joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10113b80
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x218
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x21c]
je 0x10113bc2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1011720d
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.101134d0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10113c10
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10113c10
cmp dword [esp + 4], 0xffffffff
je 0x10113c10
push eax
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1011720d
add esp, 0x218
ret 4

Function at 0x10113d70
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x22c]
je 0x10113dc8
push ecx
push eax
push dword [esp + 0x22c]
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 0x10
push esi
push ecx
push eax
lea ecx, [esp + 0xc]
call fcn.101132c0
mov eax, dword [esp + 0x218]
add eax, eax
shr eax, 1
push eax
push dword [esp + 0xc]
push dword [esp + 0x230]
push dword [esp + 0x230]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [esp + 4]
call fcn.10113460
lea ecx, [esp + 4]
mov esi, eax
call fcn.10113460
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x10113e31
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10113e31
cmp dword [esp + 4], 0xffffffff
je 0x10113e31
push eax
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 0x10
Function at 0x10113fe0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x644
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x640], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x648]
push esi
mov esi, dword [esp + 0x650]
push edi
mov edi, dword [esp + 0x65c]
je 0x10114029
push edi
push dword [esp + 0x65c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1011413f
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x224]
mov dword [esp + 0x224], 0
mov dword [esp + 0x228], 0
call fcn.101134d0
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.101134d0
push 0x104
push edi
lea ecx, [esp + 0x438]
call fcn.101132c0
push dword [esp + 0x434]
push dword [esp + 0x65c]
push dword [esp + 0x14]
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 0x430]
mov esi, eax
call fcn.10113460
mov eax, dword [esp + 0x434]
lea ecx, [esp + 0x438]
cmp eax, ecx
je 0x101140d7
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x101140d7
cmp dword [esp + 0x430], 0xffffffff
je 0x101140d7
push eax
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp + 0x434], 0
cmp ecx, eax
je 0x10114107
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10114107
cmp dword [esp + 8], 0xffffffff
je 0x10114107
push ecx
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x220]
lea eax, [esp + 0x224]
mov dword [esp + 0xc], 0
cmp ecx, eax
je 0x1011413d
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1011413d
cmp dword [esp + 0x21c], 0xffffffff
je 0x1011413d
push ecx
call fcn.1011741a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x648]
pop edi
pop esi
xor ecx, esp
call fcn.1011720d
add esp, 0x644
ret 0x10

Function at 0x10114160
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x101141aa
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.101132c0
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 4]
call fcn.10113460
mov esi, eax
test esi, esi
jle 0x101141dc
dec esi
lea ecx, [esp + 4]
call fcn.10113460
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x1011420a
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1011420a
cmp dword [esp + 4], 0xffffffff
je 0x1011420a
push eax
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 8
Function at 0x10114310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x10137de8], 0
mov ecx, dword [esp + 0x22c]
mov eax, dword [esp + 0x228]
push esi
mov esi, dword [esp + 0x224]
push ecx
push eax
je 0x1011436b
push dword [esp + 0x230]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 0x10
lea ecx, [esp + 0xc]
call fcn.101132c0
mov eax, dword [esp + 0x218]
add eax, eax
push eax
push dword [esp + 0xc]
push dword [esp + 0x230]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.10113460
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x101143c0
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x101143c0
cmp dword [esp + 4], 0xffffffff
je 0x101143c0
push edx
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 0x10
Function at 0x101143e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x444]
mov edx, dword [esp + 0x454]
mov ecx, dword [esp + 0x44c]
push ebx
mov ebx, dword [esp + 0x45c]
push ebp
mov ebp, dword [esp + 0x464]
push esi
mov esi, dword [esp + 0x46c]
push edi
mov edi, dword [esp + 0x460]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
je 0x10114453
push esi
push ebp
push ebx
push edx
push edi
push ecx
push dword [esp + 0x470]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x1011458a
test edi, edi
je 0x1011445b
mov eax, dword [edi]
jmp 0x1011445d
xor eax, eax
push eax
push ecx
lea ecx, [esp + 0x23c]
call fcn.101132c0
mov eax, dword [esp + 0x448]
add eax, eax
shr eax, 1
mov dword [esp + 0x18], eax
test esi, esi
je 0x10114482
mov eax, dword [esi]
jmp 0x10114484
xor eax, eax
push eax
push ebp
lea ecx, [esp + 0x24]
call fcn.101132c0
push esi
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push ebx
push dword [esp + 0x20]
push eax
push dword [esp + 0x24c]
push dword [esp + 0x470]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x10114516
test edi, edi
je 0x101144d5
lea ecx, [esp + 0x234]
call fcn.10113460
test eax, eax
jle 0x101144d3
dec eax
mov dword [edi], eax
test ebx, ebx
je 0x10114507
test esi, esi
je 0x10114507
mov eax, dword [ebx]
cmp eax, 2
je 0x101144ee
cmp eax, 1
je 0x101144ee
cmp eax, 7
jne 0x10114507
cmp dword [esp + 0x20], 0
mov eax, dword [esi]
je 0x10114501
push eax
lea ecx, [esp + 0x20]
call fcn.10113400
add eax, eax
mov dword [esi], eax
jmp 0x10114516
push dword [esi]
push ebp
push dword [esp + 0x28]
call fcn.101175c0
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.10113460
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
cmp ecx, eax
je 0x10114544
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10114544
cmp dword [esp + 0x1c], 0xffffffff
je 0x10114544
push ecx
call fcn.1011741a
add esp, 4
lea ecx, [esp + 0x234]
mov dword [esp + 0x20], 0
call fcn.10113460
mov ecx, dword [esp + 0x238]
lea eax, [esp + 0x23c]
cmp ecx, eax
je 0x10114586
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10114586
cmp dword [esp + 0x234], 0xffffffff
je 0x10114586
push ecx
call fcn.1011741a
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011720d
add esp, 0x440
ret 0x20
Function at 0x10114740
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x234
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x230], eax
cmp dword [0x10137de8], 0
mov ecx, dword [esp + 0x24c]
mov edx, dword [esp + 0x250]
mov eax, dword [esp + 0x23c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x254]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x258]
push ebx
mov ebx, dword [esp + 0x248]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x260]
push ebp
mov ebp, dword [esp + 0x250]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x244]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x270]
push edi
mov edi, dword [esp + 0x250]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], edx
je 0x101147f8
push dword [esp + 0x20]
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push dword [esp + 0x1c]
push dword [esp + 0x24]
push edx
push ecx
push ebp
push ebx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x10114867
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.101134d0
push dword [esp + 0x20]
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x3c]
push dword [esp + 0x34]
push ebp
push ebx
push edi
push dword [esp + 0x58]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edx, dword [esp + 0x30]
mov esi, eax
lea eax, [esp + 0x34]
cmp edx, eax
je 0x10114865
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10114865
cmp dword [esp + 0x2c], 0xffffffff
je 0x10114865
push edx
call fcn.1011741a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011720d
add esp, 0x234
ret 0x30
Function at 0x10114890
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x450]
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x448]
push ebx
mov ebx, dword [esp + 0x448]
push ebp
mov ebp, dword [esp + 0x454]
push esi
mov esi, dword [esp + 0x464]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x101148f6
push esi
push ecx
push eax
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
jmp 0x10114a8f
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x240]
mov dword [esp + 0x240], 0
mov dword [esp + 0x244], 0
call fcn.101134d0
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x24c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x10114a61
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10114a46
cmp eax, 2
jbe 0x101149c8
cmp eax, 7
jne 0x10114a46
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.101132c0
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x101149b5
lea ecx, [esp + 0x20]
call fcn.10113340
jmp 0x10114a61
cmp dword [esp + 0x24], 0
je 0x10114a36
push ecx
lea ecx, [esp + 0x24]
call fcn.10113400
jmp 0x10114a30
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.101132c0
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x10114a20
lea ecx, [esp + 0x20]
call fcn.10113340
jmp 0x10114a61
cmp dword [esp + 0x24], 0
je 0x10114a36
lea ecx, [esp + 0x20]
call fcn.10113460
mov ecx, eax
mov dword [esp + 0x10], ecx
lea eax, [ecx + ecx]
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.10113340
jmp 0x10114a61
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov edi, eax
mov ecx, dword [esp + 0x23c]
lea eax, [esp + 0x240]
cmp ecx, eax
je 0x10114a8f
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10114a8f
cmp dword [esp + 0x238], 0xffffffff
je 0x10114a8f
push ecx
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x44c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011720d
add esp, 0x440
ret 0x18
Function at 0x10115c20
Capabilities:
Create thread

Disassembly:
cmp dword [0x10137e08], 0
je 0x10115c2c
xor eax, eax
ret
push 8
push 0
push 0x100124d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [0x10137e18], eax
test eax, eax
je 0x10115cef
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100124e4
push eax
call esi
push 0x100124f4
push dword [0x10137e18]
mov dword [0x10137df8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
mov dword [0x10137dfc], eax
mov dword [0x10137e74], 0x3e8
call esi
push 0
push 0
push 0
push 0
mov dword [0x10137e00], eax
call esi
push 0x10137e20
mov dword [0x10137e04], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [0x10137e00], 0
pop esi
je 0x10115cef
cmp dword [0x10137e04], 0
je 0x10115cef
push 0
push 0
push 0x10115800
call fcn.1011d6fc
add esp, 0xc
mov dword [0x10137e0c], eax
push 0xffffffffffffffff
push dword [0x10137e00]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
mov eax, 0x80004005
cmp dword [0x10137e0c], ecx
cmovne eax, ecx
ret
mov eax, 0x80004005
ret

Function at 0x10116350
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x18
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [0x10135544]
mov ecx, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, ebx
mov dword [esp + 8], 0
and ebp, 0xfffeff
push esi
mov esi, dword [esp + 0x30]
cmp ebx, eax
jne 0x101163a2
test esi, esi
je 0x1011638c
mov dword [esi], eax
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1011720d
add esp, 0x18
ret 0xc
cmp dword [0x10137f70], 0
jne 0x101163c1
test esi, esi
je 0x101163b6
mov eax, dword [0x10137f9c]
mov dword [esi], eax
mov dword [0x10137f9c], ebx
jmp 0x10116473
push edi
xor edi, edi
xor edx, edx
cmp ecx, 0x40
jge 0x101163f3
imul edi, ecx, 0x904
add edi, dword [0x10137c64]
je 0x101163f3
cmp dword [edi + 0x8f8], edx
jne 0x101163ed
lea eax, [edi + 0x8f8]
push eax
call fcn.10115e30
mov edx, dword [edi + 0x8f8]
xor ecx, ecx
test edi, edi
pop edi
cmovne ecx, edx
test ecx, ecx
je 0x10116473
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x14]
push edx
push ebp
push ecx
call dword [eax + 0x48]
test eax, eax
jne 0x10116473
test esi, esi
je 0x10116438
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10116436
cmp dword [0x10137f9c], eax
jne 0x10116436
mov ecx, dword [0x10135544]
test ecx, ecx
je 0x10116436
mov dword [esi], ecx
jmp 0x10116438
mov dword [esi], eax
push 0xa
lea eax, [esp + 0x18]
mov dword [0x10135544], ebx
push eax
push 0x1004
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10116469
lea eax, [esp + 0x14]
push eax
call fcn.10118c10
add esp, 4
mov dword [0x10137f88], eax
jmp 0x10116473
mov dword [0x10137f88], 0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011720d
add esp, 0x18
ret 0xc
Function at 0x101247c0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1013567c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1011dc58
mov dword [ebp - 0x14], eax
cmp dword [0x10138b70], esi
jne 0x101248b3
push 0x800
push esi
push 0x100143dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10124840
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10124993
push esi
push esi
push 0x100143dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10124993
push 0x100143f4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10124993
push eax
call ebx
push 0x10014400
push edi
mov dword [0x10138b70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10014410
push edi
mov dword [0x10138b74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10014424
push edi
mov dword [0x10138b78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10138b80], eax
test eax, eax
je 0x101248b0
push 0x10014440
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10138b7c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x101248d8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x101248cb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x101248ed
push 4
pop eax
jmp 0x10124995
cmp dword [ebp - 0x14], esi
je 0x101248ed
push dword [0x10138b70]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x101248d2
mov eax, dword [0x10138b7c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1012494b
cmp dword [0x10138b80], edi
je 0x1012494b
push eax
call ebx
push dword [0x10138b80]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1012494b
test eax, eax
je 0x1012494b
call ecx
test eax, eax
je 0x10124940
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10124940
test byte [ebp - 8], 1
jne 0x1012494b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1012497b
mov eax, dword [0x10138b74]
cmp eax, edi
je 0x10124978
push eax
call ebx
test eax, eax
je 0x10124978
call eax
mov esi, eax
test esi, esi
je 0x10124978
mov eax, dword [0x10138b78]
cmp eax, edi
je 0x10124978
push eax
call ebx
test eax, eax
je 0x10124978
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10138b70]
call ebx
test eax, eax
je 0x10124993
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10124995
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011720d
mov esp, ebp
pop ebp
ret
Function at 0x10188254
Capabilities:
Encode data using xor

Disassembly:
call 0x101881cd
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x101881fd
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x10188219
xor edx, 0
jmp 0x10188224
xor edx, edx
jmp 0x1018823b
jmp 0x10188247
xor eax, eax
push 0x8427d7c0
call 0x10188254
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x10188290
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x10188269
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x101882a7
add eax, 0
jno 0x101882ac
add esi, 0
ret 0x10

Function at 0x10189015
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x10189037
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x101891d9
cmp edi, dword [ebp + 0x10]
jb 0x101891d9
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10188b01
inc edi
jmp 0x101890c0
jmp 0x101890cd
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10188b01
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10188b01
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x10189121
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x10189105
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1018914f
add dword [eax], 0x39
jle 0x1018912b
sub al, 0xf5
mov ch, al
call fcn.10189164
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10