joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c76b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ecx + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc]
push ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
add eax, 8
shr edx, 4
mov ebx, dword [ebp - 4]
xor dword [eax], ebx
mov ebx, dword [ebp - 8]
xor dword [eax + 4], ebx
mov ebx, dword [ebp - 4]
xor dword [eax + 0x20], ebx
mov ebx, dword [ebp - 8]
xor dword [eax - 8], esi
xor dword [eax - 4], edi
xor dword [eax + 0x18], esi
xor dword [eax + 0x1c], edi
xor dword [eax + 0x24], ebx
add eax, 0x40
dec edx
jne 0x44c792
mov ebx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x1c]
add ebx, 0xfffffff4
cmp ebx, 4
jb 0x44c7fb
mov eax, dword [ebp + 8]
add ebx, 0xc
add eax, 0x18
shr ebx, 4
xor dword [eax - 8], edx
xor dword [eax - 4], esi
xor dword [eax], edi
xor dword [eax + 4], ecx
xor dword [eax + 0x18], edx
xor dword [eax + 0x1c], esi
xor dword [eax + 0x20], edi
xor dword [eax + 0x24], ecx
add eax, 0x40
dec ebx
jne 0x44c7de
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x44cd15
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jbe 0x44cd33
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x44cd2a
pop esi
pop ebp
ret 0xc
Function at 0x44cd7d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0x28]
sub al, 2
push ebx
mov ebx, dword [ebp + 0x10]
and al, 0xfe
mov cl, 0xe
shl al, 2
sub cl, bl
push esi
mov esi, dword [ebp + 0xc]
or al, cl
cmp dword [ebp + 0x18], 0
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0x14], al
jbe 0x44cdbf
or al, 0x40
mov byte [ebp - 0x14], al
push ebx
lea eax, [ebp - 0x13]
push esi
push eax
call fcn.004446f0
mov ecx, dword [ebp + 0x20]
add esp, 0xc
push 0xf
pop eax
cmp ebx, eax
jae 0x44cde3
mov byte [ebp + eax - 0x14], cl
shr ecx, 8
dec eax
cmp eax, ebx
ja 0x44cdd7
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00454d80
mov edx, dword [ebp + 0x18]
test edx, edx
jbe 0x44ce57
xor ecx, ecx
push 2
pop esi
cmp edx, 0xff00
jb 0x44ce10
not byte [ebp - 0x14]
xor byte [ebp - 0x13], 0xfe
push 4
mov ecx, esi
pop esi
lea eax, [esi - 1]
test eax, eax
jl 0x44ce24
lea ebx, [ebp + ecx - 0x14]
xor byte [ebx + eax], dl
shr edx, 8
dec eax
jns 0x44ce1b
add ecx, esi
mov esi, dword [ebp + 0x14]
cmp ecx, 0x10
jne 0x44ce3d
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00454d80
xor ecx, ecx
mov al, byte [esi]
xor byte [ebp + ecx - 0x14], al
inc ecx
inc esi
dec dword [ebp + 0x18]
jne 0x44ce29
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00454d80
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
cmp ebx, 0x10
jb 0x44ce93
shr ebx, 4
mov eax, dword [esi]
xor dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
xor dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
xor dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
xor dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00454d80
sub dword [ebp + 0x20], 0x10
add esi, 0x10
dec ebx
jne 0x44ce65
cmp dword [ebp + 0x20], 0
jbe 0x44ceb3
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0044cd15
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, edi
call fcn.00454d80
push dword [ebp + 0x28]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call fcn.004446f0
add esp, 0xc
push 0x10
pop ecx
pop edi
pop esi
lea eax, [ebp - 0x14]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x44cece
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044341a
leave
ret 0x24

Function at 0x44d1bb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
not eax
cmp dword [ebp + 0x10], ecx
jbe 0x44d1eb
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461930]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x44d1cc
not eax
pop ebp
ret 0xc
Function at 0x4511cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], edx
mov edx, dword [ebx]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 8]
push esi
and dl, 8
movsx esi, dl
neg esi
sbb esi, esi
dec dword [edi]
mov dword [ebp - 0x1c], eax
movzx eax, word [eax]
push ecx
push eax
mov dword [ebp - 0x20], ecx
call fcn.00451183
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
and dword [ebp - 0x14], 0x10
pop ecx
pop ecx
jne 0x45121b
dec dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
and dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
je 0x451236
mov eax, dword [ebp + 0x14]
dec dword [ebp + 0x14]
test eax, eax
je 0x451349
push dword [ebp - 0x20]
inc dword [edi]
call fcn.00451d05
pop ecx
mov ecx, dword [ebp - 0x1c]
mov edx, 0xffff
mov word [ebp - 0x2c], ax
mov word [ecx], ax
cmp dx, ax
je 0x451339
cmp dword [ebp - 0x14], 0
jne 0x4512b8
test byte [ebp + 8], 0x20
je 0x451277
cmp ax, 9
jb 0x451271
cmp ax, 0xd
jbe 0x451277
cmp ax, 0x20
jne 0x4512b8
test byte [ebp + 8], 0x40
je 0x451339
mov dx, ax
shr dx, 3
movzx edx, dx
cmp ax, dx
jb 0x451339
mov ecx, eax
and ecx, 7
xor eax, eax
inc eax
shl eax, cl
movzx ecx, dx
mov edx, dword [ebp + 0xc]
movsx ecx, byte [ecx + edx]
xor ecx, esi
test ecx, eax
mov ecx, dword [ebp - 0x1c]
je 0x451339
mov eax, dword [ebp - 0x2c]
test byte [ebp + 8], 4
jne 0x451330
cmp dword [ebp + 0x18], 0
je 0x451370
test byte [ebp + 8], 2
je 0x4512de
mov ecx, dword [ebx]
mov word [ecx], ax
add dword [ebx], 2
dec dword [ebp + 0x18]
jmp 0x451222
mov edx, dword [ebp + 0x18]
mov cl, byte [ecx]
cmp edx, dword [0x46c2d4]
jb 0x4512f6
mov eax, dword [ebx]
mov byte [eax], cl
mov eax, dword [ebx]
movsx eax, byte [eax]
jmp 0x45131e
movsx eax, cl
mov byte [ebp - 0xc], cl
mov dword [ebp - 0x28], eax
test eax, eax
jle 0x451307
cmp eax, edx
ja 0x451370
cmp eax, 5
ja 0x451370
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebx]
call fcn.00450cc0
mov eax, dword [ebp - 0x28]
add esp, 0xc
test eax, eax
jle 0x451222
add dword [ebx], eax
sub dword [ebp + 0x18], eax
jmp 0x451222
add dword [ebp - 0x10], 2
jmp 0x451222
dec dword [edi]
movzx eax, word [ecx]
push dword [ebp - 0x20]
push eax
call fcn.00451183
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
je 0x45137e
test byte [ebp + 8], 4
jne 0x451399
mov eax, dword [ebp - 0x24]
inc dword [eax]
cmp dword [ebp - 0x14], 0
jne 0x451399
test byte [ebp + 8], 2
mov eax, dword [ebx]
je 0x451396
xor ecx, ecx
mov word [eax], cx
jmp 0x451399
test byte [ebp + 8], 2
je 0x45138e
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ecx], ax
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044341a
leave
ret
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
jmp 0x45137e
mov byte [eax], 0
xor eax, eax
jmp 0x451381
Function at 0x4525cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46c660]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
push esi
push edi
mov dword [ebp - 0x1c], 0x30303030
mov word [ebp - 0x18], ax
mov eax, dword [0x48e97c]
lea ecx, [eax + 0x438]
push eax
xor edi, edi
mov dword [ebp + 0xc], ecx
call fcn.00452c5e
movzx esi, word [ebx]
movzx eax, si
push eax
push dword [ebx + 4]
call fcn.004523e6
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45262e
movzx edi, word [eax]
push edi
push dword [eax + 4]
call fcn.004523e6
add dword [ebp - 0x10], eax
mov eax, dword [0x48ea40]
mov dword [ebp - 0x14], eax
mov eax, dword [0x48e97c]
add esi, edi
inc dword [0x48ea40]
mov dword [eax + 0x438], 0
mov edi, dword [0x48e97c]
mov word [ebp - 0x16], si
add edi, 0x43c
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx eax, word [ebx]
push eax
mov eax, dword [0x48e97c]
push dword [ebx + 4]
add eax, 0x450
push eax
call fcn.00450cc0
mov edi, dword [ebp + 0x10]
movzx esi, word [ebx]
add esp, 0xc
test edi, edi
je 0x4526a9
movzx eax, word [edi]
push eax
mov eax, dword [0x48e97c]
push dword [edi + 4]
lea eax, [eax + esi + 0x450]
push eax
call fcn.00450cc0
movzx eax, word [edi]
add esp, 0xc
add esi, eax
mov eax, dword [0x48e97c]
mov dword [eax + 0x44c], esi
mov eax, dword [0x48e97c]
mov dword [eax + 0x438], 0x103
rdtsc
push 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call fcn.0043f558
rdtsc
mov esi, eax
sub eax, dword [ebp - 0xc]
mov edi, edx
push 0
mov ecx, edi
sbb ecx, dword [ebp - 8]
push 0x3d090
push ecx
push eax
call fcn.00445a30
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push dword [0x48e97c]
call fcn.00452c5e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x452793
rdtsc
sub eax, esi
sbb edx, edi
cmp edx, dword [ebp - 8]
jb 0x4526f4
ja 0x45271e
cmp eax, dword [ebp - 0xc]
jb 0x4526f4
cmp dword [ebp - 4], 0
jne 0x452785
cmp dword [ebp + 8], 3
jne 0x45275b
mov eax, dword [ebx + 4]
cmp dword [eax], 0x3230
jne 0x452785
inc dword [0x48ea4c]
mov eax, dword [0x48e97c]
mov dword [0x48e950], 1
mov dword [eax + 0x438], 0
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 8], 0xb
jne 0x452774
mov eax, dword [ebx + 4]
cmp dword [eax], 0x3430
jne 0x452785
inc dword [0x48e980]
jmp 0x45273b
cmp dword [ebp + 8], 9
jne 0x452785
mov eax, dword [ebx + 4]
cmp dword [eax], 0x3330
je 0x4527b4
dec dword [ebp - 4]
inc dword [0x48e978]
jmp 0x4525f0
inc dword [0x48e974]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, dword [0x46c660]
jbe 0x4527ab
mov dword [0x46c660], eax
and dword [0x48e950], 0
jmp 0x452754
inc dword [0x48ea44]
jmp 0x45273b
Function at 0x4527e3
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push 0x1c
pop ecx
push esi
mov edx, dword [ebp + 8]
shr edx, cl
mov esi, eax
sar esi, 0xc
xor edx, esi
and edx, 0xf
mov esi, edx
shl esi, 7
xor esi, edx
add esi, esi
xor esi, eax
shl esi, 4
xor esi, edx
sub ecx, 4
mov eax, esi
jns 0x4527ef
and eax, 0xffff
pop esi
pop ebp
ret 8

Function at 0x452cf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
rdtsc
push ebx
mov ebx, dword [ebp + 8]
push esi
xor ecx, ecx
push edi
inc ecx
push ecx
mov dword [ebp - 4], ecx
mov dword [ebp + 8], 2
mov esi, eax
mov edi, edx
call fcn.0043f558
rdtsc
push 0
mov dword [ebp - 0xc], eax
sub eax, esi
mov dword [ebp - 8], edx
push 0x7a120
sbb edx, edi
push edx
push eax
call fcn.00445a30
mov edi, eax
mov esi, edx
push dword [0x48e97c]
call fcn.00452c5e
mov eax, dword [ebx + 0x13f0]
cmp eax, 0x103
je 0x452db5
cmp byte [ebp + 0x18], 0
je 0x452d73
rdtsc
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
cmp edx, esi
ja 0x452d6c
jb 0x452d3c
cmp eax, edi
jb 0x452d3c
mov dword [ebp + 8], 1
and dword [ebp - 4], 0
xor eax, eax
cmp dword [0x48e968], eax
je 0x452d9b
mov ecx, dword [ebx + 0x438]
cmp ecx, 0x103
jne 0x452d9b
mov dword [ebx + 0x438], eax
inc dword [0x48ea38]
mov dword [0x48e968], eax
cmp dword [ebp - 4], eax
je 0x452dab
mov dword [ebx + 0x13f0], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x14
and dword [0x48e950], 0
inc dword [0x48e964]
mov edi, dword [ebp + 0xc]
lea esi, [ebx + 0x13f8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0x13f4], 0x10
jb 0x452d77
mov esi, dword [ebp + 0x10]
and dword [ebp + 8], 0
test esi, esi
je 0x452d77
movzx eax, word [esi + 2]
push eax
lea eax, [ebx + 0x1408]
push eax
push dword [esi + 4]
call fcn.00450cc0
movzx ecx, word [esi + 2]
mov eax, dword [ebx + 0x13f4]
lea edx, [ecx + 0x10]
movzx edx, dx
add esp, 0xc
cmp eax, edx
jbe 0x452d77
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x452d77
movzx ecx, cx
mov edi, eax
sub edi, ecx
movzx ecx, word [edx + 2]
sub edi, 0x10
cmp ecx, edi
jb 0x452d77
movzx ecx, word [esi + 2]
sub eax, ecx
sub eax, 0x10
push eax
lea eax, [ecx + ebx + 0x1408]
push eax
push dword [edx + 4]
call fcn.00450cc0
add esp, 0xc
jmp 0x452d77

Function at 0x454000
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x454c40
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x46ce7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
mov dword [ebp - 0x50], eax
cmp edi, 8
ja 0x454c75
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.00450c60
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.00455ae0
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.00454b30
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.00455ae0
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov eax, 0x40
add esi, 0x28
mov byte [esi], 0
inc esi
sub eax, 1
jne 0x454d16
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044341a
mov esp, ebp
pop ebp
ret 8
Function at 0x455870
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x46cec4], 0
push ebx
jne 0x4558ed
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x4558e1
cmp dword [ebp - 8], 0x660
jae 0x4558e1
xor eax, eax
mov eax, dword [eax*4 + 0x46c604]
mov dword [0x46cec4], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x457910
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4

Function at 0x457b00
Capabilities:
Hash data using sha224

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
pop ebp
ret 4

Function at 0x457b90
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
pop ebp
ret 4
Function at 0x45f03a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4]
inc ecx
cmp ecx, 0x7f
jb 0x45f043
cmp eax, 0xffffffff
jne 0x45f057
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x45f05c
inc eax
pop ebp
ret 4
Function at 0x409468
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406978
xor eax, eax
push ebp
push 0x409528
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407264
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407414
mov eax, dword [ebx]
call fcn.00409330
test al, al
jne 0x409505
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407264
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407414
mov eax, dword [ebx]
call fcn.00409330
test al, al
jne 0x409505
mov eax, ebx
call fcn.00406894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40952f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004068f4
lea eax, [ebp - 4]
call fcn.00406894
ret

Function at 0x409e14
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x41a8a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41a8fd
test eax, edx
je 0x41a900
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41a8bb
movzx eax, word [eax]
sub eax, ecx
jmp 0x41a8e2
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41a8e3
add ecx, 4
js 0x41a8d3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41a8e0
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41a8e2
xor eax, eax
ret
test eax, eax
je 0x41a90c
test edx, edx
jne 0x41a8ac
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41e894
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41e8cd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004069fc
jmp 0x41e8d6
mov eax, ebx
mov edx, esi
call fcn.00406c54
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41e8e0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41e902
movzx eax, word [esp]
jmp 0x41e904
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41f5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41f6e5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041f3d0
mov esi, eax
mov eax, dword [0x4b71c4]
cmp byte [eax], 0
je 0x41f68d
mov eax, dword [0x4b6f8c]
call fcn.0040480c
call fcn.004044cc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41f598]
call fcn.00408304
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41f700
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41f6c9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4b6f24]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4bac34]
call fcn.004083f8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f6ec
lea eax, [ebp - 4]
mov edx, dword [0x41f598]
call fcn.00408310
ret

Function at 0x420724
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4207fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406c9c
lea eax, [ebp - 4]
call fcn.00406e04
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004071d8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4207e4
mov eax, ebx
call fcn.00404350
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4207dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004071d8
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4207c7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42080c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4207c7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4207e4
mov eax, dword [ebp - 0x10]
call fcn.0040436c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420801
lea eax, [ebp - 4]
call fcn.00406894
ret