joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a7740
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x90eeac]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a7954
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x5a77d7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x5a7935
cmp ecx, 0xe
jne 0x5a7850
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5a7935
cmp ecx, 0xf
jne 0x5a78c6
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5a7935
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.00470060
jmp fcn.005a7740
Function at 0x5a9ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x90eeac]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a9e47
sub esp, 0x30
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.005aa7a0
movzx eax, byte [esp + 0xc]
test al, al
je 0x5a9d2f
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5a9d2f
mov edx, dword [esp + 0x24]
cmp eax, 1
je 0x5a9d22
movzx ebx, byte [edx]
test bl, bl
jne 0x5a9d14
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x5a9d2f
cmp bl, 0xff
jne 0x5a9d22
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x5a9d2f
cmp eax, 8
jg 0x5a9d38
mov ebx, dword [esp + 0x38]
xor ecx, ecx
jmp 0x5a9d63
mov byte [esp + 0x3c], 0
add esp, 0x30
ret
jg 0x5a9d2f
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x5a9d43
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x20], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x40]
neg ecx
mov byte [esp + 0x13], cl
shl ebp, cl
mov dword [esp + 0x1c], ebp
mov edi, edx
shl edx, cl
add eax, 0xffffffe0
mov byte [esp + 0x12], al
mov ecx, eax
shr edi, cl
mov dword [esp + 0x18], edi
neg eax
mov ecx, eax
mov esi, dword [esp + 0x20]
shl esi, cl
movzx edi, byte [esp + 0x13]
xchg edi, eax
shr al, 5
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov dword [esp + 0x20], edi
cmp al, 0x20
sbb edi, edi
sbb ebp, ebp
and edi, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x11], al
xchg ebp, eax
movzx ecx, byte [esp + 0x13]
cmp cl, 0x20
sbb eax, eax
sbb esi, esi
and edx, esi
mov dword [ebx], edx
mov ebp, dword [esp + 0x1c]
and ebp, esi
not eax
or eax, ecx
mov byte [esp + 0x13], al
shr edx, cl
and edx, esi
mov esi, dword [esp + 0x20]
cmp esi, 1
sbb esi, esi
xor esi, 0xffffffff
mov dword [esp + 0x20], esi
movzx ecx, byte [esp + 0x12]
cmp cl, 0x20
sbb eax, eax
mov esi, dword [esp + 0x18]
and esi, eax
or ebp, esi
or ebp, edi
mov dword [ebx + 4], ebp
mov esi, ebp
shl ebp, cl
and ebp, eax
or edx, ebp
movzx ecx, byte [esp + 0x11]
mov eax, esi
sar esi, cl
mov ebp, dword [esp + 0x20]
and ebp, esi
or ebp, edx
mov dword [ebx], ebp
movzx ecx, byte [esp + 0x13]
sar eax, cl
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x5a9d38
call fcn.00470060
jmp fcn.005a9ca0
Function at 0x5b7280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x90eeac]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b741b
sub esp, 0x30
lea eax, [0x671f40]
mov dword [esp], eax
call fcn.0040bdb0
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5b72bf
mov ecx, ebp
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
cmp ebp, ecx
jle 0x5b73ed
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x44]
mov dword [esp], esi
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x1c]
xor esi, esi
jmp 0x5b7407
mov eax, dword [esp + 0x2c]
movzx esi, byte [eax + 3]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 3], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5b72b5
movzx esi, byte [eax + 2]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 2], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5b72b5
movzx esi, byte [eax + 1]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 1], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5b72b5
movzx esi, byte [eax]
inc esi
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
jmp 0x5b72b5
add esp, 0x30
ret
movzx edi, byte [ebp + ecx]
movzx edx, byte [esi + edx]
xor edi, edx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edx, dword [esp + 0x28]
cmp esi, eax
jge 0x5b738f
cmp ebx, ebp
jle 0x5b738f
ja 0x5b73f1
mov eax, ebp
mov ecx, ebx
call fcn.004714e0
nop
call fcn.00470060
jmp fcn.005b7280
Function at 0x5b9b00
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x90eeac]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b9c71
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5b9b31
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5b9b31
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5b9b37
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5b9b45
cmp ecx, 4
jne 0x5b9b76
cmp al, 0x2c
ja 0x5b9b5e
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5b9b70
cmp al, 0x24
je 0x5b9b70
cmp al, 0x26
jae 0x5b9b70
jmp 0x5b9b76
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5b9b70
cmp al, 0x5b
je 0x5b9b70
cmp al, 0x5d
jne 0x5b9b76
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5b9bad
cmp al, 0x26
ja 0x5b9b8f
cmp al, 0x24
je 0x5b9bcc
cmp al, 0x26
je 0x5b9bcc
jmp 0x5b9c53
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5b9bcc
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5b9c4d
cmp al, 0x2f
je 0x5b9bcc
jmp 0x5b9c53
cmp al, 0x3d
ja 0x5b9bc4
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5b9bcc
cmp al, 0x3d
je 0x5b9bcc
jmp 0x5b9c53
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5b9c43
cmp ecx, 2
jg 0x5b9c07
cmp ecx, 1
je 0x5b9bfc
cmp ecx, 2
jne 0x5b9c53
cmp al, 0x2f
je 0x5b9bea
cmp al, 0x3b
je 0x5b9bea
cmp al, 0x2c
jne 0x5b9bf1
mov eax, 1
jmp 0x5b9bf7
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5b9c2d
cmp al, 0x40
je 0x5b9c1b
cmp al, 0x2f
je 0x5b9c1b
cmp al, 0x3f
jne 0x5b9c22
mov eax, 1
jmp 0x5b9c28
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5b9c3d
cmp ecx, 7
jne 0x5b9c53
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5b9c4d
cmp al, 0x7e
jne 0x5b9c53
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5b9c6b
cmp al, 0x21
je 0x5b9c65
add eax, 0xffffffd8
cmp al, 2
ja 0x5b9c6b
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.00470060
jmp fcn.005b9b00
Function at 0x5c2be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x90eeac]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c2d2c
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.005aa7a0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5c2c48
lea eax, [0x683840]
mov dword [esp], eax
call fcn.0040bdb0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x6c9a83]
mov dword [eax], ecx
lea ecx, [0x71d694]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5c2d18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.005aade0
movzx eax, byte [esp + 0x10]
test al, al
je 0x5c2ce5
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5c2c48
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x683840]
mov dword [esp], eax
call fcn.0040bdb0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x6c95b2]
mov dword [eax], ecx
lea ecx, [0x71d694]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.00470060
jmp fcn.005c2be0
Function at 0x5cde50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x90eeac]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ce084
sub esp, 0x68
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.004716f5
lea ecx, [0x5ce090]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x48], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x50], edx
lea ebx, [esp + 0x84]
mov dword [esp + 0x54], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005bec60
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5cdf79
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
mov esi, dword [esp + 0x2c]
mov dword [esp], 2
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
lea edx, [esp + 0x2c]
call esi
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5cdf47
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
call fcn.005bec60
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5cdfdf
mov dword [esp + 0x14], edx
lea ecx, [eax + edx*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebp, dword [esp + 0x2c]
mov dword [esp], 1
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
lea edx, [esp + 0x2c]
call ebp
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5cdfab
mov eax, dword [esp + 0x88]
test eax, eax
je 0x5ce004
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x5ce080
mov eax, dword [esp + 0x90]
test eax, eax
jne 0x5ce080
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x64], eax
lea eax, [0x699160]
mov dword [esp], eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call fcn.00409f90
mov eax, dword [esp + 8]
lea ecx, [0x71d8e0]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x68
ret
call fcn.00470060
jmp fcn.005cde50
Function at 0x613100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x90eeac]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6132ec
sub esp, 0x68
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
xor ecx, ecx
mov ebx, 1
jmp 0x61313d
mov ebp, dword [esp + 0x5c]
lea ecx, [ebp + 1]
cmp dl, 0x2d
sete bl
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
cmp eax, ecx
jle 0x6132e0
mov dword [esp + 0x5c], ecx
mov byte [esp + 0x18], bl
movzx ebp, byte [edx + ecx]
xchg ebp, eax
mov byte [esp + 0x19], al
xchg ebp, eax
lea esi, [ebp - 0x20]
mov ecx, esi
mov edx, 1
shl edx, cl
neg ecx
mov byte [esp + 0x1b], cl
mov eax, 1
shr eax, cl
lea edi, [ebp - 0x60]
mov ecx, edi
mov ebx, 1
shl ebx, cl
mov dword [esp + 0x64], ebx
neg ecx
mov byte [esp + 0x1a], cl
mov ebx, 1
shr ebx, cl
mov dword [esp + 0x60], ebx
add ebp, 0xffffffc0
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and edx, esi
movzx esi, byte [esp + 0x1b]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb esi, esi
and eax, esi
or eax, edx
and eax, 0x3ff6cfa
cmp cl, 0x20
sbb edx, edx
and edx, ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
mov ebp, dword [esp + 0x64]
and ebp, ebx
movzx ebx, byte [esp + 0x1a]
cmp bl, 0x20
sbb ebx, ebx
mov esi, dword [esp + 0x60]
and esi, ebx
or ebp, esi
and ebp, 0x57ffffff
or ebp, eax
test ebp, ebp
setne al
test edx, 0xc7fffffe
setne dl
or eax, edx
test al, al
je 0x6132cc
movzx eax, byte [esp + 0x18]
test al, al
je 0x613221
movzx edx, byte [esp + 0x19]
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x613234
test al, al
jne 0x613128
jmp 0x613226
movzx edx, byte [esp + 0x19]
lea eax, [edx - 0x41]
cmp al, 0x19
ja 0x613128
jmp 0x613280
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.00450b00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00613300
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
call fcn.00450b00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00613300
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x78], eax
add esp, 0x68
ret
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], eax
add esp, 0x68
ret
call fcn.00470060
jmp fcn.00613100
Function at 0x4038d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x566020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403970
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403950
xor eax, eax
push ebp
push 0x403949
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40398c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403950
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x566020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x566020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404724
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x56c04c], 0
je 0x404785
cmp word [0x56c220], 0xd7b2
jne 0x40474d
cmp dword [0x56c228], 0
jbe 0x40474d
mov eax, 0x56c21c
call dword [0x56c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x566070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4047ac
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x566030], 0
jne 0x4047a1
push 0
push 0x566068
push 0x566070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4048f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a5c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x56c04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4048c0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406564
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406794
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4065e7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406794
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4065e7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4067b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406670
xor eax, eax
push ebp
push 0x406669
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004063ac
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40664e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4067d0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40664e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406670
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40678a
cmp byte [ebp - 0xd], 0
jne 0x4066b7
cmp byte [ebp - 0x12], 0
je 0x40678a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4066d0
dec ebx
cmp byte [ebx], 0x2e
je 0x4066df
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4066cf
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40678a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40671c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40678a
cmp byte [ebp - 0xd], 0
je 0x40678a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40678a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret