joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10070bb9
Capabilities:
Hash data with crc32

Disassembly:
jge 0x10070bcb
mov edx, dword [ebx]
xor edx, ecx
mov ecx, dword [ebx + 4]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a78e8]
movzx eax, dl
call 0x1f171648
mov dh, 0xc2
shr edx, 8
xor edx, dword [eax*4 + 0x100a78e8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a78e8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a78e8]
xor ecx, edx
mov edx, dword [ebx + 8]
xor ecx, dword [ebp - 4]
movzx eax, cl
shr ecx, 8
mov ebx, dword [ebx + 0xc]
xor ecx, dword [eax*4 + 0x100a78e8]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a78e8]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a78e8]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a78e8]
xor edx, ecx
xor edx, esi
mov esi, dword [ebp + 0xc]
movzx eax, dl
shr edx, 8
mov ecx, dword [esi + 0x10]
xor edx, dword [eax*4 + 0x100a78e8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a78e8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a78e8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a78e8]
xor ebx, edx
xor ebx, dword [ebp - 8]
movzx eax, bl
shr ebx, 8
xor ebx, dword [eax*4 + 0x100a78e8]
invalid
invalid

Function at 0x10070c87
Capabilities:
Hash data with crc32

Disassembly:
ret

Function at 0x10070d6f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test eax, ebp
js 0x10070d7d
adc byte [edi], cl
mov dh, 0x43
push es

Function at 0x100726de
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001

Function at 0x10074333
Capabilities:
Print debug messages

Disassembly:
call 0x100e7abb
mov eax, 0x10000000
mov dword [esi], 0x38
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0xe00
mov dword [esi + 0x10], 0x100a9e20
call fcn.1007dd90
test eax, eax
jns 0x1007437f
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10074378
push str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x100c28ad], 1
mov eax, esi
pop esi
ret

Function at 0x1007828c
Capabilities:
Set thread local storage value

Disassembly:
add byte [ebx - 0xf74ef3c], al
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x100782a8
mov ecx, esi
call dword [0x1009f398]
call esi
jmp 0x100782ae
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x10082bf7
Capabilities:
Read file on windows

Disassembly:
add byte [ecx + 0x5052026a], bl
call 0x100f5992
mov ecx, ebx
mov dword [ebp - 0x1008], eax
and ecx, 0x3f
mov dword [ebp - 0x1014], edx
mov esi, ebx
imul edi, ecx, 0x38
sar esi, 6
push 0
mov ecx, dword [esi*4 + 0x100c2468]
push dword [edi + ecx + 0x24]
push dword [edi + ecx + 0x20]
and byte [ebx - 0x18], dl
cwde
outsd dx, dword [esi]
or byte [eax], al
invalid
or al, 0xb5
invalid
Function at 0x10082bfa
Capabilities:
Read file on windows

Disassembly:
add byte [ecx + 0x5052026a], bl
call 0x100f5992
mov ecx, ebx
mov dword [ebp - 0x1008], eax
and ecx, 0x3f
mov dword [ebp - 0x1014], edx
mov esi, ebx
imul edi, ecx, 0x38
sar esi, 6
push 0
mov ecx, dword [esi*4 + 0x100c2468]
push dword [edi + ecx + 0x24]
push dword [edi + ecx + 0x20]
and byte [ebx - 0x18], dl
cwde
outsd dx, dword [esi]
or byte [eax], al
invalid
or al, 0xb5
invalid

Function at 0x10082c2b
Capabilities:
Read file on windows

Disassembly:
add byte [ecx + 0x5052026a], bl
call 0x100f5992
mov ecx, ebx
mov dword [ebp - 0x1008], eax
and ecx, 0x3f
mov dword [ebp - 0x1014], edx
mov esi, ebx
imul edi, ecx, 0x38
sar esi, 6
push 0
mov ecx, dword [esi*4 + 0x100c2468]
push dword [edi + ecx + 0x24]
push dword [edi + ecx + 0x20]
and byte [ebx - 0x18], dl
cwde
outsd dx, dword [esi]
or byte [eax], al
invalid
or al, 0xb5
invalid

Function at 0x1008778b
Capabilities:
Create thread

Disassembly:
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x100877b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call 0x100ff16c
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
invalid

Function at 0x10089240
Capabilities:
Parse pe header
Terminate process

Disassembly:
jne 0x1008924a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleW
test eax, eax
je 0x10089289
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10089289
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10089289
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10089289
cmp dword [ecx + 0x74], 0xe
jbe 0x10089289
cmp dword [ecx + 0x88684e8], 0
je 0x10089289
mov al, 1
ret
xor al, al
ret
Function at 0x1008a990
Capabilities:
Read file on windows

Disassembly:
movzx ecx, word [edx]
cmp cx, ax
je 0x1008aa4f
lea eax, [edx + 2]
cmp cx, word [ebp - 0x14]
je 0x1008a958
mov word [esi], cx
mov edx, eax
add esi, 2
jmp 0x10114799
cmp eax, dword [ebp - 0xc]
jae 0x1008a986
lea ebx, [esi + 2]
push 0xa
mov dword [ebp - 8], ebx
pop ebx
cmp word [eax], bx
jne 0x1008a971
mov eax, ebx
push 4
jmp 0x1008a975
mov eax, ecx
push 2
mov ebx, dword [ebp + 0xc]
pop ecx
mov word [esi], ax
add edx, ecx
mov esi, dword [ebp - 8]
clc
jmp 0x101147c7
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
push 2
add cl, byte [ebp - 0xaf03bb]
jne 0x1008a980
add cl, byte [ebp - 0xaf03bb]
jne 0x1008a980
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1008aa35
cmp dword [ebp - 0x1c], 0
je 0x1008aa35
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x100c2468]
test byte [edi + eax + 0x28], 0x48
je 0x1008aa0e
mov dx, word [ebp - 4]
lea eax, [esi + 2]
mov dword [ebp - 0x24], eax
cmp dx, word [ebp - 0x20]
jne 0x1008a9d9
push 0xa
pop ecx
mov word [esi], cx
jmp 0x1008aa0a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x100c2468]
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ecx*4 + 0x100c2468]
shr dx, 8
mov byte [edi + eax + 0x2b], dl
mov eax, dword [ecx*4 + 0x100c2468]
pop ecx
mov byte [edi + eax + 0x2c], cl
dec esp
pop es
sub al, 0x8b
inc ebp
invalid
mov esi, eax
jmp 0x1008aa3e
push 0xa
pop eax
cmp word [ebp - 4], ax
jne 0x1008aa1b
cmp esi, ebx
je 0x1008aa38
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call 0x101119dc
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1008aa3e
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov edx, dword [ebp - 8]
push 0x1a
pop eax
cmp edx, dword [ebp - 0xc]
jb 0x1008a936
jmp 0x1008aa72
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x100c2468]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1008aa69
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1008aa72
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1008ae99
Capabilities:
Read file on windows

Disassembly:
add al, ch
mov ch, 0xbb
or byte [eax], al
add esp, 0xc
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x1008aec4
call 0x101028a7
mov dword [eax], 0xc
call 0x1010289f
mov dword [eax], 8
jmp 0x101152ec
push 1
push 0
push 0
push ebx
call 0x10111e83
mov ecx, dword [ebp - 8]
add esp, 0x10
mov ecx, dword [ecx*4 + 0x100c2468]
mov dword [edi + ecx + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [edi + ecx + 0x24], edx
mov edx, esi
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x100c2468]
mov ebx, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x24], edx
test byte [ebx + eax + 0x28], 0x48
mov ebx, dword [ebp + 8]
je 0x1008afc9
mov ebx, dword [ebp - 0x10]
mov al, byte [ebx + eax + 0x2a]
mov ebx, dword [ebp + 8]
cmp al, 0xa
je 0x1008afc9
test ecx, ecx
je 0x1008afc9
mov ebx, dword [ebp - 0x10]
inc edi
mov byte [edx], al
inc edx
mov eax, dword [ebp - 8]
dec ecx
cmp byte [ebp - 1], 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [eax*4 + 0x100c2468]
mov byte [ebx + eax + 0x2a], 0xa
mov ebx, dword [ebp + 8]
je 0x1008afc9
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x100c2468]
mov al, byte [ebx + eax + 0x2b]
mov ebx, dword [ebp + 8]
cmp al, 0xa
je 0x1008afc9
test ecx, ecx
je 0x1008afc9
mov ebx, dword [ebp - 0x10]
mov byte [edx], al
inc edx
mov eax, dword [ebp - 8]
dec ecx
cmp byte [ebp - 1], 1
push 2
mov dword [ebp - 0x14], edx
mov eax, dword [eax*4 + 0x100c2468]
pop edi
mov dword [ebp - 0xc], ecx
mov byte [ebx + eax + 0x2b], 0xa
mov ebx, dword [ebp + 8]
jne 0x1008afc9
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x100c2468]
mov al, byte [ebx + eax + 0x2c]
mov ebx, dword [ebp + 8]
cmp al, 0xa
je 0x1008afc9
test ecx, ecx
je 0x1008afc9
mov byte [edx], al
Function at 0x1008aff5
Capabilities:
Read file on windows

Disassembly:
test eax, eax
je 0x1008b045
cmp byte [ebp - 1], 2
jne 0x1008b049
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
shr eax, 1
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
adc eax, sym.imp.KERNEL32.dll_ReadConsoleW
test eax, eax
jne 0x1008b03a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call 0x101029ea
pop ecx
or edi, 0xffffffff
push esi
call 0x10116be6
pop ecx
mov eax, edi
pop esi
jmp 0x1011554a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x10]
lea edi, [edi + eax*2]
jmp 0x1008b06e
mov byte [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1008b0bd
mov ecx, dword [ebp + 0x10]
cmp dword [ebp - 0x1c], ecx
ja 0x1008b0bd
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x100c2468]
cmp byte [edx + eax + 0x28], 0
jge 0x1008b02b
cmp byte [ebp - 1], 2
je 0x1008b09f
shr ecx, 1
push ecx
push dword [ebp + 0xc]
push edi
push dword [ebp - 0x14]
push ebx
call 0x10114f16
add esp, 0x14
mov edi, eax
jmp 0x1008b02b
shr edi, 1
cmp byte [ebp - 0x20], 0
push edi
push dword [ebp - 0x24]
push ebx
je 0x1008b0b6
call 0x10115086
add esp, 0xc
jmp 0x1008b09b
call 0x10114d8a
jmp 0x1008b0b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop edi
cmp eax, edi
jne 0x1008b0e1
call 0x10102ac8
mov dword [eax], 9
call 0x10102ac0
mov dword [eax], edi
jmp 0x10115509
cmp eax, 0x6d
jne 0x1008b021
xor edi, edi
jmp 0x1011551c

Function at 0x1008b1bf
Capabilities:
Write file on windows

Disassembly:
aam 0x8b
ret

Function at 0x1008b308
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ebp - 0x2c]
push 2
mov byte [ecx + eax + 0x2d], dl
lea eax, [ebp - 0x14]
push eax
jmp 0x1008b35a
lea eax, [ebp - 0x48]
push eax
call 0x101170e2
add esp, 0xc
cmp eax, 0xffffffff
je 0x1008b497
push ebx
push ebx
push 5
lea eax, [ebp - 0x1c]
inc edi
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x64], edi
push eax
push ebx
push dword [ebp - 0x78]

Function at 0x1008b319
Capabilities:
Write file on windows

Disassembly:
mov byte [ebp - 0x1d], al
call 0x10112d34
movzx ecx, byte [ebp - 0x1d]
jecxz 0x1008b38c
cmp dword [eax + ecx*2], ebx
jge 0x1008b357
lea eax, [edi + 1]
push 1
push edi

Function at 0x1008b32e
Capabilities:
Write file on windows

Disassembly:
mov dword [ebp - 0x34], eax
cmp eax, dword [ebp - 0x5c]
jae 0x1008b46b
push 2
lea eax, [ebp - 0x48]
push edi
push eax
call 0x101170c5
add esp, 0xc
cmp eax, 0xffffffff
je 0x1008b497
mov edi, dword [ebp - 0x34]
jmp 0x1008b36f
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
mov bl, byte [ebp - 0x1d]
mov eax, dword [edx*4 + 0x100c2468]
mov byte [ecx + eax + 0x2e], bl
mov eax, dword [edx*4 + 0x100c2468]
or byte [ecx + eax + 0x2d], 4
Function at 0x1008b386
Capabilities:
Write file on windows

Disassembly:
call 0x1011d65a
add esp, 0x20
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1008b497
push ebx
lea ecx, [ebp - 0x60]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je fcn.1008b48e
mov esi, dword [ebp - 0x50]
sub esi, dword [ebp - 0x68]
mov eax, dword [ebp - 0x34]
add esi, edi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x60], eax
inc ebp
mov al, byte [0xcc820f]
add byte [eax], al
cmp byte [ebp - 0x2f], 0xa
jne fcn.1008b405
push 0xd
pop eax
push ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x60]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je fcn.1008b48e
invalid
add byte [eax], al
invalid
cmp dword [ebp - 0x60], 1
jb 0x1008b497
inc dword [ebp - 0x50]
inc esi
mov dword [ebp - 0x54], esi

Function at 0x1008b3c3
Capabilities:
Write file on windows

Disassembly:
call 0x1011d65a
add esp, 0x20
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1008b497
push ebx
lea ecx, [ebp - 0x60]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je fcn.1008b48e
mov esi, dword [ebp - 0x50]
sub esi, dword [ebp - 0x68]
mov eax, dword [ebp - 0x34]
add esi, edi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x60], eax
inc ebp
mov al, byte [0xcc820f]
add byte [eax], al
cmp byte [ebp - 0x2f], 0xa
jne fcn.1008b405
push 0xd
pop eax
push ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x60]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je fcn.1008b48e
invalid
add byte [eax], al
invalid
cmp dword [ebp - 0x60], 1
jb 0x1008b497
inc dword [ebp - 0x50]
inc esi
mov dword [ebp - 0x54], esi

Function at 0x1008b5b7
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [ebp + 0x14]
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [eax*4 + 0x100c2468]
push esi
push edi
mov edi, ebx
mov eax, dword [eax + ecx + 0x18]
mov ecx, dword [ebp + 0x10]
add edx, ecx
mov dword [ebp - 0x1408], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x140c], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp ecx, edx
jae 0x1008b663
mov edi, dword [ebp - 0x1408]
Function at 0x1008b5ff
Capabilities:
Write file on windows

Disassembly:
lea esi, [ebp - 0x1404]
cmp ecx, edx
jae 0x1008b618
invalid
sbb byte [edx + 0xa3c4101], cl
mov al, byte [ecx]
inc ecx
cmp al, 0xa
jne 0x1008b60e
inc dword [ebx + 8]
mov byte [esi], 0xd
inc esi
mov byte [esi], al
inc esi
lea eax, [ebp - 5]
cmp esi, eax
jb 0x1008b5fc
lea eax, [ebp - 0x1404]
mov dword [ebp + 0x10], ecx
sub esi, eax
lea eax, [ebp - 0x1408]
push 0
push eax
push esi
lea eax, [ebp - 0x1404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1008b65b
mov eax, dword [ebp - 0x1408]
add dword [ebx + 4], eax
cmp eax, esi
jb 0x1008b663
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x140c]
cmp ecx, edx
jb 0x1008b5f6
jmp 0x1008b663
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
invalid
dec ebp

Function at 0x1008b615
Capabilities:
Write file on windows

Disassembly:
lea esi, [ebp - 0x1404]
cmp ecx, edx
jae 0x1008b618
invalid
sbb byte [edx + 0xa3c4101], cl
mov al, byte [ecx]
inc ecx
cmp al, 0xa
jne 0x1008b60e
inc dword [ebx + 8]
mov byte [esi], 0xd
inc esi
mov byte [esi], al
inc esi
lea eax, [ebp - 5]
cmp esi, eax
jb 0x1008b5fc
lea eax, [ebp - 0x1404]
mov dword [ebp + 0x10], ecx
sub esi, eax
lea eax, [ebp - 0x1408]
push 0
push eax
push esi
lea eax, [ebp - 0x1404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1008b65b
mov eax, dword [ebp - 0x1408]
add dword [ebx + 4], eax
cmp eax, esi
jb 0x1008b663
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x140c]
cmp ecx, edx
jb 0x1008b5f6
jmp 0x1008b663
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
invalid
dec ebp

Function at 0x1008b6dc
Capabilities:
Write file on windows

Disassembly:
lea esi, [ebp - 0x1404]
cmp ecx, edx
jae 0x1008b6f8
movzx eax, word [ecx]
add ecx, 2
cmp eax, 0xa
jne 0x1008b6eb
add dword [ebx + 8], 2
push 0xd
pop edi
mov word [esi], di
add esi, 2
mov word [esi], ax
add esi, 2
lea eax, [ebp - 6]
cmp esi, eax
jb 0x1008b6cf
mov edi, dword [ebp - 0x1408]
lea eax, [ebp - 0x1404]
sub esi, eax
mov dword [ebp + 0x10], ecx
push 0
lea eax, [ebp - 0x140c]
and esi, 0xfffffffe
push eax
push esi
lea eax, [ebp - 0x1404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1008b744
mov eax, dword [ebp - 0x140c]
add dword [ebx + 4], eax
cmp eax, esi
jb 0x1008b74c
mov ecx, dword [ebp + 0x10]
invalid
xchg ebp, eax

Function at 0x1008ba00
Capabilities:
Write file on windows

Disassembly:
punpckhdq mm0, qword [edx]
push 0
push 0
push esi
call 0x101129c0
add esp, 0x10
push esi
call 0x1011633e
pop ecx
test al, al
je 0x1008ba54
test bl, bl
je 0x1008ba41
dec bl
cmp bl, 1
ja 0x1008bb1e
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push edi
push eax
invalid
invalid
invalid

Function at 0x10092cff
Capabilities:
Clear file content

Disassembly:
jne 0x10092d0d
push ebx
call 0x10124da4
mov eax, dword [ebp - 0x28]
and eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
je 0x10092e39
and eax, dword [ecx]
add byte [eax], al
Function at 0x10092d12
Capabilities:
Clear file content

Disassembly:
and eax, dword [ecx]
add byte [eax], al
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
je 0x10092e39
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], eax
test eax, eax
jl 0x10092df5
jg 0x10092d40
test edi, edi
je 0x10092deb
push 1
push 0x1000
call 0x10123495
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10092d61
push 0x8000
push ebx
call 0x10124d3a
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
pop ecx
test eax, eax
jg 0x10092dc2
jl 0x10092df5
test edi, edi
jae 0x10092dc2
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call 0x10119db6
mov bl, 0x6f
or byte [eax], al

Function at 0x10092dff
Capabilities:
Clear file content

Disassembly:
xor edi, edi
jmp 0x10092e40
mov bl, 0x6f
or byte [eax], al
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x10092e39
push ebx
call 0x1012482f
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10092dc2
call 0x1010a81d
mov dword [eax], 0xd
call 0x1010a815
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
call 0x1010a837
mov edi, dword [eax]

Function at 0x10094547
Capabilities:
Enumerate files on windows

Disassembly:
cwde
add al, byte [eax]
add byte [ecx + 0x100bd044], ah
mov eax, dword [0x100bd044]

Function at 0x1009461c
Capabilities:
Enumerate files on windows

Disassembly:
sbb eax, eax
push ebx
push ebx
push ebx
push ecx
not eax
and eax, dword [ebp - 0x290]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10094651
push dword [ebp - 0x25c]
push ebx
push ebx
push edi
invalid
invalid

Function at 0x10095343
Capabilities:
Set environment variable

Disassembly:
les edx, [eax]
mov eax, edi
test esi, esi
je 0x100953a4
jmp 0x1009539e
mov dword [0x100c2424], esi
cmp dword [ebp + 0xc], ebx
je 0x10095435
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100953b2
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 2]
push eax
mov dword [ebp - 8], eax
call 0x10125b18
mov esi, eax
pop ecx
pop ecx
test esi, esi

Function at 0x10095389
Capabilities:
Set environment variable

Disassembly:
je 0x10095432
mov ecx, dword [ebp - 4]
mov edi, ebx
mov eax, dword [ebp + 8]
mov dword [esi + ecx*4], eax
mov dword [esi + ecx*4 + 4], ebx
or ebx, 0xffffffff

Function at 0x100953d5
Capabilities:
Set environment variable

Disassembly:
je 0x1009541e
mov eax, dword [ebp + 8]
push eax
push dword [ebp - 8]
push esi
call 0x10124646
add esp, 0xc
test eax, eax
jne 0x10095443
mov eax, dword [ebp - 0xc]
inc eax
lea ecx, [esi + eax*2]
xor eax, eax
mov word [ecx - 2], ax
mov eax, dword [ebp - 0x10]
movzx eax, ax
neg eax
sbb eax, eax
and eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x1009541e
call 0x1010ce0e
or ebx, 0xffffffff
mov dword [eax], 0x2a
push esi
call 0x10120fd9
pop ecx
jmp 0x10095435
push edi
call 0x10120ff0
pop ecx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
push ebx
push ebx
push ebx
push ebx
push ebx
call 0x1010cd99
int3
Function at 0x10098f1e
Capabilities:
Get geographical location

Disassembly:
inc esp
ror byte [ebx], 1
adc byte [ebx], dh
lds ecx, [ecx + 0x5653fc45]
mov esi, dword [ebp + 8]
push edi
call 0x10124895
mov ebx, eax
call 0x1012489c
push esi
mov edi, dword [eax + 0x34c]
call 0x1013157f
pop ecx
mov ecx, dword [ebx + 0x64]
mov esi, eax
neg ecx
lea eax, [ebp - 0xf4]
push 0x78
sbb ecx, ecx

Function at 0x10098f57
Capabilities:
Get geographical location

Disassembly:
and ecx, 0xfffff005
push eax
add ecx, 0x1002
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 0xf8], 0
test eax, eax
je 0x1009914f
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x54]
call 0x1011c269
pop ecx
pop ecx
test eax, eax
jne 0x10099049
push 0x78
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebx + 0x60]
neg eax
sbb eax, eax
and eax, 0xfffff002
add eax, 0x1001
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1009914f
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1011c2ac
pop ecx
pop ecx
mov ecx, dword [edi]
test eax, eax
jne 0x10098fe2
or ecx, 0x304
mov dword [edi + 4], esi
mov dword [edi], ecx
jmp 0x10099046
test cl, 2
jne 0x10099049
cmp dword [ebx + 0x5c], 0
je 0x1009902f
push dword [ebx + 0x5c]
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1012dd06
add esp, 0xc
test eax, eax
jne 0x1009902f
or dword [edi], 2
mov dword [edi + 8], esi
mov ecx, dword [ebx + 0x50]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xf8]
jne 0x10099012
sub ecx, edx
sar ecx, 1
cmp ecx, dword [ebx + 0x5c]
jne 0x10099049
mov dword [edi + 4], esi
jmp 0x10099049
mov edx, dword [edi]
test dl, 1
jne 0x10099049
push esi
call 0x101317a8
pop ecx
test eax, eax
je 0x10099049
or edx, 1
mov dword [edi], edx
mov dword [edi + 8], esi
mov eax, dword [edi]
mov ecx, 0x300
and eax, ecx
cmp eax, ecx
je 0x10099143
push 0x78
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebx + 0x60]
neg eax
sbb eax, eax
and eax, 0xfffff002
add eax, 0x1001
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1009914f
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1011c372
pop ecx
pop ecx
test eax, eax
jne 0x10099103
mov ecx, dword [edi]
or ecx, 0x200
mov dword [edi], ecx
cmp dword [ebx + 0x60], eax
je 0x100990b8
cmp dword [ebx + 0x5c], eax
je 0x100990a8
mov edx, dword [ebx + 0x50]
lea eax, [edx + 2]
mov dword [ebp - 0xfc], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0xf8]
jne 0x100990c9
sub edx, dword [ebp - 0xfc]
sar edx, 1
cmp edx, dword [ebx + 0x5c]
xor eax, eax
cmp dword [ebx + 0x60], eax
jne 0x10099143
cmp dword [ebx + 0x5c], eax
je 0x10099143
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x50]
call 0x1011c3fd
pop ecx
pop ecx
test eax, eax
jne 0x10099143
push edi
xor ebx, ebx
push ebx
push esi
call 0x101318bf
xchg dword [ecx], ecx
add byte [ebx - 0x3f7af33c], al
je 0x10099143
or dword [edi], 0x100
cmp dword [edi + 4], ebx
jne 0x10099143
mov dword [edi + 4], esi
xor eax, eax
mov dword [edi], eax
inc eax