joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407220
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x14]
lea esi, [eax + eax]
push esi
push 0
push 3
push 0x47faa0
call dword [0x47ea70]
test esi, esi
je 0x40727b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [eax]
push 0
push 0
push dword [0x47faa0]
push 0x407360
push 0
push 0
call edi
sub esi, 1
jne 0x407260
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042f19a
mov esp, ebp
pop ebp
ret

Function at 0x409130
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0x510
push 0
mov byte [ebp - 4], 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x409281
push 0xe0c
push 0
call esi
push eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x409273
push 0xe0c
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [edi + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
lea ecx, [ebx + 0x600]
push pe_nt_image_headers32
mov word [ebx + 6], ax
lea eax, [ebx + 0x400]
push eax
lea eax, [ebx + 0x604]
push eax
lea eax, [ebx + 0x608]
push eax
push ecx
push pe_nt_image_headers32
lea eax, [ebx + 0x200]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x409263
mov ecx, dword [ebp - 8]
movzx edi, word [edi + 0x406]
mov eax, dword [ebx + 0x600]
xor edi, 8
push edi
movzx esi, word [ecx + 0x404]
movzx edx, word [ecx + 0x402]
xor esi, 7
movzx ecx, word [ecx + 0x400]
xor edx, eax
mov edi, dword [ebp - 8]
xor ecx, eax
push esi
xor edx, 5
lea eax, [ebp + 8]
xor ecx, 6
cmp dword [ebp + 0x1c], 8
push edx
cmovae eax, dword [ebp + 8]
push ecx
push eax
push str._s_x_x_x_x.goodgame
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push 0
push 0x4000002
push 1
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
cmp eax, 0x50
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 1
movzx ecx, cl
cmove ecx, edx
mov dword [ebp - 4], ecx
push ebx
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
jmp 0x409279
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
call esi
push eax
call ebx
mov ecx, dword [ebp + 0x1c]
pop edi
pop esi
pop ebx
cmp ecx, 8
jb 0x4092ba
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4092b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4092c1
push ecx
push edx
call fcn.0042f3f9
add esp, 8
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.0043400f
int3
Function at 0x40aa00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44846d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x47c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.0042f609
mov dword [ebp - 0x14], eax
mov dword [eax], 0x42bbb0
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x40bcb0
push 0
push 0
call fcn.0043421e
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40aa80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f19a
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.0042e3f8
int3

Function at 0x40c3f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448780
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47c018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042f609
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042cba1
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411f90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov eax, dword [ebx + 8]
movaps xmm6, xmm0
movaps xmm7, xmm1
mov dword [esp + 4], ebp
movups xmm0, xmmword [eax + 0x50]
aesenc xmm0, xmmword [eax + 0x60]
movups xmm2, xmmword [eax + 0x60]
movups xmm3, xmmword [eax + 0x30]
movups xmm5, xmmword [eax + 0x70]
movups xmmword [eax + 0x60], xmm0
movups xmm0, xmmword [eax + 0x40]
aesenc xmm0, xmmword [eax + 0x50]
movups xmmword [eax + 0x50], xmm0
movups xmm0, xmmword [eax + 0x20]
aesenc xmm0, xmm3
aesenc xmm3, xmmword [eax + 0x40]
movups xmmword [eax + 0x30], xmm0
pxor xmm3, xmm7
movups xmm0, xmmword [eax + 0x10]
aesenc xmm0, xmmword [eax + 0x20]
aesenc xmm2, xmm5
aesenc xmm5, xmmword [eax]
movups xmmword [eax + 0x20], xmm0
pxor xmm5, xmm6
movups xmm0, xmmword [eax]
aesenc xmm0, xmmword [eax + 0x10]
movups xmmword [eax + 0x70], xmm2
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm5
movups xmmword [eax + 0x40], xmm3
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x412770
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x47c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xc]
xorps xmm0, xmm0
push esi
mov esi, dword [ebx + 8]
push edi
push esi
mov dword [ebp - 0x34], eax
mov edi, ecx
push edx
lea eax, [ebp - 0x30]
movaps xmmword [ebp - 0x30], xmm0
push eax
movaps xmmword [ebp - 0x20], xmm0
call fcn.00430ac0
mov eax, dword [ebp - 0x34]
add esp, 0xc
movaps xmm2, xmmword [ebp - 0x20]
movups xmm3, xmmword [eax + 0x20]
pxor xmm2, xmmword [eax + 0x50]
movups xmm0, xmmword [eax + 0x60]
pxor xmm2, xmm3
pand xmm0, xmmword [eax + 0x70]
pand xmm3, xmmword [eax + 0x30]
pxor xmm2, xmm0
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ebp - 0x20], xmm2
pxor xmm0, xmmword [eax + 0x60]
pxor xmm0, xmmword [eax + 0x10]
mov eax, 0x20
sub eax, esi
pxor xmm0, xmm3
push eax
lea eax, [ebp - 0x30]
add eax, esi
push 0
push eax
movups xmmword [ebp - 0x30], xmm0
call fcn.00431040
add esp, 0xc
lea eax, [ebp - 0x30]
push esi
push eax
push edi
call fcn.00430ac0
mov eax, dword [ebp - 0x34]
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
movups xmm5, xmmword [eax + 0x70]
movups xmm0, xmmword [eax + 0x60]
movups xmm3, xmmword [eax + 0x30]
aesenc xmm0, xmm5
aesenc xmm5, xmmword [eax]
movups xmmword [eax + 0x70], xmm0
movups xmm0, xmmword [eax + 0x50]
aesenc xmm0, xmmword [eax + 0x60]
pxor xmm5, xmmword [ebp - 0x30]
movups xmmword [eax + 0x60], xmm0
movups xmm0, xmmword [eax + 0x40]
aesenc xmm0, xmmword [eax + 0x50]
movups xmmword [eax + 0x50], xmm0
movups xmm0, xmmword [eax + 0x20]
aesenc xmm0, xmm3
aesenc xmm3, xmmword [eax + 0x40]
pxor xmm3, xmmword [ebp - 0x20]
movups xmmword [eax + 0x30], xmm0
movups xmm0, xmmword [eax + 0x10]
aesenc xmm0, xmmword [eax + 0x20]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax]
aesenc xmm0, xmmword [eax + 0x10]
pop edi
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm5
movups xmmword [eax + 0x40], xmm3
pop esi
call fcn.0042f19a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x414600
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
movups xmm2, xmmword [ecx]
mov eax, dword [ebx + 8]
movups xmm5, xmmword [ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
mov edx, 4
movups xmm3, xmmword [0x4561c0]
movups xmm4, xmmword [0x4561d0]
pxor xmm0, xmm2
pxor xmm1, xmm5
movaps xmm7, xmm5
movaps xmmword [ebp - 0x30], xmm0
movaps xmmword [ebp - 0x40], xmm1
pxor xmm7, xmm4
pxor xmm2, xmm3
movaps xmmword [ebp - 0x10], xmm1
movaps xmm6, xmm0
nop
movaps xmm0, xmm3
movaps xmm5, xmm2
movaps xmm1, xmm4
aesenc xmm0, xmm2
movaps xmm2, xmmword [ebp - 0x10]
aesenc xmm2, xmm4
movups xmm4, xmmword [ecx]
aesenc xmm1, xmm3
movaps xmm3, xmm6
aesenc xmm3, xmmword [ebp - 0x10]
aesenc xmm5, xmm7
aesenc xmm7, xmm6
pxor xmm7, xmm4
movaps xmm6, xmm0
movaps xmm4, xmm1
aesenc xmm4, xmm0
movaps xmm0, xmm2
aesenc xmm0, xmm1
movaps xmm1, xmm3
aesenc xmm1, xmm2
movaps xmm2, xmm7
aesenc xmm2, xmm3
movups xmm3, xmmword [ecx + 0x10]
aesenc xmm6, xmm5
aesenc xmm5, xmm7
pxor xmm5, xmm3
movaps xmm3, xmm4
aesenc xmm3, xmm6
movaps xmmword [ebp - 0x20], xmm3
movaps xmm3, xmm0
aesenc xmm3, xmm4
movaps xmm4, xmm1
movaps xmm7, xmm3
aesenc xmm4, xmm0
movaps xmm0, xmm2
aesenc xmm0, xmm1
movaps xmm1, xmm5
aesenc xmm1, xmm2
movaps xmm2, xmm4
aesenc xmm6, xmm5
movaps xmm5, xmmword [ebp - 0x20]
pxor xmm6, xmmword [ebp - 0x30]
aesenc xmm2, xmm3
movaps xmm3, xmm0
aesenc xmm3, xmm4
movaps xmm4, xmm1
aesenc xmm7, xmm5
aesenc xmm5, xmm6
pxor xmm5, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm5
movups xmmword [eax], xmm5
aesenc xmm4, xmm0
movaps xmm0, xmm6
movaps xmm6, xmmword [ebp - 0x20]
aesenc xmm0, xmm1
movaps xmmword [ebp - 0x10], xmm0
sub edx, 1
jne 0x414660
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax + 0x20], xmm4
movups xmmword [eax + 0x30], xmm3
movups xmmword [eax + 0x40], xmm2
movups xmmword [eax + 0x50], xmm7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x426e10
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
push edi
mov edi, ecx
mov dword [edi], 0x61707865
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
movzx esi, byte [edx + 3]
movzx eax, byte [edx + 2]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 1]
shl esi, 8
or esi, eax
movzx eax, byte [edx]
shl esi, 8
or esi, eax
mov dword [edi + 0x10], esi
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [edx + 0x18]
or ecx, eax
mov dword [edi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x2c], ecx
pop edi
pop esi
ret
Function at 0x429290
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movzx eax, byte [edx + 2]
push esi
movzx esi, byte [edx + 3]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 1]
shl esi, 8
or esi, eax
movzx eax, byte [edx]
push edi
mov edi, ecx
shl esi, 8
or esi, eax
mov dword [edi + 0x14], esi
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x28], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x3c], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x30], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x1c], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x10], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x24], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x38], ecx
mov dword [edi], 0x61707865
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
pop edi
pop esi
ret
Function at 0x42a910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
push esi
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
mov ecx, dword [ebp - 0xc]
movzx esi, byte [ecx + eax]
inc eax
mov ecx, dword [ebp - 4]
xor esi, edx
or ecx, esi
mov dword [ebp - 4], ecx
cmp eax, 0x10
jl 0x42a926
mov eax, dword [ebp - 4]
dec eax
shr eax, 8
and eax, 1
pop esi
dec eax
mov esp, ebp
pop ebp
ret
Function at 0x42aa60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x47c018]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0042ace0
test eax, eax
jne 0x42aca4
cmp dword [0x480760], eax
je 0x42aab4
cmp dword [0x480780], eax
je 0x42ac99
push 0x480764
mov dword [0x480780], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f19a
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
xor eax, eax
mov dword [0x480788], 0
xor ecx, ecx
mov dword [0x48078c], 0
push ebx
cpuid
mov esi, ebx
lea edi, [ebp - 0x14]
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp dword [ebp - 0x14], 0
je 0x42ab9d
mov eax, 1
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
xor edi, edi
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
shr eax, 0x1a
and eax, 1
mov dword [0x4807a0], edi
mov dword [0x480790], eax
mov eax, esi
and eax, 1
mov dword [0x480794], eax
mov eax, esi
shr eax, 9
and eax, 1
mov dword [0x480798], eax
mov eax, esi
shr eax, 0x13
and eax, 1
mov dword [0x48079c], eax
mov eax, esi
and eax, 0x1c000000
cmp eax, 0x1c000000
jne 0x42ab67
xor ecx, ecx
xgetbv
and al, 6
cmp al, 6
mov eax, 1
cmove edi, eax
mov dword [0x4807a0], edi
mov eax, esi
mov dword [0x4807a4], 0
shr eax, 1
and eax, 1
shr esi, 0x19
and esi, 1
mov dword [0x4807a8], 0
mov dword [0x4807ac], eax
mov dword [0x4807b0], esi
mov dword [0x4807b4], 0
mov dword [0x480784], 1
call fcn.0042a960
mov eax, dword [0x480758]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 8]
test eax, eax
je 0x42abbd
call eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x34]
mov dword [0x47d2c0], eax
cmp eax, 0x10
jb 0x42acda
cmp eax, 4
jb 0x42acda
mov eax, dword [0x480758]
test eax, eax
jne 0x42ac0c
mov dword [0x480758], 0x47cfbc
call fcn.0042a960
mov eax, dword [0x480758]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x42ac0c
call ecx
mov eax, dword [0x480758]
mov eax, dword [eax + 0x10]
push 0x10
push 0x4807b8
call eax
mov ecx, dword [0x480798]
add esp, 8
cmp dword [0x48079c], 0
je 0x42ac31
mov eax, 0x41fe50
jmp 0x42ac40
test ecx, ecx
mov eax, 0x41a220
mov edx, 0x421dd0
cmovne eax, edx
mov dword [0x47d01c], eax
test ecx, ecx
mov edx, 0x47cf9c
mov dword [0x47d14c], 0x47cf28
mov eax, 0x47cf8c
mov dword [0x47d27c], 0x47cf84
cmove eax, edx
mov ecx, 0x47cfac
cmp dword [0x480790], 0
mov dword [0x47d280], eax
mov eax, 0x47cfb4
cmove eax, ecx
mov dword [0x47d284], eax
mov dword [0x480760], 1
cmp dword [0x480780], 0
jne 0x42acb5
call fcn.00434390
mov dword [eax], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f19a
mov esp, ebp
pop ebp
ret
push 0x480764
mov dword [0x480780], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0042f19a
mov esp, ebp
pop ebp
ret
call fcn.0042ad90
int3
Function at 0x42c868
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x42c889
jl 0x42c880
test edi, edi
jne 0x42c889
xor eax, eax
xor edx, edx
jmp 0x42c94a
cmp dword [ebx + 0x38], 0
je 0x42c89e
push eax
push edi
push dword [ebp + 8]
call fcn.0040cd30
jmp 0x42c94a
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x42c8e5
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x42c8e5
cmp eax, edi
jb 0x42c8bf
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00430ac0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x42c8eb
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x42c93f
mov ecx, ebx
call fcn.0042c1dc
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x42c92a
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00435382
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x42c93f
jmp 0x42c8fd
test edx, edx
je 0x42c93f
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00435382
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x42e4a6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0042e482
pop esi
leave
ret 8

Function at 0x42fec0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42feff
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42feff
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42feff
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42feff
cmp dword [ecx + 0x74], 0xe
jbe 0x42feff
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43b0f4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44d924
push 0x44d91c
push str.FlsAlloc
push 0x1f
call fcn.0043af1f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43b128
push dword [ebp + 8]
mov ecx, esi
call dword [0x44a400]
call esi
jmp 0x43b12e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x43b172
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44d934
push 0x44d92c
push str.FlsGetValue
push 0x21
call fcn.0043af1f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43b1a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x44a400]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x43b1b1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44d93c
push 0x44d934
push str.FlsSetValue
push 0x22
call fcn.0043af1f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43b1eb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x44a400]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43e048
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00430120
mov eax, dword [0x47c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0043bc8d
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x43e08a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x43e1e6
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00447b60
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47e820]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0043f21e
mov ecx, dword [esi*4 + 0x47e820]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x43e1df
cmp eax, dword [ecx + edi + 0x24]
jne 0x43e1df
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43e1df
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043f21e
add esp, 0x14
test edx, edx
jl 0x43e1df
jg 0x43e155
test eax, eax
jb 0x43e1df
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x43e1df
jl 0x43e16f
cmp dword [ebp - 0x1008], eax
ja 0x43e1df
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x43e18d
test ebx, ebx
je 0x43e1c6
cmp ecx, edi
jae 0x43e1c6
mov al, byte [ecx]
cmp al, 0xd
jne 0x43e1a7
lea eax, [edi - 1]
cmp ecx, eax
jae 0x43e1b3
cmp byte [ecx + 1], 0xa
jne 0x43e1b3
inc ecx
jmp 0x43e1b3
movzx eax, al
movsx eax, byte [eax + 0x47c430]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x43e18d
cmp edx, ebx
jne 0x43e18d
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x43e1e4
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042f19a
leave
ret