joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028ddc
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028df9
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003ce0b], 0
jne 0x10028e0f
cmp byte [0x1003ce0a], 0
je 0x10028f4e
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e608
push edi
call fcn.10020381
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e35
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e4e
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e57
cmp byte [0x1003ce0a], 0
je 0x10028e77
push 4
push str.sizeof_Uns32____d
push edi
call fcn.10020381
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028e77
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028e90
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028e99
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.10020381
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028eb9
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028ed2
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028edb
cmp byte [0x1003ce0a], 0
je 0x10028efb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.10020381
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028efb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f14
push edi
call fcn.10005ee0
cmp byte [0x1003ce0b], 0
pop ecx
jne 0x10028f1d
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push 4
push str.sizeof_void____d
push edi
call fcn.10020381
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10028f3d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10028f4d
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028fdd
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e2c3
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, 0x1003e608
mov edi, dword [ebp + 8]
jne 0x10029008
mov al, byte [0x1003ce0a]
test al, al
jne 0x10029008
lea esi, [edi + 4]
jmp 0x1002901f
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.10020381
mov al, byte [0x1003ce0a]
add esp, 0xc
test al, al
je 0x1002902a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1002903a
push ebx
call fcn.10005ee0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10020381
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1002906d
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.10003172
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b235
ret
Function at 0x10029083
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e2f7
call fcn.1002b28b
cmp byte [0x1003ce0b], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x100290b0
cmp byte [0x1003ce0a], 0
je 0x100290ff
call fcn.10020381
test al, al
mov edx, 0x1002fbdc
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e608
call fcn.10020381
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100290eb
push 0x1003e608
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100290ff
push 0x1003e608
call fcn.10005ee0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10020381
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028bc
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10003172
test ebx, ebx
jne 0x1002917d
cmp byte [0x1003ce0b], bl
jne 0x10029149
cmp byte [0x1003ce0a], bl
je 0x100291f1
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e608
push ebx
call fcn.10020381
cmp byte [0x1003ce0a], 0
pop ecx
pop ecx
je 0x1002916b
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100291f1
push ebx
call fcn.10005ee0
pop ecx
jmp 0x100291f1
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x100291ac
cmp byte [0x1003ce0b], al
jne 0x100291a5
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002914e
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c8]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x100291e1
cmp byte [0x1003ce0b], al
jne 0x100291d7
cmp byte [0x1003ce0a], al
je 0x100291f1
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002914e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b235
ret
Function at 0x401250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
push edi
mov edi, eax
je 0x401333
cmp dword [edi + 0x14], 0
je 0x401333
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCR90.dll_memset
mov eax, 8
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x402158
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 0x40
cmp dword [esi + 0x18], eax
jb 0x4012b5
mov ecx, dword [esi + 4]
mov dword [ebp - 0x30], ecx
jmp 0x4012bb
add esi, 4
mov dword [ebp - 0x30], esi
cmp dword [edi + 0x18], eax
jb 0x4012c8
mov edx, dword [edi + 4]
mov dword [ebp - 0x2c], edx
jmp 0x4012ce
add edi, 4
mov dword [ebp - 0x2c], edi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401333
cmp dword [ebp - 0x20], 0x20
jle 0x401333
cmp dword [ebp - 8], 0
je 0x401328
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 4], 0x103
jmp 0x401300
mov ecx, dword [ebp - 8]
push 0x1f4
push ecx
call esi
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
call edi
cmp dword [ebp - 4], 0x103
je 0x401300
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40133b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401345
repz ret
jmp fcn.0040165f
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x100483d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100483e4
pop dword [ebp - 8]
mov eax, 0x2faa0b5c
add eax, 0xe05a7888
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xecfc8339
add dword [ebp - 0x18], 0x6155c212
mov dword [ebp - 0x14], 0xa95259b0
add dword [ebp - 0x14], 0x88e0f295
mov dword [ebp - 0x10], 0x3463744c
add dword [ebp - 0x10], 0x17e8cfe2
mov dword [ebp - 0xc], 0x44447bd
add dword [ebp - 0xc], 0xfbbbb843
lea eax, [ebp - 0x18]
push eax
mov eax, 0x8e1a56c4
sub eax, 0x7e1355b8
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xeacfaa8c
sub dword [ebp - 0x18], 0x765d4136
mov dword [ebp - 0x14], 0x7e7d0ac5
add dword [ebp - 0x14], 0xc2ef56b0
mov dword [ebp - 0x10], 0xa0be6ade
sub dword [ebp - 0x10], 0x3d4efe72
mov dword [ebp - 0xc], 0xf6acef11
add dword [ebp - 0xc], 0x95310ef
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x67c0c
push 0
call eax
mov ecx, 0x76751f18
add ecx, 0x898b2adc
mov ebx, eax
mov edi, 0xa1da11a
add edi, 0x5eaaae6
add edi, dword [ebp - 8]
mov edx, 0xb2b63074
sub edx, 0x94074515
xor dword [ebp - 4], esi
mov esi, dword [edi]
mov dword [ebp - 4], 0x449e7330
xor esi, edx
sub dword [ebp - 4], 0xd95f9172
mov dword [ebx], esi
sub dword [ebp - 4], 0x37e88c10
add ebx, 0x80a2659c
add ebx, 0x7f5d9a68
add edi, 0x370de90b
add edi, 0xc8f216f9
loop 0x10048501
add eax, 0x1e910fd9
add eax, 0xe1700aca
mov ebx, eax
add eax, 0xd95d48d0
sub eax, 0xd95d48cb
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x44bcc0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x18
mov dl, byte [0x65e037]
mov cl, byte [0x65e030]
xor dl, cl
and cl, byte [0x65e03e]
mov eax, dword [0x65e024]
push ebx
mov byte [0x65e030], cl
or cl, 2
shr cl, 1
and ecx, 0xff
push ebp
mov dword [esp + 8], ecx
mov ebp, dword [0x65e028]
fild dword [esp + 8]
push esi
mov esi, dword [0x65e020]
push edi
xor ebx, ebx
fdivr qword [0x65e040]
lea edi, [esi + eax*2]
mov esi, ebp
mov bl, dl
and esi, 3
mov dword [esp + 0x14], 0
mov byte [0x65e037], dl
mov dword [0x65e020], edi
imul esi, ebx
add eax, esi
fadd qword [0x65b740]
lea ecx, [eax + eax]
mov dword [0x65e024], eax
or ecx, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [0xa5ef38]
fstp qword [0x65ebd0]
fild qword [esp + 0x10]
cmp ecx, edi
fadd qword [0x65e040]
fstp qword [0x65e040]
je 0x44bd6c
xor edi, ecx
mov dword [0x65e020], edi
mov cl, byte [0x65e036]
mov esi, dword [esp + 0x2c]
xor cl, dl
mov edx, ebp
mov byte [0x65e036], cl
mov ecx, dword [0x65e02c]
shr edx, 1
add ecx, edx
mov dword [0x65e02c], ecx
and ecx, 7
imul ecx, ebx
add ebp, ecx
mov ecx, esi
cmp ecx, 0x7d000000
mov dword [0x65e028], ebp
jae 0x44bfa8
mov dl, byte [0x65e031]
mov cl, byte [0x65e035]
Function at 0x575915
Capabilities:
Encode data using xor

Disassembly:
push cs
jnp 0x57595f
and dword [esi + ebp*2], eax
salc
push esi
adc edi, dword [eax + 0xeb00eea]
fld qword [edi]
xor dh, byte [esi]
cwde
push 0x3b
dec ebp
add al, 0x33
aad 0xdc
mov eax, 0x3842fd21
push es
mov edx, 0x5971c195
dec dword [ebx]
scasb al, byte es:[edi]
stc
loop 0x575923
fsub st(0), st(0)
dec esp
push ebp
and ebp, eax
ret 0xa027
pop es
loope 0x575962
or di, sp
mov cl, byte [edx + 0x5e9e010d]
insb byte es:[di], dx
popfd
push ecx
cmp ecx, dword [edi - 0x16a270e3]
cmp dword [eax - 0x92742f], 0x94a68327
jmp 0x5759a3
insd dword es:[edi], dx
ret 0x205b

Function at 0x60eb70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [0x65e020]
mov cl, byte [0x65e037]
mov al, byte [0x65e030]
push ebx
push esi
mov esi, dword [0x65e024]
xor cl, al
xor ebx, ebx
lea edx, [edx + esi*2]
mov bl, cl
mov dword [0x65e020], edx
mov edx, dword [0x65e028]
and edx, 3
push edi
imul edx, ebx
add esi, edx
mov dl, byte [0x65e03e]
and al, dl
mov byte [0x65e037], cl
mov byte [0x65e030], al
or al, 2
shr al, 1
and eax, 0xff
mov dword [0x65e024], esi
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fdivr qword [0x65e040]
fadd qword [0x65b740]
fstp qword [0x65ebd0]
mov ebx, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [0x65e024]
xor ebx, ebx
mov dword [ebp - 8], ebx
lea ecx, [eax + eax]
mov eax, dword [0x65e020]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [0xa5ef38]
fild qword [ebp - 0xc]
cmp ecx, eax
fadd qword [0x65e040]
fstp qword [0x65e040]
je 0x60ec28
xor eax, ecx
mov dword [0x65e020], eax
mov edx, dword [ebp - 4]
mov cl, byte [0x65e037]
mov edi, dword [0x65e028]
mov dword [ebp - 8], ebx
mov eax, dword [edx + 0x30]
mov dl, byte [0x65e036]
xor dl, cl
mov dword [ebp - 4], eax
mov eax, dword [0x65e02c]
invalid
invalid
invalid
invalid

Function at 0x60ec51
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
add byte gs:[ebx + 0x3ead1d7], cl
ret 0xd233
Function at 0xf0751c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00f0a19c
test esi, esi
jne 0xf07552
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00f0a324
jmp 0xf07570
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00f07460
mov edi, eax
test esi, esi
je 0xf07570
cmp dword [ebx], 0
je 0xf07570
dec esi
jmp 0xf07559
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0xf075a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x1580008], 0x8088405
inc edx
mov dword [ebx + 0x1580008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xf08d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00f091bc
mov byte [esp], al
cmp byte [esp], 0
jne 0xf08eb9
test edi, edi
je 0xf08eb9
mov byte [esp + 1], 0
test ebp, ebp
jle 0xf08df9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0xf08dd4
cmp edi, 0xffffffff
je 0xf08d95
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0xf08d95
mov byte [esp], 0
jmp 0xf08eb9
cmp dword [esi], 1
jg 0xf08dd4
cmp dword [esi], 0
jne 0xf08dc6
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0xf08dc6
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0xf08eb9
lea eax, [esp + 0xc]
call fcn.00f089ec
dec ebp
test ebp, ebp
jg 0xf08d7a
cmp edi, 0xffffffff
je 0xf08df9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0xf08df7
mov byte [esp], 0
jmp 0xf08eb9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0xf08d3e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0xf08df9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00f08f28
mov edx, eax
mov ebx, dword [0x19c68fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0xf08e5d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0xf08e5b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0xf08e5d
xor edi, edi
cmp byte [esp], 0
je 0xf08e83
mov ebx, dword [esi]
test bl, 1
jne 0xf08e99
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0xf08e63
mov byte [esp + 1], 1
jmp 0xf08e99
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0xf08e83
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0xf08e10
cmp byte [esp], 0
je 0xf08eb9
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xf09e34
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x19c605c], 0
je 0xf09e9b
cmp word [0x19c6348], 0xd7b2
jne 0xf09e5d
cmp dword [0x19c6350], 0
jbe 0xf09e5d
mov eax, 0x19c6344
call dword [0x19c6360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0xf09ec8
call fcn.00f0aadc
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x1580038], 0
jne 0xf09eb7
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0xf0a05c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x158003c], 0
je 0xf0a087
mov edx, edi
mov eax, esi
call dword [0x158003c]
mov ebx, eax
jmp 0xf0a098
mov eax, 8
call fcn.00f0719c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x19c605d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0xf0a024
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0xf0a0c8
mov eax, ebx
call fcn.00f071b8
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0xf0dc1c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0xf0dd81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00f0a19c
cmp si, word [0x1580a08]
jb 0xf0dcb4
cmp si, word [0x1580c08]
ja 0xf0dcb4
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0xf0dcb4
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x1580a08]
jae 0xf0dc8e
mov edi, ebx
dec edi
jmp 0xf0dcaf
cmp si, word [ebx*8 + 0x1580a08]
jbe 0xf0dc9e
inc ebx
mov dword [ebp - 8], ebx
jmp 0xf0dcaf
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x1580a0c]
call fcn.00f0db3c
jmp 0xf0dcb4
cmp edi, dword [ebp - 8]
jae 0xf0dc78
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0xf0dd63
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0xf0dd63
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00f0b1b0
push dword [ebp - 0x160]
push 0xf0dd9c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00f0b1b0
push dword [ebp - 0x164]
push 0xf0ddac
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00f0b1b0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00f0b3e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf0dd88
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00f0a1fc
ret
Function at 0xf0df34
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0xf0e038
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x19c8c14
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x19c8c2c]
jne 0xf0df80
mov eax, esi
mov edx, 0x19c8c2e
mov ecx, 0x55
call fcn.00f0b1b0
push 0x19c8c14
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0xf0e022
push 0x19c8c14
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.00f0a19c
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0xf0dfef
cmp byte [0x19c8c10], 0
je 0xf0dfb4
mov edx, esi
mov eax, ebx
call fcn.00f0de18
jmp 0xf0dfef
mov edx, esi
mov eax, ebx
call fcn.00f0dc1c
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0xf0dfef
cmp dword [esi], 0
je 0xf0dfd8
mov eax, esi
mov edx, 0xf0e050
call fcn.00f0b308
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00f0dc1c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00f0b308
push 0x19c8c14
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x19c8c2c], bx
mov eax, dword [esi]
call fcn.00f0b0f4
mov ecx, eax
mov eax, 0x19c8c2e
mov edx, 0xaa
call fcn.00f0da9c
push 0x19c8c14
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf0e03f
lea eax, [ebp - 4]
call fcn.00f0a19c
ret
Function at 0xf0e268
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00f0a280
xor eax, eax
push ebp
push 0xf0e48d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0xf0e2a8
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0xf0e2c2
mov eax, dword [ebp - 4]
call fcn.00f0b0f4
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00f0da9c
cmp word [ebp - 0x21a], 0
je 0xf0e477
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0xf0e49c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0xf0e391
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0xf0e49c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0xf0e391
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0xf0e4d8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0xf0e391
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0xf0e4d8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0xf0e391
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0xf0e50c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0xf0e391
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0xf0e540
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0xf0e477
xor eax, eax
push ebp
push 0xf0e470
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00f0e078
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0xf0e400
mov eax, dword [ebp - 0x10]
call fcn.00f0719c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00f0b15c
jmp 0xf0e44b
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0xf0e580
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0xf0e44b
mov eax, dword [ebp - 0x10]
call fcn.00f0719c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0xf0e580
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00f0b15c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf0e477
cmp dword [ebp - 8], 0
je 0xf0e466
mov eax, dword [ebp - 8]
call fcn.00f071b8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf0e494
lea eax, [ebp - 4]
call fcn.00f0a19c
ret
Function at 0xf0e77c
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00f0a280
xor eax, eax
push ebp
push 0xf0e83c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00f0b1b0
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00f0b360
mov eax, dword [ebx]
call fcn.00f0e644
test al, al
jne 0xf0e819
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00f0b1b0
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00f0b360
mov eax, dword [ebx]
call fcn.00f0e644
test al, al
jne 0xf0e819
mov eax, ebx
call fcn.00f0a19c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf0e843
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00f0a1fc
lea eax, [ebp - 4]
call fcn.00f0a19c
ret

Function at 0xf1078c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret