joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f3ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x541cbc
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f4b4
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x541cbc
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53b997
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f55a
cmp edi, dword [esi + 0x7c]
jge 0x42f55a
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443dfe
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443dfe
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541cbc
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541cbc
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f4ac
jmp 0x42f47c
call fcn.00448025
int3

Function at 0x4458f4
Capabilities:
Encode data using xor

Disassembly:
int3
sub eax, 0x6522c0b9
dec ebp
jmp 0xe1946247
xchg esi, eax
jb 0x4458cd
adc byte [ebp - 0x6d], al
inc ebp
insb byte es:[edi], dx
in eax, 7
and bl, byte [esi]
push esi
out 0x3d, ax
xor ch, byte [esi - 0x4c2741ff]
loope 0x4458fc
push ebp
and eax, 0x3c82199d
test eax, 0xe2bafe01
mov eax, dword [0x85442812]
jge 0x4458e7
insb byte es:[edi], dx
push esp
cli
clc
xor dword [edi + 0x2c], esi
push eax
push es
stosd dword es:[edi], eax
popfd
sbb al, byte [edx - 0x1a]
movsd dword es:[edi], dword [esi]
mov esp, 0xf2918042
and dword [eax], ebp
rcr byte [ebp - 0x6a], cl
adc esp, dword [edx + 0x34]
adc byte [ebp + eax*2 - 0x2b], dh
pushfd
inc edi
lcall 0x6f25, 0x42e7a581
add cl, byte [eax + esi*4]
invalid
Function at 0x44602c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]

Function at 0x446073
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5588fc
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4460f4
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5588fc
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5525d7
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x44619a
cmp edi, dword [esi + 0x7c]
jge 0x44619a
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045aa3e
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045aa3e
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5588fc
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5588fc
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4460ec
jmp 0x4460bc
call fcn.0045ec65
int3

Function at 0x45aa3e
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
xchg dword [ebp + ebx*2 + 0x72], esp
or dh, bl
stosb byte es:[edi], al
push ds
pop edi
pop edi
pop esi
invalid
jo 0x45aa20
cmpsb byte [esi], byte es:[edi]
fcom st(1)
jl 0x45a973
invalid
imul ebp, edi, 0xfc4b2c04
push edi
out dx, eax
push cs
mov al, byte [0xff2a049d]
push 0xffffffffffffffff
cmpsd dword [esi], dword es:[edi]
or eax, 0x80ec23a9
test eax, 0xcbd11f7a
pop ss
push ss
std
mov al, 0xf9
push 0xca9de7ac
jmp 0x45a9cf
Function at 0x45cc8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38

Function at 0x473c8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0058655c
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473d54
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0058655c
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00580237
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473dfa
cmp edi, dword [esi + 0x7c]
jge 0x473dfa
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0048869e
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048869e
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0058655c
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0058655c
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473d4c
jmp 0x473d1c
call fcn.0048c8c5
int3
Function at 0x48b00c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059d8dc
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48b0d4
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059d8dc
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005975b7
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48b17a
cmp edi, dword [esi + 0x7c]
jge 0x48b17a
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049fa1e
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049fa1e
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d8dc
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d8dc
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48b0cc
jmp 0x48b09c
call fcn.004a3c45
int3
Function at 0x4b818a
Capabilities:
Encode data using xor

Disassembly:
fimul word [ebx - 0x3d]
xor byte [esi - 0x18], al
out 0x66, eax
out 0x66, eax
dec ecx
xchg esp, eax
xlatb
mov edx, ss
sub al, 0xad
imul esi, esi, 3
aas
jl 0x4b8106
ret 0xd9c2
call 0xbb80cefd
daa
je 0x4b8166
pop esp
mov cl, 0x65
in al, dx
mov byte [edx + 0x68], al
or dword [ebx - 0x4cf1223b], ecx
xor ah, bl
fstp dword [edx]
add eax, 0xe27cc87a
jl 0x4b8126
pushal
and eax, 0xd7ebf894
add cl, byte [ebx + edx*8 - 0x785c71cf]
add dl, byte [edi]
cmp ch, al
cmp esp, dword [esp + edx*4 - 0x3859585c]
push 0xffffffffffffffb3
mov eax, 0x1807aa2d
adc byte [ebx - 0xa8703f8], al
cld
js 0x4b815e
pop ebp
mov eax, 0x6556436
in al, dx
cmpsb byte [esi], byte es:[edi]
mov dh, 0x9a
daa
test byte [ebx], al
mov ecx, 0xa326c837
xor eax, ebp
enter 0x5bf6, 0x4b
push 0x2d
xor dword [edx + edi*2], ecx
add al, 0x34
cmpsd dword [esi], dword es:[edi]
xor al, 0xa7
aad 0xe3
or dword [esi + esi*4], 0x9603d496
jecxz 0x4b810d
or al, 0xb6
xchg esi, eax
aam 3
xchg esi, eax
mov al, 0x90
sub byte [eax], cl
xchg dword [ebp - 0x12], edx
enter 0xffffffffffffc875, 0x6a
adc esi, dword [ebx + 0x2b]
clc
mov bh, 0x79
push ds
sub dword [ecx], 0x5a
int 0x91
pop ss
lahf
fisubr word [edx - 0x1a046ab6]
sbb ebx, ecx
out 0x49, eax
push ss
aas
xor al, 0x3c
stosb byte es:[edi], al
sub al, 0x57
jns 0x4b8142
dec ecx
or al, 0x60
pop ss
mov eax, 0x493b4ad
jl 0x4b8187
xchg eax, esp
lds ebx, [ebp + 0x4569c962]
sub esi, dword [ebp - 0x1521fff1]
scasb al, byte es:[edi]
mov ch, 0x4f
pop esp
or al, 0xf
stc
pop eax
sub byte [edx + 2], bh
inc edx
cwde
xor dh, byte [ebp + 0xe]
into
and byte [edi + 0x4b16850e], 8
cmp ch, byte [eax]
jle 0x4b823b
mov esp, 0x1091b6dc
mov byte ds:[0xf00cb57c], al
mov ebp, 0xa7b5934a
lodsd eax, dword [esi]
ja 0x4b81a7
cmpsb byte gs:[esi], byte es:[edi]
aas
mov ah, 0x3b
mov ah, 0xe2
test al, 0x97
add edx, dword [esi + 0x22]
or al, 0x13
insd dword es:[edi], dx
mov edi, 0xb5fbfbac
mov al, 0x3a
dec eax
invalid
sub eax, 0x747249e5
std
in al, 0xb5
pop edi
inc edx
fist word [eax]
mov bh, 0x8d
mov byte [0x22090c10], al
salc
mov ebx, 0xbff83d77
mov ch, 0xf8
popal
or eax, 0x866674ab
or dword [esi - 0x3dd91d9c], ecx
pop esi
popal
into
mov ch, 0xea
inc esp
mov edx, 0x33d12b86
pop edx
cmpsb byte [esi], byte es:[edi]
imul ecx, dword [eax - 0x45c87c96], 0xeb191d3c
stc
inc ebx
push ds
xor bh, byte [edi - 0x124141f7]
test dword [ecx], ecx
jae 0x4b8260
loop 0x4b8288
ret 0x615e
sbb ecx, dword [ecx + edi*4]
wait
dec edx
invalid
Function at 0x4ba06d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1410
cmp edx, dword [eax]
je 0x4ba08f
add eax, 8
inc ecx
cmp eax, 0x4c14a0
jl 0x4ba080
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1410]
jne 0x4ba1bd
mov eax, dword [0x4c5db0]
cmp eax, 1
je 0x4ba197
test eax, eax
jne 0x4ba0c0
cmp dword [0x4c1338], 1
je 0x4ba197
cmp edx, 0xfc
je 0x4ba1bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba0f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baa50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004baee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba13a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004baee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf724
push edi
call fcn.004bcdb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baa50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baa60
lea eax, [ebp - 0xa0]
push 0x4bf704
push eax
call fcn.004baa60
push dword [esi + 0x4c1414]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baa60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcd24
add esp, 0x2c
pop edi
jmp 0x4ba1bd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c1414]
push 0
push eax
push dword [esi]
call fcn.004baee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
push 0x2b4f5bd0
mov edi, 0x3fe634c7
pop ecx
xor edi, ecx
mov esi, 0x46082500
mov edx, 0x38820006
xor esi, edx
xor esi, edi
mov edi, esi
mov ebx, edi
mov edi, ebx
xor edi, 0xffffffff
and edi, 0xffffffff
and ebx, 0
or ebx, edi
and ebx, 0x47cafa6a
and esi, 0xb8350595
or esi, ebx
mov ebx, 0x40c100
mov edi, 0x1080
xor ebx, edi
mov esi, dword [ebx]
mov eax, esi
add eax, 0xffffffc5
dec eax
mov ebx, dword [eax + 0x3c]
mov ecx, ebx
xor ecx, 0xffffffff
and ecx, 0xd644b80c
mov eax, 0xe381d644
inc edi
mov ebx, 0x89cb0929
fist word [edi + 0x5b]
mov eax, 0x3673a6f2
mov ecx, 0x63a3c1ba
xor ecx, eax
mov edi, 0x7d84c5d4
xor edi, 0x8d16fdd
xor edi, ecx
mov esi, 0x29749ab9
xor esi, 0x74c2b6b6
xor edi, esi
mov eax, 0x7d33e14e
xor edi, eax
mov ecx, edi
or ecx, 0
je 0x403f7f
xor edx, edx
mov dword [eax + 4], edx
xor eax, eax
mov dword [0x40c02c], eax
mov byte [0x40c033], 2
mov byte [0x40c034], 2
mov byte [0x40c035], 3
mov word [0x40c3dc], 0
mov word [0x40c3ec], 1
call fcn.0040285c
mov eax, 0x40c038
mov edx, 0x404398
call fcn.00403c25
mov eax, 0x40c204
mov edx, 0x404398
call fcn.00403c25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404391
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4030b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x452f73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, ecx
mov eax, dword [edi]
lea ebp, [edi + 0x3c]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x38]
lea eax, [esp + 0x28]
lea ebx, [esi + 0x3c]
push eax
mov ecx, ebp
mov dword [esi + 0x38], edx
mov dword [esp + 0x18], ebx
call fcn.0041f5d0
mov ebp, dword [ebp + 4]
mov edx, dword [edi + 0x3c]
xor eax, eax
sub ebp, edx
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [esp + 0x20], eax
mov dword [ebx + 8], eax
sar ebp, 3
mov byte [esp + 0x20], 1
je 0x4031c4
lea eax, [ebp*8]
cmp eax, 0x80
jbe 0x403179
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
jmp 0x4031c4
dec eax
push 0x4651b0
shr eax, 3
lea ecx, [eax*4 + 0x463ae8]
mov dword [esp + 0x14], ecx
call fcn.0040a7e0
add esp, 4
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x20], 2
mov eax, dword [ecx]
test eax, eax
je 0x4031aa
mov edx, dword [eax]
mov dword [ecx], edx
jmp 0x4031ba
lea eax, [ebp*8]
push eax
call fcn.0040e6f0
add esp, 4
mov dword [0x4651b0], 0
lea ecx, [eax + ebp*8]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov ebp, dword [esp + 0x28]
mov ecx, dword [edi + 0x40]
mov edx, dword [edi + 0x3c]
push ebp
push eax
push ecx
push edx
mov byte [esp + 0x30], 4
call fcn.0040ed30
mov dword [ebx + 4], eax
mov edx, dword [edi + 0x48]
lea eax, [edi + 0x4c]
mov dword [esi + 0x48], edx
lea ecx, [esi + 0x4c]
add esp, 0x10
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
lea edx, [esi + 0x58]
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
lea ecx, [edi + 0x58]
add edi, 0x64
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ecx + 8]
mov dword [edx + 8], ecx
mov eax, dword [edi]
lea edx, [esi + 0x64]
mov dword [esi + 0x64], eax
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x18]
pop edi
mov dword [edx + 8], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x4210e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x455608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esp + 0xb]
xor ebx, ebx
push 8
push eax
mov dword [esp + 0x1c], ebx
call fcn.00411080
mov ecx, dword [esi + 4]
mov eax, 0x3f800000
mov byte [ecx], bl
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x421180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45564e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea eax, [esp + 0xf]
xor ebx, ebx
push 8
push eax
mov dword [esp + 0x24], ebx
call fcn.00411080
mov ecx, dword [esi + 4]
mov byte [ecx], bl
lea edx, [esp + 0xf]
push ebx
push edx
lea ecx, [esi + 0x58]
mov dword [esp + 0x24], 2
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
call fcn.0040a310
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov eax, 0x3f800000
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
cmp eax, esi
mov byte [esp + 0x1c], 5
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
je 0x42127a
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov edi, dword [esi]
cmp eax, ecx
je 0x421248
cmp edi, dword [esi + 4]
je 0x421244
mov dl, byte [eax]
inc eax
mov byte [edi], dl
inc edi
cmp eax, ecx
jne 0x421233
jmp 0x421248
cmp eax, ecx
jne 0x42126c
mov ebx, dword [esi + 4]
cmp edi, ebx
je 0x42127a
mov eax, ebx
sub eax, ebx
inc eax
push eax
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [esi + 4]
sub edi, ebx
add esp, 0xc
add eax, edi
mov dword [esi + 4], eax
jmp 0x42127a
mov edx, dword [esp + 0x24]
push edx
push ecx
push eax
mov ecx, esi
call fcn.00412200
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4