joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029b04
Capabilities:
Accept command line arguments

Disassembly:
push 0x34
mov eax, 0x100432ba
call fcn.1003efaa
mov ebx, ecx
mov dword [ebp - 0x28], ebx
and dword [ebp - 0x1c], 0
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.1002d823
push eax
mov ecx, ebx
call fcn.1002fa6e
mov dword [ebp - 0x1c], esi
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x40]
call fcn.100103be
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x40]
call fcn.10010764
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1002d9fa
test esi, esi
je 0x10029c3e
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
call fcn.10010764
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
push dword [eax]
call fcn.10027aaa
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1002d987
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
call fcn.1002d823
push eax
lea ecx, [ebp - 0x18]
call fcn.1002fa6e
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x24]
call fcn.1002fa6e
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push edi
call fcn.10027aaa
mov byte [ebp - 4], 9
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x10029c17
lea ecx, [ebp - 0x20]
call fcn.100109e8
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xa
call fcn.1002fa6e
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.1002fa6e
jmp 0x10029c22
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.1002fa6e
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
lea ecx, [edi - 0x10]
call fcn.1002d9fa
mov byte [ebp - 4], 2
lea ecx, [esi - 0x10]
jmp 0x10029c5c
lea ecx, [ebp - 0x24]
call fcn.100109e8
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.1002fa6e
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
push dword [ebp + 8]
mov ecx, ebx
call fcn.1002fa6e
lea ecx, [ebp - 0x40]
call fcn.10010740
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
mov eax, ebx
call fcn.1003ef84
ret 4
Function at 0x1002fa6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002fa7d
pop dword [ebp - 0xc]
mov eax, 0x78027a77
add eax, 0x98008006
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x427ea
push 0
mov eax, 0x58fb4b9a
sub eax, 0x48f67a66
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xecf8e669
add ecx, 0x130764a5
xor esi, esi
add esi, eax
mov edi, 0xfdc0084c
add edi, 0x124553b4
add edi, dword [ebp - 0xc]
mov ebx, 0xea60fc3c
sub ebx, 0x38439be9
xor dword [ebp - 8], 0xa7bd25a2
mov edx, dword [edi]
xor edx, ebx
xor dword [ebp - 4], 0x2850d399
mov dword [esi], edx
add dword [ebp - 4], edi
add esi, 0x74dec0d6
add esi, 0x8b213f2e
add edi, 0xf3daca33
sub edi, 0xf3daca2f
loop 0x1002fade
add eax, 0x931fe4d1
add eax, 0x6ce13a3a
mov ebx, eax
add eax, 0xb6e1bf35
sub eax, 0xb6e1bf30
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x409235
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4086a8
push 0x40a6c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push ebx
mov eax, 0x564d5868
mov ebx, 0x8685d465
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [ebp - 0x1c], ebx
pop ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x40929d
xor eax, eax
cmp dword [ebp - 0x1c], 0x564d5868
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4092ba
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4086b8
push 0x40a6c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, 1
invalid

Function at 0x4093c7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x408648
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4093ea
xor eax, eax
jmp 0x409429
cmp dword [ebp + 0x10], 0
jne 0x409403
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
jmp 0x40941a
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x409e49
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
leave
ret

Function at 0x409f12
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push 0
push 0
push 0
push 0
push 0x40866c
call dword [0x40157c]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
je 0x409ff0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x82c]
call dword [0x401214]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0
je 0x409ff0
push 0x408674
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x409ff0
lea eax, [ebp - 0x824]
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
push dword [ebp - 0x830]
call dword [0x401220]
test eax, eax
jne 0x409faf
jmp 0x409fde
push dword [ebp - 0x834]
push 1
push dword [ebp - 0x824]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 0x824], 0
ja 0x409f8a
push dword [ebp - 0x834]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
jmp 0x409ff2
xor eax, eax
leave
ret
Function at 0x40a4a3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
call fcn.00409235
movzx eax, al
test eax, eax
jne 0x40a4c4
call fcn.004092ba
movzx eax, al
test eax, eax
je 0x40a4cb
xor eax, eax
jmp 0x40a6a9
push dword [0x40121c]
call dword [sym.imp.MSVCRT.dll__unlink]
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
call fcn.00409c3e
push 2
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push 0x401b82
call fcn.00408f33
pop ecx
test eax, eax
jne 0x40a515
push 0x401a83
call fcn.00408f33
pop ecx
test eax, eax
je 0x40a5a3
push 0x401b82
push 0x401c81
call dword [sym.imp.MSVCRT.dll__strcmpi]
pop ecx
pop ecx
test eax, eax
je 0x40a541
push 0x401a83
push 0x401c81
call dword [sym.imp.MSVCRT.dll__strcmpi]
pop ecx
pop ecx
test eax, eax
jne 0x40a543
jmp 0x40a5a3
push 0
push 0x408690
push dword [0x40121c]
call fcn.004093c7
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x401b82
call dword [sym.imp.MSVCRT.dll__unlink]
pop ecx
push 0x401a83
call dword [sym.imp.MSVCRT.dll__unlink]
pop ecx
call fcn.00409dea
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [0x40121c]
call dword [sym.imp.MSVCRT.dll__unlink]
pop ecx
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [sym.imp.MSVCRT.dll___argc]
cmp dword [eax], 1
jle 0x40a62a
push 0x407b74
lea eax, [ebp - 0x294]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov dword [ebp - 0x298], 1
jmp 0x40a5d9
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
mov eax, dword [sym.imp.MSVCRT.dll___argc]
mov ecx, dword [ebp - 0x298]
cmp ecx, dword [eax]
jge 0x40a61b
mov eax, dword [sym.imp.MSVCRT.dll___argv]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x298]
push dword [eax + ecx*4]
lea eax, [ebp - 0x294]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x408694
lea eax, [ebp - 0x294]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x40a5cc
push 0xa
lea eax, [ebp - 0x294]
push eax
call dword [0x401578]
push 0x408698
push 0x7f
push 0
push 4
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40a650
xor eax, eax
jmp 0x40a6a9
lea eax, [ebp - 0x194]
push eax
push 0
push 0
push 0x40a473
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea eax, [ebp - 0x190]
push eax
push 1
call dword [0x40156c]
lea eax, [ebp - 0x194]
push eax
push 0
push 0
push 0x40a233
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 1
pop eax
test eax, eax
je 0x40a6a7
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40a693
xor eax, eax
leave
ret 0x10
Function at 0x1007b4b0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x28]
mov esi, dword [0x1008a250]
mov edi, esi
add edi, 0xffffe857
mov dword [0x1008a250], edi
mov byte [ebp - 0x28], 0x56
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x75
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x41
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x63
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0xdc
add esi, 0xffffe664
mov dword [0x1008a254], esi
mov dword [esp], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
call fcn.1007bd30
cmp eax, 0
mov dword [ebp - 0x34], eax
je 0x1007b5ca
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.1007a710
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x3c], ecx
mov dword [0x1008a250], 0x1533
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x48], ecx
add ecx, 0x252e
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x1007b5c0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x48
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x48
pop esi
pop edi
pop ebp
ret
Function at 0x1007b990
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [0x1008a250], 0xe55
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x1008a254], 0xc8a
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x1007ba37
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [0x1008a250], 0xece
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jl 0x1007b9cf
jmp 0x1007ba37
mov dword [0x1008a250], 0x1201
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1007ba66
jmp 0x1007baad
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1007ba55
jmp 0x1007baad
mov eax, dword [ebp - 0x1c]
mov dword [0x1008a254], 0x1363
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
je 0x1007ba26
jmp 0x1007baad
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1007ba08
jmp 0x1007baad
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1007baad
mov dword [0x1008a254], 0xada
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1007baad
mov eax, 0x936
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
je 0x1007bac1
xor eax, eax
mov ecx, dword [0x1008a250]
add ecx, 0xffffe352
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x1008a250], ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1007bd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dl, 0x6b
lea esi, [ebp - 0x6c]
lea edi, [ebp - 0x2c]
mov ebx, dword [0x1008a250]
add ebx, 0xffffeb62
mov dword [0x1008a254], ebx
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0xdc
mov dword [0x1008a250], 0x14ad
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], esi
mov byte [ebp - 0x7d], dl
mov al, byte [ebp - 0x7d]
mov ecx, dword [ebp - 0x78]
movsx edx, al
mov si, dx
mov edx, ecx
add edx, 1
mov word [ebp + ecx*2 - 0x6c], si
mov al, byte [ebp + ecx - 0x2b]
cmp al, 0
mov dword [ebp - 0x78], edx
mov byte [ebp - 0x7d], al
jne 0x1007bdac
xor eax, eax
lea ecx, [ebp - 0x6c]
mov dword [0x1008a250], 0xf65
mov dword [0x1008a254], 0x1523
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0x84], eax
call fcn.1007a4b0
mov dword [esp], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
call fcn.10079a80
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1007be20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1008a258], 0
mov dword [0x1008a25c], 0
mov dword [0x1008a268], 0
mov dword [0x1008a254], 0x1d61
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1007bfad
jmp 0x1007bf99
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
jmp 0x1007bfb5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov esi, 0x100
add ecx, 1
mov dword [0x1008a250], 0x1ef4
mov edi, eax
add edi, 1
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1008a258], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x38]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x1008a25c], edx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x1008a260], cl
mov dword [0x1008a250], 0x2041
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1008a260]
mov edx, dword [0x1008a25c]
mov byte [ebx + edx], cl
mov dword [0x1008a250], 0x2000
mov edx, dword [0x1008a258]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1008a25c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x1008a254], 0x1e75
and ecx, 0xff
mov dword [0x1008a268], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x34]
mov ch, byte [edx + esi]
mov dword [0x1008a254], 0x16e4
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [0x1008a254]
add edx, 0xffffef35
mov dword [0x1008a250], edx
mov esi, dword [ebp - 0x10]
cmp edi, esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], edx
je 0x1007be79
mov eax, dword [0x1008a25c]
mov ecx, dword [0x1008a258]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
jmp 0x1007be84
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], eax
jmp 0x1007be84
mov eax, dword [0x1008a250]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 0xe7b
mov dword [0x1008a250], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1007bfd0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x1008a250], 0x270b
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1007aa50
lea ecx, [0x1007a320]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x30], edx
mov dword [0x1008a254], 0x103
mov dword [esp + 0x34], 0x142c00
mov edx, dword [0x1008a23c]
mov dword [esp + 0x38], edx
mov edx, dword [0x1008a240]
mov dword [esp + 0x68], edx
mov edx, dword [0x1008a244]
mov dword [esp + 0x40], edx
mov edx, dword [0x1008a248]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1008a24c]
mov dword [esp + 0x7c], edx
mov dword [0x1008a250], 0x110e
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1007c080
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x1007c0a3
jmp 0x1007c08f
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x1007c066
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1007c080
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov dword [0x1008a250], 0x17f2
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x74], eax
mov dword [0x1008a254], 0xffffe4be
call fcn.1007b990
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x1007c12e
lea eax, [esp + 0x28]
mov ecx, dword [0x1008a250]
add ecx, 0xffffe147
mov dword [0x1008a250], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1007b4b0
mov ecx, dword [0x1008a250]
add ecx, 0xfffff2ba
mov dword [0x1008a250], ecx
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000f197
pop dword [ebp - 0x50]
mov eax, 0x1000f197
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3a99d
push 0
mov eax, 0x641d11c2
add eax, 0xabe42ea2
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x2dd3a188
add ecx, 0xd22cac8d
xor edx, edx
add edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x50]
mov edi, 0x78f49ef7
sub edi, 0xccc9ab1e
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
add dword [ebp - 0x18], 0x4c2d6005
sub esi, edi
xor dword [ebp - 0x3c], 0x312f5459
mov dword [edx], esi
xor dword [ebp - 0x44], esi
add edx, 0x24001c8e
add edx, 0xdbffe376
add ebx, 4
loop 0x1000f1ed
add eax, 0x85e0e0f7
add eax, 0x7a204a30
mov ebx, eax
add eax, 0xa1a2ef43
add eax, 0x5e5d10c2
mov ecx, 0xef66f91f
sub ecx, 0xdf66f91f
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x418aa4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00404d2b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x418adc
xor eax, eax
jmp 0x418b08
cmp esi, dword [ebp - 4]
je 0x418b05
cmp dword [ebp + 0xc], 0
je 0x418b05
push dword [edi + 0x9c]
call fcn.004186b2
push dword [edi + 0x9c]
mov esi, eax
call fcn.00403f74
pop ecx
pop ecx
cmp esi, eax
je 0x418ad8
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x409b47
pop dword [ebp - 0x30]
mov eax, 0x409b47
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xc6a48035
sub dword [ebp - 0x40], 0x78523aea
mov dword [ebp - 0x3c], 0xbd353b14
sub dword [ebp - 0x3c], 0x8b01eecf
mov dword [ebp - 0x38], 0x3aa8061f
sub dword [ebp - 0x38], 0xee5bc1f1
mov dword [ebp - 0x34], 0x2f8a9aea
sub dword [ebp - 0x34], 0x2f8a9aea
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x5485dd5d
add dword [ebp - 0x40], 0x1fec8bf9
mov dword [ebp - 0x3c], 0x1658e0f2
add dword [ebp - 0x3c], 0x2b138083
mov dword [ebp - 0x38], 0xa47fd7e7
sub dword [ebp - 0x38], 0x41106b7b
mov dword [ebp - 0x34], 0xc6198477
add dword [ebp - 0x34], 0x39e67b89
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x3f1c4548
sub eax, 0x3edb74fc
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38ca6
push 0
call eax
mov ecx, 0xd2557e22
add ecx, 0x2daac6dc
xor edi, edi
add edi, eax
mov ebx, 0x5b388648
sub ebx, 0x5af6d648
add ebx, dword [ebp - 0x30]
mov esi, 0x833e40f3
add dword [ebp - 4], 0xa300b484
mov edx, dword [ebx]
xor dword [ebp - 0x24], eax
sub edx, esi
mov dword [edi], edx
xor dword [ebp - 0x10], 0xeebc8057
add edi, 0xb0f3950c
sub edi, 0xb0f39508
add ebx, 4
loop 0x409c5b
add eax, 0xbb1a0cb8
sub eax, 0xbb1905ed
mov ebx, eax
add eax, 0x21c25dbd
add eax, 0xde3da248
mov ecx, 0xf3aceeb9
sub ecx, 0xf36ceeb9
add ecx, dword [ebp - 0x30]
call ebx
leave
ret