joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435374
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call 0xfe422d5f
jge 0x4353f1
sahf

Function at 0x47a814
Capabilities:
Encode data using xor

Disassembly:
add al, 0x8b
push cs
jmp 0x47a81b
mov eax, dword [ecx]
xor esi, esi
and dword [eax + 0x37490410], 0xffffffff
cmp dword [ebx], esi
jle 0x47a83d
mov edi, dword [ebp + 0x14]
push dword [edi + esi*4]
call fcn.0040918f
inc esi
cmp esi, dword [ebx]
jl 0x47a82d
mov edi, dword [ebp + 0xc]
push 0
push ecx
call fcn.004090b3
pop ecx
pop ecx
sti
mov dword [ebp + 0x15], esi
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
push 0x11e82
call fcn.00469ead
or eax, 0xffffffff
jmp 0x47a864
je 0x47a876
pop ebx
test dl, bh
mov edx, eax
adc al, 0xf2
or al, 0x33
rcl byte [esi + 0x2c], cl
mov al, 0x10
xor ecx, ecx
Function at 0x48e15f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add eax, 0x5050505
add eax, 0x5050705
add eax, 0x5050505
add eax, 0x5050505
or byte [0xe050505], al
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
or dword [ecx], ecx
or dword [0xa050505], eax
inc esi
push ds
add dword [0xb010505], eax
or ecx, dword [ebx]
or ecx, dword [esp + ecx]
or al, 5
or al, 5
or al, 5
add eax, 0x1050505
add dword [ecx], eax
add dword [ecx], eax
add eax, 0x10d0505
or eax, 0xd010d01
add dword [esi + 0x1e], eax
add dword [ecx], eax
add eax, 0x51891442
push ebx
push cs
mov ebx, ecx
push edi
mov edi, edx
fst dword [edi - 0x75]
cli
mov esi, dword [ebx]
cmp esi, edi
ja 0x166e26a
mov dword [ebp - 4], 0x11e80
mov eax, esi
mov ecx, 0x11e80
cdq
idiv ecx
movzx eax, byte [eax + 0x4b2060]
shl eax, 7
add eax, edx
movzx ecx, word [eax*2 + 0x4a5560]
movzx eax, byte [ecx*8 + 0x4a2f53]
jne 0x48e1bf
jne 0x48e25e
mov ecx, dword [ecx*8 + 0x4a2f54]
add ecx, esi
cmp ecx, esi
jne 0x48e210
inc esi
cmp esi, edi
jbe 0x48e1d4
cmp esi, edi
ja 0x48e26a
inc dword [ebp + 0xd]
mov dword [eax], ecx
jmp 0x48e24c
inc ecx
inc esi
cmp esi, edi
jbe fcn.0048e21b
mov eax, dword [ebp + 0xc]
dec ecx
mov dword [ebx], esi
mov dword [eax], ecx
xor eax, eax
jmp 0x48e26d
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
lea ecx, [esi + 1]
mov dword [ebx], ecx
jmp 0x48e26d
or eax, 0xffffffff
pop edi
pop esi
je 0x430c6c6f
adc al, 0x89
sub esp, 0x50
jne 0x48e28a
je 0x8a236e7b
jge 0x48e27c
mov esi, dword [edi]
add esi, 2
movzx eax, word [esi]
mov bh, 6
jne 0x48e252
je 0x48e2c7
xor edx, edx
mov dword [ebx], edx
cmp eax, 0x7b
jne 0x48e2e4
cmp word [esi + 2], 0x5e
jne 0x48e2aa
mov dword [ebx], 0x8bff3701
add esi, 2
mov eax, edx
add esi, 2
movzx ecx, word [esi]
test cx, cx
je 0x48e2c7
cmp ecx, 0x7d
je 0x48e2db
mov word [ebp + eax*2 - 0x50], cx
inc eax
cmp eax, 0x1f
jl 0x48e2ac
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x11e002e
xor ecx, dword [ebx]
mov dword [edi], esi
pop edi
pop esi
je 0x340c6cd6
xor ecx, ecx
leave
mov word [ebp + eax*2 - 0x50], cx
jmp 0x48e2ee
mov word [ebp - 0x50], ax
xor eax, eax
mov word [ebp - 0x4e], ax
mov eax, 0x57000092
mov dword [edi], esi
mov dword [ebp - 0xc], eax
lea ecx, [eax + edx]
lea eax, [ebp - 0x50]
sar ecx, 1
mov dword [ebp - 4], eax
imul eax, ecx, 6
movzx ebx, word [eax + 0x4b7390]
add ebx, 0x4b6f20
inc dword [ebp - 4]
movzx edi, word [eax]
test di, di
jne 0x48e323
cmp byte [ebx], 0
je 0x48e36f
movzx edi, word [eax]
add eax, 2
mov dword [ebp - 4], eax
movzx eax, byte [ebx]
inc ebx
mov dword [ebp - 0x10], edi
cmp di, ax
mov edi, dword [ebp - 8]
imul esi, ecx, 6
xor eax, eax
mov ecx, dword [ebp + 8]
inc eax
movzx edx, word [esi + 0x4b7392]
mov dword [ecx], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [esi + 0x4b7394]
mov dword [ecx], edx
jmp 0x31e2d4

Function at 0x48e21b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, esi
cdq
idiv dword [ebp - 4]
movzx eax, byte [eax + 0x4b2060]
shl eax, 7
add eax, edx
movzx eax, word [eax*2 + 0x4a5560]
cmp byte [eax*8 + 0x4a2f53], 0
jne 0x48e252
mov eax, dword [eax*8 + 0x4a2f54]
add eax, esi
cmp eax, ecx
jne 0x48e252
Function at 0x401029
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401a4f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 7
push esi
push str..PhysicalDrive0
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x401b45
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
lea esi, [ebp - 0x41c]
mov dword [ebp - 4], 0x400
mov ebx, dword [ebp - 4]
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push ebx
push esi
lea eax, [ebp - 0x1c]
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
je 0x401af3
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], esi
cmp eax, ebx
jbe 0x401ad4
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
jmp 0x401af3
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x401af3
lea edi, [eax + esi]
push edi
call fcn.00402c90
push eax
push edi
push dword [ebp + 8]
call fcn.004018cc
add esp, 0x10
xor edi, edi
lea eax, [ebp - 0x41c]
cmp esi, eax
je 0x401b04
push esi
call fcn.00402c76
pop ecx
cmp dword [ebp - 8], edi
jne 0x401b3a
cmp dword [ebp - 0xc], edi
jne 0x401b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401b3a
cmp dword [ebp - 4], ebx
ja 0x401b27
or bx, 0xfff
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp - 4]
call fcn.00402c68
mov esi, eax
pop ecx
cmp esi, edi
jne 0x401a98
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x4038a1
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x4038b9
push dword [esp + 4]
push 0x40383a
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x4038f6
push esi
mov esi, dword [0x40c428]
test esi, esi
je 0x4038f5
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x4038ed
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
push edi
push 0x40c428
call 0x407bc4
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x4038c6
pop edi
pop ebx
pop esi
ret 4

Function at 0x404227
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x64
pop ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x4042fe
mov eax, dword [ebp - 0xc]
dec eax
je 0x4042e1
dec eax
jne 0x4042fe
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x404284
cmp byte [ebp - 0x1e], 1
jne 0x404284
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x4042dd
dec eax
je 0x4042d9
dec eax
je 0x4042b7
dec eax
jne 0x4042fe
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4042a9
dec eax
jne 0x4042fe
neg esi
sbb esi, esi
and esi, 5
jmp 0x4042b0
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
mov ebx, esi
jmp 0x4042fe
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4042d5
dec eax
je 0x4042d1
dec eax
jne 0x4042fe
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x4042b3
push 0x3c
jmp 0x4042fd
push 0x32
jmp 0x4042fd
push 0x14
jmp 0x4042fd
push 5
jmp 0x4042fd
cmp dword [ebp - 0x14], 0
je 0x4042fb
cmp dword [ebp - 0x14], 0xa
je 0x4042f7
cmp dword [ebp - 0x14], 0x5a
jne 0x4042fe
push 0x28
jmp 0x4042fd
push 0x1e
jmp 0x4042fd
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret

Function at 0x40643c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
test eax, eax
mov edi, dword [sym.imp.USER32.DLL_GetPropA]
mov dword [ebp - 4], eax
je 0x4064c7
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push 9
call esi
test al, al
jns 0x4064b9
push 0x11
call esi
test al, al
js 0x4064b9
push 0x10
call esi
test al, al
js 0x4064b9
push 0x12
call esi
test al, al
js 0x4064b9
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push 0x40a0e8
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x4064b9
push eax
push eax
push 0x44e
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, 0x800
je 0x4064e7
push 0x40a0dc
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4064e7
push 0x40a074
push dword [ebp + 8]
call edi
test eax, eax
je 0x4064e7
dec eax
push eax
push dword [0x40c71c]
call fcn.004075e1
mov eax, dword [eax + 8]
jmp 0x4064e9
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x40677c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push 0x40a134
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x40c674], eax
je 0x4067af
push 0x40a128
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40c678], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x40c670], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4067ed
cmp dword [ebp - 0xc], 1
je 0x4067fe
cmp dword [ebp - 0xc], 2
jne 0x4067ed
cmp dword [ebp - 0x18], 5
jb 0x4067fe
jne 0x4067ed
cmp dword [ebp - 0x14], edi
jne 0x4067ed
mov dword [0x40c670], edi
cmp dword [0x40c670], edi
je 0x406804
call fcn.004066c3
test eax, eax
jne 0x406804
mov dword [0x40c670], edi
pop edi
add ebp, 0x78
leave
ret
Function at 0x10001641
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x108]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001666
push esi
push dword [ebp + 0xc]
sub ecx, edx
lea eax, [ebp - 0x108]
push dword [ebp + 8]
add eax, ecx
push str.Mario_Nieto_s._s.lcs
push eax
call fcn.10001246
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea eax, [ebp - 0x108]
push 0x10031b08
push eax
call fcn.1000ecba
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100016e1
push dword [ebp + 0x10]
lea edx, [ebp - 4]
lea ecx, [ebp - 0x208]
call fcn.10001281
push esi
push 1
push dword [ebp - 4]
lea ecx, [ebp - 0x208]
push ecx
call fcn.1000f1bf
push esi
call fcn.1000eedd
xor eax, eax
add esp, 0x18
inc eax
pop esi
leave
ret

Function at 0x10003019
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10029404
call fcn.10028248
mov eax, 0x1410
call fcn.1000b520
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
cmp edx, 0x11
ja case.default.0x1000303f
jmp dword [edx*4 + 0x10003145]
push 0x28
jmp 0x10003074
push 5
jmp 0x10003074
mov eax, edi
jmp 0x10003075
push 0x1a
jmp 0x10003074
push 0x23
jmp 0x10003074
push 0x2e
jmp 0x10003074
push 0x26
jmp 0x10003074
push 0x2a
jmp 0x10003074
push 0x1c
jmp 0x10003074
push 0xd
jmp 0x10003074
push 0xe
jmp 0x10003074
push 0x27
pop eax
push edi
push eax
lea eax, [ebp - 0x41c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x1000303f
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x10]
call fcn.10007fb1
mov dword [ebp - 4], 2
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.10002779
push dword [ebp - 0x10]
call fcn.100034b8
pop ecx
pop ecx
jmp 0x10003135
xor eax, eax
mov word [ebp - 0x141c], ax
lea eax, [ebp - 0x141c]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x141c]
push eax
lea ecx, [ebp - 0x10]
call fcn.10007fb1
mov dword [ebp - 4], edi
jmp 0x100030a3
xor eax, eax
mov word [ebp - 0x141c], ax
lea eax, [ebp - 0x141c]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x141c]
push eax
lea ecx, [ebp - 0x10]
call fcn.10007fb1
mov dword [ebp - 4], 1
jmp 0x100030a3
call fcn.100073eb
mov edx, eax
mov ecx, esi
call fcn.10002eee
jmp 0x10003135
xor edx, edx
jmp 0x10003124
mov dword [esi], 0x1003bb84
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x100053d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xc], esi
mov ebx, dword [esi + 0x2c]
lea ecx, [esi + 0x38]
mov dword [ebp - 0x18], ebx
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x3c]
add eax, 0xfffffefa
sub edi, dword [esi + 0x74]
add eax, ebx
sub edi, dword [esi + 0x6c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edi
cmp dword [esi + 0x6c], eax
jb 0x1000549d
mov ecx, dword [ecx]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.1000bc30
mov ecx, dword [esi + 0x4c]
add esp, 0xc
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
sub dword [esi + 0x5c], ebx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
mov edi, dword [ebp - 8]
movzx ecx, bx
mov dword [ebp - 4], ecx
lea esi, [esi - 2]
movzx eax, word [esi]
mov edx, eax
sub eax, ecx
xor ecx, ecx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [esi], cx
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x10005440
mov esi, dword [ebp - 0xc]
mov edi, ebx
movzx ecx, bx
mov dword [ebp - 8], ecx
mov eax, dword [esi + 0x40]
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
movzx eax, word [esi]
mov edx, eax
sub eax, ecx
xor ecx, ecx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [esi], cx
mov ecx, dword [ebp - 8]
sub edi, 1
jne 0x10005470
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
add edi, ebx
lea ecx, [esi + 0x38]
mov dword [ebp - 8], ecx
mov ebx, dword [esi]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 4]
test eax, eax
je 0x1000556c
mov ebx, dword [esi + 0x74]
add ebx, dword [ecx]
mov edx, dword [esi + 0x6c]
add ebx, edx
cmp eax, edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
cmovbe edi, eax
test edi, edi
jne 0x100054ca
xor edi, edi
jmp 0x10005529
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x100054eb
mov edx, dword [ebx]
mov ecx, dword [ebx + 0x30]
push edi
call fcn.10004cb2
pop ecx
mov ecx, dword [ebp - 8]
jmp 0x1000550a
mov dword [ebp - 4], ecx
cmp eax, 2
jne 0x10005510
mov edx, dword [ebx]
test edx, edx
jne 0x100054fd
xor eax, eax
jmp 0x10005507
mov ecx, dword [ebx + 0x30]
push edi
call fcn.10004ef0
pop ecx
lea ecx, [esi + 0x38]
mov dword [ebp - 4], ecx
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x14]
call fcn.1000bc30
add dword [ebx], edi
add esp, 0xc
add dword [ebx + 8], edi
mov edx, dword [esi + 0x6c]
mov ecx, dword [ebp - 4]
add edi, dword [esi + 0x74]
mov dword [esi + 0x74], edi
cmp edi, 3
jb 0x10005552
mov eax, dword [ecx]
mov ecx, dword [esi + 0x58]
movzx edx, byte [edx + eax]
mov dword [esi + 0x48], edx
shl edx, cl
mov ecx, dword [esi + 0x6c]
movzx eax, byte [ecx + eax + 1]
xor edx, eax
and edx, dword [esi + 0x54]
mov dword [esi + 0x48], edx
cmp edi, 0x106
jae 0x1000556c
mov eax, dword [esi]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x100053f0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007723
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100292a6
call fcn.10028248
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
call fcn.1000a5cd
mov esi, eax
push 1
mov dword [ebp - 4], ebx
call fcn.100098d9
pop ecx
pop ecx
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10007a5f
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100085e0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x10002e39
mov ebx, ecx
push 0x10002c46
push 4
push 4
lea eax, [ebx + 0x48]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 0x10], eax
call fcn.1000a74c
and dword [ebp - 0x14], 0
lea edx, [ebx + 0x48]
push 0x12
mov edi, ebx
mov dword [ebp - 4], edx
pop ecx
mov esi, 0x10035ad0
mov ebx, 0x10034ad0
rep movsd dword es:[edi], dword [esi]
push dword [edx]
call fcn.100123e0
mov dword [esp], 0x400
call fcn.10014370
mov edx, dword [ebp - 4]
mov esi, ebx
pop ecx
add ebx, 0x400
mov ecx, 0x100
mov edi, eax
mov dword [edx], eax
add edx, 4
mov dword [ebp - 4], edx
rep movsd dword es:[edi], dword [esi]
cmp ebx, 0x10035ad0
jl 0x10008623
mov ebx, dword [ebp - 0xc]
mov edx, 0x10035ad0
mov esi, dword [ebp - 0x14]
sub edx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0x12
mov ecx, dword [ebp + 8]
xor edi, edi
push 4
pop ebx
movzx eax, byte [esi + ecx]
shl edi, 8
or edi, eax
lea eax, [esi + 1]
xor esi, esi
cmp eax, 0x14
cmovl esi, eax
sub ebx, 1
jne 0x1000867a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + edx]
xor eax, edi
mov dword [ecx], eax
add ecx, 4
sub dword [ebp - 8], 1
mov dword [ebp - 4], ecx
jne 0x10008672
and dword [ebp + 8], ebx
and dword [ebp - 4], ebx
xor esi, esi
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea eax, [ebp + 8]
push eax
call fcn.1000875a
mov eax, dword [ebp + 8]
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 4]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x100086b4
push 4
pop edi
xor esi, esi
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea eax, [ebp + 8]
push eax
call fcn.1000875a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [esi + ecx], eax
mov ecx, dword [edx]
mov eax, dword [ebp - 4]
mov dword [esi + ecx + 4], eax
add esi, 8
cmp esi, 0x400
jl 0x100086dd
add edx, 4
mov dword [ebp - 0x10], edx
sub edi, 1
jne 0x100086db
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x1000875a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov ebx, dword [edi]
xor edi, edi
mov edx, dword [esi + 0x4c]
xor ebx, dword [esi + edi*4]
mov eax, ebx
mov dword [ebp - 8], ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
shr ecx, 0x18
mov edx, dword [edx + eax*4]
mov eax, dword [esi + 0x48]
add edx, dword [eax + ecx*4]
mov eax, ebx
mov ecx, dword [esi + 0x50]
shr eax, 8
movzx eax, al
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi + 0x54]
movzx eax, bl
add edx, dword [ecx + eax*4]
xor edx, dword [ebp - 4]
inc edi
mov ecx, dword [ebp - 8]
mov ebx, edx
mov edx, dword [esi + 0x4c]
mov dword [ebp - 4], ecx
cmp edi, 0x10
jl 0x10008776
mov eax, dword [esi + 0x44]
mov edi, dword [ebp + 8]
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [esi + 0x40]
pop edi
xor eax, ebx
pop esi
mov dword [ecx], eax
pop ebx
leave
ret 8

Function at 0x100095a7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 8], esi
test eax, eax
jg 0x100095cc
jl 0x100095c3
test ebx, ebx
jne 0x100095cc
xor eax, eax
xor edx, edx
jmp 0x10009689
cmp dword [esi + 0x38], 0
je 0x100095e1
push eax
push ebx
push dword [ebp + 8]
call fcn.100075db
jmp 0x10009689
mov eax, dword [esi + 0x1c]
push edi
mov edi, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x10009624
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0x10009624
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push ecx
push dword [ebp + 8]
call fcn.1000bc30
mov ecx, dword [ebp - 8]
sub edi, esi
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
jmp 0x1000962a
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [esi + 0x4c], 0
je 0x1000967e
mov ecx, esi
call fcn.10008ebe
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, 0xfff
cmp edi, eax
jbe 0x10009669
push dword [esi + 0x4c]
push eax
push 1
push ecx
call fcn.10014ea8
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x1000967e
jmp 0x1000963c
test edx, edx
je 0x1000967e
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.10014ea8
add esp, 0x10
sub edi, eax
mov edx, dword [ebp + 0x10]
sub ebx, edi
mov eax, ebx
sbb edx, 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1000a1cf
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x1000a204
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x1000a201
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x1000a20d
add edx, 0x28
cmp edx, esi
jne 0x1000a1ef
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1000a20a

Function at 0x1001667a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100166b9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100166b9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100166b9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100166b9
cmp dword [ecx + 0x74], 0xe
jbe 0x100166b9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100190bc
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x100190d6
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x100190ed
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x10019145
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.10023120
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x10019145
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10019145
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10019145
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x1001913f
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x10019141
xor bl, bl
mov al, bl
jmp 0x10019147
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x1001eb26
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10018274
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001eb95
cmp esi, dword [ebp - 4]
je 0x1001eb90
cmp dword [ebp + 0xc], 0
je 0x1001eb90
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001eb6d
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1001e67b
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1001eb97
xor eax, eax
inc eax
jmp 0x1001eb97
xor eax, eax
pop edi
pop esi
leave
ret