joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10083040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x100b9680]
push esi
push eax
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call fcn.1004f0c0
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x10045cd2
mov eax, dword [edi]
test eax, eax
je 0x10045c81
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x10045c81
test ebx, ebx
je 0x10045c81
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x10045c81
cmp dword [ebp - 8], esi
je 0x10045cd2
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10045ca1
mov eax, dword [edi + 4]
cmp eax, 3
je 0x10045c95
cmp eax, 1
jne 0x10045ca1
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d4c5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d4c5
mov esp, ebp
pop ebp
ret 8
Function at 0x1004a7f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1004a9c0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004a8cd
mov edx, dword [ebp - 4]
cmp edx, dword [0x10083010]
jb 0x1004a83a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10083014]
ja 0x1004a83a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004a80a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1004f640
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1004a85f
jmp 0x1004a8cd
cmp dword [ebp - 0x14], 0x10000
jne 0x1004a8b3
cmp dword [ebp - 0x18], 0x10000
jb 0x1004a8b3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004a896
mov eax, dword [ebp - 8]
jmp 0x1004a8cf
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1004a8a6
xor eax, eax
jmp 0x1004a8cf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004a8c8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1004a9c0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004a80a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1004a8e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1004a9f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1004a9b5
mov edx, dword [ebp - 4]
cmp edx, dword [0x10083010]
jb 0x1004a925
mov eax, dword [ebp - 4]
cmp eax, dword [0x10083014]
ja 0x1004a925
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004a8f5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1004f640
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1004a94a
jmp 0x1004a9b5
cmp dword [ebp - 0x14], 0x10000
jne 0x1004a99e
cmp dword [ebp - 0x18], 0x10000
jb 0x1004a99e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004a981
mov eax, dword [ebp - 8]
jmp 0x1004a9b7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1004a991
xor eax, eax
jmp 0x1004a9b7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004a9b0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1004a9f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004a8f5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1004aa20
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1004ae10
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10086fb8], 0
jne 0x1004aa5d
cmp dword [0x10086fb4], 0
je 0x1004aa5d
mov eax, dword [0x10086fb4]
mov dword [0x10086fb8], eax
cmp dword [0x10086fb8], 0
je 0x1004aada
mov ecx, dword [0x10086fb8]
cmp dword [ecx + 8], 0
je 0x1004aada
mov edx, dword [0x10086fb8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1004aada
mov ecx, dword [0x10086fb8]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1004aada
mov eax, dword [0x10086fb8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1004aaa9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1004aab0
xor eax, eax
jmp 0x1004abf9
mov ecx, dword [0x10086fb8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1004f640
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1004abf9
mov edx, dword [0x10086fb4]
mov dword [0x10086fb8], edx
jmp 0x1004aaf6
mov eax, dword [0x10086fb8]
mov ecx, dword [eax + 4]
mov dword [0x10086fb8], ecx
cmp dword [0x10086fb8], 0
je 0x1004ab36
cmp dword [0x10086fb8], 0
je 0x1004ab34
mov edx, dword [0x10086fb8]
cmp dword [edx + 8], 0
je 0x1004ab34
mov eax, dword [0x10086fb8]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1004ab34
mov edx, dword [0x10086fb8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1004ab34
jmp 0x1004aa8e
jmp 0x1004aae8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1004ac00
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1004abf7
mov eax, dword [ebp - 0x18]
mov dword [0x10086fb8], eax
mov ecx, dword [0x10086fb8]
mov dword [ecx], 0x52727464
mov edx, dword [0x10086fb8]
mov dword [edx + 8], 0
mov eax, dword [0x10086fb8]
mov ecx, dword [0x10086fb4]
mov dword [eax + 4], ecx
mov edx, dword [0x10086fb8]
mov dword [0x10086fb4], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10086fb8]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1004abc7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1004abe7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1004abbe
mov eax, dword [0x10086fb8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1004aa8e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1004b940
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10086fb4]
mov dword [ebp - 4], eax
jmp 0x1004b959
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1004b980
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1004b97e
call sub.KERNEL32.dll_GetLastError
jmp 0x1004b982
jmp 0x1004b950
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1004be20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10086fc4], eax
je 0x1004be44
mov eax, 0x10dd
jmp 0x1004bfec
cmp dword [0x10086fc8], 0
je 0x1004be57
mov eax, dword [0x10086fc8]
jmp 0x1004bfec
cmp dword [ebp + 0xc], 0
jne 0x1004be67
mov eax, 0x57
jmp 0x1004bfec
cmp dword [ebp + 8], 0
jne 0x1004be77
mov eax, 6
jmp 0x1004bfec
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1004bea0
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x10086fc8], ecx
mov edx, dword [ebp + 8]
mov dword [0x10086fcc], edx
mov eax, dword [ebp - 8]
jmp 0x1004bfec
push 0x18
call fcn.1004d4d3
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004befb
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x10086fc8], ecx
cmp dword [ebp - 4], 0
je 0x1004beea
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1004d526
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x10086fcc], ecx
mov eax, dword [ebp - 8]
jmp 0x1004bfec
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1004be00
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1004be00
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1004bf3b
cmp dword [ebp - 0xc], 0x1e
jbe 0x1004bf57
mov dword [ebp - 8], 9
cmp dword [0x10086fbc], 0
je 0x1004bf52
jmp 0x1004bec9
jmp 0x1004bec0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1004bf7e
mov dword [ebp - 8], 9
cmp dword [0x10086fbc], 0
je 0x1004bf79
jmp 0x1004bec9
jmp 0x1004bec0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1004bfa9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1004bec0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x10086fd4]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10086fd4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1004c000
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10086fc4], eax
je 0x1004c01d
mov eax, 0x10dd
jmp 0x1004c100
mov eax, dword [0x10086fd4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004c09c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1004c078
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1004c078
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1004aea0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1004d526
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1004c025
mov dword [0x10086fd4], 0
call fcn.1004b780
mov ecx, dword [0x10086fd0]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1004c0ea
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1004d526
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1004c0b4
mov dword [0x10086fd0], 0
mov dword [0x10086fc4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1004c5e0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10086fc8], 0
je 0x1004c5f9
mov eax, dword [0x10086fc8]
jmp 0x1004c698
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1004c60a
xor eax, eax
jmp 0x1004c698
push 8
call fcn.1004d4d3
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004c662
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1004c64b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1004d526
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10086fc8], eax
mov dword [0x10086fcc], 0
mov eax, dword [ebp - 8]
jmp 0x1004c698
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1004c67a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1004c62a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10086fd0]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10086fd0], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100578de
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1005791d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005791d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005791d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1005791d
cmp dword [ecx + 0x74], 0xe
jbe 0x1005791d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10064f07
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10064fa4
push ebx
push esi
call fcn.10064ed0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10062dac
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10064f51
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10064fa3
push edi
push eax
call fcn.1005fb00
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10064f71
call fcn.1005d980
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10064fa2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10062dac
add esp, 0x20
test eax, eax
jne 0x10064f90
push edi
call fcn.1005d980
jmp 0x10064f98
push ebx
call fcn.1005d980
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10064fa7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10064fb8
pop esi
ret
push ebx
push edi
push esi
call fcn.10064ed0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1005fb00
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10064fe0
push ebx
push esi
push edi
call fcn.1004f0c0
add esp, 0xc
push 0
call fcn.1005d980
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100653af
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10064ff5
Function at 0x10068e23
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1005e2b3
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10068e92
cmp esi, dword [ebp - 4]
je 0x10068e8d
cmp dword [ebp + 0xc], 0
je 0x10068e8d
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10068e6a
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10068978
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10068e94
xor eax, eax
inc eax
jmp 0x10068e94
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10068eff
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10083040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1005e2b3
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1005e2b3
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10068f76
cmp word [ecx], dx
je 0x10068f76
mov eax, dword [0x1007707c]
push edi
dec eax
push eax
push 0x10076f68
call fcn.10068e98
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10068fe9
cmp word [eax], dx
je 0x10068fe9
mov eax, dword [edi]
test eax, eax
je 0x10068f9a
cmp word [eax], dx
je 0x10068f9a
lea eax, [ebp - 0x10]
push eax
call fcn.1006887e
jmp 0x10068fa3
lea eax, [ebp - 0x10]
push eax
call fcn.10068919
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10069013
mov eax, dword [0x10076f64]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10076c58
call fcn.10068e98
add esp, 0xc
test al, al
je 0x10069013
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10068fde
cmp word [eax], di
je 0x10068fde
lea eax, [ebp - 0x10]
push eax
call fcn.1006887e
pop ecx
jmp 0x10069015
lea eax, [ebp - 0x10]
push eax
call fcn.10068919
jmp 0x10068fdb
mov eax, dword [edi]
test eax, eax
je 0x10069000
cmp word [eax], dx
je 0x10069000
lea eax, [ebp - 0x10]
push eax
call fcn.10068833
pop ecx
jmp 0x10069013
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100690de
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10068d1d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100690de
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100690de
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100690de
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1006906b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100618e3
test ebx, ebx
je 0x100690d9
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100618e3
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100690de
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100690de
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1006b82d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100690e0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d4c5
leave
ret
Function at 0x1006aa53
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x1006aa6d
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x1006aa84
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x1006aadc
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.10065e93
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x1006aadc
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1006aadc
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1006aadc
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x1006aad6
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x1006aad8
xor bl, bl
mov al, bl
jmp 0x1006aade
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x1006dbe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1006dc0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006dc0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41b0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
sete dl
test eax, eax
sete dh
or dh, dl
jne 0x41b0e5
mov dh, byte [ecx]
test dh, dh
je 0x41b0f0
inc ecx
nop
movzx esi, byte [eax]
test esi, esi
setne dl
je 0x41b0f2
movzx edi, dh
mov dh, byte [edi + 0xea2ca8]
cmp dh, byte [esi + 0xea2ca8]
jne 0x41b100
inc eax
mov dh, byte [ecx]
inc ecx
test dh, dh
jne 0x41b0c0
jmp 0x41b0f2
or ecx, eax
sete al
movzx eax, al
pop esi
pop edi
ret
mov dl, 1
cmp byte [eax], 0
setne al
xor al, dl
movzx eax, al
pop esi
pop edi
ret
xor eax, eax
movzx eax, al
pop esi
pop edi
ret
Function at 0x47a720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c0
mov ebp, edx
mov ebx, ecx
mov edi, dword [esp + 0x1d8]
mov eax, dword [ecx + 8]
mov dword [esp], eax
lea esi, [esp + 0x5c]
push 0x100
push 0xeb338c
push esi
call fcn.007de188
add esp, 0xc
mov dword [esp + 4], ebp
push ebp
push ebx
call fcn.0042b2d0
add esp, 8
mov dword [esp + 8], eax
call fcn.0060b520
mov ebp, eax
and eax, 0xff800000
cmp eax, 0xa000000
jne 0x47a808
mov eax, ebp
and eax, 0x7fffff
cmp eax, 0x414
jg 0x47a7ab
cmp eax, 0x86
je 0x47a7bd
cmp eax, 0xcf
jne 0x47a808
mov eax, dword [esp]
or byte [eax + 0x2d8], 8
mov esi, 0xeb34cc
jmp 0x47a957
cmp eax, 0x45c
je 0x47a90d
cmp eax, 0x415
jne 0x47a808
mov eax, dword [esp]
push dword [eax + 0x10c]
call fcn.0055c9b0
add esp, 4
mov edi, 0x3c
test eax, eax
je 0x47a952
mov ecx, dword [esp + 8]
mov dword [ecx + 0x48], eax
push eax
call fcn.00686890
add esp, 4
lea esi, [esp + 0x5c]
push eax
push 0xeb348c
push 0x100
push esi
call fcn.0040ad30
add esp, 0x10
jmp 0x47a957
mov byte [esp + 0x5c], 0
push 0x100
push esi
push ebp
call fcn.0060bd40
add esp, 0xc
cmp byte [esp + 0x5c], 0
je 0x47a831
mov eax, edi
xor eax, 0x23
or eax, ebp
je 0x47a85b
jmp 0x47a957
test ebp, ebp
mov eax, 0xeb352d
mov ecx, 0xeb351f
cmove ecx, eax
lea eax, [esp + 0x5c]
push ecx
push eax
call fcn.007ddf70
add esp, 8
mov eax, edi
xor eax, 0x23
or eax, ebp
jne 0x47a957
mov ebp, dword [esp + 0x1d4]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
call dword [0x100bd04]
mov esi, eax
lea edi, [esp + 0x15c]
push edi
push 0
push 0
push dword [esp + 0x10]
push dword [ebx + 4]
call fcn.00438870
add esp, 0x14
test esi, esi
sete al
cmp ebp, 5
setne cl
or cl, al
jne 0x47a8d2
lea ebx, [esp + 0xc]
push 0x50
push ebx
push esi
call fcn.0041b460
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, 0xeb3597
cmovne eax, ebx
mov ecx, dword [esp]
jmp 0x47a8e6
mov eax, 0xeb361a
cmp ebp, 0xa
mov ecx, dword [esp]
ja 0x47a8e6
mov eax, dword [ebp*4 + 0xeb3e24]
push edi
push dword [esp + 0x1bc]
push dword [ecx + 0xf4]
push eax
push 0xeb34ef
push dword [esp + 0x18]
call fcn.00443310
add esp, 0x18
mov edi, 0x23
jmp 0x47a969
mov byte [esp + 0x5c], 0
lea esi, [esp + 0x5c]
push 0x100
push esi
push ebp
call fcn.0060bd40
add esp, 0xc
mov edi, 0x62
cmp byte [esp + 0x5c], 0
jne 0x47a957
mov word [esp + 0x68], 0x72
mov dword [esp + 0x64], 0x6f727265
mov dword [esp + 0x60], 0x206e776f
mov dword [esp + 0x5c], 0x6e6b6e55
jmp 0x47a957
mov esi, 0xeb34a8
push esi
push 0xeb351c
push dword [esp + 0xc]
call fcn.00443310
add esp, 0xc
mov eax, edi
add esp, 0x1c0
pop esi
pop edi
pop ebx
pop ebp
ret