joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8bc9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ja case.0x4e89c5.1
jmp dword [edi*4 + 0x4e8d64]
cmp cl, 8
cmp cl, 8
jne 0x4e8ad0
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x2c]
cmp cl, 8
jne 0x4e8b79
mov edx, dword [esp + 0x2c]
test eax, eax
je case.0x4e89c5.1
nop
movzx ecx, byte [edx]
lea edx, [edx + 2]
mov cl, byte [ecx + esi]
mov byte [edx - 2], cl
sub eax, 1
jne 0x4e8b60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, dword [esp + 0x2c]
test eax, eax
je case.0x4e89c5.1
movzx ebx, bl
nop dword [eax + eax]
movzx esi, byte [edi + 1]
lea edi, [edi + 4]
movzx edx, byte [edi - 4]
mov cl, bl
shr esi, cl
mov ecx, dword [ebp + esi*4]
movzx edx, word [ecx + edx*2]
mov ecx, edx
mov byte [edi - 3], dl
shr ecx, 8
mov byte [edi - 4], cl
sub eax, 1
jne 0x4e8b90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x2c]
cmp cl, 2
stc
add cl, byte [edi]
test esp, edx
add byte [eax], al
invalid
mov edi, ebx
mov dword [esp + 0x30], edi

Function at 0x4ef48f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 0xe1c1d033
push cs
xor ecx, eax
enter 0xffffffffffffeac1, 6
mov eax, dword [esp + 0x48]
xor eax, dword [esp + 0x44]
and eax, dword [esp + 0x4c]
xor eax, dword [esp + 0x48]
shl ecx, 7
xor edx, ecx
mov ecx, esi
add edx, dword [esp + 0x50]
add eax, edx
shr ecx, 9
or dword [ebp + 0x7aa9893], ecx
fdiv dword [ebx]
into
add edx, eax
mov ebx, dword [esp + 0x38]
mov eax, esi
invalid

Function at 0x4f0635
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x30]
mov edx, ecx
mov eax, esi
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x20]
add eax, ecx
rol dword [ebx + 0x16c246c], 0x89
inc esp
and al, 0x24
jne 0x4ef954
mov ecx, dword [esp + 0x7c]
add eax, dword [esp + 0x74]
je fcn.004f065a
jns 0x4f066f
add dword [ecx + 0x10], esi

Function at 0x4f09e7
Capabilities:
Hash data using sha512

Disassembly:
mov edi, edx
shrd edi, ebx, 0x17
mov dword [esp + 0x10c], eax
mov eax, edx
shr ebx, 0x17
xor edi, edx
xor ebx, ecx
shrd edi, ebx, 4
shr ebx, 4
add al, 0x33
cli
xor ebx, ecx
shld ecx, eax, 4
shrd edi, ebx, 0xe
lodsb al, byte [esi]
fisttp word [esi]
xor ecx, dword [esp + 0xa4]
shl eax, 4
xor eax, edx
shr ebx, 0xe
jmp 0x4f09f7
shld ecx, eax, 0x17
xor ecx, dword [esp + 0xa4]
shl eax, 0x17
xor eax, edx
shld ecx, eax, 0x17

Function at 0x4f0c57
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and ecx, dword [esp + 0x4c]
shl eax, 0x19
xor esi, ecx
xor dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
and eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
xor edx, eax
mov eax, dword [esp + 0x2c]
inc esp
and al, 0x2c
add eax, esi
adc ecx, edx

Function at 0x4f0fb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shld ecx, eax, 0x17
shrd edi, ebx, 0xe
fisttp word [esi]
shl eax, 0x17
shr ebx, 0xe
xor edi, eax
mov eax, dword [esp + 0x8c]
xor ebx, ecx
mov ecx, dword [esp + 0x90]
xor ecx, dword [esp + 0x94]
xor eax, dword [esp + 0x80]
and ecx, edx
xor ecx, dword [esp + 0x90]
and eax, esi
xor eax, dword [esp + 0x8c]
add edi, ecx
Function at 0x4f11c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, eax
shr esi, 5
xor esi, ecx
shrd edx, esi, 6
xor edx, eax
shr esi, 6
xor esi, ecx
shld ecx, eax, 6
shrd edx, esi, 0x1c
xor ecx, dword [esp + 0x44]
shl eax, 6
xor eax, dword [esp + 0x68]
shld ecx, eax, 5
shr esi, 0x1c
sbb al, 0x33
dec esp
and al, 0x44
shl eax, 5
xor eax, dword [esp + 0x68]
shld ecx, eax, 0x19
xor esi, ecx
int1
shl eax, 0x19
mov ecx, dword [esp + 0x50]
xor edx, eax
and ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x58]
and eax, dword [esp + 0x44]
mov dword [esp + 0x80], esi
mov esi, dword [esp + 0x50]
xor esi, dword [esp + 0x68]
and esi, dword [esp + 0x40]
mov dword [esp + 0x90], edx
xor esi, ecx
mov edx, dword [esp + 0x58]
xor edx, dword [esp + 0x44]
and edx, dword [esp + 0x70]
and al, 0x70
xor edx, eax
add dword [esp + 0x90], esi
add byte [eax], al
add byte [ebx + 0x802484], cl
add byte [eax], al
mov esi, dword [esp + 0x90]
adc eax, edx
add esi, edi
adc eax, ebx
mov dword [esp + 0x90], esi
mov dword [esp + 0x80], eax
test byte [eax + eax*4], ah
add byte [eax], al
add byte [ebx + 0x1602484], cl
add byte [eax], al
push dword [eax + 0x34]
push dword [eax + 0x30]
call 0x5e0ccb
mov ecx, dword [esp + 0x50]
mov ebx, ecx
mov dword [esp + 0x9c], edx
xchg esp, eax
and al, 0x9c
add byte [eax], al
add byte [ebx - 0x74abdbac], cl
cli
shrd edi, ebx, 0x17
mov dword [esp + 0xe0], eax
mov eax, edx
shr ebx, 0x17
xor edi, edx

Function at 0x4f1215
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, eax
shr esi, 5
xor esi, ecx
shrd edx, esi, 6
xor edx, eax
shr esi, 6
xor esi, ecx
shld ecx, eax, 6
shrd edx, esi, 0x1c
xor ecx, dword [esp + 0x44]
shl eax, 6
xor eax, dword [esp + 0x68]
shld ecx, eax, 5
shr esi, 0x1c
sbb al, 0x33
dec esp
and al, 0x44
shl eax, 5
xor eax, dword [esp + 0x68]
shld ecx, eax, 0x19
xor esi, ecx
int1
shl eax, 0x19
mov ecx, dword [esp + 0x50]
xor edx, eax
and ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x58]
and eax, dword [esp + 0x44]
mov dword [esp + 0x80], esi
mov esi, dword [esp + 0x50]
xor esi, dword [esp + 0x68]
and esi, dword [esp + 0x40]
mov dword [esp + 0x90], edx
xor esi, ecx
mov edx, dword [esp + 0x58]
xor edx, dword [esp + 0x44]
and edx, dword [esp + 0x70]
and al, 0x70
xor edx, eax
add dword [esp + 0x90], esi
add byte [eax], al
add byte [ebx + 0x802484], cl
add byte [eax], al
mov esi, dword [esp + 0x90]
adc eax, edx
add esi, edi
adc eax, ebx
mov dword [esp + 0x90], esi
mov dword [esp + 0x80], eax
test byte [eax + eax*4], ah
add byte [eax], al
add byte [ebx + 0x1602484], cl
add byte [eax], al
push dword [eax + 0x34]
push dword [eax + 0x30]
call 0x5e0ccb
mov ecx, dword [esp + 0x50]
mov ebx, ecx
mov dword [esp + 0x9c], edx
xchg esp, eax
and al, 0x9c
add byte [eax], al
add byte [ebx - 0x74abdbac], cl
cli
shrd edi, ebx, 0x17
mov dword [esp + 0xe0], eax
mov eax, edx
shr ebx, 0x17
xor edi, edx

Function at 0x4f167c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shl eax, 4
xor ebx, esi
xor eax, edx
xor ecx, esi
shrd edi, ebx, 0xe
shld ecx, eax, 0x17
shr ebx, 0xe
shl eax, 0x17
xor ecx, esi
xor eax, edx
shld ecx, eax, 0x17
xor ebx, ecx
Function at 0x4f1bd3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr esi, 0x1c
shl eax, 6
xor ecx, edx
xor eax, dword [esp + 0x58]
shld ecx, eax, 5
rol dword [0x3305e0c1], 0xca
xor eax, dword [esp + 0x58]
shld ecx, eax, 0x19
xor esi, ecx
shl eax, 0x19
xor dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x4c]
and al, 0x4c
mov edx, eax
and eax, dword [esp + 0x48]
xor edx, dword [esp + 0x48]
and edx, dword [esp + 0x64]
mov dword [esp + 0x3c], esi
xor edx, eax
mov eax, dword [esp + 0x3c]
mov esi, ecx
xor esi, dword [esp + 0x58]
and ecx, dword [esp + 0x58]
and esi, dword [esp + 0x74]
je 0x4f1b9d
int1
mov ecx, dword [esp + 0x5c]
add ecx, esi
adc eax, edx
add ecx, edi
mov dword [esp + 0x5c], ecx
and al, 0x5c
adc eax, ebx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x158]
push dword [eax + 0x6c]
push dword [eax + 0x68]
call 0x5e1610
mov esi, dword [esp + 0x78]
mov edi, esi
mov dword [esp + 0xb4], eax
mov eax, esi
mov dword [esp + 0xb8], edx
mov edx, dword [esp + 0x74]
mov ebx, edx
shrd edi, ebx, 0x17
mov ecx, edx
shr ebx, 0x17
xor edi, esi
shld ecx, eax, 4
xor ebx, edx
shrd edi, ebx, 4
shl eax, 4
xor ecx, edx
shr ebx, 4
xor eax, esi
xor ebx, edx
xor edi, esi
shld ecx, eax, 0x17
pop ss
shrd edi, ebx, 0xe
shl eax, 0x17
shr ebx, 0xe
xor eax, esi
xor ecx, edx
shld ecx, eax, 0x17
xor ebx, ecx
shl eax, 0x17
mov ecx, dword [esp + 0x88]
xor edi, eax
mov eax, dword [esp + 0x84]
xor ecx, ebp
xor eax, dword [esp + 0x8c]
and ecx, esi
xor ecx, dword [esp + 0x88]
and eax, edx
xor eax, dword [esp + 0x84]
add edi, ecx
mov edx, dword [esp + 0x44]
mov esi, edx
adc ebx, eax
add edi, dword [esp + 0xb4]
mov eax, dword [esp + 0x64]
mov ecx, eax
adc ebx, dword [esp + 0xb8]
add edi, dword [esp + 0x90]

Function at 0x4f1c3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc ebx, dword [esp + 0x80]
add edi, 0x3b1696b1
adc ebx, 0x80deb1fe
add dword [esp + 0x7c], edi
adc dword [esp + 0x6c], ebx
shrd ecx, esi, 5
xor ecx, eax
shr esi, 5
xor esi, edx
shrd ecx, esi, 6
xor ecx, eax
shr esi, 6
xor esi, edx
shrd ecx, esi, 0x1c
mov dword [esp + 0x40], ecx
mov ecx, edx
shld ecx, eax, 6
shr esi, 0x1c
Function at 0x4f25f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shld ecx, eax, 4
mov dword [esp + 0xb0], ebx
mov ebx, esi
shl eax, 4
xor ecx, esi
invalid

Function at 0x4f2a54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, eax
mov ecx, dword [esp + 0x38]
xor ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
and ecx, ebp
xor eax, dword [esp + 0x28]
xor ecx, dword [esp + 0x38]
and eax, edx
xor eax, dword [esp + 0x2c]
add edi, ecx
mov edx, dword [esp + 0x34]
mov ecx, esi
adc ebx, eax
mov eax, dword [esp + 0x50]
add edi, dword [eax + 0x18]
adc ebx, dword [eax + 0x1c]
mov eax, edx
add edi, dword [esp + 0xa0]
adc ebx, dword [esp + 0xa4]
pushfd
and al, 0xa4
add byte [eax], al
add byte [ebx], al
jl 0x4f2a80
adc byte [ebx], dl
pop esp
and al, 0x18

Function at 0x4f2b48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x4f2ace
ror byte [ebx - 0xd53f00f], 1
add dword [ebx], esi
rcl cl, 1
out dx, al

Function at 0x4f2b8b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [esp + 0x54]
mov ecx, esi
adc ebx, dword [esp + 0x64]
add edi, dword [esp + 0x94]

Function at 0x4f2c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fmul dword [ebx - 0x74efdb8c]
inc esp
and al, 0x50

Function at 0x4f2d1e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, eax
shr esi, 1
xor esi, ecx
shrd edx, esi, 6
xor edx, eax
shr esi, 6
xor esi, ecx
mov ecx, eax
mov eax, dword [esp + 0x90]
nop
add byte [eax], al
add byte [edi], cl
movsb byte es:[edi], byte [esi]
enter 0xf07, 0xffffffffffffffac
add ecx, eax
loope 0x4f2d4a
xor ecx, dword [esp + 0x8c]
xor edx, 0
shl ecx, 0x18
shr esi, 1
xor esi, ecx
add edi, edx
mov edx, dword [esp + 0x1c]
and al, 0x1c
mov eax, edx
adc ebx, esi
add edi, dword [esp + 0x74]
jl 0x4f2d85
je 0x4f2cee
je 0x4f2d89
and al, 0x8b
into
adc ebx, dword [esp + 0x78]
add edi, dword [esp + 0xb8]
mov dword [esp + 0x74], edi
mov edi, edx
adc ebx, dword [esp + 0xbc]
shld ecx, eax, 4
mov dword [esp + 0x78], ebx
mov ebx, esi
shrd edi, ebx, 0x17
shl eax, 4

Function at 0x4f3131
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, esi
shl eax, 4
xor eax, edx
shr ebx, 4
shld ecx, eax, 0x17
xor ebx, esi
xor edi, edx
xor ecx, esi
shl eax, 0x17
xor eax, edx
shld ecx, eax, 0x17
shrd edi, ebx, 0xe
shl eax, 0x17
pop ss
xor edi, eax
shr ebx, 0xe
mov eax, dword [esp + 0x24]
xor ebx, ecx
xor eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
and eax, esi
xor ecx, dword [esp + 0x30]
dec esp
and al, 0x30
xor eax, dword [esp + 0x24]
and ecx, edx
xor ecx, dword [esp + 0x1c]
add edi, ecx
mov edx, dword [esp + 0x44]
mov esi, edx
adc ebx, eax
mov eax, dword [esp + 0x50]
Function at 0x4f3154
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, esi
shl eax, 4
xor eax, edx
shr ebx, 4
shld ecx, eax, 0x17
xor ebx, esi
xor edi, edx
xor ecx, esi
shl eax, 0x17
xor eax, edx
shld ecx, eax, 0x17
shrd edi, ebx, 0xe
shl eax, 0x17
pop ss
xor edi, eax
shr ebx, 0xe
mov eax, dword [esp + 0x24]
xor ebx, ecx
xor eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
and eax, esi
xor ecx, dword [esp + 0x30]
dec esp
and al, 0x30
xor eax, dword [esp + 0x24]
and ecx, edx
xor ecx, dword [esp + 0x1c]
add edi, ecx
mov edx, dword [esp + 0x44]
mov esi, edx
adc ebx, eax
mov eax, dword [esp + 0x50]

Function at 0x4f3289
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, ecx
shr esi, 0xa
xor esi, eax
shrd esi, edx, 0xd

Function at 0x4f3345
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, dword [esp + 0x14]
xor ecx, dword [esp + 0x30]
and eax, esi
xor eax, dword [esp + 0x20]
add edi, ecx
mov edx, dword [esp + 0x3c]
mov esi, edx
adc ebx, eax
mov eax, dword [esp + 0x50]
add edi, dword [eax + 0x40]
adc ebx, dword [eax + 0x44]
add edi, dword [esp + 0xdc]

Function at 0x4f336e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x4c]
mov ecx, eax
adc ebx, dword [esp + 0xd8]
add edi, dword [esp + 0x1c]
adc ebx, dword [esp + 0x24]
add dword [esp + 0x58], edi
adc dword [esp + 0x2c], ebx
shrd ecx, esi, 5
xor ecx, eax
shr esi, 5
xor esi, edx
shrd ecx, esi, 6
lodsb al, byte [esi]
int1
push es
xor ecx, eax
shr esi, 6
out dx, al
push es
xor esi, edx
shrd ecx, esi, 0x1c
sbb al, 0x89
dec esp
and al, 0x1c
mov ecx, edx
shld ecx, eax, 6
shr esi, 0x1c
shl eax, 6
xor ecx, edx
xor eax, dword [esp + 0x4c]
shld ecx, eax, 5
shl eax, 5
loopne 0x4f33c7
xor ecx, edx
xor eax, dword [esp + 0x4c]
shld ecx, eax, 0x19
xor esi, ecx
shl eax, 0x19
xor dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x48]
dec esp
and al, 0x48
mov eax, dword [esp + 0x44]
mov edx, eax
xor edx, dword [esp + 0x3c]
and eax, dword [esp + 0x3c]
and edx, dword [esp + 0x28]
mov dword [esp + 0x24], esi
xor edx, eax
mov eax, dword [esp + 0x24]
mov esi, ecx
xor esi, dword [esp + 0x4c]
je 0x4f341e
dec esp
and ecx, dword [esp + 0x4c]
and esi, ebp
xor esi, ecx
mov ecx, dword [esp + 0x1c]
add ecx, esi
mov esi, dword [esp + 0xd0]
adc eax, edx

Function at 0x4f34ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edx
adc ebx, dword [esp + 0xe0]
shld ecx, eax, 4
add al, 0x89
pushfd
and al, 0xe0
add byte [eax], al
add byte [ebx - 0x2053f022], cl
pop ss
shl eax, 4
xor ecx, esi
shr ebx, 0x17
xor eax, edx
shld ecx, eax, 0x17
xor ebx, esi
fidiv word [ebx]
cli
shrd edi, ebx, 4
shl eax, 0x17
xor ecx, esi
shr ebx, 4
xor eax, edx
shld ecx, eax, 0x17
xor ebx, esi
xor edi, edx
shrd edi, ebx, 0xe
shl eax, 0x17
pop ss
shr ebx, 0xe
xor edi, eax
mov eax, dword [esp + 0x14]

Function at 0x4f3b99
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
shr ebx, 1
shl ecx, 0x18
xor edx, edx
xor ebx, ecx
xor edi, 0
mov ecx, dword [esp + 0x88]
xor edx, ecx
mov esi, ecx
invalid
out dx, al
Function at 0x50e2cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0xa8]
xor ecx, ecx
add eax, ebx
cmovns ecx, eax
mov eax, 0x40
cmp ecx, 0x40
cmovg ecx, eax
mov dword [esi + 0xa8], ecx
mov ebx, dword [esp + 0x10]
lea eax, [edi + 0xe92c]
jmp 0x50dc7e

Function at 0x50e35a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0xe92cbf], al
add byte [eax], al
lea eax, [edi + 0xe92c]
jne 0x50dc76
test dword [eax], ecx
stc
invalid
invalid
mov edx, dword [esi + 0x8c]
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
test edx, edx
je 0x50dc76
mov ecx, dword [esi + 0x24]
test ecx, 0x400000
je 0x50dc76
mov al, byte [edx + 0x22d]
test al, al
je case.0x50e21f.17
movzx eax, al
movzx eax, word [edx + eax*2 + 0x4a]
mov edx, dword [esp + 0x14]
cmp ebx, eax
mov ebx, dword [esp + 0x10]
lea eax, [edi + 0xe92c]
jmp 0x865fe3c5
mov ch, 0xf8
invalid
invalid
and ecx, 0xffbfffff
mov dword [esi + 0x24], ecx
jmp 0x61b451

Function at 0x5127bb
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ecx + 0xe948a9], cl
add byte [ebx], bh
invalid

Function at 0x51bb0d
Capabilities:
Encode data using xor

Disassembly:
movzx ebx, byte [edx]
movzx edx, byte [esi]
inc esi
mov al, byte [ebp]
mov edi, edx
mov byte [esp + 0x2c], al
inc ebp
movzx eax, al
sub edi, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], esi
mov esi, ebx
sub esi, eax
mov dword [esp + 0x14], ebx
mov eax, edi
mov dword [esp + 0x24], ebp
cdq
mov ebx, eax
mov eax, esi
xor ebx, edx
sub ebx, edx
cdq
mov ebp, eax
mov dword [esp + 0x18], ebx
xor ebp, edx
lea eax, [esi + edi]
sub ebp, edx
mov esi, ebx
cdq
mov edi, eax
mov eax, dword [esp + 0x10]
xor edi, edx
cli
cli
sub edi, edx
movzx edx, byte [esp + 0x2c]
cmp ebp, ebx
movzx ebx, al
mov eax, dword [esp + 0x14]
cmovl esi, ebp
movzx eax, al
cmp ebp, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
cmovge ebx, eax
cmp edi, esi
mov esi, dword [esp + 0x20]
movzx eax, bl
cmovge edx, eax
add byte [ecx], dl
inc ecx
mov edx, dword [esp + 0x30]
inc edx
mov dword [esp + 0x30], edx
cmp ecx, dword [esp + 0x1c]
jb 0x51bac0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x521b86
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
add byte [ebx - 0x40], ch
add ebx, ecx
push esp
and al, 0x38
fld1

Function at 0x521b91
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fst qword [esp + 0x60]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], 0xff

Function at 0x521bc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0xd4b3], cl
add byte [edi], cl
scasd eax, dword es:[edi]
out dx, al
imul edi, eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
add edi, ebp
mov ebp, edx
imul ebp, dword [esp + 0x74]
add edi, dword [ebx + 0xc8]
add ebp, dword [esp + 0x44]
add ebp, dword [esp + 0x70]
cmp eax, dword [esp + 0x28]
jge 0x522ce0
Function at 0x401120
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
push edi
mov eax, dword [esi]
mov dword [esi + 4], eax
test ecx, ecx
je 0x4011cd
mov edi, dword [ebp + 8]
test edi, edi
je 0x4011cd
push 0
push 0x80
push 3
push 0
push 5
push 0x120089
push ecx
mov dword [ebp - 8], 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4011be
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4011b7
mov eax, dword [ebp - 0x14]
cmp edi, eax
jb 0x401185
mov edi, eax
push esi
push edi
mov ecx, esi
call fcn.004018b0
mov ecx, dword [esi]
lea edx, [ebp - 8]
mov eax, dword [esi + 4]
push 0
push edx
sub eax, ecx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4011b2
mov eax, dword [esi + 4]
sub eax, dword [esi]
cmp dword [ebp - 8], eax
je 0x4011b7
mov eax, dword [esi]
mov dword [esi + 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401eb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451170
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x4020cf
xor eax, eax
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401f16
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.004013e0
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.00408460
push eax
mov ecx, edi
call fcn.004034c0
mov edx, dword [ebp - 0x64]
cmp edx, 0x10
jb 0x401f80
mov ecx, dword [ebp - 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401f76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4020ec
push edx
push ecx
call fcn.0041b677
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
cmp edx, 8
jb 0x401fd3
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401fc9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4020f1
push edx
push ecx
call fcn.0041b677
add esp, 8
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x4020cf
xor eax, eax
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
lea edx, [ecx + 2]
jmp 0x402010
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402010
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.004013e0
lea edx, [ebp - 0x60]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x90]
call fcn.00408460
push eax
mov ecx, ebx
call fcn.004034c0
mov edx, dword [ebp - 0x7c]
cmp edx, 0x10
jb 0x402080
mov ecx, dword [ebp - 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402076
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4020f6
push edx
push ecx
call fcn.0041b677
add esp, 8
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0xf
mov byte [ebp - 0x90], 0
cmp edx, 8
jb 0x4020cb
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4020c1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4020fb
push edx
push ecx
call fcn.0041b677
add esp, 8
mov al, 1
jmp 0x4020d1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b636
mov esp, ebp
pop ebp
ret
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
call fcn.00436a99
int3
Function at 0x407ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], edx
test esi, esi
je 0x407ef8
mov dword [esi], 0
test ebx, ebx
jne 0x407f04
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 8
call fcn.0041b647
add esp, 4
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
push 0
push 0
push edi
push 0x407eb0
push 0
push 0
mov dword [edi], ebx
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
setne bl
test eax, eax
je 0x407f5c
test esi, esi
je 0x407f48
pop edi
mov dword [esi], eax
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x407f67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push 8
push edi
call fcn.0041b677
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret