joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48aa98
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
jno 0x48aafe
jns 0x48aabc
inc ebp
fadd qword [ebx]
call dword [eax - 0x2d]
xchg dword [ebp - 0x41], ecx
scasd eax, dword es:[edi]
arpl ax, bp
mov cl, bh
loop 0x48ab1d
xor esp, dword [ebx - 0x19]
std
adc al, bl
ljmp 0x7eb9
mov word [edi], cs
sar dword [esi - 0x4d], 0x57
xor dword [ecx - 0x62], esp
add eax, 0xd043d555
pop ecx
adc dl, dh
adc esp, edx
xor ebx, dword [esi]
sub eax, dword [edx + 0x13]
mov byte [0x447f9003], al
outsd dx, dword [esi]
mov eax, dword [0x560d4f72]
fcom dword [0x4dbe5705]
pop ecx
xor ecx, edx
jb 0x48ab2e
or eax, 0x515d856
push edi
mov esi, 0xd131594d
jecxz 0x48ab3e
adc edx, edi
sub dword [edx + 0x7a73123f], esp
xor ebp, dword [esi + 0x69bd2e83]
mov byte [0x2f77534e], al
das
stosb byte es:[edi], al
cmp eax, 0x580387ff
sub byte [esi - 0x556e8169], 0x93
dec edx
scasd eax, dword es:[edi]
out dx, al
mov bl, 0xdd
and al, 0x1e
inc ecx
jae 0x48aadd
and eax, 0x18f9a20f
push ebx
mov byte [0x9e1782e3], al
and dword [esi + 0x65eba793], ecx
jnp 0x48ab45
out dx, eax
jbe 0x43292f06
and eax, 0x42
add dh, byte [esi + 0x32a46570]
jb 0x48ab99
inc ebx
arpl word [edx], si
inc ebx
inc ecx
push 0xffffffffffffff95
popfd
pushal
rcl byte [edx + 0x23c163a4], cl
aam 0x81
invalid
movsb byte es:[edi], byte [esi]
arpl cx, ax
and edx, esp
add esi, 0xaba65fe3
arpl word [esi - 0x3adaabe0], ax
inc esp
or ah, byte [ecx - 0x52f9e7f]
xor eax, 0x176cbae4
and byte [eax], ah
cli
or eax, dword [ecx - 0x2d]
test byte [eax - 0x2b6f1ead], dh
add al, al
pushal
jae 0x48abc0
popal
jno 0x48ab8d
add eax, 0x7bc65232
inc ebp
mov eax, dword cs:[0xc6e23592]
leave
out 0xa5, eax
mov bl, 0xe5
add byte [eax], dl
movsd dword es:[edi], dword [esi]
mov esp, ebp
mov cl, 0xc3
sti
aad 0x27
add al, 0xc2
add ebx, esp
loop 0x48abae
ret
sub al, byte [ecx - 0x5d]
inc eax
into
bnd jb 0x48ab41
popal
mov dword [0x72f2ce40], eax
mov eax, dword [0xe6ec1c82]
sbb byte [esp + ebp*8], 0xe6
xchg byte gs:[ebx], bl
lcall 0xb0c4, 0x25f60353
ret 0x5477
mov al, 0xc2
ja 0x48ac06
add eax, 0x1b3a336a
inc ecx
into
int1
push esi
ret 0x7b02
xchg edx, eax
xor dword [esi + 0x65c09393], 0xffffffa2
xchg dword [ebx - 0x2d], esp
mov dl, 0xf2
rcl byte [ebx + 0x113a4363], cl
push esi
popal
inc ecx
jb 0x48ab68
xchg ecx, eax
sahf
jo 0x48ac50
mov cs, word [esp + edx*4 - 0x79]
push ecx
lea eax, [ebp - 0x3b9ebfb2]
xchg dword [ebx - 0x33], esp
sbb dword [esi], ecx
aam 0xf1
xlatb
fsub dword [esi + 0x14]
add dword [esi - 0x44], esi
cmpsd dword [esi], dword es:[edi]
sub al, 3
cmpsd dword [esi], dword es:[edi]
loope 0x48abff
and ebx, dword [ebp + 0x4e]
dec esi
out 7, al
mov dl, 0xb
mov byte [ebp - 0x4cdda9ca], ah
out dx, eax
movsd dword es:[edi], dword [esi]
xor byte [ebp + esi*4 - 0x16], 0x15
and dword [edi + 0x5632a7c8], edi
mov byte [0x46635e73], al
push ebx
push esi
and dh, byte [ebx + 0x7482a5ef]
mov ch, 0xea
adc eax, 0xa7c8bf21
xor dl, byte [esi - 0x5e]
jae 0x48ac78
arpl word [esi + 0x53], ax
jb 0x48abe2
inc ebx
mov dl, 0xd8
push edi
add eax, 0x688330d1
ret 0x22c3
retf 0xe312
aas
xchg ebx, eax
outsd dx, dword [esi]
inc edx
popfd
cli
iretd
Function at 0x48ae48
Capabilities:
Encode data using xor

Disassembly:
and byte [edi + 0x73], dl
inc esp
aad 0xad
cmc
leave
xor dword [edi + ebp*8], esp
dec esp
aam 0xd4
shr dword [ecx - 0x3a433671], cl
xchg esi, eax
mov ah, 4
cmp eax, 0x3d571a83
mov bh, 0xa5
inc eax
daa
enter 0x766e, 0x1c
dec eax
mov esi, 0xf4d3c2e8
pop esp
invalid
jb 0x48adfc
invalid

Function at 0x7c5ebd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7ce388
cmp edx, dword [eax]
je 0x7c5edf
add eax, 8
inc ecx
cmp eax, 0x7ce418
jl 0x7c5ed0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x7ce388]
jne 0x7c600d
mov eax, dword [0xbd1ce4]
cmp eax, 1
je 0x7c5fe7
test eax, eax
jne 0x7c5f10
cmp dword [0x7ce2b4], 1
je 0x7c5fe7
cmp edx, 0xfc
je 0x7c600d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c5f47
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.007c68a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.007c6d30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x7c5f8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.007c6d30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7cb9ec
push edi
call fcn.007c8c00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.007c68a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.007c68b0
lea eax, [ebp - 0xa0]
push 0x7cb9cc
push eax
call fcn.007c68b0
push dword [esi + 0x7ce38c]
lea eax, [ebp - 0xa0]
push eax
call fcn.007c68b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.007c8b74
add esp, 0x2c
pop edi
jmp 0x7c600d
lea eax, [ebp + 8]
lea esi, [esi + 0x7ce38c]
push 0
push eax
push dword [esi]
call fcn.007c6d30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10097cab
Capabilities:
Query environment variable

Disassembly:
jmp 0x101a8d72
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x101a8d86
xor edi, edi
jmp 0x101a8dca
push ebx
push esi
call fcn.101a8c6b
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.10099e1b
mov edi, eax
add esp, 0x14
test edi, edi
je 0x101a8db7
push ebx
push esi
push edi
call fcn.1009a0a5
add esp, 0xc
push 2
push 0
call fcn.10099718
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x10099899
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x101c4bd0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x10211bac], 1
jge 0x101c4c3f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x101c4c15
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x101c4c15
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x101c4bf2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x101c4c2b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x101c4c32
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x101c4d2f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x101c4d00
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x101c4cf5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x101c4ce9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x101c4cf0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x101c4d2f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x101c4d2a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x101c4d13
mov eax, dword [ebx + 8]
jmp 0x101c4d2f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x101c4d21
xor eax, eax
jmp 0x101c4d2f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x101c4c5f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100ba630
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
mov edi, ebp
xor ecx, ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10215057
call fcn.1009a541
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.10098bce
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10098bce
mov esp, ebp
pop ebp
ret

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..pdata
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x402788
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403cb8
test esi, esi
jne 0x4027be
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403da8
jmp 0x4027dc
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040269c
mov edi, eax
test esi, esi
je 0x4027dc
cmp dword [ebx], 0
je 0x4027dc
dec esi
jmp 0x4027c5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402cac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40e008], 0x8088405
inc edx
mov dword [ebx + 0x40e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4031f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40e010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403290
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403270
xor eax, eax
push ebp
push 0x403269
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4032ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403270
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x40e010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40e010], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b3c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40f044], 0
je 0x403b9d
cmp word [0x40f218], 0xd7b2
jne 0x403b65
cmp dword [0x40f220], 0
jbe 0x403b65
mov eax, 0x40f214
call dword [0x40f230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40e074
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403bc4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x40e01c], 0
jne 0x403bb9
push 0
push 0x40e094
push 0x40e074
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x40465c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40488c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4046df
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40488c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4046df
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4048a8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404768
xor eax, eax
push ebp
push 0x404761
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004044a4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x404746
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4048c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x404746
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404768
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404882
cmp byte [ebp - 0xd], 0
jne 0x4047af
cmp byte [ebp - 0x12], 0
je 0x404882
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4047c8
dec ebx
cmp byte [ebx], 0x2e
je 0x4047d7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4047c7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404882
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404814
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404882
cmp byte [ebp - 0xd], 0
je 0x404882
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404882
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4067f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x406829
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403da8
jmp 0x406832
mov eax, ebx
mov edx, esi
call fcn.00403d0c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40683c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40685d
mov al, byte [esp]
jmp 0x40685f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407914
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407978
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403efc
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00405a6c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40797f
lea eax, [ebp - 0xc]
call fcn.00403cb8
ret
Function at 0x404400
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4044d0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4044d0
mov ebp, dword [esp + 0x28]
mov esi, 0x1505
test ebp, ebp
je 0x40444d
xor edi, edi
nop
movzx ecx, byte [ebx + edi]
test ecx, ecx
je 0x40444d
mov edx, esi
shl edx, 5
add edx, esi
mov esi, edx
and esi, ecx
xor edx, ecx
lea esi, [edx + esi*2]
inc edi
cmp ebp, edi
jne 0x404430
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x4044d0
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404474
inc edi
dec ebx
je 0x4044ce
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4044ce
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404470
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c520
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404470
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c540
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404470
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4044d0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x404c51
cmp dword [esp + 0x1c], 0
jle 0x404bf8
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [edx + eax]
mov dword [esp], ecx
jmp 0x404a85
cmp esi, 0xc0
jne 0x404c4f
and ebx, 0x1ff800
cmp ebx, 0xd800
je 0x404c4f
add edx, ebp
cmp edx, ecx
jae 0x404bf8
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x404c4f
mov eax, ebx
and al, 0xfe
cmp al, 0xc0
je 0x404c4f
mov eax, ebx
and eax, 0xffffffc0
cmp eax, 0x80
je 0x404c4f
mov ebp, 1
test bl, bl
jns 0x404a7b
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x404aec
movzx edi, byte [edx + 1]
mov eax, edi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404c4f
and ebx, 0x1f
shl ebx, 6
mov ebp, 2
xor eax, eax
jmp 0x404bbb
mov eax, ebx
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x404b39
movzx eax, byte [edx + 1]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404c4f
movzx edi, byte [edx + 2]
mov ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404c4f
and ebx, 0xf
shl ebx, 0xc
and eax, 0x3f
shl eax, 6
or ebx, eax
mov ebp, 3
xor eax, eax
jmp 0x404bb8
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x404c4f
movzx eax, byte [edx + 1]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404c4f
movzx ecx, byte [edx + 2]
mov edi, ecx
xor edi, 0xffffff3f
mov ebp, ecx
or ebp, 0xc0
and ebp, edi
cmp ebp, 0x80
jne 0x404c4f
movzx edi, byte [edx + 3]
mov ebp, edi
not ebp
or ebp, 0xc0
add ebp, edi
cmp ebp, 0x7f
jne 0x404c4f
and ebx, 7
shl ebx, 0xc
and eax, 0x3f
shl eax, 6
or eax, ebx
and ecx, 0x3f
or ecx, eax
shl ecx, 6
mov al, 1
mov ebp, 4
mov ebx, ecx
mov ecx, dword [esp]
and edi, 0x3f
or edi, ebx
cmp edi, 0x80
jb 0x404c4f
cmp edi, 0x7ff
jbe 0x404a5d
cmp edi, 0xffff
ja 0x404bea
test al, al
je 0x404a69
jmp 0x404c4f
cmp edi, 0x10ffff
jbe 0x404a69
jmp 0x404c4f
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x404c4f
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040c440
add esp, 0xc
push 0x10
call dword [0x450008]
add esp, 4
test eax, eax
je 0x404c45
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x404c51
push esi
call dword [0x450004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret