joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510780
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51093d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 4], 0
jne 0x5107c6
lea edx, [ebp - 0x1c]
mov eax, 0x5101e0
call fcn.00406e84
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x510104]
call fcn.004105d4
call fcn.004042f0
mov eax, dword [ebp - 4]
mov edx, dword [0x440afc]
call fcn.00406308
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x510920
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor ebx, ebx
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x5688d4]
call fcn.00510668
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x510817
inc ebx
cmp bl, 1
jbe 0x5107f2
cmp dword [ebp - 8], 0
je 0x51090d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x510906
push dword fs:[eax]
mov dword fs:[eax], esp
sub bl, 1
jb 0x510844
je 0x510852
jmp 0x5108b9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
add dword [ebp - 0x18], 4
jmp 0x5108c5
mov eax, 0x510954
call fcn.00510668
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5108ab
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5108a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5108c5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalSize
mov dword [ebp - 0x10], eax
jmp 0x5108c5
call fcn.0040439c
call fcn.0040439c
jmp 0x510927
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x440afc]
call fcn.004061e8
add esp, 4
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.00402c78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51090d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510927
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510944
lea eax, [ebp - 0x1c]
call fcn.00404974
ret
Function at 0x510968
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x510a2c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [eax + 4], 0
jne 0x5109ab
lea edx, [ebp - 8]
mov eax, 0x5101e0
call fcn.00406e84
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x510104]
call fcn.004105d4
call fcn.004042f0
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x510a0f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x5109e6
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00404b7c
jmp 0x5109ed
mov eax, ebx
call fcn.00404974
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510a16
cmp dword [ebp - 4], 0
je 0x510a09
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
ret

Function at 0x510a38
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x510bfa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 4], 0
jne 0x510a81
lea edx, [ebp - 0x14]
mov eax, 0x5101e0
call fcn.00406e84
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x510104]
call fcn.004105d4
call fcn.004042f0
mov eax, dword [ebp - 4]
call fcn.004050b0
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x510bd8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x510b00
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x510af9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x510adc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00405218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510bc5
cmp dword [ebp - 8], 0
je 0x510af8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x10
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x510b4e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x510b31
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b55
cmp dword [ebp - 8], 0
je 0x510b4d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x5110b8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x5111eb
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [eax + 4], 0
jne 0x5110fd
lea edx, [ebp - 0xc]
mov eax, 0x5101e0
call fcn.00406e84
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x510104]
call fcn.004105d4
call fcn.004042f0
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x5111ce
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
mov eax, ebx
call fcn.00404c60
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5111a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x511192
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c60
inc eax
push eax
mov eax, ebx
call fcn.00404e60
mov edx, dword [ebp - 8]
pop ecx
call fcn.00402c78
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511199
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x5111fc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x5113ae
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [eax + 4], 0
jne 0x511243
lea edx, [ebp - 0x14]
mov eax, 0x5101e0
call fcn.00406e84
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x510104]
call fcn.004105d4
call fcn.004042f0
mov eax, dword [eax + 0xc]
push eax
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x51138c
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
call fcn.00405314
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x51127a
call fcn.0040439c
jmp 0x511393
mov eax, dword [0x56908c]
cmp byte [eax], 0
jne 0x511302
mov ebx, dword [ebp - 0x10]
inc ebx
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x511302
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5112fb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x5112e4
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404c28
mov eax, dword [ebp - 0x18]
call fcn.00404e60
mov ecx, ebx
mov edx, dword [ebp - 0xc]
call fcn.00402c78
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511302
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov eax, dword [ebp - 0x10]
inc eax
mov ebx, eax
add ebx, ebx
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x511379
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x511372
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x51135b
mov eax, dword [ebp - 4]
call fcn.00405304
mov ecx, ebx
mov edx, dword [ebp - 0xc]
call fcn.00402c78
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511379
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511393
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5113b5
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404998
ret
Function at 0x5265fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x526799
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 2], 0
mov eax, dword [0x569090]
cmp byte [eax], 0
je 0x52663f
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405110
lea eax, [ebp - 8]
call fcn.00404ec0
jmp 0x526651
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404c28
lea eax, [ebp - 0xc]
call fcn.00404eb0
mov eax, dword [0x569090]
cmp byte [eax], 0
je 0x5266ef
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405304
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x52677b
mov eax, ebx
call fcn.00402a34
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5266e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405304
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5266d2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x5267ac
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5266d2
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
mov word [ebp - 2], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52677b
mov eax, dword [ebp - 0x14]
call fcn.00402a54
ret
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e60
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x52677b
mov eax, ebx
call fcn.00402a34
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x526774
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e60
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x52675e
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x5267e0
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x52675e
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
mov word [ebp - 2], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52677b
mov eax, dword [ebp - 0x14]
call fcn.00402a54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5267a0
lea eax, [ebp - 0xc]
call fcn.00404974
lea eax, [ebp - 8]
call fcn.004050b0
ret
Function at 0x537590
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x5376b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, bl
cmp eax, 0x19
ja case.0x5375c6.0
mov al, byte [eax + 0x5375cd]
jmp dword [eax*4 + 0x5375e7]
xor ebx, ebx
jmp 0x53761d
mov bl, 1
jmp 0x53761d
mov bl, 2
jmp 0x53761d
mov bl, 3
jmp 0x53761d
mov bl, 7
jmp 0x53761d
mov bl, 4
jmp 0x53761d
xor ebx, ebx
mov eax, ebx
test al, al
je 0x537627
sub al, 7
jne case.0x53765d.1
lea eax, [ebp - 8]
push eax
mov ecx, 2
mov edx, 5
mov eax, dword [ebp - 4]
call fcn.00404ec4
lea eax, [ebp - 8]
mov edx, 0x5376c8
call fcn.00404c68
mov eax, dword [ebp - 8]
call fcn.00404e60
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x53765d.1
jmp dword [eax*4 + 0x537664]
xor ebx, ebx
jmp case.0x53765d.1
mov bl, 7
jmp case.0x53765d.1
mov bl, 4
jmp case.0x53765d.1
xor ebx, ebx
jmp case.0x53765d.1
mov bl, 6
jmp case.0x53765d.1
mov bl, 5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5376b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404998
ret

Function at 0x542994
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffea8
mov dword [esp], eax
lea edi, [esp + 4]
mov edx, edi
mov eax, dword [esp]
mov ecx, 0x14
call fcn.00402c78
xor esi, esi
lea ebx, [esp + 0x18]
mov eax, dword [esp]
add eax, 0x30
mov edx, esi
shl edx, 2
add eax, edx
mov eax, dword [eax]
call fcn.0054252c
mov dword [ebx], eax
inc esi
add ebx, 4
cmp esi, 0x10
jne 0x5429ba
mov esi, 0x40
lea ebx, [esp + 0x4c]
mov eax, dword [ebx]
xor eax, dword [ebx - 0x14]
xor eax, dword [ebx - 0x2c]
xor eax, dword [ebx - 0x34]
mov dl, 1
call fcn.005424d4
mov dword [ebx + 0xc], eax
add ebx, 4
dec esi
jne 0x5429e2
xor esi, esi
lea ebp, [esp + 0x18]
mov eax, dword [edi + 0xc]
push eax
mov ebx, esi
mov eax, ebx
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
call fcn.0054292c
push eax
mov dl, 5
mov eax, dword [edi]
call fcn.005424d4
pop edx
add edx, eax
add edx, dword [edi + 0x10]
push edx
mov eax, ebx
call fcn.00542970
pop edx
add edx, eax
add edx, dword [ebp]
mov ebx, edx
mov eax, dword [edi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov dl, 0x1e
mov eax, dword [edi + 4]
call fcn.005424d4
mov dword [edi + 8], eax
mov eax, dword [edi]
mov dword [edi + 4], eax
mov dword [edi], ebx
inc esi
add ebp, 4
cmp esi, 0x50
jne 0x542a03
mov esi, 5
mov eax, edi
mov edx, dword [esp]
mov ecx, dword [eax]
add dword [edx], ecx
add edx, 4
add eax, 4
dec esi
jne 0x542a69
add esp, 0x158
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x542d78
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x542db8
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret

Function at 0x542e0c
Capabilities:
Hash data using sha224

Disassembly:
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
ret

Function at 0x542e98
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
ret
Function at 0x5433fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], eax
lea esi, [esp + 8]
mov edi, 0x568d50
mov eax, dword [esp]
mov cl, byte [eax + 0x40]
xor eax, eax
mov al, cl
mov ebx, eax
add ebx, 0x10
mov ebp, dword [esp]
mov byte [ebp + ebx], dl
xor ebx, ebx
mov bl, cl
mov ebp, dword [esp]
mov bl, byte [ebp + ebx]
xor bl, dl
push ebx
add eax, 0x20
mov ebx, dword [esp + 4]
add ebx, eax
pop eax
mov byte [ebx], al
xor eax, eax
mov al, cl
mov ebx, dword [esp]
lea eax, [ebx + eax + 0x30]
push eax
mov eax, dword [esp + 4]
xor dl, byte [eax + 0x41]
and dl, 0xff
xor eax, eax
mov al, dl
mov al, byte [edi + eax]
pop edx
xor byte [edx], al
xor eax, eax
mov al, cl
mov edx, dword [esp]
mov al, byte [edx + eax + 0x30]
mov edx, dword [esp]
mov byte [edx + 0x41], al
lea eax, [ecx + 1]
and al, 0xf
mov edx, dword [esp]
mov byte [edx + 0x40], al
mov ecx, eax
test cl, cl
jne 0x54350c
xor edx, edx
mov byte [esp + 4], 0
mov eax, dword [esp]
mov dword [esi], eax
mov cl, 8
xor eax, eax
mov al, dl
mov al, byte [edi + eax]
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov dl, byte [eax]
inc dword [esi]
xor eax, eax
mov al, dl
mov al, byte [edi + eax]
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov dl, byte [eax]
inc dword [esi]
xor eax, eax
mov al, dl
mov al, byte [edi + eax]
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov dl, byte [eax]
inc dword [esi]
xor eax, eax
mov al, dl
mov al, byte [edi + eax]
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov dl, byte [eax]
inc dword [esi]
xor eax, eax
mov al, dl
mov al, byte [edi + eax]
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov dl, byte [eax]
inc dword [esi]
xor eax, eax
mov al, dl
mov al, byte [edi + eax]
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov dl, byte [eax]
inc dword [esi]
dec cl
jne 0x543493
add dl, byte [esp + 4]
inc byte [esp + 4]
cmp byte [esp + 4], 0x12
jne 0x54348c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5436a8
Capabilities:
Hash data with md5

Disassembly:
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x54997c
Capabilities:
Check internet connectivity via wininet
Create http request
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x549b61
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404974
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x5499c2
call fcn.0054984c
push 0
push 0
push 0
push 0
push 0x549b70
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5499e2
call fcn.0054984c
xor eax, eax
push ebp
push 0x549b10
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
mov eax, ebx
call fcn.00404e60
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x549a1a
call fcn.0054984c
xor eax, eax
push ebp
push 0x549af2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.005498d0
mov eax, dword [ebp - 0x18]
mov edx, 0x549b8c
call fcn.00404dac
jne 0x549a93
lea eax, [ebp - 0x28]
mov edx, ebx
call fcn.00405288
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00441b54
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xf
lea eax, [ebp - 0x20]
push eax
push 0
lea edx, [ebp - 0x30]
mov eax, 0x54965c
call fcn.00406e84
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.00405288
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x549208]
call fcn.0043b5ec
call fcn.004042f0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetQueryDataAvailable
test eax, eax
jne 0x549aad
call fcn.0054984c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404ff0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00404eb8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x549adb
call fcn.0054984c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x549af9
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret

Function at 0x549ec8
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040526c
add esp, 0x800
pop ebx
ret

Function at 0x549f00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffc00
mov edi, ecx
mov esi, edx
mov ebx, eax
mov byte [esp], 0
push 0x400
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoA_1
mov ecx, eax
dec ecx
mov edx, esp
mov eax, edi
call fcn.00404a64
add esp, 0x400
pop edi
pop esi
pop ebx
ret