joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1002c71f
pop dword [ebp - 0x40]
mov eax, 0xb53abfbb
sub eax, 0xa537f89c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xee24015c
sub dword [ebp - 0x50], 0x9fd1bc11
mov dword [ebp - 0x4c], 0x86672283
sub dword [ebp - 0x4c], 0x5433d63e
mov dword [ebp - 0x48], 0xb39b91eb
add dword [ebp - 0x48], 0x98b0b243
mov dword [ebp - 0x44], 0xc6cc3ae
sub dword [ebp - 0x44], 0xc6cc3ae
lea eax, [ebp - 0x50]
push eax
mov eax, 0xc5484f8e
sub eax, 0xb543dec6
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x151e79cd
sub dword [ebp - 0x50], 0xa0ac1077
mov dword [ebp - 0x4c], 0x357527d2
sub dword [ebp - 0x4c], 0xf408c65d
mov dword [ebp - 0x48], 0x4275828f
sub dword [ebp - 0x48], 0xdf061623
mov dword [ebp - 0x44], 0x3c1a7fbf
sub dword [ebp - 0x44], 0x3c1a7fbf
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x7263db60
add eax, 0x9da09584
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x42039
push 0
call eax
mov ecx, 0xead4ca20
sub ecx, 0xead48394
xor ebx, ebx
add ebx, eax
mov esi, 0x7e55f5e
sub esi, 0xf7df2f5e
add esi, dword [ebp - 0x40]
mov edx, 0x70f4d433
sub edx, 0xa538096d
xor dword [ebp - 0x18], 0x5c2664e7
mov edi, dword [esi]
add dword [ebp - 0x10], 0x3f1dffc7
xor edi, edx
add dword [ebp - 4], 0xde19f09c
mov dword [ebx], edi
add dword [ebp - 0x18], 0x409ccf72
add ebx, 0x1e73ac48
add ebx, 0xe18c53bc
add esi, 0x4c9b7b86
add esi, 0xb364847e
loop 0x1002c843
add eax, 0x10d03
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x22c2cf68
sub ecx, 0x12c2cf68
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10002021
Capabilities:
Query environment variable

Disassembly:
cmp dword [esp + 0xc], 0
push ebx
push ebp
je 0x1000209d
xor ebp, ebp
push ebp
push dword [esp + 0x18]
push dword [esp + 0x14]
call sym.java.dll__JNU_GetStringPlatformChars_12
mov ebx, eax
test ebx, ebx
je 0x1000209d
push edi
push ebp
push ebp
push ebx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov ebp, eax
test ebp, ebp
je 0x10002088
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x10002088
push ebp
push edi
push ebx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
push edi
test eax, eax
je 0x10002081
push dword [esp + 0x14]
call sym.java.dll__JNU_NewStringPlatform_8
push edi
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1000208a
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor ebp, ebp
push ebx
push dword [esp + 0x1c]
push dword [esp + 0x18]
call sym.java.dll__JNU_ReleaseStringPlatformChars_12
mov eax, ebp
pop edi
jmp 0x1000209f
xor eax, eax
pop ebp
pop ebx
ret 0xc

Function at 0x10002819
Capabilities:
Identify system language via api

Disassembly:
cmp dword [esp + 0xc], 0
je 0x10002828
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
jmp 0x1000282e
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
push esi
movzx eax, ax
push edi
push eax
call fcn.10010930
mov esi, eax
pop ecx
test esi, esi
je 0x1000285a
mov ecx, dword [esp + 0xc]
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x29c]
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1000286a
push str.memory_allocation_error
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowOutOfMemoryError_8
xor edi, edi
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x10003d57
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.java.dll__JNU_ClassString_4
mov ebp, eax
test ebp, ebp
je 0x10003da0
mov ecx, dword [esi]
push str.__B_V
push str._init_
push ebp
push esi
call dword [ecx + 0x84]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10003da0
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov edi, eax
test edi, edi
jne 0x10003da9
push str.GetEnvironmentStrings_failed
push esi
call sym.java.dll__JNU_ThrowOutOfMemoryError_8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
xor ebx, ebx
cmp byte [edi], bl
je 0x10003dbc
mov al, byte [ebx + edi]
inc ebx
test al, al
jne 0x10003daf
cmp byte [ebx + edi], al
jne 0x10003daf
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x2c0]
mov ecx, eax
mov dword [esp + 0x10], ecx
push edi
test ecx, ecx
jne 0x10003dd9
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
jmp 0x10003da0
mov eax, dword [esi]
push ebx
push 0
push ecx
push esi
call dword [eax + 0x340]
push edi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
push dword [esp + 0x10]
mov eax, dword [esi]
push dword [esp + 0x18]
push ebp
push esi
call dword [eax + 0x70]
add esp, 0x10
jmp 0x10003da2
Function at 0x10007bba
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
lea eax, [esp + 0xc]
push edi
push 0
xor ebp, ebp
mov edi, str.J2SE
inc ebp
xor bl, bl
push ebp
push 0
push edi
push eax
call esi
test eax, eax
jne 0x10007bf4
push 8
push ebp
push eax
push edi
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x10007bf4
xor al, al
jmp 0x10007c51
mov esi, dword [esp + 0x18]
push dword [esp + 0x20]
push esi
mov eax, dword [esi]
call dword [eax + 0x2ac]
mov ecx, dword [esi]
mov ebp, eax
push 0
push dword [esp + 0x24]
push esi
call dword [ecx + 0x2e0]
mov edi, eax
test edi, edi
je 0x10007c43
push edi
push ebp
push dword [esp + 0x18]
call dword [sym.imp.advapi32.dll_CryptGenRandom]
mov ecx, dword [esi]
test eax, eax
push 1
pop eax
push 0
push edi
push dword [esp + 0x28]
movzx ebx, bl
push esi
cmovne ebx, eax
call dword [ecx + 0x300]
push 0
push dword [esp + 0x14]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x10007f15
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [0x1001ff58]
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a1e8
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10007f66
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push eax
push esi
call fcn.10010930
push esi
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10007f66
mov ecx, dword [esp + 0x18]
sub ecx, 1
je 0x10007f75
sub ecx, 1
je 0x10007f6d
dec ecx
sub ecx, 1
je 0x10007f75
xor al, al
pop esi
pop ebx
ret 0x10
and bl, 0x11
cmp bl, 1
je 0x10007f66
mov al, 1
jmp 0x10007f68

Function at 0x10007f79
Capabilities:
Create directory

Disassembly:
push edi
push dword [0x1001ff58]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.1000a1e8
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10007fb3
push esi
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
pop esi
je 0x10007fb3
mov al, 1
jmp 0x10007fb5
xor al, al
pop edi
ret 0xc
Function at 0x10007fba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
push edi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a6ac
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000803c
push esi
call fcn.10010930
pop ecx
test eax, eax
jne 0x10008034
push edi
push 0x200080
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008043
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x50
je 0x10008034
cmp edi, 0xb7
je 0x10008034
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10008034
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor al, al
pop edi
pop esi
ret 0xc
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x1000803e

Function at 0x1000836f
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x1001ff00]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0x7b0]
push ebx
push esi
push edi
push dword [0x1001ff58]
movlpd qword [ebp - 0x80], xmm0
push eax
push ecx
call fcn.1000a1e8
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x60]
push 0x400
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
test eax, eax
je 0x1000840e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1000840e
mov eax, dword [ebp + 0x7bc]
sub eax, 0
je 0x10008406
sub eax, 1
je 0x100083fe
sub eax, 1
jne 0x1000840e
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp 0x10008414
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
jmp 0x10008414
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x74]
jmp 0x10008414
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x80]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov ecx, dword [ebp + 0x7a4]
mov edx, edi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10014785
add ebp, 0x7a8
leave
ret 0x10
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret
Function at 0x52a9df
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x5354f6
pushal
mov word [esp + 0x14], sp
lea esp, [esp + 0x44]
call fcn.0052d65e
push ebp
push ebx
jmp 0x52de74

Function at 0x52b2e8
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 8]
jne fcn.00591141
not cl
mov ecx, esp
pushal
mov ecx, dword [ebx]
mov word [esp], sp
push dword [esp + 4]
push dword [esp]
pushfd
pop dword [esp + 0x24]
clc
or ecx, ecx
pushfd
push dword [esp + 8]
pushfd
lea esp, [esp + 0x30]
jne 0x55c904
call fcn.0058ff36
lahf
into
dec ecx
in al, 5
xor ebp, dword [edx]
mov dword [0x62c0c4be], eax
shl dword [ebx], 0x97
and bh, byte [eax + 0xa236f43]
and byte [0x47a6949b], al
sbb byte [ebp - 0x3d338f93], bl
arpl word [edx + 0x23], bx
cld
xchg ebp, eax
and eax, 0x8b7a011b
lahf
fstp dword [ebx + 0x201b3df7]
mov bh, 0x30
and dword [edi - 0x38], ebx
dec ecx
mov eax, dword [0xb364355e]
mov dl, 0xd6
mov edi, 0x7dd10e3e
push ds
cld
mov edx, 0x7ea436d2
add dword [esp + ecx*8 + 0x31a74e67], eax
ret
cld
cmc
test bl, cl
clc
popfd
push 0x8f2210b0
mov byte [esp], 0x7a
push 0xf4c26283
pushal
lea esp, [esp + 0x28]
jmp 0x58bfd1
lea edx, [ebx*2 + 0x2c1b47b8]
call fcn.0052b6e0
and al, 0xd3
adc cl, bl
push dword [edx]
mov dh, 0x78
in eax, 0x11
test dword [eax + 5], ebp
fcmove st(0), st(5)
push 0xffffffffffffff8e
jmp 0xdd129baa

Function at 0x52cebf
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
lea esp, [esp + 0x10]
call fcn.0052d65e
push 0xf43ba1da
push ecx
jmp 0x52e7a5
lea esp, [esp + 8]
jge 0x58e118
jne 0x532f16
lahf
seto ah
mov ax, di
mov eax, dword [edx + 8]
push 0xdd97ad6
pushal
lea esp, [esp + 0x24]
jmp fcn.00591147
jmp 0x592859
jne 0x532f16
lea eax, [eax - 0x79e88f95]
bswap ax
mov eax, dword [edx + 8]
pushfd
pushal
pushal
push dword [esp]
lea esp, [esp + 0x48]
Function at 0x52d0c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror di, cl
rcl di, cl
movsx di, bl
mov edi, dword [edx + 0x1c]
pushal
pushfd
clc
add edi, eax
clc
test ebp, 0x102410b
pushfd
clc
mov edi, dword [edi + ecx*4]
push ecx
test edi, edi
pushfd
pushfd
call fcn.005329c5
hlt
stc
sub ecx, dword [edx + 0x10]
stc
clc
cmp ecx, dword [edx + 0x14]
pushal
lea esp, [esp + 0x20]
jae 0x52cc06
push eax
pushfd
mov byte [esp], 0x63
lea esp, [esp + 8]
jmp 0x52a626
mov si, 0x6c0b
shld bx, di, 0xb
sub eax, eax
lea edx, [ecx - 0x3f9cf4d6]
pushal
push ecx
mov edx, dword [esp + 0x24]
setnp bh
mov edx, dword [esp + 0x28]
pushfd
mov edx, dword [esp + 0x30]
movzx ebp, al
pushfd
seto dh
movzx dx, dl
mov edx, dword [esp + 0x38]
movsx si, dl
jmp 0x58f5db
sub esp, 0xfffffffc
jo 0x55b4ed
mov ecx, dword [ebp + 4]
stc
cmp ecx, 0xffff
pushal
pushal
mov byte [esp + 0xc], bh
push 0x790b89c4
lea esp, [esp + 0x44]
jbe 0x52b07d
and bl, 0x8d
mov edi, dword [edx + 0x24]
cmp esi, ebp
ror cx, 3
test si, 0x89fc
add edi, eax
shld ebx, esp, cl
movzx cx, bl
mov ebx, dword [edx + 0x20]
bt ax, 4
add ebx, eax
not cl
and ch, 5
mov dword [esp], 0
bsr cx, bx
dec ch
mov ecx, dword [edx + 0x18]
bt sp, 0xa
test ecx, ecx
call fcn.0052e926
cmp dword [esi - 0x3a], esi
add eax, 0x5c905733
jmp 0xe7708ae1
jmp fcn.0052b768
pushfd
jmp 0x58f9de
mov ebx, dword [esp + 0x40]
movzx si, dl
mov edi, dword [esp + 0x44]
not bp
mov si, si
movzx bp, cl
mov esi, dword [esp + 0x48]
bswap bp
call fcn.0058f9ad
jecxz 0x58f9fa
int 0xe8
lodsd eax, dword [esi]
invalid
xor eax, 0xdb32ff9d
popfd
mov dl, byte [esi + 0x6ee1a54a]
repz ret

Function at 0x52f040
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x52b2d3
push edi
mov byte [esp], al
lea esp, [esp + 0x24]
jne 0x52e017
test esi, esp
call fcn.0058c603
bt edi, ebx
call fcn.0052f4fb
or ecx, ecx
jmp 0x52a5dd

Function at 0x5333df
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [esp + 4], 0xaa
lea esp, [esp + 8]
jne fcn.00591141
not cl
mov ecx, dword [ebx]
pushal
pushfd
pop dword [esp + 0x1c]
call fcn.0052f040
xchg esi, eax
mov esi, 0x3305b2fb
fdiv qword [edi - 0x2a65f2e7]
enter 0x732d, 0x74
add ah, byte [edx + eax*2 - 0x35cfe30a]
invalid
or eax, eax
push edx
mov byte [esp], bl
jmp 0x52e4ec

Function at 0x534ab7
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 4]
jne 0x532f16
call fcn.0055c112
mov ebx, 0x54d74f9
xor esi, ebp
in eax, 0x21
mov ds, word [ebx]
salc
insb byte es:[edi], dx
pslld mm7, qword [ebp + 0x296e7941]
les ebp, [ebx - 0x2c9b0473]
xchg esi, eax
xor dword [eax], ebx
clc
xchg dword [eax + 0x795da245], ecx
insd dword es:[edi], dx
mov dword [0x976fbcd1], ebx
mov esi, 0x7a3b9f62
mov eax, dword [0xa4c73f55]
les ebp, [0x4061cfb0]
salc
dec edi
int 0xd4
pop ss
mov bh, 0x5c
or eax, 0xaee0b0e
adc dword [0x86ced30d], esp
xor eax, dword [ebp + 0x25c121a1]
sbb dword [edi + edi*2], edx
iretd
Function at 0x535102
Capabilities:
Check for software breakpoints

Disassembly:
push ecx
mov dword [esp], eax
cwde
push dword [ebp - 4]
push edi
movzx eax, bl
cwde
pushal
mov dword [esp + 0x20], ebx
movsx ax, cl
mov dword [esp + 0x1c], 0xb
not ax
mov al, byte [esp + 0x14]
call fcn.0052b74c
pop esp
or ecx, dword [eax - 0x11]
add eax, 0x77c12933
cmp dword [eax - 0xe], esi
pop ebp
ret 0xe27
or eax, eax
push ebx
pushfd
pushal
lea esp, [esp + 0x2c]
je fcn.00591141
not bl
not bh
bswap bx
mov ebx, eax
cwde
lea eax, [ebp - 8]
jmp 0x52a87b

Function at 0x55c112
Capabilities:
Check for software breakpoints

Disassembly:
mov ah, ch
mov eax, dword [edx + 8]
mov byte [esp], 0x1c
lea esp, [esp + 4]
jmp fcn.00591147

Function at 0x55c3a8
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], 0x8a
lea eax, sym.imp.KERNEL32.dll_VirtualAlloc
push 0x47b4e88e
push ebx
mov byte [esp + 0xc], 0xf8
pushfd
mov dword [esp + 0x2c], 0x52f167
call fcn.0052e635
in eax, 0x22
aad 2
xor esp, dword [ebx - 0xe5460ac]
popfd
add ah, ch
jno 0x55c43f
add ch, 0x20
int3
add eax, 0x92b4400a
mov ah, 0x92
das
add byte [edi], 0xf3
dec edi
jbe 0x15f5d44e
pop edx
adc dh, byte [edi]
mov dl, 0xd3
add dh, byte [ebx]
xor eax, dword [ebx + 0x24b88588]
mov eax, dword [0x4065504c]
mov edx, dword [edi + 0x4b]
cmp al, 0x5f
stc
outsd dx, dword [esi]
inc ebx
aad 0xa4
movsb byte es:[edi], byte [esi]
xor eax, 0xa40ee7bc
adc ecx, dword [ecx + 0x6b]
mov ss, ebp
inc ebp
mov edi, 0x8095a10f
sal dword [ebx], cl
jg 0x55c442
xor dword [ebx + 4], eax
cmp ebp, esi
not bl
xchg esi, eax
push esp
push ds
xchg eax, edx
xchg esi, eax
sub al, 0xab
salc
rol cl, cl
jbe 0x55c46a
mov bh, 0xad
loop 0x55c504
mov ebp, 0xb74f7011
invalid
cmp al, 0xa1
sbb byte [esi + 0x29], dl
ret

Function at 0x58c603
Capabilities:
Check for software breakpoints

Disassembly:
push dword [esp + 4]
popfd
push 0xd10aafb4
lea esp, [esp + 0xc]
jmp fcn.00591141

Function at 0x58f816
Capabilities:
Check for software breakpoints

Disassembly:
jmp fcn.0053547a
pushfd
lea esp, [esp + 0x30]
jne 0x52d43f
bt ax, 1
cmc
test dl, 0x27
std
popfd
pushfd
lea esp, [esp + 4]
jmp fcn.00591141

Function at 0x58ff36
Capabilities:
Check for software breakpoints

Disassembly:
cmp dl, bh
push dword [esp + 4]
popfd
push edi
pushfd
lea esp, [esp + 0x10]
jmp fcn.00591141
Function at 0x591204
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov byte [esp + 8], bh
add al, 1
cmc
shr eax, 1
jmp fcn.0052e6d6
pushal
push dword [esp + 4]
pushfd
lea esp, [esp + 0x28]
call fcn.0052a541
pushfd
adc al, al
call fcn.00532e6f
push 0xdc50e6bc
bswap bx
jmp 0x534aa4
jmp 0x52ed22
mov eax, esi
lea esp, [esp + 4]
not al
lodsb al, byte [esi]
pushal
stc
bt sp, bx
pushfd
rol al, 5
push 0xc1337770
cmp dl, 0x43
not al
test al, bl
bt dx, si
pushfd
add al, 0x7d
bt di, 0xb
test si, si
neg al
jmp 0x52e3cc
mov al, 0x10
jns 0x533251
pushal
pushfd
lea esp, [esp + 0x24]
call fcn.0052a541
jmp fcn.0052e6f8
stc
invalid
lea esp, [esp + 0x2c]
jae 0x58f2e0
mov bl, bh
setb al
mov bl, 2
not al
setb al
not al
inc al
inc ecx
jmp 0x591d85
jmp 0x58f7b8
Function at 0x402ce0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
inc eax
imul ebx
sub edi, 0x41
imul edi
inc edi
ror eax, 0xae
bswap eax
rcl esi, 0x83
sbb esi, 0x9f
bswap eax
and edi, 0xe5
rcr eax, 0x3f
or ebx, 0x8a
inc esi
neg esi
not edx
sub edx, 0xa4
not edi
bswap esi
imul esi
inc esi
sub ebx, 0x2a
dec edi
sub ebx, 0x5d
and eax, 0x2b
bswap edi
ror edx, 0x54
ror edi, 0x40
inc esi
rol esi, 0x62
mov ebx, 0x38
ror esi, 0x92
sub ebx, 0x5b
add esi, 0x4b
neg edx
rol eax, 0x8f
rcr edx, 0x1a
ror esi, 0x66
dec edx
mov ebx, 0xf7
bswap edx
and eax, 0xaa
not esi
inc edx
imul edi
not edi
ror eax, 0x49
dec edx
neg esi
inc eax
xor ecx, ecx
xor edi, edi
rcr esi, 0x65
imul ebx
rol esi, 0x8c
sbb esi, 0x67
imul ebx
or ebx, 0x83
and esi, 0xaf
rol eax, 0x98
bswap edx
or edi, 0xc8
dec edi
bswap eax
and edi, 0xb3
bswap edi
not edi
mov eax, 0xe3
neg edx
rcr edx, 0x2e
neg edi
ror edx, 0xdb
rol edi, 0x2c
mov edx, 0x17
inc esi
bswap eax
add ebx, 0xa
and esi, 0x2c
and eax, 0
and edx, 0x10
bswap edi
rcl eax, 0x67
sbb esi, 0x2c
dec ebx
neg edx
imul esi
add edx, 0x84
ror esi, 0xa6
rcl ebx, 0xad
ror ebx, 0x31
mov eax, 0xae
bswap edi
not edi
sub edx, 0x16
rcr edx, 0x63
rcl esi, 0x7c
dec edx
bswap eax
inc eax
imul ebx
imul ebx
and esi, 0
mov ecx, dword [ebp + 0xc]
inc edx
not edi
sub edx, 0x2a
mov esi, 0x87
rcl eax, 4
inc edi
inc edi
imul edi
not ebx
rcl edx, 0xd6
not edx
not esi
neg edi
bswap esi
add eax, 0xe
neg edx
add edi, 0xa
add ebx, 0xc3
rol ebx, 0x66
rol edi, 0xf3
sbb esi, 0xf9
mov edx, 0x17
rol ebx, 0xfa
dec esi
inc eax
imul edx
inc esi
imul edx
rcr edi, 0x41
sub esi, 0xb4
dec eax
dec edx
bswap eax
not edi
mov edx, 0x8f
dec edi
inc edi
mov eax, 0x55
not eax
neg ebx
rcl edi, 0xde
imul ebx
mov edi, 0x72
not esi
mov esi, 0xe
sub eax, 0x2a
neg esi
and eax, 0x3b
mov ebx, 0xe2
neg esi
mov edi, dword [ebp + 8]
xor eax, esi
xor ebx, ebx
mov esi, eax
mov eax, eax
xor esi, esi
mov eax, ebx
xor esi, eax
mov esi, ebx
mov esi, ebx
mov esi, esi
xor esi, esi
xor eax, eax
not byte [edi]
xor ebx, ebx
xor esi, eax
xor ebx, ebx
mov ebx, esi
mov esi, eax
xor ebx, eax
xor esi, ebx
mov esi, ebx
mov esi, eax
add byte [edi], 0x26
xor eax, esi
mov ebx, ebx
mov esi, eax
mov ebx, ebx
xor ebx, esi
xor ebx, ebx
mov esi, ebx
mov eax, ebx
xor eax, eax
sub byte [edi], 0x87
mov esi, eax
xor ebx, eax
xor esi, ebx
xor eax, eax
mov ebx, esi
xor esi, esi
xor ebx, eax
xor ebx, eax
mov ebx, esi
imul byte [edi]
inc edi
loop 0x402e97
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4170ad
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41714a
push ebx
push esi
call fcn.00417076
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041700a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4170f7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x417149
push edi
push eax
call fcn.00415d7b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x417117
call fcn.00415dc9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x417148
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041700a
add esp, 0x20
test eax, eax
jne 0x417136
push edi
call fcn.00415dc9
jmp 0x41713e
push ebx
call fcn.00415dc9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41797e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46f2e0
push 0x46f2d8
push str.FlsAlloc
push 0x1f
call fcn.004177e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4179b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x423160]
call esi
jmp 0x4179b8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4179fc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46f2f0
push 0x46f2e8
push str.FlsGetValue
push 0x21
call fcn.004177e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417a33
push dword [ebp + 8]
mov ecx, esi
call dword [0x423160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x417a3b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46f2f8
push 0x46f2f0
push str.FlsSetValue
push 0x22
call fcn.004177e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417a75
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x423160]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x41a847
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00415a90
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41a8b6
cmp esi, dword [ebp - 4]
je 0x41a8b1
cmp dword [ebp + 0xc], 0
je 0x41a8b1
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41a88e
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0041a399
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x41a8b8
xor eax, eax
inc eax
jmp 0x41a8b8
xor eax, eax
pop edi
pop esi
leave
ret