joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ed320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x101c52b4]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [0x102dd440]
test ecx, ecx
push esi
mov esi, dword [0x102dd444]
push edi
mov edi, dword [esp + 0x34]
jne 0x100ed3de
test esi, esi
jne 0x100ed3de
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x26], al
mov dl, 0x74
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x1c], 0x4e
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], 0x46
mov byte [esp + 0x1f], cl
mov byte [esp + 0x22], 0x56
mov byte [esp + 0x23], 0x69
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], dl
mov byte [esp + 0x26], 0x75
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x4d
mov byte [esp + 0x2b], 0x6d
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], 0x79
mov byte [esp + 0x2f], 0
call fcn.100eca60
push edx
push eax
call fcn.100ecf90
mov ecx, eax
add esp, 0xc
test ecx, ecx
mov esi, edx
mov dword [0x102dd440], ecx
mov dword [0x102dd444], esi
jne 0x100ed3de
test esi, esi
je 0x100ed436
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
push eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x18], edx
lea eax, [esp + 0x18]
cdq
push edx
push eax
lea eax, [esp + 0x18]
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
push 4
push esi
push ecx
mov dword [esp + 0x40], 0
call fcn.100ec4c0
add esp, 0x2c
test eax, eax
jne 0x100ed42c
test edx, edx
je 0x100ed449
push edx
push eax
call fcn.100ecec0
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1010e4d7
add esp, 0x28
ret
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1010e4d7
add esp, 0x28
ret
Function at 0x100ed460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x101c52b4]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [0x102dd448]
test ecx, ecx
push ebp
mov ebp, dword [esp + 0x48]
push esi
mov esi, dword [0x102dd44c]
push edi
mov edi, dword [esp + 0x3c]
jne 0x100ed531
test esi, esi
jne 0x100ed531
mov al, 0x74
mov byte [esp + 0x1d], al
mov cl, 0x72
mov byte [esp + 0x21], al
mov byte [esp + 0x24], al
mov byte [esp + 0x28], al
mov dl, 0x65
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x20], 0x4e
mov byte [esp + 0x22], 0x50
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6f
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x63
mov byte [esp + 0x29], 0x56
mov byte [esp + 0x2a], 0x69
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2d], 0x75
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x30], 0x4d
mov byte [esp + 0x31], dl
mov byte [esp + 0x32], 0x6d
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0x79
mov byte [esp + 0x36], 0
call fcn.100eca60
push edx
push eax
call fcn.100ecf90
mov ecx, eax
add esp, 0xc
test ecx, ecx
mov esi, edx
mov dword [0x102dd448], ecx
mov dword [0x102dd44c], esi
jne 0x100ed531
test esi, esi
je 0x100ed58e
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x14], edx
mov eax, ebp
cdq
push edx
push eax
mov eax, dword [esp + 0x54]
push 0
push eax
lea eax, [esp + 0x24]
cdq
push edx
push eax
lea eax, [esp + 0x24]
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
push 5
push esi
push ecx
mov dword [esp + 0x4c], 0
call fcn.100ec4c0
add esp, 0x34
test eax, eax
jne 0x100ed584
test edx, edx
je 0x100ed5a2
push edx
push eax
call fcn.100ecec0
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1010e4d7
add esp, 0x2c
ret
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.1010e4d7
add esp, 0x2c
ret
Function at 0x100ed5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x101c52b4]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [0x102dd450]
test ecx, ecx
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [0x102dd454]
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x18], ebx
jne 0x100ed692
test esi, esi
jne 0x100ed692
mov al, 0x72
mov byte [esp + 0x24], al
mov byte [esp + 0x2d], al
mov dl, 0x65
mov cl, 0x61
lea eax, [esp + 0x1c]
mov bl, 0x74
push eax
mov byte [esp + 0x20], 0x4e
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x26], 0x56
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x75
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0x4d
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], 0x6d
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x32], 0x79
mov byte [esp + 0x33], 0
call fcn.100eca60
push edx
push eax
call fcn.100ecf90
mov ecx, eax
add esp, 0xc
test ecx, ecx
mov esi, edx
mov dword [0x102dd450], ecx
mov dword [0x102dd454], esi
jne 0x100ed68e
test esi, esi
je 0x100ed6e8
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x100ed69a
mov eax, dword [ebx]
jmp 0x100ed69c
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
cdq
push edx
mov edx, dword [esp + 0x4c]
push eax
push 0
push edx
mov eax, ebp
cdq
push edx
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x58]
push eax
push edx
mov eax, edi
cdq
push edx
push eax
push 5
push esi
push ecx
mov dword [esp + 0x48], 0
call fcn.100ec4c0
add esp, 0x34
test eax, eax
jne 0x100ed6de
test edx, edx
je 0x100ed6fd
push edx
push eax
call fcn.100ecec0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1010e4d7
add esp, 0x24
ret
test ebx, ebx
je 0x100ed707
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1010e4d7
add esp, 0x24
ret
Function at 0x100ed720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x101c52b4]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [0x102dd458]
test ecx, ecx
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [0x102dd45c]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x18], ebx
jne 0x100ed7f5
test esi, esi
jne 0x100ed7f5
mov al, 0x72
mov cl, 0x74
mov byte [esp + 0x1f], al
mov byte [esp + 0x25], al
mov byte [esp + 0x2e], al
mov dl, 0x65
lea eax, [esp + 0x1c]
mov bl, 0x69
push eax
mov byte [esp + 0x20], 0x4e
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], 0x57
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], 0x56
mov byte [esp + 0x28], bl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], 0x75
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], 0x4d
mov byte [esp + 0x2f], dl
mov byte [esp + 0x30], 0x6d
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x33], 0x79
mov byte [esp + 0x34], 0
call fcn.100eca60
push edx
push eax
call fcn.100ecf90
mov ecx, eax
add esp, 0xc
test ecx, ecx
mov esi, edx
mov dword [0x102dd458], ecx
mov dword [0x102dd45c], esi
jne 0x100ed7f1
test esi, esi
je 0x100ed84b
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x100ed7fd
mov eax, dword [ebx]
jmp 0x100ed7ff
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
cdq
push edx
mov edx, dword [esp + 0x50]
push eax
push 0
push edx
mov eax, ebp
cdq
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x5c]
push eax
push edx
mov eax, edi
cdq
push edx
push eax
push 5
push esi
push ecx
mov dword [esp + 0x48], 0
call fcn.100ec4c0
add esp, 0x34
test eax, eax
jne 0x100ed841
test edx, edx
je 0x100ed860
push edx
push eax
call fcn.100ecec0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1010e4d7
add esp, 0x28
ret
test ebx, ebx
je 0x100ed86a
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1010e4d7
add esp, 0x28
ret
Function at 0x100f4200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101761c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c52b4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
or eax, 0xffffffff
push ebx
lea ebp, [esi + 0x30]
push 0x3fe0
mov ecx, ebp
mov dword [esi], ebx
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.100f4c70
mov dword [esp + 0x24], ebx
push ebx
push 0x3fe0
lea ecx, [esi + 0x40]
call fcn.100f4c70
mov byte [esp + 0x24], 1
push 0x30
lea edi, [esi + 0x50]
push ebx
push edi
call fcn.1010efd0
add esp, 0xc
mov dword [edi], ebp
mov byte [esp + 0x24], 2
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
lea eax, [esi + 0xa4]
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov ecx, 1
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
lea ecx, [eax + 0x14]
mov dword [esp + 0x18], eax
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 0x10], ecx
mov dword [ecx], ebx
mov dword [esp + 0x24], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x100f4520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10176227
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x101c52b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x18], 3
push 1
mov eax, esi
call fcn.100f4420
mov al, 2
add esp, 4
mov byte [esp + 0x18], al
lea ecx, [esi + 0xa4]
mov dword [esp + 0xc], ecx
mov byte [esp + 0x18], al
push 0
call fcn.100f5100
mov byte [esp + 0x18], 1
push 0
lea ecx, [esi + 0x50]
call fcn.100f4e40
mov byte [esp + 0x18], 0
lea ecx, [esi + 0x40]
call fcn.100f4e80
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esi + 0x30]
call fcn.100f4e80
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x100f5b30
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
test edi, edi
jbe 0x100f5b5c
push esi
mov esi, dword [esp + 0xc]
sub esi, ecx
mov edi, edi
mov dl, byte [esi + ecx]
mov al, dl
sub al, 0x41
cmp al, 0x19
setbe al
shl al, 5
xor al, dl
mov byte [ecx], al
add ecx, 1
sub edi, 1
jne 0x100f5b40
pop esi
pop edi
ret

Function at 0x100f60a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov eax, dword [0x101c52b4]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
mov edi, dword [ebx + 8]
cmp edi, 0x20
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebp
ja 0x100f6174
mov eax, dword [ebx + 4]
xor ecx, ecx
test edi, edi
jbe 0x100f6116
mov ebp, eax
lea edx, [esp + 0x1c]
sub ebp, edx
lea esp, [esp]
lea esi, [esp + ecx + 0x1c]
mov dl, byte [esi + ebp]
mov al, dl
sub al, 0x41
cmp al, 0x19
setbe al
shl al, 5
xor al, dl
add ecx, 1
cmp ecx, edi
mov byte [esi], al
jb 0x100f60f0
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.100f5920
test eax, eax
mov dword [esi], eax
jne 0x100f618c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.100f28c0
add esp, 8
test eax, eax
mov dword [esi], eax
jne 0x100f618c
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.100f57c0
test eax, eax
je 0x100f6174
mov ecx, dword [ebp]
test eax, ecx
jne 0x100f6174
or ecx, eax
mov dword [ebp], ecx
mov ecx, dword [esp + 0x10]
push ebx
add ecx, 4
call fcn.100f72b0
cmp eax, 2
jne 0x100f6174
mov edi, dword [ebx + 8]
cmp edi, 0x20
jbe 0x100f60d8
pop edi
pop esi
pop ebp
mov eax, 0x16
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1010e4d7
add esp, 0x30
ret
mov edi, dword [esp + 0x10]
push ebx
lea ecx, [edi + 4]
call fcn.100f72b0
cmp eax, 2
jne 0x100f61e0
mov esi, dword [ebx + 8]
cmp esi, 0x20
ja 0x100f61e0
mov edx, dword [ebx + 4]
push edx
mov eax, esi
lea ecx, [esp + 0x20]
call fcn.100f5b30
add esp, 4
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.100f57c0
cmp eax, 0x40
jne 0x100f61e0
or dword [ebp], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1010e4d7
add esp, 0x30
ret
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x3c]
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1010e4d7
add esp, 0x30
ret

Function at 0x100f9a10
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0x1c]
add edx, 0x1c
cmp edx, eax
push esi
je 0x100f9a3b
mov ecx, dword [eax + 0x2c]
lea esi, [eax + 0x2c]
cmp ecx, esi
je 0x100f9a35
cmp dword [ecx], esi
je 0x100f9a3f
mov eax, dword [eax]
cmp edx, eax
jne 0x100f9a27
xor eax, eax
pop esi
ret
push 1
add eax, 0x1c
push eax
call fcn.100fafe0
mov esi, dword [esi]
add eax, eax
add eax, eax
add eax, eax
sub esi, eax
push esi
call fcn.100f9960
add esp, 4
neg eax
sbb eax, eax
and eax, esi
pop esi
ret
Function at 0x100fade0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [0x101c45cc]
cmp dword [eax], 3
push ebx
mov ebx, dword [ecx + 0x18]
push esi
mov esi, dword [esp + 0xc]
jl 0x100fae21
push esi
call fcn.100fac10
mov edx, dword [esi + 0x50]
mov eax, dword [0x101c45cc]
mov ecx, dword [eax + 0x2c]
add esp, 4
push edx
push 0
push ebx
call ecx
push esi
call fcn.100f9840
mov eax, dword [0x101c45cc]
cmp dword [eax], 1
jl 0x100faedc
mov edx, dword [eax + 0xc]
mov ecx, dword [edx + 4]
cmp ecx, 0x68
je 0x100fae3d
cmp ecx, 0x80
jne 0x100fae7b
push ebp
lea ebp, [esi + 0x50]
push edi
mov edi, dword [ebp]
cmp ebp, edi
je 0x100fae79
lea esp, [esp]
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x18]
mov eax, dword [eax + 0x28]
push edx
call eax
mov edi, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [0x101c45cc]
mov eax, dword [edx + 0x2c]
push ecx
push 0
push ebx
call eax
cmp ebp, edi
mov eax, dword [0x101c45cc]
jne 0x100fae50
pop edi
pop ebp
mov ecx, dword [esi + 0x30]
mov edx, dword [eax + 0x2c]
push ecx
push 0
push ebx
call edx
mov eax, dword [esi + 0x28]
mov ecx, dword [0x101c45cc]
mov edx, dword [ecx + 0x2c]
push eax
push 0
push ebx
call edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x40]
mov dword [ecx], eax
push esi
mov dword [eax + 4], ecx
mov eax, dword [0x101c45cc]
mov ecx, dword [eax + 0x2c]
push 0
push ebx
call ecx
pop esi
mov eax, 1
pop ebx
ret 4
pop esi
xor eax, eax
pop ebx
ret 4

Function at 0x100faf70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
push ebx
push ebp
mov ebp, dword [ecx + 0xc]
push esi
add ebp, 0xc
push edi
mov edi, dword [ebp]
cmp edi, ebp
je 0x100fafcb
mov ebx, dword [esp + 0x14]
mov edi, edi
mov esi, edi
movzx edx, word [esi + 0x2c]
mov eax, dword [esi + 0x30]
mov edi, dword [edi]
shr edx, 1
sub edx, 4
push edx
push eax
push ebx
call fcn.10114577
add esp, 0xc
test eax, eax
je 0x100fafd4
movzx ecx, word [esi + 0x2c]
mov edx, dword [esi + 0x30]
shr ecx, 1
push ecx
push edx
push ebx
call fcn.10114577
add esp, 0xc
test eax, eax
je 0x100fafd4
cmp edi, ebp
jne 0x100faf90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x100fb400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0x3c]
push ebx
push ebp
add eax, ecx
push esi
push edi
mov edi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
mov ebp, dword [edi + ecx + 0x1c]
mov edx, dword [edi + ecx + 0x24]
mov esi, dword [edi + ecx + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [edi + ecx + 0x20]
add eax, ecx
add edx, ecx
add ebp, ecx
xor ebx, ebx
test esi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x100fb4a3
jmp 0x100fb444
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + ebx*4]
mov esi, dword [esp + 0x20]
add eax, ecx
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [esi]
jne 0x100fb470
test dl, dl
je 0x100fb46c
mov dl, byte [eax + 1]
cmp dl, byte [esi + 1]
jne 0x100fb470
add eax, 2
add esi, 2
test dl, dl
jne 0x100fb450
xor eax, eax
jmp 0x100fb475
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100fb49a
mov edx, dword [esp + 0x10]
movzx eax, word [edx + ebx*2]
mov eax, dword [ebp + eax*4]
add eax, ecx
lea edx, [edi + ecx]
cmp eax, edx
jb 0x100fb4a5
mov edx, dword [esp + 0x14]
add edx, edi
add edx, ecx
cmp eax, edx
ja 0x100fb4a5
add ebx, 1
cmp ebx, dword [edi + ecx + 0x18]
jl 0x100fb440
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100fcc90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101aacb8
push 0x1010ea10
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x101c52b4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x100fccd5
mov dword [eax], esi
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x101c45cc]
mov edx, dword [ecx + 0x50]
call edx
mov edi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
cmp edi, esi
jne 0x100fcd0d
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [edi + 0x18]
cmp eax, 0x10b
je 0x100fcd6a
cmp eax, 0x20b
jne 0x100fccf0
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x24], esi
mov ebx, dword [edi + 0x54]
mov dword [ebp - 0x20], ebx
push 0x66
movzx eax, word [edi + 6]
lea ecx, [eax + eax*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push esi
call fcn.100fcac0
xor eax, eax
mov dword [ebp - 0x28], eax
cmp ax, word [edi + 6]
jae 0x100fcd62
add ebx, dword [esi + 0x10]
mov dword [ebp - 0x20], ebx
add eax, 1
add esi, 0x28
mov dword [ebp - 0x24], esi
jmp 0x100fcd48
add ebx, dword [edi + 0xac]
jmp 0x100fcdb3
movzx edx, word [edi + 0x14]
lea esi, [edx + edi + 0x18]
mov dword [ebp - 0x24], esi
mov ebx, dword [edi + 0x54]
mov dword [ebp - 0x20], ebx
push 0x66
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push esi
call fcn.100fcac0
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp ax, word [edi + 6]
jae 0x100fcdad
add ebx, dword [esi + 0x10]
mov dword [ebp - 0x20], ebx
add eax, 1
add esi, 0x28
mov dword [ebp - 0x24], esi
jmp 0x100fcd93
add ebx, dword [edi + 0x9c]
mov edi, dword [edi + 0x58]
mov dword [ebp - 0x20], ebx
push 0x66
push ebx
mov esi, dword [ebp + 8]
push esi
call fcn.100fcac0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100fcdce
mov dword [eax], ebx
test edi, edi
jne 0x100fcdef
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, esi
call fcn.100fc9d0
mov byte [ebp - 0x19], al
jmp 0x100fce24
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100fdfc6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x101c52b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x100fe006
push 0x1018bfa0
push 4
push eax
call fcn.1010edfc
push eax
call fcn.10001000
add esp, 0x10
jmp 0x100fe018
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
test eax, eax
je 0x100fe086
push edi
call fcn.10112d35
mov edi, dword [eax]
call fcn.10112d35
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.1010fe47
add esp, 0x18
mov ebx, eax
call fcn.10112d35
cmp dword [eax], 0
je 0x100fe066
call fcn.10112d35
push dword [eax]
call fcn.100fd167
pop ecx
jmp 0x100fe06d
call fcn.10112d35
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x100fe086
cmp ebx, esi
jae 0x100fe086
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
jmp 0x100fe088
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1010e4d7
leave
ret
Function at 0x10101cde
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], 0x1018c824
jne 0x10101d07
call fcn.100fda6c
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x10101d2a
push eax
push dword [esi + 4]
call fcn.10101c69
push esi
push eax
mov ecx, 0x102dd6b0
call fcn.10101943
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x10109f77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x10109fba
call fcn.100fda6c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x10109fba
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x10109fd5
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.10109b2e
test ebx, ebx
mov esi, eax
je 0x10109fd3
test edi, edi
je 0x10109fd3
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1010e4d7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101c52b4]
jne 0x1010e4e1
repz ret
jmp fcn.1011a58c