joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e20a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x52c1f0
test esi, esi
jne 0x4e20c2
xor eax, eax
jmp 0x4e21c4
cmp dword [ebp], 0
jne 0x4e20cd
call fcn.004e2038
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4e219d
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4e20d9
test edi, edi
jbe 0x4e21bf
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4e21a1
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f7794
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x4f7947
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283c0
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00450ed4
call fcn.004eeb34
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x4f7818
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.00422df8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283c0
mov eax, dword [eax + 0xc]
pop edx
call fcn.00422e00
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422ce0
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.004098b8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283c0
call fcn.00423c50
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422d54
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422d90
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422d90
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422d90
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00422df8
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283c0
mov eax, dword [eax + 0xc]
pop edx
call fcn.00422c8c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004283c0
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.00422ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f794e
lea eax, [ebp - 4]
call fcn.0040476c
ret
Function at 0x50f0f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x50f110
mov eax, ebx
call fcn.0050e954
cmp dword [ebx + 0x68], 0
jne 0x50f11d
mov eax, ebx
call fcn.0050e8ec
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.0050e76c
lea eax, [esp + 0x10]
xor edx, edx
call fcn.0050f8c4
cmp eax, dword [esp]
je 0x50f18b
lea eax, [esp + 0x10]
xor edx, edx
call fcn.0050f8d8
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x50f167
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.0050f8c4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x50f180
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x50f1a6
push 3
mov eax, dword [esi + 0x10]
call fcn.004454f4
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x50f1b3
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.0043e420
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0043e444
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0043e46c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0043e490
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00415bc4
mov eax, ebp
mov edx, dword [0x52aa2c]
mov byte [edx + 2], al
mov eax, dword [0x52aa2c]
mov byte [eax], 0
mov eax, dword [0x52aa2c]
mov byte [eax + 1], 0
mov eax, dword [0x52aa2c]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004454f4
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004454f4
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004454f4
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x52aa2c]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.004283c0
call fcn.00423c50
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004454f4
push eax
mov eax, dword [0x52aa08]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.004454f4
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x50fca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x52acd0]
mov eax, dword [eax]
call fcn.0045f960
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x50fcab
pop esi
pop ebx
ret
Function at 0x51020c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00409308
test al, al
je 0x510293
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403230
or esi, 0x100
test esi, esi
jns 0x510247
call fcn.004038bc
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404c1c
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x510293
mov dl, 1
mov eax, dword [0x421ca8]
call fcn.004299c0
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00429dcc
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x510293
mov eax, esp
call fcn.0040e5c8
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x5224c4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x522666
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x52267c
call fcn.00409308
test al, al
je 0x522648
mov eax, dword [ebp + 8]
add eax, 0xffffffe8
xor ecx, ecx
mov edx, 0x10
call fcn.00403230
mov eax, dword [ebp + 8]
add eax, 0xffffffa4
xor ecx, ecx
mov edx, 0x44
call fcn.00403230
mov eax, dword [ebp + 8]
mov dword [eax - 0x5c], 0x44
mov eax, dword [ebp + 8]
mov dword [eax - 0x30], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x2c], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x318]
lea eax, [ebp - 4]
mov ecx, 0x52267c
call fcn.00404a70
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x522694
call fcn.00409fbc
mov eax, dword [ebp - 0x10]
mov edx, 0x5226b0
call fcn.005212ac
pop ecx
mov eax, dword [ebp + 8]
add eax, 0xffffffe8
push eax
mov eax, dword [ebp + 8]
add eax, 0xffffffa4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x318]
call fcn.00404c1c
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404c1c
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x522648
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
call sub.user32.dll_WaitForInputIdle
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x522494
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.user32.dll_EnumThreadWindows
cmp dword [ebp - 8], 0
je 0x522648
push 0
push 0x5226b8
push 0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 0xc], eax
push 0x5226c0
push 0x5226c8
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x522648
push 0
push 0
push 0xf5
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_PostMessageA
push 0xbb8
call sub.kernel32.dll_Sleep_1
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52266d
lea eax, [ebp - 0x10]
call fcn.0040476c
lea eax, [ebp - 4]
call fcn.0040476c
ret
Function at 0x50121c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x50122e
mov eax, dword [0x53b09f]
shl eax, 2
mov dword [0x53b0a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0052de48
pop edx
call fcn.0052da48
call fcn.0052e3d4
push 0
call fcn.0052f6f8
pop ecx
push 0x53b048
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x53b0a7], eax
push 0
jmp fcn.00537404

Function at 0x501600
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
mov eax, 0x53b37c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
call fcn.0052eaf8
mov edx, dword [0x53b1b8]
mov ecx, dword [0x53b1c0]
mov dword [ebp - 0x30], edx
mov edx, dword [0x53b1bc]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], ecx
mov ecx, dword [0x53b1c4]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x3c], ecx
push 0x208
push eax
push 0
mov dword [0x542b18], 1
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
lea edx, [ebp - 0x248]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x501783
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 0x28]
push 0
push eax
lea edx, [ebp - 0x38]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x5016c3
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x50178f
push 8
lea ecx, [ebp - 0x38]
push ecx
lea eax, [ebp - 0x40]
push eax
call fcn.0052e910
add esp, 0xc
test eax, eax
je 0x5016ea
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x50178f
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea ecx, [ebp - 0x28]
push ecx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x50171d
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x50178f
push 4
push 0x1000
mov ecx, dword [esi]
push ecx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x53b1b4], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 0x28]
push 0
push edx
mov eax, dword [0x53b1b4]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x501772
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x50178f
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x50178f
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x501798
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcdc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, 0x53b3a0
call fcn.0052eaf8
push 0x2350
push 0x69
push esi
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x5017e3
mov eax, dword [ebp + 0x14]
push eax
call fcn.00501600
pop ecx
test eax, eax
jne 0x501837
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x501935
push ebx
push esi
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
test edi, edi
jne 0x501801
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x501935
je 0x501806
jne 0x501806
jmp 0x50185e
push edi
call sub.KERNEL32.DLL_LockResource
mov dword [0x53b1b4], eax
cmp dword [0x53b1b4], 0
jne 0x50182b
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x501935
push ebx
push esi
call sub.KERNEL32.DLL_SizeofResource
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x501935
push ebx
add byte [eax + 0x53], dl
call fcn.0052e470
add esp, 0xc
mov edx, sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x28], edx
mov esi, dword [ebp - 0x28]
mov al, byte [esi]
cmp al, 0xcc
je 0x5018ee
mov ecx, 0x53a144
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x5018ee
mov eax, sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x30]
mov al, byte [esi]
cmp al, 0xcc
je 0x5018ee
mov edx, sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x34], edx
mov esi, dword [ebp - 0x34]
mov al, byte [esi]
cmp al, 0xcc
je 0x5018ee
mov ecx, sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x38], ecx
mov esi, dword [ebp - 0x38]
mov al, byte [esi]
cmp al, 0xcc
je 0x5018ee
lea edi, [ebp - 0x220]
mov esi, 0x53b1ca
mov ecx, 8
lea eax, [ebp - 0x220]
rep movsd dword es:[edi], dword [esi]
push 0x124
push eax
lea edx, [ebx + 0xa4]
push 0x64
push edx
call fcn.00502080
add esp, 0x10
mov ecx, dword [ebx + 0x1bc]
push ecx
lea eax, [ebx + 0xa4]
push eax
add ebx, 0xb8
push ebx
push 0
call sub.USER32.DLL_MessageBoxA
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5020d0
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.00501958
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x502186
mov eax, fcn.00501798
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x502186
mov eax, fcn.00502080
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x502186
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebx, 0xc6ef3720
mov edx, dword [edx + 4]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov edi, 0x20
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x502186
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x50214e
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5021a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, edx
jbe 0x5021bc
xor byte [eax], 0xf5
inc edx
inc eax
cmp ecx, edx
ja 0x5021b3
pop ebp
ret

Function at 0x508e80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x508eb9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00516378
jmp 0x508ec2
mov eax, ebx
mov edx, esi
call fcn.0051623c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x508ecc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x508eee
movzx eax, word [esp]
jmp 0x508ef0
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x509680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x5097a5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00509490
mov esi, eax
mov eax, dword [0x542364]
cmp byte [eax], 0
je 0x50974d
mov eax, dword [0x5423a0]
call fcn.005147c0
call fcn.0051460c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x509658]
call fcn.0051703c
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x5097c0
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x509789
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x542424]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x542578]
call fcn.00517128
push eax
call sub.USER32.DLL_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.USER32.DLL_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5097ac
lea eax, [ebp - 4]
mov edx, dword [0x509658]
call fcn.00517048
ret

Function at 0x50b754
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00515e90
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
mov edi, eax
cmp edi, 0x104
jbe 0x50b6fe
mov eax, edi
add eax, eax
call fcn.0051443c
mov esi, eax
jmp 0x50b700
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.KERNEL32.DLL_MultiByteToWideChar
push edi
push esi
call sub.USER32.DLL_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x50b739
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x50b723
mov eax, esp
cmp esi, eax
je 0x50b746
mov eax, esi
call fcn.00514458
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x50b780
cmp bl, 0
je 0x50b77c
cmp bl, 0x41
jl 0x50b777
cmp bl, 0x5a
jg 0x50b777
or bl, 0x20
xor al, bl
inc esi
jmp 0x50b75b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x50b6c0