joyce8/EMBER2024-capa huggingface dataset:
Function at 0x116de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
and word [ebp - 0x438], 0
and word [ebp - 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x436]
rep stosd dword es:[edi], eax
mov word [ebp - 0x38], 0x5c
mov word [ebp - 0x36], 0x44
mov word [ebp - 0x34], 0x65
mov word [ebp - 0x32], 0x76
mov word [ebp - 0x30], 0x69
mov word [ebp - 0x2e], 0x63
mov word [ebp - 0x2c], 0x65
mov word [ebp - 0x2a], 0x5c
mov word [ebp - 0x28], 0x4b
mov word [ebp - 0x26], 0x65
mov word [ebp - 0x24], 0x79
mov word [ebp - 0x22], 0x62
mov word [ebp - 0x20], 0x6f
mov word [ebp - 0x1e], 0x61
mov word [ebp - 0x1c], 0x72
mov word [ebp - 0x1a], 0x64
mov word [ebp - 0x18], 0x43
mov word [ebp - 0x16], 0x6c
mov word [ebp - 0x14], 0x61
mov word [ebp - 0x12], 0x73
mov word [ebp - 0x10], 0x73
mov word [ebp - 0xe], 0x30
stosw word es:[edi], ax
mov dword [esi + 0x34], 0x114a4
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp + 8]
push eax
call fcn.00010578
test eax, eax
jl 0x11817
cmp dword [ebp + 8], 0
je 0x11817
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
push esi
push dword [ebp + 8]
call fcn.000106fa
test eax, eax
jge 0x11863
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
jmp 0x118bc
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.00010916
test eax, eax
jl 0x118a9
cmp dword [ebp + 8], 0
je 0x118a9
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov dword [esi + 0x38], 0x112c6
mov dword [esi + 0x40], 0x112c6
mov dword [esi + 0x70], 0x112f2
mov dword [esi + 0x44], 0x11602
xor eax, eax
jmp 0x118c1
nop
nop
nop
nop
nop
nop
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, eax
nop
mov eax, 0xc000009a
pop edi
pop esi
leave
ret 8
Function at 0x4c55f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4cb4cc]
cmp dword [eax + 0x28], 0
jne 0x4c5608
xor eax, eax
jmp 0x4c5737
mov ecx, dword [0x4cb43c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x4cb430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x4cb42c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x4cb430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x4cb42c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x4cb4b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x4c9680
push 0x4c96d0
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x4cb428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.004c5530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x4c55c0
mov edx, dword [0x4cb4cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4cb434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4c5737
cmp dword [ebp - 0x38], 0x12
jne 0x4c572b
mov dword [0x4cb444], 0
call fcn.004c5740
xor eax, eax
jmp 0x4c5737
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4c56fc
mov esp, ebp
pop ebp
ret 4

Function at 0x4c6b00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess_1]
Function at 0x4c769c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4c9168
sub eax, eax
test esi, esi
je 0x4c7774
sub eax, 1
test ecx, ecx
je 0x4c7772
test esi, 3
je 0x4c76da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4c76bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x4c7759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4c76e4
mov ecx, edx
test ecx, ecx
je 0x4c7772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4c775f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4c777c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.004c77ff
jae 0x4c778a
xor ecx, ecx
call fcn.004c77ff
jae 0x4c77b9
xor eax, eax
call fcn.004c77ff
jae 0x4c77c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.004c77ff
adc al, al
jae 0x4c77ab
jne 0x4c77f5
stosb byte es:[edi], al
jmp 0x4c778d
call fcn.004c780b
sub ecx, ebx
jne 0x4c77d2
call fcn.004c7809
jmp 0x4c77f1
lodsb al, byte [esi]
shr eax, 1
je 0x4c781b
adc ecx, ecx
jmp 0x4c77ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.004c7809
cmp eax, 0x7d00
jae 0x4c77ee
cmp ah, 5
jae 0x4c77ef
cmp eax, 0x7f
ja 0x4c77f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4c778d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x4c814c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4cb000]
jne 0x4c8156
repz ret
jmp fcn.004c83fd
Function at 0x401430
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x401446
mov esi, 0x100000
jmp 0x401452
jmp loc.00414911
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x40148f
mov edx, ebx
mov eax, 0x40c43c
call fcn.004012e4
test al, al
jne 0x40148f
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualFree
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x401494
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4014de
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.kernel32.dll_VirtualAlloc
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x401506
mov edx, ebx
mov eax, 0x40c43c
call fcn.004012e4
test al, al
jne 0x401506
jmp 0x417b58
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4015c4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edx, eax
mov ebp, edx
and ebp, 0xfffff000
add edx, dword [esp]
add edx, 0xfff
and edx, 0xfffff000
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
mov dword [eax], ebp
mov eax, dword [esp + 8]
sub eax, ebp
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
mov esi, dword [0x40c43c]
jmp 0x401646
jmp loc.004163fc
cmp esi, 0x40c43c
jne 0x40160a
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401b44
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ecx, edx
sub ecx, 4
lea ebx, [ecx + eax]
cmp edx, 0x10
jl 0x401b61
jmp loc.00417966
cmp edx, 4
jl 0x401b72
mov ecx, edx
or ecx, 0x80000002
mov dword [eax], ecx
mov dword [ebx], ecx
pop ebx
ret

Function at 0x401b74
Capabilities:
Packed with generic packer

Disassembly:
inc dword [0x40c3fc]
mov edx, eax
sub edx, 4
mov edx, dword [edx]
and edx, 0x7ffffffc
sub edx, 4
add dword [0x40c400], edx
jmp loc.00414172

Function at 0x401b98
Capabilities:
Packed with generic packer

Disassembly:
cmp edx, 0xc
jl 0x401bab
or edx, 2
mov dword [eax], edx
add eax, 4
call fcn.00401b74
ret
cmp edx, 4
jl 0x401bba
mov ecx, edx
or ecx, 0x80000002
mov dword [eax], ecx
jmp loc.00415d93
Function at 0x401d00
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov ebx, edi
mov dword [ebx + 8], esi
mov eax, ebx
add eax, esi
sub eax, 0xc
mov dword [eax + 8], esi
cmp esi, 0x1000
jg 0x401d4e
mov edx, esi
shr edx, 2
mov eax, dword [0x40c474]
mov eax, dword [eax + edx*4 - 0xc]
test eax, eax
jne 0x401d40
mov eax, dword [0x40c474]
mov dword [eax + edx*4 - 0xc], ebx
mov dword [ebx + 4], ebx
mov dword [ebx], ebx
jmp 0x401d7a
mov edx, dword [eax]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
jmp 0x401d7a
cmp esi, 0x3c00
jl 0x401d63
mov edx, esi
mov eax, edi
call fcn.00401c68
test al, al
jne 0x401d7a
mov eax, dword [0x40c468]
mov dword [0x40c468], ebx
mov edx, dword [eax]
mov dword [ebx + 4], eax
mov dword [ebx], edx
jmp 0x41552e
pop edi
pop esi
pop ebx
ret

Function at 0x401e84
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
mov ecx, esp
lea edx, [esi + 4]
mov eax, ebx
call fcn.00401768
cmp dword [esp], 0
je 0x401eaa
mov eax, esp
jmp loc.00414e72
xor eax, eax
jmp 0x401eb0
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4025c4
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025fc
test edx, edx
je 0x4025e6
push eax
mov eax, ecx
call dword [0x40b00c]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret
mov al, 2
jmp loc.0041572a
mov dword [eax], edx
mov eax, ecx
call dword [0x40b008]
or eax, eax
jne 0x4025df
ret
mov al, 1
jmp fcn.00402614
test edx, edx
je 0x402610
push eax
mov eax, edx
call dword [0x40b004]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x402924
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.0040292f
mov ecx, dword [eax]
jmp loc.0041733f

Function at 0x402b0c
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [section.DATA], 1
jbe fcn.00402b25
push 0
push 0
push 0
push 0xeedfacf
jmp loc.00415287

Function at 0x402b70
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [section.DATA], 1
jbe 0x402b80
push eax
push ebx
jmp loc.00414ad7
ret

Function at 0x402b84
Capabilities:
Packed with generic packer

Disassembly:
test ecx, ecx
je 0x402ba1
jmp loc.00416bb7
ret

Function at 0x402be8
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [section.DATA], 1
jbe 0x402c04
push eax
push edx
push esp
push 2
push 0
push 0xeedfad3
jmp loc.0041445c
ret

Function at 0x402f54
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
mov ecx, dword [esp + 8]
jmp loc.00415e11

Function at 0x40310c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
cmp dword [0x40c3d0], 0
jge fcn.00403120
mov eax, 0xe2
jmp loc.00414d37
Function at 0x403154
Capabilities:
Get thread local storage value

Disassembly:
mov cl, byte [0x40c030]
mov eax, dword [0x40c3d0]
test cl, cl
jne 0x40318c
mov edx, dword fs:[0x2c]
mov eax, dword [edx + eax*4]
ret
push eax
jmp loc.00414f52

Function at 0x40322c
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x403239
mov ecx, dword [edx - 8]
inc ecx
jle 0x403239
mov dword [edx - 8], ecx
xchg dword [eax], edx
test edx, edx
je 0x403252
mov ecx, dword [edx - 8]
dec ecx
jl 0x403252
mov dword [edx - 8], ecx
jne 0x403252
lea eax, [edx - 8]
jmp 0x417446
ret

Function at 0x4033b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edx
push eax
mov ebx, edx
xor eax, eax
mov ecx, dword [esp + edx*4 + 0x10]
test ecx, ecx
je 0x4033c7
add eax, dword [ecx - 4]
dec edx
jne 0x4033bc
jmp 0x414824

Function at 0x403420
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x403451
mov ecx, dword [edx - 8]
dec ecx
je 0x403451
push ebx
mov ebx, eax
mov eax, dword [edx - 4]
call fcn.00403254
mov edx, eax
mov eax, dword [ebx]
jmp loc.00414e0d
mov eax, edx
ret

Function at 0x403604
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, 1
jmp loc.00414862

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
push 0xa729976
mov eax, 0x48cff233
pop edx
xor eax, edx
mov edx, 0x418dd58d
xor eax, edx
xor eax, 0x70d30972
mov edi, 0x68401090
mov ebx, 0x41ea004
xor edi, ebx
push edi
mov ecx, 0x1f5b77bd
xor ecx, 0xe67ac9
pop esi
xor ecx, esi
xor ecx, eax
mov eax, ecx
push eax
pop edi
push 0xc82f71f4
mov esi, 0x37d08e08
pop edx
xor esi, edx
add esp, esi
mov dword [esp], edi
pop edx
mov esi, 0
xor esi, edx
mov eax, 0xfffffffc
add esp, eax
mov dword [esp], esi
pop ebx
mov ecx, 0x23ca205f
xor ecx, 0xb7b20bb
push 0x1658240a
mov esi, 0x3ee924ef
pop edi
xor esi, edi
xor esi, ecx
sub ebx, esi
mov ecx, 0x61ba783
xor ecx, 0xbed9200
mov esi, 0x6bc5a9d9
xor esi, 0x66339c5a
xor esi, ecx
xor esi, esi
jmp 0x403f68

Function at 0x40457c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push 0x4045cc
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x4045dc
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x40459f
jmp loc.00417937
push 0x4045f4
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4045b5
push 0x8001
call eax
push 0x404608
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4045c8
push 1
call eax
pop ebx
ret

Function at 0x404bd4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov ecx, ebx
mov dl, 1
mov eax, 0x404a2c
jmp loc.00416523

Function at 0x404bec
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push esi
push edi
mov ecx, ebx
mov dl, 1
mov eax, 0x404a2c
jmp loc.004141ff
Function at 0x404c30
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov edi, edx
or eax, eax
je 0x404c3e
mov eax, dword [eax - 4]
or edx, edx
je 0x404c45
mov edx, dword [edx - 4]
mov ecx, eax
cmp ecx, edx
jbe 0x404c4d
mov ecx, edx
cmp ecx, ecx
repe cmpsb byte [esi], byte es:[edi]
je 0x404c7d
mov bl, byte [esi - 1]
cmp bl, 0x61
jb 0x404c63
cmp bl, 0x7a
ja 0x404c63
sub bl, 0x20
mov bh, byte [edi - 1]
cmp bh, 0x61
jb 0x404c73
cmp bh, 0x7a
ja 0x404c73
sub bh, 0x20
cmp bl, bh
je 0x404c4f
jmp 0x417a44
sub eax, edx
pop ebx
pop edi
pop esi
ret

Function at 0x404d1c
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov esi, edx
mov edi, eax
mov edx, ecx
cmp edi, esi
jg 0x404d39
je 0x404d55
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
jmp loc.004160d6
pop edi
pop esi
ret

Function at 0x404d58
Capabilities:
Packed with generic packer

Disassembly:
push edi
push esi
push ebx
mov esi, eax
mov edi, edx
mov ebx, ecx
xor al, al
test ecx, ecx
je 0x404d6c
repne scasb al, byte es:[edi]
jne 0x404d6c
inc ecx
sub ebx, ecx
mov edi, esi
mov esi, edx
mov edx, edi
jmp loc.00415112

Function at 0x404f6a
Capabilities:
Packed with generic packer

Disassembly:
and al, 0xdf
mov cl, al
mov eax, 1
mov ebx, dword [ebp - 8]
cmp ebx, dword [ebp + 8]
ja 0x404fcb
inc dword [ebp - 8]
mov esi, dword [ebp + 0xc]
lea esi, [esi + ebx*8]
mov eax, dword [esi]
movzx ebx, byte [esi + 4]
jmp loc.00415b0b
xor eax, eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
sub ecx, edx
call fcn.00404de4
cmp cl, 0x44
je 0x404fee
cmp cl, 0x55
je 0x405000
cmp cl, 0x58
jne 0x404fc9
mov ecx, 0x10
jmp 0x405005
or eax, eax
jns 0x405000
neg eax
call 0x405000
mov al, 0x2d
inc ecx
dec esi
mov byte [esi], al
ret
mov ecx, 0xa
lea esi, [ebp - 0x38]
xor edx, edx
div ecx
add dl, 0x30
cmp dl, 0x3a
jb 0x405017
add dl, 7
dec esi
mov byte [esi], dl
or eax, eax
jne 0x405008
lea ecx, [ebp - 0x38]
sub ecx, esi
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x40502c
ret
sub edx, ecx
jbe 0x40503a
add ecx, edx
mov al, 0x30
dec esi
mov byte [esi], al
dec edx
jne 0x405034
ret

Function at 0x4051fc
Capabilities:
Get geographical location
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp fcn.0040523e
mov eax, ebx
mov edx, esi
jmp loc.004149f6

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4058b4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je fcn.004058c8
add esp, 0xfffffff0
jmp loc.00416931

Function at 0x405930
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x405944
add esp, 0xfffffff0
call fcn.00402ac8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x405983
jmp loc.00417875

Function at 0x4062f1
Capabilities:
Packed with generic packer

Disassembly:
mov ax, word [esi + 8]
mov edx, eax
and eax, 0x7fff
je 0x40630e
cmp eax, 0x7fff
jne 0x406319
cmp word [esi + 6], 0x8000
je 0x406310
inc eax
xor edx, edx
mov byte [ebx + 3], 0
jmp 0x4063db
fld xword [esi]
sub eax, 0x3fff
imul eax, eax, 0x4d10
sar eax, 0x10
inc eax
mov dword [ebp - 8], eax
mov eax, 0x12
sub eax, dword [ebp - 8]
fabs
call fcn.00404014
frndint
fld xword [0x405d1c]
fcomp st(1)
wait
fnstsw word [ebp - 4]
wait
test word [ebp - 4], 0x4100
je 0x40635c
fidiv dword [0x405d0c]
inc dword [ebp - 8]
fbstp tbyte [ebp - 0x1a]
lea edi, [ebx + 3]
mov edx, 9
wait
mov al, byte [ebp + edx - 0x1b]
mov ah, al
shr al, 4
and ah, 0xf
add ax, 0x3030
stosw word es:[edi], ax
dec edx
jne 0x406368
xor al, al
stosb byte es:[edi], al
mov edi, dword [ebp - 8]
add edi, dword [ebp + 8]
jns 0x40638c
xor eax, eax
jmp 0x40630e
cmp edi, dword [ebp + 0xc]
jb 0x406394
mov edi, dword [ebp + 0xc]
cmp edi, 0x12
jae 0x4063c0
cmp byte [ebx + edi + 3], 0x35
jb 0x4063c5
mov byte [ebx + edi + 3], 0
dec edi
js 0x4063b5
inc byte [ebx + edi + 3]
cmp byte [ebx + edi + 3], 0x39
ja 0x4063a0
jmp 0x4063d4
mov word [ebx + 3], 0x31
inc dword [ebp - 8]
jmp 0x4063d4
mov edi, 0x12
mov byte [ebx + edi + 3], 0
dec edi
js 0x4063d4
cmp byte [ebx + edi + 3], 0x30
je 0x4063c5
jmp 0x417602
shr dx, 0xf
mov word [ebx], ax
mov byte [ebx + 2], dl
ret

Function at 0x406744
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov esi, eax
mov eax, esi
call fcn.004032f4
mov edi, eax
cmp edi, 2
jl 0x4067b9
mov al, byte [esi]
call fcn.004066b0
test al, al
je 0x4067b9
mov al, byte [esi + 1]
call fcn.004066b0
test al, al
je 0x4067b9
mov ebx, 3
xor ebp, ebp
cmp edi, ebx
jl 0x4067b4
mov al, byte [esi + ebx - 1]
call fcn.004066b0
test al, al
je 0x4067a5
inc ebp
cmp ebp, 2
jge 0x4067b4
inc ebx
cmp edi, ebx
jl 0x4067b0
mov al, byte [esi + ebx - 1]
call fcn.004066b0
test al, al
jne 0x406791
jmp 0x4067b0
mov edx, ebx
mov eax, esi
call fcn.00406680
add ebx, eax
cmp edi, ebx
jge 0x40677e
mov eax, ebx
dec eax
jmp 0x406819
cmp edi, 1
jl 0x4067da
mov al, byte [esi]
call fcn.004066b0
test al, al
je 0x4067da
cmp byte [esp], 0
je 0x4067d6
mov eax, 1
jmp 0x406819
xor eax, eax
jmp 0x406819
test edi, edi
jle 0x406817
mov edx, 1
mov eax, esi
call fcn.00406680
mov ebx, eax
inc ebx
cmp edi, ebx
jl 0x406817
jmp 0x41499a
xor eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret