joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fec70
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [ebx + 0x48]
mov eax, dword [edi + 0x18]
cmp eax, 0xc
jle 0x4fec8d
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
push ebp
push esi
cmp dword [edi + 0x2c], eax
jge 0x4fed51
lea esi, [edi + 0x44]
jmp 0x4feca0
mov dl, byte [esi]
test dl, dl
jne 0x4fed25
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4fecbb
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x4feccc
push dword [ecx + 0x38]
push 1
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4fedac
mov al, byte [esi]
test al, al
je 0x4fed9e
mov edx, dword [ebx + 0x48]
lea ebp, [esi + 1]
movzx eax, al
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x4fecf9
push eax
push ebp
push ebx
call ecx
add esp, 0xc
jmp 0x4fed09
push dword [edx + 0x38]
push eax
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov cl, byte [esi]
mov edx, eax
movzx eax, cl
cmp edx, eax
jne 0x4fedac
mov al, byte [ebp]
dec cl
mov byte [ebp], 2
mov byte [esi], cl
jmp 0x4fed37
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
dec dl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
movzx eax, al
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
cmp eax, dword [edi + 0x18]
jl 0x4feca0
mov eax, dword [edi + 0x18]
movzx ecx, word [eax*2 + 0x54e478]
mov eax, dword [esp + 0x18]
and ecx, dword [edi + 0x30]
mov dword [eax], ecx
mov ecx, dword [edi + 0x18]
shr dword [edi + 0x30], cl
sub dword [edi + 0x2c], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0x1001
jge 0x4fed94
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x4fed94
cmp ecx, 0xc
jge 0x4fed94
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
pop esi
pop ebp
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
pop esi
pop ebp
pop edi
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop ebx
ret
Function at 0x4ff080
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4ff09f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ff0b4
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4ff10b
mov cl, byte [esp + 0xc]
test cl, cl
je 0x4ff117
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4ff0e8
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4ff100
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x4ff12c
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret

Function at 0x4ff140
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4ff15f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ff174
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4ff1cb
mov cl, byte [esp + 0xc]
test cl, cl
je 0x4ff1d7
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4ff1a8
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4ff1c0
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x4ff1e1
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x4ff530
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x4ff548
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4ff55e
push 1
lea eax, [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4ff573
push dword [eax + 0x38]
lea eax, [esp + 0xc]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4ff583
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov al, byte [esp + 8]
cmp al, 0x21
je 0x4ff5c6
cmp al, 0x2c
je 0x4ff5b5
cmp al, 0x3b
mov eax, dword [esp + 0xc]
je 0x4ff5a8
mov dword [eax], 0
xor eax, eax
mov dword [esi + 0x40], 0x6b
pop esi
ret
mov dword [eax], 4
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 2
mov eax, 1
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 3
mov eax, 1
ret
Function at 0x4ff5e0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x4ff5f8
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
push esi
push esi
call fcn.004ff790
add esp, 8
test eax, eax
je 0x4ff5f4
lea eax, [esi + 4]
push eax
push esi
call fcn.004ff790
add esp, 8
test eax, eax
je 0x4ff5f4
mov ecx, dword [esi + 0x48]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ff637
push 3
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ff648
push dword [ecx + 0x38]
lea eax, [esp + 0x10]
push 3
push 1
push eax
call ebp
add esp, 0x10
cmp eax, 3
je 0x4ff66b
push dword [esi + 0x14]
mov dword [esi + 0x40], 0x66
call fcn.00500040
add esp, 4
mov dword [esi + 0x14], 0
xor eax, eax
pop ebp
pop esi
ret
mov dl, byte [esp + 0xc]
movzx ecx, dl
mov eax, ecx
and ecx, 7
shr eax, 4
inc ecx
and eax, 7
inc eax
push ebx
mov dword [esi + 8], eax
mov bl, dl
movzx eax, byte [esp + 0x11]
shr bl, 3
mov dword [esi + 0xc], eax
and bl, 1
mov al, byte [esp + 0x12]
mov byte [esi + 0x10], al
push edi
test dl, dl
jns 0x4ff770
mov eax, 1
shl eax, cl
push 0
push eax
call fcn.005000f0
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4ff6c8
pop edi
pop ebx
pop ebp
mov dword [esi + 0x40], 0x6d
pop esi
ret
mov byte [eax + 8], bl
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp dword [eax], ebx
jle 0x4ff777
xor edi, edi
lea ebx, [ebx]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ff6f9
push 3
lea ecx, [esp + 0x18]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ff70a
push dword [ecx + 0x38]
lea eax, [esp + 0x18]
push 3
push 1
push eax
call ebp
add esp, 0x10
cmp eax, 3
jne 0x4ff750
mov eax, dword [esi + 0x14]
inc ebx
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x14]
mov byte [edi + ecx], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x15]
mov byte [ecx + edi + 1], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x16]
mov byte [ecx + edi + 2], al
add edi, 3
mov eax, dword [esi + 0x14]
cmp ebx, dword [eax]
jl 0x4ff6e0
pop edi
pop ebx
pop ebp
mov eax, 1
pop esi
ret
push dword [esi + 0x14]
call fcn.00500040
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0x66
xor eax, eax
pop edi
pop ebx
pop ebp
pop esi
ret
mov dword [esi + 0x14], 0
pop edi
pop ebx
pop ebp
mov eax, 1
pop esi
ret

Function at 0x4ff790
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ff7ae
push 2
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ff7c3
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 2
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 2
je 0x4ff7d3
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov ax, word [esp + 8]
movzx ecx, ah
movzx eax, al
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], ecx
mov eax, 1
ret
Function at 0x4ff7f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push edi
push 0x4c
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4ff81a
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4ff813
mov dword [eax], 0x6d
xor eax, eax
pop edi
add esp, 8
ret
push esi
push 0x4c
push 0
push edi
call sub.MSVCRT.dll_memset
push 0x614c
push 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x14], 0
call dword [sym.imp.MSVCRT.dll_calloc]
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4ff869
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4ff857
mov dword [eax], 0x6d
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop esi
pop edi
add esp, 8
ret
push 0x614c
push 0
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [esp + 0x24]
add esp, 0xc
mov dword [edi + 0x48], esi
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 0x38], 0
mov dword [esi], 8
mov ecx, dword [edi + 0x48]
mov dword [edi + 0x44], eax
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ff8b7
push 6
lea ecx, [esp + 0xc]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x4ff8cc
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 6
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 6
je 0x4ff8e1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4ff90d
mov dword [eax], 0x66
jmp 0x4ff90d
push 3
lea eax, [esp + 0xc]
mov byte [esp + 0x12], 0
push eax
push str.GIFVER
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x4ff924
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4ff90d
mov dword [eax], 0x67
push esi
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push edi
call esi
add esp, 8
xor eax, eax
pop esi
pop edi
add esp, 8
ret
push edi
call fcn.004ff5e0
add esp, 4
test eax, eax
jne 0x4ff956
push esi
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push edi
call esi
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x4ff94e
mov dword [eax], 0x68
pop esi
xor eax, eax
pop edi
add esp, 8
ret
mov dword [edi + 0x40], 0
cmp byte [esp + 0xb], 0x39
sete al
mov byte [esi + 0x6148], al
mov eax, edi
pop esi
pop edi
add esp, 8
ret

Function at 0x4ffba0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4ffbbf
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ffbd4
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jb 0x4ffbea
movzx ecx, byte [esp + 0xc]
cmp ecx, 8
jle 0x4ffbef
mov dword [esi + 0x40], 0x66
pop edi
xor eax, eax
pop esi
ret
mov eax, 1
mov dword [edi + 8], ecx
shl eax, cl
inc ecx
mov dword [edi + 0xc], eax
inc eax
mov dword [edi + 0x10], eax
inc eax
mov dword [edi + 0x14], eax
mov eax, 1
shl eax, cl
mov dword [edi + 0x1c], eax
mov eax, 0x1002
mov dword [edi + 0x18], ecx
mov ecx, 0x1000
mov byte [edi + 0x44], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x20], 0x1002
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
add edi, 0x2144
rep stosd dword es:[edi], eax
pop edi
mov eax, 1
pop esi
ret
Function at 0x500991
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x77f2f8], 0
push ebx
push esi
mov esi, 0x77f300
jne 0x5009bd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x77f318], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x77f2f8], 1
push dword [0x77f318]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x500a5a
push 0x14
push 8
push dword [0x77c498]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x500a84
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x77f2fc]
test eax, eax
je 0x5009ff
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x77f2fc], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x500a89
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x77f318]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x77c498]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x500a84
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x500ec9
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x77c498]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x77f744]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x77f748], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00503ac5
mov dword [esi + 0x58], 0x501adc
mov eax, esi
mov dword [esi + 0x5c], 0x501b28
mov dword [esi + 0x10], fcn.0050167d
mov dword [esi + 0x30], 0x50156f
mov dword [esi + 0x64], 0x501bb2
mov dword [esi + 0x60], 0x501b6a
mov dword [esi + 0x34], 0x50121f
mov dword [esi + 0x24], 0x5011f6
mov dword [esi + 0x28], 0x5011cb
mov dword [esi + 0x2c], 0x50111d
mov dword [esi + 0x44], 0x5018e2
pop esi
ret 4
Function at 0x506d59
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x506e0f
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x506def
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x506dca
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x506e04
add edi, dword [esp + 0x14]
jmp 0x506e08
add edi, dword [esp + 0x24]
test edx, edx
jne 0x506da8
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x50711a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x5071f4
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x5071ca
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x507192
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x5071e1
add edi, ecx
jmp 0x5071e5
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x507168
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x507814
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x5078c9
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x5078aa
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x507885
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x5078bf
add edx, dword [esp + 0x14]
jmp 0x5078c3
add edx, dword [esp + 0x24]
test esi, esi
jne 0x507863
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x40458c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407028
test esi, esi
jne 0x4045c4
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407164
jmp 0x4045e2
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044d0
mov edi, eax
test esi, esi
je 0x4045e2
cmp dword [ebx], 0
je 0x4045e2
dec esi
jmp 0x4045cb
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40631c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x543050], 0
je 0x40637d
cmp word [0x54332c], 0xd7b2
jne 0x406345
cmp dword [0x543334], 0
jbe 0x406345
mov eax, 0x543328
call dword [0x543344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4063a8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x53a030], 0
jne 0x406399
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406528
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x53a038], 0
je 0x40654e
mov edx, esi
mov eax, ebx
call dword [0x53a038]
jmp 0x40655d
mov eax, 8
call fcn.00404218
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x543051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4064f0
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408e70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408fd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00407028
cmp si, word [0x53a7d4]
jb 0x408f0a
cmp si, word [0x53a9d4]
ja 0x408f0a
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408f0a
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x53a7d4]
jae 0x408ee4
mov edi, ebx
dec edi
jmp 0x408f05
cmp si, word [ebx*8 + 0x53a7d4]
jbe 0x408ef4
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408f05
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x53a7d8]
call fcn.00408d80
jmp 0x408f0a
cmp edi, dword [ebp - 0xc]
jae 0x408ece
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408fb9
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408fb9
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407238
push dword [ebp - 0x164]
push 0x408ff4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00407238
push dword [ebp - 0x168]
push 0x409004
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407238
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.004075f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408fde
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00407020
ret