joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], edi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp edi, 0x7ffffffe
ja 0x404c75
mov dword [esi + 0x14], 7
cmp edi, 8
jae 0x404b11
mov dword [esi + 0x10], edi
test edi, edi
je 0x404b06
mov ecx, edi
mov eax, 0x200020
shr ecx, 1
mov edi, esi
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x10]
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x404b91
mov eax, edi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x404b38
push 0x7fffffff
mov ecx, esi
call fcn.004079c0
mov ecx, eax
mov eax, 0x7ffffffe
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
jmp 0x404b57
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov ecx, esi
mov dword [ebp - 4], eax
inc eax
push eax
call fcn.004079c0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
lea edx, [esi + 0x14]
mov dword [ebp - 0xc], edx
lea ecx, [esi + 0x10]
mov edx, esi
mov dword [edx], ebx
mov ebx, edi
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov ecx, edi
mov edi, dword [ebp - 0x14]
mov eax, 0x200020
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
xor edx, edx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov ebx, dword [ebp - 8]
mov word [ecx + eax*2], dx
cmp dword [esi + 0x14], 8
lea edx, [esi + 0x14]
mov edi, esi
jb 0x404b9e
mov edi, dword [esi]
cmp dword [ebx + 0x14], 8
mov esi, dword [ebx + 0x10]
mov dword [ebp - 4], esi
jb 0x404baf
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
xor ecx, ecx
test esi, esi
je 0x404c69
cmp esi, 0x20
jb 0x404c4c
lea eax, [esi - 1]
lea eax, [ebx + eax*2]
lea edx, [esi - 1]
lea edx, [edi + edx*2]
cmp edi, eax
ja 0x404bd6
cmp edx, ebx
jae 0x404c4c
movaps xmm2, xmmword [0x4562b0]
lea edx, [ebx + 0x30]
mov eax, esi
mov esi, ebx
and eax, 0xffffffe0
sub esi, edi
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
lea eax, [edi + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [edx - 0x30]
lea eax, [eax + 0x40]
add ecx, 0x20
movaps xmm1, xmm2
lea edx, [edx + 0x40]
pxor xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [ebx + eax - 0x40]
pxor xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [edx - 0x50]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [edx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, dword [ebp - 0xc]
jb 0x404c00
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, esi
jae 0x404c69
sub ebx, edi
lea edx, [edi + ecx*2]
sub esi, ecx
mov ecx, 0xbf
lea edx, [edx + 2]
xor cx, word [edx + ebx - 2]
mov word [edx - 2], cx
sub esi, 1
jne 0x404c53
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00408350
int3
Function at 0x404c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44671d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call fcn.00404e00
push 0x20
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x18]
call fcn.004078a0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
mov dword [ebp - 0x2c], esi
jb 0x404cdf
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp eax, 0x10
mov dword [ebp - 0x34], edx
cmovae esi, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x30], esi
test edx, edx
je 0x404da3
cmp edx, 0x40
jb 0x404d86
lea eax, [edx - 1]
add eax, esi
cmp ecx, eax
ja 0x404d1a
lea eax, [edx - 1]
add eax, ecx
cmp eax, esi
jae 0x404d86
movaps xmm1, xmmword [0x4563d0]
lea ecx, [esi + 0x30]
mov eax, edx
mov edx, esi
and eax, 0xffffffc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
movups xmm0, xmmword [ecx - 0x30]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [esi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edi, dword [ebp - 0x3c]
jb 0x404d40
mov esi, dword [ebp - 0x30]
cmp edi, edx
jae 0x404da0
mov eax, dword [ebp - 0x2c]
sub esi, eax
sub edx, edi
lea ecx, [edi + eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor al, 0xc2
mov byte [ecx - 1], al
sub edx, 1
jne 0x404d90
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x404dd2
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x404dc8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404df2
push ecx
push edx
call fcn.00421817
add esp, 8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421809
mov esp, ebp
pop ebp
ret 4
call fcn.0042699f
int3
Function at 0x404eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4467ad
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call fcn.00405030
push 0x20
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x18]
call fcn.004078a0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
mov dword [ebp - 0x2c], esi
jb 0x404f0f
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp eax, 0x10
mov dword [ebp - 0x34], edx
cmovae esi, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x30], esi
test edx, edx
je 0x404fd3
cmp edx, 0x40
jb 0x404fb6
lea eax, [edx - 1]
add eax, esi
cmp ecx, eax
ja 0x404f4a
lea eax, [edx - 1]
add eax, ecx
cmp eax, esi
jae 0x404fb6
movaps xmm1, xmmword [0x4563e0]
lea ecx, [esi + 0x30]
mov eax, edx
mov edx, esi
and eax, 0xffffffc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
movups xmm0, xmmword [ecx - 0x30]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [esi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edi, dword [ebp - 0x3c]
jb 0x404f70
mov esi, dword [ebp - 0x30]
cmp edi, edx
jae 0x404fd0
mov eax, dword [ebp - 0x2c]
sub esi, eax
sub edx, edi
lea ecx, [edi + eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor al, 0xc4
mov byte [ecx - 1], al
sub edx, 1
jne 0x404fc0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x405002
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x404ff8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405022
push ecx
push edx
call fcn.00421817
add esp, 8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421809
mov esp, ebp
pop ebp
ret 4
call fcn.0042699f
int3
Function at 0x4050e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44683d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call fcn.00405260
push 0x20
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x18]
call fcn.004078a0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
mov dword [ebp - 0x2c], esi
jb 0x40513f
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp eax, 0x10
mov dword [ebp - 0x34], edx
cmovae esi, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x30], esi
test edx, edx
je 0x405203
cmp edx, 0x40
jb 0x4051e6
lea eax, [edx - 1]
add eax, esi
cmp ecx, eax
ja 0x40517a
lea eax, [edx - 1]
add eax, ecx
cmp eax, esi
jae 0x4051e6
movaps xmm1, xmmword [0x4563f0]
lea ecx, [esi + 0x30]
mov eax, edx
mov edx, esi
and eax, 0xffffffc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
movups xmm0, xmmword [ecx - 0x30]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [esi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edi, dword [ebp - 0x3c]
jb 0x4051a0
mov esi, dword [ebp - 0x30]
cmp edi, edx
jae 0x405200
mov eax, dword [ebp - 0x2c]
sub esi, eax
sub edx, edi
lea ecx, [edi + eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor al, 0xc5
mov byte [ecx - 1], al
sub edx, 1
jne 0x4051f0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x405232
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x405228
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405252
push ecx
push edx
call fcn.00421817
add esp, 8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421809
mov esp, ebp
pop ebp
ret 4
call fcn.0042699f
int3
Function at 0x405310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4468cd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call fcn.00405490
push 0x20
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x18]
call fcn.004078a0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
mov dword [ebp - 0x2c], esi
jb 0x40536f
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp eax, 0x10
mov dword [ebp - 0x34], edx
cmovae esi, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x30], esi
test edx, edx
je 0x405433
cmp edx, 0x40
jb 0x405416
lea eax, [edx - 1]
add eax, esi
cmp ecx, eax
ja 0x4053aa
lea eax, [edx - 1]
add eax, ecx
cmp eax, esi
jae 0x405416
movaps xmm1, xmmword [0x456400]
lea ecx, [esi + 0x30]
mov eax, edx
mov edx, esi
and eax, 0xffffffc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
movups xmm0, xmmword [ecx - 0x30]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [esi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edi, dword [ebp - 0x3c]
jb 0x4053d0
mov esi, dword [ebp - 0x30]
cmp edi, edx
jae 0x405430
mov eax, dword [ebp - 0x2c]
sub esi, eax
sub edx, edi
lea ecx, [edi + eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor al, 0xc9
mov byte [ecx - 1], al
sub edx, 1
jne 0x405420
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x405462
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x405458
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405482
push ecx
push edx
call fcn.00421817
add esp, 8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421809
mov esp, ebp
pop ebp
ret 4
call fcn.0042699f
int3
Function at 0x405550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44695d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call fcn.004056d0
push 0x20
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x18]
call fcn.004078a0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
mov dword [ebp - 0x2c], esi
jb 0x4055af
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp eax, 0x10
mov dword [ebp - 0x34], edx
cmovae esi, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x30], esi
test edx, edx
je 0x405673
cmp edx, 0x40
jb 0x405656
lea eax, [edx - 1]
add eax, esi
cmp ecx, eax
ja 0x4055ea
lea eax, [edx - 1]
add eax, ecx
cmp eax, esi
jae 0x405656
movaps xmm1, xmmword [0x456430]
lea ecx, [esi + 0x30]
mov eax, edx
mov edx, esi
and eax, 0xffffffc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
movups xmm0, xmmword [ecx - 0x30]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [esi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edi, dword [ebp - 0x3c]
jb 0x405610
mov esi, dword [ebp - 0x30]
cmp edi, edx
jae 0x405670
mov eax, dword [ebp - 0x2c]
sub esi, eax
sub edx, edi
lea ecx, [edi + eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor al, 0xd4
mov byte [ecx - 1], al
sub edx, 1
jne 0x405660
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4056a2
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x405698
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056c2
push ecx
push edx
call fcn.00421817
add esp, 8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421809
mov esp, ebp
pop ebp
ret 4
call fcn.0042699f
int3
Function at 0x4058a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446a2d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45d010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
call fcn.00405a20
push 0x20
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp - 0x18]
call fcn.004078a0
cmp dword [esi + 0x14], 0x10
mov ecx, esi
mov dword [ebp - 0x2c], esi
jb 0x4058ff
mov ecx, dword [esi]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmp eax, 0x10
mov dword [ebp - 0x34], edx
cmovae esi, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x30], esi
test edx, edx
je 0x4059c3
cmp edx, 0x40
jb 0x4059a6
lea eax, [edx - 1]
add eax, esi
cmp ecx, eax
ja 0x40593a
lea eax, [edx - 1]
add eax, ecx
cmp eax, esi
jae 0x4059a6
movaps xmm1, xmmword [0x4562f0]
lea ecx, [esi + 0x30]
mov eax, edx
mov edx, esi
and eax, 0xffffffc0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x10
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
movups xmm0, xmmword [ecx - 0x30]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [esi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edi, dword [ebp - 0x3c]
jb 0x405960
mov esi, dword [ebp - 0x30]
cmp edi, edx
jae 0x4059c0
mov eax, dword [ebp - 0x2c]
sub esi, eax
sub edx, edi
lea ecx, [edi + eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor al, 0x41
mov byte [ecx - 1], al
sub edx, 1
jne 0x4059b0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4059f2
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4059e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a12
push ecx
push edx
call fcn.00421817
add esp, 8
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421809
mov esp, ebp
pop ebp
ret 4
call fcn.0042699f
int3

Function at 0x408dfa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00408dd6
pop esi
leave
ret 8
Function at 0x4212c2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.0042a849
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x421301
sub eax, 1
je 0x4212fc
sub eax, 1
je 0x4212f8
xor eax, eax
leave
ret
push 3
jmp 0x421303
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x422546
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x422585
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x422585
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x422585
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x422585
cmp dword [ecx + 0x74], 0xe
jbe 0x422585
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43552c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44eb80
push 0x44eb78
push str.FlsAlloc
push 0x1e
call fcn.00435399
mov esi, eax
add esp, 0x10
test esi, esi
je 0x435560
push dword [ebp + 8]
mov ecx, esi
call dword [0x44a15c]
call esi
jmp 0x435566
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4355aa
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44eb90
push 0x44eb88
push str.FlsGetValue
push 0x20
call fcn.00435399
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4355e1
push dword [ebp + 8]
mov ecx, esi
call dword [0x44a15c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x43b4cd
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x45d010]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x43b518
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0043b66c
test al, al
jne 0x43b512
sub edx, 2
cmp edx, edi
jne 0x43b4f8
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x43b53a
lea eax, [edi + 2]
cmp edx, eax
je 0x43b53a
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0043b419
add esp, 0x10
jmp 0x43b634
push esi
lea ecx, [ebp - 0x255]
call fcn.0043b66c
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43b57d
push dword [ebp - 0x25c]
jmp 0x43b52a
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x43b5ba
cmp word [ebp - 0x226], 0
je 0x43b5db
cmp word [ebp - 0x226], ax
jne 0x43b5ba
cmp word [ebp - 0x224], 0
je 0x43b5db
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0043b419
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x43b627
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x43b594
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x43b60f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43b634
push 0x43b249
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004434b0
add esp, 0x10
jmp 0x43b604
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421809
leave
ret

Function at 0x43bfdc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x43bfed
pop esi
ret
push ebx
push edi
push esi
call fcn.0043bfa5
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004365e4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43c015
push ebx
push esi
push edi
call fcn.00422d60
add esp, 0xc
push 0
call fcn.004365aa
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x43c3d9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c02a