joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d170
Capabilities:
Encode data using xor

Disassembly:
shl byte [esi - 0xa], 0x6a
xor edx, dword [edi + 0x15]
inc ebp
xor eax, 0x60680460
dec edx
imul byte [edx + 0x33]
push edi
sbb dword [esi - 5], eax
push edx
adc byte [eax + 0x65], ch
pop edi
mov esp, 0xf556df6e
insd dword es:[edi], dx
or ebx, dword [eax + edx + 0x68]
xchg ebx, eax
dec ecx
mov esp, 0xf056df6e
push 0xffffffffffffffc7
pop esi
adc byte [eax + 0x3c], ch
dec edi
invalid
cmp al, 0x4f
cwde
outsd dx, dword [esi]
fist word [esi + 2]
jo 0x42d123
pop esi
add al, 0x68
not byte [ebx + 0x2c]
js 0x42d197
push edi
pop esi
inc ebp
sti
push edx
add al, 0x68
or dword [edi + 0x2c], esp
js 0x42d14f
push esi
popal
inc eax
or ebx, dword [eax + edx + 0x68]
mov sp, 0x336e
push edi
inc ecx
inc eax
sti
push edx
add al, 0x68
mov cl, 0x58
sub al, 0x78
fist word [esi - 0x5f]
js 0x42d153
pop esi
adc byte [eax + 0x59], ch
push eax
jnp 0x42d1fd
fist word [esi - 0x4a]
insb byte es:[edi], dx
or ebx, dword [eax + edx + 0x68]
push 0xdf420964
push esi
mov dword [0x4679940], eax
push 0x782c75a6
xor edx, dword [edi - 0x1a]
push edi
out 0x79, al
inc ecx
dec edx
add al, 0x68
xlatb
pop esp
sub al, 0x78
fist word [esi + 0x7d]
jp 0x42d1b7
sti
push edx
adc byte [eax - 0x2b], ch
pop edx
sub al, 0x78
xor edx, dword [edi - 0x6e]
inc ebx
sti
push edx
add al, 0x68
pop ebp
pop edx
cmp byte [ebx + esi + 0x57], 0x6e
js 0x42d1e1
pop ebp
add al, 0x68
fld xword [ebx - 0x7e]
jl 0x42d1bb
push esi
mov eax, 0x45ec792
push 0x782c54a1
xor edx, dword [edi + 0xf]
inc esi
or eax, 0x1d68105d
add al, 0x68
mov eax, dword [0x33782c54]
push edi
cmovbe ecx, dword [0x1d68105d]
pop edi
out dx, eax
inc edx
fist word [esi - 0x43]
inc ebp
sub al, 0x68
add al, 0x68
inc esi
arpl word [edi - 0x4fa8cc69], sp
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
xor edx, dword [edi - 0x50]
inc ebx
or eax, 0x5768045d
push eax
into
xchg ebp, eax
fist word [esi + 0x5b]
xchg ecx, eax
sub al, 0x68
add al, 0x68
cdq
insb byte es:[edi], dx
into
xchg ebp, eax
fist word [esi + 0x4d]
xchg ecx, eax
sub al, 0x68
add al, 0x68
jnp 0x42d281
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
and edx, dword [edi + 0x1d]
inc ecx
lea ebx, [ebp + 4]
push 0x97a74898
xor edx, dword [edi - 0x42]
xchg ecx, eax
or eax, 0xd968045d
dec ecx
into
xchg ebp, eax
xor edx, dword [edi + 8]
xchg ebx, eax
or eax, 0xd268045d
push 0xffffffffffffffce
xchg ebp, eax
xor edx, dword [edi - 0x1c]
inc ebp
or eax, 0x9a97f45d
insb byte es:[edi], dx
mov esp, 0x1456cf42
inc esp
pop esi
inc ebp
add byte [eax + 0x6e], ch
xchg ecx, eax
insd dword es:[edi], dx
pop esi
push esp
insd dword es:[edi], dx
inc ebx
leave
push esi
add byte [eax - 0x32], ch
pop edi
xchg ecx, eax
insd dword es:[edi], dx
xor edx, dword [edi - 0x2c]
inc edx
sti
push edx
add al, 0x68
outsd dx, dword [esi]
push edi
sub al, 0x78
xor edx, dword [edi + 0x17]
js 0x42d277
push edx
add al, 0x68
invalid
sub al, 0x78
xor edx, dword [edi + 0x3c]
inc ebp
xor eax, 0x3c680460
imul byte [bp + si + 0x33]
push edi
nop
sti
push edx
add al, 0x68
dec ecx
sub al, 0x78
retf
Function at 0x438a90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438abd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438abd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10044d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10044d57
pop dword [ebp - 0x30]
mov eax, 0x23d50e13
add eax, 0xec2f3f44
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x7e737c46
sub dword [ebp - 0x40], 0x302136fb
mov dword [ebp - 0x3c], 0x85730d55
add dword [ebp - 0x3c], 0xacc03ef0
mov dword [ebp - 0x38], 0x14984825
add dword [ebp - 0x38], 0x37b3fc09
mov dword [ebp - 0x34], 0xb613f85a
add dword [ebp - 0x34], 0x49ec07a6
lea eax, [ebp - 0x40]
push eax
mov eax, 0x2203e8db
sub eax, 0x11fe57cf
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xa7ed85b7
add dword [ebp - 0x40], 0xcc84e39f
mov dword [ebp - 0x3c], 0x339f5863
add dword [ebp - 0x3c], 0xdcd0912
mov dword [ebp - 0x38], 0xf736994a
add dword [ebp - 0x38], 0x6c38d322
mov dword [ebp - 0x34], 0xab878fcf
add dword [ebp - 0x34], 0x54787031
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x599ed
push 0
call eax
mov ecx, 0xbdb88519
sub ecx, 0xbdb84d14
xor edx, edx
add edx, eax
mov ebx, 0x1dba1589
sub ebx, 0xdb38189
add ebx, dword [ebp - 0x30]
mov edi, 0x257700f3
add edi, 0x90e003c
mov dword [ebp - 0x14], 0xfe694339
mov esi, dword [ebx]
xor dword [ebp - 0xc], edx
add esi, edi
xor dword [ebp - 0x10], 0xcb8ac255
mov dword [edx], esi
add dword [ebp - 0x28], edi
add edx, 0x6bbf8808
add edx, 0x944077fc
add ebx, 4
loop 0x10044e76
add eax, 0x8bce4561
add eax, 0x74328d86
xor ebx, ebx
add ebx, eax
add eax, 0xd8f85eca
add eax, 0x2707a13b
mov ecx, 0x5a08decf
add ecx, 0xb5f72131
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10147d3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
jne 0x10147f0
push 0x57
pop eax
jmp 0x1014871
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [esi], edi
call fcn.01033c75
test eax, eax
je 0x1014807
mov eax, 0x65b
jmp 0x1014871
xor eax, eax
inc eax
cmp dword [ebp - 0xc], eax
jne 0x1014813
mov dword [esi], eax
jmp 0x101486f
cmp dword [ebp - 0xc], 2
jne 0x101486f
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1001c28
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101486f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x1001bf4
push dword [ebp - 4]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x101485f
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x101486f
mov dword [esi], edi
xor eax, eax
pop edi
leave
ret

Function at 0x101498a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10149e4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10149d5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x10149d1
cmp esi, eax
jae 0x10149d5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10149c3
cmp esi, eax
jb 0x10149d9
xor eax, eax
jmp 0x10149e3
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x1014a98
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
lea eax, [ebp - 0x10]
push eax
push 0x20008
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
xor edi, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1014b60
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push ebx
push 1
push dword [ebp - 0x10]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1014b5f
push dword [ebp - 0x14]
call fcn.010216b0
mov edi, eax
cmp edi, ebx
pop ecx
je 0x1014b5f
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push edi
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x1014b5f
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1014b5f
push dword [ebp - 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [ebp - 0x1c], ecx
pop esi
cmp dword [ebp - 0x18], ebx
je 0x1014b6e
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp edi, ebx
je 0x1014b79
push edi
call fcn.010215c9
pop ecx
cmp dword [ebp - 0x10], ebx
pop edi
pop ebx
je 0x1014b89
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0102177f
leave
ret
Function at 0x101529b
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
je 0x101542b
cmp dword [ebp + 0xc], esi
je 0x101542b
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, esi
jne 0x10152d6
mov edi, 0x65b
jmp 0x1015413
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0xc], ebx
jne 0x10152f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10153e3
lea eax, [ebp - 0x14]
push eax
push SysReAllocString
push dword [ebx]
call fcn.010150e8
test eax, eax
jl 0x1015424
mov esi, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
inc esi
lea eax, [esi + esi]
push eax
push 0x40
call edi
test eax, eax
mov dword [ebp - 0x10], eax
je 0x1015384
push dword [ebx]
push esi
push eax
call fcn.0101506d
test eax, eax
jl 0x1015424
xor ebx, ebx
inc ebx
cmp dword [ebp - 4], ebx
jle 0x10153d1
xor esi, esi
cmp dword [ebp - 4], ebx
jle 0x1015375
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push SysReAllocString
push dword [eax + ebx*4]
call fcn.010150e8
test eax, eax
jl 0x1015424
inc dword [ebp - 0x14]
add esi, dword [ebp - 0x14]
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x101534d
lea eax, [esi + esi]
push eax
push 0x40
call edi
test eax, eax
mov dword [ebp - 8], eax
jne 0x1015389
push 8
pop edi
jmp 0x10153e3
mov ecx, dword [ebp - 0xc]
push dword [ecx + 4]
push esi
push eax
call fcn.0101506d
test eax, eax
jl 0x1015424
push 2
pop edi
cmp dword [ebp - 4], edi
jle 0x10153d1
push 0x1001ca8
push esi
push dword [ebp - 8]
call fcn.010150a7
test eax, eax
jl 0x1015424
mov eax, dword [ebp - 0xc]
push dword [eax + edi*4]
push esi
push dword [ebp - 8]
call fcn.010150a7
test eax, eax
jl 0x1015424
inc edi
cmp edi, dword [ebp - 4]
jl 0x10153a6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor edi, edi
cmp dword [ebp - 0xc], 0
pop ebx
je 0x10153f3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
je 0x101541f
cmp dword [ebp - 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1015408
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 8], 0
je 0x1015413
push dword [ebp - 8]
call esi
mov eax, dword [ebp + 8]
and dword [eax], 0
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, edi
pop edi
jmp 0x101542e
mov edi, 0x65b
jmp 0x10153e3
push 0x57
pop eax
pop esi
leave
ret 8
Function at 0x1015438
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
xor esi, esi
push 0x3c
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.01021bf0
push 0x30
pop edi
push edi
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.01021bf0
mov eax, dword [0x1064628]
mov dword [ebp - 0x28], eax
add esp, 0x18
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x3c]
mov edi, 0x1001cd8
push eax
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x34], 0x1014879
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x1015577
push esi
push dword [0x1064628]
mov eax, SysReAllocString
push esi
push esi
push esi
push esi
push eax
push eax
push eax
push 0x1001cb8
push edi
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
cmp edi, esi
je 0x1015577
push dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0101529b
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1015580
mov eax, dword [ebp - 8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xc]
push 0xffffffffffffffff
mov dword [ebp - 0x78], 0x3c
mov dword [ebp - 0x74], 0x4040
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], 0x1001cac
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], 5
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1015577
cmp dword [ebp - 0x40], esi
jne 0x101554f
mov dword [ebp - 4], 0x65b
jmp 0x101558e
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x1015566
cmp eax, 0xffffffff
jmp 0x1015575
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1015580
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x40], esi
je 0x101558e
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x101559e
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], esi
je 0x10155a8
push dword [ebp - 0xc]
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x10158d9
Capabilities:
Set current directory

Disassembly:
push 0x10
mov eax, 0x105441f
call fcn.01022092
and dword [ebp - 4], 0
mov esi, 0x1064ac0
push esi
lea ecx, [ebp - 0x14]
call fcn.01015177
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.01015177
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.01015177
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.01035d59
test al, al
jne 0x1015960
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.01014c32
xor eax, eax
call fcn.0102217e
ret 8
push 0
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.010155f4
call fcn.0103645b
test eax, eax
jne 0x101592a
cmp dword [ebp + 0xc], eax
je 0x10159c2
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x10159c2
xor esi, esi
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.01014c32
mov eax, esi
jmp 0x1015958
xor esi, esi
inc esi
jmp 0x1015992

Function at 0x1016b11
Capabilities:
Get common file path

Disassembly:
push 0xc
mov eax, 0x10544e8
call fcn.01022092
mov esi, 0x1064ac0
push esi
lea ecx, [ebp - 0x10]
call fcn.01015177
and dword [ebp - 4], 0
mov edi, 0x105
push edi
lea ecx, [ebp - 0x10]
call fcn.01015aa6
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1016bd4
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.01015124
push esi
lea ecx, [ebp - 0x14]
call fcn.01015177
push dword [0x106312c]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.01016a0f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.01035e1c
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov bl, al
mov byte [ebp - 4], 1
call fcn.01014c32
test bl, bl
je 0x1016bc9
push dword [ebp - 0x14]
mov ecx, 0x1064634
call fcn.01020147
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov esi, eax
call fcn.01014c32
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01014c32
mov eax, esi
call fcn.0102217e
ret
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.01014c32
xor esi, esi
jmp 0x1016bb6
Function at 0x1017565
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x1054738
call fcn.01022092
xor ebx, ebx
cmp di, bx
mov dword [ebp - 0x10], ebx
jne 0x101763a
call fcn.0101ab8a
test eax, eax
je 0x10176c0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
push esi
call fcn.0101ba0a
test eax, eax
movzx eax, si
push eax
je 0x10175af
push 0x1003a84
push 1
jmp 0x10176b8
cmp dword [ebp + 0xc], ebx
je 0x10175bb
push 0x1003a08
jmp 0x10175a8
push 0x1003990
push 3
call fcn.01016dbf
add esp, 0xc
cmp dword [ebp + 8], ebx
jne 0x101762e
mov esi, 0x1064ac0
push esi
lea ecx, [ebp + 8]
call fcn.01015177
push esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.01015177
lea eax, [ebp + 8]
push eax
push 0x1388
mov byte [ebp - 4], 1
call fcn.01020b48
lea eax, [ebp + 0xc]
push eax
push 0x13c7
call fcn.01020b48
push 0x30
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.01014c32
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.01014c32
mov dword [ebp - 0x10], 0x717
jmp 0x10176c0
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call esi
cmp ax, di
je 0x10176c0
push 1
push 0x10
push edi
call fcn.01020993
test eax, eax
jne 0x10176ad
movzx ebx, di
push ebx
push 0x1003958
push 1
call fcn.01016dbf
add esp, 0xc
call fcn.0101ab8a
test eax, eax
je 0x10176c0
push edi
call fcn.0101bb24
test eax, eax
je 0x10176a5
call esi
cmp ax, di
jne 0x101768d
push ebx
push 0x10038e0
jmp 0x10175a8
call esi
movzx eax, ax
push eax
push ebx
push 0x10037c8
push 1
call fcn.01016dbf
add esp, 0x10
jmp 0x10176c0
push ebx
push 0x1003740
jmp 0x10176b6
movzx eax, di
push eax
push 0x10036c8
push 2
call fcn.01016dbf
add esp, 0xc
mov eax, dword [ebp - 0x10]
call fcn.0102217e
ret 8
Function at 0x101bb24
Capabilities:
Identify system language via api

Disassembly:
push 0x28
mov eax, 0x1054de4
call fcn.01022092
xor edi, edi
cmp dword [0x1064768], edi
jne 0x101bb41
xor eax, eax
jmp 0x101bc65
lea eax, [ebp - 0x14]
mov ebx, 0x106476c
push eax
mov ecx, ebx
mov dword [ebp - 0x14], edi
call fcn.0101ae5b
mov ax, word [ebp + 8]
cmp ax, di
jne 0x101bb63
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esi, 0x1064ac0
push esi
lea ecx, [ebp - 0x18]
mov word [0x106475c], ax
call fcn.01015177
push 0xa
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], edi
call fcn.0101ac95
lea eax, [ebp - 0x34]
push eax
push edi
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x1064768
mov byte [ebp - 4], 1
call fcn.0101aebc
call fcn.0101b999
push esi
lea ecx, [ebp - 0x10]
call fcn.01015177
mov eax, dword [ebp - 0x34]
xor esi, esi
cmp eax, edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], eax
je 0x101bc45
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.01014be7
push eax
lea ecx, [ebp + 8]
call fcn.0101aebc
lea eax, [ebp - 0x10]
push eax
push edi
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov byte [ebp - 4], 3
call fcn.0101aebc
call fcn.0101b534
cmp eax, edi
je 0x101bc30
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
je 0x101bc30
push 0x1002fcc
push 0x10052ec
lea ecx, [ebp - 0x10]
call fcn.0101b03a
push dword [ebp - 0x10]
call fcn.01034eb9
movzx ecx, word [0x106475c]
cmp eax, ecx
jne 0x101bc30
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.0101ae5b
xor esi, esi
inc esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.0101ae9d
cmp dword [ebp - 0x14], edi
jne 0x101bbbf
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01014c32
lea ecx, [ebp - 0x34]
call fcn.0101ad01
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.01014c32
mov eax, esi
call fcn.0102217e
ret 4
Function at 0x101c707
Capabilities:
Encode data using xor

Disassembly:
push 0x18
mov eax, 0x1055172
call fcn.01022092
mov edi, dword [ebp + 0xc]
or dword [ebp - 0x10], 0xffffffff
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
pop ecx
stosd dword es:[edi], eax
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ecx
stosd dword es:[edi], eax
call fcn.010216b0
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
jne 0x101c751
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp ecx, ebx
je 0x101c74a
call fcn.0101ab3d
xor eax, eax
jmp 0x101c881
mov eax, dword [ebp + 8]
add eax, 8
mov eax, dword [eax]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x101c853
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
add ecx, 8
call fcn.01014be7
push eax
lea ecx, [ebp - 0x20]
call fcn.0101acbb
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], ebx
push ebx
push ebx
push 3
push ebx
push 1
mov byte [ebp - 4], 1
push SysReAllocString
jne 0x101c79a
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x101c7e3
mov ecx, edi
xor esi, esi
mov byte [ebp - 4], bl
call fcn.0101ab3d
jmp 0x101c856
cmp eax, 0x7a
jne 0x101c7a9
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
call sub.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle
cmp eax, ebx
je 0x101c7e3
push dword [ebp - 0x18]
push esi
call fcn.010221bf
cmp eax, ebx
pop ecx
pop ecx
je 0x101c7a9
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call sub.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle
cmp eax, ebx
je 0x101c7ba
lea eax, [edi + 0x10]
push eax
push dword [ebp - 0x18]
push esi
call fcn.01035f94
test eax, eax
je 0x101c7a9
push 0x14
pop eax
cmp dword [ebp - 0x14], eax
jbe 0x101c81a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jbe 0x101c830
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
sub esi, eax
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x101c827
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x10], 0xffffffff
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.0101ab3d
cmp dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
jne 0x101c764
xor esi, esi
inc esi
cmp dword [ebp - 0x1c], ebx
je 0x101c864
push dword [ebp - 0x1c]
call fcn.010215c9
pop ecx
cmp dword [ebp - 0x10], 0xffffffff
je 0x101c873
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
call fcn.0101ab3d
mov eax, esi
call fcn.0102217e
ret 8