joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e5b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x569be0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov al, byte [esp + 0x40]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0x48]
xor ebx, ebx
mov byte [esp + 0x15], cl
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
mov byte [esp + 0x1c], bl
call fcn.0045fa00
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x2c]
mov eax, dword [edx]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x28], eax
call fcn.0045e9a0
lea edx, [esp + 0x24]
lea eax, [esp + 0xc]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x48], 1
call fcn.0045edb0
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x48]
push ecx
push edx
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], bl
call fcn.00468a30
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.0045ece0
mov edx, dword [esp + 0x2c]
push edx
call fcn.00529b40
mov eax, dword [0x5e81dc]
add esp, 4
dec eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
mov dword [0x5e81dc], eax
jne 0x45e67f
mov eax, dword [0x5e81d8]
mov dword [0x5e81d8], ebx
cmp eax, ebx
je 0x45e67f
push eax
call fcn.00529b40
add esp, 4
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x48]
push eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 0xffffffff
call fcn.00468a30
mov edx, dword [eax]
lea eax, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.0045ece0
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00529b40
mov eax, dword [0x5e81dc]
add esp, 4
dec eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [0x5e81dc], eax
jne 0x45e719
mov eax, dword [0x5e81d8]
mov dword [0x5e81d8], ebx
cmp eax, ebx
je 0x45e6ff
push eax
call fcn.00529b40
mov edx, dword [esp + 0x10]
add esp, 4
pop esi
lea eax, [edx + 0x10]
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
mov eax, dword [esp + 0xc]
pop esi
add eax, 0x10
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
lea eax, [ecx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x464580
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xcc
push eax
call fcn.00552f10
add esp, 4
test eax, eax
je 0x464731
mov eax, dword [0x5e8260]
test eax, eax
je 0x4645ad
push eax
call fcn.00535980
add esp, 4
push ebp
push esi
push edi
push 0x8cb2
call fcn.005358b0
mov esi, eax
mov ecx, 0x232c
xor eax, eax
mov edi, esi
mov dword [0x5e8260], esi
push 1
rep stosd dword es:[edi], eax
push str.city_guard
mov dword [esp + 0x18], esi
stosw word es:[edi], ax
call fcn.00552c60
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x464729
push ebx
jmp 0x4645f3
mov esi, dword [esp + 0x10]
push 0
push ebp
push 1
push str.city
call fcn.00466a60
add esp, 0x10
test eax, eax
je 0x464710
lea ecx, [eax + eax*2]
push 0x5eddd4
shl ecx, 3
sub ecx, eax
push ebp
push 1
push str.select_role
lea ecx, [ecx + ecx*2]
lea esi, [esi + ecx*2 - 0x8a]
mov word [esi], ax
call fcn.00552d20
add esp, 0x10
test eax, eax
je 0x46467b
lea edx, [esp + 0x14]
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x14]
push 8
push edx
rep stosd dword es:[edi], eax
push 0x5eddd4
call fcn.00466c40
add esp, 0xc
cmp eax, 8
jg 0x46467b
test eax, eax
jle 0x46467b
lea edx, [esp + 0x14]
lea ecx, [esi + 2]
mov di, word [edx]
add edx, 4
mov word [ecx], di
add ecx, 2
dec eax
jne 0x46466c
push 0x5eddd4
push ebp
push 1
push str.guard_data
xor ebx, ebx
call fcn.00552d20
add esp, 0x10
test eax, eax
je 0x464710
add esi, 0x14
cmp ebx, 6
jge 0x464710
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x14]
push 6
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x5eddd4
call fcn.00466c40
add esp, 0xc
cmp eax, 6
jne 0x464710
mov cx, word [esp + 0x14]
inc ebx
mov word [esi - 2], cx
mov dx, word [esp + 0x18]
mov word [esi], dx
mov eax, dword [esp + 0x1c]
mov dword [esi + 2], eax
mov ecx, dword [esp + 0x20]
mov dword [esi + 6], ecx
mov edx, dword [esp + 0x24]
mov dword [esi + 0xa], edx
mov eax, dword [esp + 0x28]
push 0x5eddd4
lea ecx, [ebx + 1]
push ebp
push ecx
mov dword [esi + 0xe], eax
push str.guard_data
add esi, 0x14
call fcn.00552d20
add esp, 0x10
test eax, eax
jne 0x464699
push ebp
push str.city_guard
call fcn.00552cc0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4645ef
pop ebx
call fcn.00553100
pop edi
pop esi
pop ebp
add esp, 0xcc
ret
Function at 0x476300
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x569e57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00482ac0
lea edi, [esi + 0x38]
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x1c], ebp
call fcn.004842c0
mov eax, 8
push ebp
mov ecx, esi
mov dword [esi], 0x56c4e8
mov dword [esi + 0x80], 0x82
mov dword [esi + 0x84], ebp
mov dword [esi + 0x78], 0x1e
mov dword [esi + 0x7c], eax
mov dword [esi + 0x90], 0x18
mov dword [esi + 0x88], 0xa0000
mov dword [esi + 0x8c], eax
call fcn.00476470
mov eax, 2
push ebp
mov dword [esi + 0x4c], 1
mov dword [esi + 0x44], 1
push 0xc
mov dword [edi + 0x30], eax
mov dword [edi + 0x38], eax
call fcn.00481680
mov ebp, eax
add esp, 8
mov dword [esp + 0x10], ebp
test ebp, ebp
mov byte [esp + 0x1c], 1
je 0x476417
push 0
push 0x28
mov dword [ebp + 4], 0xa
mov dword [ebp + 8], 0
call fcn.004817c0
mov edx, eax
add esp, 8
test edx, edx
je 0x4763f8
mov ecx, 0xa
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp], edx
mov dword [esi + 0xb4], ebp
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
xor edx, edx
mov eax, esi
mov dword [ebp], edx
mov dword [esi + 0xb4], ebp
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esi + 0xb4], eax
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4e2280
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x56a378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov cl, byte [esi + 1]
mov al, byte [esi]
mov dl, byte [esi + 8]
mov byte [esp + 0x19], cl
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
mov byte [esp + 0x20], dl
call fcn.004e24d0
push esi
lea ecx, [esp + 0x1c]
call fcn.004e23e0
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov edi, eax
mov ecx, dword [eax]
cmp ecx, eax
mov dword [esp + 0xc], ecx
je 0x4e2304
mov esi, dword [esp + 0x38]
cmp esi, ebx
je 0x4e22ef
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
push eax
push ecx
call esi
add esp, 8
lea ecx, [esp + 0xc]
call fcn.004e17e0
mov ecx, dword [esp + 0xc]
cmp ecx, edi
jne 0x4e22de
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov esi, eax
cmp edx, ebx
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esi]
mov dword [esp + 0x38], ecx
je 0x4e235d
mov edx, ecx
cmp ecx, edx
jne 0x4e235d
mov edx, dword [eax + 4]
lea ecx, [esp + 0x18]
push edx
call fcn.004e11c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x5e8f18]
lea edx, [esp + 0xc]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ebx
push edx
mov dword [eax], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
mov dword [eax + 8], eax
call fcn.00468a30
jmp 0x4e2387
cmp ecx, esi
je 0x4e238b
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x40]
call fcn.004e25e0
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.004e0df0
cmp dword [esp + 0x38], esi
jne 0x4e2361
mov eax, dword [esp + 0x1c]
push eax
call fcn.00529b40
mov eax, dword [0x5e8f14]
add esp, 4
dec eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [0x5e8f14], eax
jne 0x4e23c1
mov eax, dword [0x5e8f18]
mov dword [0x5e8f18], ebx
cmp eax, ebx
je 0x4e23c1
push eax
call fcn.00529b40
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x4f57f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56ada8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x30]
push ebx
push edi
xor edi, edi
mov dword [esp + 8], ecx
mov byte [esp + 0xc], al
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x24], edi
cmp ebx, edi
jle 0x4f5896
push ebp
mov ebp, dword [esp + 0x38]
push esi
cmp dword [ebp], 0xffffffff
je 0x4f588a
mov ecx, dword [0x56c2ec]
mov edx, dword [esp + 0x1c]
sub ecx, edx
cmp ecx, 1
ja 0x4f5852
call fcn.00534310
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x18]
lea esi, [edx + 1]
push esi
call fcn.0044c000
test al, al
je 0x4f5882
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, eax
mov byte [ecx], 0x2a
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], esi
mov byte [edx + esi], 0
inc edi
add ebp, 4
cmp edi, ebx
jl 0x4f5836
mov eax, dword [esp + 0x18]
xor edi, edi
pop esi
cmp eax, edi
pop ebp
jne 0x4f589b
mov eax, 0x56c2f0
mov ecx, dword [esp + 0x2c]
push edi
push 1
push eax
mov eax, dword [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004e0ab0
mov ecx, dword [esp + 0x10]
cmp ecx, edi
pop edi
pop ebx
je 0x4f58e7
mov al, byte [ecx - 1]
test al, al
je 0x4f58dd
cmp al, 0xff
je 0x4f58dd
dec al
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
dec ecx
push ecx
call fcn.00529b40
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10

Function at 0x4f5900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56adc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x30]
push ebx
push edi
xor edi, edi
mov dword [esp + 8], ecx
mov byte [esp + 0xc], al
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x24], edi
cmp ebx, edi
jle 0x4f59a6
push ebp
mov ebp, dword [esp + 0x38]
push esi
cmp dword [ebp], 0xffffffff
je 0x4f599a
mov ecx, dword [0x56c2ec]
mov edx, dword [esp + 0x1c]
sub ecx, edx
cmp ecx, 1
ja 0x4f5962
call fcn.00534310
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x18]
lea esi, [edx + 1]
push esi
call fcn.0044c000
test al, al
je 0x4f5992
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, eax
mov byte [ecx], 0x2a
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], esi
mov byte [edx + esi], 0
inc edi
add ebp, 4
cmp edi, ebx
jl 0x4f5946
mov eax, dword [esp + 0x18]
xor edi, edi
pop esi
cmp eax, edi
pop ebp
jne 0x4f59ab
mov eax, 0x56c2f0
mov ecx, dword [esp + 0x2c]
push edi
push 1
push eax
mov eax, dword [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004e0ab0
mov ecx, dword [esp + 0x10]
cmp ecx, edi
pop edi
pop ebx
je 0x4f59f7
mov al, byte [ecx - 1]
test al, al
je 0x4f59ed
cmp al, 0xff
je 0x4f59ed
dec al
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
dec ecx
push ecx
call fcn.00529b40
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x50c620
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x50c650
push esi
call fcn.0050cb30
mov al, byte [esi + 0x48]
add esp, 4
test al, al
je 0x50c649
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x50c6d6
mov eax, dword [esi + 0x198]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x50c6bf
mov eax, dword [esi + 8]
test eax, eax
je 0x50c674
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x198]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x50c6bb
cmp eax, 2
je 0x50c6bf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x50c667
cmp eax, 3
je 0x50c69a
cmp eax, 1
jne 0x50c667
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x50c667
mov edx, dword [esi + 0x124]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x50c667
xor al, al
pop esi
ret
mov eax, dword [esi + 0x84]
push esi
mov dword [esi + 0x8c], eax
call fcn.0050c710
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x50c6f6
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0050c710
add esp, 4
pop esi
ret
Function at 0x537e8a
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
xor byte [esi], al
inc esi
dec ecx
jne 0x537e98
pop esi
leave
ret

Function at 0x537f9b
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov ecx, 8
xor esi, esi
mov eax, dword [esi + 0x5ee868]
mov edx, eax
xor eax, dword [esi + 0x5ee848]
and eax, dword [esi + 0x5ee868]
mov dword [esi + 0x5ee848], edx
mov dword [esi + 0x5ee888], eax
add esi, 4
dec ecx
jne 0x537fa4
pop edi
pop esi
ret
Function at 0x53f870
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x53f910
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x53f8c2
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x580880]
xor eax, edx
inc esi
cmp esi, edi
jl 0x53f8a3
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x53f8eb
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x580880]
xor eax, edx
inc esi
cmp esi, edi
jl 0x53f8ce
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x54e8d0
Capabilities:
Encode data using xor

Disassembly:
call fcn.005346e0
mov edx, dword [0x5ee978]
mov ecx, eax
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x5ee97c]
add eax, edx
mov edx, dword [0x5ee974]
cmp eax, edx
jl fcn.0054e8d0
mov dword [0x5901e0], eax
sub eax, edx
mov dword [0x5ee978], ecx
mov dword [0x5ee97c], eax
ret

Function at 0x5640b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [0x61c250]
mov edx, dword [esp + 4]
mov eax, ecx
and edx, 0xff
and eax, 0xff
xor eax, edx
shr ecx, 8
mov eax, dword [eax*4 + 0x5e5a34]
xor eax, ecx
mov ecx, dword [0x61c254]
mov dword [0x61c250], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [0x61c258]
imul eax, eax, 0x8088405
inc eax
mov edx, ecx
mov dword [0x61c254], eax
and edx, 0xff
shr eax, 0x18
xor eax, edx
shr ecx, 8
mov eax, dword [eax*4 + 0x5e5a34]
xor eax, ecx
mov dword [0x61c258], eax
ret

Function at 0x564190
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
lea eax, [esp]
push 0xc
push eax
push ecx
call fcn.00535370
add esp, 0xc
cmp eax, 0xc
jne 0x5641e3
push ebx
push esi
xor esi, esi
call fcn.00564120
mov cl, byte [esp + esi + 8]
mov bl, al
xor bl, cl
mov byte [esp + 0x18], bl
mov edx, dword [esp + 0x18]
push edx
call fcn.005640b0
add esp, 4
mov byte [esp + esi + 8], bl
inc esi
cmp esi, 0xc
jl 0x5641b0
pop esi
mov eax, 0xc
pop ebx
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x5641f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, eax
dec eax
test ecx, ecx
jle 0x56422a
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [eax + 1]
call fcn.00564120
mov cl, byte [esi]
mov bl, al
xor bl, cl
mov byte [esp + 0x14], bl
mov edx, dword [esp + 0x14]
push edx
call fcn.005640b0
add esp, 4
mov byte [esi], bl
inc esi
dec edi
jne 0x564205
pop edi
pop esi
pop ebx
ret
Function at 0x564e70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
push esi
xor esi, esi
cmp eax, esi
mov word [esp + 0xc], si
mov word [esp + 0xe], si
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov word [esp + 0x18], si
jne 0x564ea9
mov dword [esp + 4], 0x6054b50
mov word [esp + 8], si
mov word [esp + 0xa], si
jmp 0x564ed6
mov dword [esp + 4], 0x605444f
mov dword [esp + 8], 1
mov ecx, 4
mov al, cl
mov dl, 3
imul dl
mov dl, byte [esp + ecx + 4]
sub al, 0x5b
xor dl, al
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x16
jb 0x564ebe
mov ecx, dword [esp + 0x20]
lea eax, [esp + 4]
push 0x16
push eax
push ecx
call fcn.005353a0
add esp, 0xc
cmp eax, 0x16
mov eax, 1
je 0x564ef6
mov eax, esi
pop esi
add esp, 0x18
ret

Function at 0x565770
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push ebx
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
not eax
jl 0x56587d
push esi
mov esi, edi
shr esi, 3
mov ecx, esi
neg ecx
lea edi, [edi + ecx*8]
mov ecx, dword [esp + 0x14]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5e5a34]
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5e5a34]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5e5a34]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5e5a34]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5e5a34]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5e5a34]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5e5a34]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5e5a34]
xor eax, edx
inc ecx
dec esi
jne 0x565796
pop esi
jmp 0x565881
mov ecx, dword [esp + 0x10]
test edi, edi
je 0x5658a3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5e5a34]
xor eax, edx
inc ecx
dec edi
jne 0x565885
pop edi
pop ebx
not eax
ret

Function at 0x565900
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [0x61c3a0]
mov edx, dword [esp + 4]
mov eax, ecx
and edx, 0xff
and eax, 0xff
xor eax, edx
shr ecx, 8
mov eax, dword [eax*4 + 0x5e5a34]
xor eax, ecx
mov ecx, dword [0x61c3a4]
mov dword [0x61c3a0], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [0x61c3a8]
imul eax, eax, 0x8088405
inc eax
mov edx, ecx
mov dword [0x61c3a4], eax
and edx, 0xff
shr eax, 0x18
xor eax, edx
shr ecx, 8
mov eax, dword [eax*4 + 0x5e5a34]
xor eax, ecx
mov dword [0x61c3a8], eax
ret
Function at 0x565990
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, eax
dec eax
test ecx, ecx
jle 0x5659ce
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea edi, [eax + 1]
mov dl, byte [esi]
mov byte [esp + 0x14], dl
call fcn.00565970
mov bl, al
mov eax, dword [esp + 0x14]
push eax
call fcn.00565900
mov dl, byte [esp + 0x18]
add esp, 4
xor bl, dl
mov byte [esi], bl
inc esi
dec edi
jne 0x5659a5
pop edi
pop esi
pop ebx
ret
Function at 0x62ec10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x62ed1c
test eax, eax
je 0x62ed1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x649fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x62ed03
lea edi, [eax + 4]
jmp 0x62ec67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x62ec7c
mov dword [ebp - 4], 2
jmp 0x62ec9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x62ec93
mov dword [ebp - 4], 1
jmp 0x62ec9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x62ed13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x62ecd6
mov byte [ecx], 0x3d
jmp 0x62ece2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x62eced
mov byte [ecx], 0x3d
jmp 0x62ecf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x62ec64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405a20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a86
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004040bc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a70
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a8d
lea eax, [ebp - 0x10]
call fcn.00403e4c
ret

Function at 0x40aadc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab15
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f3c
jmp 0x40ab1e
mov eax, ebx
mov edx, esi
call fcn.00403ea0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ab28
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab49
mov al, byte [esp]
jmp 0x40ab4b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b1d0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b048
mov eax, dword [0x4560d0]
cmp byte [eax], 0
je 0x40b24c
mov eax, dword [0x455eec]
call fcn.004029a4
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408350
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b294
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b282
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x455e9c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x457664]
call fcn.00404f34
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret