joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5910cd90
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x5915b0e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x49c
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x4b8]
mov dword [esp + 0xc], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x591b1f28]
test esi, esi
je 0x5910ce7b
test eax, eax
jne 0x5910ce3a
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x591b1f28], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x5910ce2e
cmp dword [esp + 0x14], 5
jb 0x5910ce2e
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x591b1f2c], ecx
jmp 0x5910ce3a
mov edx, dword [0x591a6be8]
mov dword [0x591b1f2c], edx
mov eax, dword [esp + 0x4bc]
test eax, eax
mov eax, dword [0x591a6be8]
jne 0x5910ce4f
mov eax, dword [0x591b1f2c]
mov ecx, dword [esp + 0x4c4]
mov edx, dword [esp + 0x4c0]
push ecx
push edx
push esi
push eax
lea eax, [esp + 0xb4]
push str._s__s__08x__08x
push eax
call fcn.590881e0
add esp, 0x18
jmp 0x5910cf0a
test eax, eax
jne 0x5910cecf
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x591b1f28], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x5910cec5
cmp dword [esp + 0x14], 5
jb 0x5910cec5
mov edx, dword [str.GlobalOCULAR_]
mov dword [0x591b1f2c], edx
jmp 0x5910cecf
mov eax, dword [0x591a6be8]
mov dword [0x591b1f2c], eax
mov eax, dword [esp + 0x4bc]
test eax, eax
mov eax, dword [0x591a6be8]
jne 0x5910cee4
mov eax, dword [0x591b1f2c]
mov ecx, dword [esp + 0x4c4]
mov edx, dword [esp + 0x4c0]
push ecx
push edx
push eax
lea eax, [esp + 0xb0]
push str._s___08x__08x
push eax
call fcn.590881e0
add esp, 0x14
lea ecx, [esp + 0xa4]
push ecx
lea ecx, [esp + 0xc]
call fcn.590a0590
mov esi, dword [esp + 0x4b4]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x4b0], 1
call fcn.590a0490
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x4ac], 0
call fcn.590a0ec0
mov ecx, dword [esp + 0x4a4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x4a8
ret
Function at 0x59110b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5915b57f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov ecx, dword [0x59162880]
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov ecx, 9
lea edi, [esp + 0x16]
mov ebx, dword [esp + 0x50]
mov word [esp + 0x14], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, ebx
lea edx, [esp + 0x14]
push 0xa
push edx
shr eax, 0x18
push eax
mov dword [esp + 0x50], 1
call fcn.59132a98
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.590a6e90
push 0x5918d814
lea ecx, [esp + 0x10]
call fcn.590a6e90
xor edx, edx
lea ecx, [esp + 0x14]
mov dl, byte [esp + 0x52]
push 0xa
push ecx
push edx
call fcn.59132a98
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.590a6e90
push 0x5918d814
lea ecx, [esp + 0x10]
call fcn.590a6e90
xor ecx, ecx
lea eax, [esp + 0x14]
push 0xa
mov cl, bh
push eax
push ecx
call fcn.59132a98
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.590a6e90
push 0x5918d814
lea ecx, [esp + 0x10]
call fcn.590a6e90
lea edx, [esp + 0x14]
push 0xa
and ebx, 0xff
push edx
push ebx
call fcn.59132a98
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.590a6e90
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.590a5840
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 0
call fcn.590a6240
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret

Function at 0x59113170
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5915b97b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x59169890]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.59122390
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.59124670
mov ecx, dword [eax]
push 0x591900ec
push ecx
call fcn.590889fc
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.591220b0
test edi, edi
je 0x59113210
push 0x591900ec
mov ecx, esi
call fcn.59122cf0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x59113350
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5915b9bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x59169890]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.59122390
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.59124670
mov ecx, dword [eax]
push 0x591900ec
push ecx
call fcn.590889fc
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.591220b0
test edi, edi
je 0x591133f0
push 0x591900ec
mov ecx, esi
call fcn.59122cf0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x591205a0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x591205f9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x591205f9
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x59120600
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x591205dd
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x591205fb
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x591260d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x59126120
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x59126120
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x59126125
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x5912610b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x59126132
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x59135840
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x59135926
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x591358b3
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x5913590a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x591358c6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x591358f6
mov ebx, 0x3d
jmp 0x59135904
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x5913585a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x59135d00
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.5908a310
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x59135d2b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x59135d3d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x59135ea9
push esi
call fcn.59137eb0
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x59135d73
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.590dfa70
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x59135db2
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.590ddb20
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.590ddc90
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.590ddd90
add esp, 0x24
jmp 0x59135df1
test ebp, ebp
jl 0x59135dbe
cmp ebp, 0x80
jle 0x59135dd2
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.590dfa70
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x59135e16
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x59135e1f
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.590ddb20
push esi
call fcn.59137eb0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.590ddc90
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x59135e5b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.590ddb20
push esi
call fcn.59137eb0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.590ddc90
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.590dde40
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x59135e8e
jmp 0x59135e1d
Function at 0x591366c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.5908a310
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x59136814
cmp ebx, 0x80
jg 0x59136814
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.59136fd0
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x59136757
test ebp, ebp
jle 0x591367a5
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x59136744
jmp 0x591367a1
xor esi, esi
test ebp, ebp
jle 0x591367a5
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x59136787
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x59136783
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x591367b4
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x591367e5
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x591367fc
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x591367f8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x20d17a8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x20d17b2
pushal
call 0x20d17b8
pop ebp
sub ebp, 0x10
sub ebp, 0x1cd17a8
jmp 0x20d17ce
mov eax, 0x1cd17a8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
mov edx, 0xdbc4c6cb
xor byte [eax], dl
inc eax
dec ecx
jne 0x20d17e5
jmp 0x20d17f8
inc eax
push es
inc eax
inc edx
test ebx, 0xa4acbcb
xor ecx, ebx
retf
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1e2850fc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3f206198
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x23a6755a
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x336a0fff
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x44aab0
Capabilities:
Get geographical location

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x24]
mov dword [esp], str.Name
mov ebx, dword [esp + 0x20]
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
je 0x44aae7
mov dword [esp], str.CommonName
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
jne 0x44ab00
mov dword [esp], str.X520.CommonName
mov ecx, ebx
call fcn.0042ca80
sub esp, 4
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp], str.SerialNumber
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
je 0x44ab83
mov dword [esp], 0x663854
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
je 0x44abc0
mov dword [esp], str.Organization
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
je 0x44aba0
mov dword [esp], str.Organizational_Unit
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
je 0x44ab6d
mov dword [esp], str.OrgUnit
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
jne 0x44abd6
mov dword [esp], str.X520.OrganizationalUnit
mov ecx, ebx
call fcn.0042ca80
sub esp, 4
jmp 0x44aaf8
mov dword [esp], str.X520.SerialNumber
mov ecx, ebx
call fcn.0042ca80
sub esp, 4
jmp 0x44aaf8
mov dword [esp], str.X520.Organization
mov ecx, ebx
call fcn.0042ca80
sub esp, 4
jmp 0x44aaf8
mov dword [esp], str.X520.Country
mov ecx, ebx
call fcn.0042ca80
sub esp, 4
jmp 0x44aaf8
mov dword [esp], str.Locality
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
je 0x44ac2b
mov dword [esp], str.State
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
je 0x44ac15
mov dword [esp], str.Province
mov ecx, esi
call fcn.005ae020
sub esp, 4
test eax, eax
jne 0x44ac41
mov dword [esp], str.X520.State
mov ecx, ebx
call fcn.0042ca80
sub esp, 4
jmp 0x44aaf8
mov dword [esp], str.X520.Locality
mov ecx, ebx
call fcn.0042ca80
sub esp, 4
jmp 0x44aaf8
mov ecx, esi
mov dword [esp], 0x6638e2
call fcn.005ae020
test eax, eax
push ecx
je 0x44ac75
lea eax, [ebx + 8]
mov ecx, ebx
mov dword [ebx], eax
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp], eax
add edx, eax
mov dword [esp + 4], edx
call fcn.0042c9d0
push eax
push eax
jmp 0x44aaf8
mov dword [esp], str.RFC822
mov ecx, ebx
call fcn.0042ca80
push edx
jmp 0x44aaf8
Function at 0x44ae00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x28
mov ebp, dword [ecx + 0x14]
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], ecx
nop
lea esi, [esi]
mov eax, ebx
xor edx, edx
div esi
lea eax, [ebx + 3]
movzx ecx, byte [edi + edx]
xor edx, edx
div esi
shl ecx, 0x18
movzx eax, byte [edi + edx]
xor edx, edx
or ecx, eax
lea eax, [ebx + 1]
div esi
movzx eax, byte [edi + edx]
xor edx, edx
shl eax, 0x10
or ecx, eax
lea eax, [ebx + 2]
div esi
movzx eax, byte [edi + edx]
shl eax, 8
or ecx, eax
xor dword [ebp + ebx], ecx
add ebx, 4
cmp ebx, 0x48
jne 0x44ae20
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
lea esi, [esp + 0x24]
lea ebx, [esp + 0x20]
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], eax
lea eax, [edi + 0x14]
mov ecx, edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0044ac90
sub esp, 0x14
mov ecx, edi
mov eax, dword [esp + 0x44]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
lea eax, [edi + 4]
mov dword [esp], eax
call fcn.0044ac90
sub esp, 0x14
add esp, 0x28
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x44afb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
mov ebp, dword [esp + 0x28]
lea eax, [ebp + 0x10]
mov dword [esp], eax
mov eax, dword [ebp]
mov dword [esp + 0x10], 0
mov edx, 2
xor esi, esi
bswap eax
mov dword [esp + 0xc], eax
xor ecx, ecx
mov edi, 0x80808081
movzx eax, byte [esp + ecx + 0xc]
test al, al
je 0x44b018
test dl, dl
je 0x44b018
movzx ebx, byte [eax + 0x67e0a0]
movzx eax, byte [edx + 0x67e0a0]
add ebx, eax
mov eax, ebx
mul edi
shr edx, 7
mov eax, edx
shl eax, 8
sub eax, edx
sub ebx, eax
movzx eax, byte [ebx + 0x67dfa0]
xor byte [esp + esi + 0x10], al
add ecx, 1
cmp ecx, 4
je 0x44b040
movzx eax, byte [esp + ecx + 0xc]
movzx edx, byte [esi + ecx*4 + 0x67bf80]
test al, al
jne 0x44afe9
add ecx, 1
cmp ecx, 4
jne 0x44b020
lea esi, [esi]
add esi, 1
cmp esi, 4
je 0x44b051
movzx edx, byte [esi + 0x67bf80]
jmp 0x44afd9
mov eax, dword [esp + 0x10]
add ebp, 4
bswap eax
mov dword [ebp - 4], eax
cmp dword [esp], ebp
jne 0x44afc1
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret