joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dec5
Capabilities:
Create thread

Disassembly:
push 0x1c
mov eax, 0x485b61
call fcn.0045e540
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 0x10], edi
test edi, edi
je 0x40deee
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
add eax, 8
add eax, edi
push eax
call esi
and dword [ebp - 4], 0
lea ebx, [edi + 8]
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x14], 1
mov byte [ebp - 4], 1
cmp byte [edi + 0x20], 0
jne 0x40dfc0
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
add eax, 8
add eax, edi
push eax
call esi
lea ecx, [edi + 0x28]
push ecx
push 0
push edi
push 0x40ddd9
push dword [ebp + 0xc]
push 0
call fcn.00466fb1
add esp, 0x18
lea ecx, [edi + 0x24]
mov esi, eax
call fcn.0040e041
mov dword [eax + 0xc], esi
lea esi, [edi + 0x24]
mov ecx, esi
call fcn.0040e041
cmp dword [eax + 0xc], 0
jne 0x40df87
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
mov eax, dword [eax + 4]
add ecx, eax
call fcn.0040d31f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x13d
push str.e:works10720_blowsnow_sourcehiethread.cpp
lea ecx, [ebp - 0x28]
call fcn.0040e1ee
push 0x4ae160
mov eax, ecx
jmp 0x40dfd1
push dword [edi + 0x28]
mov ecx, dword [ebp + 8]
push esi
mov byte [edi + 0x20], 1
call fcn.0040dc5d
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 2
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
add ecx, 4
add ecx, edi
call fcn.0040d31f
mov eax, dword [ebp + 8]
call fcn.0045e509
ret 8
push ecx
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040e322
push 0x4ae328
mov eax, ecx
push eax
call fcn.0045f309
int3
Function at 0x4106aa
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
lea edi, [esi + 4]
mov dword [ebp - 4], eax
test eax, eax
jg 0x4106d1
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
inc eax
mov dword [esi], eax
pop edi
pop esi
pop ebx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
jmp 0x410700
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
cmp ecx, ebx
jae 0x4106eb
mov ebx, ecx
jmp 0x4106f8
mov eax, ecx
sub eax, ebx
cmp eax, dword [ebp - 4]
jb 0x4106f8
cmp ecx, ebx
ja 0x41070d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x4106db
jmp 0x4106c7
push 0xffffffffffffff9c
pop eax
jmp 0x4106cc
Function at 0x417447
Capabilities:
Get disk size

Disassembly:
push 0x74
mov eax, 0x486eee
call fcn.0045e574
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0041b6f8
xor ebx, ebx
lea ecx, [ebp - 0x64]
push 0x49be78
mov dword [ebp - 4], ebx
call fcn.0041b69b
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c033
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.0041bb22
cmp dword [ebp - 0x18], ebx
jne 0x4174a1
xorps xmm0, xmm0
movlpd qword [ebp - 0x70], xmm0
mov esi, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x70]
jmp 0x417537
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
cmovae eax, dword [ebp - 0x28]
movzx eax, word [eax]
push eax
call fcn.0041b0c9
push 0x49c210
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0041b69b
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x44]
call fcn.004086f5
lea ecx, [ebp - 0x64]
call fcn.0041bb22
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x417510
xorps xmm0, xmm0
movlpd qword [ebp - 0x70], xmm0
mov esi, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x70]
jmp 0x41752f
push ebx
mov esi, 0x400
push esi
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.00482ed0
push ebx
push esi
push edx
push eax
call fcn.00482ed0
mov edi, eax
mov esi, edx
lea ecx, [ebp - 0x48]
call fcn.0041bb22
lea ecx, [ebp - 0x2c]
call fcn.0041bb22
mov eax, edi
mov edx, esi
call fcn.0045e51e
ret
Function at 0x418de0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp byte [ebx + 0x70], 0
jne 0x418ef7
push esi
push edi
push 0x64
call fcn.0045dc17
and dword [ebp - 0x30], 0
mov esi, eax
push 0
call fcn.0046265d
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x30]
pop ecx
pop ecx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1c
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
push eax
push 1
push eax
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x418e65
cmp dword [ebp - 0x28], 0
je 0x418e65
lea eax, [esi + 0x1c]
push eax
push 0x20
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0x3c
pop edi
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [edi + esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [edi + esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [edi + esi + 0xc], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov dword [edi + esi + 0x10], eax
mov dword [edi + esi + 0x14], ecx
lea ecx, [ebp - 0x2c]
call fcn.0041a612
push 0x64
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041a5c6
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041a5e5
xor ecx, ecx
lea edx, [ebx + 0x30]
and dword [edx + 4], 0
mov eax, dword [ebp + ecx*4 - 0x24]
inc ecx
mov dword [edx], eax
lea edx, [edx + 8]
cmp ecx, 8
jl 0x418ec8
push esi
call fcn.0045dbd4
push 0xe8
push dword [ebp - 0x2c]
mov byte [ebx + 0x70], 1
call fcn.0045dc09
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0045d929
leave
ret
Function at 0x419015
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x844
mov eax, 0x487322
call fcn.0045e574
mov edi, ecx
and dword [edi], 0
cmp byte [edi + 8], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
je 0x419104
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x850], 1
push 0
push eax
call fcn.0045fe80
lea eax, [esi + 4]
mov dword [ebp - 0x84c], 0x800
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41906e
mov eax, dword [eax]
lea ecx, [ebp - 0x84c]
push ecx
lea ecx, [ebp - 0x810]
push ecx
lea ecx, [ebp - 0x850]
push ecx
push 0
push eax
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test esi, esi
jne 0x4190d3
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x82c]
call fcn.0041b69b
and dword [ebp - 4], esi
lea ecx, [ebp - 0x828]
push ecx
lea ecx, [ebx + 4]
call fcn.0041e21c
lea ecx, [ebp - 0x82c]
call fcn.0041bb22
mov al, 1
jmp 0x419106
push 0x49b6ac
lea ecx, [ebp - 0x848]
call fcn.0041b69b
lea eax, [ebp - 0x844]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebx + 4]
call fcn.0041e21c
lea ecx, [ebp - 0x848]
call fcn.0041bb22
xor al, al
call fcn.0045e51e
ret 8

Function at 0x41910e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
and dword [edi], 0
cmp byte [edi + 8], 0
je 0x419164
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x419136
mov eax, dword [eax]
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [edi], eax
pop esi
jne 0x419164
mov al, 1
jmp 0x419166
xor al, al
pop edi
leave
ret 8
Function at 0x4193ad
Capabilities:
Encode data using xor

Disassembly:
push 0x1a0
mov eax, 0x487355
call fcn.0045e574
mov esi, ecx
cmp byte [esi], 0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
jne 0x4193d1
or eax, 0xffffffff
jmp 0x41954e
cmp byte [esi + 1], 0
jne 0x4193c9
test edi, edi
je 0x4193c9
cmp dword [ebp + 0xc], 0
jle 0x4193c9
test ebx, ebx
je 0x4193c9
cmp byte [edi], 4
jne 0x4193c9
lea ecx, [ebp - 0x17c]
call fcn.00436b16
lea ecx, [ebp - 0x18c]
call fcn.00436b16
cmp byte [edi], 4
jne 0x41942c
push dword [esi + 0x28]
lea edx, [edi + 1]
lea ecx, [ebp - 0x17c]
call fcn.0043795a
mov eax, dword [esi + 0x28]
lea edx, [edi + 1]
push eax
add edx, eax
lea ecx, [ebp - 0x18c]
call fcn.0043795a
pop ecx
pop ecx
lea ecx, [ebp - 0x19c]
call fcn.00436b16
lea ecx, [ebp - 0x1ac]
call fcn.00436b16
push dword [esi + 4]
lea eax, [ebp - 0x18c]
push dword [esi + 8]
lea edx, [ebp - 0x1ac]
push dword [esi + 0x18]
lea ecx, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.0041980e
add esp, 0x14
lea eax, [ebp - 0x15c]
mov ecx, esi
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00419607
lea ecx, [ebp - 0x160]
call fcn.0041a612
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x28]
test eax, eax
jle 0x4194b5
mov ecx, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
push eax
call fcn.0041a3a9
mov eax, dword [esi + 0x28]
pop ecx
lea ecx, [ebp - 0x15c]
add eax, ecx
mov ecx, esi
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.00419607
and dword [ebp - 0x164], 0
lea eax, [ebp - 0x164]
push eax
mov eax, dword [esi + 0x28]
push ebx
push dword [ebp + 0xc]
add eax, eax
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.004192b1
push dword [ebp - 0x164]
push ebx
call fcn.00419649
test al, al
je 0x419556
lea ecx, [ebp - 0x17c]
call fcn.00436191
lea ecx, [ebp - 0x18c]
call fcn.00436191
lea ecx, [ebp - 0x19c]
call fcn.00436191
lea ecx, [ebp - 0x1ac]
call fcn.00436191
mov dword [ebp - 0x168], 0xfffffffe
push 0xe8
push dword [ebp - 0x160]
call fcn.0045dc09
mov eax, dword [ebp - 0x168]
pop ecx
pop ecx
call fcn.0045e51e
ret 0xc
mov eax, dword [esi + 0x28]
lea eax, [eax*2 + 1]
add eax, edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x16c], eax
test edi, edi
jle 0x419583
mov edx, eax
mov ecx, ebx
sub edx, ebx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x419575
mov edi, dword [ebp + 0xc]
push edi
push ebx
lea ecx, [ebp - 0x160]
call fcn.0041a5c6
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0x15c]
push eax
add eax, ecx
lea ecx, [ebp - 0x160]
push eax
call fcn.0041a5c6
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x160]
call fcn.0041a5e5
lea ecx, [ebp - 0x17c]
call fcn.00436191
lea ecx, [ebp - 0x18c]
call fcn.00436191
lea ecx, [ebp - 0x19c]
call fcn.00436191
lea ecx, [ebp - 0x1ac]
call fcn.00436191
mov edx, dword [ebp - 0x16c]
lea esi, [ebp - 0x30]
add edx, edi
xor ecx, ecx
mov eax, dword [esi + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x41952c
inc ecx
cmp ecx, 8
jne 0x4195f0
jmp 0x419536
Function at 0x41a63c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [edx + 1]
push esi
movzx esi, byte [edx]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 2]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 3]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 5]
push edi
mov edi, ecx
xor esi, 0xa3b1bac6
movzx ecx, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0x94], esi
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
xor ecx, 0x56aa3350
mov dword [ebp - 0x90], ecx
movzx ecx, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
xor ecx, 0x677d9197
mov dword [ebp - 0x8c], ecx
movzx ecx, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
xor ecx, 0xb27022dc
xor esi, esi
mov dword [ebp - 0x88], ecx
mov ecx, dword [esi + 0x49bcb8]
xor ecx, dword [ebp + esi - 0x90]
xor ecx, dword [ebp + esi - 0x88]
xor ecx, dword [ebp + esi - 0x8c]
mov eax, ecx
shr eax, 0x18
movzx edx, byte [eax + 0x49bbb8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x49bbb8]
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x49bbb8]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + 0x49bbb8]
or edx, eax
mov ecx, edx
mov eax, edx
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [ebp + esi - 0x94]
xor ecx, edx
mov dword [ebp + esi - 0x84], ecx
mov dword [esi + edi], ecx
add esi, 4
cmp esi, 0x80
jb 0x41a700
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045d929
leave
ret
Function at 0x41a79a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push 0x80
push 0
push eax
mov esi, edx
mov dword [ebp - 0xa8], edi
mov ebx, ecx
call fcn.0045fe80
movzx ecx, byte [esi]
lea edi, [ebp - 0x8c]
movzx eax, byte [esi + 1]
add esp, 0xc
shl ecx, 8
sub edi, ebx
or ecx, eax
mov dword [ebp - 0x98], 0x20
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
mov dword [ebp - 0x94], ecx
movzx ecx, byte [esi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
mov dword [ebp - 0x90], ecx
movzx ecx, byte [esi + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
mov dword [ebp - 0x8c], ecx
movzx ecx, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xf]
shl ecx, 8
lea esi, [ebp - 0x88]
or ecx, eax
sub esi, ebx
mov dword [ebp - 0x88], ecx
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x94]
sub eax, ebx
sub ecx, ebx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x84]
sub ecx, ebx
mov dword [ebp - 0xa0], ecx
mov ecx, dword [eax + ebx]
xor ecx, dword [edi + ebx]
xor ecx, dword [esi + ebx]
xor ecx, dword [ebx]
mov eax, ecx
shr eax, 0x18
movzx edx, byte [eax + 0x49bbb8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x49bbb8]
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x49bbb8]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + 0x49bbb8]
or edx, eax
mov ecx, edx
mov eax, edx
rol eax, 0xa
ror ecx, 0xe
xor ecx, eax
mov eax, edx
ror eax, 8
xor ecx, eax
mov eax, edx
rol eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x9c]
xor ecx, dword [eax + ebx]
mov eax, dword [ebp - 0xa0]
xor ecx, edx
sub dword [ebp - 0x98], 1
mov dword [eax + ebx], ecx
lea ebx, [ebx + 4]
mov eax, dword [ebp - 0xa4]
jne 0x41a8aa
mov edi, dword [ebp - 0xa8]
mov ecx, dword [ebp - 8]
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ecx
shr eax, 8
mov byte [edi + 2], al
mov byte [edi + 3], cl
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 0x18
mov byte [edi + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, ecx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], cl
mov ecx, dword [ebp - 0x10]
mov eax, ecx
shr eax, 0x18
mov byte [edi + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 9], al
mov eax, ecx
shr eax, 8
mov byte [edi + 0xa], al
mov byte [edi + 0xb], cl
mov ecx, dword [ebp - 0x14]
mov eax, ecx
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edi + 0xf], cl
mov ecx, dword [ebp - 4]
mov byte [edi + 0xe], al
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0045d929
leave
ret
Function at 0x41a9c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test eax, eax
jl 0x41aae3
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], ebx
jg 0x41a9ed
test ebx, ebx
je 0x41aae2
push esi
push edi
cmp edx, 1
jne 0x41aa70
mov edx, dword [ebp + 0x10]
lea eax, [ecx + 4]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
sub edx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edi
mov esi, edi
mov ecx, eax
push 0x10
sub esi, eax
pop edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
sub edi, 1
jne 0x41aa17
mov edi, dword [ebp - 8]
mov edx, edi
mov ecx, dword [ebp - 0x14]
push edi
call fcn.0041a79a
mov edx, dword [ebp - 0xc]
mov esi, edi
mov edi, dword [ebp + 0x10]
sub edx, 0x10
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0xc], edx
pop ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
add edi, 0x10
add ebx, 0xfffffff0
mov dword [ebp - 8], edi
adc esi, 0xffffffff
mov dword [ebp - 4], esi
test esi, esi
jg 0x41aa0e
jl 0x41aae0
test ebx, ebx
jne 0x41aa0e
jmp 0x41aae0
mov eax, dword [ebp + 0x10]
add ecx, 4
mov ebx, dword [ebp + 0x18]
sub eax, ebx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov esi, edx
lea edi, [ebp - 0x24]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a79a
pop ecx
mov ecx, dword [ebp - 0xc]
push 0x10
pop edx
mov al, byte [ecx + ebx]
xor byte [ebx], al
inc ebx
sub edx, 1
jne 0x41aa9d
mov edi, dword [ebp + 0x10]
lea esi, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
sub ecx, 0x10
mov eax, dword [ebp - 8]
add edx, 0x10
mov dword [ebp - 0xc], ecx
add eax, 0xfffffff0
mov ecx, dword [ebp - 4]
movsd dword es:[edi], dword [esi]
adc ecx, 0xffffffff
mov dword [ebp - 4], ecx
test ecx, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jg 0x41aa87
jl 0x41aae0
test eax, eax
jne 0x41aa87
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41bc7d
Capabilities:
Get geographical location

Disassembly:
push 0x4b4
mov eax, 0x4876e5
call fcn.0045e5e2
mov esi, ecx
test esi, esi
jne 0x41bc9a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
jne 0x41bcaf
or eax, 0xffffffff
jmp 0x41be2e
push 8
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push 0xb
push esi
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41bcd1
push 0xfffffffffffffffe
jmp 0x41be2d
lea eax, [ebp - 0x1c]
push eax
call fcn.0046d0bc
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41be2b
cmp ebx, 0xfde8
je 0x41be2b
cmp ebx, 0xfde9
je 0x41be2b
movzx eax, bx
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41be2b
push 0x40
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.0045fe80
add esp, 0xc
lea eax, [ebp - 0xb0]
push 0x40
push 0
push eax
call fcn.0045fe80
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x814
cmp si, ax
lea eax, [ebp - 0x70]
jne 0x41bd78
push str.Norwegian_Nynorsk
push 0x40
push eax
call fcn.0046d0e6
add esp, 0xc
push 0x40
lea eax, [ebp - 0xb0]
push eax
push 0x1002
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41bd92
push 0xfffffffffffffffb
jmp 0x41be2d
push 0x40
push eax
push 0x1001
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41bd58
push 0xfffffffffffffffc
jmp 0x41be2d
push 0xa
push 0x10
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.0046b88a
push 0x400
lea eax, [ebp - 0x4b0]
push 0
push eax
call fcn.0045fe80
add esp, 0x1c
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x70]
push eax
push str._s__s._s_n
lea eax, [ebp - 0x4b0]
push 0x3fc
push eax
call fcn.0040a2d2
and dword [ebp - 4], 0
lea eax, [ebp - 0x4b0]
add esp, 0x14
lea ecx, [ebp - 0x4c0]
push eax
call fcn.0041ae18
push eax
lea eax, [ebp - 0x4b8]
mov byte [ebp - 4], 1
push eax
call fcn.0044d8be
pop ecx
pop ecx
lea ecx, [ebp - 0x4b8]
call fcn.0040a5ef
lea ecx, [ebp - 0x4c0]
call fcn.0040a5ef
xor eax, eax
jmp 0x41be2e
push 0xfffffffffffffffd
pop eax
call fcn.0045e52f
ret

Function at 0x41ceca
Capabilities:
Query environment variable

Disassembly:
push 0x828
mov eax, 0x4879ec
call fcn.0045e574
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x830]
push eax
mov dword [ebp - 0x834], esi
call fcn.0041d42b
and dword [ebp - 4], 0
lea eax, [ebp - 0x814]
push 0x802
push 0
push eax
call fcn.0045fe80
add esp, 0xc
lea ecx, [ebp - 0x814]
cmp dword [ebp - 0x818], 8
lea eax, [ebp - 0x82c]
cmovae eax, dword [ebp - 0x82c]
push 0x400
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
test eax, eax
je 0x41cf43
lea eax, [ebp - 0x814]
push eax
call fcn.0041b69b
jmp 0x41cf4f
lea eax, [ebp - 0x830]
push eax
call fcn.0041b6f8
lea ecx, [ebp - 0x830]
call fcn.0041bb22
mov eax, esi
call fcn.0045e51e
ret 4
Function at 0x41ff6a
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0x17c
mov eax, 0x487e97
call fcn.0045e574
mov esi, edx
mov edi, ecx
call fcn.00404281
push esi
lea ecx, [ebp - 0x164]
call fcn.0041b6f8
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x150], ebx
jne 0x420001
mov esi, 0x100
lea eax, [ebp - 0x114]
push esi
push ebx
push eax
call fcn.0045fe80
add esp, 0xc
lea eax, [ebp - 0x114]
push esi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x41ffcb
or ebx, 0xffffffff
jmp 0x4200f3
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.0041b5c1
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x160]
call fcn.0041e21c
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], bl
call fcn.0041bb22
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x184], 2
lea eax, [ebp - 0x148]
movlpd qword [ebp - 0x178], xmm0
push eax
lea ecx, [ebp - 0x164]
movlpd qword [ebp - 0x170], xmm0
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x168], ebx
call fcn.0041bac9
cmp dword [ebp - 0x134], 0x10
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x188]
push ecx
lea eax, [ebp - 0x148]
cmovae eax, dword [ebp - 0x148]
push ebx
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 4], 2
test eax, eax
jne 0x4200e8
mov esi, dword [ebp - 0x168]
test esi, esi
je 0x4200e8
mov eax, dword [esi + 0x18]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x4200cd
push eax
lea ecx, [ebp - 0x130]
call fcn.0041b5c1
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 5
push eax
mov ecx, edi
call fcn.004042d5
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 2
call fcn.0041bb22
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x420090
cmp dword [ebp - 0x168], esi
je 0x4200e8
push dword [ebp - 0x168]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
lea ecx, [ebp - 0x148]
call fcn.004019a2
lea ecx, [ebp - 0x164]
call fcn.0041bb22
mov eax, ebx
call fcn.0045e51e
ret

Function at 0x420106
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x4b1070]
xor eax, esp
mov dword [esp + 0x194], eax
cmp byte [0x4b3340], 0
jne 0x42012d
xor eax, eax
jmp 0x42015e
lea eax, [esp]
mov byte [0x4b3340], 0
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42015b
mov eax, dword [esp]
cmp al, 2
jne 0x420155
shr eax, 8
cmp al, 2
je 0x420129
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0045d929
mov esp, ebp
pop ebp
ret