joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10068e00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov ebx, dword [esp + 0x6c]
push edi
push ebp
cmp ebx, 0x13d
jne 0x10068e3c
xor di, di
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x78]
movsx eax, di
shl eax, 2
inc di
mov esi, dword [eax + edx]
mov dword [ecx + eax], esi
movsx eax, di
cmp eax, 9
jbe 0x10068e1e
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x5c
ret
xor ecx, ecx
xor edx, edx
movsx eax, cx
inc cx
mov dword [esp + eax*4 + 0x18], edx
movsx ebp, cx
cmp ebp, 0x14
jbe 0x10068e40
mov si, 0x14
mov eax, ebx
shr eax, 5
sub si, ax
and bx, 0x1f
mov word [esp + 0x16], ax
je 0x10068eac
mov ax, 0x20
mov edx, dword [esp + 0x70]
mov word [esp + 0x14], 9
sub ax, bx
mov word [esp + 0x12], ax
movsx edi, si
movsx eax, word [esp + 0x14]
dec si
mov cl, bl
mov eax, dword [edx + eax*4]
mov ebp, eax
shl ebp, cl
mov cl, byte [esp + 0x12]
or dword [esp + edi*4 + 0x18], ebp
movsx edi, si
shr eax, cl
or dword [esp + edi*4 + 0x18], eax
dec word [esp + 0x14]
jns 0x10068e7f
jmp 0x10068ec7
mov cx, 9
mov edx, dword [esp + 0x70]
movsx edi, si
movsx eax, cx
dec si
mov ebx, dword [edx + eax*4]
or dword [esp + edi*4 + 0x18], ebx
dec cx
jns 0x10068eb4
mov dx, 0xb
mov ecx, 0x14
movsx eax, word [esp + 0x16]
mov si, 0x14
sub ecx, eax
cmp ecx, 0x14
ja 0x10068f0e
movsx eax, si
movsx ebp, dx
dec dx
lea edi, [esp + eax*4 + 0x18]
dec si
mov ebx, dword [esp + ebp*4 + 0x18]
movsx eax, dx
shr ebx, 0x1d
or ebx, dword [edi]
mov dword [edi], ebx
mov eax, dword [esp + eax*4 + 0x18]
shl eax, 3
or eax, ebx
movsx ebx, si
mov dword [edi], eax
cmp ebx, ecx
jae 0x10068ee0
mov eax, dword [esp + 0x44]
mov esi, 0
and eax, 0x10000000
mov ecx, dword [esp + 0x78]
cmp eax, 1
adc esi, 0xffffffff
xor di, di
movsx eax, di
inc di
mov edx, dword [esp + eax*4 + 0x44]
xor edx, esi
mov dword [ecx + eax*4], edx
movsx eax, di
cmp eax, 9
jbe 0x10068f29
pop ebp
and dword [ecx], 0xfffffff
pop edi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x1006bf80
Capabilities:
Encode data using xor

Disassembly:
xor cx, cx
sub esp, 0x3c
xor edx, edx
push ebx
push esi
push edi
mov esi, dword [esp + 0x4c]
push ebp
movsx eax, cx
inc cx
or edx, dword [esi + eax*4]
movsx eax, cx
cmp eax, 5
jb 0x1006bf90
test edx, edx
jne 0x1006bfd6
mov edi, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
push edi
push eax
call fcn.10068920
add esp, 8
push edi
call fcn.100688c0
add esp, 4
lea eax, [edi + 0x14]
push eax
push edi
call fcn.10068920
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
lea eax, [esp + 0x38]
push eax
push esi
call fcn.10068f50
lea eax, [esp + 0x40]
add esp, 8
push eax
call fcn.10068880
lea eax, [esp + 0x28]
lea ecx, [esp + 0x3c]
mov edx, dword [esp + 0x58]
add esp, 4
push eax
push ecx
push edx
call fcn.10068c10
lea ecx, [esp + 0x30]
add esp, 0xc
push ecx
call fcn.100688c0
add esp, 4
xor ecx, ecx
xor edx, edx
movsx eax, cx
inc cx
xor edx, dword [esp + eax*4 + 0x24]
movsx eax, cx
cmp eax, 5
jb 0x1006c019
mov ax, 0x10
mov edi, 0xffffffff
mov cl, al
shr edi, cl
sar ax, 1
mov ebx, edi
and ebx, edx
shr edx, cl
xor ebx, edx
test ax, ax
mov edx, ebx
jg 0x1006c033
test edx, edx
je 0x1006c074
mov edi, dword [esp + 0x58]
push edi
call fcn.10068900
add esp, 4
add edi, 0x14
push edi
call fcn.10068900
add esp, 4
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
lea eax, [esp + 0x10]
push eax
call fcn.10068900
xor cx, cx
add esp, 4
mov edx, 1
movsx edi, cx
mov bx, 4
mov eax, edi
shr eax, 5
inc edi
shr edi, 5
sub bx, ax
mov ax, 4
sub ax, di
movsx edi, bx
lea ebp, [edi*4]
mov edi, dword [esp + edi*4 + 0x24]
xor edi, dword [esp + ebp + 0x10]
and edi, edx
cmp ax, bx
jne 0x1006c0c9
movsx eax, ax
add edi, edi
add edx, edx
or dword [esp + eax*4 + 0x10], edi
jmp 0x1006c0d9
mov edx, 1
test edi, edi
je 0x1006c0d9
movsx eax, ax
mov dword [esp + eax*4 + 0x10], edx
inc cx
cmp cx, 0x9e
jl 0x1006c089
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x58]
xor eax, dword [esp + 0x10]
push edi
test eax, 0x20000000
je 0x1006c117
add edi, 0x14
call fcn.10068900
add esp, 4
push edi
call fcn.10068900
add esp, 4
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
lea eax, [esp + 0x14]
push eax
push esi
call fcn.10068c10
add esp, 0xc
lea eax, [edi + 0x14]
push eax
call fcn.10068900
xor cx, cx
add esp, 4
movsx eax, cx
shl eax, 2
inc cx
lea edx, [edi + eax]
mov eax, dword [esi + eax]
xor eax, dword [edx]
mov dword [edx + 0x14], eax
movsx edx, cx
cmp edx, 5
jb 0x1006c134
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x1006c160
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
lea eax, [esp]
push esi
mov esi, dword [esp + 0x30]
push edi
push eax
push esi
call fcn.10068920
lea ecx, [esp + 0x10]
add esp, 8
push ecx
call fcn.10068880
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
add esp, 4
push eax
push ecx
push esi
call fcn.10068c10
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
add esp, 0xc
cmp word [esi], 0
push edi
je 0x1006c1b9
lea eax, [esi + 2]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.10068c10
add esp, 0xc
jmp 0x1006c1c1
call fcn.10068900
add esp, 4
xor dx, dx
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esi + eax + 0x16]
xor ecx, dword [esp + eax + 0x1c]
xor dword [edi + eax], ecx
movsx eax, dx
cmp eax, 5
jb 0x1006c1c4
pop edi
pop esi
add esp, 0x28
ret

Function at 0x1006c1f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
lea eax, [esp + 0x28]
push ebx
push esi
push edi
push ebp
push eax
call fcn.10068900
lea eax, [esp + 0x50]
add esp, 4
push eax
call fcn.10068900
xor cx, cx
mov ebx, dword [esp + 0x80]
mov esi, dword [esp + 0x7c]
add esp, 4
movsx eax, cx
inc cx
lea edi, [eax*4]
lea eax, [edi + ebx]
lea edx, [edi + esi]
mov ebp, dword [eax]
mov eax, dword [eax + 0x14]
xor ebp, dword [edx]
xor eax, dword [edx + 0x14]
movsx edx, cx
mov dword [esp + edi + 0x38], ebp
mov dword [esp + edi + 0x4c], eax
cmp edx, 5
jb 0x1006c21f
lea eax, [esp + 0x60]
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.10068f50
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x54]
lea eax, [esp + 0x68]
add esp, 8
push ecx
push edx
push eax
call fcn.10068c10
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x30]
add esp, 0xc
push ecx
push edx
call fcn.10068920
lea ecx, [esp + 0x18]
add esp, 8
push ecx
call fcn.10068880
mov ecx, dword [esp + 0x88]
add esp, 4
cmp word [ecx], 0
je 0x1006c2d1
xor dx, dx
mov edi, dword [esp + 0x80]
movsx eax, dx
shl eax, 2
inc dx
mov ebp, dword [eax + ecx + 2]
xor ebp, dword [eax + ebx]
xor ebp, dword [eax + esi]
xor ebp, dword [esp + eax + 0x10]
xor ebp, dword [esp + eax + 0x24]
mov dword [eax + edi], ebp
movsx eax, dx
cmp eax, 5
jb 0x1006c2aa
jmp 0x1006c2fc
xor cx, cx
mov edi, dword [esp + 0x80]
movsx eax, cx
shl eax, 2
inc cx
mov edx, dword [eax + ebx]
xor edx, dword [eax + esi]
xor edx, dword [esp + eax + 0x10]
xor edx, dword [esp + eax + 0x24]
mov dword [eax + edi], edx
movsx eax, cx
cmp eax, 5
jb 0x1006c2db
xor dx, dx
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [eax + edi]
xor ecx, dword [eax + esi]
mov dword [esp + eax + 0x38], ecx
movsx eax, dx
cmp eax, 5
jb 0x1006c2ff
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x38]
push eax
push ecx
push edx
call fcn.10068c10
xor dx, dx
add esp, 0xc
movsx eax, dx
inc dx
mov ebx, dword [esi + eax*4 + 0x14]
xor ebx, dword [esp + eax*4 + 0x10]
lea ecx, [eax*4]
lea eax, [ecx + edi]
xor ebx, dword [eax]
mov dword [eax + 0x14], ebx
movsx eax, dx
cmp eax, 5
jb 0x1006c333
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
Function at 0x1006c360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
lea eax, [esp + 0x28]
push ebx
push esi
push edi
mov esi, dword [esp + 0x74]
push eax
push esi
call fcn.10068f50
lea ecx, [esp + 0x14]
lea edx, [esp + 0x3c]
add esp, 8
lea eax, [esi + 0x14]
push ecx
push eax
push edx
call fcn.10068c10
xor dx, dx
add esp, 0xc
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [eax + esi]
xor ecx, dword [esp + eax + 0xc]
mov dword [esp + eax + 0x20], ecx
movsx eax, dx
cmp eax, 5
jb 0x1006c391
lea eax, [esp + 0x48]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.10068920
lea ecx, [esp + 0x50]
add esp, 8
push ecx
call fcn.10068880
mov edx, dword [esp + 0x80]
add esp, 4
cmp word [edx], 0
je 0x1006c400
xor cx, cx
mov edi, dword [esp + 0x78]
movsx eax, cx
shl eax, 2
inc cx
mov ebx, dword [eax + edx + 2]
xor ebx, dword [esp + eax + 0x20]
xor ebx, dword [esp + eax + 0x48]
mov dword [eax + edi], ebx
movsx eax, cx
cmp eax, 5
jb 0x1006c3df
jmp 0x1006c422
xor dx, dx
mov edi, dword [esp + 0x78]
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x20]
xor ecx, dword [esp + eax + 0x48]
mov dword [eax + edi], ecx
movsx eax, dx
cmp eax, 5
jb 0x1006c407
xor cx, cx
mov edx, 0xffffffff
movsx eax, cx
inc cx
mov dword [esp + eax*4 + 0xc], edx
movsx ebx, cx
cmp ebx, 5
jb 0x1006c42a
and dword [esp + 0xc], 0x3fffffff
xor dx, dx
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x20]
xor dword [esp + eax + 0xc], ecx
movsx eax, dx
cmp eax, 5
jb 0x1006c446
lea eax, [esp + 0x5c]
lea ecx, [esp + 0xc]
push eax
push edi
push ecx
call fcn.10068c10
lea ecx, [esp + 0x40]
add esp, 0xc
push ecx
push esi
call fcn.10068920
lea ecx, [esp + 0x3c]
add esp, 8
push ecx
call fcn.10068880
xor dx, dx
add esp, 4
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x5c]
xor ecx, dword [esp + eax + 0x34]
mov dword [eax + edi + 0x14], ecx
movsx eax, dx
cmp eax, 5
jb 0x1006c48f
pop edi
pop esi
pop ebx
add esp, 0x64
ret

Function at 0x1006c4c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
lea eax, [esp]
push esi
mov esi, dword [esp + 0x34]
push edi
push eax
push esi
xor di, di
call fcn.10068920
lea ecx, [esp + 0x24]
add esp, 8
push ecx
call fcn.10068900
add esp, 4
movsx eax, di
inc di
lea ecx, [eax*4]
mov edx, dword [esi + ecx + 0x14]
lea eax, [esi + ecx]
xor edx, dword [eax]
movsx eax, di
mov dword [esp + ecx + 0x1c], edx
cmp eax, 5
jb 0x1006c4e7
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 8]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
call fcn.1006c1f0
add esp, 0x10
pop edi
pop esi
add esp, 0x28
ret
Function at 0x1006dae0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x1006dbd0
mov eax, 0x94
call fcn.1006eb60
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1006dc45
mov ecx, dword [esi + 0x10]
mov dword [0x100f58b4], ecx
mov eax, dword [esi + 4]
mov dword [0x100f58c0], eax
mov edx, dword [esi + 8]
mov dword [0x100f58c4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100f58b8], esi
je 0x1006db4b
or esi, 0x8000
mov dword [0x100f58b8], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100f58bc], eax
call fcn.1006ea87
test eax, eax
pop ecx
je 0x1006dc45
call fcn.1006e189
test eax, eax
jne 0x1006db78
call fcn.1006ead8
jmp 0x1006dc45
call fcn.1006e9e5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100fb614], eax
call fcn.1006e8c3
mov dword [0x100f58a0], eax
call fcn.1006e3a4
test eax, eax
jl 0x1006dbc9
call fcn.1006e821
test eax, eax
jl 0x1006dbc4
call fcn.1006e5ee
test eax, eax
jl 0x1006dbc4
push 0
call fcn.1006ddf0
test eax, eax
pop ecx
jne 0x1006dbc4
inc dword [0x100f589c]
jmp 0x1006dc56
call fcn.1006e5a2
call fcn.1006df66
jmp 0x1006db6e
test eax, eax
jne 0x1006dc00
cmp dword [0x100f589c], eax
jle 0x1006dc45
dec dword [0x100f589c]
cmp dword [0x100f58f0], eax
jne 0x1006dbef
call fcn.1006df3f
call fcn.1006e5a2
call fcn.1006df66
call fcn.1006ead8
jmp 0x1006dc56
cmp eax, 2
jne 0x1006dc49
push 0x8c
push 1
call fcn.1006e2e9
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1006dc45
push esi
push dword [0x1008ee14]
call dword [0x100f5900]
test eax, eax
push esi
je 0x1006dc3f
call fcn.1006df83
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1006dc56
call fcn.1006e278
pop ecx
xor eax, eax
jmp 0x1006dc59
cmp eax, 3
jne 0x1006dc56
push 0
call fcn.1006e14e
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x1006de5a
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100792a8
call fcn.1006ed48
push 8
call fcn.1006f1e2
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100f58f4], esi
jne 0x1006de8e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100f58f0], esi
mov al, byte [ebp + 0x10]
mov byte [0x100f58ec], al
cmp dword [ebp + 0xc], edi
jne 0x1006ded8
cmp dword [0x100fb608], edi
je 0x1006dec8
mov eax, dword [0x100fb604]
sub eax, 4
mov dword [0x100fb604], eax
cmp eax, dword [0x100fb608]
jb 0x1006dec8
mov eax, dword [eax]
cmp eax, edi
je 0x1006dea9
call eax
jmp 0x1006dea9
push 0x1007c020
mov eax, 0x1007c01c
call fcn.1006ddba
pop ecx
push 0x1007c028
mov eax, 0x1007c024
call fcn.1006ddba
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x1006df09
cmp dword [ebp + 0x10], edi
jne 0x1006df17
mov dword [0x100f58f4], esi
push dword [ebp + 8]
call fcn.1006dd78
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x1006df16
push 8
call fcn.1006f115
pop ecx
ret
call fcn.1006ed83
ret
Function at 0x1006ee9d
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1008f370]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1008eec8]
je 0x1006eed2
inc eax
cmp eax, 0x13
jb 0x1006eec3
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1008eec8]
jne 0x1006eff8
mov eax, dword [0x100f58a8]
cmp eax, 1
je 0x1006efd0
cmp eax, edx
jne 0x1006ef02
cmp dword [0x100f58ac], 1
je 0x1006efd0
cmp ecx, 0xfc
je 0x1006eff8
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1006ef38
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10071540
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10071640
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1006ef6c
mov eax, edi
push eax
call fcn.10071640
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x10079738
push edi
call fcn.10071e20
add esp, 0x10
push edi
call fcn.10071640
push dword [esi + 0x1008eecc]
mov ebx, eax
call fcn.10071640
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1006eb60
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10071540
push edi
push ebx
call fcn.10071550
push 0x10079718
push ebx
call fcn.10071550
push dword [esi + 0x1008eecc]
push ebx
call fcn.10071550
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10071d27
add esp, 0x2c
jmp 0x1006eff8
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x1008eecc]
push dword [esi]
call fcn.10071640
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.10071f75
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10071d27
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100f5bd4], ebx
push esi
push edi
jne 0x10071da7
push 0x10079a38
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10071de2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10079a2c
push edi
call esi
test eax, eax
mov dword [0x100f5bd4], eax
je 0x10071de2
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x100f5bd8], eax
call esi
cmp dword [0x100f58b4], 2
mov dword [0x100f5bdc], eax
jne 0x10071da7
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x100f5be4], eax
je 0x10071da7
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x100f5be0], eax
mov eax, dword [0x100f5be0]
test eax, eax
je 0x10071dec
call eax
test eax, eax
je 0x10071dd3
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100f5be4]
test eax, eax
je 0x10071dd3
test byte [ebp - 8], 1
jne 0x10071dec
cmp dword [0x100f58c0], 4
jb 0x10071de6
or byte [ebp + 0x12], 0x20
jmp 0x10071e0b
xor eax, eax
jmp 0x10071e1b
or byte [ebp + 0x12], 4
jmp 0x10071e0b
mov eax, dword [0x100f5bd8]
test eax, eax
je 0x10071e0b
call eax
mov ebx, eax
test ebx, ebx
je 0x10071e0b
mov eax, dword [0x100f5bdc]
test eax, eax
je 0x10071e0b
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100f5bd4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007585e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.1006eb60
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100758f9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100f58b4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x100758f9
cmp eax, 1
je 0x1007591a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100758f9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x100758c6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x100758f5
xor eax, eax
inc eax
jmp 0x10075939
cmp edi, eax
jae 0x100758fd
xor eax, eax
jmp 0x10075939
cmp eax, esi
jae 0x10075904
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100f58b4]
jmp 0x1007591d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10076392
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1007b170
call fcn.1006ed48
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x100f5d28], edi
jne 0x100763d6
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100763c1
mov dword [0x100f5d28], ebx
jmp 0x100763d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x100763d6
mov dword [0x100f5d28], 2
mov eax, dword [0x100f5d28]
cmp eax, ebx
jne 0x100763f6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x100764b9
cmp eax, 2
je 0x100763ff
cmp eax, edi
jne 0x10076427
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x10076412
mov eax, dword [0x100f5c30]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1007642e
xor eax, eax
jmp 0x100764b9
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.1006eb60
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x10076461
cmp esi, edi
jne 0x10076477
push dword [ebp - 0x20]
call fcn.10071522
pop ecx
mov esi, eax
cmp esi, edi
je 0x10076427
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100764aa
cmp dword [ebp + 0x14], edi
jne 0x10076494
push edi
push edi
jmp 0x1007649a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x100764b6
push esi
call fcn.1006e278
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.1006ed83
ret
Function at 0x100764c2
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1007b180
call fcn.1006ed48
xor esi, esi
cmp dword [0x100f5d2c], esi
jne 0x10076506
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100764f1
mov dword [0x100f5d2c], edi
jmp 0x10076506
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10076506
mov dword [0x100f5d2c], 2
mov eax, dword [0x100f5d2c]
cmp eax, 2
je 0x100765e7
cmp eax, esi
je 0x100765e7
cmp eax, 1
jne 0x1007654b
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x10076534
mov eax, dword [0x100f5c30]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x10076552
xor eax, eax
jmp 0x100765f9
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.1006eb60
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x10076588
cmp edi, esi
jne 0x100765a3
lea eax, [ebx + ebx]
push eax
call fcn.10071522
pop ecx
mov edi, eax
cmp edi, esi
je 0x1007654b
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100765d6
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x100765c0
push esi
push esi
jmp 0x100765c6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x100765e2
push edi
call fcn.1006e278
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x100765f9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.1006ed83
ret