joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f0920
Capabilities:
Hash data using murmur3

Disassembly:
sub esp, 0xc
push esi
mov eax, edx
mov esi, ecx
mov dword [esp + 0xc], eax
push edi
lea edi, [esi + eax]
mov dword [esp + 0xc], edi
cmp eax, 0x10
jb 0x100f09c7
lea eax, [edi - 0x10]
mov edx, 0x24234428
push ebx
mov dword [esp + 0xc], eax
mov ebx, 0x85ebca77
mov edi, dword [esp + 0xc]
mov eax, 0x61c8864f
push ebp
xor ebp, ebp
nop dword [eax + eax]
imul ecx, dword [esi], 0x7a143589
sub edx, ecx
imul ecx, dword [esi + 4], 0x7a143589
rol edx, 0xd
imul edx, edx, 0x9e3779b1
sub ebx, ecx
imul ecx, dword [esi + 8], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub ebp, ecx
imul ecx, dword [esi + 0xc], 0x7a143589
rol ebp, 0xd
add esi, 0x10
imul ebp, ebp, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp esi, edi
jbe 0x100f0960
mov edi, dword [esp + 0x14]
rol eax, 0x12
rol ebp, 0xc
add eax, ebp
rol ebx, 7
add eax, ebx
rol edx, 1
pop ebp
add eax, edx
pop ebx
jmp 0x100f09cc
mov eax, 0x165667b1
add eax, dword [esp + 0x10]
lea edx, [esi + 4]
cmp edx, edi
ja 0x100f09fa
nop word [eax + eax]
imul ecx, dword [esi], 0x3d4d51c3
mov esi, edx
lea edx, [esi + 4]
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp edx, edi
jbe 0x100f09e0
cmp esi, edi
jae 0x100f0a19
nop
movzx ecx, byte [esi]
inc esi
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp esi, edi
jb 0x100f0a00
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
add esp, 0xc
ret

Function at 0x100f0bd0
Capabilities:
Hash data using murmur3

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
add edi, dword [esi + 0x28]
lea edx, [esi + 0x18]
cmp dword [esi + 4], 0
je 0x100f0c02
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
rol ecx, 7
rol eax, 0x12
add eax, ecx
mov ecx, dword [esi + 8]
rol ecx, 1
add eax, ecx
mov ecx, dword [esi + 0x10]
rol ecx, 0xc
add eax, ecx
jmp 0x100f0c0a
mov eax, dword [esi + 0x10]
add eax, 0x165667b1
add eax, dword [esi]
add esi, 0x1c
cmp esi, edi
ja 0x100f0c2e
imul ecx, dword [edx], 0x3d4d51c3
add esi, 4
add edx, 4
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp esi, edi
jbe 0x100f0c13
cmp edx, edi
jae 0x100f0c4b
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, edi
jb 0x100f0c32
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x100f5fc0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
lea eax, [ecx + ebp]
cmp eax, edi
jbe 0x100f5fe0
mov ebp, edi
sub ebp, ecx
xor ebx, ebx
test ebp, ebp
je 0x100f6057
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
nop dword [eax]
sub eax, ecx
mov edi, ebp
sub edi, ebx
cmp edi, eax
cmovae edi, eax
mov eax, dword [esi + 0x24]
add eax, ecx
push edi
push eax
lea eax, [ebx + edx]
push eax
call fcn.10146160
mov ecx, dword [esi + 0x1c]
add esp, 0xc
add ecx, edi
add ebx, edi
cmp dword [esi + 0x28], 0
mov dword [esi + 0x1c], ecx
jne 0x100f6057
mov eax, dword [esi + 0x20]
cmp ecx, eax
jb 0x100f6042
mov ecx, dword [esi]
lea eax, [esi + 0x30]
push dword [esi + 0x24]
push eax
mov eax, dword [ecx + 8]
call eax
add esp, 8
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], 0
xor ecx, ecx
test eax, eax
je 0x100f6050
mov edx, dword [esp + 0x10]
cmp ebx, ebp
jb 0x100f5ff0
jmp 0x100f6057
mov dword [esi + 0x28], 1
movzx ecx, word [esi + 0x2c]
xor edx, edx
test ebx, ebx
je 0x100f6082
mov edi, dword [esp + 0x10]
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
shr cx, 8
movzx eax, al
xor cx, word [eax*4 + 0x101a5df8]
movzx ecx, cx
cmp edx, ebx
jb 0x100f6065
mov word [esi + 0x2c], cx
mov edx, dword [esi + 0x14]
add edx, ebx
cmp dword [esi + 4], 0
mov dword [esi + 0x14], edx
je 0x100f60c9
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
lea eax, [ecx - 1]
add eax, edx
xor edx, edx
div ecx
mov edi, eax
cmp dword [esi + 0xc], edi
je 0x100f60c9
nop dword [eax]
push dword [esi + 8]
inc dword [esi + 0xc]
push dword [esi + 0x10]
mov ecx, dword [esi + 4]
push dword [esi + 0xc]
call ecx
add esp, 0xc
cmp dword [esi + 0xc], edi
jne 0x100f60b0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x100f66e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], esi
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100f63f7
cmp byte [edx], dh
invalid
Function at 0x101033b0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x40
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x4c]
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
mov esi, ebx
mov dword [esp + 0x10], ecx
sub esi, ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
xor ecx, ecx
mov edx, 2
push edi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10146843
mov edi, eax
mov dword [esp + 0x28], 0
xor ecx, ecx
mov dword [esp + 0x20], 0
add esp, 4
lea eax, [esi + 1]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10146843
mov esi, eax
add esp, 4
test esi, esi
je 0x10103569
test edi, edi
je 0x10103569
push 0x40000
call fcn.10146843
add esp, 4
mov dword [esp + 0x28], eax
push 0x10000
call fcn.10146843
add esp, 4
mov dword [esp + 0x2c], eax
push 0x20000
call fcn.10146843
add esp, 4
mov dword [esp + 0x30], eax
push 0x10000
call fcn.10146843
add esp, 4
mov dword [esp + 0x48], eax
push 0x40000
call fcn.10146843
add esp, 4
mov dword [esp + 0x38], eax
push 0x10000
call fcn.10146843
add esp, 4
mov dword [esp + 0x3c], eax
push 0x20000
call fcn.10146843
add esp, 4
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
push esi
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x28]
mov dword [eax + 8], ebp
push 0
push 0x101023a0
push edi
push ecx
lea ecx, [esp + 0x40]
mov dword [eax + 0xc], ebx
push ecx
push ebx
push ebp
mov ecx, eax
call fcn.10102960
push edi
call fcn.10146720
add esp, 0x2c
push dword [esp + 0x24]
call fcn.10146720
add esp, 4
push esi
call fcn.10146720
add esp, 4
push dword [esp + 0x28]
call fcn.10146720
add esp, 4
push dword [esp + 0x2c]
call fcn.10146720
add esp, 4
push dword [esp + 0x30]
call fcn.10146720
add esp, 4
push dword [esp + 0x38]
call fcn.10146720
add esp, 4
push dword [esp + 0x3c]
call fcn.10146720
add esp, 4
push dword [esp + 0x40]
call fcn.10146720
add esp, 4
push dword [esp + 0x48]
call fcn.10146720
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10142783
add esp, 0x40
ret
push 0xffffffffffffffff
call fcn.10146d26
int3
Function at 0x101078d0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
sub esp, 0x150
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x18], ebp
xor esi, esi
lea edi, [ebp + 0x1c]
mov edx, dword [edi]
lea edi, [edi + 4]
mov eax, edx
rol edx, 8
ror eax, 8
and edx, 0xff00ff
and eax, 0xff00ff00
or eax, edx
mov dword [esp + esi*4 + 0x20], eax
inc esi
cmp esi, 0x10
jb 0x101078e5
lea eax, [esp + 0x28]
mov edx, 0x40
mov ecx, dword [eax + 0x2c]
lea eax, [eax + 4]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax - 0xc]
xor ecx, dword [eax - 4]
rol ecx, 1
mov dword [eax + 0x34], ecx
sub edx, 1
jne 0x10107912
mov eax, dword [ebp + 8]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebp, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], edx
mov eax, dword [eax + 0x18]
mov dword [esp + 0x14], eax
nop dword [eax]
mov ecx, ebx
mov eax, edi
not ecx
and eax, ebx
and ecx, ebp
mov edx, esi
xor ecx, eax
rol esi, 5
mov eax, dword [esp + 0x14]
add esi, ecx
mov ecx, dword [esp + 0x10]
add eax, 0x5a827999
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, ebx
mov ebx, edx
ror edi, 2
add esi, dword [esp + ecx*4 + 0x20]
inc ecx
add esi, eax
mov dword [esp + 0x10], ecx
cmp ecx, 0x14
jb 0x10107950
mov edx, 0x14
mov ecx, esi
mov eax, ebp
xor eax, edi
rol esi, 5
xor eax, ebx
add esi, eax
mov eax, dword [esp + 0x14]
add esi, dword [esp + edx*4 + 0x20]
add eax, 0x6ed9eba1
mov dword [esp + 0x14], ebp
inc edx
mov ebp, edi
add esi, eax
mov edi, ebx
mov ebx, ecx
ror edi, 2
cmp edx, 0x28
jb 0x10107992
mov dword [esp + 0x10], 0x28
nop dword [eax]
mov ecx, edi
mov eax, edi
xor ecx, ebx
and eax, ebx
and ecx, ebp
mov edx, esi
xor ecx, eax
rol esi, 5
mov eax, dword [esp + 0x10]
add ecx, 0x8f1bbcdc
add esi, dword [esp + 0x14]
add ecx, dword [esp + eax*4 + 0x20]
inc eax
add esi, ecx
mov dword [esp + 0x10], eax
mov ecx, ebp
mov ebp, edi
mov edi, ebx
mov dword [esp + 0x14], ecx
ror edi, 2
mov ebx, edx
cmp eax, 0x3c
jb 0x101079d0
mov edx, 0x3c
mov dword [esp + 0x10], esi
mov eax, ebp
xor eax, edi
rol esi, 5
add ecx, 0xca62c1d6
xor eax, ebx
add eax, dword [esp + edx*4 + 0x20]
add esi, ecx
mov ecx, ebp
inc edx
mov ebp, edi
add esi, eax
mov edi, ebx
mov ebx, dword [esp + 0x10]
ror edi, 2
cmp edx, 0x50
jb 0x10107a13
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
add eax, esi
mov ecx, dword [esp + 0x18]
add dword [ecx + 0x10], edi
add dword [ecx + 0x14], ebp
pop edi
mov dword [ecx + 8], eax
mov eax, ebx
add dword [ecx + 0xc], eax
mov eax, dword [esp + 0x10]
add dword [ecx + 0x18], eax
pop esi
pop ebp
pop ebx
add esp, 0x150
ret
Function at 0x1010f250
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
xor ecx, ecx
mov eax, esi
push edi
mov edi, 2
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10146843
mov dword [ebx], eax
lea ebp, [ebx + 4]
xor ecx, ecx
mov eax, esi
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10146843
mov dword [ebp], eax
xor ecx, ecx
mov eax, esi
mov edx, 0x18
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10146843
lea edx, [ebx + 8]
add esp, 0xc
mov dword [edx], eax
mov dword [esp + 0x14], edx
test eax, eax
je 0x1010f3c5
xor ecx, ecx
test esi, esi
je 0x1010f36e
cmp esi, 8
jb 0x1010f30b
mov edi, dword [ebx]
lea eax, [esi - 1]
lea eax, [edi + eax*2]
cmp edi, ebx
ja 0x1010f2d9
cmp eax, ebx
jae 0x1010f30b
mov eax, esi
and eax, 0xfffffff8
nop
add ecx, 8
cmp ecx, eax
jb 0x1010f2e0
shr eax, 3
shl eax, 4
mov dword [esp + 0x10], ecx
shr eax, 1
mov ecx, eax
mov eax, 0x10001
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [esp + 0x10]
cmp ecx, esi
jae 0x1010f31b
mov edi, 1
mov eax, dword [ebx]
mov word [eax + ecx*2], di
inc ecx
cmp ecx, esi
jb 0x1010f310
xor ecx, ecx
cmp esi, 8
jb 0x1010f360
mov edi, dword [ebp]
lea eax, [esi - 1]
lea eax, [edi + eax*2]
cmp edi, ebp
ja 0x1010f333
cmp eax, ebp
jae 0x1010f360
mov eax, esi
and eax, 0xfffffff8
add ecx, 8
mov ebx, ecx
cmp ecx, eax
jb 0x1010f338
shr eax, 3
shl eax, 4
shr eax, 1
mov ecx, eax
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, ebx
cmp ebx, esi
jae 0x1010f36e
nop dword [eax]
mov eax, dword [ebp]
xor edi, edi
mov word [eax + ecx*2], di
inc ecx
cmp ecx, esi
jb 0x1010f360
lea esi, [esi + esi*2]
xor eax, eax
shl esi, 3
test esi, esi
je 0x1010f3bd
cmp esi, 0x10
jb 0x1010f3b2
mov ebx, dword [edx]
lea ecx, [ebx - 1]
add ecx, esi
cmp ebx, edx
ja 0x1010f38e
cmp ecx, edx
jae 0x1010f3b2
mov ecx, esi
and ecx, 0xfffffff0
add eax, 0x10
mov edi, eax
cmp eax, ecx
jb 0x1010f393
push ecx
push 0
push ebx
call fcn.10143f10
add esp, 0xc
mov eax, edi
cmp edi, esi
jae 0x1010f3bd
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov byte [eax + ecx], 0
inc eax
cmp eax, esi
jb 0x1010f3b2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
call fcn.10146d26
int3
Function at 0x10110560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x44
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x3c], eax
mov edx, dword [esp + 0x58]
mov al, cl
mov ecx, dword [esp + 0x50]
push ebx
mov dword [esp + 0x14], edx
xor ebx, ebx
mov edx, dword [esp + 0x60]
test al, al
push ebp
mov ebp, dword [esp + 0x74]
setne bl
mov dword [esp + 0x14], edx
dec ebx
mov edx, dword [esp + 0x68]
push esi
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x78]
mov byte [esp + 0x13], al
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], edx
push edi
mov edx, ebx
call fcn.10110130
add esp, 4
mov esi, eax
cmp dword [edi], 0
jg 0x10110616
test esi, esi
je 0x10110616
mov eax, dword [esi]
lea ecx, [esp + 0x48]
push edi
push ecx
push dword [esp + 0x20]
mov eax, dword [eax]
push esi
call eax
add esp, 0x10
test eax, eax
je 0x10110616
mov edx, dword [esp + 0x28]
mov ecx, eax
push ebp
push edi
push dword [esp + 0x24]
push dword [esp + 0x2c]
push dword [esp + 0x34]
call fcn.101104a0
add esp, 0x14
mov ecx, eax
cmp dword [ebp], 0
jg 0x101106ba
test ecx, ecx
jne 0x1011069e
cmp byte [esp + 0x13], 0
je 0x101106ba
test esi, esi
je 0x1011062c
mov ecx, dword [esp + 0x14]
inc ebx
jmp 0x101105b8
cmp byte [0x101fb5d3], 0
jne 0x101106ba
push edi
or edx, 0xffffffff
mov byte [0x101fb5d3], 1
mov ecx, str.icudt46l
call fcn.10110130
add esp, 4
test eax, eax
je 0x101106ba
movups xmm0, xmmword [eax]
push edi
lea ecx, [esp + 0x30]
movups xmmword [esp + 0x30], xmm0
mov byte [esp + 0x3c], 0
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
movq qword [esp + 0x40], xmm0
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
call fcn.1010f7f0
add esp, 4
test al, al
je 0x101106ba
mov ecx, dword [esp + 0x14]
jmp 0x101105b8
mov eax, dword [esp + 0x48]
mov dword [ecx + 0x18], eax
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10142783
add esp, 0x44
ret
mov ecx, dword [esp + 0x4c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 0x44
ret
Function at 0x10118720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10163e45
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x101ed004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [esi + 0x44]
movzx eax, byte [ebx + 9]
push eax
call fcn.1011a8c0
movzx eax, byte [ebx + 8]
lea ecx, [esi + 0x50]
push eax
call fcn.1011a8c0
push 0x40
call fcn.101427a2
mov edi, eax
lea ecx, [esi + 0x68]
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push edi
mov byte [edi + 0x34], 0
mov word [edi + 0x38], 0
call fcn.100c00e0
mov eax, dword [ebx + 0xc]
mov dword [edi + 8], eax
mov esi, dword [ebx]
test esi, esi
je 0x101187d5
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [edi]
test ecx, ecx
je 0x101187e1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi], esi
mov esi, dword [ebx + 4]
test esi, esi
je 0x101187f0
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x101187fd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 4], esi
mov esi, dword [ebx]
test esi, esi
jne 0x10118809
mov esi, dword [ebx + 4]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
mov eax, dword [esi]
push ecx
push 0x101d5d1c
push esi
call dword [eax]
mov eax, dword [ebp - 0x14]
test eax, eax
setne cl
mov byte [edi + 0x38], cl
mov dword [ebp - 4], 1
test eax, eax
je 0x10118841
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
mov eax, dword [esi]
push ecx
push 0x101d5c3c
push esi
call dword [eax]
mov eax, dword [ebp - 0x14]
test eax, eax
setne cl
mov byte [edi + 0x39], cl
mov dword [ebp - 4], 3
test eax, eax
je 0x10118879
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10142783
mov esp, ebp
pop ebp
ret 4
Function at 0x1011a9d0
Capabilities:
Get geographical location

Disassembly:
push esi
push edi
push 0x9d
push 0
push 0x10203158
mov edi, edx
mov esi, ecx
call fcn.10143f10
add esp, 0xc
push 0x9d
push 0x10203158
push 0x5c
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp eax, 1
jle 0x1011aad4
xor ecx, ecx
nop dword [eax + eax]
cmp byte [ecx + 0x10203158], 0x2d
jne 0x1011aa20
mov byte [ecx + 0x10203158], 0x5f
inc ecx
cmp ecx, eax
jl 0x1011aa10
cmp eax, 3
jl 0x1011aacc
mov al, byte [0x10203158]
cmp al, 0x71
jne 0x1011aa7a
cmp byte [0x10203159], 0x75
jne 0x1011aacc
cmp byte [0x1020315a], 0x7a
jne 0x1011aacc
mov edx, 0x1020315b
mov byte [0x1020315a], 0
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1011aa60
mov edi, 0x10203158
sub edx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1011aa70
jmp 0x1011aabe
cmp al, 0x70
jne 0x1011aacc
cmp byte [0x10203159], 0x72
jne 0x1011aacc
cmp byte [0x1020315a], 0x73
jne 0x1011aacc
mov edx, 0x1020315b
mov word [0x10203158], 0x6166
mov byte [0x1020315a], 0
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1011aaa7
mov edi, 0x10203158
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1011aab6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x10203158
pop esi
ret
mov edx, esi
and edx, 0x3ff
xor ecx, ecx
nop
mov eax, dword [ecx*8 + 0x101a67c4]
cmp edx, dword [eax]
je 0x1011aaff
inc ecx
cmp ecx, 0x83
jb 0x1011aae0
mov dword [edi], 1
xor eax, eax
pop edi
pop esi
ret
mov edx, dword [ecx*8 + 0x101a67c0]
xor eax, eax
mov ecx, dword [ecx*8 + 0x101a67c4]
nop
cmp dword [ecx + eax*8], esi
je 0x1011ab20
inc eax
cmp eax, edx
jbe 0x1011ab10
mov eax, dword [ecx + 4]
pop edi
pop esi
ret
mov eax, dword [ecx + eax*8 + 4]
pop edi
pop esi
ret
Function at 0x10131180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016411d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x101ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 4], vtable.icu_46::UnicodeMatcher.0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov dword [esi], vtable.icu_46::UnicodeSet.1.0
mov dword [esi + 4], vtable.icu_46::UnicodeSet.0
mov dword [esi + 8], 1
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x30], 0
mov dword [ebp - 0x10], 0
call fcn.10132e40
cmp dword [ebp - 0x10], 0
jg 0x10131282
mov eax, dword [esi + 0xc]
shl eax, 2
test eax, eax
je 0x10131274
mov ecx, dword [0x10201be4]
push eax
test ecx, ecx
je 0x10131248
push dword [0x10201be0]
call ecx
add esp, 8
jmp 0x10131250
call fcn.10146843
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
jne 0x1013127c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov byte [esi + 0x30], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10184dc0
mov dword [esi + 0x10], eax
mov dword [eax], 0x110000
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10131370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016414d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x101ed004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [esi + 4], vtable.icu_46::UnicodeMatcher.0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
mov dword [esi], vtable.icu_46::UnicodeSet.1.0
mov dword [esi + 4], vtable.icu_46::UnicodeSet.0
mov dword [esi + 8], 1
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x30], 0
mov dword [ebp - 0x20], 0
call fcn.10132e40
cmp dword [ebp - 0x20], 0
jg 0x101314dd
mov eax, dword [esi + 0xc]
shl eax, 2
test eax, eax
je 0x1013145e
mov ecx, dword [0x10201be4]
push eax
test ecx, ecx
je 0x10131442
push dword [0x10201be0]
call ecx
add esp, 8
jmp 0x1013144a
call fcn.10146843
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10131466
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x58]
mov byte [esi + 0x30], 1
jmp 0x101314dd
mov eax, 0x10184dc0
mov dword [esi + 0x10], eax
mov dword [eax], 0x110000
cmp dword [esi + 0x14], 0
jne 0x101314dd
cmp dword [esi + 0x2c], 0
jne 0x101314dd
test byte [esi + 0x30], 1
jne 0x101314dd
push ecx
push 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
mov ecx, esi
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x110000
call fcn.10132ef0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x101314dd
cmp eax, 0x10184dc0
je 0x101314cf
mov ecx, dword [0x10201bec]
push eax
test ecx, ecx
je 0x101314c7
push dword [0x10201be0]
call ecx
add esp, 8
jmp 0x101314cf
call fcn.10146720
add esp, 4
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10142783
mov esp, ebp
pop ebp
ret 8
Function at 0x10153d56
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101539d3

Function at 0x101575d8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1015744e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xee8638
Capabilities:
Encode data using xor

Disassembly:
jmp 0xee8642
or eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xee8648
pop ebp
sub ebp, 0x10
sub ebp, 0xae8638
jmp 0xee865e
mov eax, 0xae8638
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x36a75e94
xor byte [eax], dl
inc eax
dec ecx
jne 0xee8675
jmp 0xee8688
pop ds
pop ecx
pop ds
sbb eax, 0x949494a8
adc eax, 0x94946c55
xchg esp, eax
xchg edi, eax
pop ecx
sub al, 0x91
xchg esp, eax
xchg esp, eax
xchg esp, eax
mov esp, 0x63949494
jbe 0xee863c
pop esp
pop ds
adc eax, 0x94949498
xchg edi, eax
push ecx
les ebx, [ecx]
invalid