword [esp + 0x18]
push eax
call fcn.00407238
inc ebx
jmp 0x48157a
cmp dword [esp + 0x10], 0
jne 0x481583
push 0x1c
lea eax, [esp + 0x40]
push eax
mov eax, dword [edi]
push eax
call fcn.00407248
cmp dword [esp + 0x48], 0x118
jb 0x481575
mov eax, dword [esp + 0x50]
and eax, 4
cmp eax, 4
jne 0x481575
mov eax, ebp
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
push edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x481530
cmp eax, dword [esp]
pop edx
pop eax
jne 0x481575
mov eax, ebp
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
push edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 0x114]
mov eax, dword [eax + 0x110]
cmp edx, dword [esp + 4]
jne 0x48155d
cmp eax, dword [esp]
pop edx
pop eax
jne 0x481575
mov eax, dword [edi]
add eax, 8
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004033c0
je 0x481583
inc ebx
xor eax, eax
mov dword [edi], eax
cmp ebx, 0x14
jle 0x481485
xor eax, eax
mov dword [esp + 8], eax
cmp dword [esp + 0x10], 0
je 0x481601
mov eax, dword [edi]
cmp eax, dword [esp + 0x10]
jne 0x481627
mov eax, ebp
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov ecx, dword [edi]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [edi]
add eax, 8
mov edx, dword [esp]
call fcn.00403314
mov eax, ebp
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov ecx, dword [edi]
mov dword [ecx + 0x110], eax
mov dword [ecx + 0x114], edx
mov eax, dword [edi]
mov dword [eax + 0x108], 1
mov eax, dword [edi]
add eax, 0x118
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov dword [eax], 1
jmp 0x481627
cmp dword [edi], 0
je 0x481627
mov eax, dword [edi]
inc dword [eax + 0x108]
mov eax, dword [edi]
add eax, 0x118
mov dword [esp + 8], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x108]
mov edx, dword [esp + 4]
mov dword [edx], eax
mov eax, dword [esp + 8]
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48355c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483739
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403430
lea eax, [ebp - 0x28]
push eax
call fcn.00407118
mov eax, dword [ebp - 0x14]
mov dword [0x497ff4], eax
mov eax, dword [ebp - 0xc]
mov dword [0x497ff8], eax
mov eax, dword [ebp - 0x24]
mov dword [0x497ffc], eax
mov eax, dword [0x49978c]
cmp dword [eax], 2
sete byte [0x4979a0]
push 0x483744
call fcn.004070e0
lea edx, [ebp - 4]
call fcn.00483f6c
cmp byte [0x4979a0], 0
jne 0x4835e8
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004840b0
test al, al
je 0x4835e8
mov eax, dword [ebp - 0x4c]
mov dword [0x49d7b8], eax
jmp 0x4835ef
xor eax, eax
mov dword [0x49d7b8], eax
call fcn.0048329c
and eax, 0x7f
cmp eax, 0x12
ja case.0x483600.0
jmp dword [eax*4 + 0x483607]
mov byte [0x49798c], 1
jmp case.0x483600.0
mov byte [0x497990], 1
jmp case.0x483600.0
mov byte [0x497994], 1
jmp case.0x483600.0
mov byte [0x497998], 1
jmp case.0x483600.0
mov byte [0x49799c], 1
jmp case.0x483600.0
mov byte [0x4979a4], 1
mov byte [0x4979a8], 1
jmp case.0x483600.0
mov byte [0x4979a4], 1
mov byte [0x4979ac], 1
jmp case.0x483600.0
mov byte [0x4979a4], 1
mov byte [0x4979ac], 1
mov byte [0x4979b0], 1
jmp case.0x483600.0
mov byte [0x4979b4], 1
jmp case.0x483600.0
mov byte [0x4979b8], 1
jmp case.0x483600.0
mov byte [0x4979bc], 1
jmp case.0x483600.0
mov byte [0x4979c0], 1
jmp case.0x483600.0
mov byte [0x4979c4], 1
jmp case.0x483600.0
mov byte [0x4979c8], 1
jmp case.0x483600.0
mov byte [0x4979cc], 1
jmp case.0x483600.0
mov byte [0x4979d0], 1
jmp case.0x483600.0
mov byte [0x4979d4], 1
jmp case.0x483600.0
mov byte [0x4979d8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483740
lea eax, [ebp - 4]
call fcn.00404888
ret

Function at 0x4840b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x484157
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404d58
push eax
call fcn.00407290
mov edi, eax
test edi, edi
jbe 0x484141
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404ee4
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404d58
push eax
call fcn.00407288
test eax, eax
je 0x484141
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x484168
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407298
test eax, eax
je 0x484141
cmp dword [ebp - 8], 0x34
jne 0x484141
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48415e
lea eax, [ebp - 0x10]
call fcn.00404888
ret
Function at 0x4868ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x486910
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call fcn.004070d0
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b08
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407078
mov edx, eax
pop eax
call fcn.0040b9c4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486917
lea eax, [ebp - 0xc]
call fcn.00404888
ret

Function at 0x48b1fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x48b260
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call fcn.004070d0
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b08
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407078
mov edx, eax
pop eax
call fcn.0040b9c4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b267
lea eax, [ebp - 0xc]
call fcn.00404888
ret

Function at 0x491e28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d48
mov eax, dword [ebp - 8]
call fcn.00404d48
xor eax, eax
push ebp
push 0x491f35
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403430
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov eax, dword [ebp + 8]
cmp byte [eax + 0xc], 0
je 0x491e86
mov word [ebp - 0x20], bx
jmp 0x491e8c
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x10]
call fcn.00404d58
push eax
push 0
push 0x4000030
push 0
push 0
push 0
push dword [ebp - 4]
push 0x491f4c
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00404c18
mov eax, dword [ebp - 0x64]
call fcn.00404d58
push eax
push 0
call fcn.00407000
test eax, eax
jne 0x491ef6
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x491f12
mov eax, dword [0x499558]
mov eax, dword [eax]
call fcn.0046eb4c
push 0x64
call fcn.00410edc
push 0xa
mov eax, dword [ebp - 0x60]
push eax
call fcn.00407250
test eax, eax
jne 0x491ee3
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x60]
push eax
call fcn.004070b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491f3c
lea eax, [ebp - 0x64]
call fcn.00404888
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048ac
ret