joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7cf0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4efa64]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00465af0
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x104
ja 0x4a7d53
lea edx, [ebp - 0x210]
push edx
call fcn.004a7ca0
add esp, 4
jmp 0x4a7e31
push 0x25
push str.minkernelcrtsucrt_srcdesktopcrtmiscdrive.cpp
push 2
push 2
mov eax, dword [ebp - 0x218]
add eax, 1
push eax
call fcn.004981d0
add esp, 0x14
push eax
lea ecx, [ebp - 0x214]
call fcn.00469fe0
lea ecx, [ebp - 0x214]
call fcn.0046a020
test eax, eax
jne 0x4a7db3
call fcn.0048a040
mov dword [eax], 0xc
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x214]
call fcn.0046a000
mov eax, dword [ebp - 0x21c]
jmp 0x4a7e31
lea ecx, [ebp - 0x214]
call fcn.0046a020
push eax
mov ecx, dword [ebp - 0x218]
add ecx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x4a7e06
call fcn.0048a040
mov dword [eax], 0xc
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x214]
call fcn.0046a000
mov eax, dword [ebp - 0x224]
jmp 0x4a7e31
lea ecx, [ebp - 0x214]
call fcn.0046a020
push eax
call fcn.004a7ca0
add esp, 4
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x214]
call fcn.0046a000
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464bf6
mov esp, ebp
pop ebp
ret

Function at 0x4abb40
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4abb67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00489f90
add esp, 4
or eax, 0xffffffff
jmp 0x4abb69
xor eax, eax
pop ebp
ret
Function at 0x4abc80
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.00485d30
lea ecx, [ebp - 0x34]
call fcn.00485d30
call fcn.00485fa0
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004852d0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4abcd3
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.00485dc0
lea ecx, [ebp - 0x4c]
call fcn.00485dc0
mov eax, dword [ebp - 8]
jmp 0x4abd48
call fcn.00485fa0
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004852d0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4abd0e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.00485dc0
lea ecx, [ebp - 0x4c]
call fcn.00485dc0
mov eax, dword [ebp - 0x10]
jmp 0x4abd48
lea ecx, [ebp - 0x34]
call fcn.00486350
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.00486350
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.00485dc0
lea ecx, [ebp - 0x4c]
call fcn.00485dc0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x4aebe0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00469fe0
lea ecx, [ebp - 4]
call fcn.004aebb0
movzx eax, al
test eax, eax
jne 0x4aec1d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x18]
jmp 0x4aed45
lea ecx, [ebp - 4]
call fcn.0046a020
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004aeb70
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.0046a020
push eax
push 0
push 0
call fcn.004a9690
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4aec83
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x20]
jmp 0x4aed45
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004982f0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00467510
lea ecx, [ebp - 8]
call fcn.00467550
movzx edx, al
test edx, edx
jne 0x4aeccc
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00467530
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x24]
jmp 0x4aed45
lea ecx, [ebp - 8]
call fcn.00467590
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.0046a020
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.004a9690
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4aed27
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00467530
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x34]
jmp 0x4aed45
lea ecx, [ebp - 8]
call fcn.0046a040
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00467530
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x4aed50
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00469fe0
lea ecx, [ebp - 4]
call fcn.004aeaf0
movzx eax, al
test eax, eax
jne 0x4aed8d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x14]
jmp 0x4aee47
lea ecx, [ebp - 4]
call fcn.0046a020
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004aeb70
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.004982f0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00469fe0
lea ecx, [ebp - 8]
call fcn.0047a220
movzx ecx, al
test ecx, ecx
jne 0x4aedfd
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.0046a000
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x1c]
jmp 0x4aee47
lea ecx, [ebp - 4]
call fcn.0046a020
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.0046a020
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00465c50
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.0046a040
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.0046a000
lea ecx, [ebp - 4]
call fcn.004aead0
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x4b3e70
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
lea ecx, [ebp - 0x70]
call fcn.00485d30
lea ecx, [ebp - 0x58]
call fcn.00485d30
lea ecx, [ebp - 0x40]
call fcn.00485d30
call fcn.00485fa0
push eax
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004852d0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b3ed6
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x40]
call fcn.00485dc0
lea ecx, [ebp - 0x58]
call fcn.00485dc0
lea ecx, [ebp - 0x70]
call fcn.00485dc0
mov eax, dword [ebp - 0xc]
jmp 0x4b3fd9
call fcn.00485fa0
push eax
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004852d0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b3f1c
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x40]
call fcn.00485dc0
lea ecx, [ebp - 0x58]
call fcn.00485dc0
lea ecx, [ebp - 0x70]
call fcn.00485dc0
mov eax, dword [ebp - 0x14]
jmp 0x4b3fd9
mov dword [ebp - 4], 0
cmp dword [ebp + 0x24], 0
je 0x4b3f77
call fcn.00485fa0
push eax
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp + 0x24]
push edx
call fcn.004852d0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b3f6c
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x40]
call fcn.00485dc0
lea ecx, [ebp - 0x58]
call fcn.00485dc0
lea ecx, [ebp - 0x70]
call fcn.00485dc0
mov eax, dword [ebp - 0x1c]
jmp 0x4b3fd9
lea ecx, [ebp - 0x40]
call fcn.00486350
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x58]
call fcn.00486350
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x70]
call fcn.00486350
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x40]
call fcn.00485dc0
lea ecx, [ebp - 0x58]
call fcn.00485dc0
lea ecx, [ebp - 0x70]
call fcn.00485dc0
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret

Function at 0x4b9320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b934d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b934d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10008509
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
imul ebx, dword [0x10024808], 0x64e1595f
push esi
push edi
push 0x53
mov ecx, str.Sxipper_Memborable_Password
and ebx, 0xb19e1ee9
pop edx
mov eax, 0x1f84
mov esi, ecx
mov edi, edx
add eax, edi
inc esi
cmp eax, 0x67b
ja 0x10008549
movzx edi, byte [esi]
test edi, edi
jne 0x10008531
mov eax, dword [0x10024938]
jmp 0x10008553
mov eax, dword [0x10024928]
or eax, 0x42c35ec4
xor ebx, 0x960f5164
imul ebx, ebx, 0x2cd0cf2d
mov dword [ebp - 4], ebx
imul ebx, eax, 0x9b00feef
or ebx, 0xe765eb0
lea edi, [ebx + 0x75eb89d5]
mov esi, ecx
mov al, dl
sub al, 0x30
cmp al, 9
ja 0x10008587
inc esi
mov al, byte [esi]
test al, al
jne 0x10008578
jmp 0x1000858e
imul edi, dword [ebp - 4], 0xcda5112d
lea eax, [edi - 0x200944ff]
mov esi, 0x2705
mov dword [0x10024808], eax
add esi, edx
inc ecx
cmp esi, 0x1f44
ja 0x100085b2
movzx edx, byte [ecx]
test edx, edx
jne 0x1000859e
jmp 0x100085be
mov eax, edi
and eax, 0x6a87241
mov dword [0x10024808], eax
or ebx, 0x3ed788aa
add eax, 0xf5b664a3
movzx ecx, byte [str.Failed_to_delete_item_from_protected_storage]
add ebx, 0xa5f1a5a6
mov dword [0x10024928], ebx
mov edx, 0x1651
mov esi, str.Failed_to_delete_item_from_protected_storage
jmp 0x100085f6
add edx, ecx
inc esi
cmp edx, 0x12c
ja 0x100085fc
movzx ecx, byte [esi]
test ecx, ecx
jne 0x100085e8
jmp 0x10008603
mov eax, ebx
or eax, 0x2ec4e6ae
add eax, 0x27065868
mov dword [0x100247cc], eax
pop edi
add eax, 0xe685671d
pop esi
mov dword [0x10024938], eax
pop ebx
leave
ret
Function at 0x100086bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10024998]
push ebx
push esi
push edi
add eax, 0x656c086d
mov dword [ebp - 0x14], 0x52
mov ebx, edx
mov dword [0x10024878], eax
push 0x22
xor edi, edi
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 0x10], 0x5b
pop edx
mov dword [ebp - 0xc], 0xffffff86
mov eax, edi
inc eax
cmp eax, 0x9bc
jl 0x10008712
cmp byte [eax + 0x10020088], 0
jne 0x100086fa
mov eax, dword [0x10024898]
jmp 0x1000871c
mov eax, dword [0x10024898]
add eax, 0x4ae7f4d2
xor eax, 0x5d7304b2
mov dword [0x10024998], eax
and eax, 0x72d2057d
mov ecx, edi
mov dword [0x10024898], eax
add edx, dword [ebp + ecx*4 - 0x14]
inc ecx
cmp ecx, 3
jl 0x10008732
mov dword [ebp - 0x1c], 2
mov eax, edi
mov dword [ebp - 0x18], 0x46
mov dword [ebp - 0x14], 0x24
mov dword [ebp - 0x10], 0x50
mov dword [ebp - 0xc], 0xffffff44
sub edi, dword [ebp + eax*4 - 0x1c]
inc eax
cmp eax, 5
jl 0x10008761
cmp edi, ebx
mov byte [ebp - 1], dl
mov ebx, dword [ebp + 8]
jae 0x100087da
sub esi, ebx
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x1f
mov dword [ebp - 0x10], 0x2b
mov dword [ebp - 0xc], 0xffffffba
movups xmm2, xmmword [ebp - 0x18]
mov dword [ebp + 8], esi
xorps xmm1, xmm1
lea esi, [edi + ebx]
psubd xmm1, xmm2
mov eax, edi
movaps xmm0, xmm1
cdq
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
add ecx, 9
idiv ecx
mov eax, dword [ebp + 8]
mov cl, byte [ebp + edx - 1]
xor cl, byte [eax + esi]
inc edi
mov byte [esi], cl
cmp edi, dword [ebp - 8]
jb 0x1000879a
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10015adb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov dword [ebp - 8], ecx
mov eax, ecx
movzx ecx, word [ecx]
push esi
movzx ebx, cx
mov dword [ebp - 0x14], ecx
mov esi, ebx
mov ecx, dword [0x100254b8]
push edi
mov edi, edx
mov edx, 0x1734
mov dword [ebp - 0x18], edi
test ebx, ebx
je 0x10015b1c
add edx, esi
lea eax, [eax + 2]
cmp edx, 0x14c
ja 0x10015b4b
movzx esi, word [eax]
test esi, esi
jne 0x10015b08
mov edx, dword [0x100255a8]
lea eax, [ecx - 0x5242795e]
xor esi, esi
mov cl, byte [edi]
imul eax, eax, 0xbe19fddd
mov dword [ebp - 4], eax
mov eax, esi
test cl, cl
je 0x10015b5e
inc eax
cmp eax, 0x3ab
jg 0x10015b55
cmp byte [eax + edi], 0
jne 0x10015b3b
jmp 0x10015b5e
mov edx, ecx
or edx, 0x65ad4c47
jmp 0x10015b22
mov edx, dword [ebp - 4]
add edx, 0xd53920fc
and edx, 0x29fa4a2f
lea eax, [edx + 0x6f89911f]
mov dword [ebp - 4], 0x13f
mov dword [ebp - 0x10], eax
or eax, 0xdd68e4e3
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
jmp 0x10015b93
add dword [ebp - 4], ebx
lea eax, [eax + 2]
cmp dword [ebp - 4], 0x1e72
ja 0x10015b99
movzx ebx, word [eax]
test ebx, ebx
jne 0x10015b81
jmp 0x10015ba2
mov edx, dword [ebp - 0xc]
and edx, 0x84a2da3e
movsx eax, cl
mov ebx, dword [ebp - 0x10]
and ebx, 0x41c4241d
test cl, cl
je 0x10015bc9
inc esi
cmp esi, 0x139a
je 0x10015bc3
cmp byte [esi + edi], 0
jne 0x10015bb2
jmp 0x10015bc9
imul edx, ebx, 0x629ef345
imul esi, ebx, 0xe51ef5bc
and edx, 0xb41bd25d
mov dword [ebp - 4], 0x7a4
mov ebx, edi
test cl, cl
je 0x10015c00
add dword [ebp - 4], eax
inc ebx
cmp dword [ebp - 4], 0xc57
ja 0x10015bf8
movsx eax, byte [ebx]
test eax, eax
jne 0x10015be2
jmp 0x10015c00
mov esi, edx
or esi, 0x29ddfd35
mov eax, dword [ebp - 0x14]
lea ebx, [edx + 0x162ec9d4]
add edx, 0x3ab502ac
or ebx, 0xcb916c23
mov dword [0x100254b8], edx
test ax, ax
je 0x10015c53
movzx eax, ax
add eax, 0xffffffd0
cmp ax, 9
ja 0x10015c45
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 8], eax
movzx eax, word [eax]
mov dword [ebp - 0x14], eax
test ax, ax
jne 0x10015c23
jmp 0x10015c53
mov edx, ebx
xor edx, 0x20238ffa
mov dword [0x100254b8], edx
and esi, 0x75bdf1ef
mov dword [0x100255a8], esi
jmp 0x10015c6c
sub cl, 0x30
cmp cl, 9
ja 0x10015c72
inc edi
mov cl, byte [edi]
test cl, cl
jne 0x10015c61
jmp 0x10015c7e
sub edx, 0x10ff3af0
mov dword [0x100254b8], edx
pop edi
mov ecx, edx
mov eax, edx
or ecx, 0x92a55ee9
pop esi
mov dword [0x100255b8], ecx
pop ebx
leave
ret
Function at 0x1001a95b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x1001a976
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x1001a9bd
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x1001a997
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x1001aa4f
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x1001a9fb
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x1001aa17
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x1001a9ea
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ce64
Capabilities:
Get geographical location

Disassembly:
mov cl, byte [str.wxContextMenuEvent]
push ebx
push esi
push edi
movzx edi, cl
mov edx, dword [0x10026ca4]
mov esi, str.country__Country_Default
and edx, 0x1026565
push 0x63
or edx, 0xda491008
pop ebx
lea eax, [ebx - 0x30]
cmp ax, 9
ja 0x1001cea7
add esi, 2
movzx eax, word [esi]
mov ebx, eax
test ax, ax
jne 0x1001ce8a
mov eax, dword [0x10026d00]
jmp 0x1001cead
imul eax, edx, 0x399a3236
mov edx, str.wxContextMenuEvent
xor eax, 0xc8066ae4
mov esi, edx
jmp 0x1001cec6
sub cl, 0x30
cmp cl, 9
ja 0x1001cecc
inc esi
mov cl, byte [esi]
test cl, cl
jne 0x1001cebb
jmp 0x1001ced1
and eax, 0x157fc8ac
add eax, 0xbb6ba431
mov dword [0x10026ca4], eax
mov ecx, eax
xor ecx, 0x3f98809c
mov dword [0x10026d0c], ecx
and ecx, 0xccc625a
mov esi, 0x169c
mov dword [0x10026bdc], ecx
jmp 0x1001cf0a
add esi, edi
inc edx
cmp esi, 0x347
ja 0x1001cf10
movzx edi, byte [edx]
test edi, edi
jne 0x1001cefc
jmp 0x1001cf1c
lea ecx, [eax - 0x61fdd4bd]
mov dword [0x10026bdc], ecx
add ecx, 0xb7867eef
mov dword [0x10026d00], ecx
pop edi
mov ecx, eax
and ecx, 0x5c447f71
pop esi
mov dword [0x10026c28], ecx
pop ebx
ret
Function at 0x1001e05f
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x91468c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x914696
pushal
call 0x91469c
pop ebp
sub ebp, 0x10
sub ebp, 0x51468c
jmp 0x9146b2
mov eax, 0x51468c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f0
mov edx, 0x5b3fafc9
xor byte [eax], dl
inc eax
dec ecx
jne 0x9146c9
jmp 0x9146dc
inc edx
add al, 0x42
inc eax
cmc
leave
leave
leave
dec eax
or byte [ecx], dh
leave
leave
leave
retf 0x7104
Function at 0x40ff70
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x40ffaf
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x10], ecx
jge 0x4100cb
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x41003c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x410037
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410010
xor eax, eax
jmp 0x4100d0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00538df0
add esp, 0xc
jmp 0x40ff9d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ff50
add esp, 8
test eax, eax
jne 0x41005d
xor eax, eax
jmp 0x4100d0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410094
xor eax, eax
jmp 0x4100d0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00538870
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x40ff9d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4212a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b2044]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x4212ca
jl 0x4212c1
cmp dword [ebp + 0xc], 0
ja 0x4212ca
xor eax, eax
xor edx, edx
jmp 0x421401
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x4212ec
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00421420
jmp 0x421401
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.004161a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x42135b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00408f20
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041e7c0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0041bca0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0041e3b0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x4213f2
mov ecx, dword [ebp - 0x10]
call fcn.00419270
mov dword [ebp - 0x24], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x4213cb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00543880
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x4213c9
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x421401
jmp 0x421377
cmp dword [ebp - 8], 0
jbe 0x4213f2
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00543880
add esp, 0x10
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00535f90
mov esp, ebp
pop ebp
ret 0xc