joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c57a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]

Function at 0x45c58e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]

Function at 0x45c5bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
pop esp
and al, 0x14

Function at 0x45c5e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esp
and al, 0x14
mov dword [esp + 0x1c], ebx
call fcn.0056ee41
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45c639
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0056ee41
invalid

Function at 0x470ef8
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xaee71246
inc ecx
outsd dx, dword [esi]
mov cl, 0xde
popfd
mov ebp, 0x45282103
sti
pop ss
invalid
je 0x470ecf
lodsd eax, dword [esi]
jns 0x470efa
invalid
loope 0x470f2e
pop ebp
xor edx, dword [edi + 0x3f]
xor bl, ah
push cs
mov byte [ebp - 0x5fdc7c27], ah
and dword [ebx], 0xffffffa0
push eax
mov byte [0xb01379fc], al
or edi, dword [edx - 0x7c17cebf]
aas
xor byte [edi - 0x532e6fc4], cl
cmpsd dword [esi], dword es:[edi]
imul ecx, dword [edi], 0x42d4406b
inc edx
inc edx
mov esi, 0xe121d04d
mov edi, 0xa8fed94e
lodsd eax, dword [esi]
dec ebp
shl byte [ecx], 1
loope 0x470ebe
dec esi
fsin
test al, 0xad
loopne 0x470edc
inc eax
and al, 0x7b
ja 0x470ebc
push ecx
loope 0x470ea5
fnstsw word [0xa560af5e]
aaa
sub eax, dword [ecx]
stosd dword es:[edi], eax
in al, dx
cmpsd dword [esi], dword es:[edi]
arpl word [edx + ecx], bp
pop ds
inc edx
or eax, dword [ebp + 0x12]
inc ebp
fimul word [ebp + 0x77211138]
or dword [ecx + edi*2 + 0x7fea49b5], edx
mov eax, dword [0xd4acbd10]
dec edx
xchg edx, eax
aam 0x31
inc eax
cmp dword [ecx], edi
and al, 0x49
popfd
ljmp 0xd4ac:0xbd10a17f
Function at 0x473371
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00585c41
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473439
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00585c41
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057f91c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4734df
cmp edi, dword [esi + 0x7c]
jge 0x4734df
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00487d83
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00487d83
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585c41
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585c41
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473431
jmp 0x473401
call fcn.0048bfaa
int3
Function at 0x4890de
Capabilities:
Encode data using xor

Disassembly:
stc
pop eax
mov dh, 0xac
cmp ecx, 0x582602e6
xor byte [edi + 0x227c2221], bh
inc eax
sub al, byte [ebx]
xor dword [ecx], edx
test dword [eax + 0x17], esp
jge 0x4890f8
and al, byte [eax + 0x2a]
add esi, dword [ecx]
adc dword [ebp - 0x82e8a0], eax
invalid
fidiv dword [eax - 0x6a]
adc eax, edi
push ss
cmp edi, ebp
cmpsd dword [esi], dword es:[edi]
cli
cmp al, 0xa4
in eax, dx
adc byte [edx - 0x60d5719c], cl
lahf
xor ah, byte [edi + 0x16]
adc ebx, edx
in al, dx
xchg ebx, eax
mov eax, 0xf19547c6
stosb byte es:[edi], al
stosd dword es:[edi], eax
dec ebp
pop fs
lea eax, [edx + 0x35]
cld
mov dword gs:[edx + 0x64], ebx
js 0x48910b
das
xor byte [esi], bh
jb 0x489176
out dx, al
test byte [edi + 0x4b], ch
call 0xcb38b36f
mov cl, 0xb3
xor edx, dword [esi + esi*8]
out 0x43, eax
jo 0x4891af
and dh, al
retf 0xb3b1
sbb al, 0x2d
stosb byte es:[edi], al
jb 0x4890ee
sub eax, 0xe8aa72aa
jae 0x489133
call 0x44ed7dbc
movsb byte es:[edi], byte [esi]
inc esp
jae 0x489140
sub edx, dword [eax + 0x34]
mov al, byte [0x5327a5cb]
stosb byte es:[edi], al
inc esp
xchg edx, eax
sahf
test eax, 0x19efcb69
call dword [esi + 0x36]
hlt
or al, 0xee
out dx, al
pop edi
push edx
fcmovb st(0), st(4)
in eax, 0x64
sar dword [ebx], cl
test al, 0x4e
mov edi, 0xb38fad14
int1
jl 0x4891ed
rcl dword [edi + 0x74], 0x40
daa
pop ss
aas
popal
popfd
inc ecx
sub esp, esp
dec eax
fnsave dword [edx - 0x3952e622]
push es
aaa
invalid
jno 0x4891b5
and al, 0xa7
adc esp, dword [edx - 0x51]
scasd eax, dword es:[edi]
out 0x49, al
fisubr word [ebp - 0x25def6dc]
push ebp
invalid
dec esi
xchg ecx, eax
xchg dword [edi - 0x69], ebp
loope 0x489177
jl 0x491800
rcl byte [0x8ceb929c], cl
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
lea ebp, [ecx + eax*8]
mov dl, 0x2e
and eax, 0xae9dbff
jmp 0x65b8ef94
add byte [ebx + 0x8c483f0], cl
test esi, esi
jne 0x491820
lea ecx, [ebp - 0x218]
push ecx
call dword [0x536454]
lea esi, [ebp + eax - 0x219]
jmp 0x491823
mov byte [esi], 0
mov ebx, dword [0x53642c]
push 0x55eedc
push esi
call ebx
push edi
push esi
call ebx
push 5
lea edx, [ebp - 0x218]
push edx
call dword [0x536430]
mov dword [ebp - 0x328], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x324]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x491873
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596adc
mov esp, ebp
pop ebp
ret
Function at 0x48a531
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059ce01
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax

Function at 0x48a5bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 0x7c], edi
jg 0x48a5f9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059ce01
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596adc
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a69f
cmp edi, dword [esi + 0x7c]
jge 0x48a69f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049ef43
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049ef43
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ce01
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ce01
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a5f1
jmp 0x48a5c1
call fcn.004a316a
int3

Function at 0x49ee2c
Capabilities:
Encode data using xor

Disassembly:
out dx, al
xor eax, 0xa4adf5f3
div dh
invalid

Function at 0x4a1008
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rcl dword [ecx], 0x32
in al, 0x74
sub al, byte [0x7c2b69ac]
enter 0xffffffffffffdcf7, 0x71
or eax, eax
scasb al, byte es:[edi]
add dl, ah
xchg edi, eax
jl 0x4a1044
aad 0x9b
adc al, 0x84
sbb al, 0x78
jno 0x4a1000
dec ebp
invalid
outsd dx, dword [esi]
or al, byte [edx - 0x3e2d8815]
cld
ret 0xab0c
Function at 0x4a1411
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b3ce1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a14d9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b3ce1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ad9bc
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a157f
cmp edi, dword [esi + 0x7c]
jge 0x4a157f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b5e23
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b5e23
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3ce1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3ce1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a14d1
jmp 0x4a14a1
call fcn.004ba04a
int3

Function at 0x4b3d2e
Capabilities:
Encode data using xor

Disassembly:
popal
xor byte [esi + 0x6e], bl
test al, 0x92
and dword [ebp + 0x33420224], 0xcdb9d6c8
add al, byte [edx + 0x33]
enter 0xffffffffffffb9d6, 0xffffffffffffffcd
add al, byte [edx + 0x33]
enter 0xffffffffffffb9d6, 0xffffffffffffffcd
salc
mov ecx, 0x5f2ad2cd
shr byte [edx], cl
pop edi
dec ebx
inc esp
push esi
ja 0x4b3d25
je 0x4b3d32
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
mov ebx, dword [eax + 0x63]
mov eax, dword [0xef651099]
out dx, eax
iretd
Function at 0x4b7f1f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be3e0
push 0x4b7e1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
add byte [ebx], dh
ror byte [edx - 0x7bea762c], cl
dec ebp
dec esp
add byte [ebx - 0x1e7e38], cl
add byte [eax], al
add byte [ecx + 0x4c4d800d], cl
add cl, al
loope 0x4b7f43
add ecx, edx
mov dword [0x4c4d7c], ecx
shr eax, 0x10
mov dword [0x4c4d78], eax
push 1
call fcn.004b900b
pop ecx
test eax, eax
jne 0x4b7f5f
push 0x1c
call fcn.004b8021
pop ecx
call fcn.004b8dc8
test eax, eax
jne 0x4b7f70
push 0x10
call fcn.004b8021
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004b8c0c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
adc eax, sym.imp.KERNEL32.dll_GetCommandLineA
mov dword [0x4c5434], eax
call fcn.004b8ada
mov dword [0x4c4d68], eax
call fcn.004b888d
call fcn.004b87d4
call fcn.004b84e4
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b877c
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b7fbf
movzx eax, word [ebp - 0x2c]
jmp 0x4b7fc2
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b8511
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b8604
pop ecx
pop ecx
ret
Function at 0x4b90a1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c03d0
cmp edx, dword [eax]
je 0x4b90c3
add eax, 8
inc ecx
cmp eax, 0x4c0460
jl 0x4b90b4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c03d0]
jne 0x4b91f1
mov eax, dword [0x4c4d70]
cmp eax, 1
je 0x4b91cb
test eax, eax
jne 0x4b90f4
cmp dword [0x4c02fc], 1
je 0x4b91cb
cmp edx, 0xfc
je 0x4b91f1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b912b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9a80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9f10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b916e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9f10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be744
push edi
call fcn.004bbde0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9a80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9a90
lea eax, [ebp - 0xa0]
push 0x4be724
push eax
call fcn.004b9a90
push dword [esi + 0x4c03d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9a90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbd54
add esp, 0x2c
pop edi
jmp 0x4b91f1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c03d4]
push 0
push eax
push dword [esi]
call fcn.004b9f10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x53f881
Capabilities:
Accept command line arguments

Disassembly:
add al, 0
add byte [eax], al
mov dword [esp], edx
mov dword [esp], 0xc19729
mov dword [esp], edi
mov dword [esp], ebx
mov dword [esp], eax
push ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
mov esp, dword [esp]
mov dword [esp], ebx
mov eax, dword [esp]
add esp, 4
push dword [esp]
pop eax
sub esp, 4
mov dword [esp], ecx
push esp
pop ecx
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
jmp 0x57b502
xor eax, eax
push ebx
mov ebx, esp
push ebp
mov ebp, 4
add ebx, ebp
pop ebp
push edx
mov edx, 4
add ebx, 0x7eff32a6
sub ebx, edx
sub ebx, 0x7eff32a6
pop edx
xchg dword [esp], ebx
pop esp
mov dword [esp], ebx
push 0x82f92e8
mov dword [esp], ecx
mov ebx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
push dword [esp]
pop ebx
push eax
mov eax, esp
add eax, 4
push edi
push 4
pop edi
add eax, edi
pop edi
xchg dword [esp], eax
pop esp
jmp 0x656117
mov al, byte [0x4c0043]
push esi
push ecx
mov ecx, 0x7cb6de2f
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], edx
mov dword [esp], ebx
push ecx
mov ebx, dword [esp]
push 0x6f9ab024
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
push ecx
mov ecx, 4
add ebx, ecx
pop ecx
xchg dword [esp], ebx
pop esp
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edx
mov edx, esp
push ebx
mov ebx, 4
add edx, ebx
pop ebx
add edx, 4
xchg dword [esp], edx
pop esp
jmp fcn.0061896b
Function at 0x3001f3a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x3001f3dc
test cl, cl
lea eax, [eax - 4]
je 0x3001f420
test ecx, 0xff00
lea eax, [eax + 1]
je 0x3001f420
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x3001f420
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x3001f420
lea eax, [eax + 1]
jmp 0x3001f3dc
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3001f42f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x3001f456
cmp word [eax], 0
je 0x3001f44f
lea eax, [eax + 2]
test eax, 3
je 0x3001f456
jmp 0x3001f43d
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x3001f491
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x3001f456
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x3001f491
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x3001f491
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x3001f456
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3002138d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
cmp si, 0xffff
push edi
mov dword [ebp - 4], edx
je 0x30021402
test si, 0x3ff
je 0x30021402
push dword [ebp + 8]
call fcn.30021317
test eax, eax
jne 0x3002140b
movzx edi, si
mov esi, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
push eax
push eax
push 0x58
push edi
call esi
test eax, eax
je 0x3002140b
lea eax, [ebp - 0x24]
push 0x20
push eax
push 0x58
push edi
call esi
and dword [ebp - 0x10], 0
lea edx, [ebp - 0x44]
push 3
lea ecx, [ebp - 0x14]
call fcn.3002128d
test eax, eax
je 0x300213fa
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x44]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x3002140b
mov eax, dword [ebp - 4]
mov byte [eax], 1
jmp 0x30021405
mov byte [edx], 1
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop esi
leave
ret 4

Function at 0x442748
Capabilities:
Encode data using xor

Disassembly:
aad 0xf4
sbb dword [edx], 0xa47b4b29
out dx, eax
pop esp
jmp 0x4427a7
outsd dx, dword [esi]
daa
ficom word [ebx + 0x6f]
pop ds
retf
cdq
popfd
or bh, byte [eax + 0x70]
out dx, al
test eax, 0x36b99fd8
xor eax, 0xb3ff3d6d
insb byte es:[edi], dx
and bl, byte [ecx + 0xa]
mov ecx, 0x3d6d3536
push dword [ebx + 0xa59226c]
invalid
stosd dword es:[edi], eax
leave
sbb esi, dword [ebx]
or bh, byte [edi + 0x5e0450a1]
jg 0x44278f
mov dh, 0x59
sbb ch, byte [edi + 0x1d]
loope 0x442799
fld st(1)
jecxz 0x442786
aad 0x91
or eax, 0xb82e81f7
fcom dword [ebx - 0x6f654477]
hlt
Function at 0x10044374
Capabilities:
Encode data using xor

Disassembly:
call 0x100442ed
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1004431d
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x10044339
xor edx, 0
jmp 0x10044344
xor edx, edx
jmp 0x1004435b
jmp 0x10044367
xor eax, eax
push 0x8427d7c0
call 0x10044374
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x100443b0
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x10044389
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x100443c7
add eax, 0
jno 0x100443cc
add esi, 0
ret 0x10

Function at 0x10045135
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x10045157
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x100452f9
cmp edi, dword [ebp + 0x10]
jb 0x100452f9
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10044c21
inc edi
jmp 0x100451e0
jmp 0x100451ed
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10044c21
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10044c21
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x10045241
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x10045225
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1004526f
add dword [eax], 0x39
jle 0x1004524b
sub al, 0xf5
mov ch, al
call fcn.10045284
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10