joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ae30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp dword [ebx + 8], 0
je 0x50af47
mov edx, dword [esp + 0x10]
mov edi, edx
push ebp
cmp dword [edx + 0x14], 8
mov ebp, dword [edx + 0x10]
jb 0x50ae53
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebp, ebp
je 0x50ae71
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x50ae60
push esi
push edx
mov ecx, ebx
call fcn.0050bf60
pop ebp
cmp eax, dword [ebx + 4]
je 0x50af47
mov edi, dword [esp + 0x14]
lea esi, [eax + 0x20]
cmp edi, esi
je 0x50aea4
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x50ae99
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.00407c80
lea eax, [esi + 0x18]
lea ecx, [edi + 0x18]
cmp ecx, eax
je 0x50aec0
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x50aeb9
mov eax, dword [eax]
push edx
push eax
call fcn.00407c80
lea eax, [esi + 0x30]
lea ecx, [edi + 0x30]
cmp ecx, eax
je 0x50aedc
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x50aed5
mov eax, dword [eax]
push edx
push eax
call fcn.00407c80
mov eax, dword [esi + 0x48]
lea ecx, [edi + 0x50]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
lea eax, [esi + 0x50]
cmp ecx, eax
je 0x50af04
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x50aefd
mov eax, dword [eax]
push edx
push eax
call fcn.00407c80
lea eax, [esi + 0x68]
lea ecx, [edi + 0x68]
cmp ecx, eax
je 0x50af20
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x50af19
mov eax, dword [eax]
push edx
push eax
call fcn.00407c80
sub esi, 0xffffff80
lea ecx, [edi + 0x80]
cmp ecx, esi
je 0x50af3f
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x50af38
mov esi, dword [esi]
push eax
push esi
call fcn.00407c80
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
Function at 0x50bd90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573900
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5d6024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebx + 8], 0x1642c85
je 0x50bf53
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0xb8
mov dword [ebp - 0x1c], 0
call fcn.005214a3
mov esi, dword [ebp + 0xc]
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
lea eax, [edi + 8]
push esi
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.00406c70
mov byte [ebp - 4], 1
lea eax, [esi + 0x18]
lea ecx, [edi + 0x20]
push eax
call fcn.0050b590
mov dword [ebp - 4], 3
lea eax, [edi + 8]
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
mov dword [ebp + 0xc], eax
jb 0x50be33
mov ecx, dword [eax]
mov dword [ebp + 0xc], ecx
xor ecx, ecx
mov esi, 0x811c9dc5
add edx, edx
je 0x50be55
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x50be41
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 8]
movss xmm3, dword [ebx]
inc eax
mov ebx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x59dab0]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x59dab0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x50bed8
divss xmm0, xmm3
call fcn.0040ae60
call fcn.0053f6f0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x50becb
cmp ebx, 0x200
jae 0x50bec9
shl ebx, 3
cmp ebx, ecx
jae 0x50becb
mov ebx, ecx
push ebx
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
call fcn.0050c160
jmp 0x50bedb
mov ebx, dword [ebp - 0x10]
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040add0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov ecx, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x50bf1d
mov dword [ecx + eax*8], edi
jmp 0x50bf2f
cmp esi, edx
jne 0x50bf26
mov dword [ecx + eax*8], edi
jmp 0x50bf33
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x50bf33
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0051f575
int3
Function at 0x519eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5d6024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x4c], ebx
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
cmp dword [ecx + 0x14], 8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], 0x587650
mov dword [ebp - 0x38], eax
jb 0x519f20
mov ecx, dword [ecx]
cmp dword [edx + 0x10], 0
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x58], 0
mov eax, dword [ecx]
jne 0x519f39
xor edx, edx
jmp 0x519f41
cmp dword [edx + 0x14], 8
jb 0x519f41
mov edx, dword [edx]
lea edi, [ebp - 0x54]
push edi
push edx
push 0
lea edx, [ebp - 0x5c]
push edx
push esi
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x44], edi
cmp esi, edi
je 0x51a01a
mov edx, dword [esi]
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x51a00f
cmp dword [edx + 0x14], 8
lea eax, [ebx + 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], edx
jb 0x519f82
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
lea eax, [ecx + ecx]
mov ebx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x40], eax
test eax, eax
je 0x519fae
mov edx, dword [ebp - 0x30]
mov edi, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x519f98
mov edi, dword [ebp - 0x44]
mov edx, dword [esi]
push ebx
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x64]
push edx
push eax
mov ecx, ebx
call fcn.0040add0
mov eax, dword [eax + 4]
test eax, eax
jne 0x519fc8
mov eax, dword [ebx + 4]
mov ebx, dword [ebp - 0x4c]
cmp eax, dword [ebx + 0x38]
jne 0x51a00f
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
push dword [esi]
mov ecx, ebx
call fcn.0051b500
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00407f50
add esi, 0xc
cmp esi, edi
jne 0x519f61
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0042dcc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00521461
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51a7f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576116
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5d6024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov esi, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea edi, [ecx + 2]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51a855
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00407c80
mov dword [ebp - 4], 1
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov edx, 0x811c9dc5
cmp dword [ebp - 0x14], 8
cmovae edi, dword [ebp - 0x28]
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x51a8a2
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x51a891
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push edx
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebx + 0x34]
call fcn.0040add0
mov edi, dword [eax + 4]
test edi, edi
jne 0x51a8c0
mov edi, dword [ebx + 0x38]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407f50
mov eax, ebx
cmp edi, dword [eax + 0x38]
jne 0x51a8e8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x51a8f3
lea eax, [edi + 0x20]
mov ecx, esi
push eax
call fcn.00406c70
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521461
mov esp, ebp
pop ebp
ret 8
Function at 0x51b6b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5763ed
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5d6024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x51b6ea
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x51b70b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x51b6f7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.0040add0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x51b73c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x51b887
lea eax, [ebx + 4]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x10], 0
call fcn.005214a3
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00427ab0
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x59dab0]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x59dab0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x51b817
divss xmm0, xmm3
call fcn.0040ae60
call fcn.0053f6f0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x51b7fb
cmp eax, 0x200
jae 0x51b7f9
shl eax, 3
cmp eax, ecx
jae 0x51b7fb
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00426ec0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040add0
mov edx, dword [eax]
jmp 0x51b81a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x51b84d
mov dword [ecx + eax*8], edi
jmp 0x51b85f
cmp esi, edx
jne 0x51b856
mov dword [ecx + eax*8], edi
jmp 0x51b863
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x51b863
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0051f575
int3
Function at 0x51ba00
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b4dd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5d6024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.00409310
mov ecx, eax
test ecx, ecx
je 0x51bb55
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebx]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x51baac
lea ecx, [eax - 1]
test ecx, ecx
js 0x51bb5f
cmp ecx, eax
jg 0x51bb5f
cmp word [edx + ecx*2], 0x5c
jne 0x51baac
push ecx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040d100
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00478250
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x51bab5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x51bab5
push ebx
lea ecx, [ebp - 0x10]
call fcn.00478250
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, dword [ecx - 0xc]
jge 0x51bb24
push 0x5c
push ecx
call fcn.00522f2a
add esp, 8
test eax, eax
jne 0x51bad6
or eax, 0xffffffff
jmp 0x51bada
sub eax, dword [edi]
sar eax, 1
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0040d100
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x51bb06
push dword [edi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.0051ba00
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x51bb24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x51bb43
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408fe0
push 0x80070057
call fcn.00408fe0
int3
Function at 0x51d050
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x20
mov eax, dword [0x5d6024]
xor eax, esp
mov dword [esp + 0x1c], eax
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x51d087
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00521461
add esp, 0x20
ret
push esi
push 0x14
push 0x59bca0
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x51d0e4
lea eax, [esp + 8]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x10], xmm0
movq qword [esp + 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x51d0e1
cmp dword [esp + 0xc], 4
je 0x51d0fb
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x51d0fb
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00521461
add esp, 0x20
ret
push esi
call edi
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
pop edi
xor ecx, esp
call fcn.00521461
add esp, 0x20
ret

Function at 0x52f73b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0052f34b
push eax
push esi
push dword [ebp + 8]
call fcn.0052f300
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0052f34b
push eax
push esi
push dword [ebp + 8]
call fcn.0052f300
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0052f33b
je 0x52f801
je 0x52f766
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0052f33b
cmovnp esp, dword [edx + 0x7c858d42]
invalid
ja 0x52f7c9
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
Function at 0x539278
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005390a8
Function at 0x40e083
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004094ef
mov dword [ebp - 0x14], eax
cmp dword [0x4545fc], esi
jne 0x40e176
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e103
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e256
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e256
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e256
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4545fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x454600], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x454604], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45460c], eax
test eax, eax
je 0x40e173
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x454608], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e19b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e18e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e1b0
push 4
pop eax
jmp 0x40e258
cmp dword [ebp - 0x14], esi
je 0x40e1b0
push dword [0x4545fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e195
mov eax, dword [0x454608]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e20e
cmp dword [0x45460c], edi
je 0x40e20e
push eax
call ebx
push dword [0x45460c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e20e
test eax, eax
je 0x40e20e
call ecx
test eax, eax
je 0x40e203
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e203
test byte [ebp - 8], 1
jne 0x40e20e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e23e
mov eax, dword [0x454600]
cmp eax, edi
je 0x40e23b
push eax
call ebx
test eax, eax
je 0x40e23b
call eax
mov esi, eax
test esi, esi
je 0x40e23b
mov eax, dword [0x454604]
cmp eax, edi
je 0x40e23b
push eax
call ebx
test eax, eax
je 0x40e23b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4545fc]
call ebx
test eax, eax
je 0x40e256
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e258
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040ec
mov esp, ebp
pop ebp
ret
Function at 0x10001190
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x5a
push 0x400
call esi
test eax, eax
je 0x100011f1
push 0xa
lea ecx, [ebp - 0x2c]
push ecx
push 0x59
push 0x400
call esi
test eax, eax
je 0x100011f1
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c]
push eax
push str._S__S
call sub.glib_2.0.dll_g_strdup_printf
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_retrieve_user_locale_data__error___u.
call fcn.10050cd0
push 0x1005d78c
call sub.glib_2.0.dll_g_strdup
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret

Function at 0x1000141c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
push dword [0x1008777f]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp], eax
push 4
push 0x1000
push dword [0x100877b7]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov edx, dword [0x100877b7]
mov ecx, eax
call fcn.1000138c
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0xffffffff
mov eax, dword [0x100877a3]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ecx*2 + 2], 0
lea ecx, [ecx + 1]
jne 0x1000147c
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x1000149c
mov edx, ecx
jmp 0x100014af
mov word [edi + ecx*2], 0
lea edx, [ecx - 1]
cmp word [edi + ecx*2 - 4], 0x5c
mov ecx, edx
jne 0x1000149c
movzx ecx, byte [eax]
test cl, cl
je 0x100014cd
lea edx, [edi + edx*2]
xor esi, esi
nop
movsx ecx, cl
mov word [edx + esi*2], cx
movzx ecx, byte [eax + esi + 1]
inc esi
test cl, cl
jne 0x100014bc
push 0
push 0x80
push 3
push 0
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10001675
mov edi, eax
push 0