joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x100106ec
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x1001058b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x100105b4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x100105a0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10009960
push 0x48
push edi
call fcn.1001cab4
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10010619
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100105d0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10010608
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1001062b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x1001062e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x100106df
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x1001064e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x10010674
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10010660
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10009960
push 0x48
push edi
call fcn.1001cab4
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x100106c9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10010688
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x10010640
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10013530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028235
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1003b500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 7
mov ecx, dword [edi + 0x10]
jbe 0x10013570
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
lea eax, [ecx + ecx]
mov esi, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x1001359a
mov edx, dword [ebp - 0x14]
mov edi, eax
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10013583
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push esi
push edi
lea eax, [ebp - 0x18]
mov ecx, edx
push eax
call fcn.10002c50
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100135ca
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x100136ff
add eax, 4
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.1001ca84
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [eax + 8], xmm0
mov dword [eax + 0x18], 0
add esp, 4
mov dword [eax + 0x1c], 0
lea ecx, [eax + 8]
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [ecx], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ecx + 0x10], xmm0
xorps xmm0, xmm0
mov word [edi], ax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
movups xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmmword [ecx + 0x18], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x28], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1002ad10]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1002ad10]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x100136d2
mov ecx, edi
call fcn.10017e60
mov eax, dword [ebp - 0x1c]
mov ecx, edi
push esi
add eax, 8
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10002c50
mov ecx, dword [eax]
jmp 0x100136d5
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
push esi
mov ecx, edi
call fcn.1000efc0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.1001a2ea
int3
Function at 0x10013a10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028300
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1003b500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1001ca84
mov edi, eax
add esp, 4
test edi, edi
je 0x10013abd
push 1
mov dword [ebp - 4], 0
call fcn.1001bd34
add esp, 4
mov dword [edi + 4], eax
jmp 0x10013abf
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.10017810
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x1003c580]
mov ecx, dword [0x1003c584]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1001817c
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x1001801b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x10018044
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10018030
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.100037f0
push 0x38
push edi
call fcn.1001cab4
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x100180a9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10018060
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10018098
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100180bb
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x100180be
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x1001816f
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x100180de
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x10018104
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x100180f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.100037f0
push 0x38
push edi
call fcn.1001cab4
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10018159
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10018118
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x100180d0
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10018a70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028aad
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1003b500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1001ca84
mov edi, eax
add esp, 4
test edi, edi
je 0x10018b0d
push 1
mov dword [ebp - 4], 0
call fcn.1001bd34
add esp, 4
mov dword [edi + 4], eax
jmp 0x10018b0f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10013880
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10018b6a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10018b6a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10018b86
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10018ba9
cmp byte [ebp + 0xc], 0
je 0x10018b95
push esi
call fcn.1001c273
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10018bb5
mov esi, str.ios_base::badbit_set
jmp 0x10018bc5
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10018bf0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10014d90
push 0x10034a38
lea eax, [ebp - 0x28]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x1001b23a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1001b261
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1001b264
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001b216
pop esi
leave
ret 8

Function at 0x1001df30
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001de60
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x1001df5a
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x1001df66
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x1001df70
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001de60
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x1001df9a
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x1001e3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x1003b500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1001e3f7
mov ecx, 5
int 0x29
push 2
call fcn.1001d98c
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1001e502
test esi, esi
jne 0x1001e502
push 2
call fcn.1001d98c
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001cebc
mov esp, ebp
pop ebp
ret
Function at 0x100214c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x1003b500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100215bb
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x100215bb
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x1002151a
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x100214f8
jmp 0x100215bb
cmp edx, 0x200
jae 0x10021621
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x100215bb
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x100215ba
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x100215ba
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x10021603
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x100215a0
pop edi
mov eax, dword [0x1003cc68]
test eax, eax
jne 0x100215e1
push str.setlocale
call fcn.10023510
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100215dc
or eax, 0xffffffff
mov dword [0x1003cc68], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x1002160f
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001cebc
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x100215ba
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1001cebc
mov esp, ebp
pop ebp
ret
call fcn.1001dab6
int3
Function at 0x10021f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.10021f80
mov esi, dword [ebp + 8]
test al, al
je 0x10021f6e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10021f90
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10026580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100265ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100265ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000be60
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000be69
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x1000c61e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10024140], 0
push esi
push edi
jne 0x1000c594
call fcn.1000c500
test eax, eax
je 0x1000c5d9
mov eax, dword [0x10024140]
cmp eax, 1
jne 0x1000c5b5
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000c5d9
jmp 0x1000c61b
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000c61b
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000c5dd
xor eax, eax
jmp 0x1000c61b
mov eax, dword [esi]
push dword [0x10024140]
call edi
mov edi, eax
test edi, edi
je 0x1000c5ff
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000c61b
lea edi, [esi + 0xff0]
push esi
push dword [0x10024140]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000c605
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000c580

Function at 0x1000cc2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022cac]
jne 0x1000cc34
repz ret
jmp fcn.10010608

Function at 0x1001a572
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001a581
pop dword [ebp - 8]
mov eax, 0x1001a581
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x398a9
push 0
mov eax, 0x851d7094
sub eax, 0x751bbee4
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xfac86162
add ecx, 0x537e4fc
xor edx, edx
add edx, eax
mov esi, 0x1002b200
add esi, dword [ebp - 8]
mov ebx, 0xd0cb10e4
xor dword [ebp - 4], 0x8985f063
mov edi, dword [esi]
mov dword [ebp - 4], 0x23a92f71
xor edi, ebx
xor dword [ebp - 4], esi
mov dword [edx], edi
add dword [ebp - 4], 0xa3505875
add edx, 4
add esi, 4
loop 0x1001a5d1
add eax, 0x94b207e7
add eax, 0x6b4f0464
mov ebx, eax
add eax, 5
mov ecx, 0x5947f71f
add ecx, 0xb6b808e1
add ecx, dword [ebp - 8]
call ebx
leave
ret