joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40fba0
cmp edx, dword [eax]
je 0x4059df
add eax, 8
inc ecx
cmp eax, 0x40fc30
jl 0x4059d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40fba0]
jne 0x405b0d
mov eax, dword [0x41f1f0]
cmp eax, 1
je 0x405ae7
test eax, eax
jne 0x405a10
cmp dword [0x40faec], 1
je 0x405ae7
cmp edx, 0xfc
je 0x405b0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405a47
lea eax, [ebp - 0x1a4]
push 0x408420
push eax
call fcn.004067c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405a8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40841c
push edi
call fcn.00406940
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x408400
push eax
call fcn.004067c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004067d0
lea eax, [ebp - 0xa0]
push 0x4083fc
push eax
call fcn.004067d0
push dword [esi + 0x40fba4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004067d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4083d4
push eax
call fcn.004068b0
add esp, 0x2c
pop edi
jmp 0x405b0d
lea eax, [ebp + 8]
lea esi, [esi + 0x40fba4]
push 0
push eax
push dword [esi]
call fcn.00405e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
pop esi
leave
ret

Function at 0x8e2160
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e2166
pop ebp
sub ebp, 6
sub ebp, 0x4e2160
jmp 0x8e21c4
jmp 0x8e21cd
mov eax, 0x4e2160
add eax, ebp
add eax, 0x93
mov ecx, 0x61f
mov edx, 0xcf36a8e9
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e21e4
jmp 0x8e21f7
sub dword [ecx - 0x1606167f], 0xffffffe9
sub ecx, 0xdae9c525
sub dword [ecx - 0x772a83ea], edi
lodsd eax, dword [esi]
jmp 0x62b284c9
Function at 0x402320
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
xor eax, eax
mov byte [eax + ebx], al
inc eax
cmp eax, 0x100
jb 0x40232a
mov ebp, dword [esp + 0x1c]
xor edi, edi
xor esi, esi
mov eax, esi
xor edx, edx
div ebp
mov eax, dword [esp + 0x18]
mov cl, byte [edx + eax]
mov dl, byte [esi + ebx]
add edi, edx
add ecx, edi
and ecx, 0xff
mov edi, ecx
push edi
push esi
push ebx
call fcn.00402300
add esp, 0xc
inc esi
cmp esi, 0x100
jb 0x40233d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4023b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [esp + 0x108]
test ebx, ebx
push edi
je 0x402422
mov edi, dword [esp + 0x110]
test edi, edi
je 0x402422
mov ecx, dword [esp + 0x114]
test ecx, ecx
je 0x402422
mov eax, dword [esp + 0x118]
test eax, eax
je 0x402422
push esi
push eax
lea eax, [esp + 0x10]
push ecx
push eax
call fcn.00402320
add esp, 0xc
xor esi, esi
test edi, edi
jbe 0x402414
lea ecx, [esp + 0xc]
push ecx
call fcn.00402380
mov dl, byte [esi + ebx]
add esp, 4
xor dl, al
mov byte [esi + ebx], dl
inc esi
cmp esi, edi
jb 0x4023fa
pop esi
pop edi
mov al, 1
pop ebx
add esp, 0x100
ret 0x10
pop edi
xor al, al
pop ebx
add esp, 0x100
ret 0x10

Function at 0x4029f0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x4029d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x406585
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c328
cmp edx, dword [eax]
je 0x4065a7
add eax, 8
inc ecx
cmp eax, 0x40c3b8
jl 0x406598
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c328]
jne 0x4066d5
mov eax, dword [0x40d060]
cmp eax, 1
je 0x4066af
test eax, eax
jne 0x4065d8
cmp dword [0x40c1b0], 1
je 0x4066af
cmp edx, 0xfc
je 0x4066d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40660f
lea eax, [ebp - 0x1a4]
push 0x40b5dc
push eax
call fcn.00407750
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406ee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406652
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406ee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b5d8
push edi
call fcn.00409240
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x40b5bc
push eax
call fcn.00407750
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407760
lea eax, [ebp - 0xa0]
push 0x40b5b8
push eax
call fcn.00407760
push dword [esi + 0x40c32c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407760
push 0x12010
lea eax, [ebp - 0xa0]
push 0x40b590
push eax
call fcn.004091b5
add esp, 0x2c
pop edi
jmp 0x4066d5
lea eax, [ebp + 8]
lea esi, [esi + 0x40c32c]
push 0
push eax
push dword [esi]
call fcn.00406ee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
jmp loc.0040a000

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x1001e7b
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
push 0xfffffffffffffff5
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x1002026
cmp eax, esi
je 0x1002026
push eax
mov dword [0x10093d4], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test al, 2
mov dword [ebp - 4], eax
jne 0x1001ed0
mov word [0x10093e0], si
mov word [0x10093d8], si
mov word [0x10093d0], si
pop esi
leave
ret
lea eax, [ebp - 0x28]
push eax
push dword [0x10093d4]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ax, word [ebp - 0x20]
mov word [0x10093e0], ax
mov eax, dword [ebp - 0x1a]
sub eax, dword [ebp - 0x1e]
mov word [0x10093d8], ax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov word [0x10093d0], ax
lea eax, [ebp - 8]
push eax
push 1
push esi
push 0x100124c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1001fa6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1001238
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1001fa6
mov eax, 0xff
cmp dword [ebp - 4], eax
jne 0x1001f81
mov ecx, dword [ebp - 0x20]
mov edx, ecx
or edx, 8
mov ax, cx
and ecx, 0xf0
mov word [0x10093e8], dx
mov edx, ecx
or edx, 0xc
mov word [0x10093e4], dx
or ecx, 8
mov word [0x10093ec], cx
jmp 0x1001fbb
mov cl, byte [ebp - 4]
and ax, cx
movzx cx, byte [ebp - 3]
mov word [0x10093e4], cx
movzx cx, byte [ebp - 2]
mov word [0x10093e8], cx
movzx cx, byte [ebp - 1]
jmp 0x1001f78
mov eax, dword [ebp - 0x20]
mov word [0x10093e4], ax
mov word [0x10093e8], ax
mov word [0x10093ec], ax
mov ecx, dword [0x10093ec]
shr cl, 4
xor cl, byte [0x10093ec]
mov word [0x10093f0], ax
test cl, 0xf
jne 0x1001fdb
mov word [0x10093ec], ax
mov ecx, dword [0x10093e8]
shr cl, 4
xor cl, byte [0x10093e8]
test cl, 0xf
jne 0x1001ff5
mov word [0x10093e8], ax
mov ecx, dword [0x10093e4]
shr cl, 4
xor cl, byte [0x10093e4]
test cl, 0xf
jne 0x100200f
mov word [0x10093e4], ax
cmp dword [ebp - 8], esi
je 0x1001ecd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001ecd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x10026d1
Capabilities:
Write file on windows

Disassembly:
push 0x14
push 0x10083f8
call fcn.01007e20
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x1002815
xor ebx, ebx
cmp esi, ebx
je 0x1002815
cmp word [0x10093e0], bx
je 0x1002715
push dword [ebp + 8]
push dword [0x10093d4]
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
lea eax, [ebp + 0x10]
push eax
push 0x1000
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push 0x500
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp + 8], ebx
je 0x10027d9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
jne 0x1002763
push edi
push dword [ebp + 8]
push esi
call fcn.01001b87
jmp 0x10027b9
lea eax, [edi + edi + 2]
push eax
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x10027b9
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CharToOemW]
test eax, eax
je 0x10027aa
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002791
sub eax, edx
push ebx
lea ecx, [ebp - 0x24]
push ecx
push eax
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, ebx
je 0x10027b9
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0100222a
test eax, eax
je 0x10027d0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 4], 0xfffffffe
movzx eax, word [0x10093e0]
cmp ax, bx
je 0x10027f9
push eax
push dword [0x10093d4]
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 0x1c]
jmp 0x1002817
xor eax, eax
call fcn.01007e65
ret 0xc
Function at 0x1003372
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.01007ef0
mov eax, dword [0x10093b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x400
lea eax, [ebp - 0xc04]
xor esi, esi
push eax
push esi
mov dword [ebp - 0x1014], esi
mov dword [ebp - 0x100c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1001428
mov dword [ebp - 0x1008], eax
mov edi, 0x200
push edi
lea eax, [ebp - 0x1004]
push eax
call fcn.010024cc
cmp dword [ebp - 0x1008], esi
jbe 0x1003528
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0xc04]
push eax
push 2
call sub.VERSION.dll_GetFileVersionInfoSizeExW
cmp eax, esi
mov dword [ebp - 0x1008], eax
jbe 0x1003528
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
je 0x1003527
push ebx
push dword [ebp - 0x1008]
lea eax, [ebp - 0xc04]
push esi
push eax
push 2
call sub.VERSION.dll_GetFileVersionInfoExW
test eax, eax
je 0x1003518
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1010]
push eax
push 0x10013f4
push ebx
mov dword [ebp - 0x1010], esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x1010]
cmp eax, esi
je 0x10034e0
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push 0x10013d4
push ecx
push eax
mov esi, 0x100139c
push esi
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.010025d0
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x1010]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push 0x1001378
push ecx
push eax
push esi
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.010025d0
add esp, 0x18
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
xor esi, esi
cmp dword [ebp - 0x100c], esi
je 0x1003518
cmp dword [ebp - 0x1014], esi
je 0x1003518
push dword [ebp - 0x1014]
lea eax, [ebp - 0x1004]
push dword [ebp - 0x100c]
push eax
movzx eax, word [0x10093f0]
push 0x1001348
push eax
call fcn.01002824
add esp, 0x14
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01007ed1
leave
ret
Function at 0x1003f31
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa6c
mov eax, dword [0x10093b0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa68], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx]
test esi, esi
mov dword [ebp - 0xa6c], ebx
je 0x1004103
push edi
mov edi, 0x100
jmp 0x1003f70
mov ebx, dword [ebp - 0xa6c]
cmp word [esi], 0
je 0x10040e0
push edi
lea eax, [ebp - 0x614]
push eax
push edi
lea eax, [ebp - 0x814]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.01007f38
add esp, 0x24
lea eax, [ebp - 0xa64]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100408c
mov ecx, 0x1001480
lea eax, [ebp - 0xa38]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003feb
test dx, dx
je 0x1003fe7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003feb
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003fc5
xor eax, eax
jmp 0x1003ff0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100406c
mov ecx, 0x1001478
lea eax, [ebp - 0xa38]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004025
test dx, dx
je 0x1004021
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004025
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003fff
xor eax, eax
jmp 0x100402a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100406c
push 0x1001234
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.01007f2c
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa68]
push eax
call fcn.01002fd8
lea eax, [ebp - 0xa64]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x1003fba
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x10040b5
mov ebx, dword [sym.imp.msvcrt.dll_wcschr]
push 0x2a
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x10040b5
push 0x3f
push esi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x10040b5
push esi
lea eax, [ebp - 0xa68]
push eax
call fcn.01002fd8
cmp dword [ebp + 0xc], 0
je 0x10040da
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10040c0
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
test esi, esi
jne 0x1003f6a
mov ebx, dword [ebp - 0xa6c]
mov esi, dword [ebp - 0xa68]
test esi, esi
pop edi
je 0x1004103
mov eax, dword [ebx]
test eax, eax
je 0x1004101
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebx], esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.01007ed1
leave
ret 8
Function at 0x1004815
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x10093b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], 0x2f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x82c], 0
and dword [ebp - 0x828], 0
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x24], 0x3a
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x400
push edi
lea eax, [ebp - 0x824]
push eax
push 0x21
push edi
call ebx
test eax, eax
jle 0x100488c
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x82c], eax
push 8
lea eax, [ebp - 0x824]
push eax
push 0x1e
push edi
call ebx
test eax, eax
jle 0x10048b0
lea eax, [ebp - 0x824]
push eax
push 8
lea eax, [ebp - 0x24]
push eax
call fcn.010024cc
push 8
lea eax, [ebp - 0x824]
push eax
push 0x1d
push edi
call ebx
test eax, eax
jle 0x10048d4
lea eax, [ebp - 0x824]
push eax
push 8
lea eax, [ebp - 0x14]
push eax
call fcn.010024cc
movzx eax, word [esi + 2]
test ax, ax
mov edi, dword [ebp + 8]
je 0x1004944
mov ecx, dword [ebp - 0x82c]
sub ecx, 0
je 0x100491b
dec ecx
je 0x1004906
dec ecx
jne 0x1004944
movzx ecx, word [esi + 6]
push ecx
movzx eax, ax
lea ecx, [ebp - 0x14]
push ecx
push eax
mov eax, ecx
push eax
movzx eax, word [esi]
jmp 0x100492f
movzx ecx, word [esi]
push ecx
movzx eax, ax
lea ecx, [ebp - 0x14]
push ecx
push eax
mov eax, ecx
push eax
movzx eax, word [esi + 6]
jmp 0x100492f
movzx ecx, word [esi]
push ecx
lea ecx, [ebp - 0x14]
push ecx
movzx ecx, word [esi + 6]
push ecx
lea ecx, [ebp - 0x14]
push ecx
movzx eax, ax
push eax
push 0x10014ec
push edi
call fcn.01002824
add esp, 0x1c
mov dword [ebp - 0x828], eax
movzx eax, word [esi + 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
movzx eax, word [esi + 0xa]
push eax
lea eax, [ebp - 0x24]
push eax
movzx eax, word [esi + 8]
push eax
push 0x10014b0
push edi
call fcn.01002824
mov ecx, dword [ebp - 4]
add eax, dword [ebp - 0x828]
add esp, 0x1c
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007ed1
leave
ret 8
Function at 0x10071ba
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x18], edi
jne 0x1007241
cmp dword [esi + 0x94], edi
je 0x1007241
mov eax, dword [esi + 0x28]
cmp eax, edi
jne 0x10071e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100724d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1007244
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x20], eax
mov eax, 0x3e8
cmp ecx, eax
mov dword [esi + 0x1c], ecx
jae 0x100720d
mov dword [esi + 0x1c], eax
or dword [esi + 0x18], 1
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1007153
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x89c], eax
jne 0x1007244
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1007244
push 4
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x1007258
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x89c], ebx
je 0x10072bf
push dword [esi + 0x28]
and dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x1388
push dword [esi + 0x89c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10072ac
push ebx
push dword [esi + 0x89c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x10072ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [esi + 0x89c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x89c], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x1008000
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100803f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1008035
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1008041
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1008025
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xed5eab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0xed5edd
test dl, 7
je 0xed5edd
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0xf0e040]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0xed5ebd
cmp esi, 8
jb 0xed5f6d
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0xf0e040]
xor ecx, dword [eax*4 + 0xf0e440]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xf0e840]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0xf0f040]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0xf0f440]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xf0f840]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0xf0ec40]
movzx eax, bl
xor ecx, dword [eax*4 + 0xf0fc40]
mov ebx, ecx
sub edi, 1
jne 0xed5eec
pop edi
test esi, esi
je 0xed5f89
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0xf0e040]
inc edx
sub esi, 1
jne 0xed5f71
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0xed60f6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push 0x20
pop ebp
cmp dword [esi], 2
jne 0xed614d
mov eax, dword [esi + 4]
push edi
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push ebp
push dword [esp + 0x58]
call fcn.00ed67d0
mov dword [esi + 4], ebx
mov edx, ebx
mov edi, ebx
movzx eax, byte [esp + edx + 0x10]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, ebp
jb 0xed6133
mov dword [esi + 4], edi
pop edi
cmp dword [esi], 3
jne 0xed6179
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
add esi, 4
push eax
push ebp
push esi
push ebp
push dword [esp + 0x54]
call fcn.00ed67d0
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00eeea80
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8