joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40399e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0
add byte [esp + 0x24], dh
cmp esi, 0x7fff0093
jae 0x403a5d
add byte [esp + 0x20], bh
mov eax, dword [edi - 0x3d]
add al, dh
jae 0x4039d2
sub esp, 4
inc dword [eax]
add byte [esi + 0x57], dl
call 0x1093a6e
add esp, 0x10
jmp 0x403a50
cmp esi, 0
add byte [edi - 0x76], bl
dec esp
and al, 0x28
in eax, dx
add byte [edi + edx*2 - 0x75], dh
dec edi
adc al, 0x39
int1
add byte [eax], al
ja 0x4039ea
mov ebx, ecx
sub dword [edi], 0x72
xor al, 0x8d
dec edi
add al, 0x8b
sub dword [eax], eax
add byte [ecx + edx - 0x7d], dh
in al, dx
add al, 0x8f
add byte [ecx - 0x18], dl
push ebx
xor byte [ebp], bh
add dword [eax], 0
mov eax, dword [edi + 0x18]
lea eax, [edx + eax]
cmp eax, 0x1000
jb 0x403a17
add byte [eax], al
cld
sub esp, 0xc
push ebp
hlt
test esi, esi
setne byte [eax]
add ah, al
or al, 0x5e
pop edi
pop ebx
test eax, 0xcec8300
sub esp, 0xc
push 0xd9844c
add byte [ebp + ebp*8 - 0x457cff84], dh
add byte [eax + 0x53e58955], dl
push edi
push esi
add byte [eax], al
mov word [eax], es
add byte [eax], al
mov eax, dword [edi]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax], eax
add byte [ecx + 0x4589e84d], cl
and eax, dword [eax]
add byte [eax], al
add byte [ebx + 0x4d8b0047], cl
or al, 0x8b
push ebp
or byte [ecx + 0x4d890000], cl
call 0x638016
jne 0x403a77
or esi, 7
mov ebx, dword [ebp]
add byte [ebp - 0x60], al
dec eax
mov al, 0xbe
popfd
add byte [ebp - 0x5c], al
or al, 0x87
fld dword [eax]
mov dword [eax], eax
add byte [ecx + 0x45c7b065], cl
les eax, [eax]
push esi
inc eax
add byte [ebp + 0xe88445], cl
add byte [esi], bh
cmp esi, 0x7f0024fe
ja 0x403aee
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
add byte [ecx - 0x45102e31], cl
bound eax, qword [eax]
stosb byte es:[edi], al
stosb byte es:[edi], al
mov eax, esi
mul edx
rol dword [eax], 1
add bh, dl
mov ebx, esi
jbe 0x403aee
rol dword [eax], 1
invalid
mov ecx, dword [ebp - 0x10]
mov eax, ebx
inc eax
add byte [eax], al
test eax, eax
js 0x411852
add eax, eax
cmp eax, 0x1000
add byte [ebp - 0x14], bl
jb 0x403b44
mov ecx, dword [edi]
cmp eax, 0xffffffdd
jae 0x403c67
mov ecx, dword [ebp - 0x10]
add eax, 0x3f
add byte [ebp - 0x28], cl
mov dword [ebp - 0x74], 3
mov dword [esp], eax
call fcn.004068b6
mov esi, eax
add esi, 0x23
add dword [eax], 0
mov dword [esi - 4], eax
jmp 0x403b5b
add byte [eax], al
invalid
jg 0x403b5d
in al, dx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x34], esi
add byte [eax], al
je 0x403b67
invalid
invalid
mov dword [ebp - 0x28], ecx
invalid
Function at 0x42a1f6
Capabilities:
Encode data using xor

Disassembly:
ror ah, 1
push edx
push edx
push cs
add al, 0x3b
push ebx
mov edi, 0xb004ca5d
jno 0x429ff8
mov bl, 0xbe
int3
ja 0x42a06a
jecxz 0x42a0ea
ljmp 0xfaf4:0x8bde41e
xchg ebx, eax
add cl, byte [ecx]
jp 0x42a146
fisubr word [ebx - 0x615f5ea7]
test al, 0xe
lcall 0x4735, 0xb7e8fe6a
or dword [edx + ebp*4], ebx
cld
pop esi
fnsave dword [edi + 0xc]
mov edx, 0x89899809
cwde
fmul dword [edx]
outsd dx, dword [esi]
mov byte [0x35b97e81], ah
or al, 0xba
or dword [eax - 0x27677677], ebx
or ch, byte [edi - 0x78]
and eax, 0x35b97e81
aaa
out 0x36, al
in eax, 0x33
aam 0x90
jns 0x42a118
push edx
and al, 0x27
in eax, dx
inc edi
jg 0x42a17c
hlt
scasb al, byte es:[edi]
jmp edx
ja 0x42a0d7
idiv dword [edx - 0x46]
xchg ebp, eax
push 0xfe8a
jg 0x42a166
pop ebp
je 0x42a11a
ffree st(3)
sub al, 0xcd
cdq
mov ebx, 0x846dee52
rcl dword [edx + 3]
inc esi
cld
out dx, al
insd dword es:[edi], dx
test cl, dl
push edx
add eax, dword [esi - 4]
cmp bl, byte [ebp + 0x77]
loope 0x42a105
cmp cl, dl
dec ebx
mov bh, 0x2d
imul edx, dword [esp + ebx + 0x47], 0x45
inc edi
inc ebp
punpckhwd mm1, qword [eax - 0x73]
adc byte [esi], bl
and ch, byte [esp]
lcall 0xe74c, 0xe39831ed
cwde
dec esp
enter 0x1cb6, 0x14
lcall 0xbf02, 0x4a62e7fa
dec esi
inc ebp
sahf
sub esi, dword gs:[ebx + 0x45]
xchg ecx, eax
test dword ds:[ebp + 0x6fd5ab57], edx
sub al, byte [edx - 0x1fca191b]
jnp 0x42a150
or byte [edx - 0x632c25b0], dh
pushal
mov cl, cl
add al, 0x96
test dword [edi + 3], ebp
or al, 0x70
jmp dword [ecx]
sbb al, 0xc
in al, 0x24
je 0x42a21e
pushal
scasb al, byte es:[edi]
adc al, 0x45
and bl, byte [ebx]
fidiv word [ecx + 0x40]
adc byte [ebx], 0xef
clc
or dword [eax + edx*4 + 0x5ab66e04], ebp
mov al, 0xf2
sahf
push 0xe5cafc79
loope 0x42a16b
sub al, 0x7c
mov byte [ecx + 0x318ac18a], dl
cmp al, 0xfb
sub byte [edx - 0x2b], ch
aad 0x3e
mov ebp, 0x5f4f9aae
aad 0x3e
mov ebp, 0x5f4f9aae
ficom word [edx]
mov dh, 0x13
push esp
movsb byte es:[edi], byte [esi]
inc eax
jns 0x42a1c5
imul byte [edi]
mov dl, 0x8f
push 0x27
push edx
fidiv dword [ebp + 0x38]
xchg byte [ecx - 0x2c], bl
adc al, 0x4c
and esp, dword [ecx]
xlatb
invalid
inc ecx
xor ch, byte [edx]
cmp al, 0x3c
aas
inc esi
loope 0x42a21f
shl ah, 1
fstp st(7)
test byte [edx], cl
xor al, 0xd9
bound ecx, qword [ebp - 0x72]
cmp dword [eax + 0x10f7db91], esp
push cs
fild dword [eax + 3]
hlt
Function at 0x440d5c
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xb585faf
dec esi
push esp
sahf
mov esi, dword [edx]
adc dword [ebp - 0x538a7484], eax
mov dword [0x1b3efa33], eax
pop edi
popfd
mov eax, 0xd3a6ff1f
lea ebp, [esi]
test dword gs:[ebx], edx
shr dword [ecx - 0x72ab20c2], cl
stc
jecxz 0x440df5
inc eax
cdq
and edx, dword [ecx]
lahf
hlt
imul ecx, dword [ecx - 0x75], 0x695a4ca7
ror byte [eax - 0x45], 1
xor byte [eax - 0x79aa7470], al
imul edx, eax, 0x8030bb48
nop
mov edx, dword [ebp - 0x7a]
ror ebp, 0x73
jnp 0x440da9
ret 0x5ca2
cmp dword [ebp - 0x642e518a], ecx
sub byte [edi - 0x7850b8ab], cl
sub dword [ebx + ebp*8 + 0x48], eax
pop edx
loop 0x440daf
and al, 0x50
fcmovb st(0), st(1)
les ecx, [ecx]
jl 0x440e42
inc ebx
les ebp, [0x8f59cd1f]
pop es
mov al, 0xad
sbb edi, edx
pushfd
not dword [esi + 0x738d9109]
lodsb al, byte [esi]
arpl word gs:[eax], cx
iretd
wait
ret

Function at 0x452686
Capabilities:
Encode data using xor

Disassembly:
push ebx
popfd
or byte [ecx + esi], ch
adc dword [edi - 0x31351c75], esi
jge 0x45268a
dec esi
fild word [edx]
xchg edi, eax
xchg dword [edx - 0x5cde80f1], edi
and al, 0xae
inc edx
fst st(6)
mov dl, 0x48
cmp byte [esi + 0x1c], al
xchg dword [edi], ecx
invalid
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
enter 0x18df, 0xffffffffffffffc0
sbb al, al
js 0x452694
dec eax
sahf
xchg ebp, eax
jg 0x452631
and ebp, dword [ecx + ebp*2 - 0x18]
and eax, 0x5cc93f53
insb byte es:[edi], dx
imul ebp, eax, 0xc93f5325

Function at 0x4c752e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4ce5a0
cmp edx, dword [eax]
je 0x4c7550
add eax, 8
inc ecx
cmp eax, 0x4ce630
jl 0x4c7541
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4ce5a0]
jne 0x4c767e
mov eax, dword [0x4d2c80]
cmp eax, 1
je 0x4c7658
test eax, eax
jne 0x4c7581
cmp dword [0x4ce4e0], 1
je 0x4c7658
cmp edx, 0xfc
je 0x4c767e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c75b8
lea eax, [ebp - 0x1a4]
push 0x4cb984
push eax
call fcn.004c7c40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7e70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c75fb
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7e70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cb980
push edi
call fcn.004c9640
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cb964
push eax
call fcn.004c7c40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7c50
lea eax, [ebp - 0xa0]
push 0x4cb960
push eax
call fcn.004c7c50
push dword [esi + 0x4ce5a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7c50
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cb938
push eax
call fcn.004c95b4
add esp, 0x2c
pop edi
jmp 0x4c767e
lea eax, [ebp + 8]
lea esi, [esi + 0x4ce5a4]
push 0
push eax
push dword [esi]
call fcn.004c7e70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x43cf60
Capabilities:
Encode data using xor

Disassembly:
push 0x43ccda
pop esi
call fcn.0043cf8a
or ebx, ebx
xor dword [edx], esi
inc ebx
push 0x244d56ae
pop ebx
inc edx
or ebx, ebx
sub edi, ebx
cmp edx, eax
jne fcn.0043cf60
or ebx, edi
ret
Function at 0x4defd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4be015
lea edi, [esi - 0xbd015]
push edi
jmp 0x4defea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4deff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4defe0
mov eax, 1
add ebx, ebx
jne 0x4df003
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4df014
jne 0x4df033
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4df033
dec eax
add ebx, ebx
jne 0x4df020
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4deff8
add ebx, ebx
jne 0x4df02f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4df085
xor ecx, ecx
sub eax, 3
jb 0x4df04b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4df0ba
sar eax, 1
mov ebp, eax
jmp 0x4df056
add ebx, ebx
jne 0x4df056
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4df024
inc ecx
add ebx, ebx
jne 0x4df064
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4df024
add ebx, ebx
jne 0x4df071
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4df066
jne 0x4df082
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4df066
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4df0a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4df096
jmp 0x4defe6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4df0a4
add edi, ecx
jmp 0x4defe6
pop esi
mov edi, esi
mov ecx, 0x39fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4df0c2
cmp byte [edi], 8
jne 0x4df0c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4df0c7
lea edi, [esi + 0xdc000]
mov eax, dword [edi]
or eax, eax
je 0x4df13f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xdf590]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xdf5cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4df0f4
mov ecx, edi
jns 0x4df123
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xdf5d4]
or eax, eax
je 0x4df139
mov dword [ebx], eax
add ebx, 4
jmp 0x4df111
call dword [esi + 0xdf5d0]
mov ebp, dword [esi + 0xdf5d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4df173
sub esp, 0xffffff80
jmp 0x4024c0
Function at 0x40c2d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x446490], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x44648c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x446490], edx
cmp eax, 0x26f
jl 0x40c2d8
mov dword [0x438d20], 0x270
ret

Function at 0x40c310
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x446494]
mov ebx, dword [eax*4 + 0x446490]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x446ac4]
mov dword [eax*4 + 0x446490], edx
cmp eax, 0xe2
jl 0x40c318
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x446494]
mov ebx, dword [eax*4 + 0x446490]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x446104]
mov dword [eax*4 + 0x446490], edx
cmp eax, 0x26e
jl 0x40c368
mov edx, dword [0x446490]
mov ecx, dword [0x446e4c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x446ac0]
mov dword [0x446e4c], eax
mov dword [0x438d20], 0
pop ebx
ret

Function at 0x40c3f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x438d20]
add dword [0x438d20], 1
mov eax, dword [0x445030]
cmp eax, dword [0x438470]
jne 0x40c413
cmp ebx, 0x271
jb 0x40c434
mov eax, dword [0x445030]
call fcn.0040c2d0
not dword [0x445030]
mov eax, dword [0x445030]
mov dword [0x438470], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40c450
call fcn.0040c310
xor ebx, ebx
mov dword [0x438d20], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x446490]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x40def0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x438200]
cmp ax, 0xcb
je 0x40dffc
cmp ax, 0xcc
je 0x40dffc
lea esi, [esi]
mov edx, dword [0x447090]
test edx, edx
je 0x40df25
mov eax, dword [0x446f40]
call edx
mov ebx, eax
jmp 0x40df2a
mov ebx, 0x446f44
cmp word [0x446f30], 0
jle 0x40df50
mov eax, 0x446f10
call fcn.0040e160
mov eax, ebx
call fcn.0040dab0
mov eax, ebx
call fcn.0040db20
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40df72
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40df6d
mov edx, edi
mov eax, ebx
call fcn.0040cf20
jmp 0x40df70
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40df58
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x446f30], 0
jle 0x40dffc
mov edx, 0x446e50
mov eax, ebx
call fcn.0040d060
mov edi, eax
test edi, edi
je 0x40dfcc
mov eax, dword [0x446ee4]
mov dword [edi + 0xc], eax
cmp dword [0x446ee4], 0
je 0x40dfc0
mov eax, dword [0x446ee4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x446ee4], eax
nop
sub word [0x446f30], 1
cmp word [0x446f30], 0
sete bl
mov eax, 0x446f10
call fcn.0040e180
test bl, bl
je 0x40dffc
mov eax, 0x446f10
call fcn.0040e150
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x4100e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x446270], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.004102c0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x446270]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402220
call sub.kernel32.dll_GetCommandLineA
mov dword [0x438270], eax
mov ebx, eax
jmp 0x410283
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x410168
cmp byte [ebx], 0
je 0x41028c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x4101e3
mov al, byte [ebx]
cmp al, 1
jb 0x4101d8
sub al, 0x20
jbe 0x4101a8
sub al, 2
je 0x4101bc
jmp 0x4101d8
mov al, byte [ebp - 0x114]
test al, al
je 0x4101e8
add dword [ebp - 0x110], 1
jmp 0x4101e0
cmp byte [ebx + 1], 0x22
je 0x4101d3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4101e0
add ebx, 1
jmp 0x4101e0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x410198
test dword [ebp - 0x10c], 0xffffffff
je 0x41027c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.004102c0
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x446270]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x410273
mov al, byte [ebx]
cmp al, 1
jb 0x410268
sub al, 0x20
jbe 0x410238
sub al, 2
je 0x41024c
jmp 0x410268
mov al, byte [ebp - 0x114]
test al, al
je 0x410278
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x410270
cmp byte [ebx + 1], 0x22
je 0x410263
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x410270
add ebx, 1
jmp 0x410270
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x410228
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41016b
mov ebx, dword [ebp - 0x10c]
mov dword [0x446260], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x446270
call fcn.0040dd30
mov eax, dword [0x446270]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00412260
push ebp
push 0x410f10
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x412380
mov al, byte [ebp - 0x110]
test al, al
je 0x412349
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403570
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004078c0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004085d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43bb0c
call fcn.00426880
mov edx, 0x4122da
mov ecx, ebp
call fcn.00410dd0
jmp 0x412380
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43bb0c
call fcn.00426880
mov edx, 0x412349
mov ecx, ebp
call fcn.00410dd0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x412444
mov al, byte [ebp - 0x110]
test al, al
je 0x41240d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403570
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004078c0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004085d0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43bb0c
call fcn.00426880
mov edx, 0x41239e
mov ecx, ebp
call fcn.00410dd0
jmp 0x412444
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x43bb0c
call fcn.00426880
mov edx, 0x41240d
mov ecx, ebp
call fcn.00410dd0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00411fa0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00412260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x427760
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00427750
push ebp
push 0x410f10
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x4277d0
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.00409560
cmp ebx, 1
jle 0x4277c0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.004090d0
jmp 0x4277db
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407040
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00427750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x427be0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00427bd0
push ebp
push 0x410f10
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x44797c]
xor edx, edx
call fcn.00407040
mov dword [ebx*4 + 0x44799c], 0xffffffff
cmp ebx, 7
jl 0x427c08
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x427c94
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00407a30
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.0041f4e0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x427c94
push 4
push ebx
push esi
mov eax, 0x427ab0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x427b40
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00427bd0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4282e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push fcn.004282b0
push ebp
push 0x410f10
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
call fcn.0041f180
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00407040
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.004085d0
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00407040
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x1c], eax
mov ebx, eax
jmp 0x4283ec
lea ecx, [ebp - 8]
mov eax, ebx
xor dx, dx
call fcn.00407990
mov eax, dword [ebp - 8]
test eax, eax
je 0x428377
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.004085d0
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.00407f70
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00407e10
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0041f180
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00407bb0
test eax, eax
jne 0x4283e4
push dword [ebp - 0x18]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4283d3
mov eax, dword [eax - 4]
sub eax, esi
mov ecx, eax
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.00407e10
jmp 0x4283f5
lea eax, [ebx + edi]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x428360
push dword [ebp - 0x1c]
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004282b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428430
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x4479e0], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x447840], eax
mov eax, dword [ebp - 0x90]
mov dword [0x447850], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x447860], eax
mov eax, dword [ebp - 0x88]
mov dword [0x447870], eax
mov edx, 0x447881
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00402220
lea eax, [ebp - 0x80]
call fcn.00403050
mov byte [0x447880], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4479f0], eax
test eax, eax
je 0x4284d0
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x4479f0]
call sub.kernel32.dll_GetProcAddress
mov dword [0x4479e0], eax
nop
cmp dword [0x447850], 6
jae 0x4284e4
mov dword [0x439030], 0
nop
cmp dword [0x447850], 6
jb 0x428500
cmp dword [0x447860], 1
jb 0x428500
mov dword [0x439040], 2
mov esp, ebp
pop ebp
ret