joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f200
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x521340]
push ebx
push esi
lea eax, [ecx + 1]
lea esi, [ecx + 2]
imul esi, eax
imul esi, ecx
mov eax, esi
push edi
cdq
mov edi, 0x12
idiv edi
mov bl, 1
cmp edx, 0x11
jne 0x43f2c9
mov eax, esi
cdq
mov esi, 0x14
idiv esi
cmp edx, 8
jne 0x43f2c3
xor esi, esi
nop
mov edx, esi
and edx, 1
dec edx
not edx
and edx, ecx
mov eax, esi
sar eax, 1
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
mov edx, eax
and edx, 1
dec edx
sar eax, 1
not edx
and edx, ecx
xor edx, eax
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor eax, edx
inc esi
add ecx, eax
cmp esi, 0x100
jl 0x43f240
mov dword [0x521340], ecx
pop edi
pop esi
xor al, al
pop ebx
ret
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x43f4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca919
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51fee0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov dword [ebp - 4], 0
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.00439a10
test al, al
jne 0x43f5b3
mov edx, dword [0x521340]
xor esi, esi
jmp 0x43f530
mov ecx, esi
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, esi
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
inc esi
add edx, eax
cmp esi, 0x100
jl 0x43f530
mov dword [0x521340], edx
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ecx]
push str._s_d
push edi
call fcn.004060e0
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0040af50
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 5
push esi
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x4494de
push 0xf0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], edi
test ecx, ecx
je 0x449469
push ecx
push ebx
call eax
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 8]
xor esi, esi
push ebx
call eax
test eax, eax
je 0x4494cb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x4494cb
push dword [ebp - 4]
push eax
call fcn.0044e990
add esp, 8
mov ebx, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov edi, eax
test edi, edi
jne 0x4494b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp ebx, dword [ebp - 8]
je 0x4494d3
test ebx, ebx
je 0x4494d3
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4494d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4494de
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbd26
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x44d23c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x44d23c
call fcn.004042a0
mov esi, eax
jmp 0x44d32c
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x44d25f
call fcn.004042a0
jmp 0x44d31f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x44d27d
call fcn.004042a0
jmp 0x44d31f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x44d29e
mov esi, 0x8007000e
jmp 0x44d321
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0044a1c0
jmp 0x44d2c8
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x44d2df
mov esi, 0x8007000e
jmp 0x44d321
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x44d2ff
call fcn.004042a0
jmp 0x44d31f
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.0044d030
mov esi, eax
test edi, edi
je 0x44d32c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x44d350
lea ecx, [ebp - 0x418]
call fcn.0044c4b0
jmp 0x44d350
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44e870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x44e889
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e895
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x44e890
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x454dc0
Capabilities:
Access the windows event log

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.004a9180
mov eax, dword [0x51fee0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x454e25
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x454e25
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004ab8ff
add eax, 0x40
push eax
call fcn.004ab737
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004a7434
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004ab672
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x454eb4
call fcn.00454c80
test eax, eax
jle 0x454eb4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004a7434
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004a7434
add esp, 0x108
ret

Function at 0x459ec0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x459f07
mov al, byte [edx]
test al, al
je 0x459f07
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x459ed7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x466ed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.004a9180
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x466f00
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x466f00
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x466f78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x466f5a
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x466f78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x46700a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x466ff8
lea eax, [esi + esi]
call fcn.004a8520
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x46700a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x466fa3
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x46700a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004a9a4d
mov esi, eax
add esp, 8
test esi, esi
jne 0x4670ae
call fcn.004a86d6
cmp dword [eax], 2
je 0x466ff0
call fcn.004a86d6
cmp dword [eax], 9
jne 0x467002
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.004aa741
mov esi, eax
add esp, 8
test esi, esi
jne 0x4670ae
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00453940
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x4eb7c4
push eax
push 0x4eb7c0
push ecx
push str.fopen_
push 5
call fcn.00453520
add esp, 0x2c
call fcn.004a86d6
cmp dword [eax], 2
jne 0x467080
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00453940
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00453940
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret
push 0x51ef70
call fcn.00451f90
mov edi, eax
add esp, 4
test edi, edi
jne 0x4670e0
push esi
call fcn.004a9bdd
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00451a20
push esi
push 1
push 0x6a
push edi
call fcn.00451d80
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret
Function at 0x485db0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x485dc9
mov esi, edi
mov edi, eax
jmp 0x485dcb
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x485ddb
mov eax, ebx
jmp 0x485de5
push eax
push ebx
call fcn.00457030
add esp, 8
test eax, eax
jne 0x485ded
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x485e09
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x485df4
cmp eax, dword [esi + 4]
jge 0x485e20
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x485e10
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x485e41
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x485e3e
dec eax
test eax, eax
jg 0x485e30
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4be6f8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004af8a6
mov dword [ebp - 0x14], eax
cmp dword [0x525a18], edi
jne 0x4be7e9
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4be776
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4be8c9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4be8c9
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4be8c9
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x525a18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x525a1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x50f45c
push esi
mov dword [0x525a20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x525a28], eax
test eax, eax
je 0x4be7e6
push 0x50f478
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x525a24], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4be80e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4be801
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4be823
push 4
pop eax
jmp 0x4be8cb
cmp dword [ebp - 0x14], edi
je 0x4be823
push dword [0x525a18]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4be808
mov eax, dword [0x525a24]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4be881
cmp dword [0x525a28], esi
je 0x4be881
push eax
call ebx
push dword [0x525a28]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4be881
test eax, eax
je 0x4be881
call ecx
test eax, eax
je 0x4be876
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4be876
test byte [ebp - 8], 1
jne 0x4be881
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4be8b1
mov eax, dword [0x525a1c]
cmp eax, esi
je 0x4be8ae
push eax
call ebx
test eax, eax
je 0x4be8ae
call eax
mov edi, eax
test edi, edi
je 0x4be8ae
mov eax, dword [0x525a20]
cmp eax, esi
je 0x4be8ae
push eax
call ebx
test eax, eax
je 0x4be8ae
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x525a18]
call ebx
test eax, eax
je 0x4be8c9
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4be8cb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7434
leave
ret
Function at 0x4c12c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004b2175
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4c12fc
xor eax, eax
jmp 0x4c1328
cmp esi, dword [ebp - 4]
je 0x4c1325
cmp dword [ebp + 0xc], 0
je 0x4c1325
push dword [edi + 0x9c]
call fcn.004c0ed2
push dword [edi + 0x9c]
mov esi, eax
call fcn.004afbbe
pop ecx
pop ecx
cmp esi, eax
je 0x4c12f8
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x1544214
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x3d
adc eax, 0x4833e57d
inc ecx
xor ecx, dword [eax + 0x41]
sub dword [esi + 0x45], esp
stosd dword es:[edi], eax
rcr dword [ebx - 0x1cb0cb4c], 1
xor eax, 0x4fd8334e
stosb byte es:[edi], al
adc byte [edi - 0x1d], bh
cwde
mov dword [eax], ebx
rol byte [ecx + 9], cl
jmp 0xdc08c444
adc dword [edx + ebp*8 - 0x31c9076e], eax
pop esp
mov al, 0xa4
jb 0x154418f
dec esp
les ebx, [esi + 0x38]
pop eax
inc eax
and bl, byte [ecx - 8]
add al, 0xc8
jecxz 0x1544194
fdivr dword [ecx]
fsubr qword [edi - 0x42]
or al, 0x1a
push ebp
mov dh, 0x8d
nop
pushfd
notrack jmp 0x1544204
sbb al, 0xf2
inc esi
fadd dword [esi + 0x7b68988e]
cmpsb byte [esi], byte es:[edi]
push cs
or byte [edi - 0x57], ah
invalid
cmp al, ah
push dword [esp + 4]
call fcn.01269eaf
nop
pop esp
sar bh, cl
xor dword [0x71d3ba7c], edx
push es
and eax, dword [eax + eax*2 + 0x6e9483a9]
sbb dword [0xb85a9faa], edx
stosd dword es:[edi], eax
dec eax
sub byte [ecx - 0x5f], dl
and byte [ecx - 0x10], dl
cwde
xchg dword [ebx + 0xbbfa7e8], ecx
xor dh, byte [ecx - 0x30cfab5f]
mov edi, 0xa1b1320b
push esp
xor bh, cl
jge 0x15441d3
push edi
out dx, eax
cmp ebp, dword [eax]
xchg ebp, eax
arpl word [ecx + 0x4b135659], bp
out dx, al
or al, 0x6a
or ch, byte [esi + 0x10]
jl 0x1544240
push edx
mov al, byte [0x749e8e7a]
push ss
jp 0x154421b
dec esp
fisubr dword [edx]
adc al, 0x1c
sub dl, byte [esp + ebx]
push ss
dec eax
fcomp qword [edx + 0x72080ea6]
mov ah, 0x8b
lahf
aaa
dec esi
xchg ebp, eax
cwde
sbb edx, ecx
das
imul ebp, dword [ebp + 0x67], 0x4da18ad3
stosb byte es:[edi], al
push ds
xchg dword [edi - 0xa], esi
fdivrp st(3)
cmpsd dword [esi], dword es:[edi]
add dh, dh
mov dword [0x736ae475], eax
test dword [edi + 0x27], ecx
or byte [ecx + edx*2], 0xa3
in eax, 0xa4
sbb bl, bh
push ss
std
mov ebp, 0x6543d1e4
fild qword [edx - 0x1b]
clc
aam 0xf
sbb byte [ecx + 0x31cce081], 0x49
dec ecx
sub ecx, dword [ebx + 0x2d]
push esi
and dword [ebx + 0xc], eax
xor ch, bl
xchg esi, eax
xchg ebp, eax
or al, dl
shr dword [ecx - 0x45], 0x77
fld xword [edx + edi*4]
push edi
jo 0x154433a
push cs
jne 0x1544269
add eax, 0x30835dc1
mov byte [0x8fa84b28], al
jmp 0x154432c
jbe 0x15442b4
out 0x8c, al
mov al, byte [0xe82cde76]
push es
clc
adc byte [eax], dl
ljmp 0xf896
nop
hlt
Function at 0x15515b7
Capabilities:
Encode data using xor

Disassembly:
mov eax, esi
movsx di, bl
push edi
movzx di, dl
mov edi, dword [esp + 8]
pushal
mov esi, esi
mov dword [esp], 0x8205b1db
movsx bx, al
mov esi, dword [esp + 0x2c]
pop ebx
mov ebx, dword [esp + 0x2c]
pushfd
mov word [esp], 0x8da0
mov esp, ebp
pushal
jmp 0x1551e3d
invalid
push ebp
mov word [edx], cs
aam 0xe9
xchg ch, ah
xor al, 0x4e
fld xword [ebx - 0xf]
jae 0x1551e1b
jge 0x1551e58
add edx, dword [0xabc310dd]
sar dword [ecx - 0x67a14456], 1
cwde
adc ebx, eax
cdq
fsub st(4), st(0)
daa
in al, 0x9d
jmp 0xc6ee9daf
jmp 0xe927963
call 0x1268eb1
pop eax
mov al, byte [0xd2aae31f]
mov ah, 0x7e
and al, byte [edi - 0x22d864ab]
stosd dword es:[edi], eax
jg 0x1551e4f
jo 0x1551e12
call [eax - 0x60]
pop ds
jecxz 0x1551df1
sal byte [esi + edi*2 - 0x64aa78de], cl
daa
invalid
push 0xb4821b1d
stosd dword es:[edi], eax
and eax, dword [edx - 0x25decc5a]
insb byte es:[edi], dx
leave
stosd dword es:[edi], eax
add al, 0x2c
and dword [edi], ecx
add al, 0xf6
add al, 0x12
loop 0x1551e19
arpl word [esp + ecx*4 - 0x36], di
stc
fimul dword [ebx]
jb 0x1551df5
dec edx
pushal
ja 0x1551e23
dec byte [edi + ebx]
or eax, 0xa66cfb97
jbe 0x1551e3f
mov dl, 0x99
not byte [ebx + 0x6b927bed]
pop esp
in al, 0xcf
popal
movsb byte es:[edi], byte [esi]
cli
jecxz 0x1551e99
inc esi
adc dword [ebp + 0x6ffe815], edi
push es
xchg ecx, eax
add al, 0xca
mov edi, fs
inc byte [ecx + 0x52c22058]
xor al, dl
jae 0x1551f1f
retf 0xe78c
out dx, al
xor al, 0x50
je 0x1551e9c
in al, 4
jle 0x1551ebd
xor al, 0xc4
mov edi, 0xff281408
mov bh, byte [ebp - 0x18]
mov ds, word [eax + 0x4d63b2d7]
cwde
xlatb
mov dl, 0x63
dec ebp
xchg byte [esi + 0x2570bc6c], bl
pop esp
rcr byte [edx - 0x7c], 0x37
jns 0x1551f2d
fisub word [ebx - 0x1db74bb3]
xchg edi, eax
inc ebp
lds ecx, [ebp - 0x6ba09f9e]
jmp dword [edi - 0x37]
imul esp, dword [ecx - 0x7e711cca], 0xfde6cc73
imul esi, esp, 0x7a0d0d74
sahf
or eax, 0x3f48d423
or eax, 0x230d9e7a
aam 0x48
aas
je 0x1551f94
popfd
or dword [edi], 0xd6b0bf3
sar dword [esp + ebx*2], 0x13
inc edi
mov byte [0xc3751502], al
into
lahf
ror dword [esi - 0x50659b54], 0xa7
enter 0xffffffffffffe7a8, 0x53
inc edx
add dl, byte [ecx + 0x60737fb3]
sub ebx, edx
salc
adc dword [ecx + 0x39eb47bd], 0xfffffffd
and dh, ch
test al, 0x31
push edx
xlatb
mov dl, 0x30
mov ecx, 0x1fb8708b
ljmp 0x4d2d
or al, 0x7d
sub eax, 0xe4ab734d
stc
adc dword [edx], eax
invalid
loop 0x1551f77
int1
outsb dx, byte es:[esi]
test byte [edx], 0xd9
xor ecx, edx
das
xchg dword [ebp + 0x79], edx
outsb dx, byte [esi]
imul esi, dword [edi + 0x1e9bdb], 0xe
ret 0x93a9

Function at 0x1556d49
Capabilities:
Encode data using xor

Disassembly:
push 0xed6b171b
call fcn.01544b60
mov byte [edi], al
sub eax, 0xa91617c1
dec ecx
dec eax
or byte [esi], 0xb9
cmp eax, 0x158a5643
add al, 0x63
cld
pop ebx
mov ch, 2
aam 0x4a
push ebx
inc eax
cwde
dec esp
xchg byte [ebp + 0x382bd545], dh
xor byte [eax], ah
xlatb
retf 0xdd96
lea esp, [esp + 8]
je 0x1549656
pushfd
call fcn.01544214
test esp, edi
mov byte [ebx - 0xc2a6c7d], bl
adc dword [edi + 0x46d7bb1e], esp
sbb bl, byte [ebx + 0x396d64d]
xchg edx, eax
ja 0x1556cf2
invalid