joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411140
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x4a4090], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateSemaphoreA_16
sub esp, 0x10
mov dword [0x4a4094], eax
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x4111a0
mov dword [0x4a409c], eax
mov dword [esp + 4], sym._emutls_destroy
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
jne 0x4111a7
add esp, 0x1c
ret
call sym._GetLastError_0
jmp 0x411198
call sym._abort
Function at 0x4111ac
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov ecx, dword [0x4a4054]
test ecx, ecx
jne 0x4111d4
mov eax, dword [esi + 8]
test eax, eax
je 0x4112e4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esi + 8]
test ebp, ebp
je 0x411264
mov ebx, dword [0x4a409c]
call sym._GetLastError_0
mov edi, eax
mov dword [esp], ebx
call sym._TlsGetValue_4
push ecx
mov ebx, eax
mov dword [esp], edi
call sym._SetLastError_4
push edi
test ebx, ebx
je 0x411224
mov edi, dword [ebx]
cmp ebp, edi
ja 0x4112f3
dec ebp
mov eax, dword [ebx + ebp*4 + 4]
test eax, eax
jne 0x4111cc
mov eax, esi
call sym._emutls_alloc
mov dword [ebx + ebp*4 + 4], eax
jmp 0x4111cc
lea edi, [ebp + 0x20]
mov dword [esp + 4], 4
lea eax, [ebp + 0x21]
mov dword [esp], eax
call sym._calloc
mov ebx, eax
test eax, eax
je 0x4113b9
mov dword [eax], edi
mov dword [esp + 4], ebx
mov eax, dword [0x4a409c]
mov dword [esp], eax
call sym._TlsSetValue_8
push edx
push edx
test eax, eax
jne 0x41120e
call sym._GetLastError_0
jmp 0x41120e
cmp dword [0x46e014], 0
je 0x41133c
mov dword [esp], 0x4a4090
call sym._InterlockedIncrement_4
push edx
test eax, eax
jne 0x411388
mov ebp, dword [esi + 8]
test ebp, ebp
jne 0x41129d
mov ebp, dword [0x4a4098]
inc ebp
mov dword [0x4a4098], ebp
mov dword [esi + 8], ebp
cmp dword [0x4a4054], 0
je 0x4111df
mov dword [esp], 0x4a4090
call sym._InterlockedDecrement_4
push edx
test eax, eax
js 0x4111df
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [0x4a4094]
mov dword [esp], eax
call sym._ReleaseSemaphore_12
sub esp, 0xc
jmp 0x4111df
mov eax, esi
call sym._emutls_alloc
mov dword [esi + 8], eax
jmp 0x4111cc
lea edx, [edi + edi]
cmp ebp, edx
jbe 0x4112fd
lea edx, [ebp + 0x20]
lea eax, [edx*4 + 4]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._realloc
mov ebx, eax
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x4113b9
mov dword [eax], edx
sub edx, edi
lea ecx, [edx*4]
lea edx, [eax + edi*4 + 4]
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
jmp 0x411246
mov dword [esp], 0x46e018
call sym._InterlockedIncrement_4
push ebp
test eax, eax
jne 0x41135c
jmp 0x411377
mov dword [esp], 0
call sym._Sleep_4
push edi
cmp dword [0x46e014], 0
je 0x41134f
cmp dword [0x4a4054], 0
je 0x411286
jmp 0x411271
call sym._emutls_init
mov dword [0x46e014], 1
jmp 0x411365
mov dword [esp + 4], 0xffffffff
mov eax, dword [0x4a4094]
mov dword [esp], eax
call sym._WaitForSingleObject_8
push ebx
push ebx
test eax, eax
je 0x411286
mov dword [esp], 0x4a4090
call sym._InterlockedDecrement_4
push ecx
jmp 0x411286
call sym._abort
nop
Function at 0x41cf78
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4742bc], 0
jne 0x41d04c
mov byte [0x4742bc], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x41d098
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
sete al
add ebx, eax
mov dword [esp + 0x1c], 0xffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym.___cxa_demangle
mov ebp, eax
mov esi, dword [sym.imp.msvcrt.dll__iob]
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x41d042
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x476201
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x41d079
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x41d013
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x41d03d
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x41d093
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x1bcd474
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1bcd47e
pushal
call 0x1bcd484
pop ebp
sub ebp, 0x10
sub ebp, 0x17cd474
jmp 0x1bcd49a
mov eax, 0x17cd474
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0xeacdb41c
xor byte [eax], dl
inc eax
dec ecx
jne 0x1bcd4b1
jmp 0x1bcd4c4
xchg edi, eax
rcl dword [edi + 0x1c1c2095]
sbb al, 0x9d
fucom st(4)
sbb al, 0x1c
sbb al, 0x1f
shl dword [edx + ebx - 0x59e3e3e4], 1
xor al, 0x1c
sbb al, 0x1c
jmp 0x1bcd4de
Function at 0x4066d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x406015
lea edi, [esi - 0x5015]
push edi
or ebp, 0xffffffff
jmp 0x4066f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4066f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4066e8
mov eax, 1
add ebx, ebx
jne 0x40670b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x406700
jne 0x40671c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x406700
xor ecx, ecx
sub eax, 3
jb 0x406730
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4067a2
mov ebp, eax
add ebx, ebx
jne 0x40673b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x406748
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40676c
inc ecx
add ebx, ebx
jne 0x406758
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40674d
jne 0x406769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40674d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40678c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40677d
jmp 0x4066ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40678c
add edi, ecx
jmp 0x4066ee
pop esi
mov edi, esi
mov ecx, 1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4067aa
cmp byte [edi], 0
jne 0x4067aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4067af
lea edi, [esi + 0x4000]
mov eax, dword [edi]
or eax, eax
je 0x40681e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4067dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6058]
or eax, eax
je 0x406818
mov dword [ebx], eax
add ebx, 4
jmp 0x4067f9
call dword [esi + 0x6054]
mov ebp, dword [esi + 0x605c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x406852
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40a020
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40a0cb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e394
push edx
call dword [sym.imp.msvcrt.dll_sprintf]
mov edi, 0x40e38c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40a0b5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.msvcrt.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3fa46418
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x22466378
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x51af50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc0000]
push edi
jmp 0x51af6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51af71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51af60
mov eax, 1
add ebx, ebx
jne 0x51af83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51af94
jne 0x51afb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51afb3
dec eax
add ebx, ebx
jne 0x51afa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51af78
add ebx, ebx
jne 0x51afaf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51b005
xor ecx, ecx
sub eax, 3
jb 0x51afcb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51b03a
sar eax, 1
mov ebp, eax
jmp 0x51afd6
add ebx, ebx
jne 0x51afd6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51afa4
inc ecx
add ebx, ebx
jne 0x51afe4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51afa4
add ebx, ebx
jne 0x51aff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51afe6
jne 0x51b002
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51afe6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51b024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51b016
jmp 0x51af66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51b024
add edi, ecx
jmp 0x51af66
pop esi
mov edi, esi
mov ecx, 0x34ee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51b042
cmp byte [edi], 0x1e
jne 0x51b042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51b047
lea edi, [esi + 0x117000]
mov eax, dword [edi]
or eax, eax
je 0x51b0bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11c3b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11c4dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51b074
mov ecx, edi
jns 0x51b0a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11c4e0]
or eax, eax
je 0x51b0b9
mov dword [ebx], eax
add ebx, 4
jmp 0x51b091
call dword [esi + 0x11c4f0]
mov ebp, dword [esi + 0x11c4e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51b0f3
sub esp, 0xffffff80
jmp 0x47ec04
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
jge 0x414aed
mov al, 0x37
and al, 0x9e
aaa
xor dh, ch
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
invalid
or esi, dword [eax]
mov edx, ebx
scasd eax, dword es:[edi]
xor byte [ecx + 0x16df4ccd], cl
xor byte [ecx - 0x76cf5026], cl
int 0x4c
fist word [esi]
jae 0x414aee
daa
cmpsd dword [esi], dword es:[edi]
mov ah, 0xb
xor byte [edi + 0x76cff4f1], bh
xor dh, ah
iretd
Function at 0x38c123de
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4d0
mov eax, dword [0x38c27144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0x4d0]
push ecx
push eax
call fcn.38c16cff
mov esi, eax
test esi, esi
je 0x38c124cf
push 0
push esi
call fcn.38c16ee3
mov dword [ebp - 0x4c4], eax
test eax, eax
je 0x38c124c2
and dword [ebp - 0x4c0], 0
push 0x2b0
lea eax, [ebp - 0x4bc]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
push 0x2b4
lea eax, [ebp - 0x4c0]
push eax
push 0
push dword [ebp - 0x4c4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x38c124b6
cmp dword [esi], 1
jbe 0x38c124a6
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x14b
push dword [0x38c270d0]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.38c06580
add esp, 0x10
jmp 0x38c124b6
lea eax, [ebp - 0x4b4]
push eax
push dword [ebp + 0x10]
push ebx
call fcn.38c074ef
push dword [ebp - 0x4c4]
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, [ebp - 0x4d0]
push eax
push esi
call fcn.38c16d61
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.38c02c4c
leave
ret 0xc

Function at 0x38c12b99
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x38c27144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x2bc], eax
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
call fcn.38c12a05
xor edi, edi
cmp eax, edi
je 0x38c12bea
push 1
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
xor eax, eax
jmp 0x38c12c45
push edi
push dword [ebp - 0x2bc]
call 0x38c44d56
mov dword [esi], eax
cmp eax, edi
je 0x38c12c42
cmp ebx, edi
je 0x38c12c42
push dword [ebp + 0xc]
push ebx
push eax
call fcn.38c12b0a
push 0x108
push 0x2b4
mov dword [esi + 4], eax
lea eax, [ebp - 0x2b8]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x38c12c42
mov eax, dword [ebp - 0x2b8]
push edi
push eax
push 0x402
push dword [esi]
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.38c02c4c
leave
ret 0x10
Function at 0x38c165b0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x38c27144]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x78], 0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 5
lea eax, [ebp - 0x10]
push eax
push 0x10
mov esi, 0x400
push esi
call edi
test eax, eax
je 0x38c165ff
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov dword [ebp - 0x70], eax
jmp 0x38c16606
mov dword [ebp - 0x70], 3
push 5
lea eax, [ebp - 0x10]
push eax
push 0xf
push esi
call edi
test eax, eax
lea eax, [ebp - 0x10]
jne 0x38c1661d
mov eax, 0x38c16684
push dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
push dword [ebp + 8]
mov dword [ebp - 0x6c], eax
push 0x38c16678
lea eax, [ebp - 0x60]
push 0x28
push eax
call fcn.38c06580
add esp, 0x14
push dword [ebp + 0x14]
lea eax, [ebp - 0x78]
push ebx
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x38c16662
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0x14]
push ebx
call fcn.38c074ef
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.38c02c4c
leave
ret 0x10

Function at 0x38c17b26
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x38c17b87
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x38c17b7e
cmp dword [ebp - 0xc], 4
je 0x38c17b7e
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x38c17bca
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x38c17bc1
cmp dword [ebp - 0xc], esi
je 0x38c17bc1
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x38c17bd9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x38c27144]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push 1
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x38c17c4f
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.38c02c4c
leave
ret 0xc

Function at 0x38c17dff
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x38c17e78
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x38c17e51
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x38c17e58
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x38c17ef5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x38c28364]
cmp eax, 0xffffffff
jne 0x38c17f79
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x38c17f88
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x38c17f68
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x38c17f7c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x38c17f5f
cmp dword [ebp - 0xc], 4
jne 0x38c17f5f
cmp dword [ebp - 0x10], eax
je 0x38c17f5f
mov dword [0x38c28364], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x38c28364]
cmp eax, 0xffffffff
jne 0x38c17f79
xor eax, eax
mov dword [0x38c28364], eax
leave
ret
Function at 0xb973dd
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00b973dd
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x502841a2
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x39f65dca
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404b49
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
lea ecx, [edi + 0xd8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
lea esi, [edi + 0x50]
mov dword [ebp - 8], ebx
call fcn.004019e0
test al, al
je 0x404b9b
mov ecx, dword [esi]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x63], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x67], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x6f], eax
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x73], eax
lea eax, [ebp - 0x98]
push eax
push 0x80
push 0xd
push 0x402
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x98]
push eax
call fcn.00408234
mov ecx, eax
cmp edx, ebx
ja 0x404bd4
cmp ecx, ebx
jbe 0x404bdc
mov eax, dword [esi]
mov dword [eax + 0x5b], ecx
mov dword [eax + 0x5f], edx
pop edi
pop esi
pop ebx
leave
ret