joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1500a1c4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d
mov dword [esp + 0x19], edi
add esp, 0x19
push esi
push 0
je 0x1500a1dc
add edx, 0
add dword [esp], ecx
push edx
push ebx
pop ebx
sub edx, edx
je 0x1500a1f2
dec esp
xchg ebp, eax
stosb byte es:[edi], al
wait
cmp byte [ecx], dl
jbe 0x1500a265
in al, 0x4d
add dl, byte [ebx]
or edx, 0xffffffff
push ecx
call 0x1500a210
dec esi
outsd dx, dword [esi]
jl 0x1500a207
pop edx
mov ebp, dword [eax - 0x7f]
adc al, 0xbd
adc al, 0xbd
mov dl, 3
cmp byte [ecx - 0x74a6a002], 0xcc
and edx, dword [ecx + 4]
sub esp, 4
mov dword [esp], 0x760b497b
xor dword [esp], 0x760b497b
add edi, dword [esp]
lea esp, [esp + 4]
test edx, esi
mov ecx, dword [ecx]
js 0x1500a237
sub esi, 0
add esp, 8
pop ecx
pop esi
pop edi
mov esp, ebp
lea esp, [esp - 0x40]
xchg dword [esp + 0x40], ebp
mov dword [esp + 0x40], ebp
lea esp, [esp + 0x44]
push 0xffffffffffffffc8
call 0x1500a260
popal
xchg byte [edi + 0x74], al
popfd
adc ah, bl
loopne 0x1500a1f8
pop esi
add esp, 8
jmp 0x1500a26c
push ebp
push 0x5b
clc
sal dword [esi], 1
aaa
ret 0xc

Function at 0x1500bc3c
Capabilities:
Encode data using xor

Disassembly:
push 0
push ecx
mov ecx, esp
call 0x1500bb60
int 0x82
call 0x1500bb6a
xchg ebx, eax
ror cl, 1
into
out dx, eax
add esp, 8
or dword [ecx + 4], ebp
pop ecx
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea esp, [esp - 4]
mov dword [esp], edx
mov edi, dword [ebp + 8]
mov edi, dword [edi]
lea edi, [edi + 0xc00]
mov esi, 0x7159b292
xor ecx, ecx
jne 0x1541180b
not ecx
and ecx, 0xfa
mov dword [edi], esi
js 0x1500bba8
add edi, 0
jns 0x1500bbad
sub edx, 0
add edi, 4
inc esi
push esi
call fcn.14ffb430
or dword [esp - 0x6d], esi
jb 0x1500bbc3
sub eax, 0
cmp al, 0xff
jne 0x1500bbb0
inc esi
dec ecx
jne 0x1500bb9e
mov edi, dword [ebp + 8]
mov edi, dword [edi]
lea edi, [edi]
mov esi, 0x7159b7be
push 0x300
lea eax, [esi]
push 0x40
push 0xec7b
push ecx
mov ecx, esp
jne 0x1500bbf9
sub edx, 0
jmp 0x1500bc12
and dword [ecx + 4], eax
or dword [ecx + 4], eax
pop ecx
call fcn.14ffbb37
mov eax, eax
and eax, 0x3ff
xchg ecx, esi
and esi, 0
add esi, 9
xor dword [esp - 0x5e], ebx
push 0x45
call 0x1500bc3c
lcall 0x9f1, 0x8708c483
pop esp
and al, 0xd3
cmp eax, 3
je 0x1500bc65
mov ecx, 0x49
xor dword [esp - 0x3d], esi
cmp eax, 4
je 0x1500bc65
mov ecx, 1
mov dword [edi], esi
add edi, 4
push esi
call fcn.1500be4b
mov edx, 4
xor dword [esp - 0x12], edx
mul edx
add esi, eax
dec ecx
jne 0x1500bc6a
mov dword [esp - 0x3f], esi
dec dword [esp]
jne 0x1500bbe4
add esp, 4
xor edx, edx
jne 0x15411911
sub edx, edx
or edx, dword [esp]
add esp, 4
pop ecx
pop ebx
pop esi
xchg dword [esp], edi
mov dword [esp], edi
lea esp, [esp + 4]
leave
ret 4
Function at 0x1500d767
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp - 0x52]
xchg dword [esp + 0x4e], ebp
mov ebp, dword [esp + 0x4e]
lea esp, [esp + 0x4e]
mov ebp, esp
add dword [esp - 0x18], esi
sub esp, 8
push edi
push esi
push edx
push ecx
push ebx
push ebp
push 0xffffffffffffffff
push 0x715913d8
lea esp, [esp - 4]
mov dword [esp], 0x71581491
push 0xffffffffffffffff
call fcn.14ffe26f
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
Function at 0x1500db7b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 8
and al, 3
push 0x30254a91
call 0x1500db7b
div bh
int 0x82
add esp, 8
and eax, 3
push eax
call fcn.1500d732
ja 0x1500db8f
sub edi, 0
add dword [esp - 0x37], edi
test dword [edx + 0x68], eax
je 0x1500dc1b
test dword [edx + 0x70], 0x100
jne 0x1500dbce
mov al, byte [esi + 1]
and dword [esp - 0x35], esi
jmp 0x1500dbb7
shr al, 3
and al, 7
and eax, 7
push eax
call fcn.1500d732
test dword [edx + 0x70], eax
je 0x1500dc1b
test dword [edx + 0x6c], 0x100
jne 0x1500dbfa
add dword [esp - 0x18], edx
mov al, byte [esi + 1]
and al, 7
and eax, 7
push eax
call fcn.1500d732
and dword [esp - 0x1b], ecx
test dword [edx + 0x6c], eax
je 0x1500dc1b
Function at 0x1500dd22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x1500dd2f
and eax, 0xa108abfa
mov byte [edi + 0x8c483b4], 0xc0
call 0x9a03503b
fdiv dword [eax + 6]
Function at 0x150130d7
Capabilities:
Encode data using add xor sub operations

Disassembly:
or bh, byte [ebx - 0x68]
int1
salc
push edi
add esp, 8
add esp, 8
neg edi
or edi, 0xffffffff
push esi
xor esi, esi
jne 0x15418cbf
mov esi, esp
and edi, dword [esi + 4]
mov dword [esp - 0x21], esi
mov esi, dword [esi]
push esi
and esi, 0xfe2ab961
mov esi, esp
mov dword [esi - 0x32], edi
pop esi
mov dword [esp - 0x22], ecx
add esp, 8
pop esi
pop edx
pop ebx
leave
ret 0x14
push 0x40ec7b
push esi
mov esi, esp
call 0x1501308a
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x11e8fe], 0
add byte [edi - 0x54], bl
jne 0x1501309d
jnp 0x1501302d
int1
salc
push edi
inc esp
sub eax, 0x29b0f362
scasb al, byte es:[edi]
dec edi
add esp, 8
sub dword [esi + 0x8c4834f], ebp
and dword [esi + 4], ebp
push ebx
dec ebx
mov ebx, esp
xor dword [ebx - 0x69], eax
pop ebx
jbe 0x150130b3
xor eax, 0
or dword [esi + 4], ebp
pop esi
mov ebp, esp
sub esp, 0x104
sub esp, 0xd
xor dword [esp + 9], eax
call 0x150130d7
push 0x5b
clc
sal dword [esi], 1
aaa
movsb byte es:[edi], byte [esi]
or eax, 0x910d3c2
call 0x150130e8
push cs
das
cmp al, 0xc5
sbb cl, byte [ebx + 0x28]
inc ecx
out 0x27, al
aam 0x7d
add esp, 8
xor eax, dword [esp + 9]
push ebx
and ebx, 0
jne 0x15418d6e
or ebx, 0xffffffff
push eax
or eax, edx
mov eax, esp
mov dword [eax - 0x5b], esi
pop eax
xor ecx, 0
not ebx
or ebx, 0x486abb3
jmp 0x1501311d
or edi, edi
xor ebx, 0x55e6afca
xor ebx, 0x51600479
sub ecx, ebx
pop ebx
xor dword [esp + 9], eax
mov eax, dword [esp + 9]
add esp, 9
push 0xffffffffffffffff
sub ecx, 0
push edx
and edx, ecx
mov edx, esp
cmp dword [edx - 0xe], edi
pop edx
and dword [esp], ebx
sbb al, 0x24
push ecx
push edx
push edi
sub esp, 4
add ebx, 0
or dword [esp - 0x61], esi
xor dword [esp], esi
call 0x1501316f
cmp eax, 0x39008332
jle 0x15013148
sub al, 0xf5
mov bh, bl
sbb byte [ecx - 0x18], dh
adc al, 0
add byte [eax], al
push esi
xlatb
les ebp, [ebp - 0x56cf8c1e]
iretd
Function at 0x150130e8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
or bh, byte [ebx - 0x68]
int1
salc
push edi
add esp, 8
add esp, 8
neg edi
or edi, 0xffffffff
push esi
xor esi, esi
jne 0x15418cbf
mov esi, esp
and edi, dword [esi + 4]
mov dword [esp - 0x21], esi
mov esi, dword [esi]
push esi
and esi, 0xfe2ab961
mov esi, esp
mov dword [esi - 0x32], edi
pop esi
mov dword [esp - 0x22], ecx
add esp, 8
pop esi
pop edx
pop ebx
leave
ret 0x14
push 0x40ec7b
push esi
mov esi, esp
call 0x1501308a
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x11e8fe], 0
add byte [edi - 0x54], bl
jne 0x1501309d
jnp 0x1501302d
int1
salc
push edi
inc esp
sub eax, 0x29b0f362
scasb al, byte es:[edi]
dec edi
add esp, 8
sub dword [esi + 0x8c4834f], ebp
and dword [esi + 4], ebp
push ebx
dec ebx
mov ebx, esp
xor dword [ebx - 0x69], eax
pop ebx
jbe 0x150130b3
xor eax, 0
or dword [esi + 4], ebp
pop esi
mov ebp, esp
sub esp, 0x104
sub esp, 0xd
xor dword [esp + 9], eax
call 0x150130d7
push 0x5b
clc
sal dword [esi], 1
aaa
movsb byte es:[edi], byte [esi]
or eax, 0x910d3c2
call 0x150130e8
push cs
das
cmp al, 0xc5
sbb cl, byte [ebx + 0x28]
inc ecx
out 0x27, al
aam 0x7d
add esp, 8
xor eax, dword [esp + 9]
push ebx
and ebx, 0
jne 0x15418d6e
or ebx, 0xffffffff
push eax
or eax, edx
mov eax, esp
mov dword [eax - 0x5b], esi
pop eax
xor ecx, 0
not ebx
or ebx, 0x486abb3
jmp 0x1501311d
or edi, edi
xor ebx, 0x55e6afca
xor ebx, 0x51600479
sub ecx, ebx
pop ebx
xor dword [esp + 9], eax
mov eax, dword [esp + 9]
add esp, 9
push 0xffffffffffffffff
sub ecx, 0
push edx
and edx, ecx
mov edx, esp
cmp dword [edx - 0xe], edi
pop edx
and dword [esp], ebx
sbb al, 0x24
push ecx
push edx
push edi
sub esp, 4
add ebx, 0
or dword [esp - 0x61], esi
xor dword [esp], esi
call 0x1501316f
cmp eax, 0x39008332
jle 0x15013148
sub al, 0xf5
mov bh, bl
sbb byte [ecx - 0x18], dh
adc al, 0
add byte [eax], al
push esi
xlatb
les ebp, [ebp - 0x56cf8c1e]
iretd
Function at 0x150165c9
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
push ebx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0xdc12c045
lea esp, [esp + 0xd]
mov dword [esp], ecx
push edx
push edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x150165eb
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x150165eb
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x150165eb
mov dword [esp - 0x1d], esi
jb 0x15016621
sub edx, 0
cmp word [ebx + 4], 0x14c
jne 0x150165eb
test word [ebx + 0x16], 2
je 0x150165eb
test word [ebx + 0x16], 0x100
je 0x150165eb
jmp 0x15016657
push ebx
call 0x15016668
sbb al, 0x25
cli
stosd dword es:[edi], eax
or byte [ecx - 0x224b783a], ah
push edx
add esp, 8
cmp word [ebx + 0x18], 0x10b
jne 0x150165eb
mov edx, dword [ebx + 0x78]
cmp dword [esp - 0x23], ecx
cmp edx, 0
je 0x150165eb
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.14ffda71
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x150165eb
lea esi, [edx + 0x316f4195]
or esi, 0xffffffff
push ecx
xor ecx, 0x723b9e9b
mov ecx, esp
and esi, dword [ecx + 4]
xor eax, 0
mov ecx, dword [ecx]
push eax
call 0x150166d7
add dl, byte [ebx]
push eax
dec ecx
dec esi
outsd dx, dword [esi]
jl 0x150166d2
pop edx
mov ebp, dword [eax - 0x7f]
adc al, 0xbd
adc al, 0xbd
mov dl, 3
add esp, 8
add esp, 8
sub edi, edi
jne 0x15016756
or edi, 0xffffffff
not edi
or edi, dword [esp]
add esp, 4
not edx
or edx, 0xffffffff
push ebx
sub ebx, ebx
jne 0x1541c36f
mov ebx, esp
mov dword [ebx - 9], edi
pop ebx
not edx
push eax
add eax, esi
mov eax, esp
xor edx, dword [eax + 4]
push edx
lea edx, [esi + edi*2 - 0x55f35438]
mov edx, esp
cmp dword [edx - 0x37], edi
pop edx
or dword [esp - 0x21], ecx
mov eax, dword [eax]
push ebx
and ebx, eax
mov ebx, esp
sub dword [ebx - 0xb], ecx
pop ebx
add esp, 8
pop ecx
xchg dword [esp], ebx
mov dword [esp], ebx
lea esp, [esp + 4]
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
ret 8
invalid
Function at 0x15016668
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
push ebx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0xdc12c045
lea esp, [esp + 0xd]
mov dword [esp], ecx
push edx
push edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x150165eb
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x150165eb
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x150165eb
mov dword [esp - 0x1d], esi
jb 0x15016621
sub edx, 0
cmp word [ebx + 4], 0x14c
jne 0x150165eb
test word [ebx + 0x16], 2
je 0x150165eb
test word [ebx + 0x16], 0x100
je 0x150165eb
jmp 0x15016657
push ebx
call 0x15016668
sbb al, 0x25
cli
stosd dword es:[edi], eax
or byte [ecx - 0x224b783a], ah
push edx
add esp, 8
cmp word [ebx + 0x18], 0x10b
jne 0x150165eb
mov edx, dword [ebx + 0x78]
cmp dword [esp - 0x23], ecx
cmp edx, 0
je 0x150165eb
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.14ffda71
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x150165eb
lea esi, [edx + 0x316f4195]
or esi, 0xffffffff
push ecx
xor ecx, 0x723b9e9b
mov ecx, esp
and esi, dword [ecx + 4]
xor eax, 0
mov ecx, dword [ecx]
push eax
call 0x150166d7
add dl, byte [ebx]
push eax
dec ecx
dec esi
outsd dx, dword [esi]
jl 0x150166d2
pop edx
mov ebp, dword [eax - 0x7f]
adc al, 0xbd
adc al, 0xbd
mov dl, 3
add esp, 8
add esp, 8
sub edi, edi
jne 0x15016756
or edi, 0xffffffff
not edi
or edi, dword [esp]
add esp, 4
not edx
or edx, 0xffffffff
push ebx
sub ebx, ebx
jne 0x1541c36f
mov ebx, esp
mov dword [ebx - 9], edi
pop ebx
not edx
push eax
add eax, esi
mov eax, esp
xor edx, dword [eax + 4]
push edx
lea edx, [esi + edi*2 - 0x55f35438]
mov edx, esp
cmp dword [edx - 0x37], edi
pop edx
or dword [esp - 0x21], ecx
mov eax, dword [eax]
push ebx
and ebx, eax
mov ebx, esp
sub dword [ebx - 0xb], ecx
pop ebx
add esp, 8
pop ecx
xchg dword [esp], ebx
mov dword [esp], ebx
lea esp, [esp + 4]
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
ret 8
invalid
Function at 0x402f90
Capabilities:
Accept command line arguments

Disassembly:
mov dword [0x430530], ebp
mov dword [0x430534], esp
mov edi, edi
push ebp
mov ebp, esp
mov dword [0x430528], edi
mov dword [0x43052c], ebx
mov dword [0x430524], esi
call fcn.00402f50
pop ebp
jmp 0x4041b2
push 0xf0
push 0x426098
call fcn.0040730c
push dword [0x42f1b0]
call fcn.004072d1
pop ecx
mov dword [0x42f1b0], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4041a7
mov ecx, dword [ebp - 0xa4]
and ecx, 0x7fff
mov edi, dword [ebp - 0xa0]
cmp edi, 2
je 0x40404e
or ecx, 0x8000
mov edx, dword [ebp - 0xac]
mov eax, edx
shl eax, 8
mov esi, dword [ebp - 0xa8]
add eax, esi
mov dword [0x4306a0], edi
mov dword [0x4306a8], eax
mov dword [0x4306ac], edx
mov dword [0x4306b0], esi
mov dword [0x4306a4], ecx
call fcn.00403f99
mov dword [ebp - 0xb8], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.00407199
pop ecx
test eax, eax
jne 0x40409f
push 0x1c
call fcn.00403f70
pop ecx
call fcn.00406fbd
test eax, eax
jne 0x4040b0
push 0x10
call fcn.00403f70
pop ecx
mov dword [ebp - 4], ebx
call fcn.004068a4
test eax, eax
jge 0x4040c4
push 0x1b
call fcn.00405bc9
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x432144], eax
call fcn.0040676d
mov dword [0x43053c], eax
call fcn.00406684
test eax, eax
jge 0x4040ea
push 8
call fcn.00405bc9
pop ecx
call fcn.00406321
test eax, eax
jge 0x4040fb
push 9
call fcn.00405bc9
pop ecx
push ebx
call fcn.00405d22
pop ecx
test eax, eax
je 0x40410d
push eax
call fcn.00405bc9
pop ecx
call fcn.004062c2
test byte [ebp - 0xd4], bl
je 0x404123
movzx ecx, word [ebp - 0xd0]
jmp 0x404126
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call fcn.00402fc0
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb8], 0
jne 0x404149
push eax
call fcn.00405e78
call fcn.00405ea4
jmp 0x40418a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0xb4]
jmp 0x4041ac
mov eax, 0xff
call fcn.00407354
ret
call fcn.00407363
jmp 0x403fda
Function at 0x405f28
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x42f560]
je 0x405f4e
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x405f3c
cmp esi, 0x17
jae 0x4060a8
push 3
call fcn.0040e9c9
cmp eax, 1
pop ecx
je 0x406072
push 3
call fcn.0040e9c9
test eax, eax
pop ecx
jne 0x405f81
cmp dword [0x42f1b0], 1
je 0x406072
cmp edi, 0xfc
je 0x4060a8
push 0x4018c4
mov edi, 0x314
push edi
mov esi, 0x4306e8
push esi
call fcn.0040e961
add esp, 0xc
test eax, eax
je 0x405fb7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004081be
add esp, 0x14
mov byte [0x430805], bl
push 0x104
mov ebx, 0x430701
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405ffa
push 0x4018ac
push 0x2fb
push ebx
call fcn.0040e961
add esp, 0xc
test eax, eax
je 0x405ffa
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004081be
add esp, 0x14
push ebx
push edi
push esi
call fcn.0040e8ed
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x406018
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004081be
add esp, 0x14
push 0x4018a8
push edi
push esi
call fcn.0040e8ed
add esp, 0xc
test eax, eax
je 0x406038
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004081be
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x42f564]
push edi
push esi
call fcn.0040e8ed
add esp, 0xc
test eax, eax
je 0x40605d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004081be
add esp, 0x14
push 0x12010
push 0x401880
push esi
call fcn.0040e74d
add esp, 0xc
jmp 0x4060a8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x4060a8
cmp edi, 0xffffffff
je 0x4060a8
mov edx, dword [esi*8 + 0x42f564]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406091
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40df20
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x40df33
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40df2f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x40df50
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40df8f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40df85
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40df91
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40df75
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40e74d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00406b92
xor ebx, ebx
cmp dword [0x430b94], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40e824
push 0x401c0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40e78f
xor eax, eax
jmp 0x40e8e8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c00
push edi
call esi
cmp eax, ebx
je 0x40e788
push eax
call fcn.00406b2c
mov dword [esp], 0x401bf0
push edi
mov dword [0x430b94], eax
call esi
push eax
call fcn.00406b2c
mov dword [esp], 0x401bdc
push edi
mov dword [0x430b98], eax
call esi
push eax
call fcn.00406b2c
mov dword [0x430b9c], eax
lea eax, [ebp - 8]
push eax
call fcn.00405c64
test eax, eax
pop ecx
pop ecx
je 0x40e7f2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004081be
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40e824
push 0x401bc0
push edi
call esi
push eax
call fcn.00406b2c
cmp eax, ebx
pop ecx
mov dword [0x430ba4], eax
je 0x40e824
push 0x401ba8
push edi
call esi
push eax
call fcn.00406b2c
pop ecx
mov dword [0x430ba0], eax
mov eax, dword [0x430ba0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40e89d
cmp dword [0x430ba4], esi
je 0x40e89d
push eax
call fcn.00406b9b
pop ecx
call eax
cmp eax, ebx
je 0x40e86a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x430ba4]
call fcn.00406b9b
pop ecx
call eax
test eax, eax
je 0x40e86a
test byte [ebp - 0x18], 1
jne 0x40e89d
lea eax, [ebp - 0xc]
push eax
call fcn.00405ce1
test eax, eax
pop ecx
je 0x40e885
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004081be
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40e894
or dword [ebp + 0x10], 0x200000
jmp 0x40e8ce
or dword [ebp + 0x10], 0x40000
jmp 0x40e8ce
mov eax, dword [0x430b98]
cmp eax, esi
je 0x40e8ce
push eax
call fcn.00406b9b
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40e8ce
mov eax, dword [0x430b9c]
cmp eax, esi
je 0x40e8ce
push dword [ebp - 4]
push eax
call fcn.00406b9b
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x430b94]
call fcn.00406b9b
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415703
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.00406dde
mov ebx, dword [ebp + 8]
mov esi, eax
add esi, 0x9c
test ebx, ebx
jne 0x41572b
or dword [esi + 8], 0x104
jmp 0x4157ef
lea eax, [ebx + 0x40]
test eax, eax
lea edi, [esi + 4]
mov dword [esi], ebx
mov dword [edi], eax
je 0x41574e
cmp byte [eax], 0
je 0x41574e
push edi
push 0x16
push 0x402cd8
call fcn.004150db
add esp, 0xc
mov eax, dword [esi]
and dword [esi + 8], 0
test eax, eax
je 0x4157ab
cmp byte [eax], 0
je 0x4157ab
mov eax, dword [edi]
test eax, eax
je 0x41576f
cmp byte [eax], 0
je 0x41576f
call fcn.00415648
jmp 0x415774
call fcn.004156bb
cmp dword [esi + 8], 0
jne 0x415805
push esi
push 0x41
push 0x402ac8
call fcn.004150db
add esp, 0xc
test eax, eax
je 0x4157fb
mov edi, dword [edi]
test edi, edi
je 0x4157a4
cmp byte [edi], 0
je 0x4157a4
call fcn.00415648
jmp 0x4157fb
call fcn.004156bb
jmp 0x4157fb
mov edi, dword [edi]
test edi, edi
je 0x4157e8
cmp byte [edi], 0
je 0x4157e8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4157bb
xor ecx, ecx
sub eax, edx
cmp eax, 3
sete cl
push 1
push 0x415240
mov dword [esi + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x4157fb
and dword [esi + 8], 0
jmp 0x4157fb
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], 0
je 0x4158f9
mov eax, ebx
add ebx, 0x80
neg eax
sbb eax, eax
and eax, ebx
push eax
mov edx, esi
call fcn.00415151
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp + 8], edi
je 0x4158f9
cmp edi, 0xfde8
je 0x4158f9
cmp edi, 0xfde9
je 0x4158f9
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4158f9
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4158f9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x415880
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], di
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4158f4
cmp word [eax], 0x814
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jne 0x4158b9
push 0x402dac
push 0x40
push ebx
call fcn.0040e961
add esp, 0xc
test eax, eax
je 0x4158ca
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004081be
add esp, 0x14
jmp 0x4158ca
push 0x40
push ebx
push 0x1001
push dword [esi + 0x18]
call edi
test eax, eax
je 0x4158f9
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call edi
test eax, eax
je 0x4158f9
push 0xa
push 0x10
add ebx, 0x80
push ebx
push dword [ebp + 8]
call fcn.0041bc08
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4158fb
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret