joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029c2
Capabilities:
Read file on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, dword [0x404100]
jl 0x402a01
mov eax, esi
add eax, 0xa
mov dword [0x404100], eax
mov edx, eax
inc edx
shl edx, 4
push edx
push dword [0x4040fc]
push 8
push dword [0x405038]
call sub.KERNEL32.DLL_HeapReAlloc
mov dword [0x4040fc], eax
push esi
call fcn.0040292c
push 0x405050
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x402ada
push 0
lea eax, [ebp - 0x20]
push eax
push 2
lea eax, [ebp - 2]
push eax
push edi
call sub.KERNEL32.DLL_ReadFile
push edi
call sub.KERNEL32.DLL_CloseHandle
mov edi, dword [0x4040fc]
mov edx, esi
shl edx, 4
add edi, edx
mov dword [0x4040f4], edi
cmp word [ebp - 2], 0x4d42
jne 0x402aa9
push 0x10
push 0
push 0
push 0
push dword [ebp + 0xc]
push 0
call sub.USER32.DLL_LoadImageA
mov ebx, eax
or eax, eax
je 0x402ada
lea eax, [ebp - 0x1a]
push eax
push 0x18
push ebx
call sub.GDI32.DLL_GetObjectA
mov eax, dword [0x4040f4]
mov dword [eax], ebx
mov edx, dword [ebp - 0x16]
mov word [eax + 4], dx
mov edx, dword [ebp - 0x12]
mov word [eax + 6], dx
movzx edx, word [ebp - 8]
mov word [eax + 8], dx
jmp 0x402ada
push 0x10
push 0
push 0
push 1
push dword [ebp + 0xc]
push 0
call sub.USER32.DLL_LoadImageA
mov ebx, eax
or eax, eax
je 0x402ada
mov eax, dword [0x4040f4]
mov dword [eax], ebx
mov word [eax + 4], 0
mov word [eax + 6], 0
mov word [eax + 8], 0
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x402e34
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x402e68
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x402e83
mov edi, eax
inc edi
jmp 0x402e60
inc edi
cmp byte [edi], 0x20
je 0x402e5f
jmp 0x402e83
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x402e74
cmp eax, 0x20
jne 0x402e67
jmp 0x402e77
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x402e83
cmp eax, 0x20
je 0x402e76
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.0040123c
pop edi
leave
ret
Function at 0x1073d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1073d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1073d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1073d06a
add dl, dl
jne 0x1073d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1073d0dc
xor eax, eax
add dl, dl
jne 0x1073d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1073d17d
add dl, dl
jne 0x1073d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1073d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1073d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1073d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1073d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1073d075
mov eax, 1
add dl, dl
jne 0x1073d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1073d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1073d0e1
sub eax, ebx
mov ebx, 1
jne 0x1073d128
mov ecx, 1
add dl, dl
jne 0x1073d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1073d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1073d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1073d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1073d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1073d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1073d136
cmp eax, 0x7d00
jae 0x1073d16d
cmp eax, 0x500
jb 0x1073d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1073d075
cmp eax, 0x7f
ja 0x1073d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1073d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1073d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1073d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x5b81ca
Capabilities:
Encode data using xor

Disassembly:
inc edx
jle 0x5b81e9
invalid
invalid
invalid
movsd dword es:[edi], dword [esi]
jecxz 0x5b818b
pop edi
aaa
aaa
lahf
std
dec ebp
invalid
Function at 0x402ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x402df0
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x402d14
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402d95
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x402d00
mov dword [esp], eax
mov ebx, eax
call fcn.004035d0
test eax, eax
mov edi, eax
je 0x402e17
mov eax, dword [0x4063a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004036d0
add eax, dword [edi + 0xc]
mov edx, dword [0x4063a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402df7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402d8e
sub eax, 4
and eax, 0xfffffffb
jne 0x402da0
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402d8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00403af0
lea esi, [esi]
xor esi, esi
jmp 0x402d1e
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00403af0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00403af0
mov esi, esi
lea edi, [edi]

Function at 0x403250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x4032a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40329e
test esi, esi
je 0x40329e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403280
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403af0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00403ac0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00403ac0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
xor eax, 0xcf2f0142
das
aad 0xc
xor eax, 0xc6990838
invalid
xchg esp, eax
shr byte [edi], cl
add esp, eax
mov ebx, 0x5ac186ab
mov byte [0xca104317], al
lodsd eax, dword [esi]
aaa
mov bl, 0x90
jnp 0x415434
movsb byte es:[edi], byte [esi]
lcall 0x7838, 0x34e6452f
pop ebx
push 0xffffffffffffff8c
shl ecx, 0xce
loope 0x4153d1
mov bl, byte [bp + di + 0x72]
xchg dword [ecx - 0x6ed035e6], esi
movsb byte es:[edi], byte [esi]
xor eax, 0x35002938
cmp byte [esi], bh
jecxz 0x415401
mov bh, reloc.shlwapi.dll_PathFileExistsA
pop ebx
and dh, byte [esi]
mov esp, 0x20e35a4
pop ebx
retf 0xc1c7
rcr dword [ebx - 0x36], 0xc7
movsb byte es:[edi], byte ds:[esi]
xor eax, 0xca5bc138
invalid
Function at 0x40ebf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x5d2470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x5d246c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x5d2470], edx
cmp eax, 0x26f
jl 0x40ebf8
mov dword [0x564fa0], 0x270
ret

Function at 0x40ec30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x5d2474]
mov ebx, dword [eax*4 + 0x5d2470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d2aa4]
mov dword [eax*4 + 0x5d2470], edx
cmp eax, 0xe2
jl 0x40ec38
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x5d2474]
mov ebx, dword [eax*4 + 0x5d2470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x5d20e4]
mov dword [eax*4 + 0x5d2470], edx
cmp eax, 0x26e
jl 0x40ec88
mov edx, dword [0x5d2470]
mov ecx, dword [0x5d2e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x5d2aa0]
mov dword [0x5d2e2c], eax
mov dword [0x564fa0], 0
pop ebx
ret

Function at 0x40ed10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x564fa0]
add dword [0x564fa0], 1
mov eax, dword [0x5d1020]
cmp eax, dword [0x5646f0]
jne 0x40ed33
cmp ebx, 0x271
jb 0x40ed54
mov eax, dword [0x5d1020]
call fcn.0040ebf0
not dword [0x5d1020]
mov eax, dword [0x5d1020]
mov dword [0x5646f0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40ed70
call fcn.0040ec30
xor ebx, ebx
mov dword [0x564fa0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x5d2470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x4108c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x564440]
cmp ax, 0xcb
je 0x4109cc
cmp ax, 0xcc
je 0x4109cc
lea esi, [esi]
mov edx, dword [0x5d3070]
test edx, edx
je 0x4108f5
mov eax, dword [0x5d2f20]
call edx
mov ebx, eax
jmp 0x4108fa
mov ebx, 0x5d2f24
cmp word [0x5d2f10], 0
jle 0x410920
mov eax, 0x5d2ef0
call fcn.00410b30
mov eax, ebx
call fcn.00410480
mov eax, ebx
call fcn.004104f0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410942
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x41093d
mov edx, edi
mov eax, ebx
call fcn.0040f8f0
jmp 0x410940
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410928
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x5d2f10], 0
jle 0x4109cc
mov edx, 0x5d2e30
mov eax, ebx
call fcn.0040fa30
mov edi, eax
test edi, edi
je 0x41099c
mov eax, dword [0x5d2ec4]
mov dword [edi + 0xc], eax
cmp dword [0x5d2ec4], 0
je 0x410990
mov eax, dword [0x5d2ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x5d2ec4], eax
nop
sub word [0x5d2f10], 1
cmp word [0x5d2f10], 0
sete bl
mov eax, 0x5d2ef0
call fcn.00410b50
test bl, bl
je 0x4109cc
mov eax, 0x5d2ef0
call fcn.00410b20
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x4130c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.004130a0
push ebp
push 0x414440
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x4131ea
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b4c0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x41314f
mov edx, 0x5d22f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x4131a1
call sub.kernel32.dll_GetLastError
call fcn.00403fc0
lea eax, [ebp - 0x10]
call fcn.0040a0a0
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040a540
mov edx, dword [ebp - 0x14]
mov ecx, 0x580314
lea eax, [ebp - 0x10]
call fcn.0040a3d0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040ad90
jmp 0x413238
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x4131ba
cmp eax, ecx
je 0x4131c4
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040b4c0
cmp byte [0x5646c0], 0
jne 0x413238
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040ba60
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040ae20
lea esi, [esi]
jmp 0x413238
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040b4c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x41320e
mov eax, 0x5d22f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5646c0], 0
jne 0x413238
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040ba60
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040ae20
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004130a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4135d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5d2260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.004137b0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5d2260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403530
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5644c0], eax
mov ebx, eax
jmp 0x413773
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x413658
cmp byte [ebx], 0
je 0x41377c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x4136d3
mov al, byte [ebx]
cmp al, 1
jb 0x4136c8
sub al, 0x20
jbe 0x413698
sub al, 2
je 0x4136ac
jmp 0x4136c8
mov al, byte [ebp - 0x114]
test al, al
je 0x4136d8
add dword [ebp - 0x110], 1
jmp 0x4136d0
cmp byte [ebx + 1], 0x22
je 0x4136c3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4136d0
add ebx, 1
jmp 0x4136d0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413688
test dword [ebp - 0x10c], 0xffffffff
je 0x41376c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.004137b0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5d2260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413763
mov al, byte [ebx]
cmp al, 1
jb 0x413758
sub al, 0x20
jbe 0x413728
sub al, 2
je 0x41373c
jmp 0x413758
mov al, byte [ebp - 0x114]
test al, al
je 0x413768
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413760
cmp byte [ebx + 1], 0x22
je 0x413753
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413760
add ebx, 1
jmp 0x413760
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413718
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41365b
mov ebx, dword [ebp - 0x10c]
mov dword [0x5d2250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5d2260
call fcn.00410700
mov eax, dword [0x5d2260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416e40
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov dx, 0xffff
lea esi, [esi]
add dx, 1
movsx eax, dx
mov ecx, eax
xor bx, bx
lea esi, [esi]
add bx, 1
mov eax, ecx
and eax, 1
je 0x416e71
mov eax, ecx
shr eax, 1
xor eax, 0xedb88320
mov ecx, eax
jmp 0x416e73
shr ecx, 1
cmp bx, 8
jl 0x416e58
movzx eax, dx
mov dword [eax*4 + 0x5f4d00], ecx
cmp dx, 0xff
jl 0x416e48
pop ebx
ret

Function at 0x416e90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov esi, ecx
cmp dword [0x5f4d04], 0
jne 0x416ea8
call fcn.00416e40
nop
mov ecx, edi
not ebx
mov eax, ebx
cmp esi, 1
jl 0x416edc
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov dl, al
xor dl, byte [ecx]
and edx, 0xff
mov edi, eax
shr edi, 8
xor edi, dword [edx*4 + 0x5f4d00]
mov eax, edi
add ecx, 1
cmp esi, ebx
jg 0x416eb8
mov esi, esi
not eax
pop edi
pop esi
pop ebx
ret
Function at 0x42a260
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x42a30a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x42a326
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x42a326
sub dx, 0x20
je 0x42a300
sub dx, 0x80
je 0x42a300
sub dx, 0x1f62
jb 0x42a326
sub dx, 1
jbe 0x42a300
sub dx, 6
je 0x42a300
sub dx, 0x26
jne 0x42a326
nop
jmp 0x42a300
cmp eax, dword [ebp - 0x20]
jg 0x42a2a8
lea esi, [esi]
jmp 0x42a326
cmp dword [ebp - 0x1c], 2
jne 0x42a31a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x42a326
mov al, byte [ebp - 0xc]
call fcn.0040b120
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x42a3a4
sub ax, 0x21
je 0x42a3b8
sub ax, 0x17
je 0x42a3c4
sub ax, 0x222
je 0x42a3d0
sub ax, 0x392
je 0x42a3d8
sub ax, 1
je 0x42a3e0
sub ax, 0x1996
je 0x42a3e8
sub ax, 1
je 0x42a3f0
sub ax, 6
je 0x42a3f8
sub ax, 0xb
je 0x42a408
sub ax, 0x1b
je 0x42a400
sub ax, 0x367
je 0x42a410
jmp 0x42a418
mov ax, word [ebp - 0x24]
call fcn.0040b1c0
mov byte [ebp - 0x10], al
jmp 0x42a420
mov byte [ebp - 0x10], 0x20
jmp 0x42a420
mov byte [ebp - 0x10], 0x2e
jmp 0x42a420
mov byte [ebp - 0x10], 0x27
jmp 0x42a420
mov byte [ebp - 0x10], 0x2c
jmp 0x42a420
mov byte [ebp - 0x10], 0x27
jmp 0x42a420
mov byte [ebp - 0x10], 0x20
jmp 0x42a420
mov byte [ebp - 0x10], 0x20
jmp 0x42a420
mov byte [ebp - 0x10], 0x20
jmp 0x42a420
mov byte [ebp - 0x10], 0x20
jmp 0x42a420
mov byte [ebp - 0x10], 0x2d
jmp 0x42a420
mov byte [ebp - 0x10], 0x27
jmp 0x42a420
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret