joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4b9301
push ebx
sub esp, 0x9c
mov eax, dword [0x4b9300]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4b9365]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040b420
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004aed70
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4b7bfc], 0
jne 0x41cf86
mov byte [0x4b7bfc], 1
call fcn.004ad180
test eax, eax
je 0x41cf54
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040a310
mov dword [esp], 2
mov esi, dword [fcn.00419640]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x41cf44
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4b9ae9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4af638
jmp 0x4af630
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x41cf0a
mov dword [esp], 2
call dword [0x4b60ac]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4af62b
mov dword [esp], 2
call dword [0x4b60ac]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.00419cc0
call fcn.004ad4b0
call fcn.004ad070
call fcn.004ad1b0
jmp 0x4af62b
Function at 0x474b50
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x474b90
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x474b61
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x402ca5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x402cb4
pop dword [ebp - 0x24]
mov eax, 0x45a12dbe
add eax, 0xba9efef6
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xbe7f8b2e
add dword [ebp - 0x34], 0x8fd2ba1d
mov dword [ebp - 0x30], 0xf8310de4
add dword [ebp - 0x30], 0x3a023e61
mov dword [ebp - 0x2c], 0xd4ddf67f
add dword [ebp - 0x2c], 0x776e4daf
mov dword [ebp - 0x28], 0xf52a8e44
add dword [ebp - 0x28], 0xad571bc
lea eax, [ebp - 0x34]
push eax
mov eax, 0x4478d6b2
sub eax, 0x4438656e
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xd2c81693
sub dword [ebp - 0x34], 0x5e55ad3d
mov dword [ebp - 0x30], 0x739f2f80
add dword [ebp - 0x30], 0xcdcd31f5
mov dword [ebp - 0x2c], 0x5505d5f5
sub dword [ebp - 0x2c], 0xf1966989
mov dword [ebp - 0x28], 0x2e1a7558
add dword [ebp - 0x28], 0xd1e58aa8
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x35637
push 0
call eax
mov ecx, 0xfe92c9b9
sub ecx, 0xfe92880f
xor edi, edi
add edi, eax
mov ebx, 0xd698a646
add ebx, 0x29aab9ba
add ebx, dword [ebp - 0x24]
mov esi, 0xeabe1c03
xor dword [ebp - 0x18], 0xb2246a75
mov edx, dword [ebx]
add dword [ebp - 0x14], esi
add edx, esi
sub dword [ebp - 0x10], eax
mov dword [edi], edx
xor dword [ebp - 8], 0x86ad2e62
add edi, 0xa01426d
sub edi, 0xa014269
add ebx, 4
loop 0x402dcd
add eax, 0xf97b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401506
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.0041011e
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401324
push 0x5c
mov ecx, edi
call fcn.00401424
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x401297
push edi
push edi
mov dword [0x41b7a0], esi
mov dword [0x41b7a8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x41b7e8], 2
mov dword [0x41b7a4], eax
je 0x401563
call fcn.004078d3
push 0xffffffffffffffff
push dword [0x41b7a4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x41b7a8]
cmp eax, edi
mov dword [0x41b85c], edi
je 0x4015b2
cmp eax, 1
je 0x4015a6
cmp eax, 2
je 0x4015a2
cmp eax, 3
je 0x40159e
cmp eax, 0x67
jle 0x401599
cmp eax, 0x6a
jle 0x401616
push eax
push 0x14
jmp 0x4015e9
push 0x12
jmp 0x4015a8
push 0x13
jmp 0x4015a8
push 0x11
push edi
call fcn.004077de
pop ecx
pop ecx
jmp 0x401616
cmp dword [0x41b864], edi
jne 0x401616
lea eax, [ebp + 8]
push eax
push dword [0x41b7a4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x4015d9
cmp ecx, edi
jne 0x4015d9
xor eax, eax
jmp 0x40161b
mov eax, 0x80070000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x4015ec
push ecx
push 0x21
push edi
jmp 0x40160e
and ecx, 0xffff
cmp ecx, 0xe
jne 0x401600
cmp dword [0x41b7ec], 0xffffffff
je 0x401616
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.004077de
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x401be9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov ebx, eax
movzx eax, word [0x41b7ac]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x401c2d
push 0x409
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
je 0x401c53
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x401c3e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi], eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401c53
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x401ccd
cmp dword [0x41b7bc], 0
jne 0x401ccb
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SetProcessPreferredUILanguages
mov ebx, str.kernel32
push ebx
mov dword [0x41b7bc], 1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0
mov dword [ebp - 4], eax
movzx eax, word [0x41b7ac]
push 0x409
push 0
push eax
lea eax, [ebp - 0x44]
push str._04X_c_04X_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp dword [ebp - 4], 0
jne 0x401cc0
push str.SetThreadPreferredUILanguages
push ebx
call esi
push eax
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x401ccb
push 0
lea eax, [ebp - 0x44]
push eax
push 4
call dword [ebp - 4]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402424
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
invalid
inc ebp

Function at 0x4025f5
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x402625
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x402620
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40260a
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x402612
cmp edx, ebx
jne 0x402760
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4025e1
add eax, dword [eax + 4]
jmp 0x4025ce
mov dword [ebp + 0xc], ebx
jmp 0x402630

Function at 0x402688
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402648
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x402666
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4026c4
mov edx, edi
mov dword [ebp + 8], edi
or byte [ecx + 0x865], al
add byte [eax - 0x77], al
jge 0x4026a3
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4026ab
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4026b4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4026be
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4026a0
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40262a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402711
dec eax
je 0x402708
sub eax, 3
je 0x4026ff
mov dword [ebp - 4], 0x40
jmp 0x40272e
mov dword [ebp - 4], 4
jmp 0x402714
mov dword [ebp - 4], 0x20
jmp 0x402714
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402760
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4026e0
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00401f71
or eax, dword [ebp + 0x75ff0a8e]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40276c
Function at 0x4026b0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402648
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x402666
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4026c4
mov edx, edi
mov dword [ebp + 8], edi
or byte [ecx + 0x865], al
add byte [eax - 0x77], al
jge 0x4026a3
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4026ab
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4026b4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4026be
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4026a0
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40262a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402711
dec eax
je 0x402708
sub eax, 3
je 0x4026ff
mov dword [ebp - 4], 0x40
jmp 0x40272e
mov dword [ebp - 4], 4
jmp 0x402714
mov dword [ebp - 4], 0x20
jmp 0x402714
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402760
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4026e0
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00401f71
or eax, dword [ebp + 0x75ff0a8e]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40276c

Function at 0x402ed2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
test dword [ecx + 0x2cfffffc], ebp
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.00401f81
pop ecx
push eax
push dword [ebp + 0x18]
sbb bh, bh
jne 0x402ff4
Function at 0x403fb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x680]
jmp 0x403fc0
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x404007
lea eax, [ebp - 0x714]
push eax
call fcn.00401f81
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00401f36
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x404012
jmp 0x404017
jmp 0x403913

Function at 0x404436
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
push ebx
push esi
push edi
call fcn.00401f51
push 3
call fcn.00401fa7
push 0x28
mov dword [0x41b7e4], eax
call fcn.00401fa7
push 2
mov dword [0x41b7e0], eax
call fcn.00401fa7
push 5
mov dword [0x41b7dc], eax
call fcn.00401fa7
push 0x15
mov dword [0x41b7d8], eax
call fcn.00401fa7
push 0x16
mov dword [0x41b7d4], eax
call fcn.00401fa7
push 0x17
mov dword [0x41b7d0], eax
call fcn.00401fa7
add esp, 0x1c
xor ebx, ebx
mov dword [0x41b7cc], eax
mov dword [0x41b7c4], ebx
mov dword [0x41b7c8], ebx
mov edi, 0x41b394
xor esi, esi
push esi
push ebx
lea eax, [ebp - 0x2a4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40455a
push ebx
lea eax, [ebp - 0x98]
push 0x4184fc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0040140c
lea ecx, [ebp - 0xc]
call fcn.0040140c
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401324
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.00401324
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00402f2e
cmp dword [esi + 0x41b36c], ebx
jne 0x40454a
push dword [esi + 0x41b370]
lea ecx, [ebp - 0x18]
call fcn.00401324
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.00401324
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00402f2e
add esi, 8
cmp esi, 0x28
jb 0x40451a
lea ecx, [ebp - 0x18]
call fcn.00402424
inc ebx
cmp ebx, 0x40
jl 0x4044b1
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415800
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41bac0], ecx
add edx, 1
cmp edx, 0x100
jb 0x415802
cmp edx, 0x800
jae 0x4158eb
mov edi, edi
mov eax, dword [edx*4 + 0x41b6c0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41bac0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x41babc], eax
jb 0x4158c0
mov dword [0x41ba94], 0x415f40
call fcn.00415a30
test eax, eax
jne 0x415908
mov dword [0x41ba94], 0x415e60
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10004820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004829
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004849
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10005590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10005599
pop esi
pop ebp
ret 8

Function at 0x100055b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055b9
pop esi
pop ebp
ret 4

Function at 0x100055d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055d9
pop esi
pop ebp
ret 8

Function at 0x100184b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1017c928]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1017f7a8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018588
push esi
push 0x55
pop esi
push esi
push 0x1017f7b0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018572
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a6450
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x1017f7b0], 0x5f
mov cl, 0x2d
je 0x10018512
mov cl, byte [eax*2 + 0x1017f7b0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001851f
inc eax
cmp eax, esi
jl 0x100184fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
mov esi, eax
pop ecx
test esi, esi
je 0x10018572
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001856b
push 0x10017d70
push 0x15
mov byte [eax + esi], bl
mov dword [0x1017f7a8], esi
mov byte [0x1017f7ac], 1
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
pop ecx
jmp 0x10018571
push esi
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
pop ecx
mov ecx, dword [0x1017f7a8]
mov eax, 0x100fbd80
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x1017f7a8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100814c9
leave
ret
Function at 0x1004fc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
test eax, eax
jle 0x1004fc67
mov ebx, dword [edi + 4]
movzx edx, byte [ebp + 8]
mov ecx, dword [ebx + esi*8]
mov ebx, dword [ebx + esi*8 + 4]
movzx eax, cl
dec ebx
mov dword [ebp - 4], eax
mov eax, ebx
xor eax, ecx
test eax, 0xffffff00
jne 0x1004fc52
cmp dword [ebp - 4], edx
ja 0x1004fc5e
jmp 0x1004fc57
cmp dword [ebp - 4], edx
jbe 0x1004fcab
movzx eax, bl
cmp edx, eax
jbe 0x1004fcab
mov ebx, dword [edi + 4]
inc esi
cmp esi, dword [ebp - 8]
jl 0x1004fc32
lea ecx, [edi - 4]
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeSet::hasStrings_void_const
test al, al
je 0x1004fca2
mov eax, dword [edi + 0x28]
xor esi, esi
cmp dword [eax + 4], esi
jle 0x1004fca2
movzx ebx, byte [ebp + 8]
push esi
mov ecx, eax
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
push 0
mov ecx, eax
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
movzx eax, al
cmp eax, ebx
je 0x1004fcab
mov eax, dword [edi + 0x28]
inc esi
cmp esi, dword [eax + 4]
jl 0x1004fc81
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
mov al, 1
jmp 0x1004fca4

Function at 0x1005d8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1005d8df
pop dword [ebp - 0x4c]
mov eax, 0x7de3c951
sub eax, 0x6dddf072
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x6e04c
push 0
mov eax, 0x4d1dafe1
add eax, 0xc2f1514b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x6ef2f9c1
sub ecx, 0x6ef2bb35
mov edi, eax
mov ebx, 0x1018cc00
add ebx, dword [ebp - 0x4c]
mov esi, 0x5d8b3537
add esi, 0xe5e691c
sub dword [ebp - 0x1c], edi
mov edx, dword [ebx]
add dword [ebp - 0x28], edx
sub edx, esi
xor dword [ebp - 0x28], 0x173d53d1
mov dword [edi], edx
add dword [ebp - 0x48], edi
add edi, 0x2fab4666
sub edi, 0x2fab4662
add ebx, 4
loop 0x1005d938
add eax, 0xed03
mov ebx, eax
add eax, 0x101e3aea
add eax, 0xefe1c51b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret