joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405095
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x41b5e0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
and dword [eax], 0
push eax
push 0
push 0
push 0x42bc1c
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
je 0x40510c
lea ecx, [ebp - 0x34]
call fcn.004014ad
and dword [ebp - 0x10], 0
push 8
pop ecx
call fcn.00402405
movsd xmm0, qword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0x42b754
movsd qword [eax], xmm0
mov dword [ecx], 0x80000000
jmp 0x405151
mov edx, dword [ebp - 0x24]
xor eax, eax
dec eax
cmp word [edx + eax*2 + 2], 0
lea eax, [eax + 1]
jne 0x405112
or dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x34]
push eax
call fcn.00413ee6
pop eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 1
push eax
call sub.ole32.dll_CoTaskMemFree
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405258
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], ecx
mov dword [esi], esp
or dword [esi + 0xc], 0xffffffff
push 4
pop ebx
mov dword [esi + 8], 0x41b600
lea ecx, [esi + ebx]
mov edi, dword [ebp + 8]
lea edx, [ebp - 0x44]
mov eax, dword fs:[0]
mov dword [esi + 4], eax
mov dword fs:[0], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + 4], edi
add ecx, edi
lea edi, [ebp - 0x34]
mov dword [edx + 8], ecx
and word [edx + 0xc], 0
mov ecx, edi
mov dword [edx], 1
call fcn.0040210f
mov ecx, dword [edi + 4]
and dword [esi + 0xc], 0
lea eax, [ebp + 0x10]
push ebx
push eax
push ebx
push 0
mov dword [ebp - 0x24], ecx
push ecx
push dword [ebp - 0x28]
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4052dc
mov ecx, dword [ebp - 0x20]
call fcn.0040149c
jmp 0x4052e2
mov eax, dword [ebp - 0x20]
mov byte [eax], 4
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
call fcn.004133b5
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4095f7
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [edx]
movdqa xmm2, xmm0
movdqa xmm1, xmm0
movdqa xmmword [ecx], xmm0
pslldq xmm1, 4
pslldq xmm2, 0xc
pxor xmm2, xmm1
aeskeygenassist xmm1, xmm0, 1
pshufd xmm1, xmm1, 0xff
pxor xmm1, xmm0
pslldq xmm0, 8
pxor xmm2, xmm0
pxor xmm1, xmm2
movdqa xmm0, xmm1
movdqa xmm2, xmm1
movdqa xmmword [ecx + 0x10], xmm1
pslldq xmm2, 4
pslldq xmm0, 0xc
pxor xmm0, xmm2
aeskeygenassist xmm2, xmm1, 2
pshufd xmm2, xmm2, 0xff
pxor xmm2, xmm1
pslldq xmm1, 8
pxor xmm0, xmm1
pxor xmm2, xmm0
movdqa xmm0, xmm2
movdqa xmm1, xmm2
movdqa xmmword [ecx + 0x20], xmm2
pslldq xmm1, 4
pslldq xmm0, 0xc
pxor xmm0, xmm1
aeskeygenassist xmm1, xmm2, 4
pshufd xmm1, xmm1, 0xff
pxor xmm1, xmm2
pslldq xmm2, 8
pxor xmm0, xmm2
pxor xmm1, xmm0
movdqa xmm0, xmm1
movdqa xmm2, xmm1
movdqa xmmword [ecx + 0x30], xmm1
pslldq xmm2, 4
pslldq xmm0, 0xc
pxor xmm0, xmm2
aeskeygenassist xmm2, xmm1, 8
pshufd xmm2, xmm2, 0xff
pxor xmm2, xmm1
pslldq xmm1, 8
pxor xmm0, xmm1
pxor xmm2, xmm0
movdqa xmm0, xmm2
movdqa xmm1, xmm2
movdqa xmmword [ecx + 0x40], xmm2
pslldq xmm1, 4
pslldq xmm0, 0xc
pxor xmm0, xmm1
aeskeygenassist xmm1, xmm2, 0x10
pshufd xmm1, xmm1, 0xff
pxor xmm1, xmm2
pslldq xmm2, 8
pxor xmm0, xmm2
pxor xmm1, xmm0
movdqa xmm0, xmm1
movdqa xmm2, xmm1
movdqa xmmword [ecx + 0x50], xmm1
pslldq xmm2, 4
pslldq xmm0, 0xc
pxor xmm0, xmm2
aeskeygenassist xmm2, xmm1, 0x20
pshufd xmm2, xmm2, 0xff
pxor xmm2, xmm1
pslldq xmm1, 8
pxor xmm0, xmm1
pxor xmm2, xmm0
movdqa xmm0, xmm2
movdqa xmm1, xmm2
movdqa xmmword [ecx + 0x60], xmm2
pslldq xmm1, 4
pslldq xmm0, 0xc
pxor xmm0, xmm1
aeskeygenassist xmm1, xmm2, 0x40
pshufd xmm1, xmm1, 0xff
pxor xmm1, xmm2
pslldq xmm2, 8
pxor xmm0, xmm2
pxor xmm1, xmm0
movdqa xmm0, xmm1
movdqa xmm2, xmm1
movdqa xmmword [ecx + 0x70], xmm1
pslldq xmm2, 4
pslldq xmm0, 0xc
pxor xmm0, xmm2
aeskeygenassist xmm2, xmm1, 0x80
pshufd xmm2, xmm2, 0xff
pxor xmm2, xmm1
pslldq xmm1, 8
pxor xmm0, xmm1
pxor xmm2, xmm0
movdqa xmm0, xmm2
movdqa xmm1, xmm2
movdqa xmmword [ecx + 0x80], xmm2
pslldq xmm1, 4
pslldq xmm0, 0xc
pxor xmm0, xmm1
aeskeygenassist xmm1, xmm2, 0x1b
pshufd xmm1, xmm1, 0xff
pxor xmm1, xmm2
pslldq xmm2, 8
pxor xmm0, xmm2
pxor xmm1, xmm0
movdqa xmm0, xmm1
movdqa xmm2, xmm1
movdqa xmmword [ecx + 0x90], xmm1
pslldq xmm2, 4
pslldq xmm0, 0xc
pxor xmm0, xmm2
aeskeygenassist xmm2, xmm1, 0x36
pshufd xmm2, xmm2, 0xff
pxor xmm2, xmm1
pslldq xmm1, 8
pxor xmm0, xmm1
pxor xmm2, xmm0
movdqa xmmword [ecx + 0xa0], xmm2
ret
Function at 0x40bb2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov edi, edx
lea eax, [edx + eax*2]
mov dword [esp], eax
xor eax, eax
cmp edi, dword [esp]
je 0x40bb8e
movzx edx, byte [edi + 1]
cmp byte [edi], ch
lea ebx, [edi + 2]
lea esi, [eax + edx]
jne 0x40bb74
cmp eax, esi
ja 0x40bbd7
cmp esi, dword [esp + 0x20]
ja 0x40bbc7
add eax, dword [esp + 0x1c]
test edx, edx
je 0x40bb7c
dec edx
cmp byte [eax], cl
lea eax, [eax + 1]
jne 0x40bb66
jmp 0x40bb82
mov edi, ebx
mov eax, esi
jbe 0x40bb45
jmp 0x40bb8e
mov edi, ebx
mov eax, esi
jmp 0x40bb45
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 0x28]
movzx ecx, cx
mov al, 1
add edi, ebp
cmp ebp, edi
je 0x40bb84
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x40bbac
mov ebp, esi
jmp 0x40bbbf
cmp esi, edi
je 0x40bbe5
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x40bb84
xor al, 1
jmp 0x40bb99
mov edx, dword [esp + 0x20]
mov ecx, esi
push 0x42d160
call fcn.00429ee5
mov ecx, eax
mov edx, esi
push 0x42d160
call fcn.0042a04a
mov ecx, 0x42d150
call fcn.0042a10b
Function at 0x4128a5
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
mov edi, dword [edx + 4]
mov ebp, dword [edx]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov eax, ebx
rol ebx, 0xe
mov esi, edi
mov ecx, ebp
mov dword [esp], ebp
rol ebp, 0xe
rol eax, 0x19
rol esi, 0xe
rol ecx, 0x19
xor ebx, eax
mov eax, edi
xor ebp, ecx
rol eax, 0x19
xor esi, eax
mov eax, dword [edx + 8]
mov ecx, eax
mov edx, eax
rol ecx, 0x19
rol edx, 0xe
xor edx, ecx
mov ecx, dword [esp + 0x24]
shr ecx, 3
xor ecx, ebx
mov ebx, dword [esp]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
shr ebx, 3
xor ebx, ebp
mov ebp, dword [esp + 0x2c]
add ebx, edi
shr edi, 3
xor edi, esi
add edi, eax
shr eax, 3
xor eax, edx
mov edx, dword [ebp + 4]
add eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x28]
mov esi, edx
add ebx, dword [ecx]
add edi, dword [ecx + 4]
add eax, dword [ecx + 8]
mov ecx, edx
rol esi, 0xd
shr edx, 0xa
rol ecx, 0xf
xor esi, ecx
xor edx, esi
add edx, eax
mov eax, dword [ebp]
mov ecx, eax
mov esi, eax
shr eax, 0xa
rol ecx, 0xf
rol esi, 0xd
xor esi, ecx
mov ecx, edx
xor eax, esi
mov esi, edx
rol ecx, 0xf
rol esi, 0xd
add eax, edi
xor esi, ecx
mov ecx, edx
mov edi, eax
shr ecx, 0xa
rol edi, 0xd
xor ecx, esi
mov esi, eax
rol esi, 0xf
add ecx, ebx
xor edi, esi
mov esi, eax
shr esi, 0xa
xor esi, edi
mov edi, dword [esp]
add edi, dword [ebp + 0xc]
add edi, dword [esp + 8]
add edi, esi
mov esi, dword [esp + 0xc]
mov dword [esi], edi
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418d72
Capabilities:
Terminate process

Disassembly:
call fcn.004162b0
call 0x418d7c
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x41c155
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x41c194
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c194
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c194
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41c194
cmp dword [ecx + 0x74], 0xe
jbe 0x41c194
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x423316
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4233b3
push ebx
push esi
call fcn.004232df
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00423228
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x423360
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4233b2
push edi
push eax
call fcn.00423f16
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x423380
call fcn.00421e51
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4233b1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00423228
add esp, 0x20
test eax, eax
jne 0x42339f
push edi
call fcn.00421e51
jmp 0x4233a7
push ebx
call fcn.00421e51
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x424699
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433380
push 0x433378
push str.FlsAlloc
push 0x1e
call fcn.0042455a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4246cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x42b1bc]
call esi
jmp 0x4246d3
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x424717
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433390
push 0x433388
push str.FlsGetValue
push 0x20
call fcn.0042455a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42474e
push dword [ebp + 8]
mov ecx, esi
call dword [0x42b1bc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]
Function at 0x429bd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x429bfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x429bfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40274c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403b38
test esi, esi
jne 0x402782
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403c28
jmp 0x4027a0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402600
mov edi, eax
test esi, esi
je 0x4027a0
cmp dword [ebx], 0
je 0x4027a0
dec esi
jmp 0x402789
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402914
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x415008], 0x8088405
inc edx
mov dword [ebx + 0x415008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403118
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x415010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031b0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403190
xor eax, eax
push ebp
push 0x403189
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403190
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x415010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x415010], ax
mov esp, ebp
pop ebp
ret

Function at 0x4039bc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x416034], 0
je 0x403a1d
cmp word [0x416208], 0xd7b2
jne 0x4039e5
cmp dword [0x416210], 0
jbe 0x4039e5
mov eax, 0x416204
call dword [0x416220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41507c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403a44
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41501c], 0
jne 0x403a39
push 0
push 0x41509c
push 0x41507c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40f634
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f78
xor eax, eax
push ebp
push 0x40f6fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea ebx, [ebp - 0xc]
mov dword [ebx], esi
mov eax, dword [ebp - 4]
call fcn.00403d90
mov edi, eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp edi, 4
jl 0x40f69e
mov esi, dword [ebx]
lea eax, [ebp - 4]
call fcn.00403fd8
mov edx, edi
test edx, edx
jns 0x40f687
add edx, 3
sar edx, 2
mov dword [ebp - 0x10], edx
mov ebx, dword [ebp - 0x10]
dec ebx
test ebx, ebx
jl 0x40f69e
inc ebx
xor dword [eax], esi
add eax, 4
dec ebx
jne 0x40f696
xor esi, esi
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x10]
shl eax, 2
inc eax
mov ebx, edi
sub ebx, eax
jl 0x40f6dd
inc ebx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00403fd8
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, byte [ebp + esi - 0xc]
mov byte [eax + edi - 1], dl
inc esi
and esi, 0x80000003
jns 0x40f6d9
dec esi
or esi, 0xfffffffc
inc esi
inc edi
dec ebx
jne 0x40f6b4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403b8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f705
lea eax, [ebp - 4]
call fcn.00403b38
ret

Function at 0x40fa5c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x416780
mov eax, ebx
mov edx, 0xfffffff8
test al, 1
je 0x40fa78
shr eax, 1
xor eax, 0xedb88320
jmp 0x40fa7a
shr eax, 1
inc edx
jne 0x40fa6b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x40fa64
pop ebx
ret

Function at 0x40fa90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
cmp byte [0x41677c], 0
jne 0x40faa9
mov byte [0x41677c], 1
call fcn.0040fa5c
or ebx, 0xffffffff
mov eax, esi
call fcn.00403d90
mov edx, eax
test edx, edx
jle 0x40fae3
mov ecx, 1
mov eax, ebx
xor ebx, ebx
mov bl, byte [esi + ecx - 1]
xor ebx, eax
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x416780]
shr eax, 8
and eax, 0xffffff
xor ebx, eax
inc ecx
dec edx
jne 0x40fabe
and ebx, 0x7fffffff
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x411d84
Capabilities:
Parse pe header

Disassembly:
xor ecx, ecx
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x411da6
mov edx, eax
mov eax, dword [edx + 0x3c]
test eax, eax
jle 0x411da6
mov ecx, edx
add ecx, eax
cmp dword [ecx], 0x4550
je 0x411da6
xor ecx, ecx
mov eax, ecx
ret
Function at 0x40400f
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 4
mov esi, ecx
call fcn.00429cd2
mov edx, dword [esp + 0x14]
lea edi, [esi + 4]
push edi
xor ebx, ebx
push ebx
push eax
push 0x404650
push ebx
push ebx
mov dword [eax], edx
call fcn.004388ce
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x404044
pop edi
pop esi
pop ebx
ret 4
push 6
mov dword [edi], ebx
call fcn.00404ee8
int3

Function at 0x406875
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x406896
jl 0x40688d
test edi, edi
jne 0x406896
xor eax, eax
xor edx, edx
jmp 0x406957
cmp dword [ebx + 0x38], 0
je 0x4068ab
push eax
push edi
push dword [ebp + 8]
call fcn.0040695d
jmp 0x406957
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4068f2
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4068f2
cmp eax, edi
jb 0x4068cc
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0042b920
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4068f8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40694c
mov ecx, ebx
call fcn.00405f4b
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x406937
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0043c17a
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40694c
jmp 0x40690a
test edx, edx
je 0x40694c
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0043c17a
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x419a1f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x419a42
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x419a30
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x429714
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.0043ef43
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x429753
sub eax, 1
je 0x42974e
sub eax, 1
je 0x42974a
xor eax, eax
leave
ret
push 3
jmp 0x429755
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x46ac38
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046a81f

Function at 0x46ac43
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046a9ae

Function at 0x46b166
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042b110
mov eax, dword [0x497040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00469587
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x46b1a8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x46b304
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00480540
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4ddea0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0046c6f9
mov ecx, dword [esi*4 + 0x4ddea0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x46b2fd
cmp eax, dword [edi + ecx + 0x24]
jne 0x46b2fd
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46b2fd
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0046c6f9
add esp, 0x14
test edx, edx
jl 0x46b2fd
jg 0x46b273
test eax, eax
jb 0x46b2fd
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x46b2fd
jl 0x46b28d
cmp dword [ebp - 0x1008], eax
ja 0x46b2fd
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x46b2ab
test ebx, ebx
je 0x46b2e4
cmp ecx, edi
jae 0x46b2e4
mov al, byte [ecx]
cmp al, 0xd
jne 0x46b2c5
lea eax, [edi - 1]
cmp ecx, eax
jae 0x46b2d1
cmp byte [ecx + 1], 0xa
jne 0x46b2d1
inc ecx
jmp 0x46b2d1
movzx eax, al
movsx eax, byte [eax + 0x497308]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x46b2ab
cmp edx, ebx
jne 0x46b2ab
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x46b302
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00429cbf
leave
ret
Function at 0x46b882
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4ddea0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46b8c2
cmp byte [ebx], 0xa
jne 0x46b8c2
or byte [eax + edi + 0x28], 4
jmp 0x46b8c7
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x46b9c5
mov al, byte [edx]
cmp al, 0x1a
je 0x46b9a7
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x46b8f6
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x46b91b
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x46b925
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x46b8d8
jmp 0x46b9c5
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46b9a2
cmp dword [ebp - 0xc], 0
je 0x46b9a2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4ddea0]
test byte [eax + edi + 0x28], 0x48
je 0x46b97c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x46b967
mov byte [esi], dl
jmp 0x46b978
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4ddea0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x46b9c5
cmp byte [ebp - 1], 0xa
jne 0x46b98b
cmp esi, ebx
jne 0x46b98b
mov byte [esi], 0xa
jmp 0x46b9c4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0046c717
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x46b9c5
mov byte [esi], 0xd
jmp 0x46b9c4
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4ddea0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46b9c1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46b9c5
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret