joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f33d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1005f34c
pop dword [ebp - 0x3c]
mov eax, 0x391d6e73
add eax, 0xd6e884d9
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd05a6d40
add dword [ebp - 0x4c], 0x7df7d80b
mov dword [ebp - 0x48], 0x2cc258b9
sub dword [ebp - 0x48], 0xfa8f0c74
mov dword [ebp - 0x44], 0xdfb3b433
add dword [ebp - 0x44], 0x6c988ffb
mov dword [ebp - 0x40], 0x84890120
add dword [ebp - 0x40], 0x7b76fee0
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x18a5800f
sub dword [ebp - 0x4c], 0xa43316b9
mov dword [ebp - 0x48], 0x46130698
add dword [ebp - 0x48], 0xfb595add
mov dword [ebp - 0x44], 0xf421f7f9
add dword [ebp - 0x44], 0x6f4d7473
mov dword [ebp - 0x40], 0xaaa43bc5
add dword [ebp - 0x40], 0x555bc43b
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x454d6d40
add eax, 0xcabb02e4
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x433b3
push 0
call eax
mov ecx, 0xafc38841
add ecx, 0x503cd43a
xor esi, esi
add esi, eax
mov edx, 0xd1dccbc9
sub edx, 0xc1d13bc9
add edx, dword [ebp - 0x3c]
mov ebx, 0xb8272252
xor dword [ebp - 0x10], 0xf74679d3
mov edi, dword [edx]
add dword [ebp - 0x10], 0x401dafc7
xor edi, ebx
sub dword [ebp - 0x28], edx
mov dword [esi], edi
sub dword [ebp - 8], ecx
add esi, 0x3559d998
sub esi, 0x3559d994
add edx, 0x2531d145
add edx, 0xdace2ebf
loop 0x1005f465
add eax, 0x2e3255e4
sub eax, 0x2e30f125
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x919844e
sub ecx, 0xf919844e
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x52686f45
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0xac02195
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x72f220
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24b000]
lea eax, [edi + 0x2c1ff0]
push dword [eax]
mov dword [eax], 0x6e022b3c
push eax
push edi
or ebp, 0xffffffff
jmp 0x72f252
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x72f259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x72f248
mov eax, 1
add ebx, ebx
jne 0x72f26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x72f27c
jne 0x72f29b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x72f29b
dec eax
add ebx, ebx
jne 0x72f288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x72f260
add ebx, ebx
jne 0x72f297
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x72f2ed
xor ecx, ecx
sub eax, 3
jb 0x72f2b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x72f322
sar eax, 1
mov ebp, eax
jmp 0x72f2be
add ebx, ebx
jne 0x72f2be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x72f28c
inc ecx
add ebx, ebx
jne 0x72f2cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x72f28c
add ebx, ebx
jne 0x72f2d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x72f2ce
jne 0x72f2ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x72f2ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x72f30c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x72f2fe
jmp 0x72f24e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x72f30c
add edi, ecx
jmp 0x72f24e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x10f46
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x72f32e
cmp byte [edi], 0x2a
jne 0x72f32e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x72f333
lea edi, [esi + 0x319000]
mov eax, dword [edi]
or eax, eax
je 0x72f3a2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x339e3c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x339e64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x72f360
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x339e6c]
or eax, eax
je 0x72f39c
mov dword [ebx], eax
add ebx, 4
jmp 0x72f37d
call dword [esi + 0x339e68]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x72f3d3
cmp al, 0xef
ja 0x72f3c6
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x72f3a8
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x72f3b5
mov ebp, dword [esi + 0x339e70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x72f407
sub esp, 0xffffff80
jmp 0x5b4754
Function at 0x100193bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100193cb
pop dword [ebp - 0x4c]
mov eax, 0x100193cb
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xa9abffa6
sub dword [ebp - 0x5c], 0x5b59ba5b
mov dword [ebp - 0x58], 0x2a0c9271
add dword [ebp - 0x58], 0x826b9d4
mov dword [ebp - 0x54], 0xc1b2bfc7
add dword [ebp - 0x54], 0x8a998467
mov dword [ebp - 0x50], 0x411f2898
add dword [ebp - 0x50], 0xbee0d768
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x74338478
add eax, 0x9bce9bcc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x5fd07fee
add dword [ebp - 0x5c], 0x14a1e968
mov dword [ebp - 0x58], 0xa7825552
add dword [ebp - 0x58], 0x99ea0c23
mov dword [ebp - 0x54], 0xa12a268e
sub dword [ebp - 0x54], 0x3dbaba22
mov dword [ebp - 0x50], 0x396b4815
add dword [ebp - 0x50], 0xc694b7eb
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xeba2faac
sub eax, 0xdba0da6c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x36b92
push 0
call eax
mov ecx, 0x4275
mov edx, eax
mov ebx, 0x9b542917
add ebx, 0x74aef2e9
add ebx, dword [ebp - 0x4c]
mov edi, 0xfbab2063
sub edi, 0xb5a46bd6
add dword [ebp - 0x3c], 0x76cdafc7
mov esi, dword [ebx]
add dword [ebp - 0x38], edi
add esi, edi
xor dword [ebp - 0x40], 0xc941d6ca
mov dword [edx], esi
add edx, 0x20c2b63f
sub edx, 0x20c2b63b
add ebx, 0x203e4ed5
sub ebx, 0x203e4ed1
loop 0x100194e2
add eax, 0xb3be9304
add eax, 0x4c4269a3
mov ebx, eax
add eax, 0x8166aba
sub eax, 0x8166ab5
mov ecx, 0x6e833500
sub ecx, 0x5e833500
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1001fc58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001fc67
pop dword [ebp - 0x28]
mov eax, 0xd90743e7
sub eax, 0xc9054780
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x91fb4f31
add dword [ebp - 0x38], 0xbc56f61a
mov dword [ebp - 0x34], 0xff4d685
add dword [ebp - 0x34], 0x223e75c0
mov dword [ebp - 0x30], 0x229a9dd6
add dword [ebp - 0x30], 0x29b1a658
mov dword [ebp - 0x2c], 0x102fb51d
add dword [ebp - 0x2c], 0xefd04ae3
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa35a5200
add eax, 0x6ca5bf08
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x9c10e6dc
add dword [ebp - 0x38], 0xd861827a
mov dword [ebp - 0x34], 0xf91d6e25
add dword [ebp - 0x34], 0x484ef350
mov dword [ebp - 0x30], 0xce98ef3a
add dword [ebp - 0x30], 0x94d67d32
mov dword [ebp - 0x2c], 0xab37a2fd
add dword [ebp - 0x2c], 0x54c85d03
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae32
push 0
call eax
mov ecx, 0xa5efadf
add ecx, 0xf5a14604
xor edx, edx
add edx, eax
mov edi, 0x70c62db2
add edi, 0x9f3c884e
add edi, dword [ebp - 0x28]
mov esi, 0xac372477
add esi, 0xf16eb7eb
add dword [ebp - 0x20], eax
mov ebx, dword [edi]
xor dword [ebp - 8], 0xc38e88d
sub ebx, esi
add dword [ebp - 0x24], 0x97e6c2a4
mov dword [edx], ebx
mov dword [ebp - 0x18], 0x1a546c77
add edx, 0xafc3d628
sub edx, 0xafc3d624
add edi, 0x31d8cc7c
sub edi, 0x31d8cc78
loop 0x1001fd86
add eax, 0xa7703933
sub eax, 0xa76f42d4
xor ebx, ebx
add ebx, eax
add eax, 0xbc2f71d8
sub eax, 0xbc2f71d3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x10023fab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100037dc]
jne 0x100243f1
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100289d8], eax
mov dword [0x100289d4], ecx
mov dword [0x100289d0], edx
mov dword [0x100289cc], ebx
mov dword [0x100289c8], esi
mov dword [0x100289c4], edi
mov word [0x100289f0], ss
mov word [0x100289e4], cs
mov word [0x100289c0], ds
mov word [0x100289bc], es
mov word [0x100289b8], fs
mov word [0x100289b4], gs
pushfd
pop dword [0x100289e8]
mov eax, dword [ebp]
mov dword [0x100289dc], eax
mov eax, dword [ebp + 4]
mov dword [0x100289e0], eax
lea eax, [ebp + 8]
mov dword [0x100289ec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10028928], 0x10001
mov eax, dword [0x100289e0]
mov dword [0x100288dc], eax
mov dword [0x100288d0], 0xc0000409
mov dword [0x100288d4], 1
mov eax, dword [0x100037dc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10028734]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10028920], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100037e4
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10028920], 0
jne 0x100244dd
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x40ca80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40ca8f
pop dword [ebp - 0x10]
mov eax, 0x653df501
add eax, 0x9b02d58e
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x27ea2552
add dword [ebp - 0x20], 0x26681ff9
mov dword [ebp - 0x1c], 0x58edc1f8
sub dword [ebp - 0x1c], 0x26ba75b3
mov dword [ebp - 0x18], 0xf100bedf
add dword [ebp - 0x18], 0x5b4b854f
mov dword [ebp - 0x14], 0x524c015
sub dword [ebp - 0x14], 0x524c015
lea eax, [ebp - 0x20]
push eax
mov eax, 0x57c174e2
add eax, 0xa87fcbae
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xcf0b3a42
add dword [ebp - 0x20], 0xa5672f14
mov dword [ebp - 0x1c], 0x843bd9d5
sub dword [ebp - 0x1c], 0x42cf7860
mov dword [ebp - 0x18], 0x8d0a48f3
add dword [ebp - 0x18], 0xd6652379
mov dword [ebp - 0x14], 0x52dc3010
sub dword [ebp - 0x14], 0x52dc3010
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x8654773d
add eax, 0x79ecc8ff
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39b69
push 0
call eax
mov ecx, 0x3ba39b5a
sub ecx, 0x3ba3592c
xor ebx, ebx
add ebx, eax
mov esi, 0x4dbc5204
add esi, 0xb2856dfc
add esi, dword [ebp - 0x10]
mov edi, 0xc17239eb
add edi, 0x27566ef9
mov dword [ebp - 0xc], 0x62d91587
mov edx, dword [esi]
sub dword [ebp - 4], 0x4edcb49c
xor edx, edi
add dword [ebp - 8], ebx
mov dword [ebx], edx
add dword [ebp - 0xc], ebx
add ebx, 4
add esi, 0x2891f4c5
add esi, 0xd76e0b3f
loop 0x40cbb3
add eax, 0xfb8b
xor ebx, ebx
add ebx, eax
add eax, 0x76c55139
sub eax, 0x76c55134
mov ecx, 0x2d744ff7
sub ecx, 0x2d344ff7
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.kernel32
call esi
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
mov ebx, 0x40de38
nop
mov ecx, 0x496d6acf
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0xf643410
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10471058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104711a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1047107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1047106a
add dl, dl
jne 0x10471089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104710dc
xor eax, eax
add dl, dl
jne 0x10471096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1047117d
add dl, dl
jne 0x104710a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104710d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10471075
mov eax, 1
add dl, dl
jne 0x104710ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104710e1
sub eax, ebx
mov ebx, 1
jne 0x10471128
mov ecx, 1
add dl, dl
jne 0x1047110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10471119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10471105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10471075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1047113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1047114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10471136
cmp eax, 0x7d00
jae 0x1047116d
cmp eax, 0x500
jb 0x10471168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10471075
cmp eax, 0x7f
ja 0x10471170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10471075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1047119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10471075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x43ce6e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43cead
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43cead
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43cead
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43cead
cmp dword [ecx + 0x74], 0xe
jbe 0x43cead
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43e196
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x43e1b7
jl 0x43e1ae
test edi, edi
jne 0x43e1b7
xor eax, eax
xor edx, edx
jmp 0x43e278
cmp dword [ebx + 0x38], 0
je 0x43e1cc
push eax
push edi
push dword [ebp + 8]
call fcn.0043e27e
jmp 0x43e278
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x43e213
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x43e213
cmp eax, edi
jb 0x43e1ed
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0043f1e0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x43e219
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x43e26d
mov ecx, ebx
call fcn.0043d9f0
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x43e258
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0044829f
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x43e26d
jmp 0x43e22b
test edx, edx
je 0x43e26d
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0044829f
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x44b4a5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47a8e8
push 0x47a8e0
push str.FlsAlloc
push 0x1f
call fcn.0044b310
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44b4d9
push dword [ebp + 8]
mov ecx, esi
call dword [0x45b164]
call esi
jmp 0x44b4df
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44b523
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47a8f8
push 0x47a8f0
push str.FlsGetValue
push 0x21
call fcn.0044b310
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44b55a
push dword [ebp + 8]
mov ecx, esi
call dword [0x45b164]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x44b562
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x47a900
push 0x47a8f8
push str.FlsSetValue
push 0x22
call fcn.0044b310
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44b59c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x45b164]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x44ecad
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x44ed4a
push ebx
push esi
call fcn.0044ec76
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044ec0a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x44ecf7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44ed49
push edi
push eax
call fcn.0044c33b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x44ed17
call fcn.0044c1e8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44ed48
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044ec0a
add esp, 0x20
test eax, eax
jne 0x44ed36
push edi
call fcn.0044c1e8
jmp 0x44ed3e
push ebx
call fcn.0044c1e8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x45199e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0044ad80
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x451a0d
cmp esi, dword [ebp - 4]
je 0x451a08
cmp dword [ebp + 0xc], 0
je 0x451a08
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4519e5
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004514f0
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x451a0f
xor eax, eax
inc eax
jmp 0x451a0f
xor eax, eax
pop edi
pop esi
leave
ret