joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10198ba0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.10146cf0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x102b50b0]
mov esi, eax
add esp, 8
test esi, esi
je 0x10198d22
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x10198c22
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10198c93
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x10198c50
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x10198cc5
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x101c9e65
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x101c9e66
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x10198ca0
push dword [esp + 0x30]
call fcn.10146cf0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x10198cf0
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x102b50b4]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x10198df0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10198e16
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x10198e4e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.10146cf0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x10198ea5
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x10198eb4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10198ec5
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x10199b00
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x10199b4c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x10199b11
pop ebx
pop edi
pop esi
ret
Function at 0x10001420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
ret

Function at 0x10001743
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10001833
mov eax, 0x94
call fcn.100028a0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100018a8
mov ecx, dword [esi + 0x10]
mov dword [0x10014698], ecx
mov eax, dword [esi + 4]
mov dword [0x100146a4], eax
mov edx, dword [esi + 8]
mov dword [0x100146a8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1001469c], esi
je 0x100017ae
or esi, 0x8000
mov dword [0x1001469c], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100146a0], eax
call fcn.100027bf
test eax, eax
pop ecx
je 0x100018a8
call fcn.10001f16
test eax, eax
jne 0x100017db
call fcn.10002810
jmp 0x100018a8
call fcn.1000271d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10014eb4], eax
call fcn.100025fb
mov dword [0x10014684], eax
call fcn.100020dc
test eax, eax
jl 0x1000182c
call fcn.10002559
test eax, eax
jl 0x10001827
call fcn.10002326
test eax, eax
jl 0x10001827
push 0
call fcn.10001b7d
test eax, eax
pop ecx
jne 0x10001827
inc dword [0x10014680]
jmp 0x100018b9
call fcn.100022da
call fcn.10001cf3
jmp 0x100017d1
test eax, eax
jne 0x10001863
cmp dword [0x10014680], eax
jle 0x100018a8
dec dword [0x10014680]
cmp dword [0x100146d4], eax
jne 0x10001852
call fcn.10001ccc
call fcn.100022da
call fcn.10001cf3
call fcn.10002810
jmp 0x100018b9
cmp eax, 2
jne 0x100018ac
push 0x8c
push 1
call fcn.10002005
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x100018a8
push esi
push dword [0x10013d64]
call dword [0x100146e4]
test eax, eax
push esi
je 0x100018a2
call fcn.10001d10
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x100018b9
call fcn.10001a94
pop ecx
xor eax, eax
jmp 0x100018bc
cmp eax, 3
jne 0x100018b9
push 0
call fcn.10001edb
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x10001be7
Capabilities:
Terminate process

Disassembly:
push 8
push 0x1000f920
call fcn.10002a88
push 8
call fcn.10002f23
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100146d8], esi
jne 0x10001c1b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100146d4], esi
mov al, byte [ebp + 0x10]
mov byte [0x100146d0], al
cmp dword [ebp + 0xc], edi
jne 0x10001c65
cmp dword [0x10014ea8], edi
je 0x10001c55
mov eax, dword [0x10014ea4]
sub eax, 4
mov dword [0x10014ea4], eax
cmp eax, dword [0x10014ea8]
jb 0x10001c55
mov eax, dword [eax]
cmp eax, edi
je 0x10001c36
call eax
jmp 0x10001c36
push 0x10012020
mov eax, 0x1001201c
call fcn.10001b47
pop ecx
push 0x10012028
mov eax, 0x10012024
call fcn.10001b47
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10001c96
cmp dword [ebp + 0x10], edi
jne 0x10001ca4
mov dword [0x100146d8], esi
push dword [ebp + 8]
call fcn.10001b05
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10001ca3
push 8
call fcn.10002e56
pop ecx
ret
call fcn.10002ac3
ret

Function at 0x10002bdd
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x100142c0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10013e18]
je 0x10002c14
inc eax
cmp eax, 0x13
jb 0x10002c05
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10013e18]
jne 0x10002d37
mov eax, dword [0x1001468c]
cmp eax, 1
je 0x10002d12
cmp eax, edx
jne 0x10002c44
cmp dword [0x10014690], 1
je 0x10002d12
cmp ecx, 0xfc
je 0x10002d37
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10002c7a
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.10005190
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.10005290
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10002cae
mov eax, edi
push eax
call fcn.10005290
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x1000fda0
push edi
call fcn.10005a70
add esp, 0x10
push edi
call fcn.10005290
push dword [esi + 0x10013e1c]
mov ebx, eax
call fcn.10005290
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.100028a0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10005190
push edi
push ebx
call fcn.100051a0
push 0x1000fd80
push ebx
call fcn.100051a0
push dword [esi + 0x10013e1c]
push ebx
call fcn.100051a0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10005977
add esp, 0x2c
jmp 0x10002d37
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x10013e1c]
push dword [esi]
call fcn.10005290
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.10005bc5
add ebp, 0x90
leave
ret
Function at 0x10005977
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100149bc], ebx
push esi
push edi
jne 0x100059f7
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10005a32
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x100149bc], eax
je 0x10005a32
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x100149c0], eax
call esi
cmp dword [0x10014698], 2
mov dword [0x100149c4], eax
jne 0x100059f7
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x100149cc], eax
je 0x100059f7
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x100149c8], eax
mov eax, dword [0x100149c8]
test eax, eax
je 0x10005a3c
call eax
test eax, eax
je 0x10005a23
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100149cc]
test eax, eax
je 0x10005a23
test byte [ebp - 8], 1
jne 0x10005a3c
cmp dword [0x100146a4], 4
jb 0x10005a36
or byte [ebp + 0x12], 0x20
jmp 0x10005a5b
xor eax, eax
jmp 0x10005a6b
or byte [ebp + 0x12], 4
jmp 0x10005a5b
mov eax, dword [0x100149c0]
test eax, eax
je 0x10005a5b
call eax
mov ebx, eax
test ebx, ebx
je 0x10005a5b
mov eax, dword [0x100149c4]
test eax, eax
je 0x10005a5b
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100149bc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100094de
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.100028a0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10009579
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x10014698]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10009579
cmp eax, 1
je 0x1000959a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10009579
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10009546
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10009575
xor eax, eax
inc eax
jmp 0x100095b9
cmp edi, eax
jae 0x1000957d
xor eax, eax
jmp 0x100095b9
cmp eax, esi
jae 0x10009584
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10014698]
jmp 0x1000959d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a030
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x100117c8
call fcn.10002a88
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x10014b10], edi
jne 0x1000a074
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000a05f
mov dword [0x10014b10], ebx
jmp 0x1000a074
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000a074
mov dword [0x10014b10], 2
mov eax, dword [0x10014b10]
cmp eax, ebx
jne 0x1000a094
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000a157
cmp eax, 2
je 0x1000a09d
cmp eax, edi
jne 0x1000a0c5
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x1000a0b0
mov eax, dword [0x10014a18]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1000a0cc
xor eax, eax
jmp 0x1000a157
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.100028a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1000a0ff
cmp esi, edi
jne 0x1000a115
push dword [ebp - 0x20]
call fcn.10001a82
pop ecx
mov esi, eax
cmp esi, edi
je 0x1000a0c5
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1000a148
cmp dword [ebp + 0x14], edi
jne 0x1000a132
push edi
push edi
jmp 0x1000a138
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x1000a154
push esi
call fcn.10001a94
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.10002ac3
ret
Function at 0x1000a160
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x100117d8
call fcn.10002a88
xor esi, esi
cmp dword [0x10014b14], esi
jne 0x1000a1a4
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000a18f
mov dword [0x10014b14], edi
jmp 0x1000a1a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000a1a4
mov dword [0x10014b14], 2
mov eax, dword [0x10014b14]
cmp eax, 2
je 0x1000a285
cmp eax, esi
je 0x1000a285
cmp eax, 1
jne 0x1000a1e9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x1000a1d2
mov eax, dword [0x10014a18]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x1000a1f0
xor eax, eax
jmp 0x1000a297
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.100028a0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x1000a226
cmp edi, esi
jne 0x1000a241
lea eax, [ebx + ebx]
push eax
call fcn.10001a82
pop ecx
mov edi, eax
cmp edi, esi
je 0x1000a1e9
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000a274
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x1000a25e
push esi
push esi
jmp 0x1000a264
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1000a280
push edi
call fcn.10001a94
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x1000a297
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.10002ac3
ret
Function at 0x1000aaa7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x1000aac0
or eax, 0xffffffff
jmp 0x1000ab21
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x1000ab1d
push 0x3d
push esi
call fcn.1000aca8
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x1000ab1d
cmp esi, eax
je 0x1000ab1d
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x100146b8]
sete cl
cmp eax, dword [0x100146bc]
mov dword [ebp - 4], ecx
jne 0x1000ab03
mov edi, eax
call fcn.1000aa46
mov dword [0x100146b8], eax
cmp eax, ebx
jne 0x1000ab5c
cmp dword [ebp + 0xc], ebx
je 0x1000ab25
cmp dword [0x100146c0], ebx
je 0x1000ab25
call fcn.1000a5c3
test eax, eax
je 0x1000ab5c
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x1000ab2e
xor eax, eax
jmp 0x1000ab20
push 4
call fcn.10001a82
cmp eax, ebx
pop ecx
mov dword [0x100146b8], eax
je 0x1000ab1d
mov dword [eax], ebx
cmp dword [0x100146c0], ebx
jne 0x1000ab5c
push 4
call fcn.10001a82
cmp eax, ebx
pop ecx
mov dword [0x100146c0], eax
je 0x1000ab1d
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x100146b8]
sub edi, esi
push esi
call fcn.1000a9f9
mov edi, eax
test edi, edi
pop ecx
jl 0x1000abc3
cmp dword [ebx], 0
je 0x1000abc3
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.10001a94
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x1000aba3
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1000ac04
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x1000ab9a
mov eax, edi
shl eax, 2
push eax
push dword [0x100146b8]
call fcn.10005f9d
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x1000ac04
jmp 0x1000abff
cmp dword [ebp - 4], 0
jne 0x1000ac6b
test edi, edi
jge 0x1000abd3
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x100146b8]
call fcn.10005f9d
test eax, eax
pop ecx
pop ecx
je 0x1000ab1d
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x100146b8], eax
cmp dword [ebp + 0xc], 0
je 0x1000ac56
push esi
call fcn.10005290
inc eax
inc eax
push eax
call fcn.10001a82
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1000ac56
push esi
push edi
call fcn.10005190
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x1000ac4f
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.10001a94
pop ecx
cmp dword [ebp - 4], 0
je 0x1000ac63
push esi
call fcn.10001a94
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x1000ab20
push esi
call fcn.10001a94
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x1000ab2a
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov edi, dword [edx + 0x5678ec83]
fidiv word [ebp + 0xc]
dec byte [ebp + 0x156a8845]
push eax
push esi
call 0x7e4086e0
xchg ebp, eax
dec ebp
or byte [ebx + 0x40c0c315], cl
add byte [ebp + 0x40c283b1], cl
push 0xd740d4ac
push edx
call dword [0x71c180]
test byte [ecx + 2], 0x41
add byte [ebx + 0x7a8514c4], al
je 0x401e8c
push eax
push str.Total_of__d_requests_completed_n
call dword [0x85c164]
and dword [edx + 0x15ff5608], esp
jo 0x401e52
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
inc eax
add byte [esi - 0x70], bl
nop
nop
nop
nop
or byte [eax - 0x6fe56f70], dl
nop
push ebp
mov ebp, esp
pop ebp
inc ebx
adc al, 0x53
push esi
mov esi, dword [ebp + 8]
fisttp qword [ebx + 0x1a811446]
or al, ch
dec ecx
dec ebx
add byte [eax], al
mov dword [0x72410ba0], eax
mov dword [esp - 0x74ffbef5], esi
mov eax, 0x8562468b
mov edi, edx
invalid

Function at 0x4067e4
Capabilities:
Packed with generic packer

Disassembly:
jne 0x406850
add byte [ebx + 0x6a], dl
add dword [ecx + 0x518b1450], ecx
mov ebp, dword [ebx - 0x74e5a5ec]
push es
mov dword [eax + 0x34], 0xd67b0001
mov ecx, dword [esi]
add ecx, 0x36
pop ds
call 0x8e0f6079
lodsb al, byte [esi]
je 0x406866
xchg bl, al
nop
nop
nop
inc ebx
add al, 0x83
clc
dec dword [edi]
test byte [ecx + eax + 0x678b0000], dl
adc byte [edi - 0x767bf037], dh
add dword [eax], eax
add al, 0x8b
jne 0x406875
rol dword [eax], 0xcc
jo 0x40687a
dec dword [edi]
test dword [edi], esi
jns 0x406821
jne 0xe1e1b8
add byte [ebx + 0x40c1d835], cl
add bh, bh
salc
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call esi
test eax, eax
mov al, 0xf8
xor eax, 0xff000000
salc
dec ecx
cmp ah, 0x4a
add byte [0xb23b3], bh
jne 0x4069f4
mov edi, dword [ebx + 0x20]
add byte [ebx + 0x24], dh
mov eax, edi
or eax, esi
jne 0x40691e
pop edi
mov dl, 0xc5
mov ah, 0x23
xor eax, 0x898b5b00
pop ebp
sub dword [eax], ecx
add byte [ebx + 0x51b91943], cl
add byte [eax], al
add byte [ebp - 0xb7a810a], al
std
invalid
push edx
push 0
das
call dword ss:[0xae40c1c4]
test al, bh
dec dword [ecx + 0x4d740845]
test eax, eax
ror dword [esi], 1
pop edi
pop esi
mov eax, 0xeaf323cc
pop ebx
mov edi, dword [ebx]
pop ebp
ret 8

Function at 0x40a940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0x1b
mov gs, edi
stosb byte es:[edi], al
jb 0x40a90f
dec ebx
cmp dword [esi - 0x6752f615], ecx
fistp word [ecx - 0x679ca736]
inc esi