joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007d396
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10086001
call fcn.100839c0
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.PK_page3.0
lea ecx, [esi + 0x14d8]
mov dword [ebp - 4], 0x25
call fcn.100012f7
lea ecx, [esi + 0x1428]
mov byte [ebp - 4], 0x24
call fcn.10001ae5
lea ecx, [esi + 0x1398]
mov byte [ebp - 4], 0x23
call fcn.100012f7
lea ecx, [esi + 0x130c]
mov byte [ebp - 4], 0x22
call fcn.100012f7
lea ecx, [esi + 0x1280]
mov byte [ebp - 4], 0x21
call fcn.100012f7
mov byte [ebp - 4], 0x20
mov edi, dword [sym.imp.mfc100.dll_Ordinal_915]
lea ecx, [esi + 0x120c]
call edi
lea ecx, [esi + 0x1198]
mov byte [ebp - 4], 0x1f
call edi
lea ecx, [esi + 0x1124]
mov byte [ebp - 4], 0x1e
call edi
lea ecx, [esi + 0x10b0]
mov byte [ebp - 4], 0x1d
call edi
lea ecx, [esi + 0x103c]
mov byte [ebp - 4], 0x1c
call edi
lea ecx, [esi + 0xfc8]
mov byte [ebp - 4], 0x1b
call edi
lea ecx, [esi + 0xf54]
mov byte [ebp - 4], 0x1a
call edi
lea ecx, [esi + 0xee0]
mov byte [ebp - 4], 0x19
call edi
mov byte [ebp - 4], 0x18
lea ecx, [esi + 0xe6c]
call edi
lea ecx, [esi + 0xdf8]
mov byte [ebp - 4], 0x17
call edi
lea ecx, [esi + 0xd84]
mov byte [ebp - 4], 0x16
call edi
lea ecx, [esi + 0xd10]
mov byte [ebp - 4], 0x15
call edi
lea ecx, [esi + 0xc9c]
mov byte [ebp - 4], 0x14
call edi
lea ecx, [esi + 0xc28]
mov byte [ebp - 4], 0x13
call edi
lea ecx, [esi + 0xbb4]
mov byte [ebp - 4], 0x12
call edi
lea ecx, [esi + 0xaf8]
mov byte [ebp - 4], 0x11
call fcn.10001ae5
lea ecx, [esi + 0xa4c]
mov byte [ebp - 4], 0x10
call fcn.10001ae5
lea ecx, [esi + 0x9a0]
mov byte [ebp - 4], 0xf
call fcn.10001ae5
lea ecx, [esi + 0x8f4]
mov byte [ebp - 4], 0xe
call fcn.10001ae5
lea ecx, [esi + 0x868]
mov byte [ebp - 4], 0xd
call fcn.100012f7
lea ecx, [esi + 0x7dc]
mov byte [ebp - 4], 0xc
call fcn.100012f7
lea ecx, [esi + 0x750]
mov byte [ebp - 4], 0xb
call fcn.100012f7
lea ecx, [esi + 0x6c4]
mov byte [ebp - 4], 0xa
call fcn.100012f7
lea ecx, [esi + 0x638]
mov byte [ebp - 4], 9
call fcn.100012f7
lea ecx, [esi + 0x5ac]
mov byte [ebp - 4], 8
call fcn.100012f7
lea ecx, [esi + 0x520]
mov byte [ebp - 4], 7
call fcn.100012f7
lea ecx, [esi + 0x494]
mov byte [ebp - 4], 6
call fcn.100012f7
lea ecx, [esi + 0x408]
mov byte [ebp - 4], 5
call fcn.100012f7
lea ecx, [esi + 0x37c]
mov byte [ebp - 4], 4
call fcn.100012f7
lea ecx, [esi + 0x2ac]
mov byte [ebp - 4], 3
call fcn.10001ae5
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 2
call fcn.10001ae5
lea ecx, [esi + 0x140]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_1011]
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 0
call fcn.10001ae5
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_946]
call fcn.10083a98
ret
Function at 0x1007f3a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10085dc8
call fcn.100839c0
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.PK_page4.0
mov dword [ebp - 4], 0x24
mov edi, dword [sym.imp.mfc100.dll_Ordinal_915]
lea ecx, [esi + 0x1374]
call edi
lea ecx, [esi + 0x12fc]
mov byte [ebp - 4], 0x23
call edi
lea ecx, [esi + 0x1288]
mov byte [ebp - 4], 0x22
call edi
lea ecx, [esi + 0x1214]
mov byte [ebp - 4], 0x21
call edi
lea ecx, [esi + 0x11a0]
mov byte [ebp - 4], 0x20
call edi
lea ecx, [esi + 0x112c]
mov byte [ebp - 4], 0x1f
call edi
lea ecx, [esi + 0x10b8]
mov byte [ebp - 4], 0x1e
call edi
lea ecx, [esi + 0x1044]
mov byte [ebp - 4], 0x1d
call edi
lea ecx, [esi + 0xfd0]
mov byte [ebp - 4], 0x1c
call edi
lea ecx, [esi + 0xf5c]
mov byte [ebp - 4], 0x1b
call edi
lea ecx, [esi + 0xee8]
mov byte [ebp - 4], 0x1a
call edi
lea ecx, [esi + 0xe74]
mov byte [ebp - 4], 0x19
call edi
lea ecx, [esi + 0xe00]
mov byte [ebp - 4], 0x18
call edi
lea ecx, [esi + 0xd8c]
mov byte [ebp - 4], 0x17
call edi
lea ecx, [esi + 0xd18]
mov byte [ebp - 4], 0x16
call edi
lea ecx, [esi + 0xca4]
mov byte [ebp - 4], 0x15
call edi
lea ecx, [esi + 0xc30]
mov byte [ebp - 4], 0x14
call edi
lea ecx, [esi + 0xbbc]
mov byte [ebp - 4], 0x13
call edi
lea ecx, [esi + 0xb48]
mov byte [ebp - 4], 0x12
call edi
lea ecx, [esi + 0xad4]
mov byte [ebp - 4], 0x11
call edi
lea ecx, [esi + 0xa60]
mov byte [ebp - 4], 0x10
call edi
lea ecx, [esi + 0x9ec]
mov byte [ebp - 4], 0xf
call edi
lea ecx, [esi + 0x978]
mov byte [ebp - 4], 0xe
call edi
lea ecx, [esi + 0x8a8]
mov byte [ebp - 4], 0xd
call fcn.10001ae5
lea ecx, [esi + 0x7fc]
mov byte [ebp - 4], 0xc
call fcn.10001ae5
lea ecx, [esi + 0x750]
mov byte [ebp - 4], 0xb
call fcn.10001ae5
lea ecx, [esi + 0x6c4]
mov byte [ebp - 4], 0xa
call fcn.100012f7
lea ecx, [esi + 0x638]
mov byte [ebp - 4], 9
call fcn.100012f7
lea ecx, [esi + 0x5ac]
mov byte [ebp - 4], 8
call fcn.100012f7
lea ecx, [esi + 0x520]
mov byte [ebp - 4], 7
call fcn.100012f7
lea ecx, [esi + 0x494]
mov byte [ebp - 4], 6
call fcn.100012f7
lea ecx, [esi + 0x408]
mov byte [ebp - 4], 5
call fcn.100012f7
lea ecx, [esi + 0x37c]
mov byte [ebp - 4], 4
call fcn.100012f7
lea ecx, [esi + 0x2f0]
mov byte [ebp - 4], 3
call fcn.100012f7
lea ecx, [esi + 0x228]
mov byte [ebp - 4], 2
call fcn.10001ae5
lea ecx, [esi + 0x17c]
mov byte [ebp - 4], 1
call fcn.10001ae5
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 0
call fcn.10001ae5
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_946]
call fcn.10083a98
ret
Function at 0x10080874
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x10085b96
call fcn.100839c0
xor esi, esi
mov edi, 0x103d57d8
push esi
push 0x1b8c
mov ecx, edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.mfc100.dll_Ordinal_381]
mov dword [ebp - 4], esi
push 0x103d58b4
mov dword [0x103d57d8], 0x1009e504
mov dword [0x103d586c], esi
mov dword [0x103d5870], esi
mov dword [0x103d5874], esi
mov dword [0x103d5878], esi
mov dword [0x103d587c], esi
mov dword [0x103d5880], esi
mov dword [0x103d5884], esi
mov dword [0x103d5888], esi
mov dword [0x103d588c], esi
mov dword [0x103d5890], esi
mov dword [0x103d5894], esi
mov dword [0x103d5898], esi
mov dword [0x103d589c], esi
mov dword [0x103d58a0], esi
mov dword [0x103d58a4], esi
mov dword [0x103d58a8], esi
mov dword [0x103d58ac], esi
mov dword [0x103d58b0], esi
call fcn.10001268
push 0x103d5940
mov byte [ebp - 4], 1
call fcn.10001268
push 0x103d59cc
mov byte [ebp - 4], 2
call fcn.10001268
push 0x103d5a58
mov byte [ebp - 4], 3
call fcn.10001268
push 0x103d5ae4
mov byte [ebp - 4], 4
call fcn.10001268
push 0x103d5b70
mov byte [ebp - 4], 5
call fcn.10001268
push 0x103d5bfc
mov byte [ebp - 4], 6
call fcn.10001268
push 0x103d5c88
mov byte [ebp - 4], 7
call fcn.10001268
push 0x103d5d14
mov byte [ebp - 4], 8
call fcn.10001268
push 0x103d5da0
mov byte [ebp - 4], 9
call fcn.10001268
push 0x103d5e2c
mov byte [ebp - 4], 0xa
call fcn.10001268
push 0x103d5eb8
mov byte [ebp - 4], 0xb
call fcn.10001268
push 0x103d5f44
mov byte [ebp - 4], 0xc
call fcn.10001268
mov byte [ebp - 4], 0xd
push 0x103d5fd0
call fcn.10001268
push 0x103d605c
mov byte [ebp - 4], 0xe
call fcn.10001268
push 0x103d60e8
mov byte [ebp - 4], 0xf
call fcn.10001268
push 0x103d6174
mov byte [ebp - 4], 0x10
call fcn.10001268
push 0x103d6200
mov byte [ebp - 4], 0x11
call fcn.10001268
mov esi, 0x103d628c
mov byte [ebp - 4], 0x12
call fcn.10001a44
mov esi, 0x103d6338
mov byte [ebp - 4], 0x13
call fcn.10001a44
mov esi, 0x103d63e4
mov byte [ebp - 4], 0x14
call fcn.10001a44
mov esi, 0x103d6490
mov byte [ebp - 4], 0x15
call fcn.10001a44
mov esi, 0x103d653c
mov byte [ebp - 4], 0x16
call fcn.10001a44
mov esi, 0x103d65e8
mov byte [ebp - 4], 0x17
call fcn.10001a44
mov esi, 0x103d6694
mov byte [ebp - 4], 0x18
call fcn.10001a44
mov esi, 0x103d6740
mov byte [ebp - 4], 0x19
call fcn.10001a44
mov esi, 0x103d67ec
mov byte [ebp - 4], 0x1a
call fcn.10001a44
mov esi, 0x103d6898
mov byte [ebp - 4], 0x1b
call fcn.10001a44
mov esi, 0x103d6944
mov byte [ebp - 4], 0x1c
call fcn.10001a44
mov esi, 0x103d69f0
mov byte [ebp - 4], 0x1d
call fcn.10001a44
mov esi, 0x103d6a9c
mov byte [ebp - 4], 0x1e
call fcn.10001a44
mov esi, 0x103d6b48
mov byte [ebp - 4], 0x1f
call fcn.10001a44
mov esi, 0x103d6bf4
mov byte [ebp - 4], 0x20
call fcn.10001a44
mov esi, 0x103d6ca0
mov byte [ebp - 4], 0x21
call fcn.10001a44
mov esi, 0x103d6d4c
mov byte [ebp - 4], 0x22
call fcn.10001a44
mov esi, 0x103d6df8
mov byte [ebp - 4], 0x23
call fcn.10001a44
mov eax, edi
call fcn.10083a98
ret

Function at 0x1008344f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a609c]
jne 0x10083459
repz ret
jmp fcn.10083aca
Function at 0x103e43f1
Capabilities:
Packed with generic packer

Disassembly:
call fcn.104ea576
sub dx, dx
mov ecx, edx
bswap eax
dec eax
ror cx, 0xe5
setae dl
bswap eax
jae 0x10487859
shr cx, 0x4c
xor ebx, eax
add edi, eax
movsx eax, cl
add ecx, edi
jmp ecx

Function at 0x10403e00
Capabilities:
Authenticate hmac

Disassembly:
shr dl, 2
lea eax, [eax + edx*4 - 0x610aafb]
not eax
js 0x103e59e3
mov dword [esp + edx - 0x9930000], 0x5f95a026
lea eax, [eax + edx*2 + 0x7f96f0bc]
mov dword [esp + edx - 0x992fffc], ecx
xor edx, dword [esp + ecx*2 - 0x3734203a]
rol eax, 1
call fcn.104e6ca6

Function at 0x1041eb24
Capabilities:
Encode data using xor

Disassembly:
xor dl, cl
inc eax
or cl, 0x16
mov dword [esp + ecx - 0x6dabd8d6], 0x84bf8b0b
sal dl, 0xc2
xor eax, 0x69b2baa1
not ecx
inc dword [esp]
not eax
shl ecx, 0x2a
jp 0x10496918
mov cl, bl
jge 0x1041eb53
add al, al
lock or dword [ebp + 0x3fb6a790], 1
sal al, 0x83
lea edx, [eax + 0x13fb6a7]
mov dh, 0x3f
add esi, edi
sar esi, 0xc8
inc cl
dec al
not cl
call fcn.104bf814
dec edi
rol dword [ebx + 0x60b9e6c7], 1
xor eax, 0x63901937
xor eax, 0x6e08b119
mov al, byte [0x637b1932]
jnp 0x1041ebda
rol bh, 1
out 0xb4, al
sbb eax, 0x27e6cef2
mov esi, 0x1bf2e6cd
mov esp, 0x33191932
xchg edi, eax
aaa
sbb dword [eax - 0x3bb5db64], ebx
out 0xb4, al
and eax, edi
out 0x75, al
enter 0x3a53, 0x38
sbb dword [ecx - 0x46], esi
pop ds
std
div esp
jae 0x1041eb48
dec edx
invalid
invalid
add edx, ebp
mov ecx, 0x9ca01938
dec esi
jp 0x1041ebed
test eax, 0x5520b81f
sub eax, 0x1db3a05b
js 0x1041ebc3
arpl word [edi], bp
movsd dword es:[edi], dword [esi]
jb 0x1041eb75
xchg edi, eax
pmaddwd mm4, mm6
xchg dword [edi + 0x3c], esp
push edx
int 0x71
and bl, byte [edx]
adc dword [eax - 0x4aeb650e], edi
jecxz 0x1041ebfd
stc
mov dl, byte [ebp - 0x13]
cwde
nop
and byte [esi], bl
js 0x1041eb95
mov edx, 0xbf92a9f1
mov edx, 0x3272ab2a
jo 0x1041eb90
xchg edx, eax
mov edi, 0x72ab2aba
xor dh, byte [eax - 0x5c]
daa
pop ds
mov dl, 0xef
fsub st(6)
hlt
add al, 0x1c
in al, dx
and dword [ecx], ebx
mov al, byte es:[0x121a1922]
mov byte [0x3a10e6dd], al
mov eax, ebx
out 0xc1, al
in al, dx
jne 0x1041ec68
sub ebx, dword [ecx]
in eax, 0x3d
sub byte [ecx], bl
test byte [edx - 0x1928db82], cl
pop ebp
inc ebp
pop ebp
sbb dword cs:[ebp - 0x77e6d3f5], esi
xchg dl, bh
and bh, byte [ebx - 0x5909ed0a]
sbb ebp, dword [ebp - 0x7e]
sub eax, 0x8437eb19
add ecx, ebx
rol byte [edi + 0x46], 1
jb 0x1041ebe3
pop edi
or eax, 0x59978ea7
lea ecx, [esi]
jbe 0x1041ec12
dec ebp
sbb bh, byte [eax - 0x52]
test byte [esi - 0x5d2877ce], ch
in eax, dx
inc edi
daa
invalid
dec ecx
push ebp
insd dword es:[edi], dx
rcr byte [edi], cl
xchg edx, eax
push edi
lea eax, [edi - 0x23]
jle 0x1041ec85
clc
in ax, 0xbd
dec edx
pop edx
add bl, ch
inc byte [esi - 0x79e35a0a]
test dh, dh
retf 0xf687
xchg dword [esp + ecx - 0x509ca3fc], ecx
xor eax, 0xbf90c935
xchg dword [esp + ecx - 0x3d5e11dc], edx
rol cx, 0xa2
xor ebx, eax
call fcn.103e8159
mov dword ss:[eax], edx
pop edx
pop ecx
jmp edi

Function at 0x1044427f
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
lea edx, [edx + eax - 0x1ea1b60c]
push ecx
call fcn.104f5314
jmp 0x1040b6ba
Function at 0x1044ead4
Capabilities:
Encode data using xor

Disassembly:
neg ax
sar edx, 0xac
mov eax, dword [ebp]
movsx ecx, dx
xor eax, ebx
bswap ecx
rol eax, 1
xor eax, 0x4c84b505
xor cx, 0x3aa
push ecx
jge 0x1041c31f
xor cl, 0x20
not cl
add edx, 0xf58b57a0
call fcn.104a6f21
mov edx, 0xd603df96
mov eax, edx
sub ebp, 4
jmp 0x103f627c
sub ecx, ecx
mov word ss:[eax + ecx*2], dx
adc ecx, dword [ecx + esi]
mov eax, 0xf53772b5
add esi, 4
movsx edx, ax
shr al, 0xa4
neg edx
xor ecx, ebx
ror ecx, 3
ror dl, 0x43
not ecx
call fcn.103e2e1d
mov eax, 0x6989a88
mov ecx, dword [ebp + eax - 0x6989a88]
lea edx, [eax*8 + 0x75ac8714]
sub al, dh
sal edx, 0x84
lea ebp, [ebp + eax*4 - 0x1a6268b0]
jns 0x1042c450
shr dx, 0xa
xor ecx, ebx
neg eax
bswap eax
rol edx, 0xe3
xor ecx, 0xc1f891f
lea ecx, [ecx + edx - 0x30a785cb]
ror ecx, 3
add edx, 0xa890da03
bswap ecx
ror ax, 0xae
shr eax, 0x18
xchg dx, ax
xor ebx, ecx
shr eax, 0xb1
adc dl, ah
xadd dx, ax
adc edi, ecx
shl ax, 0x81
mov edx, dword [esi + eax*2 - 0x34c]
mov eax, dword [esi + eax*4 - 0x694]
mov ecx, 0x988c9032
mov ecx, dword [esi + 8]
push 0x96966fa7
push 0xff3b1d89
adc esi, 4
call fcn.104306e2
mov eax, 0x8a1cd39
bswap eax
add eax, eax
mov ax, word [ebp + eax - 0x739b4210]
mov ecx, 0xbc022f03
mov dx, word [ebp + 2]
shl ecx, 0xb0
shl ecx, 0x9a
sar cx, 0xaf
adc cl, byte [ecx + ebp + 4]
add ebp, 4
push 0xe1025d9f
mov dword [esp], 0x1d03be0b
shrd ax, dx, cl
mov word [ebp], ax
jmp 0x104ec3c9
neg eax
xor eax, 0x7f34c826
bswap eax
dec eax
call fcn.104857c0
mov edx, 0xd63c1a95
mov eax, dword [ebp]
movzx ecx, dl
mov dx, word [ebp + ecx*2 - 0x126]
bswap ecx
dec ecx
add ebp, 6
or cl, cl
jno 0x1044a74f
ror word [esp + ecx - 0x7198affa], 0x8f
neg dword [esp + ecx - 0x7198affd]
mov ecx, dword [ebp + ecx - 0x7198affc]
jne 0x104b1b56
add ecx, 0xf41e27a2
xor ecx, 0xf20b701e
ror ecx, 1
mov eax, 0xbc0f7aa5
xor ecx, 0xeba15822
shr eax, 9
jbe 0x1043d475
movsx edx, ax
adc ecx, 0xa23a88bd
not dx
call fcn.10442740
neg cx
xor ecx, 0xa59ecb2e
ror eax, 2
xor ebx, eax
inc ecx
shl dx, 0x49
not dl
add edi, eax
push ecx
ror ecx, cl
mov eax, dword [ebp]
inc word [esp]
jbe 0x104b5274
ror dl, 0x21
sub dx, 0x9290
sbb cl, 0x29
not cl
jmp 0x10435f51
pop edx
lea ebp, [ebp + edx - 0x5a61df30]
shl eax, cl
rol edx, 0x1d
mov dword [ebp + edx - 0x4b4c3be6], eax
mov eax, edx
lea ecx, [edx*4 - 0x18647fc1]
jmp edi
mov cl, byte [ebp + 4]
jbe 0x10461bf3
push ebx
push 0xffffffffffffff88
inc esp
rcl dword [esi - 0x51], cl
inc ecx
invalid
mov ecx, 0xe4ab13ad
mov ecx, dword [esi]
rol byte [esp + 2], 0xa6
call fcn.1042add5
pop eax
pop eax
jmp fcn.1042e2aa
Function at 0x10493c53
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + edx - 0x720887a8]
lea eax, [edx + edx*2 - 0x124ba04c]
setge dl
mov word [edx + esi - 0x72088701], cx
movsx ecx, dl
xchg al, cl
not ax
mov eax, dword [eax + ebp - 0x43cd09fe]
call fcn.103dcdb8
xchg ecx, ebp
movzx edi, dl
add edi, ecx
shl edx, 0xee
jne 0x103f8f0e
mov ecx, dword [esi + edx*2 - 0x7692e61a]
mov eax, 0x7182c81a
xadd dx, ax
lea esi, [esi + eax - 0x71827309]
cmovs ax, dx
xor ecx, ebx
dec byte [esp + eax - 0x7182730c]
rol edx, 0xe9
xor ecx, 0x20117830
mov dword [esp + eax - 0x7182730d], 0x1e3f72bc
rol edx, 0x86
call fcn.10497b57
out dx, al
sbb bl, ch
push cs
lea ecx, [edi - 0x33]
invalid
mov eax, edx
mov ecx, dword [edx + edi - 0x7896781c]
mov dword [esp + eax - 0x7896781c], 0x37b59ebf
mov eax, dword [edi + eax - 0x78967818]
add byte [esp + edx - 0x7896781a], dl
xadd word [esp + edx - 0x7896781b], dx
rol edx, 3
add edi, 8
neg edx
mov dword [esp + edx - 0x3b49730d], edx
mov dword [ecx + edx*2 - 0x7692e61a], eax
shr word [esp + edx - 0x3b49730d], 0xe
ror byte [esp + edx - 0x3b49730c], 0xe1
jno 0x1040fef4
bswap ecx
inc dword [esp + eax - 0x42baa8e5]
push eax
sub edx, dword [esp + eax - 0x42baa8e1]
rol ecx, 3
xchg word [esp + eax - 0x42baa8df], ax
or byte [esp + edx - 0x6b609fe1], 0x1e
pop eax
inc ecx
xor ebx, ecx
sar dword [esp + edx - 0x6b609fe6], 0x74
adc esi, ecx
mov edx, dword [eax + edi - 0x42baa8e5]
mov ax, word [eax + edx - 0x42baa8e5]
mov edx, 0xb1994587
xor dword [esp], 0xdf80873e
adc edi, 2
neg edx
call fcn.104794da
neg cl
call fcn.104f0830
mov ecx, esi
mov edx, 0x720887a7
dec edx
jno 0x1040d774
Function at 0x104f58be
Capabilities:
Encode data using xor

Disassembly:
shl ecx, cl
xor dx, 0x5306
neg byte [esp + 2]
sbb byte [esp + 3], 0xa8
setne byte [esp]
xor bx, dx
shr eax, 0x81
shr ax, 0xad
setbe byte [esp + eax - 0x7e470001]
lea edi, [edi + eax - 0x7e470005]
add al, cl
sub ecx, ecx
jb 0x104522ad
mov word [ecx + edi], dx
lea esi, [esi + ecx*8 - 4]
mov eax, dword [esi + ecx]
xor eax, ebx
movzx edx, byte [esp + ecx]
bswap eax
rol eax, 2
ror edx, 0x98
xadd byte [esp + ecx*2 + 2], ch
neg eax
neg edx
pop ecx
call fcn.104f23af
mov ecx, 0x8c8a16b2
pop ecx
movzx edx, cl
mov cx, word [edx + esi - 0x35]
lea esi, [esi + edx*8 - 0x1c2]
mov word [eax + edx - 0x39], cx
mov ecx, dword [ebp + edx*4 - 0xe4]
movzx eax, dx
or edx, edx
sub eax, 0xcc8b790c
lea ebp, [ebp + edx*2 - 0x6e]
jns 0x10497510
ror eax, 0xfe
lea edx, [eax + edx*4 - 0x20fac553]
not ecx
sbb al, 0x31
cmovg edx, eax
xor ebx, ecx
sar dl, 0x61
shr edx, 0xb3
add edi, ecx
movsx ecx, dx
jmp edi
neg dx
jmp 0x1041375c
xadd edx, eax
xor ecx, ebx
xor ecx, 0x768b0030
xor dl, 0xac
dec ecx
push eax
shr word [esp + edx*2 - 0x66e90f93], 0xc3
ror ecx, 1
lea ecx, [ecx + edx + 0x55c20f3c]
and byte [esp + edx - 0x337487ca], dh
xor ebx, ecx
ror ax, 0xca
sar edx, 0xcd
adc edi, ecx
movsx ecx, ax
xor cx, 0xea2e
jnp 0x104f28d5
mov ecx, dword [esi + 4]
jb 0x104ee4f4
dec dl
adc esi, 4
not dl
add eax, ecx
movzx ecx, dx
sal ecx, cl
mov dword [esi + ecx - 0x70d00000], eax
mov ecx, dword [ecx + ebp - 0x70d00000]
lea eax, [edx + edx*2 - 0xb74b4d7]
adc ebp, 4
add dl, 0xaf
xor ecx, ebx
dec ecx
dec edx
shl eax, 0x1b
not ecx
adc dx, 0xe0af
adc al, dh
sal eax, 0x49
rol ecx, 1
jmp 0x104790e6
push eax
push eax
push eax
mov dword [esp + eax*2 - 0x56396104], edi
ret 0x10
mov dword [esp + ecx*2 - 0x71a20cde], 0x56a2fd87
jmp 0x1048de90
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call fcn.1009f576
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.1009f576
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call fcn.1009f576
pop ecx
jmp 0x10018771
push esi
call fcn.1009f576
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
Function at 0x10001497
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edi, dword [ebp + 8]
push 0xa0000301
push 0
push 0x1008c0d5
push 1
mov ebx, 0x1000f3f0
call fcn.1000e01d
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.100013fa
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100014f3
push ebx
call fcn.1000e005
add esp, 4
cmp dword [ebp - 8], 0
je 0x100014ff
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x1000153e
cmp ebx, 0x20
je 0x1000153e
cmp ebx, 0xffffffe0
je 0x1000153e
jne 0x10001547
add eax, 1
cmp esi, eax
je 0x10001554
jne 0x10001523
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x10001558
jne 0x1000151f
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x100016b9
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x100016e7
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x100016de
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x100016d6
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10001708
mov esp, ebp
pop ebp
ret

Function at 0x1000170c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x10001751
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x10001757
add eax, 4
pop esi
dec esi
push esi
jne 0x10001739
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8