joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.10053a90
test eax, eax
jne 0x10053b51
push esi
push dword [ebp + 0xc]
call fcn.1008e4f0
push dword [ebp + 0xc]
call fcn.1008f010
add esp, 0xc
jmp 0x10053be0
mov al, byte [esi + 2]
mov byte [ebp + 8], al
mov eax, dword [ebp + 0x10]
mov al, byte [esi + eax - 3]
push ebx
push edi
mov byte [ebp + 9], al
lea eax, [ebp - 8]
push eax
mov edi, str._02X
lea eax, [ebp + 8]
push edi
push eax
mov byte [ebp + 0xa], 0
call fcn.100931e7
mov eax, dword [ebp + 0x10]
add eax, 0xfffffffa
cdq
sub eax, edx
sar eax, 1
add esp, 0xc
xor ebx, ebx
test eax, eax
mov dword [ebp + 0x10], eax
jle 0x10053bd0
add esi, 4
mov al, byte [esi - 1]
mov byte [ebp - 4], al
mov al, byte [esi]
mov byte [ebp - 3], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push edi
push eax
mov byte [ebp - 2], 0
call fcn.100931e7
add esp, 0xc
mov al, bl
inc al
mov cl, 0xd
imul cl
add al, byte [ebp - 8]
mov ecx, dword [ebp + 0xc]
xor al, byte [ebp - 0xc]
mov byte [ebx + ecx], al
inc ebx
inc esi
inc esi
cmp ebx, dword [ebp + 0x10]
jl 0x10053b94
mov eax, dword [ebp + 0xc]
push eax
mov byte [ebx + eax], 0
call fcn.1008f010
pop ecx
pop edi
pop ebx
pop esi
leave
ret 0xc

Function at 0x10053bea
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xa0]
push 0
mov dword [ebp - 0x7c], edi
call fcn.10093143
push eax
call fcn.100933ab
pop ecx
pop ecx
call fcn.100933b8
xor edx, edx
cmp dword [ebp + 0xa4], edx
mov byte [ebp - 0x71], al
jle 0x10053c5a
mov esi, dword [ebp + 0x9c]
lea eax, [ebp - 0x70]
sub esi, eax
mov al, dl
inc al
mov bl, 0xd
imul bl
add al, byte [ebp - 0x71]
lea ecx, [ebp + edx - 0x70]
xor al, byte [esi + ecx]
inc edx
cmp edx, dword [ebp + 0xa4]
mov byte [ecx], al
jl 0x10053c3d
movzx ebx, byte [ebp - 0x71]
push 0x100ec134
mov esi, ebx
push edi
and esi, 0xf
call fcn.1008e4f0
mov eax, ebx
shr eax, 4
push eax
mov edi, 0x100ec130
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.1008e5f7
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call fcn.1008e500
and dword [ebp - 0x80], 0
add esp, 0x1c
cmp dword [ebp + 0xa4], 0
jle 0x10053cd3
mov eax, dword [ebp - 0x80]
movzx eax, byte [ebp + eax - 0x70]
push eax
lea eax, [ebp - 0x78]
push str._02X
push eax
call fcn.1008e5f7
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call fcn.1008e500
add esp, 0x14
inc dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp + 0xa4]
jl 0x10053c9f
push esi
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.1008e5f7
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call fcn.1008e500
mov eax, 0xff
sub eax, ebx
push eax
lea eax, [ebp - 0x78]
push str._02X
push eax
call fcn.1008e5f7
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call fcn.1008e500
push dword [ebp - 0x7c]
call fcn.1008f010
mov ecx, dword [ebp + 0x90]
add esp, 0x2c
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008e5e8
add ebp, 0x94
leave
ret 0xc
Function at 0x10057378
Capabilities:
Query or enumerate registry value

Disassembly:
cmp byte [0x1011c700], 0
jne 0x10057384
xor eax, eax
ret
push esi
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
je 0x100573a0
push esi
call fcn.10001b5e
test eax, eax
pop ecx
jne 0x100573a4
xor eax, eax
pop esi
ret
mov ecx, dword [0x1011cc1c]
pop esi
jmp fcn.1002462c

Function at 0x100573b0
Capabilities:
Query or enumerate registry value

Disassembly:
cmp byte [0x1011c700], 0
jne 0x100573bc
xor eax, eax
ret
push esi
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
je 0x100573d8
push esi
call fcn.10001b5e
test eax, eax
pop ecx
jne 0x100573dc
xor eax, eax
pop esi
ret
mov ecx, dword [0x1011cc1c]
pop esi
jmp fcn.10024797
Function at 0x100573e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x190
lea ebp, [esp - 4]
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x190], eax
push 0x18
mov eax, 0x100bdd49
call fcn.10092efa
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.1006f7ae
push eax
lea ecx, [ebp - 0x18]
call fcn.10004d63
mov eax, dword [esi]
push ebx
lea edi, [esi + 0x84]
push edi
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
call dword [eax + 0xc0]
lea eax, [ebp - 0x20]
push eax
call fcn.10009e6a
cmp dword [ebp - 0x20], 0xb
pop ecx
lea eax, [ebp + 0x80]
jl 0x10024965
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318_
jmp 0x1002496a
push str.SYSTEMCurrentControlSetServicesClassNet_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x80]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10024a1e
push 4
pop eax
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x180]
push ebx
push eax
call fcn.1008ef90
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x180]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push str.BssidRepositTime
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100249f6
lea eax, [ebp]
push str.RegQueryValueEx_REGSTR_BSSIDREPOSITTIME_failed_n
push eax
call fcn.1008e5f7
lea eax, [ebp]
push eax
push 1
call fcn.1000926a
add esp, 0x10
jmp 0x10024a0d
lea eax, [ebp + 0x180]
push eax
call fcn.10091c8d
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x10024a0d
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x10], ebx
je 0x10024a1e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001210
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.1008e5e8
add ebp, 0x194
leave
ret
cmp byte [0x1011c700], 0
jne 0x100573f4
xor eax, eax
ret
push esi
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
je 0x10057410
push esi
call fcn.10001b5e
test eax, eax
pop ecx
jne 0x10057414
xor eax, eax
pop esi
ret
mov ecx, dword [0x1011cc1c]
pop esi
jmp 0x100248f3
Function at 0x1005761f
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x98]
lea eax, [ebp - 0x80]
push eax
mov esi, ecx
mov dword [ebp - 0x7c], edi
call fcn.10009e6a
mov eax, dword [ebp - 0x80]
cmp eax, 0x29
pop ecx
jl 0x1001b5cf
call fcn.1000a36a
test eax, eax
mov eax, dword [esi + 0x50c]
jne 0x1001b5c4
imul eax, eax, 0x18
push dword [eax + 0x1010e7e0]
push str.drivers_s
jmp 0x1001b6b2
imul eax, eax, 0x18
push dword [eax + 0x1010e7e4]
jmp 0x1001b5ba
cmp eax, 0x1f
jl 0x1001b667
push 0x103
lea eax, [ebp - 0x77]
push 0
push eax
mov byte [ebp - 0x78], 0
call fcn.1008ef90
add esp, 0xc
push 0x105
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esi + 0x50c]
imul eax, eax, 0x18
push dword [eax + 0x1010e7dc]
mov ebx, str.drivers_s
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
call edi
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call fcn.1008e500
lea eax, [ebp - 0x78]
push eax
call fcn.10008d21
add esp, 0x18
test eax, eax
jne 0x1001b6bc
call fcn.1000a36a
test eax, eax
mov eax, dword [esi + 0x50c]
jne 0x1001b65c
imul eax, eax, 0x18
push dword [eax + 0x1010e7e0]
push ebx
push dword [ebp - 0x7c]
call edi
jmp 0x1001b6b9
imul eax, eax, 0x18
push dword [eax + 0x1010e7e4]
jmp 0x1001b654
cmp eax, 0x15
jl 0x1001b680
mov eax, dword [esi + 0x50c]
imul eax, eax, 0x18
push dword [eax + 0x1010e7dc]
jmp 0x1001b5ba
cmp eax, 0xb
jne 0x1001b699
mov eax, dword [esi + 0x50c]
imul eax, eax, 0x18
push dword [eax + 0x1010e7d8]
jmp 0x1001b5ba
cmp eax, 2
jl 0x1001b6bc
mov eax, dword [esi + 0x50c]
imul eax, eax, 0x18
push dword [eax + 0x1010e7d4]
push 0x100d8034
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008e5e8
add ebp, 0x90
leave
ret 4
mov ecx, dword [0x1011cc1c]
jmp 0x1001b567
Function at 0x10057ab9
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000a91b
push str._RAWLAPI__Detect_Process_CreateToolhelp32Snapshot__of_processes__n
push 3
call fcn.1000926a
pop ecx
pop ecx
xor eax, eax
jmp 0x1000a98a
lea eax, [ebp - 0x80]
push eax
push esi
mov dword [ebp - 0x80], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000a947
push str._RAWLAPI__Detect_Process_Cant_Open_Process32First_n
push 1
call fcn.1000926a
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000a917
lea eax, [ebp - 0x5c]
push eax
push str._RAWLAPI__Detect_Process_Name_:_s_n
push 3
call fcn.1000926a
lea eax, [ebp - 0x5c]
push str.RaUI.exe
push eax
call fcn.1008eb30
add esp, 0x14
test eax, eax
jne 0x1000a96d
inc edi
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000a947
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp edi, 1
setg al
mov ecx, dword [ebp + 0xa8]
pop edi
xor ecx, ebp
pop esi
call fcn.1008e5e8
add ebp, 0xac
leave
ret
jmp 0x1000a8db
Function at 0x100581c1
Capabilities:
Create thread

Disassembly:
cmp byte [0x1011c700], 0
jne 0x100581ce
xor eax, eax
jmp 0x100581ed
push esi
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
je 0x100581ea
push esi
call fcn.10001b5e
test eax, eax
pop ecx
jne 0x100581f0
xor eax, eax
pop esi
ret 4
mov ecx, dword [0x1011cc1c]
pop esi
jmp fcn.1003c355
Function at 0x1005b937
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x514
lea ebp, [esp - 4]
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x514], eax
push 0x10
mov eax, 0x100c1835
call fcn.10092efa
cmp byte [0x1011c700], 0
jne 0x1005b96c
push 0xfffffffffffffffe
pop eax
jmp 0x1005baf1
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
jne 0x1005b980
push 0xfffffffffffffff7
jmp 0x1005b966
push esi
call fcn.10001b5e
test eax, eax
pop ecx
jne 0x1005b98f
push 0xfffffffffffffff5
jmp 0x1005b966
push str._RaWLAPI_______RAWL_HostedNetworkStartICS__n
push 3
pop ebx
push ebx
call fcn.1000926a
pop ecx
pop ecx
mov esi, 0x100cdb5f
push esi
lea ecx, [ebp - 0x10]
call fcn.10007f0d
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.10009e6a
push dword [ebp - 0x1c]
push str._RaWLAPI__RAWL_HostedNetworkStartICS_:_nWinOS___d__n
push ebx
call fcn.1000926a
add esp, 0x10
cmp dword [0x1011cc18], 0x33
mov edi, 0x1011d158
jge 0x1005b9e0
push str.5D624F94_8850_40C3_A3FA_A4FD2080BAF3VWIFIMP
jmp 0x1005b9e5
push str.5D624F94_8850_40C3_A3FA_A4FD2080BAF3VWIFIMP_SAP
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x1c], 0x29
jl 0x1005baa4
mov ecx, dword [0x1011cc1c]
and dword [ebp - 0x14], 0
and dword [ebp - 0x18], 0
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
push 4
lea edx, [ebp - 0x18]
push edx
push 0xff0c001a
call dword [eax + 0xc]
push dword [0x1011d148]
push dword [ebp - 0x18]
push str._RaWLAPI__RAWL_HostedNetworkStartICS_:_ulOpMode___d___gVar.bWiFiDirectVPort2___d__n
push ebx
call fcn.1000926a
add esp, 0x10
cmp dword [ebp - 0x18], ebx
jne 0x1005baa1
cmp dword [0x1011d148], 0
je 0x1005baa1
push 0x514
lea eax, [ebp]
push 0
push eax
call fcn.1008ef90
push dword [0x1011d14c]
lea eax, [ebp]
push eax
call fcn.1000461a
lea ecx, [ebp]
push ecx
push eax
push str._RaWLAPI__RAWL_HostedNetworkStartICS_:_GetVMPortStatus_Return___d___VMadapter.DevDesc___s__n
push ebx
mov dword [ebp - 0x14], eax
call fcn.1000926a
lea eax, [ebp]
push esi
push eax
call fcn.1008eb30
add esp, 0x2c
test eax, eax
je 0x1005baa1
cmp dword [ebp - 0x14], 1
jne 0x1005baa1
lea eax, [ebp + 0x80]
push eax
push edi
lea eax, [ebp - 0x10]
push str.SelectWAN.exe___s__s_
push eax
call fcn.10005cfd
add esp, 0x10
jmp 0x1005baba
push edi
jmp 0x1005baa9
push 0x1011c744
lea eax, [ebp - 0x10]
push str.SelectWAN.exe___s_
push eax
call fcn.10005cfd
add esp, 0xc
push dword [ebp - 0x10]
push str._RaWLAPI__RAWL_HostedNetworkStartICS_:_strCommand___s__n
push ebx
call fcn.1000926a
add esp, 0xc
push 6
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WinExec]
push str._RaWLAPI______RAWL_HostedNetworkStartICS__n
push ebx
call fcn.1000926a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001210
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x514]
xor ecx, ebp
call fcn.1008e5e8
add ebp, 0x518
leave
ret
Function at 0x1005d72d
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x100c1a3e
call fcn.10092efa
mov edi, ecx
call fcn.1006f7ae
push eax
lea ecx, [ebp - 0x10]
call fcn.10004d63
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10007f0d
cmp dword [ebp + 0x2c], 1
mov byte [ebp - 4], 1
jne 0x1005d7cc
mov esi, 0x10112aec
push dword [esi]
lea ecx, [ebp - 0x14]
call fcn.1000aaa5
test eax, eax
je 0x1005d782
add esi, 4
cmp esi, 0x10112b20
jl 0x1005d767
jmp 0x1005d7cc
push ecx
mov ecx, esp
mov dword [ebp + 0x1c], esp
push dword [ebp + 0x18]
call fcn.1000b20e
lea eax, [ebp + 0x18]
push eax
mov ecx, edi
call fcn.1005d51d
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.1000aedd
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.10001210
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp + 0x1c], eax
call fcn.10005348
mov dword [ebp + 0x18], eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
jne 0x1005d807
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001210
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001210
xor eax, eax
jmp 0x1005d8a7
push dword [ebp + 0x24]
mov ecx, edi
call fcn.1005c1de
cmp eax, 1
jne 0x1005d88f
xor esi, esi
cmp dword [edi], esi
jne 0x1005d823
call fcn.1005c6cb
mov dword [edi], eax
push dword [0x10114f7c]
call dword [sym.imp.RPCRT4.dll_RpcMgmtIsServerListening]
cmp eax, 0x6b3
je 0x1005d88f
cmp dword [edi], 1
jne 0x1005d88f
mov ecx, dword [ebp + 0x28]
xor eax, eax
cmp ecx, reloc.OLEAUT32.dll_SysReAllocString
je 0x1005d878
cmp ecx, 0x80000000
jne 0x1005d855
xor eax, eax
inc eax
jmp 0x1005d878
cmp ecx, 0x80000001
jne 0x1005d861
push 2
jmp 0x1005d877
cmp ecx, 0x80000003
jne 0x1005d86d
push 3
jmp 0x1005d877
cmp ecx, reloc.OLEAUT32.dll_SysFreeString
jne 0x1005d878
push 4
pop eax
push eax
push dword [ebp + 0x1c]
mov ecx, edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 0x20]
call fcn.1005c2d2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001210
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001210
mov eax, esi
call fcn.10092fd2
ret 0x28
Function at 0x1005d8af
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x100c1a71
call fcn.10092efa
mov esi, ecx
call fcn.1006f7ae
push eax
lea ecx, [ebp - 0x10]
call fcn.10004d63
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10007f0d
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
push ebx
push edi
push dword [ebp + 0x14]
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp + 0x20], 1
mov dword [ebp + 0x1c], eax
jne 0x1005d926
mov dword [ebp + 0xc], str.LeapPassword
mov eax, dword [ebp + 0xc]
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.1000aaa5
test eax, eax
je 0x1005d947
add dword [ebp + 0xc], 4
cmp dword [ebp + 0xc], 0x10112b20
jl 0x1005d908
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001210
lea ecx, [esi - 0x10]
call fcn.10001210
mov eax, dword [ebp + 0x1c]
call fcn.10092fd2
ret 0x1c
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push edi
call fcn.1000b20e
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.1005d629
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.1000aedd
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001210
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
mov dword [ebx], eax
push dword [esi - 0xc]
push esi
push edi
call fcn.1008ebc0
mov eax, dword [esi - 0xc]
add esp, 0xc
test eax, eax
mov ecx, edi
jle 0x1005d997
lea ecx, [eax + edi]
mov byte [ecx], 0
jmp 0x1005d929

Function at 0x1005d99c
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
push edi
xor ecx, ecx
mov dword [eax + 0x154], ecx
mov dword [eax + 0x15c], ecx
mov dword [eax + 0x158], ecx
push 0x50
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
lea edi, [eax + 0x14]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
ret
Function at 0x1005d9e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x40
pop edx
push ebx
push esi
lea ecx, [eax + 0x1c]
push edi
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x1005d9f2
mov edi, dword [eax + 0x10]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov edx, dword [eax + 8]
mov dword [ebp - 8], edi
lea edi, [eax + 0x14]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 0x14
mov edi, dword [ebp - 4]
mov ebx, ecx
xor ebx, edx
and ebx, esi
mov esi, dword [ebp - 0x10]
mov esi, dword [esi]
add dword [ebp - 0x10], 4
rol edi, 5
add edi, dword [ebp - 8]
xor ebx, ecx
add ebx, edi
dec dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov ecx, edx
mov edx, dword [ebp - 0xc]
ror edx, 2
lea edi, [ebx + esi + 0x5a827999]
mov esi, dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edi
jne 0x1005da2c
lea ebx, [eax + 0x64]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x14
mov ebx, ecx
xor ebx, edx
xor ebx, esi
rol edi, 5
add edi, ebx
mov ebx, dword [ebp - 0x10]
add edi, dword [ebx]
mov ebx, dword [ebp - 8]
add dword [ebp - 0x10], 4
dec dword [ebp - 0x14]
ror esi, 2
mov dword [ebp - 8], ecx
mov ecx, edx
lea edi, [edi + ebx + 0x6ed9eba1]
mov edx, esi
mov esi, dword [ebp - 4]
mov dword [ebp - 4], edi
jne 0x1005da75
lea ebx, [eax + 0xb4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x14
mov ebx, edx
or ebx, esi
mov esi, edx
and esi, dword [ebp - 0xc]
and ebx, ecx
or ebx, esi
add ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
add dword [ebp - 0x10], 4
rol edi, 5
add edi, dword [esi]
dec dword [ebp - 0x14]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, edx
mov edx, dword [ebp - 0xc]
ror edx, 2
lea edi, [ebx + edi - 0x70e44324]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edi
jne 0x1005dabb
lea ebx, [eax + 0x104]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x14
mov ebx, ecx
xor ebx, edx
xor ebx, esi
mov esi, dword [ebp - 0x10]
add ebx, dword [esi]
mov esi, dword [ebp - 4]
add dword [ebp - 0x10], 4
rol edi, 5
add edi, dword [ebp - 8]
dec dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov ecx, edx
mov edx, dword [ebp - 0xc]
ror edx, 2
lea edi, [ebx + edi - 0x359d3e2a]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edi
jne 0x1005db07
mov ebx, dword [eax]
add ebx, edi
mov edi, dword [eax + 4]
add edi, esi
mov esi, dword [eax + 8]
add esi, edx
mov edx, dword [eax + 0xc]
add edx, ecx
mov ecx, dword [eax + 0x10]
mov dword [eax + 4], edi
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 8]
pop edi
mov dword [eax + 8], esi
add ecx, edx
pop esi
mov dword [eax], ebx
mov dword [eax + 0x10], ecx
pop ebx
leave
ret
Function at 0x10074d0d
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0xdc], eax
cmp dword [ebp + 0xec], 0x800
mov eax, dword [ebp + 0xe8]
push esi
mov dword [ebp - 0x3c], eax
mov esi, ecx
lea eax, [ebp - 0x40]
jne 0x10074da5
push 0x100f0944
push 4
push eax
call fcn.1008ef25
push eax
call fcn.1000101d
add esp, 0x10
push ebx
push edi
call fcn.100958f2
mov edi, dword [eax]
call fcn.100958f2
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.1008e6c5
add esp, 0x18
mov dword [ebp - 0x3c], eax
call fcn.100958f2
cmp dword [eax], ebx
je 0x10074dbc
call fcn.100958f2
push dword [eax]
call fcn.1006e6cc
pop ecx
jmp 0x10074dc3
push 4
push eax
push 3
push dword [ebp + 0xec]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10074d59
jmp 0x10074e35
call fcn.100958f2
mov dword [eax], edi
cmp dword [ebp - 0x3c], 0xffffffff
je 0x10074e31
cmp dword [ebp - 0x3c], esi
jae 0x10074e31
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.1008ef90
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x10074e23
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10074e23
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x10074e23
push ebx
push ebx
push esi
jmp 0x10074e29
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x10074e33
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
pop esi
call fcn.1008e5e8
add ebp, 0xe0
leave
ret
Function at 0x1008148a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x100814c3
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1006f6ad
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10020fb5
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x100832cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x1008330f
call fcn.10072273
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1008330f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1008332a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.10082e83
test ebx, ebx
mov esi, eax
je 0x10083328
test edi, edi
je 0x10083328
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4