joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002a66
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10094040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10002a8c
xor eax, eax
jmp 0x10002b51
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10002ab5
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x10002ab5
dec dword [edx]
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
mov eax, ebx
jmp 0x10002b51
cmp dword [esi + 0x4c], 0
je 0x10002b4f
mov ecx, esi
call fcn.1000338f
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10002ae3
movsx eax, bl
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
pop ecx
cmove ebx, edi
jmp 0x10002aae
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10002b1e
sub eax, 1
je 0x10002b1e
dec eax
sub eax, 1
jne 0x10002b4f
movsx eax, byte [ebp - 0x25]
jmp 0x10002ad0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x10002b42
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x10002b4f
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
cmovne edi, ebx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100739ff
leave
ret 4
Function at 0x100033b2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10094040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x1000340a
cmp byte [esi + 0x3d], bl
je 0x1000340a
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003444
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x1000341b
sub eax, 1
je 0x1000341e
dec eax
sub eax, 1
jne 0x10003444
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100739ff
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000343c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10003444
cmp byte [esi + 0x3d], bl
sete al
jmp 0x1000340c
xor al, al
jmp 0x1000340c

Function at 0x10003e05
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003e92
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
pop ecx
test esi, esi
js 0x10003e92
jne 0x10003e38
xor eax, eax
jmp 0x10003e95
lea eax, [esi + 1]
push 0x10080750
push eax
call fcn.10073b53
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10003e52
push 0xfffffffffffffffe
jmp 0x10003e94
xor eax, eax
push eax
push eax
push dword [ebp + 8]
mov byte [edi + esi], al
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [ebp + 8]
push esi
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x1c
cmp eax, esi
je 0x10003e7b
push 0xfffffffffffffffd
pop esi
jmp 0x10003e87
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.10004326
mov esi, eax
push edi
call fcn.10073a6e
pop ecx
mov eax, esi
jmp 0x10003e95
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
leave
ret 4
Function at 0x10008525
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ecx]
mov ecx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.100059fd
mov edi, eax
neg eax
push eax
push ebx
call fcn.1004d410
not edi
mov esi, eax
push edi
push ebx
call fcn.1004d0e0
add esp, 0x10
mov dword [ebp + 8], esi
mov edx, 0x811c9dc5
xor ecx, ecx
pop edi
pop esi
pop ebx
movzx eax, byte [ebp + ecx + 8]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1000855c
mov eax, edx
pop ebp
ret 4

Function at 0x100085d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
push edi
mov ecx, 0x811c9dc5
mov esi, dword [eax + 4]
mov edi, dword [eax]
test esi, esi
je 0x100085fd
movzx eax, byte [edx + edi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, esi
jb 0x100085ec
pop edi
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x10053de0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10094040]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
mov ebp, dword [esp + 0x234]
push esi
mov esi, dword [esp + 0x234]
push edi
mov edi, dword [esp + 0x230]
push str._5_4
push esi
push str._s_s
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebp
call fcn.1004c970
push eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x10053e4f
push esi
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10053f62
push str.LUA_NOENV
push 0xfff0b9d8
push edi
call fcn.1004c240
push 0xffffffffffffffff
push edi
call fcn.1004d250
push 0xfffffffffffffffe
push edi
mov esi, eax
call fcn.1004d0e0
add esp, 0x1c
test esi, esi
jne 0x10053f62
push 0x1007e300
push ebx
call sub.VCRUNTIME140.dll_strstr
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10053e96
push ebx
jmp 0x10053f63
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10053ea0
lea eax, [esp + 0x18]
sub esi, ecx
push eax
push edi
call fcn.1004dce0
add esp, 8
cmp ebx, ebp
jae 0x10053ef7
mov eax, ebp
sub eax, ebx
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.1004daf0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
cmp ecx, dword [esp + 0x1c]
jb 0x10053eeb
lea eax, [esp + 0x18]
push 1
push eax
call fcn.1004e8f0
mov ecx, dword [esp + 0x28]
add esp, 8
mov eax, dword [esp + 0x18]
mov byte [eax + ecx], 0x3b
inc dword [esp + 0x20]
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.1004db20
lea eax, [ebx - 2]
add esp, 8
add eax, esi
cmp ebp, eax
jae 0x10053f53
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x1c]
jb 0x10053f2e
lea eax, [esp + 0x18]
push 1
push eax
call fcn.1004e8f0
mov ecx, dword [esp + 0x28]
add esp, 8
mov eax, dword [esp + 0x18]
sub esi, ebp
mov byte [eax + ecx], 0x3b
lea eax, [esi - 2]
inc dword [esp + 0x20]
add eax, ebx
push eax
lea eax, [ebp + 2]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1004daf0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.1004e910
add esp, 4
jmp 0x10053f6c
push ebp
push edi
call fcn.1004ca80
add esp, 8
push 0x105
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10053fd4
cmp eax, 0x105
je 0x10053fd4
lea eax, [esp + 0x18]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x10053fd4
mov byte [eax], 0
lea eax, [esp + 0x18]
push eax
push 0x1007e2cc
push 0
push 0xffffffffffffffff
push edi
call fcn.1004d330
add esp, 0xc
push eax
push edi
call fcn.1004e300
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.1004cd80
push 0xfffffffffffffffe
push edi
call fcn.1004d0e0
add esp, 0x24
jmp 0x10053fe2
push str.unable_to_get_ModuleFileName
push edi
call fcn.1004e080
add esp, 8
push dword [esp + 0x14]
push 0xfffffffffffffffd
push edi
call fcn.1004cde0
push 0xfffffffffffffffe
push edi
call fcn.1004d0e0
mov ecx, dword [esp + 0x23c]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100739ff
add esp, 0x21c
ret
Function at 0x10059000
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x2c]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
push edi
mov edi, 0xff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x10], eax
xor ebp, edx
xor edi, ebx
mov ebx, dword [esp + 0x14]
xor ecx, esi
xor ebx, dword [esp + 0x10]
mov eax, ebp
mov ebp, dword [esp + 0x38]
xor esi, ebx
xor edx, edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edx
mov dword [ebp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [ebp], edx
xor esi, eax
mov edx, dword [esp + 0x14]
mov dword [ebp + 8], esi
xor edx, ecx
mov dword [ebp + 0xc], edx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
shld dword [esp + 0x10], ebp, 0x11
xor dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], edi
shl dword [esp + 0x10], 0xd
shrd edi, ebx, 0x13
shl ebp, 0x11
xor ebp, eax
mov dword [esp + 0x14], 0
or dword [esp + 0x14], edi
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
shr ebx, 0x13
or edi, ebx
mov dword [esp + 0x18], esi
sub dword [esp + 0x1c], 1
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [eax + 0x1c], edi
mov edi, esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 0x10], ebp
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ebx
jne 0x10059045
push dword [esp + 0x40]
mov esi, dword [esp + 0x38]
push dword [esp + 0x40]
push esi
call fcn.1004c9b0
push dword [esp + 0x54]
push dword [esp + 0x54]
push esi
call fcn.1004c9b0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1005a260
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10094040]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x228]
push ebp
push esi
push edi
mov edi, dword [esp + 0x230]
push edi
call fcn.1004c4b0
push ebx
mov esi, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_clearerr
add esp, 8
sub esi, 1
jne 0x1005a2b7
push 1
push ebx
push edi
call fcn.1005a990
mov ebp, dword [esp + 0x244]
add esp, 0xc
mov esi, eax
inc ebp
jmp 0x1005a43e
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.1004df10
mov ebp, dword [esp + 0x244]
mov eax, 1
add esp, 0xc
mov dword [esp + 0x10], eax
nop dword [eax]
dec esi
mov dword [esp + 0x14], esi
test eax, eax
je 0x1005a43a
push ebp
push edi
call fcn.1004d4f0
add esp, 8
cmp eax, 3
jne 0x1005a382
push ebp
push edi
call fcn.1004dd60
mov esi, eax
add esp, 8
test esi, esi
jne 0x1005a33e
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
mov esi, eax
push ebx
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ungetc
push 0x10080c32
push edi
call fcn.1004ca80
xor eax, eax
add esp, 0x14
cmp esi, 0xffffffff
mov esi, dword [esp + 0x14]
setne al
jmp 0x1005a42d
lea eax, [esp + 0x18]
push eax
push edi
call fcn.1004dce0
lea eax, [esp + 0x20]
push esi
push eax
call fcn.1004e8f0
push ebx
push esi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov esi, eax
lea eax, [esp + 0x38]
add dword [esp + 0x40], esi
push eax
call fcn.1004e910
xor eax, eax
add esp, 0x24
cmp eax, esi
mov esi, dword [esp + 0x14]
sbb eax, eax
neg eax
jmp 0x1005a42d
push 0
push ebp
push edi
call fcn.1004ddd0
add esp, 0xc
mov cl, byte [eax]
cmp cl, 0x2a
jne 0x1005a398
mov cl, byte [eax + 1]
movsx eax, cl
add eax, 0xffffffb4
cmp eax, 0x22
ja case.0x1005a3ae.77
movzx eax, byte [eax + 0x1005a4b8]
jmp dword [eax*4 + 0x1005a4a4]
push ebx
push edi
call fcn.1005aab0
add esp, 8
jmp 0x1005a42d
push 1
push ebx
push edi
call fcn.1005a990
add esp, 0xc
jmp 0x1005a42d
push 0
push ebx
push edi
call fcn.1005a990
add esp, 0xc
jmp 0x1005a42d
lea eax, [esp + 0x18]
push eax
push edi
call fcn.1004dce0
add esp, 8
nop dword [eax + eax]
lea eax, [esp + 0x18]
push 0x200
push eax
call fcn.1004e8f0
push ebx
push 0x200
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add dword [esp + 0x38], eax
add esp, 0x18
cmp eax, 0x200
je 0x1005a3f0
lea eax, [esp + 0x18]
push eax
call fcn.1004e910
add esp, 4
mov eax, 1
inc ebp
mov dword [esp + 0x10], eax
test esi, esi
jne 0x1005a2e0
mov esi, dword [esp + 0x10]
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
add esp, 4
test eax, eax
je 0x1005a46b
push 0
push 0
push edi
call fcn.1004e1b0
add esp, 0xc
jmp 0x1005a489
push str.invalid_format
push ebp
push edi
call fcn.1004dbb0
add esp, 0xc
jmp 0x1005a489
test esi, esi
jne 0x1005a480
push 0xfffffffffffffffe
push edi
call fcn.1004d0e0
push edi
call fcn.1004ca50
add esp, 0xc
sub ebp, dword [esp + 0x238]
mov eax, ebp
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100739ff
add esp, 0x21c
ret
Function at 0x1005a4e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.1004c4b0
mov edi, dword [ebp + 0x10]
add esp, 4
sub eax, edi
je 0x1005a5bd
dec eax
push edi
push ebx
mov dword [esp + 0x44], eax
call fcn.1004d4f0
add esp, 8
cmp eax, 3
jne 0x1005a58b
push edi
push ebx
call fcn.1004c5a0
add esp, 8
push 0
push edi
push ebx
test eax, eax
je 0x1005a547
call fcn.1004d2d0
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.1004d940
add esp, 0x1c
jmp 0x1005a562
call fcn.1004d3c0
add esp, 4
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.1004d940
add esp, 0x10
test esi, esi
je 0x1005a56a
test eax, eax
jg 0x1005a5b6
xor esi, esi
mov eax, dword [esp + 0x3c]
inc edi
test eax, eax
jne 0x1005a508
test esi, esi
jne 0x1005a5bd
push esi
push esi
push ebx
call fcn.1004e1b0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
push edi
push ebx
call fcn.1004ddd0
add esp, 0xc
test esi, esi
je 0x1005a56a
push dword [ebp + 0xc]
push dword [esp + 0x3c]
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, dword [esp + 0x38]
jne 0x1005a56a
mov esi, 1
jmp 0x1005a56c
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005cfe0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xd8
mov eax, dword [0x10094040]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
push ebp
mov ebp, dword [esp + 0xe8]
lea eax, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xec]
push eax
push edi
call fcn.1005c550
mov esi, eax
add esp, 8
test esi, esi
je 0x1005d034
mov ecx, dword [esp + 0x10]
sub esi, edi
mov edx, dword [esp + 0x14]
mov al, 3
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x1005d053
push 0x1007f8d8
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
add esp, 8
test eax, eax
je 0x1005d06c
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x1005d06e
xor eax, eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100739ff
add esp, 0xd8
ret
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.1005c4d0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1005d10b
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
je 0x1005d051
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005d0a0
sub ecx, edx
cmp ecx, 0xc8
ja 0x1005d051
lea edx, [esp + 0x18]
mov ecx, edi
sub edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1005d0c0
call sub.api_ms_win_crt_locale_l1_1_0.dll_localeconv
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x1c], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1005c4d0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1005d051
mov eax, edi
lea ecx, [esp + 0x18]
sub eax, ecx
add esi, eax
test esi, esi
je 0x1005d051
movsd xmm0, qword [esp + 0x10]
sub esi, edi
mov al, 0x13
movsd qword [ebp], xmm0
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x1005d053
Function at 0x1005d1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push esi
push edi
call sub.api_ms_win_crt_locale_l1_1_0.dll_localeconv
mov ecx, dword [esp + 0x1c]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x100804a9], 8
je 0x1005d224
mov al, byte [ecx + 1]
inc ecx
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x100804a9], 8
jne 0x1005d210
mov al, byte [esp + 0x1f]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x1005d239
mov dword [esp + 0xc], 1
jmp 0x1005d242
cmp al, 0x2b
mov dword [esp + 0xc], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x1005d387
mov al, byte [edx + 1]
cmp al, 0x78
je 0x1005d25a
cmp al, 0x58
jne 0x1005d387
movsd xmm2, qword [0x1007ee68]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov byte [esp + 0x1f], al
cmp ecx, dword [esp + 8]
jne 0x1005d286
cmp dword [esp + 0x14], 0
jne 0x1005d2db
mov dword [esp + 0x14], 1
inc edx
jmp 0x1005d265
movzx eax, al
test byte [eax + 0x100804a9], 0x10
je 0x1005d2db
test edi, edi
jne 0x1005d2a3
cmp byte [esp + 0x1f], 0x30
jne 0x1005d2a3
inc dword [esp + 0x10]
jmp 0x1005d2d0
inc edi
cmp edi, 0x1e
jg 0x1005d2cf
test byte [ecx + 0x100804a9], 2
je 0x1005d2b7
add ecx, 0xffffffd0
jmp 0x1005d2bd
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1005d2d0
inc esi
cmp dword [esp + 0x14], 0
je 0x1005d2d8
dec esi
inc edx
jmp 0x1005d265
mov eax, dword [esp + 0x10]
add eax, edi
je 0x1005d387
mov eax, dword [esp + 0x20]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x1005d2fa
cmp al, 0x50
jne 0x1005d362
mov al, byte [edx + 1]
xor ecx, ecx
mov byte [esp + 0x1f], al
cmp al, 0x2d
jne 0x1005d30f
lea edi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x1005d31c
xor eax, eax
xor edi, edi
cmp byte [esp + 0x1f], 0x2b
sete al
inc eax
add edx, eax
mov al, byte [edx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x100804a9], 2
je 0x1005d387
movsx eax, byte [esp + 0x1f]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x100804a9], 2
jne 0x1005d330
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [esp + 0x20]
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x1005d370
xorps xmm1, xmmword [0x1007ee80]
push esi
sub esp, 8
movsd qword [esp], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_ldexp
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
fldz
pop edi
pop esi
add esp, 0x10
ret
Function at 0x10061180
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
mov al, byte [eax + 0x4c]
mov byte [esp + 0x10], al
mov esi, dword [edi]
cmp esi, dword [esp + 0x18]
je 0x10061303
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x24]
nop word [eax + eax]
mov cl, byte [esi + 5]
test cl, 0x18
je 0x100612b8
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x100611d7.11
movzx eax, byte [eax + 0x10061330]
jmp dword [eax*4 + 0x10061308]
push esi
push ebx
call fcn.1005eae0
add esp, 8
jmp case.0x100611d7.11
lea eax, [esi + 0x10]
cmp dword [esi + 8], eax
je 0x100611fe
push esi
call fcn.1005edb0
add esp, 4
push 0x20
push esi
push ebx
call fcn.10069840
add esp, 0xc
jmp case.0x100611d7.11
movzx eax, byte [esi + 6]
lea eax, [eax*4 + 0x10]
push eax
push esi
push ebx
call fcn.10069840
add esp, 0xc
jmp case.0x100611d7.11
movzx eax, byte [esi + 6]
inc eax
shl eax, 4
push eax
push esi
push ebx
call fcn.10069840
add esp, 0xc
jmp case.0x100611d7.11
push esi
push ebx
call fcn.10062790
add esp, 8
jmp case.0x100611d7.11
push esi
push ebx
call fcn.100592a0
add esp, 8
jmp case.0x100611d7.11
movzx eax, word [esi + 6]
test ax, ax
jne 0x10061270
mov ecx, 0x10
jmp 0x10061278
mov ecx, eax
shl ecx, 4
add ecx, 0x18
mov eax, dword [esi + 8]
add eax, ecx
push eax
push esi
push ebx
call fcn.10069840
add esp, 0xc
jmp case.0x100611d7.11
push esi
push ebx
call fcn.10062300
movzx eax, byte [esi + 7]
add eax, 0x11
push eax
push esi
push ebx
call fcn.10069840
add esp, 0x14
jmp case.0x100611d7.11
mov eax, dword [esi + 0xc]
add eax, 0x11
push eax
push esi
push ebx
call fcn.10069840
add esp, 0xc
jmp case.0x100611d7.11
test cl, 7
jne 0x100612cc
and cl, 0xc1
and al, 0x18
or cl, al
or cl, 1
mov byte [esi + 5], cl
jmp 0x100612ef
movzx eax, cl
and cl, 0xf8
and eax, 7
or cl, byte [eax + 0x1007fb28]
mov byte [esi + 5], cl
and cl, 7
cmp cl, 3
jne 0x100612ef
cmp dword [ebp], 0
jne 0x100612ef
mov dword [ebp], esi
mov edi, esi
mov esi, dword [edi]
mov al, byte [esp + 0x18]
cmp esi, dword [esp + 0x20]
jne 0x100611b0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x10062010
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
xor eax, dword [esp + 0x10]
test esi, esi
je 0x1006203f
push edi
mov edi, dword [esp + 0xc]
movzx edx, byte [edi + esi - 1]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub esi, 1
jne 0x10062024
pop edi
pop esi
ret
Function at 0x10074e28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10074e4f
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10074e52
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10074e04
pop esi
leave
ret 8