joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015c734
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1022e844], 0
mov byte [0x1022e848], 0
mov dword [0x1022e83c], 0x37b
mov dword [0x1022e840], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1015c82e
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x1022e84c], 0
mov esi, dword [0x1022e844]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x1022e84c], ebx
add ecx, 0xffffe110
mov dword [0x1022e838], ecx
mov eax, ebx
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x1022e844], edx
mov dword [0x1022e83c], 0x2010
mov ebx, dword [ebp - 0x28]
mov cl, byte [edi + ebx]
mov byte [0x1022e848], cl
mov dword [0x1022e838], 0x21db
mov cl, byte [edi + edx]
mov byte [edi + ebx], cl
mov cl, byte [0x1022e848]
mov edx, dword [0x1022e844]
mov byte [edi + edx], cl
mov edx, dword [0x1022e840]
add edx, 1
mov dword [0x1022e840], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jl 0x1015c88e
jmp 0x1015c8a1
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1022e838], 0x195
mov dword [0x1022e83c], 0xfffff8ce
mov eax, dword [0x1022e840]
add eax, 1
mov dword [0x1022e840], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1015c82e
mov eax, 0xfffff8ce
xor ecx, ecx
mov dword [0x1022e838], 0x6f3
mov dword [0x1022e840], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x1015c77e
mov eax, dword [0x1022e83c]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x1015c77e
mov dword [0x1022e838], 0x1374
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1015ccb7
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1022e83c], 0x8e3
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1015cd0f
mov eax, dword [ebp - 0x14]
mov dword [0x1022e838], 0x4c9
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x1015cda3
jmp 0x1015cd57
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
je 0x1015cced
jmp 0x1015cd83
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1015cd57
mov dword [0x1022e83c], 0x27
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1015cd68
mov dword [0x1022e838], 0x8eb
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1015cd27
mov dword [0x1022e838], 0x192b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1015cdc3
jmp 0x1015cd57
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jl 0x1015cd0f
jmp 0x1015cced
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
sete dl
mov byte [ebp - 0x21], dl
mov al, byte [ebp - 0x21]
test al, 1
jne 0x1015cd2f
jmp 0x1015cd57
mov dword [0x1022e838], 0x157c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1015cd57
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x1015cd27
jmp 0x1015cd57
Function at 0x1015d063
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov dword [0x1022e83c], 0x1712
mov esi, dword [0x1022e838]
add esi, 0xffffecd1
mov dword [0x1022e838], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
lea eax, [0x1021db18]
mov ecx, 0xe
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x34], ecx
call fcn.1015c8be
mov dword [0x1022e83c], 0xa58
call fcn.1015cbd9
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1015c546
xor ecx, ecx
mov dword [0x1022e838], 0x4cc
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x1015d1a4
mov eax, dword [ebp - 0x38]
mov dword [0x1022e838], 0x1780
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.1015ce22
xor eax, eax
mov dword [0x1022e838], 0x6a3
mov dword [0x1022e83c], 0x1c22
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x24], ecx
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x1015d1a4
mov eax, dword [ebp - 0x40]
add eax, 0x1792
mov dword [0x1022e83c], 0x6cd
mov dword [0x1022e838], 0x1dc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x1015d37f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [0x1022e838]
mov edx, ecx
add edx, 0xfffff6a0
mov dword [0x1022e83c], edx
add ecx, 0xffffdda3
mov dword [0x1022e838], ecx
mov dword [ebp - 0x10], eax
call fcn.1015c9d8
xor ecx, ecx
mov edx, eax
mov dword [0x1022e83c], 0x3d
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1015d3e5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x1022e838], 0xffffe1e3
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x1015d52e
jmp 0x1015d48d
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x34], eax
jb 0x1015d49d
jmp 0x1015d52e
mov al, byte [ebp - 0x45]
test al, 1
jne 0x1015d4f3
jmp 0x1015d427
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, 0x20
setb cl
mov dl, byte [ebp - 0x51]
cmp dl, 0
setne ch
mov dh, byte [ebp - 0x45]
and dh, ch
and dh, cl
test dh, 1
mov dword [ebp - 0x58], eax
jne 0x1015d4c1
jmp 0x1015d450
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [0x1022e83c], 0xffffd675
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
mov ecx, eax
mov edx, dword [ebp - 0x5c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x45], cl
je 0x1015d450
jmp 0x1015d45d
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov dword [0x1022e83c], 0x257f
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
mov edx, dword [eax + ecx*4]
mov dword [0x1022e838], 0x2299
mov esi, dword [ebp - 0x1c]
add esi, edx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1015d539
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1022e840], 0
mov dword [0x1022e844], 0
mov dword [0x1022e850], 0
mov dword [0x1022e838], 0xecf
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1015d6cd
jmp 0x1015d5b1
mov eax, 0x3c5f
mov ecx, dword [0x1022e840]
mov edx, dword [0x1022e844]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
jmp 0x1015d5d5
mov eax, dword [0x1022e83c]
add eax, 0x2467
mov dword [ebp - 0x34], eax
xor eax, eax
mov ecx, dword [ebp - 0x34]
mov edx, eax
mov esi, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], eax
jmp 0x1015d5d5
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov edi, 0x100
add ecx, 1
mov dword [ebp - 0x38], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x1022e840], edx
mov dword [0x1022e838], 0x2136
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x3c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x1022e844], edx
mov dword [0x1022e838], esi
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov byte [0x1022e848], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x1022e838]
mov ebx, edx
add ebx, 0xffffedd9
mov dword [0x1022e838], ebx
add edx, 0xfffff568
mov dword [0x1022e83c], edx
mov cl, byte [0x1022e848]
mov edx, dword [0x1022e844]
mov byte [edi + edx], cl
mov edx, dword [0x1022e840]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1022e844]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x1022e838], 0x20d8
and ebx, 0xff
mov dword [0x1022e850], ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x38]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x38]
mov byte [ebx + edx], cl
mov dword [0x1022e83c], 0x17f8
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x20], edx
jne 0x1015d58f
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3fc33c1c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x50e207a8
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x405130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418c78
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x424140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
xor ecx, ecx
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [eax + 0x18], ecx
mov byte [eax + 0x1c], cl
mov dword [eax + 0x20], ecx
mov byte [eax + 0x24], cl
add eax, 0x28
mov byte [ebp - 4], 1
push 0x3c
mov dword [ebp - 0x10], eax
call fcn.0040bbf3
mov edi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
push 0x30
push 0
movq qword [edi], xmm0
lea esi, [edi + 0xc]
mov dword [edi + 8], 0
push esi
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_obj2_class_std::mutex_.0
call fcn.0040d8e0
mov eax, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi + 0xc], xmm0
movq qword [esi + 0x1c], xmm0
mov dword [esi + 0x24], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi], 2
mov dword [esi + 0x2c], 0
movq qword [eax + 0x28], xmm0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], esi
mov dword [eax + 0x2c], edi
add eax, 0x30
push eax
call fcn.0040a90c
mov eax, dword [ebp - 0x14]
xorps xmm0, xmm0
add esp, 0x14
movups xmmword [eax + 0x64], xmm0
movq qword [eax + 0x74], xmm0
mov dword [eax + 0x7c], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x80], 0xffffffff
mov dword [eax + 0x58], 2
mov dword [eax + 0x84], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ae7e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x40aea5
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40aea8
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0040ae5a
pop esi
leave
ret 8

Function at 0x40ca00
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40ca3f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ca3f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ca3f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40ca3f
cmp dword [ecx + 0x74], 0xe
jbe 0x40ca3f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41177b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c878
push 0x41c870
push str.FlsAlloc
push 0x1f
call fcn.00411697
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4117af
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a1d4]
call esi
jmp 0x4117b5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4117f9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c888
push 0x41c880
push str.FlsGetValue
push 0x21
call fcn.00411697
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411830
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a1d4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x411838
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c890
push 0x41c888
push str.FlsSetValue
push 0x22
call fcn.00411697
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411872
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41a1d4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x413795
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x413832
push ebx
push esi
call fcn.0041375e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004136f2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4137df
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413831
push edi
push eax
call fcn.004114d3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4137ff
call fcn.00411499
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413830
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004136f2
add esp, 0x20
test eax, eax
jne 0x41381e
push edi
call fcn.00411499
jmp 0x413826
push ebx
call fcn.00411499
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x418300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41832d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41832d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4050b0
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00413cf0
sub esp, 0x18
mov ecx, esp
push str.Zw
call fcn.00413990
lea ecx, [ebp - 0x140]
call fcn.00402910
push eax
lea edx, [ebp - 0x128]
mov ecx, esi
call fcn.00413e40
mov edx, dword [ebp - 0x114]
add esp, 0x1c
cmp edx, 0x10
jb 0x40512d
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405123
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40518f
push edx
push ecx
call fcn.004152ae
add esp, 8
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x40517e
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405174
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40518f
push edx
push ecx
call fcn.004152ae
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414c3c
mov esp, ebp
pop ebp
ret
call fcn.004186fc
int3

Function at 0x4051a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4051f0
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00413cf0
sub esp, 0x18
mov ecx, esp
push str.Zw
call fcn.00413990
lea ecx, [ebp - 0x140]
call fcn.00402910
push eax
lea edx, [ebp - 0x128]
mov ecx, esi
call fcn.00413e40
mov edx, dword [ebp - 0x114]
add esp, 0x1c
cmp edx, 0x10
jb 0x40526d
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405263
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4052cf
push edx
push ecx
call fcn.004152ae
add esp, 8
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x4052be
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4052b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4052cf
push edx
push ecx
call fcn.004152ae
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414c3c
mov esp, ebp
pop ebp
ret
call fcn.004186fc
int3
Function at 0x4052e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405330
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00413cf0
sub esp, 0x18
mov ecx, esp
push str.Zw
call fcn.00413990
lea ecx, [ebp - 0x140]
call fcn.00402910
push eax
lea edx, [ebp - 0x128]
mov ecx, esi
call fcn.00413e40
mov edx, dword [ebp - 0x114]
add esp, 0x1c
cmp edx, 0x10
jb 0x4053ad
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4053a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40540f
push edx
push ecx
call fcn.004152ae
add esp, 8
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x4053fe
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4053f4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40540f
push edx
push ecx
call fcn.004152ae
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414c3c
mov esp, ebp
pop ebp
ret
call fcn.004186fc
int3