joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a0d14
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.005a0ac8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x5a0d30
mov bl, 0x1c
mov esi, 0x6261e4
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.005a0ac8
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.005a0ac8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x5a0d4c
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.005a0ca8
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x5a0d76
mov bl, 1
mov eax, 0x626114
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x5a0daf
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x5a0dbc
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x5a0d9b
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x5a0de6
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.005a0b30
jmp 0x5a0e0d
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.005a0b30
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x5a0e15
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x5a0dce
mov bl, 0x40
mov esi, 0x626154
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x5a0e7b
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x5a0e88
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x5a0e64
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.005a0af0
inc ebx
inc esi
cmp bl, 0x41
jne 0x5a0e96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5a1034
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x5a10e5
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x5a10e0
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.00406378
push 1
mov eax, edi
call fcn.00406250
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.005a0d14
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5a6de0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5a6de9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5a6faf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005a7144
xor eax, eax
push ebp
push 0x5a6f80
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x5a6e39
call fcn.004052e4
jmp 0x5a6f87
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x5a6f0e
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x5a6e8e
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x5a6e8e
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005a6d34
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406f68
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x5a6ecd
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.005a6d34
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406f68
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.00406a3c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x5a6f6a
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005a6d34
push dword [ebp - 0x24]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
push 0x5a6fcc
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406f68
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.005a6d54
jmp 0x5a6f6a
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x5a6f31
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x5a6f31
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x5a6f47
mov eax, ebx
call fcn.00406a3c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x5a6f6a
lea eax, [ebp - 0x28]
mov ecx, 0x5a6fcc
mov edx, ebx
call fcn.00406e84
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.005a6d54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6f87
mov eax, dword [ebp - 4]
call fcn.005a714c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6fb6
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004069a8
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004069a8
ret
Function at 0x5b50f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x5b5111
inc edi
mov eax, esi
call fcn.00405ddc
cmp edi, eax
jg 0x5b5123
cmp byte [esi + edi - 1], 0x20
je 0x5b5110
mov eax, esi
test eax, eax
je 0x5b512e
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x5b51f0
cmp byte [esi + edi - 1], 0x2e
je 0x5b5214
jmp 0x5b51f0
cmp byte [esi + edi - 1], 0x2e
jne 0x5b5198
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x5b5214
cmp dword [esp + 8], 0xff
jg 0x5b5214
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x5b517c
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x5b5184
mov bl, 1
jmp 0x5b5192
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x5b5214
jmp 0x5b51ef
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x5b51bd
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x5b51ef
inc edi
mov eax, esi
call fcn.00405ddc
cmp edi, eax
jg 0x5b51cf
cmp byte [esi + edi - 1], 0x20
je 0x5b51bc
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x5b51e7
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x5b5214
jmp 0x5b51ff
inc edi
mov eax, esi
call fcn.00405ddc
cmp edi, eax
jle 0x5b5146
cmp dword [esp + 4], 3
jne 0x5b5214
cmp dword [esp + 8], 0xff
jg 0x5b5214
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e6188
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00406410
cmp byte [ebp - 1], 0
jne 0x5e61e8
mov eax, esi
call fcn.00406250
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5e6202
sub al, 2
jb 0x5e6209
jmp 0x5e620e
mov ebx, 2
jmp 0x5e620e
mov ebx, 1
mov eax, esi
call fcn.00406250
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x5e62f2
test edi, edi
jle 0x5e626a
mov eax, esi
call fcn.00406250
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00406250
mov byte [eax + ebx - 1], 0
jmp 0x5e62e6
test edi, edi
jge 0x5e62b0
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00406250
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x5e62e6
mov eax, esi
call fcn.00406250
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00406250
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x5e6226
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5e6303
sub al, 2
jb 0x5e633d
jmp 0x5e6385
cmp edi, 2
jne 0x5e6309
dec ebx
mov eax, ebx
sub eax, 2
jl 0x5e6385
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00406250
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x62a004]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5e6319
jmp 0x5e6385
cmp edi, 2
jne 0x5e6343
dec ebx
test ebx, ebx
jle 0x5e6380
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00406250
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x62a008]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5e634f
jmp 0x5e6380
inc ebx
mov eax, esi
call fcn.00406250
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x5e6373
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.00406378
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5eb6c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
xor eax, eax
push ebp
push 0x5eb913
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0046fc38
mov edx, dword [ebp - 0x5c]
mov eax, 0x5eb934
call fcn.004074cc
dec eax
jne 0x5eb74c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5dd5b4]
call fcn.005ddae4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x5b2440]
call fcn.005c4878
mov edx, eax
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.005e6970
mov eax, ebx
call fcn.005e6964
call fcn.005c8c68
jmp 0x5eb75d
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5dc724]
call fcn.005ddae4
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x5eb8e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x40
call fcn.00403a80
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 8]
lea edx, [ebp - 0x58]
mov ecx, 0x20
call fcn.00406bb0
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x40
call fcn.00403a80
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
push dword [ebp - 8]
push 0x5eb954
lea eax, [ebp - 0x60]
lea edx, [ebp - 0x58]
mov ecx, 0x20
call fcn.00406bb0
push dword [ebp - 0x60]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406f68
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x374], edx
mov eax, dword [ebp - 0x18]
add eax, 0x118
mov edx, dword [ebp - 8]
call fcn.004069b0
mov eax, dword [ebp - 0x18]
add eax, 0xec
mov edx, dword [ebp - 4]
call fcn.004069b0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x188], edx
xor eax, eax
push ebp
push 0x5eb840
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.005e6050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5eb8c2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x12c]
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eb8eb
mov eax, dword [ebp - 0x18]
call fcn.00404358
ret
Function at 0x5eef5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
mov eax, dword [ebp + 0x10]
call fcn.00406998
mov eax, dword [ebp + 0xc]
call fcn.00406998
xor eax, eax
push ebp
push 0x5ef1de
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0046fc38
mov edx, dword [ebp - 0x50]
mov eax, 0x5ef1fc
call fcn.004074cc
dec eax
jne 0x5eeff5
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5dd5b4]
call fcn.005ddae4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x5b2440]
call fcn.005c4878
mov edx, eax
mov esi, dword [ebp - 0xc]
mov eax, esi
call fcn.005e6970
mov eax, esi
call fcn.005e6964
call fcn.005c8c68
jmp 0x5ef006
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5dc724]
call fcn.005ddae4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5ef1a2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x62d704], 0
je 0x5ef073
mov eax, dword [ebp - 0xc]
add eax, 0x90
mov edx, dword [0x62d704]
call fcn.004069b0
lea edx, [ebp - 0x54]
mov eax, dword [0x62d708]
call fcn.004707a4
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0xc]
add eax, 0x94
call fcn.004069b0
mov eax, dword [ebp - 0xc]
add eax, 0xa8
mov edx, dword [0x62d70c]
call fcn.004069b0
mov eax, dword [ebp - 0xc]
add eax, 0xac
mov edx, dword [0x62d710]
call fcn.004069b0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.00403a80
push 0x20
lea eax, [ebp - 0x4c]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 8]
lea edx, [ebp - 0x4c]
mov ecx, 0x20
call fcn.00406bb0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.00403a80
push 0x20
lea eax, [ebp - 0x4c]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
push dword [ebp - 8]
push 0x5ef21c
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x4c]
mov ecx, 0x20
call fcn.00406bb0
push dword [ebp - 0x58]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406f68
push 0
push 0
mov eax, ebx
call fcn.0048bcdc
cmp dword [ebp + 0xc], 0
je 0x5ef10e
mov eax, dword [ebp - 0xc]
add eax, 0xfc
mov edx, dword [ebp + 0xc]
call fcn.004069b0
cmp dword [ebp + 0x10], 0
je 0x5ef124
mov eax, dword [ebp - 0xc]
add eax, 0x16c
mov edx, dword [ebp + 0x10]
call fcn.004069b0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x374], edx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1a0], ebx
mov eax, dword [ebp - 0xc]
add eax, 0x118
mov edx, dword [ebp - 8]
call fcn.004069b0
mov eax, dword [ebp - 0xc]
add eax, 0xec
mov edx, dword [ebp - 4]
call fcn.004069b0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x188], edi
xor eax, eax
push ebp
push 0x5ef182
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.005e6064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ef18c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ef1a9
mov eax, dword [ebp - 0xc]
call fcn.00404358
ret
Function at 0x5ef388
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ef432
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x5ef3c1
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x5ef3cb
cmp eax, 0
jne 0x5ef3cb
mov eax, dword [ebp - 8]
call fcn.00405a18
jmp 0x5ef41c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x5ef3fa
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x5ef3e2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0059f4a0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004090c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ef439
lea eax, [ebp - 0xc]
call fcn.00405a18
ret

Function at 0x5ef514
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
xor eax, eax
push ebp
push 0x5ef60c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406bf4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.0055bb7c
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.00408278
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x5ef586
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x5ef56e
mov eax, dword [ebp - 8]
call fcn.00408278
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 0xfde9
call fcn.00406378
lea eax, [ebp - 0xc]
call fcn.00406250
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00408278
mov edx, ebx
mov ecx, dword [ebp - 8]
xchg ecx, eax
call fcn.00403294
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004091c8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004069b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ef613
lea eax, [ebp - 0x18]
call fcn.00405a18
lea eax, [ebp - 0x10]
call fcn.004069a0
lea eax, [ebp - 0xc]
call fcn.00405a18
lea eax, [ebp - 8]
mov edx, dword [0x46e418]
call fcn.00408560
lea eax, [ebp - 4]
call fcn.004069a0
ret
Function at 0x605c10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x605c18
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
xor eax, eax
push ebp
push 0x605f26
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004069b0
xor eax, eax
push ebp
push 0x605c87
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x605f40
call fcn.00406e84
mov eax, dword [ebp - 0x14]
mov ecx, 0x605f70
mov edx, 6
call fcn.005ef220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x605cc3
cmp dword [ebp - 8], 0
je 0x605d38
mov edx, dword [ebp - 8]
mov eax, dword [0x5ec028]
call fcn.005ed688
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x605d38
xor eax, eax
push ebp
push 0x605d31
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x606018
mov eax, dword [ebp - 0x10]
call fcn.005ec92c
test eax, eax
jl 0x605d1b
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x606018
mov eax, dword [ebp - 0x10]
call fcn.005ece0c
call fcn.004052e4
jmp 0x605efe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x605d38
mov eax, dword [ebp - 0x10]
call fcn.00404358
ret
xor eax, eax
push ebp
push 0x605d76
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x606034
call fcn.00406e84
mov eax, dword [ebp - 0x1c]
mov ecx, 0x605f70
mov edx, 6
call fcn.005ef220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x605db2
cmp dword [ebp - 8], 0
je 0x605e27
mov edx, dword [ebp - 8]
mov eax, dword [0x5ec028]
call fcn.005ed688
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x605e27
xor eax, eax
push ebp
push 0x605e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6060ec
mov eax, dword [ebp - 0x10]
call fcn.005ec92c
test eax, eax
jl 0x605e0a
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x6060ec
mov eax, dword [ebp - 0x10]
call fcn.005ece0c
call fcn.004052e4
jmp 0x605efe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x605e27
mov eax, dword [ebp - 0x10]
call fcn.00404358
ret
cmp dword [ebp - 4], 0
jne 0x605efe
xor eax, eax
push ebp
push 0x605e61
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov ecx, 0x605f70
mov edx, 6
mov eax, 0x606110
call fcn.005ef220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x605e9d
cmp dword [ebp - 8], 0
je 0x605efe
mov edx, dword [ebp - 8]
mov eax, dword [0x5ec028]
call fcn.005ed688
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x605efe
xor eax, eax
push ebp
push 0x605ef7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x606210
mov eax, dword [ebp - 0x10]
call fcn.005ece0c
call fcn.004052e4
jmp 0x605efe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x605f2d
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004069a8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004069a8
ret