joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4133b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4133dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4133dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401460
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40b064
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x408]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [ebp - 0x408]
mov dword [esp], eax
call sym._system
nop
leave
ret

Function at 0x40149f
Capabilities:
Connect pipe
Create pipe
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x434
call sym.___main
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x400
mov dword [esp + 0x10], 0x400
mov dword [esp + 0xc], 1
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], str..pipeMyPipe
call sym._CreateNamedPipeA_32
sub esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x401527
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.CreateNamedPipe_failed:__d_n
call sym._printf
mov eax, 1
jmp 0x40161f
mov dword [esp], str.Waiting_for_a_client_to_connect...
call sym._puts
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ConnectNamedPipe_8
sub esp, 8
cmp eax, 1
je 0x4015ad
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.ConnectNamedPipe_failed:__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, 1
jmp 0x40161f
mov eax, dword [ebp - 0x410]
mov byte [ebp + eax - 0x40c], 0
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], str.Received_data:_n_s_n
call sym._printf
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._execute_code
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x410]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3ff
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
je 0x4015ed
mov eax, dword [ebp - 0x410]
test eax, eax
jne 0x40157b
call sym._GetLastError_0
cmp eax, 0x6d
je 0x40160c
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.ReadFile_failed:__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x40505d
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
mov ebp, dword [esp + 0xc]
inc eax
push esi
mov ebx, dword [ebx]
mov esi, eax
push edi
push 0x20
pop edi
cmp dword [ebp], eax
jle 0x4050f5
push 0x42629c
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050e3
push 0x4261f8
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050e3
push 0x4262a4
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050df
push 0x4261f0
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050df
call fcn.00401d51
test al, al
je 0x4050d5
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x4050e6
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x4050ec
jmp 0x4050e6
push 0x20
jmp 0x4050e5
push 0x40
pop edi
inc esi
cmp esi, dword [ebp]
jl 0x405078
cmp edi, 0x20
jne 0x405256
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004056c3
pop ecx
pop ecx
test al, al
jne 0x40511a
push 0x426310
call fcn.00405aa8
pop ecx
push 2
jmp 0x405265
mov eax, 0x426344
push eax
push 0x426294
push eax
push eax
push dword [esp + 0x2c]
push 0x426348
push dword [esp + 0x48]
push dword [esp + 0x48]
call fcn.00405c8b
push 0
push dword [esp + 0x50]
call fcn.00402e39
add esp, 0x28
cmp eax, 1
jge 0x40515f
push 0x426360
call fcn.00405aa8
jmp 0x405262
mov ebx, dword [esp + 0x18]
push 0
push ebx
push ebp
call fcn.004017b8
mov esi, eax
push str.ERROR
push esi
call fcn.00413d40
add esp, 0x14
test eax, eax
jne 0x405192
push 0x426398
call fcn.00405aa8
pop ecx
push 4
jmp 0x405265
push dword [esp + 0x28]
mov edi, dword [esp + 0x28]
push edi
push esi
push dword [esp + 0x28]
mov byte [edi], 0
call fcn.004057bf
add esp, 0x10
test al, al
jne 0x4051c0
push edi
push esi
push 0x4263c0
call fcn.00405aa8
add esp, 0xc
jmp 0x40518b
mov edi, dword [ebx]
xor esi, esi
cmp dword [ebp], esi
jle 0x405251
mov ecx, dword [0x431020]
test ecx, ecx
jns 0x4051fc
push dword [edi + esi*4]
push 0x426430
call fcn.00405681
xor ebx, ebx
pop ecx
inc ebx
pop ecx
mov ecx, dword [0x431020]
cmp eax, ebx
cmove ecx, ebx
mov dword [0x431020], ecx
jmp 0x4051ff
xor ebx, ebx
inc ebx
test ecx, ecx
je 0x405242
push dword [edi + esi*4]
push 0x426444
call fcn.00405681
pop ecx
pop ecx
cmp eax, ebx
je 0x40524a
push dword [edi + esi*4]
push 0x42645c
call fcn.00405681
pop ecx
pop ecx
test eax, eax
je 0x40524a
push dword [edi + esi*4]
push 0x426470
call fcn.00405681
pop ecx
pop ecx
cmp eax, ebx
je 0x40524a
mov ecx, dword [0x431020]
inc esi
cmp esi, dword [ebp]
jl 0x4051d3
jmp 0x405251
and dword [0x431020], 0
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push 0x4262b0
call fcn.00405aa8
pop ecx
pop ecx
push 1
call fcn.0040ed64
int3
Function at 0x4148c6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041473c

Function at 0x418e62
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004189b5

Function at 0xd39c7c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd39c86
pushal
call 0xd39c8c
pop ebp
sub ebp, 0x10
sub ebp, 0x939c7c
jmp 0xd39ca2
mov eax, 0x939c7c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c6
mov edx, 0x75346429
xor byte [eax], dl
inc eax
dec ecx
jne 0xd39cb9
jmp 0xd39ccc
mov byte [0x15a0a2e4], al
sub dword [ecx], ebp
sub dword [eax + 0x2929d1e8], ebp
sub dword [edx], ebp
in al, 0x91
das
sub dword [ecx], ebp
sub dword [ebx + 0x29292901], edx
fmulp st(3)
sub ah, cl
mov byte [0x292925a8], al
sub dword [edx], ebp
in al, dx
movsb byte es:[edi], byte [esi]
dec ebp
or eax, 0xd2da0d5
jns 0xd39d3c
stc
movsd dword es:[edi], dword [esi]
aaa
sub dword [ecx - 0x7d], eax
pop esp
sub dword [eax], ebp
add eax, 0xd9ed410d
invalid
cmp dword [ecx], ebp
sub dword [ecx], ebp
call 0x2bebc8f0
stosb byte es:[edi], al
jmp 0xd39d60
sub eax, ebp
shr byte [ebx], 0x18
sub ebp, dword [edx + 0x26602deb]
lodsb al, byte [esi]
fst st(6)
salc
salc
je 0xd39d27
and eax, 0xda5a229
sub eax, 0x41292929
stc
movsd dword es:[edi], dword [esi]
aaa
sub dword [ecx - 0x7d], eax
pop esp
sub dword [eax], ebp
add eax, 0x2cc1780d
sub dword [ecx], ebp
sub eax, eax
jp 0xd39d86
sub dword [ecx], ebp
jl 0xd39d03
inc ebp
or eax, 0x255cd629
salc
pop esp
and ecx, eax
lodsd eax, dword [esi]
sub dword [ecx], ebp
sub dword [edx + 0x29292194], esp
sub dword [eax + 0x4bf73d8], ebp
cmp ebp, dword [eax + 0x4bf73d8]
cmp ebx, dword [edx]
loopne 0xd39d2a
fcmovnb st(0), st(1)
inc ebx
enter 0xffffffffffffa8b2, 0xffffffffffffffdb
rol dword [ebx - 0x38], 0xb2
sbb bh, bl
mov dl, 0xa8
fcmovnb st(0), st(1)
inc ebx
enter 0x1ab2, 0xfffffffffffffffb
stosb byte es:[edi], al
shr dword [ecx], 0x26
lodsd eax, dword [esi]
sub dword [bx + di], ebp
sub dword [esi], esp
mov eax, dword [0x29292961]
dec edi
mov byte [0xd2a91035], al
shl dword [esi], 0xad
xor ebp, dword [ecx]
sub dword [ecx], ebp
test eax, 0xad26c0d2
cmp byte [ecx], ch
sub dword [ecx], ebp
dec edi
test al, 0xd2
salc
or al, 0x26
lodsd eax, dword [esi]
cmp al, 0x29
sub dword [ecx], ebp
push 0xd6d6e5c0
salc
add byte [ebp + 0x10], ah
sub byte [edx - 0x3e55d318], ch
sub eax, 0xd6d694c0
salc
add byte [ebp + 0x10], bh
sub ebp, dword [edx - 0x3c55d018]
sub eax, 0xc02cc1aa
adc dh, 0xd6
salc
mov byte [0x4da40d05], al
or eax, 0x2925eb2d
jl 0xd39d95
lds edi, [edi + 0x7e]
jl 0xd39d9a
pop esp
and eax, 0xd52154a2
wait
test eax, 0xefa82fa3
sub byte [ecx], ch
sub dword [ecx], ebp
mov eax, dword [0x28eea82e]
sub dword [ecx], ebp
sub dword [edx + 0x2929292b], edx
sub edi, ebx
lodsb al, byte es:[esi]
sub al, 0x29
sub dword [ecx], ebp
mov dword [0xfb3b6f3f], eax
stosb byte es:[edi], al
int1
salc
salc
salc
sub edi, ebx
lodsb al, byte es:[esi]
sub al, 0x29
sub dword [ecx], ebp
mov dword [0xfb3b6f3f], eax
stosb byte es:[edi], al
inc ebx
sub dword [ecx], ebp
sub dword [edx], ebx
jmp 0xacfa996c
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x466008], 0x8088405
inc edx
mov dword [ebx + 0x466008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd18
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd31
add dl, dl
jne 0x41cd54
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cda5
xor eax, eax
add dl, dl
jne 0x41cd61
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce42
add dl, dl
jne 0x41cd70
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd7b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd86
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd91
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cd9b
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd40
mov eax, 1
add dl, dl
jne 0x41cdb3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdbe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdaa
sub eax, ebx
mov ebx, 1
jne 0x41cdf1
mov ecx, 1
add dl, dl
jne 0x41cdd7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cde2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdce
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce08
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce13
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdff
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ce63
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd40
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e558
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44ea17
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e609
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e5f2
test esi, esi
jbe 0x41e609
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e5e4
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e609
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e5c1
jmp 0x41e609
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e609
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ea1e
ret
Function at 0x41ee60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x44f40f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41ee9b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eeb4
lea eax, [ebp - 0x10]
mov edx, dword [0x468270]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eec7
lea eax, [ebp - 0x10]
mov edx, dword [0x468270]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eed3
adc edx, 0
mov edx, dword [edx*4 + 0x4670e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41efe1
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41efd4
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dd4
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41efd4
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41efd4
cmp dx, 0x150
ja 0x41efd4
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41efd4
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eff9
inc ebx
cmp ebx, 0x19
jne 0x41ee8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f416
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1000d6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
cmp edi, 6
jae 0x1000d707
mov edx, ecx
mov ebx, ecx
mov ecx, 6
sub edx, esi
sub ecx, edi
cmp edx, ecx
jbe 0x1000d6ce
lea ebx, [esi + 6]
mov ecx, ebx
xor edx, edx
sub ecx, esi
cmp ebx, esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1000d704
mov edi, edi
mov ecx, eax
inc edx
shl ecx, 6
inc edi
xor eax, ecx
lea ecx, [eax*8]
not ecx
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi]
inc esi
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1000d6e0
mov ecx, dword [ebp + 0xc]
cmp edi, 9
jae 0x1000d75a
mov edx, ecx
mov ebx, ecx
mov ecx, 9
sub edx, esi
sub ecx, edi
cmp edx, ecx
jbe 0x1000d724
mov ebx, esi
sub ebx, edi
add ebx, 9
mov ecx, ebx
xor edx, edx
sub ecx, esi
cmp ebx, esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1000d75a
lea ecx, [eax*4]
inc edx
xor eax, ecx
inc edi
lea ecx, [eax*8]
not ecx
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi]
inc esi
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1000d734
mov ecx, dword [ebp + 0xc]
xor edx, edx
sub ecx, esi
cmp dword [ebp + 0xc], esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1000d78f
lea esp, [esp]
lea ecx, [eax*8]
inc edx
not ecx
lea esi, [esi + 1]
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi - 1]
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1000d770
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10035690
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov ebx, ecx
mov edi, dword [edx + 0x10]
jb 0x100356a6
mov edx, dword [edx]
mov esi, 0x811c9dc5
inc edi
je 0x100356ce
mov edi, edi
mov cl, byte [edx]
lea eax, [ecx - 0x61]
cmp al, 0x19
movsx eax, cl
ja 0x100356bf
sub eax, 0x20
movsx eax, al
inc edx
xor eax, esi
imul esi, eax, 0x1000193
dec edi
jne 0x100356b0
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1003c3a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e274
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
mov dword [edx + 0x18], 0xf
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x30], 0xf
mov dword [edx + 0x2c], 0
mov byte [edx + 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov al, byte [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x60], 0xffffffff
mov dword [edx + 0x64], 0x7fffffff
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x405a00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a66
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a50
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a6d
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40ab3c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab75
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40ab7e
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ab88
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aba9
mov al, byte [esp]
jmp 0x40abab
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b230
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b0a8
mov eax, dword [0x46a9e4]
cmp byte [eax], 0
je 0x40b2ac
mov eax, dword [0x46a7f4]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408374
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b2f4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b2e2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46a7a4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46b664]
call fcn.00404f14
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bb48
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bc1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ee4
lea eax, [ebp - 8]
call fcn.0040435c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bc08
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bc01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040430c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bbeb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bc30
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bbeb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc08
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc25
lea eax, [ebp - 8]
call fcn.00403e4c
ret

Function at 0x40c130
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c194
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407ebc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c19b
lea eax, [ebp - 0xc]
call fcn.00403e4c
ret

Function at 0x41a3f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46b884
cmp dword [edi], 0
jne 0x41a46c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46b880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4693ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a3c8
lea eax, [esi + 5]
call fcn.0041a3e8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a3e8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a441
mov dword [0x46b880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b9f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b9f6
ret