joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce4c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cf50
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x61db8c
call sub.KERNEL32.DLL_EnterCriticalSection_1
cmp bx, word [0x61dba4]
jne 0x40ce98
mov eax, esi
mov edx, 0x61dba6
mov ecx, 0x55
call fcn.0040b00c
push 0x61db8c
call sub.KERNEL32.DLL_LeaveCriticalSection_1
jmp 0x40cf3a
push 0x61db8c
call sub.KERNEL32.DLL_LeaveCriticalSection_1
mov eax, esi
call fcn.0040a2bc
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale_1
test eax, eax
je 0x40cf07
cmp byte [0x61db88], 0
je 0x40cecc
mov edx, esi
mov eax, ebx
call fcn.0040cd30
jmp 0x40cf07
mov edx, esi
mov eax, ebx
call fcn.0040cb34
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40cf07
cmp dword [esi], 0
je 0x40cef0
mov eax, esi
mov edx, 0x40cf68
call fcn.0040b164
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040cb34
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040b164
push 0x61db8c
call sub.KERNEL32.DLL_EnterCriticalSection_1
mov word [0x61dba4], bx
mov eax, dword [esi]
call fcn.0040af50
mov ecx, eax
mov eax, 0x61dba6
mov edx, 0xaa
call fcn.0040c9b4
push 0x61db8c
call sub.KERNEL32.DLL_LeaveCriticalSection_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf57
lea eax, [ebp - 4]
call fcn.0040a2bc
ret
Function at 0x40d180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a3a0
xor eax, eax
push ebp
push 0x40d3a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40d1c0
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW_1
jmp 0x40d1da
mov eax, dword [ebp - 4]
call fcn.0040af50
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040c9b4
cmp word [ebp - 0x21a], 0
je 0x40d38f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d3b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d2a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d3b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d2a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d3f0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d2a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d3f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d2a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d424
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d2a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d458
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40d38f
xor eax, eax
push ebp
push 0x40d388
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040cf90
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40d318
mov eax, dword [ebp - 0x10]
call fcn.00406750
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040afb8
jmp 0x40d363
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40d498
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40d363
mov eax, dword [ebp - 0x10]
call fcn.00406750
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40d498
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040afb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d38f
cmp dword [ebp - 8], 0
je 0x40d37e
mov eax, dword [ebp - 8]
call fcn.0040676c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3ac
lea eax, [ebp - 4]
call fcn.0040a2bc
ret
Function at 0x40d694
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a3a0
xor eax, eax
push ebp
push 0x40d754
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040b00c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040b1bc
mov eax, dword [ebx]
call fcn.0040d55c
test al, al
jne 0x40d731
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040b00c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040b1bc
mov eax, dword [ebx]
call fcn.0040d55c
test al, al
jne 0x40d731
mov eax, ebx
call fcn.0040a2bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d75b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a31c
lea eax, [ebp - 4]
call fcn.0040a2bc
ret
Function at 0x41336a
Capabilities:
Get number of processors

Disassembly:
ror esp, cl
add byte [eax], al
and ecx, 0x140d6
call 0x413323
add byte [eax + 0x4f], al
cmp cl, byte [ebx + esi + 0x50]
xor edx, dword [eax + 0x3a]
add esp, 4
pop ecx
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x260], edx
jmp 0x413344
push edi
push ecx
add esp, 4
or edi, 0x7a8e
pop edi
push esi
sub esi, 0x10151
or esi, 0x100cd
call 0x41336a
add byte [edx + esi + 0x48], cl
inc ebp
xor bh, byte [edx]
inc edx
add esp, 4
pop esi
push eax
sub eax, 0x59
pop eax
mov ecx, dword [ebp - 0x260]
sub ecx, dword [ebp - 0x238]
cmp ecx, 0xffffffff
jb 0x4133be
push edi
xor edi, 0x124b9
call 0x41339b
add byte [edx], bh
inc eax
inc ebx
cmp al, 0x4d
dec ebp
cmp edi, dword [eax]
add esp, 4
jmp 0x4133a6
and edi, 0x224a
pop edi
push ebx
push edi
add esp, 4
or ebx, 0x18434
pop ebx
jmp 0x4135ba
mov dword [ebp - 0x6a0], 7
mov edx, dword [ebp - 0x260]
mov dword [ebp - 0x60c], edx
push edi
push edx
add esp, 4
xor edi, 0x14e07
or edi, 0x11e5d
and edi, 0x104c9
pop edi
push eax
xor eax, 0xfd67
add eax, 0x2580
pop eax
push edx
push edi
add esp, 4
and edx, 0xddb
pop edx
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x6a4], 0
mov ecx, dword [ebp - 0x260]
cmp ecx, dword [ebp - 0xb48]
jne 0x41343b
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0xb50], edx
jmp 0x41356c
cmp dword [ebp - 0x6a0], 0
jle 0x413560
push eax
sub eax, 0xc670
sub eax, 0xcb2f
or eax, 0x7f99
pop eax
push esi
xor esi, 0xd3b9
jmp 0x41346b
pop esi
push edx
xor edx, 0x2dea
and edx, 0x53e3
pop edx
mov eax, dword [ebp - 0x60c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x610]
movzx eax, byte [edx]
cmp ecx, eax
je 0x4134fc
push edi
and edi, 0x7b1b
or edi, 0x8483
sub edi, 0xa20f
pop edi
push ebx
push edx
add esp, 4
and ebx, 0x549
and ebx, 0xee7f
xor ebx, 0x14640
or ebx, 0xf7ad
pop ebx
mov ecx, dword [ebp - 0x60c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x610]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x4134e4
mov dword [ebp - 0xb4c], 1
jmp 0x4134ee
mov dword [ebp - 0xb4c], 0xffffffff
mov edx, dword [ebp - 0xb4c]
invalid
xchg ebp, eax
pop esp
stc
Function at 0x41339b
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
ror esp, cl
add byte [eax], al
and ecx, 0x140d6
call 0x413323
add byte [eax + 0x4f], al
cmp cl, byte [ebx + esi + 0x50]
xor edx, dword [eax + 0x3a]
add esp, 4
pop ecx
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x260], edx
jmp 0x413344
push edi
push ecx
add esp, 4
or edi, 0x7a8e
pop edi
push esi
sub esi, 0x10151
or esi, 0x100cd
call 0x41336a
add byte [edx + esi + 0x48], cl
inc ebp
xor bh, byte [edx]
inc edx
add esp, 4
pop esi
push eax
sub eax, 0x59
pop eax
mov ecx, dword [ebp - 0x260]
sub ecx, dword [ebp - 0x238]
cmp ecx, 0xffffffff
jb 0x4133be
push edi
xor edi, 0x124b9
call 0x41339b
add byte [edx], bh
inc eax
inc ebx
cmp al, 0x4d
dec ebp
cmp edi, dword [eax]
add esp, 4
jmp 0x4133a6
and edi, 0x224a
pop edi
push ebx
push edi
add esp, 4
or ebx, 0x18434
pop ebx
jmp 0x4135ba
mov dword [ebp - 0x6a0], 7
mov edx, dword [ebp - 0x260]
mov dword [ebp - 0x60c], edx
push edi
push edx
add esp, 4
xor edi, 0x14e07
or edi, 0x11e5d
and edi, 0x104c9
pop edi
push eax
xor eax, 0xfd67
add eax, 0x2580
pop eax
push edx
push edi
add esp, 4
and edx, 0xddb
pop edx
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x6a4], 0
mov ecx, dword [ebp - 0x260]
cmp ecx, dword [ebp - 0xb48]
jne 0x41343b
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0xb50], edx
jmp 0x41356c
cmp dword [ebp - 0x6a0], 0
jle 0x413560
push eax
sub eax, 0xc670
sub eax, 0xcb2f
or eax, 0x7f99
pop eax
push esi
xor esi, 0xd3b9
jmp 0x41346b
pop esi
push edx
xor edx, 0x2dea
and edx, 0x53e3
pop edx
mov eax, dword [ebp - 0x60c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x610]
movzx eax, byte [edx]
cmp ecx, eax
je 0x4134fc
push edi
and edi, 0x7b1b
or edi, 0x8483
sub edi, 0xa20f
pop edi
push ebx
push edx
add esp, 4
and ebx, 0x549
and ebx, 0xee7f
xor ebx, 0x14640
or ebx, 0xf7ad
pop ebx
mov ecx, dword [ebp - 0x60c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x610]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x4134e4
mov dword [ebp - 0xb4c], 1
jmp 0x4134ee
mov dword [ebp - 0xb4c], 0xffffffff
mov edx, dword [ebp - 0xb4c]
invalid
xchg ebp, eax
pop esp
stc

Function at 0x413510
Capabilities:
Get number of processors

Disassembly:
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
invalid
std
invalid
invalid
push ebx
push esi
add esp, 4
add ebx, 0xd142
pop ebx
push edi
push ebx
add esp, 4
jmp 0x413527
xor edi, 0x1659
pop edi
mov eax, dword [ebp - 0x6a0]
sub eax, 1
mov dword [ebp - 0x6a0], eax
invalid
invalid
hlt

Function at 0x413584
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
aaa
inc edi
dec ebx
cmp dword [esi], edi
dec esi
and ecx, 0x11ce4
pop ecx
push ebx
push ebx
add esp, 4
add ebx, 0x9b36
jmp 0x4135a6
pop ebx
invalid
invalid
invalid
std
invalid
Function at 0x4138ce
Capabilities:
Get number of processors

Disassembly:
push edi
sub edi, 0xbcb2
or edi, 0x74bc
pop edi
push ecx
add ecx, 0xd892
xor ecx, 0x1222d
pop ecx
push eax
jmp 0x413877
and eax, 0x166b1
or eax, 0x12380
pop eax
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push edi
sub edi, 0x3979
or edi, 0x1d8
pop edi
push ecx
push ecx
add esp, 4
call 0x4138ce
add byte [ecx], bh
xor eax, dword [edx + 0x42]
xor dh, byte [edi]
add esp, 4
add ecx, 0x127a2
pop ecx
push eax
xor eax, 0x134c8
pop eax
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
invalid
invalid
xchg ebp, eax
Function at 0x41543d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
add esp, 4
or esi, 0xa511
pop esi
push ebx
push edx
add esp, 4
sub ebx, 0x10a51
pop ebx
push edx
call fcn.004151cc
add byte [0x424d4337], dh
inc ecx
cmp byte [ebx + 0x505a04c4], al
add esp, 4
pop edx
push eax
add esp, 4
pop edx
push eax
or eax, 0xfa35
pop eax
lea ecx, [ebp - 0xcc4]
mov dword [ebp - 0x6e4], ecx
mov edx, dword [ebp - 0x248]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x6e0], eax
xor ecx, ecx
mov word [ebp - 0x124], cx
xor edx, edx
mov word [ebp - 0x38], dx
push edx
add edx, 0x11793
and edx, 0x93fb
pop edx
push edi
push edx
add esp, 4
and edi, 0x4d87
or edi, 0x13102
and edi, 0x138f2
pop edi
push esi
push ebx
add esp, 4
add esi, 0x1a34
pop esi
mov eax, dword [ebp - 0x6e0]
mov cx, word [eax]
mov word [ebp - 0x892], cx
mov edx, dword [ebp - 0x6e0]
add edx, 2
mov dword [ebp - 0x6e0], edx
mov ax, word [ebp - 0x892]
mov word [ebp - 0x124], ax
mov ecx, dword [ebp - 0x6e4]
mov dx, word [ecx]
mov word [ebp - 0x894], dx
mov eax, dword [ebp - 0x6e4]
add eax, 2
mov dword [ebp - 0x6e4], eax
mov cx, word [ebp - 0x894]
mov word [ebp - 0x38], cx
push ebx
sub ebx, 0xb0ed
xor ebx, 0x3d50
or ebx, 0x17dc0
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0x12585
pop ecx
push ecx
push eax
add esp, 4
and ecx, 0x8b01
or ecx, 0xe160
pop ecx
movzx edx, word [ebp - 0x38]
test edx, edx
jne 0x4152da
movzx eax, word [ebp - 0x124]
movzx ecx, word [ebp - 0x38]
sub eax, ecx
mov dword [ebp - 0xbe4], eax
jmp 0x415334
movzx edx, word [ebp - 0x124]
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x415202
movzx ecx, word [ebp - 0x124]
xor ecx, 0x20
movzx edx, word [ebp - 0x38]
cmp ecx, edx
je 0x415202
movzx eax, word [ebp - 0x124]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
jge 0x41531e
mov dword [ebp - 0xba0], 0xffffffff
jmp 0x415328
mov dword [ebp - 0xba0], 1
mov edx, dword [ebp - 0xba0]
mov dword [ebp - 0xbe4], edx
cmp dword [ebp - 0xbe4], 0
jne 0x41537d
push ebx
push ecx
add esp, 4
xor ebx, 0xa281
xor ebx, 0x121cf
xor ebx, 0xffce
pop ebx
push ebx
push ebx
add esp, 4
and ebx, 0xa40e
sub ebx, 0x13c92
jmp 0x41536e
pop ebx
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x3f0], eax
jmp 0x4153e5
push edi
xor edi, 0x17630
add edi, 0x3b46
sub edi, 0xb99a
sub edi, 0x7103
pop edi
push eax
push ecx
add esp, 4
and eax, 0x1c4f
and eax, 0x17481
sub eax, 0xbcf2
pop eax
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx]
mov dword [ebp - 0x248], edx
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x6e8]
je 0x4153db
mov ecx, dword [ebp - 0x248]
cmp dword [ecx + 0x30], 0
jne 0x4151a6
mov dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0
jne 0x41542f
push ecx
push edi
add esp, 4
xor ecx, 0x3938
call 0x415408
add byte [eax + 0x43], dl
cmp al, 0x4b
cmp byte [edx], bh
inc esi
aas
add esp, 4
pop ecx
push ebx
jmp 0x415413
or ebx, 0x14d4c
add ebx, 0xe6d5
pop ebx
mov dword [ebp - 0x618], 0
jmp 0x415f57
push edi
call 0x41543d
add byte [ebp + 0x48], al
cmp edi, dword [0x834a4740]
les eax, [ecx + eax*4]
iretd
Function at 0x422198
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4221f1
test eax, edx
je 0x4221f4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4221af
movzx eax, word [eax]
sub eax, ecx
jmp 0x4221d6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4221d7
add ecx, 4
js 0x4221c7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4221d4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4221d6
xor eax, eax
ret
test eax, eax
je 0x422200
test edx, edx
jne 0x4221a0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x502dc8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x502dce
ret

Function at 0x50e290
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50e445
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x50e421
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x50e421
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x50e258]
call fcn.0040c440
add esp, 4
lea eax, [ebp - 4]
call fcn.0040db14
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x61a1d0]
push eax
call sub.windowscodecs.dll_WICConvertBitmapSource
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0040c224
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x2c
call fcn.0040750c
mov dword [ebp - 0x3c], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x34], eax
mov word [ebp - 0x30], 1
mov word [ebp - 0x2e], 0x20
mov dl, 1
mov eax, dword [0x50168c]
call fcn.0050abe0
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor edx, edx
push ebp
push 0x50e3f8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov dl, 7
call fcn.0050c86c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
push 0
call fcn.00412c24
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.0050b87c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50e421
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e44c
lea eax, [ebp - 8]
mov edx, dword [0x50e258]
call fcn.0040c564
lea eax, [ebp - 4]
call fcn.0040db14
ret
Function at 0x518440
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x615978
test edx, edx
jne 0x51845f
xor eax, eax
jmp 0x51857d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x51847c
push esi
push edx
push eax
call fcn.00518584
add esp, 0xc
jmp 0x51857d
push esi
push edx
push eax
call fcn.00518844
add esp, 0xc
jmp 0x51857d
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5d6adc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5d6b0a
mov eax, ebx
call fcn.005d7598
cmp dword [ebx + 0x40], 0
je 0x5d6b03
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5d6b7b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5d6b6d
cmp dword [ebx + 8], 0
je 0x5d6b2c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5d6b3e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5d6b6d
cmp dword [ebx + 8], 0
je 0x5d6b1f
cmp eax, 3
je 0x5d6b51
dec eax
jne 0x5d6b1f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5d6b1f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5d6b1f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5d6b99
cmp dword [ebx + 0x14], 0xcc
je 0x5d6b99
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005d6ba4
pop ebx
ret

Function at 0x5ef7dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x5ef7f4
add esp, 0xfffffff0
call fcn.00408c10
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x5ef90e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00406738
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x5ef8f8
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00519560
xor eax, eax
push ebp
push 0x5ef8e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00519560
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040b048
jmp 0x5ef8b6
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040b374
mov eax, dword [ebx + 4]
call fcn.0040a7ac
dec eax
jle 0x5ef8ca
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x5ef8a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ef8ec
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ef915
lea eax, [ebp - 4]
call fcn.0040a304
ret