joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xdc1008], 0x8088405
inc edx
mov dword [ebx + 0xdc1008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d330
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d361
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d349
add dl, dl
jne 0x41d36c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d3bd
xor eax, eax
add dl, dl
jne 0x41d379
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d45a
add dl, dl
jne 0x41d388
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d393
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d39e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3a9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d3b3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d358
mov eax, 1
add dl, dl
jne 0x41d3cb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d3d6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3c2
sub eax, ebx
mov ebx, 1
jne 0x41d409
mov ecx, 1
add dl, dl
jne 0x41d3ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3e6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d420
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d42b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d417
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d358
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d47b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d358
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0xda4a8e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f5ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
jmp 0x41f60e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f60e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f680
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f669
test esi, esi
jbe 0x41f680
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f65b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f680
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f638
jmp 0x41f680
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f680
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xda4a95
ret
Function at 0x4207ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0xda5e07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420827
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420840
lea eax, [ebp - 0x10]
mov edx, dword [0xdc377c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420853
lea eax, [ebp - 0x10]
mov edx, dword [0xdc377c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42085f
adc edx, 0
mov edx, dword [edx*4 + 0xdc2568]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4209d9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4209cc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4209cc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42096a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42096a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42096a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42096a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4209cc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4209cc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4209f1
inc ebx
cmp ebx, 0x19
jne 0x420819
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xda5e0e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x40623d
Capabilities:
Get number of processors

Disassembly:
call 0x40623d
add byte [edi], dh
push eax
inc ecx
dec eax
inc ebx
dec ecx
add esp, 4
sub ecx, 0x13276
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xc80]
mov dword [ebp - 0x16cc], eax
push esi
sub esi, 0x154ba
push esp
add dword [eax], eax
sub esi, 0x76ab
jmp 0x406272
sub esi, 0xe848
pop esi
push eax
push ebx
add esp, 4
add eax, 0xd99d
jmp 0x40628d
pop eax
mov dword [ebp - 0x2240], 0xffffffff
push esi
add esi, 0x1e92
and esi, 0x6f7d
sub esi, 0x9226
sub esi, 0x4636
pop esi
push edi
push ecx
add esp, 4
add edi, 0x88a9
sub edi, 0x11d9a
and edi, 0x67fd
pop edi
mov ecx, dword [ebp - 0x420]
Function at 0x406490
Capabilities:
Get number of processors

Disassembly:
sub ebx, 0xf013
pop ebx
mov eax, dword [ebp - 0xb50]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xb4c]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x4064b9
mov dword [ebp - 0x169c], 1
jmp 0x4064c3
mov dword [ebp - 0x169c], 0xffffffff
mov ecx, dword [ebp - 0x169c]
mov dword [ebp - 0xd40], ecx
jmp 0x406535
mov edx, dword [ebp - 0x7b0]
add edx, 1
mov dword [ebp - 0x7b0], edx

Function at 0x4064f0
Capabilities:
Get number of processors

Disassembly:
xor al, 0x4c
xor eax, 0x8104c483
mul dword [esi - 0x30]
add byte [eax], al
add edi, 0x102a6
pop edi
mov edx, dword [ebp - 0xd3c]
sub edx, 1
mov dword [ebp - 0xd3c], edx
mov eax, dword [ebp - 0xb50]
add eax, 1
mov dword [ebp - 0xb50], eax
mov ecx, dword [ebp - 0xb4c]
add ecx, 1
mov dword [ebp - 0xb4c], ecx
jmp 0x406410

Function at 0x4064f3
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
xor al, 0x4c
xor eax, 0x8104c483
mul dword [esi - 0x30]
add byte [eax], al
add edi, 0x102a6
pop edi
mov edx, dword [ebp - 0xd3c]
sub edx, 1
mov dword [ebp - 0xd3c], edx
mov eax, dword [ebp - 0xb50]
add eax, 1
mov dword [ebp - 0xb50], eax
mov ecx, dword [ebp - 0xb4c]
add ecx, 1
mov dword [ebp - 0xb4c], ecx
jmp 0x406410
Function at 0x406b9a
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x6c
mov word [ebp - 0x189a], cx
xor edx, edx
mov word [ebp - 0x1898], dx
push edx
sub edx, 0x9b37
call 0x406b9a
add byte [ebp + 0x3e], cl
dec ecx
cmp al, 0x34
dec ecx
xor al, 0x83
les eax, [edx + ebx*2]
push esi
xor esi, 0x16830
sub esi, 0x6b47
add esi, 0x113fb
and esi, 0x4e85
pop esi
mov byte [ebp - 0x8fc], 0x4c
mov byte [ebp - 0x8fb], 0x6f
test dword [0x6ffffff7], eax
Function at 0x4075f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
or eax, 0x4766
pop eax
push eax
sub eax, 0x9581
and eax, 0xc71f
pop eax
push eax
push esi
add esp, 4
or eax, 0x162bc
sub eax, 0x134e7
sub eax, 0x9411
pop eax
lea edx, [ebp - 0x1844]
mov dword [ebp - 0xd64], edx
mov eax, dword [ebp - 0x54c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd60], ecx
xor edx, edx
mov word [ebp - 0x230], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edi
push edx
add esp, 4
xor edi, 0xabec
add edi, 0xa587
sub edi, 0x17d50
or edi, 0x8efc
pop edi
push esi
push ecx
add esp, 4
or esi, 0x6d6
pop esi
push eax
and eax, 0x156f7
pop eax
mov ecx, dword [ebp - 0xd60]
mov dx, word [ecx]
mov word [ebp - 0x111a], dx
mov eax, dword [ebp - 0xd60]
add eax, 2
mov dword [ebp - 0xd60], eax
mov cx, word [ebp - 0x111a]
mov word [ebp - 0x230], cx
mov edx, dword [ebp - 0xd64]
mov ax, word [edx]
mov word [ebp - 0x111c], ax
mov ecx, dword [ebp - 0xd64]
add ecx, 2
mov dword [ebp - 0xd64], ecx
mov dx, word [ebp - 0x111c]
mov word [ebp - 0x34], dx
push ecx
or ecx, 0x15908
sub ecx, 0xa954
pop ecx
push esi
push edx
add esp, 4
add esi, 0x4c61
and esi, 0x5971
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x1089b
or ebx, 0x60ed
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x407638
movzx ecx, word [ebp - 0x230]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1700], ecx
jmp 0x407692
movzx eax, word [ebp - 0x230]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x407560
movzx edx, word [ebp - 0x230]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x407560
movzx ecx, word [ebp - 0x230]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x40767c
mov dword [ebp - 0x16fc], 0xffffffff
jmp 0x407686
mov dword [ebp - 0x16fc], 1
mov eax, dword [ebp - 0x16fc]
mov dword [ebp - 0x1700], eax
cmp dword [ebp - 0x1700], 0
jne 0x4076db
push edi
push esi
add esp, 4
and edi, 0x509f
or edi, 0x1072b
and edi, 0x569e
add edi, 0xcb49
pop edi
push esi
push ebx
add esp, 4
xor esi, 0x1658f
jmp 0x4076cc
pop esi
mov ecx, dword [ebp - 0x54c]
mov dword [ebp - 0x324], ecx
jmp 0x407743
push eax
push esi
add esp, 4
or eax, 0x13cd1
pop eax
push edi
add edi, 0x182cc
add edi, 0x153c8
pop edi
push ecx
push eax
add esp, 4
add ecx, 0x6963
add ecx, 0x12f0f
xor ecx, 0x1114c
pop ecx
mov edx, dword [ebp - 0x54c]
mov eax, dword [edx]
mov dword [ebp - 0x54c], eax
mov ecx, dword [ebp - 0x54c]
cmp ecx, dword [ebp - 0xd68]
je 0x407739
mov edx, dword [ebp - 0x54c]
cmp dword [edx + 0x30], 0
jne 0x407504
mov dword [ebp - 0x324], 0
Function at 0x407d93
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0xd78], 0
jne 0x407daf
mov dword [ebp - 0x33c], 0
jmp 0x407ffa
mov ecx, dword [ebp - 0xd78]
mov dword [ebp - 0x554], ecx
push edx
push edx
add esp, 4
and edx, 0x70f2
pop edx
push edx
push eax
add esp, 4
jmp 0x407dd2
pop edx
push edi
add edi, 0xe891
xor edi, 0x1b07
or edi, 0x10221
and edi, 0x16caa
pop edi
lea edx, [ebp - 0x1844]
mov dword [ebp - 0xd74], edx
mov eax, dword [ebp - 0x554]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd70], ecx
xor edx, edx
mov word [ebp - 0x234], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
push edi
add esp, 4
and eax, 0xeea6
and eax, 0xb9dd
jmp 0x407e2e
add eax, 0x7ae4
pop eax
push ebx
and ebx, 0xece6
add ebx, 0x8802
add ebx, 0x11684
pop ebx
mov ecx, dword [ebp - 0xd70]
mov dx, word [ecx]
mov word [ebp - 0x111e], dx
mov eax, dword [ebp - 0xd70]
add eax, 2
mov dword [ebp - 0xd70], eax
mov cx, word [ebp - 0x111e]
mov word [ebp - 0x234], cx
mov edx, dword [ebp - 0xd74]
mov ax, word [edx]
mov word [ebp - 0x1120], ax
mov ecx, dword [ebp - 0xd74]
add ecx, 2
mov dword [ebp - 0xd74], ecx
mov dx, word [ebp - 0x1120]
mov word [ebp - 0x38], dx
push edi
push ebx
add esp, 4
call 0x407eb3
add byte [edi + 0x40], al
inc ebx
aaa
dec ebx
xor dh, byte [ebx]
push eax
add esp, 4
jmp 0x407ebf
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x74c8
sub ebx, 0x63fb
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x407eef
movzx ecx, word [ebp - 0x234]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1718], ecx
jmp 0x407f49
movzx eax, word [ebp - 0x234]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407e17
movzx edx, word [ebp - 0x234]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407e17
movzx ecx, word [ebp - 0x234]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x407f33
mov dword [ebp - 0x1714], 0xffffffff
jmp 0x407f3d
mov dword [ebp - 0x1714], 1
mov eax, dword [ebp - 0x1714]
mov dword [ebp - 0x1718], eax
cmp dword [ebp - 0x1718], 0
jne 0x407f92
push eax
push ecx
add esp, 4
or eax, 0x7eb7
pop eax
push esi
push ecx
add esp, 4
or esi, 0x161e2
or esi, 0xbbda
or esi, 0x264d
pop esi
push ecx
xor ecx, 0x152bc
and ecx, 0x552b
pop ecx
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x33c], ecx
jmp 0x407ffa
push esi
sub esi, 0x17ed6
jmp 0x407f9f
and esi, 0x4265
pop esi
push ebx
push ebx
add esp, 4
and ebx, 0x24ca
add ebx, 0x103a3
sub ebx, 0x12f04
sub ebx, 0x1773d
pop ebx
mov edx, dword [ebp - 0x554]
mov eax, dword [edx]
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [ebp - 0xd78]
je 0x407ff0
mov edx, dword [ebp - 0x554]
cmp dword [edx + 0x30], 0
jne 0x407dbb
mov dword [ebp - 0x33c], 0
Function at 0x407eb3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0xd78], 0
jne 0x407daf
mov dword [ebp - 0x33c], 0
jmp 0x407ffa
mov ecx, dword [ebp - 0xd78]
mov dword [ebp - 0x554], ecx
push edx
push edx
add esp, 4
and edx, 0x70f2
pop edx
push edx
push eax
add esp, 4
jmp 0x407dd2
pop edx
push edi
add edi, 0xe891
xor edi, 0x1b07
or edi, 0x10221
and edi, 0x16caa
pop edi
lea edx, [ebp - 0x1844]
mov dword [ebp - 0xd74], edx
mov eax, dword [ebp - 0x554]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd70], ecx
xor edx, edx
mov word [ebp - 0x234], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
push edi
add esp, 4
and eax, 0xeea6
and eax, 0xb9dd
jmp 0x407e2e
add eax, 0x7ae4
pop eax
push ebx
and ebx, 0xece6
add ebx, 0x8802
add ebx, 0x11684
pop ebx
mov ecx, dword [ebp - 0xd70]
mov dx, word [ecx]
mov word [ebp - 0x111e], dx
mov eax, dword [ebp - 0xd70]
add eax, 2
mov dword [ebp - 0xd70], eax
mov cx, word [ebp - 0x111e]
mov word [ebp - 0x234], cx
mov edx, dword [ebp - 0xd74]
mov ax, word [edx]
mov word [ebp - 0x1120], ax
mov ecx, dword [ebp - 0xd74]
add ecx, 2
mov dword [ebp - 0xd74], ecx
mov dx, word [ebp - 0x1120]
mov word [ebp - 0x38], dx
push edi
push ebx
add esp, 4
call 0x407eb3
add byte [edi + 0x40], al
inc ebx
aaa
dec ebx
xor dh, byte [ebx]
push eax
add esp, 4
jmp 0x407ebf
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x74c8
sub ebx, 0x63fb
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x407eef
movzx ecx, word [ebp - 0x234]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1718], ecx
jmp 0x407f49
movzx eax, word [ebp - 0x234]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407e17
movzx edx, word [ebp - 0x234]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407e17
movzx ecx, word [ebp - 0x234]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x407f33
mov dword [ebp - 0x1714], 0xffffffff
jmp 0x407f3d
mov dword [ebp - 0x1714], 1
mov eax, dword [ebp - 0x1714]
mov dword [ebp - 0x1718], eax
cmp dword [ebp - 0x1718], 0
jne 0x407f92
push eax
push ecx
add esp, 4
or eax, 0x7eb7
pop eax
push esi
push ecx
add esp, 4
or esi, 0x161e2
or esi, 0xbbda
or esi, 0x264d
pop esi
push ecx
xor ecx, 0x152bc
and ecx, 0x552b
pop ecx
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x33c], ecx
jmp 0x407ffa
push esi
sub esi, 0x17ed6
jmp 0x407f9f
and esi, 0x4265
pop esi
push ebx
push ebx
add esp, 4
and ebx, 0x24ca
add ebx, 0x103a3
sub ebx, 0x12f04
sub ebx, 0x1773d
pop ebx
mov edx, dword [ebp - 0x554]
mov eax, dword [edx]
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [ebp - 0xd78]
je 0x407ff0
mov edx, dword [ebp - 0x554]
cmp dword [edx + 0x30], 0
jne 0x407dbb
mov dword [ebp - 0x33c], 0
Function at 0x42dda0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f3150
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52a6ec]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x18], 0
cmp dword [ebp + 4], 0
jne 0x42ddf3
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea esi, [ebp + 0x44]
push 0
push eax
call edi
cmp eax, 0xffffffff
je 0x42de15
cmp eax, dword [esi + 0x4c]
jbe 0x42de15
mov eax, 1
jmp 0x42de17
xor eax, eax
mov dword [esp + 0x28], 0xffffffff
test eax, eax
je 0x42de44
mov ecx, dword [esi + 8]
push 0
push ecx
call edi
cmp eax, 0xffffffff
je 0x42de39
mov ebx, eax
call fcn.004564d0
jmp 0x42de3b
xor eax, eax
mov edx, dword [esi]
mov dword [ebp + 4], edx
test eax, eax
je 0x42dddd
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431d50
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax + 0x14], 8
push esi
jb 0x431d5b
mov ecx, dword [eax]
jmp 0x431d5d
mov ecx, eax
mov edx, dword [eax + 0x10]
lea edx, [ecx + edx*2]
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x431d82
lea esp, [esp]
movzx esi, word [ecx]
imul eax, eax, 0x1000193
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x431d70
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.004cd152
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x431dac
add eax, 0x7fffffff
pop esi
ret
Function at 0x432880
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebp
push edi
mov edi, eax
mov ecx, dword [edi + 4]
mov eax, dword [esp + 0x14]
lea ebp, [edi + 4]
cmp eax, dword [ecx]
jne 0x4328b1
cmp edx, ecx
jne 0x4328b1
call fcn.00432b50
mov eax, dword [ebp]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
pop ebp
pop ecx
ret 0xc
cmp eax, edx
je 0x43297e
push ebx
push esi
jmp 0x4328c0
mov edx, dword [eax]
mov esi, eax
mov dword [esp + 0x1c], edx
cmp dword [esi + 0x1c], 0x10
jb 0x4328d3
mov ecx, dword [esi + 8]
jmp 0x4328d6
lea ecx, [esi + 8]
mov edx, dword [esi + 0x18]
add edx, ecx
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x4328f4
movzx ebx, byte [ecx]
imul eax, eax, 0x1000193
inc ecx
xor eax, ebx
cmp ecx, edx
jne 0x4328e4
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.004cd152
imul edx, edx, 0x41a7
imul eax, eax, 0xb14
add esp, 8
sub edx, eax
jns 0x43291d
add edx, 0x7fffffff
mov ecx, dword [edi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [edi + 0x24], eax
ja 0x432932
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [edi + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x43295b
cmp dword [ecx], esi
jne 0x432953
mov edx, dword [ebp]
mov dword [ecx], edx
mov ecx, dword [edi + 0x10]
mov edx, dword [ebp]
mov dword [ecx + eax*8 + 4], edx
jmp 0x432963
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x432963
cmp dword [ecx], esi
jne 0x432963
mov edx, dword [esi]
mov dword [ecx], edx
push esi
push ebp
lea ebx, [esp + 0x18]
call fcn.00432c10
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x20]
jne 0x4328c0
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], eax
mov eax, ecx
pop ebp
pop ecx
ret 0xc

Function at 0x432bb0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax + 0x14], 0x10
push esi
jb 0x432bbb
mov ecx, dword [eax]
jmp 0x432bbd
mov ecx, eax
mov edx, dword [eax + 0x10]
add edx, ecx
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x432be0
jmp 0x432bd0
movzx esi, byte [ecx]
imul eax, eax, 0x1000193
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x432bd0
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.004cd152
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x432c0a
add eax, 0x7fffffff
pop esi
ret
Function at 0x43ca50
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4f2c30
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x52a6ec]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov esi, dword [edi + 4]
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
call ebx
cmp eax, 0xffffffff
je 0x43ca9d
cmp eax, dword [esi + 0x4c]
jbe 0x43ca9d
mov eax, 1
jmp 0x43ca9f
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
test eax, eax
je 0x43cada
mov esi, dword [edi + 4]
mov ecx, dword [esi + 8]
push 0
push ecx
call ebx
cmp eax, 0xffffffff
je 0x43cac6
mov ebx, eax
call fcn.004564d0
test eax, eax
jne 0x43cada
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
mov edx, dword [edi + 4]
mov eax, dword [edx]
mov dword [edi + 0x48], eax
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x448bd0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [0x52a6ec]
xor eax, esp
mov dword [esp + 0x14], eax
push 0xa
xor eax, eax
lea ecx, [esp + 4]
push ecx
push 0x5a
push 0x400
mov word [esp + 0x10], ax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x448c23
xor al, al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004c9392
add esp, 0x18
ret
push 2
lea edx, [esp + 4]
push 0x50a1a4
push edx
call fcn.004cd416
mov ecx, dword [esp + 0x20]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.004c9392
add esp, 0x18
ret