joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b63e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4b6400
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4b8970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x4b8b2d
call fcn.004b8986
Function at 0x50dc80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x50dd8c
test eax, eax
je 0x50dd8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x528ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x50dd73
lea edi, [eax + 4]
jmp 0x50dcd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x50dcec
mov dword [ebp - 4], 2
jmp 0x50dd0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x50dd03
mov dword [ebp - 4], 1
jmp 0x50dd0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x50dd83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x50dd46
mov byte [ecx], 0x3d
jmp 0x50dd52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x50dd5d
mov byte [ecx], 0x3d
jmp 0x50dd63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x50dcd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6d954d
Capabilities:
Write file on windows

Disassembly:
wait
cmc
mov dword [ebp - 4], 0
stc
cmp byte [ebp - 0x1e21], 0
jmp 0x61c235
push esi
jmp 0x72ccbf
call fcn.004547f0
mov dword [ebp - 0x1e50], eax
push 0
cmovs dx, sp
bswap dx
cwd
mov edx, dword [ebp - 0x1e50]
mov ax, 0x33cb
bswap eax
push edx
cmove eax, ebp
xchg al, ah
push 0x4c9
cwde
cmovl ax, bx
cbw
mov eax, dword [0x5007b0]
push eax
call dword [0x4c25ac]
call dword [0x4c236c]
wait
mov dword [ebp - 4], 0xfffffffe
jmp 0x73faab
fmul dword [ebp - 0x1e40]
jmp 0x5dc4eb
je 0x72ccce
mov eax, dword [ebp - 0x1e34]
mov ecx, 0x73a7185
setb ch
movsx cx, bl
push eax
push 1
not ch
mov ecx, 0x1217892
mov ecx, dword [ebp - 0x1e3c]
jmp 0x717258
fstp dword [ebp - 0x1e40]
fild dword [0x5007bc]
jmp 0x60fd0a
push edx
jmp 0x6fe453
jne 0x6de5af
mov eax, dword [ebp - 0x1e30]
jmp 0x7897ca
call dword [0x4c2418]
call fcn.0041f740
test eax, eax
jne 0x6cd845
cmp dword [ebp - 0x1e3c], eax
je 0x6cd845
mov ecx, dword [ebp - 0x1e38]
cmp edi, dword [ecx]
jmp 0x6cd83f
call fcn.00432e5c
add esp, 4
jmp 0x70ece2
test ecx, ecx
jmp 0x6c31a1
cmp esi, 0x8000
jle 0x6ba3f5
mov esi, 0x8000
cmp ecx, 0x602640ae
test edi, edi
jmp 0x78d050
jge 0x6c31af
fadd dword [0x4eac30]
test edx, ebx
mov dword [ebp - 0x1e40], eax
fild dword [ebp - 0x1e40]
test eax, eax
jmp 0x7438bb
jmp 0x6cd845
jne 0x4212b8
test ebx, ebx
jmp 0x41d25b
push 0x6834bf81
call fcn.005f62b8
cmovo dx, cx
push esi
movsx edx, cx
not esi
mov esi, dword [ebp - 0x1e28]
movzx dx, ah
lea edx, [edi + esi]
jmp 0x65cf12
cmp byte [ebp - 0x1e21], 0
jmp 0x6144fb
mov dword [ebp - 4], 0xfffffffe
jmp 0x6cc479
push ebx
call dword [0x500c20]
test eax, eax
jmp 0x667b92
mov dword [ebp - 0x1e28], 0
wait
jmp 0x6e7737
push ecx
jmp 0x5592ef
call fcn.00450440
lea esp, [esp + 0x10]
sub edx, 0x740a4a77
add edi, dword [ebp - 0x1e3c]
mov dword [ebp - 0x1e64], edi
and si, si
mov edx, dword [ebp - 0x1e38]
mov al, bl
mov eax, dword [edx]
movzx esi, ax
adc esi, ebp
cmovns si, si
mov esi, eax
sub esi, edi
stc
jmp 0x6ba3de
push 5
jmp 0x67a2ca
jge 0x7438c7
fadd dword [0x4eac30]
fdivp st(1)
jmp 0x65750a
call 0x6b5b55
mov ecx, dword [ebp - 0x1e2c]
and dx, bp
mov dword [ecx], eax
cmp edi, esp
mov edx, dword [ebp - 0x1e38]
mov dword [edx], 0
test esi, esi
je 0x70ece2
push esi
jmp 0x67e67d
mov dword [eax], 9
jmp 0x762022
jbe 0x5dc4f6
mov ecx, edi
mov dword [ebp - 0x1e40], ecx
cmc
cmp edx, ebp
fild dword [ebp - 0x1e40]
cmc
jmp 0x69d674
Function at 0x703838
Capabilities:
Parse pe header

Disassembly:
mov byte [ebp - 0x110], 0x6d
mov byte [ebp - 0x10f], 0x61
jmp 0x40d36c
mov byte [ebp - 0x1d], 0x6e
jmp 0x6e0232
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
jmp 0x74487a
push ebx
jmp 0x567d6c
mov byte [ebp - 0x7a], 0x70
jmp 0x59a267
mov byte [ebp - 0x20], 0x6b
mov byte [ebp - 0x1f], bl
jmp 0x57f8bf
push esi
push edi
call 0x6021ef
lea eax, [ebp - 0x10]
jmp 0x78556d
mov byte [ebp - 0x1e], 0x72
jmp 0x551e41
jne 0x5e788e
pop edi
or si, ax
pop esi
sub eax, eax
and ecx, 0x377e3c81
cmc
pop ebx
stc
mov ecx, dword [ebp - 4]
cmc
xor ecx, ebp
call fcn.0044fddd
mov esp, ebp
jmp 0x626312
mov byte [ebp - 0x79], 0x56
jmp 0x6e6491
test eax, eax
jmp 0x75e625
mov byte [ebp - 0xc], 0x6c
jmp 0x552330
pop ebp
jmp 0x44d55f
mov byte [ebp - 0x117], 0x72
jmp 0x6da6f5
mov byte [ebp - 0x17], 0x64
jmp 0x71d9be
mov byte [ebp - 0x73], 0x53
jmp 0x71a32d
call edi
test esi, esi
jmp 0x5959dd
mov byte [ebp - 0x71], 0x63
mov byte [ebp - 0x70], 0x74
jmp 0x78b6fe
mov byte [ebp - 0x1b], 0x6c
jmp 0x73aad6
push eax
push esi
jmp 0x6d1dfe
mov byte [ebp - 0x11c], 0x4e
mov byte [ebp - 0x11b], 0x74
jmp 0x6d4d4c
mov byte [ebp - 0x11a], 0x51
jmp 0x6d84ef
mov byte [ebp - 0x18], 0x2e
jmp 0x693711
mov byte [ebp - 0x119], 0x75
mov byte [ebp - 0x118], bl
jmp 0x654b70
mov byte [ebp - 0x116], 0x79
mov byte [ebp - 0x115], 0x49
mov byte [ebp - 0x114], 0x6e
jmp 0x75e5c1
push esi
jmp 0x740a57
mov byte [ebp - 0x1c], bl
jmp 0x6c9958
mov byte [ebp - 0x74], 0x66
jmp 0x6a50fd
mov byte [ebp - 0x78], 0x69
jmp 0x77b370
mov byte [ebp - 0x19], 0x32
jmp 0x6d76bb
push ebp
mov eax, 0x24e502c5
mov ebp, esp
stc
cbw
xor al, 0x3d
sub esp, 0x11c
or ax, sp
add ah, 0x43
neg al
mov eax, dword [0x4f65e8]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x553b95
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
jmp 0x5408ca
mov byte [ebp - 0x72], bl
jmp 0x6b527c
mov byte [ebp - 0x75], 0x4f
jmp 0x6e48ba
mov byte [ebp - 0x6d], 0x6e
jmp 0x75d0f1
mov byte [ebp - 0x16], 0x6c
jmp 0x742517
call edi
mov dword [0x500c7c], eax
cmc
test eax, eax
jmp 0x75a3fc
mov byte [ebp - 0x6e], 0x6f
jmp 0x71b042
mov byte [ebp - 0x1a], 0x33
jmp 0x6fa4e6
mov byte [ebp - 0x80], 0x4e
mov byte [ebp - 0x7f], 0x74
mov byte [ebp - 0x7e], 0x55
mov byte [ebp - 0x7d], 0x6e
mov byte [ebp - 0x7c], 0x6d
mov byte [ebp - 0x7b], 0x61
jmp 0x557efb
call edi
lea ecx, [ebp - 0x20]
mov bl, 0x65
mov esi, 0x39b50bde
push ecx
not si
movzx esi, ax
mov esi, eax
jmp 0x560e14
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0
jmp 0x6ab26b
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
jmp 0x762e3a
mov byte [ebp - 0x76], 0x77
jmp 0x71a36f
je 0x5959e3
lea eax, [ebp - 0x11c]
jmp 0x6d0845
mov byte [ebp - 0x6c], 0
jmp 0x72c5f7
mov byte [ebp - 0x113], 0x66
jmp 0x71a11b
je 0x5959e3
call 0x761964
lea edx, [ebp - 0x80]
push edx
jmp 0x6de518
mov byte [ebp - 7], 0
jmp 0x741465
mov byte [ebp - 0x77], bl
jmp 0x756a60
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x6c
jmp 0x5fc924
push eax
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x74
jmp 0x784163
mov byte [ebp - 0x6f], 0x69
jmp 0x732da2
Function at 0x775d95
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
call esi
push eax
jmp 0x78224d
call fcn.00419420
push 0
call fcn.0045119d
push 0xc
shld edx, ebx, 0x15
cwd
xor eax, eax
mov dx, di
xchg dh, dh
lea edx, [ebp - 0xf68]
jmp 0x5cc66b
push edx
jmp 0x752ae7
cmp byte [ecx], 0xe9
jmp 0x6d743d
je 0x719aad
push eax
jmp 0x5600b9
mov dword [ebp - 0xf68], 0
mov dword [ebp - 0xf64], eax
mov dword [ebp - 0xf60], eax
jmp 0x72046e
call 0x761712
mov esi, dword [0x4c2410]
jmp 0x6ff223
push eax
jmp 0x71ac1c
push 0x91cd5c00
call fcn.0072f0e2
jl 0x57c234
mov esi, dword [ebp - 0xf24]
jmp 0x57c228
call 0x7515f2
mov ecx, dword [ebp - 0xf64]
mov eax, dword [ebp - 0xf68]
btr di, 0x5b
add edi, 0x12aa5aec
lea edi, [ecx + eax]
shr cl, 0x5f
mov ecx, dword [0x500c10]
test esp, 0x2f8a5bbc
jmp 0x6a8fe8

Function at 0x7964ec
Capabilities:
Read file on windows
Write file on windows

Disassembly:
call fcn.00402980
mov ecx, dword [0x5007b0]
add esp, 8
jmp 0x65829a
push edi
push 0x4c8
jmp 0x786802
mov byte [0x500779], 0
jmp 0x50e6ca
lea edx, [ebp - 0xf20]
jmp 0x6e24a1
jne 0x5e0aac
push 0xa00000
jmp 0x76932d
call fcn.0044fddd
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x781d72
push edi
jmp 0x559de6
mov dword [ebp - 4], edi
jmp 0x79ca43
push eax
jmp 0x6f452d
push edx
jmp 0x769cf6
cmp dword [0x5009e8], edi
jmp 0x606354
call 0x582892
test eax, eax
je 0x787adc
mov byte [0x500779], 1
jmp 0x6eac68
call fcn.004270c0
push 0x4e9e48
jmp 0x72d117
mov edx, 0x5007d0
jmp 0x42dab8
push edi
jmp 0x68c011
jne 0x5e0aac
push str.Cant_Optimize_Resource_File.
push str._s_Error:0x00000006
mov dh, 0x14
cdq
not edx
mov edx, 0x5007d0
jmp 0x5be7bf
push cs
invalid
out 0xff, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004272b0
push edi
jmp 0x714138
call fcn.00432e51
add esp, 4
test bl, al
cmp cx, bp
mov dword [0x5009e8], eax
test ax, sp
cmc
cmp eax, edi
jmp 0x74b291
call fcn.004274a0
mov edx, 0x501dd8
jmp 0x662d3f
ret
push ecx
call dword [0x4c25ac]
call 0x6c89fc
push 6
mov esi, eax
bswap edi
mov edi, 0x4e9e34
call fcn.0041c320
add esp, 4
jmp 0x787adc
lea esp, [ebp - 0xf68]
bt bx, 0x80
mov ecx, dword [ebp - 0xc]
sal bh, cl
sbb ebx, 0x3dd642ad
mov dword fs:[0], ecx
cmc
shl ecx, 0x9d
ror ebx, cl
pop ecx
pop edi
xadd ebx, ecx
pop esi
cmp ebx, 0x425179b8
sal cl, cl
test ch, 0x43
pop ebx
sal ecx, cl
ror ecx, 0x16
btr ecx, 0xa6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
jmp 0x6465d6
push ebp
add al, 3
rol al, 0x18
mov ebp, esp
sbb al, 0x86
sar ah, cl
push 0xffffffffffffffff
stc
push 0x4c087e
mov eax, dword fs:[0]
push eax
sub ax, 0x7c3a
sbb eax, 0x4f38562b
sub esp, 0xf4c
adc eax, ebp
btr eax, 0x3e
mov eax, dword [0x4f65e8]
stc
test edx, ebp
cmc
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
test ah, 0x6c
cmp si, 0xa0a
push eax
dec ah
xor eax, 0xe304f68
btr eax, ecx
lea eax, [ebp - 0xc]
clc
stc
mov dword fs:[0], eax
shl al, 0xff
mov eax, dword [0x501dd0]
sub edi, edi
jmp 0x746fe9
call fcn.00427250
lea eax, [ebp - 0xf20]
push eax
jmp 0x74c951
Function at 0x98c000
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushfd
call fcn.0098c037
mov ebx, eax
test eax, eax
je 0x98c0c4
push ebx
call fcn.0098c061
test eax, eax
je 0x98c0c4
call fcn.0098c0ce
add ebx, 4
push ebx
call eax
test eax, eax
je 0x98c0cb
jmp 0x98c0c4
popfd
popal
jmp 0x7bf892
popfd
popal
ret

Function at 0x98c037
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ecx
xor ecx, ecx
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp word [edi + 0x18], cx
jne 0x98c04c
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x98c061
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push edx
push ecx
push esi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
dec ecx
je 0x98c0b7
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x64616f4c
cmp dword [esi], eax
jne 0x98c07d
mov eax, 0x7262694c
cmp dword [esi + 4], eax
jne 0x98c07d
mov eax, 0x41797261
cmp dword [esi + 8], eax
jne 0x98c07d
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
jmp 0x98c0b9
xor eax, eax
pop ebx
pop esi
pop ecx
pop edx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x417704
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x1c
lea eax, [ebp - 0x1c]
mov edi, edx
push eax
push ecx
call dword [0x44f28c]
mov esi, dword [ebp - 0x18]
push 0x1000
push esi
call dword [0x44f288]
test eax, eax
jne 0x417765
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417765
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
jne 0x417765
mov edx, dword [ecx + esi + 0xd8]
lea eax, [edx + esi]
cmp edi, eax
jb 0x417765
mov eax, dword [ecx + esi + 0xdc]
add eax, edx
add eax, esi
cmp edi, eax
jae 0x417765
mov al, 1
jmp 0x417767
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417923
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x462340]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x46234c]
test edx, edx
jne 0x41796c
test eax, eax
je 0x41797f
mov edx, eax
mov dword [0x462340], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x41797f
cmp ecx, ebx
jb 0x41797f
cmp ecx, edi
jbe 0x417a65
invalid

Function at 0x417ab6
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov ecx, dword [0x46234c]
push esi
mov esi, 0x46234c
test ecx, ecx
je 0x417b1b
push edi
cmp dword [ecx], 0x52727464
jne 0x417b11
lea edi, [ecx + 0x10000]
xor eax, eax
lea edx, [ecx + 0x88]
cmp dword [edx], 0
je 0x417aea
cmp dword [edx], ecx
jb 0x417b11
cmp dword [edx], edi
jae 0x417b11
inc eax
add edx, 0x48
cmp eax, 0x38d
jb 0x417add
mov eax, dword [ecx + 4]
push 0x8000
push 0
push ecx
mov dword [esi], eax
call dword [0x44f1c4]
and dword [0x462340], 0
jmp 0x417b14
lea esi, [ecx + 4]
mov ecx, dword [esi]
test ecx, ecx
jne 0x417ac7
pop edi
pop esi
ret

Function at 0x417aca
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov ecx, dword [0x46234c]
push esi
mov esi, 0x46234c
test ecx, ecx
je 0x417b1b
push edi
cmp dword [ecx], 0x52727464
jne 0x417b11
lea edi, [ecx + 0x10000]
xor eax, eax
lea edx, [ecx + 0x88]
cmp dword [edx], 0
je 0x417aea
cmp dword [edx], ecx
jb 0x417b11
cmp dword [edx], edi
jae 0x417b11
inc eax
add edx, 0x48
cmp eax, 0x38d
jb 0x417add
mov eax, dword [ecx + 4]
push 0x8000
push 0
push ecx
mov dword [esi], eax
call dword [0x44f1c4]
and dword [0x462340], 0
jmp 0x417b14
lea esi, [ecx + 4]
mov ecx, dword [esi]
test ecx, ecx
jne 0x417ac7
pop edi
pop esi
ret
Function at 0x43627d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop es
push dword [esi - 1]
call 0x6a441294
pop es
push dword [esi + 0x28]
call fcn.00437f13
pop edi
add byte [eax], al
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x3c]
test dword [eax + 0x6a00f0], esp
push esi
push 0x1e
pop ecx
add byte [ebp - 0x46db0206], bl
xchg esi, eax
add byte [eax], al
add byte [edx], dl
add byte [ecx + 0x5224fdfa], dl
push dword [esi + 8]
mov dword [ebx + 0x7189c151], ecx
add al, 0x40
adc al, 0x8b
or eax, 0
add byte [eax], al
add byte [eax], al
sbb al, 0xeb
add cl, bl
lea eax, [esp]
and al, 1
adc eax, ebp
add byte [eax], al
add byte [esp + eax], cl
add byte [eax + 0xf002478], al
add ch, cl
add dword [ecx], edx
call 0x8b448355
sub ebp, ebx
pop es
cmp dword [eax + 8], ebx
je 0x4362f9
adc dword [ecx], eax
mov bl, 4
add dword [ecx], edx
call 0xa6436389
sbb eax, 0x83fffffc
inc dword [edi + 0x75]
adc ecx, dword [ecx + 0x6a01208b]
add byte [ebx + 0x6a0120a3], al
push 0
inc edi
push 0xffe791e8
dec dword [ebx - 0x4c7697b1]
and byte [ecx], al
push 0x6a
adc al, 0x75
or ecx, dword [ebx - 0x4cc6dbbc]
in al, 0
adc eax, ebp
jle 0x436397
lea edi, [ebx - 0x17eeff20]
add byte [eax], al
add byte [eax], al
dec edi
and bh, ch
and al, 4
add byte [eax + eax], al
je 0x4363b7
sbb byte [ecx + 0x7583c350], cl
cmp eax, 0
cmp ah, byte [edx]
std
and al, 0x51
add ah, dh
add al, 0
add al, 0x38
push edx
invalid
mov dword [ebx + 0x6a0120], ecx
je 0x436410
sbb byte [ecx + 0xf000000], cl
mov cs, word [edx]
add dword [ecx], edx
call 0x8b44c018
sub ebp, ebx
pop es
cmp dword [eax + 8], ebx
je 0x4363bc
and bl, byte [edi*2 + 0x4a8d0400]
sbb al, 0x7d
add byte [ecx*4 - 0x17afd7b6], al
dec edx
sub byte [eax - 0x18], dl
mov ch, 0xed
add dword [ebx - 0x17eefee0], esi
mov eax, dword [eax]
add dword [ebx - 0x17eefefc], esi
call 0x3f793b
inc dword [ebx + 0x137547ff]
mov dword [ebx + 0x6a0128], ecx
and dword [ebx + 0x6a6a0128], 0
inc edi
push 0xffe791e8
dec dword [ebx + 0xcff684f]
mov dword [ebx + 0x6a6a0128], esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sbb dword [ecx + 0x6a01288b], ecx
add bh, bh
mov ebp, eax
out dx, al
scasd eax, dword es:[edi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
sal dword [ebp + 0x50020000], 1
push dword [esp + 0x10]
adc byte [ebx + 0x6a0124], dh
and dword [ebx + 0x6a6a0124], 0
inc edi
add byte [eax], al
sldt word [eax]
add byte [eax], dl
mov dh, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 4], al
test eax, eax
je 0x43644c
push esp
pop es
add dword [eax], eax
mov dword [ebx + 0x54], eax
or dword [ecx + 0x6a0124bb], 0
add byte [eax], al
lock add byte [edx], ch
call 0xca420263
mov edi, esp
push edx
adc byte [eax], al
mov ebx, 0x6a00f0
adc byte [ebx + 0x6a0124], dh
add byte [eax], al
add byte [eax], al
add byte [ebp], al
add byte [eax], dl
push edi
sbb byte [esp + 0x10], dh
mov dword [esp + 0x14], esi
sbb al, 0x74
and al, 0x10
adc byte [ebp + 0x891024], cl
add byte [eax], al
add byte [ebx], al
je 0x436493
add byte [eax], dh
add bl, cl
Function at 0x43940d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [eax], al
mov ecx, 0xe68605c
push cs
push 6
mov dword [eax + 0x74], ecx
lock xchg dword [eax - 0x77000000], ebx
dec eax
js 0x439413
xchg dword [eax - 0x77000000], ebx
dec eax
jl 0x439414
in eax, dx
fisttp word [esi + edi + 0x40]
dec eax
mov ecx, ebp
loopne 0x439482
inc eax
invalid
xchg dword [eax + eax - 0x50180000], ebx
push ebx
cld
add byte [eax - 0x71], al
Function at 0x4022d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x441630]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x402311
push 0x433ab8
push 4
push eax
call fcn.0041f697
push eax
call fcn.00401e97
add esp, 0x10
jmp 0x402323
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40238e
push edi
call fcn.0041faf6
mov edi, dword [eax]
call fcn.0041faf6
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.0041fa9c
add esp, 0x18
mov ebx, eax
call fcn.0041faf6
cmp dword [eax], 0
je 0x40236e
call fcn.0041faf6
push dword [eax]
call fcn.00402072
pop ecx
jmp 0x402375
call fcn.0041faf6
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x40238e
cmp ebx, esi
jae 0x40238e
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x402390
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d4c0
leave
ret
Function at 0x40ac12
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40ac55
call fcn.0040b501
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40ac55
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40ac70
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040a7cc
test ebx, ebx
mov esi, eax
je 0x40ac6e
test edi, edi
je 0x40ac6e
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40d559
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40d587
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d5a5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040d4c3
jmp 0x40d5a5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40d5a5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0040d4c3
test edi, edi
mov eax, edi
jne 0x40d58f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x444940]
test ecx, ecx
je 0x40d668
jmp 0x40d558
ret 8

Function at 0x41d4c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441630]
jne 0x41d4ca
repz ret
jmp fcn.00422bcf