joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1609e1a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp - 0x48]
cmp ax, di
mov ecx, dword [eax + 8]
sar edx, 0xba
mov edx, dword [eax + 0xc]
push ebx
push esi
dec esi
or esi, 0xc214d229
push edi
dec si
btc esi, 0x83
mov edi, 1
mov esi, edi
shl esi, cl
sbb ch, 0x3c
shl ecx, cl
not cl
mov ecx, dword [eax + 4]
cmp dx, 0x7ca7
xor ebx, ebx
test di, 0xba9e
mov dword [ebp - 0x20], edx
sub esi, edi
cmc
test bp, cx
mov dword [ebp - 0x44], esi
test dl, 0x9e
bsr si, sp
sbb si, 0x740b
mov esi, edi
cmp dx, bp
clc
test ebx, 0x42cae9d
shl esi, cl
sub cl, 0x2e
ror ch, 0x39
mov ecx, dword [ebp + 0xc]
cmp cx, bp
mov dword [ebp - 0x18], ebx
cmp esp, edx
clc
mov byte [ebp - 1], bl
test edx, esi
stc
sub esi, edi
stc
mov dword [ebp - 0x48], esi
cmp dx, di
inc si
mov esi, dword [eax]
mov dword [ecx], ebx
shl ch, 0x11
mov cl, 0x8c
btc ecx, 0x19
mov ecx, dword [ebp + 0x14]
clc
mov dword [ecx], ebx
sbb ecx, 0x6d3ca6a9
sar ch, cl
mov ecx, dword [eax + 4]
movzx ax, dh
rol ax, 0xb8
add ecx, esi
mov eax, 0x300
test dl, 0x20
shl eax, cl
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
cmc
test bh, 0x1e
clc
mov dword [ebp - 0x10], edi
test bp, bp
cmp ax, ax
stc
add eax, 0x736
mov dword [ebp - 0x28], edi
jmp 0x162f8c3
mov dword [ebp - 0x2c], edi
je 0x15ad10c
mov ecx, eax
bts ax, si
sal di, 0x8f
adc ah, 0xa7
mov eax, 0x400
shl edi, 0xbf
clc
mov edi, edx
bts dx, si
movzx edx, ax
sar al, 0xc
mov eax, edx
test esp, 0x713ad42c
shl edx, 0x10
test ebx, esp
or eax, edx
stc
shr ecx, 1
rep stosd dword es:[edi], eax
jmp 0x15ad102
inc bx
mov ecx, dword [esp + edx - 0x441e6984]
dec esi
mov dword [esp + edx - 0x441e6984], edx
inc edx
xor byte [esp + edx - 0x441e697f], 0x9a
inc ebp
movsx esi, dx
inc bx
mov edi, dword [esi - 0x6982]
dec ecx
not edx
dec edx
sar dword [esp + esi - 0x6984], 0xed
call fcn.015d4b8e
push ebp
mov ebp, esp
jmp 0xdb0a11
mov dword [ebp - 0x24], edi
jmp 0x15a51d1
Function at 0x1c36058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01c361a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1c3607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c3606a
add dl, dl
jne 0x1c36089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c360dc
xor eax, eax
add dl, dl
jne 0x1c36096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c3617d
add dl, dl
jne 0x1c360a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c360b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c360bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c360c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1c360d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1c36075
mov eax, 1
add dl, dl
jne 0x1c360ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c360f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c360e1
sub eax, ebx
mov ebx, 1
jne 0x1c36128
mov ecx, 1
add dl, dl
jne 0x1c3610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c36119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c36105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c36075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1c3613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c3614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c36136
cmp eax, 0x7d00
jae 0x1c3616d
cmp eax, 0x500
jb 0x1c36168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c36075
cmp eax, 0x7f
ja 0x1c36170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c36075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1c3619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1c36075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x416830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x41684a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416840
mov eax, 1
add ebx, ebx
jne 0x416863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416858
jne 0x416874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416858
xor ecx, ecx
sub eax, 3
jb 0x416888
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4168fa
mov ebp, eax
add ebx, ebx
jne 0x416893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4168a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4168c4
inc ecx
add ebx, ebx
jne 0x4168b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4168a5
jne 0x4168c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4168a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4168e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4168d5
jmp 0x416846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4168e4
add edi, ecx
jmp 0x416846
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41694c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x169f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416901
mov ecx, edi
jns 0x416930
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16a7c]
or eax, eax
je 0x416946
mov dword [ebx], eax
add ebx, 4
jmp 0x41691e
call dword [esi + 0x16a78]
mov ebp, dword [esi + 0x16a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416980
sub esp, 0xffffff80
jmp 0x404843
Function at 0x6f8a10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x29b000]
push edi
jmp 0x6f8a2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6f8a31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f8a20
mov eax, 1
add ebx, ebx
jne 0x6f8a43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6f8a54
jne 0x6f8a73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f8a73
dec eax
add ebx, ebx
jne 0x6f8a60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6f8a38
add ebx, ebx
jne 0x6f8a6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6f8ac5
xor ecx, ecx
sub eax, 3
jb 0x6f8a8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6f8afa
sar eax, 1
mov ebp, eax
jmp 0x6f8a96
add ebx, ebx
jne 0x6f8a96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f8a64
inc ecx
add ebx, ebx
jne 0x6f8aa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f8a64
add ebx, ebx
jne 0x6f8ab1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6f8aa6
jne 0x6f8ac2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6f8aa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6f8ae4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6f8ad6
jmp 0x6f8a26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6f8ae4
add edi, ecx
jmp 0x6f8a26
pop esi
mov edi, esi
mov ecx, 0x40f2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6f8b02
cmp byte [edi], 0x19
jne 0x6f8b02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6f8b07
lea edi, [esi + 0x2f1000]
mov eax, dword [edi]
or eax, eax
je 0x6f8b7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x50b75c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x50b8d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6f8b34
mov ecx, edi
jns 0x6f8b63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x50b8dc]
or eax, eax
je 0x6f8b79
mov dword [ebx], eax
add ebx, 4
jmp 0x6f8b51
call dword [esi + 0x50b8ec]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6f8bb0
cmp al, 0xef
ja 0x6f8ba3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6f8b85
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6f8b92
mov ebp, dword [esi + 0x50b8e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6f8be4
sub esp, 0xffffff80
jmp 0x420567
Function at 0x43b64d
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop ecx
sub edx, edx
sub edx, esi
add esi, 0x5f7a9b70
call fcn.0043b680
dec esi
sub edx, 0xa819349a
xor dword [ebx], ecx
mov edx, esi
push esi
pop esi
inc ebx
add edx, 0x9e850187
mov esi, esi
cmp ebx, edi
jne fcn.0043b64d
sub esi, edx
ret
Function at 0x402530
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026cd
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026cd
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x5fa6f4
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x5fbc20]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x5fb820]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5fc020]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x5fc420]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x5fb820]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5fbc20]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5fc020]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x5fc420]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x5fa718
jne 0x402640
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4026e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402530
add esp, 4
test eax, eax
js 0x4028cc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402754
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x402714
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028c7
lea esi, [ebx + 2]
jmp 0x402770
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x5fc020]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x5fb420]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fac20]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fa820]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fb020]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x5fc020]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x5fb420]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fac20]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fb020]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fa820]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x5fc020]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x5fb420]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fac20]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fb020]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fa820]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x5fc020]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x5fb420]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fac20]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fb020]
movzx eax, dl
movzx eax, byte [eax*4 + 0x5fc020]
xor ecx, dword [eax*4 + 0x5fa820]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402770
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac76a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x627490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.005921f8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a36
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00570b5f
push 0x621a64
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.00575e95
push edi
push esi
call fcn.0059248e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570aac
mov esp, ebp
pop ebp
ret 4

Function at 0x403fd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x627490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047d0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403f00
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404041
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00570b5f
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40406a
push dword [esp + 0xc]
call fcn.00448bc8
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x627490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x627490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.00421150
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.00448bcd
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f80
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060fa
push dword [esp + 0x18]
call fcn.00448bc8
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00570aac
mov esp, ebp
pop ebp
ret 4

Function at 0x4071d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acba8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x627490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00592bc1
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b980
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ad2eb
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x627490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x627490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0045ea41
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.004633ae
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40ba83
call fcn.0045f9ca
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40ba02
push 0x80004005
call fcn.0040ccd0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.00462cc9
test eax, eax
je 0x40ba36
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c660
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40ba5e
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ba83
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040b840
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00570aac
mov esp, ebp
pop ebp
ret

Function at 0x40c2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0045e350

Function at 0x40c530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c545
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c584
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c580
lea ebx, [ebx]
cmp esi, edx
jae 0x40c584
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c570
cmp esi, edx
jb 0x40c589
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret