joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc0810c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0xc08170
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00c039e8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00c05e90
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc08177
lea eax, [ebp - 0xc]
call fcn.00c03794
ret

Function at 0xc08d7c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, ecx
mov dword [esp], edx
mov esi, eax
test esi, esi
jne 0xc08d9a
mov eax, 0xc08e4c
call fcn.00c0ebb0
jmp 0xc08dbb
cmp dword [esp], 0
jne 0xc08dac
mov eax, 0xc08e74
call fcn.00c0ebb0
jmp 0xc08dbb
cmp ebx, 5
jae 0xc08dbb
mov eax, 0xc08ea0
call fcn.00c0ebb0
lea ebp, [ebx + 5]
mov eax, ebp
call fcn.00c02510
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x40
push ebp
push edi
call sub.kernel32.dll_VirtualProtect
lea eax, [esp + 4]
push eax
push 0x40
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov ecx, ebx
mov edx, esi
mov eax, edi
call fcn.00c04f30
mov ebp, edi
add ebp, ebx
mov byte [ebp], 0xe9
mov edx, esi
mov eax, edi
call fcn.00c112d4
inc ebp
mov dword [ebp], eax
cmp ebx, 5
jbe 0xc08e17
mov edx, ebx
sub edx, 5
mov eax, esi
add eax, 5
call fcn.00c08d74
mov byte [esi], 0xe9
mov edx, dword [esp]
mov eax, esi
call fcn.00c112d4
mov edx, esi
inc edx
mov dword [edx], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, edi
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xc0a08c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, 0xc16100
mov edi, esp
mov ebp, 0xc164b8
mov ebx, dword [ebp]
add ebx, 7
xor eax, eax
mov al, byte [esi]
add eax, eax
sub ebx, eax
mov eax, ebx
sub eax, 2
cmp word [eax], 0xec81
je 0xc0a0c1
mov eax, 0xc0a2a8
call fcn.00c0ebb0
push edi
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
movzx eax, word [0xc164f4]
mov dword [ebx], eax
push edi
mov eax, dword [edi]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ebx, dword [ebp]
add ebx, 0xd
xor eax, eax
mov al, byte [esi]
shl eax, 2
add ebx, eax
mov eax, ebx
sub eax, 2
cmp word [eax], 0xf883
je 0xc0a106
mov eax, 0xc0a2e4
call fcn.00c0ebb0
push edi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov al, byte [0xc164f0]
mov byte [ebx], al
push edi
mov eax, dword [edi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov ebx, dword [ebp]
add ebx, 0x1d
xor eax, eax
mov al, byte [esi]
lea eax, [eax + eax*4]
add ebx, eax
cmp byte [esi], 0
jne 0xc0a14e
mov eax, ebx
mov edx, eax
sub edx, 2
cmp word [edx], 0x2484
jne 0xc0a15f
sub eax, 3
cmp byte [eax], 0x8b
jne 0xc0a15f
cmp byte [esi], 0
je 0xc0a169
mov eax, ebx
sub eax, 2
cmp word [eax], 0x8d8d
je 0xc0a169
mov eax, 0xc0a320
call fcn.00c0ebb0
push edi
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
cmp byte [esi], 0
jne 0xc0a187
movzx eax, word [0xc164f4]
add eax, 8
mov dword [ebx], eax
jmp 0xc0a192
movzx eax, word [0xc164f4]
neg eax
mov dword [ebx], eax
push edi
mov eax, dword [edi]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ebx, dword [ebp]
add ebx, 0x27
xor eax, eax
mov al, byte [esi]
add ebx, eax
mov eax, ebx
sub eax, 2
cmp word [eax], 0x6850
je 0xc0a1c0
mov eax, 0xc0a35c
call fcn.00c0ebb0
push edi
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
movzx eax, word [0xc164f4]
mov dword [ebx], eax
push edi
mov eax, dword [edi]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ebx, dword [ebp]
add ebx, 0x7e
xor eax, eax
mov al, byte [esi]
imul eax, eax, 0x13
sub ebx, eax
cmp byte [esi], 0
jne 0xc0a200
mov eax, ebx
sub eax, 2
cmp word [eax], 0xc481
jne 0xc0a211
cmp byte [esi], 0
je 0xc0a21b
mov eax, ebx
sub eax, 2
cmp word [eax], 0x958d
je 0xc0a21b
mov eax, 0xc0a398
call fcn.00c0ebb0
push edi
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
cmp byte [esi], 0
jne 0xc0a236
movzx eax, word [0xc164f4]
mov dword [ebx], eax
jmp 0xc0a241
movzx eax, word [0xc164f4]
neg eax
mov dword [ebx], eax
push edi
mov eax, dword [edi]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ebx, dword [ebp]
add ebx, 0xf
xor eax, eax
mov al, byte [esi]
lea eax, [eax + eax*2]
add ebx, eax
cmp byte [esi], 0
jne 0xc0a26b
mov eax, ebx
dec eax
cmp word [eax], 0x7556
jne 0xc0a275
cmp byte [esi], 0
je 0xc0a27f
cmp byte [ebx], 0x75
je 0xc0a27f
mov eax, 0xc0a3d4
call fcn.00c0ebb0
push edi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0x7c
push edi
mov eax, dword [edi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xc0e71c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
je 0xc0e741
test ecx, ecx
je 0xc0e741
push ebx
push edi
mov ebx, 0
mov edi, 0xc0e744
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0xc0e730
pop edi
pop ebx
ret
xor eax, eax
ret

Function at 0xc1280c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov al, byte [0xc1293c]
cmp al, byte [0xc1626c]
je 0xc12936
push 0x2b
push 0x2b
mov ecx, 0xc167e8
mov edx, dword [0xc1767c]
mov eax, dword [0xc17674]
call fcn.00c11378
mov ebx, eax
push 0
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, ebx
call fcn.00c112dc
test al, al
je 0xc1285f
mov eax, 0xc12940
call fcn.00c0f150
mov esi, ebx
test byte [0xc1626c], 2
je 0xc12886
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
test byte [0xc1626c], 1
je 0xc128ce
sub ebx, 0x28
sub ebx, 0x2b
mov edi, ebx
cmp word [edi], 0xd74
jne 0xc128bc
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [edi], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc128ce
mov dl, byte [0xc12950]
mov eax, 0xc1295c
call fcn.00c0f3b0
jmp 0xc12936
test byte [0xc1626c], 4
je 0xc12936
push 0x27
push 0x11
mov ecx, 0xc1683c
mov edx, dword [0xc1767c]
mov eax, esi
call fcn.00c11378
mov ebx, eax
push 0
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, ebx
call fcn.00c112dc
test al, al
je 0xc1291a
mov dl, byte [0xc12950]
mov eax, 0xc129a8
call fcn.00c0f3b0
jmp 0xc12936
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0xc129ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov al, byte [0xc12b1c]
cmp al, byte [0xc1626c]
je 0xc12b16
push 0x26
push 0x26
mov ecx, 0xc16814
mov edx, dword [0xc1767c]
mov eax, dword [0xc17674]
call fcn.00c11378
mov ebx, eax
push 0
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, ebx
call fcn.00c112dc
test al, al
je 0xc12a3e
mov eax, 0xc12b20
call fcn.00c0f150
mov esi, ebx
test byte [0xc1626c], 2
je 0xc12a65
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
test byte [0xc1626c], 1
je 0xc12aae
sub ebx, 0x25
sub ebx, 0x26
mov eax, ebx
dec eax
cmp word [eax], 0x7401
jne 0xc12a9c
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc12aae
mov dl, byte [0xc12b30]
mov eax, 0xc12b3c
call fcn.00c0f3b0
jmp 0xc12b16
test byte [0xc1626c], 4
je 0xc12b16
push 0x27
push 0x11
mov ecx, 0xc1683c
mov edx, dword [0xc1767c]
mov eax, esi
call fcn.00c11378
mov ebx, eax
push 0
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, ebx
call fcn.00c112dc
test al, al
je 0xc12afa
mov dl, byte [0xc12b30]
mov eax, 0xc12b88
call fcn.00c0f3b0
jmp 0xc12b16
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop esi
pop ebx
ret

Function at 0xc12bcc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov dl, 1
mov eax, 0xc12cb8
call fcn.00c0de20
mov ebx, eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.00c0de98
mov eax, dword [ebx + 8]
add eax, 0xab
xor edx, edx
mov dl, byte [0xc16100]
lea edx, [edx + edx*2]
sub eax, edx
mov ebx, eax
push 0
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, ebx
call fcn.00c112dc
test al, al
jne 0xc12c28
xor ecx, ecx
mov dx, 0xc085
mov eax, ebx
call fcn.00c11398
test al, al
je 0xc12c32
mov eax, 0xc12cc8
call fcn.00c0ebb0
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 4
mov eax, ebx
call fcn.00c08d74
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ecx, 9
mov edx, 0x840fc085
mov eax, ebx
call fcn.00c113a4
test al, al
je 0xc12c76
mov eax, 0xc12d04
call fcn.00c0ebb0
add ebx, 0xb
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xe9
mov eax, ebx
mov edx, eax
add edx, 2
movzx edx, byte [edx]
inc edx
mov ecx, eax
inc ecx
mov dword [ecx], edx
add eax, 5
mov byte [eax], 0x90
push esp
mov eax, dword [esp + 4]
push eax
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
Function at 0xc12d38
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push 0xf
push 0xf
mov ecx, 0xc16864
mov edx, dword [0xc1767c]
mov eax, dword [0xc16120]
call fcn.00c11378
mov ebx, eax
push 0
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, ebx
call fcn.00c112dc
test al, al
je 0xc12d78
mov eax, 0xc12e0c
call fcn.00c0ebb0
mov al, byte [ebx]
sub al, 0x5e
je 0xc12d88
sub al, 0x8a
je 0xc12d8d
dec al
je 0xc12d90
jmp 0xc12d9c
add ebx, 2
jmp 0xc12da6
inc ebx
jmp 0xc12da6
mov eax, 0xc12e4c
call fcn.00c0ebb0
jmp 0xc12da6
mov eax, 0xc12e7c
call fcn.00c0ebb0
mov eax, ebx
call fcn.00c112c4
mov dword [0xc161ac], eax
push 1
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, dword [0xc161ac]
call fcn.00c112dc
test al, al
je 0xc12dd8
mov eax, 0xc12ebc
call fcn.00c0ebb0
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc10914
mov eax, ebx
dec eax
call fcn.00c112cc
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret

Function at 0xc13240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov ebx, dword [0xc1612c]
add ebx, 0x80
xor ecx, ecx
mov dl, 0x74
mov eax, ebx
call fcn.00c11390
test al, al
jne 0xc1326f
mov ecx, 2
mov dl, 0xa1
mov eax, ebx
call fcn.00c11390
test al, al
je 0xc13279
mov eax, 0xc132a0
call fcn.00c0ebb0
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
Function at 0xc133d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
cmp byte [0xc16248], 1
jne 0xc13494
mov dl, 1
mov eax, 0xc13548
call fcn.00c0de20
mov esi, eax
mov cl, 1
xor edx, edx
mov eax, esi
call fcn.00c0de98
mov ebx, dword [esi + 8]
add ebx, 0x5b
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, ebx
call fcn.00c11390
test al, al
je 0xc13419
mov eax, 0xc13558
call fcn.00c0ebb0
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc177e8]
mov edx, dword [eax + 0x28]
mov eax, ebx
dec eax
call fcn.00c112cc
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov ebx, dword [esi + 8]
add ebx, 0x87
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, ebx
call fcn.00c11390
test al, al
je 0xc13467
mov eax, 0xc135ac
call fcn.00c0ebb0
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc177e8]
mov edx, dword [eax + 0x28]
mov eax, ebx
dec eax
call fcn.00c112cc
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc134e3
mov ebx, dword [0xc16164]
add ebx, 7
xor eax, eax
mov al, byte [0xc16100]
add eax, eax
add ebx, eax
mov ecx, 0xfffffffd
mov edx, 0x752a3880
mov eax, ebx
call fcn.00c113a4
test al, al
je 0xc134c7
mov eax, 0xc13600
call fcn.00c0ebb0
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov dl, 1
mov eax, 0xc13654
call fcn.00c0de20
mov esi, eax
mov cl, 1
xor edx, edx
mov eax, esi
call fcn.00c0de98
mov ebx, dword [esi + 8]
add ebx, 0x49
or ecx, 0xffffffff
mov dx, 0x752a
mov eax, ebx
call fcn.00c11398
test al, al
je 0xc1351e
mov eax, 0xc13668
call fcn.00c0ebb0
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop esi
pop ebx
ret
Function at 0xc1381c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
cmp byte [0xc160f4], 0x30
jne 0xc13850
push esp
push 0x40
push 1
mov eax, dword [0xc161c4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc161c4]
mov byte [eax], 0xc3
push esp
mov edx, dword [esp + 4]
push edx
push 1
push eax
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
mov ebx, dword [0xc161c4]
add ebx, 0xb
xor eax, eax
mov al, byte [0xc16100]
lea eax, [eax + eax*8]
add ebx, eax
xor ecx, ecx
mov dl, 0xf
mov eax, ebx
call fcn.00c11390
test al, al
je 0xc138bb
xor eax, eax
mov al, byte [0xc16100]
lea eax, [eax + eax*2]
add eax, dword [0xc161c4]
cmp byte [eax], 0x8b
je 0xc13893
mov eax, 0xc138f8
call fcn.00c0ebb0
push esp
push 0x40
push 1
mov eax, dword [0xc161c4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc161c4]
mov byte [eax], 0xc3
push esp
mov edx, dword [esp + 4]
push edx
push 1
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0xc138ec
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xe9
mov eax, ebx
mov edx, eax
add edx, 2
mov edx, dword [edx]
inc edx
mov ecx, eax
inc ecx
mov dword [ecx], edx
add eax, 5
mov byte [eax], 0x90
push esp
mov eax, dword [esp + 4]
push eax
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret

Function at 0xc13934
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov dl, 1
mov eax, 0xc139fc
call fcn.00c0de20
mov ebx, eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.00c0de98
mov eax, dword [ebx + 8]
add eax, 0x28
mov ebx, eax
xor ecx, ecx
mov dl, 0x75
mov eax, ebx
call fcn.00c11390
test al, al
jne 0xc1397a
mov ecx, 0xfffffffe
mov dx, 0xc085
mov eax, ebx
call fcn.00c11398
test al, al
je 0xc13984
mov eax, 0xc13a10
call fcn.00c0ebb0
push esp
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esp
mov eax, dword [esp + 4]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 0x13
or ecx, 0xffffffff
mov dl, 0xe8
mov eax, ebx
call fcn.00c11390
test al, al
je 0xc139bd
mov eax, 0xc13a50
call fcn.00c0ebb0
mov eax, ebx
call fcn.00c112c4
mov dword [0xc161c8], eax
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc10c44
mov eax, ebx
dec eax
call fcn.00c112cc
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
Function at 0xc13ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov esi, esp
mov ebx, dword [0xc161a8]
add ebx, 0x1f
xor eax, eax
mov al, byte [0xc16100]
lea eax, [eax + eax*2]
add ebx, eax
mov eax, ebx
sub eax, 3
cmp word [eax], 0xc4f6
je 0xc13b10
mov eax, 0xc13cd0
call fcn.00c0ebb0
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, dword [0xc161a8]
mov ecx, eax
add ecx, 0x44
xor edx, edx
mov dl, byte [0xc16100]
lea edx, [edx + edx*2]
add ecx, edx
cmp byte [ecx], 0xd9
jne 0xc13b63
mov ebx, eax
add ebx, 0x55
add ebx, edx
mov eax, ebx
sub eax, 2
cmp word [eax], 0x41c4
je 0xc13b63
mov eax, 0xc13d10
call fcn.00c0ebb0
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
cmp byte [0xc160f4], 0x2f
jne 0xc13ba0
mov ebx, dword [0xc161a8]
add ebx, 0x9c
xor eax, eax
mov al, byte [0xc16100]
lea eax, [eax + eax*2]
add ebx, eax
jmp 0xc13bb8
mov ebx, dword [0xc161a8]
add ebx, 0xd0
xor eax, eax
mov al, byte [0xc16100]
lea eax, [eax + eax*2]
add ebx, eax
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x8b
jg 0xc13bd1
je 0xc13be2
sub eax, 0xe
je 0xc13be7
sub eax, 0x2d
je 0xc13bed
jmp 0xc13bf0
sub eax, 0xc7
je 0xc13bea
sub eax, 0x30
jne 0xc13bf0
sub ebx, 3
jmp 0xc13bf0
sub ebx, 2
jmp 0xc13bf0
dec ebx
jmp 0xc13bf0
inc ebx
jmp 0xc13bf0
add ebx, 2
mov eax, ebx
sub eax, 2
cmp word [eax], 0xc73b
je 0xc13c06
mov eax, 0xc13d50
call fcn.00c0ebb0
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
cmp byte [0xc160f4], 0x2f
jne 0xc13c43
mov ebx, dword [0xc161a8]
add ebx, 0xad
xor eax, eax
mov al, byte [0xc16100]
lea eax, [eax + eax*2]
add ebx, eax
jmp 0xc13c5a
mov ebx, dword [0xc161a8]
add ebx, 0xe5
xor eax, eax
mov al, byte [0xc16100]
add eax, eax
add ebx, eax
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x8b
jg 0xc13c73
je 0xc13c84
sub eax, 0x3b
je 0xc13c8f
sub eax, 0x11
je 0xc13c89
jmp 0xc13c92
sub eax, 0xcb
je 0xc13c8c
sub eax, 0x28
jne 0xc13c92
sub ebx, 3
jmp 0xc13c92
sub ebx, 2
jmp 0xc13c92
dec ebx
jmp 0xc13c92
inc ebx
jmp 0xc13c92
add ebx, 2
mov eax, ebx
sub eax, 2
cmp word [eax], 0xcb3b
je 0xc13ca8
mov eax, 0xc13d90
call fcn.00c0ebb0
push esi
push 0x40
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xeb
push esi
mov eax, dword [esi]
push eax
push 1
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop esi
pop ebx
ret
Function at 0xc14174
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov ebx, dword [0xc161d0]
add ebx, 7
mov ecx, 0xfffffffc
mov edx, 0xe856006a
mov eax, ebx
call fcn.00c113a4
test al, al
je 0xc1419e
mov eax, 0xc141d4
call fcn.00c0ebb0
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc10c9c
mov eax, ebx
dec eax
call fcn.00c112cc
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret

Function at 0xc14544
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, dword [0xc17674]
mov edi, dword [0xc1767c]
sub edi, 0xf
sub edi, esi
jb 0xc145d7
inc edi
mov edx, 0xc16960
mov ecx, 0x10
mov eax, esi
call fcn.00c11300
test al, al
je 0xc145d3
lea eax, [esi + 1]
mov ebx, dword [eax]
push 0
mov ecx, dword [0xc1767c]
mov edx, dword [0xc17674]
mov eax, ebx
call fcn.00c112dc
test al, al
jne 0xc145d3
mov edx, 0xc145e8
mov ecx, 0xb
mov eax, ebx
call fcn.00c0f010
test eax, eax
jne 0xc145d3
mov ebx, esi
sub ebx, 5
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc1027c
mov eax, ebx
dec eax
call fcn.00c112cc
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0xc145e1
inc esi
dec edi
jne 0xc1455c
mov eax, 0xc145f4
call fcn.00c0f150
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xc1460c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
mov dl, 1
mov eax, 0xc14690
call fcn.00c0de20
mov ebx, eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.00c0de98
cmp byte [0xc16278], 0
je 0xc14670
mov eax, dword [ebx + 8]
add eax, 0xe
xor edx, edx
mov dl, byte [0xc16100]
lea edx, [edx + edx*2]
add eax, edx
mov ebx, eax
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, 0xc11050
mov eax, ebx
dec eax
call fcn.00c112cc
mov dword [ebx], eax
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
pop edx
pop ebx
ret
call fcn.00c111a4
mov eax, dword [ebx + 8]
mov dword [0xc161bc], eax
mov eax, 0xc1113c
mov dword [ebx + 8], eax
pop edx
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e640
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1012be80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 0
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
mov edx, dword [esi + 0x24]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 1
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 8
test ecx, ecx
je 0x10003b58
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x10003b69
push 0x40
push esi
call fcn.1007c1f4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100041f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e600
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1012be80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 0
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x10004254
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x10004265
push 0x48
push esi
call fcn.1007c1f4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10007090
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x100070b2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x4f]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x100070a0
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret

Function at 0x100166c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100166fd
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0
push 0x10017910
push 0
push 0
mov dword [0x1012d53c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edi
push 0x10015ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov eax, 1
pop ebp
ret 0xc