joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b63a
Capabilities:
Allocate thread local storage

Disassembly:
push edi
push esi
xchg dword [ebx], esi
dec dword [ebx + 0xbca2444]
imul ecx, dword [esp + edx], 0x24548b47
adc byte [edi - 0x42], ch
neg edx
sbb eax, 0
mov edi, edi
and al, 0x5e
mov eax, 0x8b105254
inc esp
and al, 0x1c
or eax, eax
jge 0x40b5cd
inc edi
mov edx, dword [esp + 0x18]
neg eax
neg edx
adc esi, 0
lodsb al, byte [esi]
inc esp
and al, 0x1c
mov dword [esp + edx*4 + 0x73], edx
or eax, eax
jne 0x40b5e9
sal byte [ebp + 0x18], 0x8b
dec esp
and al, 0x18
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx]
and al, 0x14
xor edx, edx
jno 0x40b5ce
mov ebx, eax
mov edx, esi
and al, 0xf0
sbb ecx, esi
mov edx, ebx
jmp 0x40b62a
mov ebx, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + edx + 0x14]
mov eax, dword [esp + 0x10]
rol dword [eax - 0x152e932f], 1
rcr eax, 1
mov esp, 0xf712f0db
int1
mov eax, dword [edx]
les esp, [esp + 0x1c]
mov ebp, dword [ebx - 0x75]
inc esp
and al, 0x18
mov bl, 0xe6
add edx, ecx
jb 0x40b64d
cmp edx, dword [esp + 0x14]
ja 0x40b625
salc
pop es
cmp eax, dword [esp + 0x10]
jbe 0x40b626
dec esi
xor edx, edx
mov esp, 0x7754fc6
dec edi
jne 0x40b634
imul dword [esi - 9]
fadd dword [ebx + 0x5e5b00da]
pop ebx
pop esi
pop edi
pop edx
adc byte [eax], al
push ebp
mov ebp, esp
push 0xffffffffffffff8d
jbe 0x40b6a1
sbb dword [eax + 0x5a], eax
push 0x38b948
mov eax, dword fs:[0x57000000]
push eax
add byte [edi + 0x50], dl
mov dword fs:[eax], ecx
add byte [ebx], dh
and dword [edx], 0x20
push ebx
push esi
push edi
test al, 0x87
mov ebx, 0xfc6583
push 1
call dword [0xf40c0d0]
pop ecx
sbb bl, byte [edi + 0x414054]
inc dword [ebx - 0x42bf59f3]
add bh, bh
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xf90b7d]
jg 0x40b691
inc dword [eax + ebx*8 - 0x40]
inc eax
push cs
add ecx, ebx
xchg esp, eax
or eax, dword [ecx]
test dword [eax], 0x5812dca1
add byte [ebx + 0x4001b800], cl
inc ecx
add al, ch
lahf
add al, byte [eax]
add byte [ebx + 0x4102503d], al
add byte [eax], al
jne 0x40b6bd
push 0xc23e44
call [ebx + sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call 0xb76a32
push 0x40d00c
leave
or al, dl
inc eax
add al, ch
pop ebx
add al, byte [eax]
lcall 0x8900, 0x410b9096
inc ebp
fmul dword [ebp - 0x613b27e1]
xor eax, 0x890b8c
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x7b]
mov bh, bh
adc al, al
inc eax
add byte [eax + 0x59], ch
rol byte [eax], 1
jnp 0x40b6fc
rol byte [eax], 1
call sub.KERNEL32.dll_TlsAlloc
xchg ebx, eax
adc eax, sym.imp.MSVCRT.dll___p___initenv
mov ecx, dword [ebp - 0x20]
int3
Function at 0x68b109
Capabilities:
Encode data using xor

Disassembly:
pushal
mov byte [esp + 4], ch
jmp 0x68b580
mov dword [esp + 0x20], edi
mov dword [esp], 0x8b4294b7
call fcn.005c35d2
or esp, dword [edx + 0x79]
pop esi
cmp edi, esp
xchg edi, eax
mov ecx, 0x6f52ddd4
mov esp, 0xf93e31d5
movsd dword es:[edi], dword [esi]
adc byte [ecx + edx + 0x2c21a13e], bl
arpl ax, sp
aad 0x72
arpl word [eax], cx
add dword [ebp + 0x70f114ba], ebx
cmp dword [edx], esp
xlatb
or eax, 0xbb6f4238
cmp byte [edx + 0x6f], al
mov ebx, 0x62f32d8
fdiv dword [edx]
das
push es
movsb byte es:[edi], byte [esi]
pop edi
add eax, 0x6d4c30b
sbb ebp, dword [ecx + edi*2 - 0x59f571c3]
mov edi, 0xa7a0af84
jns 0x68b593
jl 0x68b604
das
jns 0x68b5b9
je 0x68b5ef
int1
sbb byte [edx + 0x71], ch
dec ecx
dec eax
dec esi
dec edx
cmp esi, dword [edi + 0x74]
out dx, eax
invalid
adc edi, edi
out dx, eax
out 0x3e, al
jb 0x68b5c3
out dx, al
and ecx, edi
leave
ror dl, 0xce
int3
mov dl, 0x90
nop
xchg dword [esi + 0x7b], ebx
je 0x68b65e
in al, dx
xor bl, dl
arpl word [ebx + 0x64e31ef7], sp
xchg edi, eax
out dx, al
fstp qword [esi - 0x6f]
js 0x68b605
rcl ch, 0x39
mov al, byte [0x6ae8ff95]
dec ebx
fst st(2)
arpl sp, cx
pop es
inc esi
jns 0x68b5bd
scasd eax, dword es:[edi]
invalid
or ah, byte [esi - 0x5d9bd03d]
scasd eax, dword es:[edi]
cmc
cli
test byte [ecx + 0x15], ch
mov al, 0xb1
sub byte [edi + 0x2f86c4d0], al
sbb dword [eax - 0x2df06831], 0x25
mov esi, dword [eax - 0x80]
xor cl, byte [ebx - 0x56]
ret 0x4a3a

Function at 0x6e570c
Capabilities:
Encode data using xor

Disassembly:
pushal
neg dl
jmp 0x5bcebe
or eax, 0xc0858ba7
or esp, dword [esi]
sbb esp, ecx
rcl dword [esi], 0xbf
inc esp
pushfd
je 0x5ce439
dec ebp
aam 0x6d
mov ah, 6
adc ecx, dword [ebp + 0x3e]
mov byte [0x8f669c66], al
inc esp
and al, 0x1e
pushf
pop word [esp + 0x1e]
shr dl, 5
mov dl, byte [esi]
push 0xf1e97b27
test ah, dl
xor dl, 0xfa
cli
lea esp, [esp + 0x22]
jbe 0x5cdd14
cmp dh, 0x51
cmp eax, 0x3198b08c
stc
neg dl
pushal
pushfd
clc
sub dl, 0x30
pushfd
pushfd
mov byte [esp], 0x96
ror dl, 3
test bh, bh
std
stc
stc
push word [esp + 0x2c]
popf
pushfd
pushfd
pushfd
inc esi
push dword [esp + 0xc]
call fcn.006ceb9a
jl 0x5ce40b
js 0x5ce462
push 0x969397d3
cmpsd dword [esi], dword es:[edi]
adc eax, dword [eax + ecx*4 - 0x5b]
or bh, bh
mov dword [0xae693cb0], eax
stosd dword es:[edi], eax
aas
pushal
invalid
lea esp, [esp + 0x20]
jne 0x6ceba0
pushal
jmp 0x5ce425
push eax
push dword [esp + 4]
ret 8
cmp bl, bl
stc
cmc
add dl, dl
pushal
jmp 0x68aaaf
Function at 0x6eb844
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x6eb8a5
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x6eb888
cmp edi, 2
jb 0x6eb888
cmp byte [esi], cl
jne 0x6eb888
cmp byte [esi + 1], cl
jne 0x6eb888
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4887d8]
jmp 0x6eb859
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4887d8]
test edi, edi
jne 0x6eb859
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x6eb8d4
cmp cl, 0x23
jne 0x6eb8bb
cmp byte [esi], cl
jne 0x6eb8bb
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4887d8]
test cl, cl
jne 0x6eb8ac
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x6eb9e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x6eb9f7
mov dword [ebx], 0
mov edx, 0x4882fc
call fcn.006eb8e4
mov esi, eax
test esi, esi
je 0x6ebad4
push esi
call fcn.00744f5f
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x6ebacb
push 2
push 0
push esi
call fcn.00745ab3
add esp, 0xc
test eax, eax
jne 0x6ebacb
push esi
call fcn.00744f5f
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x6ebacb
push 0
push dword [ebp + 8]
push esi
call fcn.00745ab3
add esp, 0xc
test eax, eax
jne 0x6ebacb
mov eax, dword [0x4ece60]
test eax, eax
je 0x6eba6a
inc dword [eax + 0x374]
push edi
call fcn.0074d4c4
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x6ebacb
push esi
push edi
push 1
push eax
call fcn.007488dd
add esp, 0x10
push esi
cmp eax, edi
je 0x6ebab5
call fcn.00745758
mov eax, dword [0x4ece60]
add esp, 4
test eax, eax
je 0x6ebaa3
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.00748704
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00745758
add esp, 4
test ebx, ebx
je 0x6ebac3
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.00745758
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x6f8fd4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4b8040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4ece60]
push ebx
mov dword [ebp - 8], ecx
push esi
mov ebx, dword [eax + 0x1c48]
lea esi, [ebp - 8]
push edi
mov edi, 4
mov ecx, dword [ebx + 0xfc]
mov eax, dword [ebx + 0x104]
mov eax, dword [eax + ecx*4 - 4]
not eax
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4887d8]
sub edi, 1
jne 0x6f9014
not eax
lea ecx, [ebx + 0xfc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.007088a4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0073d90b
mov esp, ebp
pop ebp
ret
Function at 0x6fe734
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x6fe77c
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x6fe763
cmp byte [esi], bl
jne 0x6fe763
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4887d8]
test bl, bl
jne 0x6fe754
mov ebx, dword [0x4ece60]
mov edi, dword [ebx + 0x3008]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x6fe7b6
not eax
cmp dword [esi], eax
je 0x6fe7c5
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x3000]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x6fe797
mov ecx, dword [ebp - 4]
call fcn.006fe654
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x711ca4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x711cda
mov eax, dword [0x4ece60]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x711cca
dec dword [eax + 0x374]
push ecx
call fcn.00748704
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x711d0e
mov eax, dword [0x4ece60]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x711cfe
dec dword [eax + 0x374]
push ecx
call fcn.00748704
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x711d42
mov eax, dword [0x4ece60]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x711d32
dec dword [eax + 0x374]
push ecx
call fcn.00748704
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x711d92
mov eax, dword [0x4ece60]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x711d82
dec dword [eax + 0x374]
push ecx
call fcn.00748704
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x711dc6
mov eax, dword [0x4ece60]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x711db6
dec dword [eax + 0x374]
push ecx
call fcn.00748704
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x711dfa
mov eax, dword [0x4ece60]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x711dea
dec dword [eax + 0x374]
push ecx
call fcn.00748704
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.007146d4
Function at 0x720454
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4b8040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
xor edx, edx
push ebx
push esi
mov dword [ebp - 0x1c], eax
mov esi, ecx
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], edx
push edi
test eax, eax
js 0x720495
cmp eax, 6
jge 0x720495
lea edx, [ebp - 0xc]
push edx
push eax
push ecx
call fcn.00720434
mov edx, dword [ebp - 0xc]
add esp, 0xc
push 0
mov ecx, esi
call fcn.0071fae4
add esp, 4
test al, al
jne 0x7204b6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0073d90b
mov esp, ebp
pop ebp
ret
mov esi, dword [0x4ece60]
xor al, al
xor ebx, ebx
mov byte [ebp - 0x11], al
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
nop word [eax + eax]
mov eax, dword [esi + 0x1c48]
mov edi, 4
add eax, 0xfc
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
lea esi, [ebp - 8]
mov ecx, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4887d8]
sub edi, 1
jne 0x7204f8
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 8]
not edx
push eax
mov dword [ebp - 8], edx
call fcn.007088a4
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x20]
mov esi, dword [edi]
cmp ebx, esi
sete byte [ebp - 0x12]
call fcn.00720434
add esp, 0xc
test al, al
jne 0x72054c
mov ecx, str.Unknown_item
mov dword [ebp - 0x10], ecx
jmp 0x72054f
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0x12]
lea eax, [ebp - 0x28]
push eax
push 0
call fcn.00726eb4
add esp, 8
test al, al
je 0x72056a
mov byte [ebp - 0x11], 1
mov dword [edi], ebx
cmp ebx, esi
jne 0x720573
call fcn.006f8ea4
mov esi, dword [0x4ece60]
inc ebx
mov eax, dword [esi + 0x1c48]
dec dword [eax + 0xfc]
cmp ebx, 6
jl 0x7204d4
mov eax, dword [esi + 0x1c48]
cmp dword [esi + 0x1e18], eax
jne 0x7205ad
mov dword [esi + 0x1f18], eax
mov dword [esi + 0x1f1c], 2
test dword [eax + 8], 0x1000000
je 0x7205bd
mov byte [esi + 0x1bf2], 1
call fcn.006f86f4
mov al, byte [ebp - 0x11]
mov byte [esi + 0x1bf2], 0
test al, al
je 0x7205ec
mov ecx, dword [0x4ece60]
mov word [ecx + 0x1c94], 0x101
mov ecx, dword [ecx + 0x1c48]
or dword [ecx + 0x158], 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0073d90b
mov esp, ebp
pop ebp
ret
Function at 0x728ba4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, edx
je 0x728c15
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x728bec
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x728bd3
cmp byte [esi], cl
jne 0x728bd3
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4887d8]
test cl, cl
jne 0x728bc4
mov ecx, dword [0x4ece60]
not eax
cmp dword [ecx + 0x1c84], eax
jne 0x728c02
mov dword [ecx + 0x1c88], eax
cmp dword [ecx + 0x1cbc], eax
jne 0x728c5a
pop edi
mov byte [ecx + 0x1cc0], 1
pop esi
pop ebp
ret
mov esi, dword [0x4ece60]
xor edx, edx
mov eax, dword [esi + 0x1c48]
mov ecx, dword [eax + 0xfc]
mov eax, dword [eax + 0x104]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.006eb844
add esp, 4
cmp dword [esi + 0x1c84], eax
jne 0x728c4b
mov dword [esi + 0x1c88], eax
cmp dword [esi + 0x1cbc], eax
jne 0x728c5a
mov byte [esi + 0x1cc0], 1
pop edi
pop esi
pop ebp
ret
Function at 0x736dc4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f0dd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4b8040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x4abbb8
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0072ee24
push 8
call fcn.0073dfb8
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 1
call fcn.0073f0f5
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00737f74
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp + 0xb], al
test ecx, ecx
je 0x736eee
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x736eee
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x736f0a
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.0072ee24
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x7378a4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f150
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b8040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x48061c
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0073dfb8
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0073f0f5
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00737db4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x73e5d8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x4801a0]
test eax, eax
je 0x73e617
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x73e617
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x73e617
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x73e617
cmp dword [ecx + 0x74], 0xe
jbe 0x73e617
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x7629b4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x7629e1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x7629e1
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000726c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10146f60]
jne 0x10007276
repz ret
jmp fcn.1000751d

Function at 0x10008680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [fcn.10008680]
mov dword [0x10146f3c], 0x83f
mov dword [ebp - 8], eax
mov dword [0x10146f3c], 0x19e4
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100086c2
jmp 0x100086d6
mov eax, dword [ebp - 4]
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x100086b2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
je 0x100086ba
jmp 0x100086d6
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [0x10146f40], 0x773
mov al, 1
test al, 1
jne 0x100086a3
jmp 0x100086fe
mov dword [0x10146f3c], 0x24f
mov dword [ebp - 4], 0
jmp 0x100086b2
Function at 0x10008720
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [0x10146f40], 0x3cb
mov dword [ebp - 8], 0
mov dword [0x10146f40], 0x4f5
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x10146f3c], 0x650
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100087f5
jmp 0x100088bd
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100087f5
jmp 0x1000882f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
je 0x100087a7
jmp 0x100088b1
jmp 0x100088b1
jmp 0x100088b6
mov dword [0x10146f40], 0x7a0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x1000879d
mov dword [ebp - 4], 1
jmp 0x100088ce
mov eax, dword [0x10146f40]
add eax, 0x20dc
mov dword [0x10146f3c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x1000886b
jmp 0x100088b8
cmp dword [ebp - 0x10], 0x104
setl al
mov byte [ebp - 0x11], al
mov al, byte [ebp - 0x11]
test al, 1
jne 0x1000880b
jmp 0x1000882f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x10008781
mov dword [0x10146f40], 0xab6
jmp 0x10008774
mov eax, dword [0x10146f40]
sub eax, 0x21b9
mov dword [0x10146f40], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x100088bd
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x100087cf
jmp 0x1000876f
mov dword [0x10146f3c], 0xe50
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x100088b6
mov eax, dword [0x10146f3c]
add eax, 0x5c9
mov dword [0x10146f3c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
je 0x10008786
jmp 0x100087a2
jmp 0x100087a2
jmp 0x100088b8
jmp 0x1000876f
mov dword [0x10146f40], 0x1280
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x18
pop ebp
ret
Function at 0x1000282f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1000707c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1000284b
sub eax, ecx
sar eax, 1
mov edi, eax
push 0x10
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
lea ecx, [esi + edi*2]
pop edi
pop esi
cmp dword [ebp - 0x48], ecx
jne 0x10002890
push 0x20
lea ecx, [ebp - 0x44]
push ecx
push 0x80000001
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x10002890
xor eax, eax
inc eax
jmp 0x10002892
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100034be
leave
ret 4

Function at 0x10004147
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000707c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x10004434
push dword [ebp + 0x14]
xor eax, eax
push dword [ebp + 0x18]
mov word [ecx], ax
call fcn.100028a5
mov ecx, dword [ebp + 0x20]
push dword [ebp + 8]
xor eax, eax
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x10004287
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10004287
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10004287
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10004287
movzx esi, word [edi]
mov eax, esi
shr eax, 1
add eax, esi
call fcn.100016d0
mov ebx, esp
push esi
push edi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10004400
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10004221
mov ecx, dword [ebp - 0xc]
movzx ecx, word [ecx]
xor eax, eax
cmp cx, word [eax*8 + 0x100042a0]
je 0x1000420f
inc eax
cmp eax, 0x27
jae 0x10004221
jmp 0x100041fd
push dword [eax*8 + 0x100042a4]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.100028a5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x1000429c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10004287
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0xffffffff
je 0x1000426b
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x100043e8
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.10003cad
mov eax, dword [ebp - 8]
add esp, 0x1c
test byte [eax + 0x1c], 1
mov eax, 0x100043e0
jne 0x1000427b
mov eax, 0x100043d8
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x20]
call fcn.100028a5
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100034be
leave
ret 0x1c