joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001be62
Capabilities:
Get graphical window text

Disassembly:
push 0x2c
mov eax, 0x100421f6
call fcn.1003efaa
mov eax, edx
mov dword [ebp - 0x1c], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x14]
xor ebx, ebx
push ecx
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x14]
je 0x1001bfc8
call fcn.1002d823
push eax
lea ecx, [ebp - 0x10]
call fcn.1003e175
mov dword [ebp - 4], ebx
xor ecx, ecx
mov esi, dword [ebp - 0x10]
inc ecx
mov edx, 0x200
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x1001bed0
push edx
lea ecx, [ebp - 0x10]
call fcn.1003e175
mov esi, dword [ebp - 0x10]
mov edx, 0x200
push edx
lea ecx, [ebp - 0x10]
call fcn.1003e175
cmp dword [esi - 4], 1
mov eax, dword [esi - 8]
mov dword [ebp - 0x24], eax
jle 0x1001bef6
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.1003e175
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1003e175
push dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.1003e175
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x10]
setne byte [ebp - 0x24]
push dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
call fcn.1001bb0f
mov byte [ebp - 4], 2
cmp dword [edi + 4], ebx
jle 0x1001bfa2
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x38]
push ebx
call fcn.1003e175
cmp edi, dword [eax]
mov edi, dword [ebp - 0x18]
je 0x1001bf66
inc ebx
cmp ebx, dword [edi + 4]
jl 0x1001bf4b
jmp 0x1001bfa2
push ebx
mov ecx, edi
call fcn.1003e175
mov edx, eax
mov ecx, dword [edx]
sub ecx, dword [ebp - 0x38]
jne 0x1001bf96
cmp byte [edx + 0xc], cl
setne cl
xor eax, eax
cmp byte [ebp - 0x2c], al
setne al
sub ecx, eax
jne 0x1001bf96
push dword [ebp - 0x30]
lea ecx, [edx + 8]
call fcn.1003e175
mov ecx, eax
test ecx, ecx
jns 0x1001bfad
push ebx
mov ecx, edi
call fcn.1003e175
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.10024f57
lea ecx, [ebp - 0x38]
call fcn.1001bfd6
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.1002d9fa
lea ecx, [esi - 0x10]
call fcn.1002d9fa
xor eax, eax
inc eax
call fcn.1003ef84
ret

Function at 0x1001c46b
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x1001c47f
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 8], 0
je 0x1001c490
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x1001cb9f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x30
mov eax, 0x100423ba
call fcn.1003efaa
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 0x68]
mov dword [eax + 4], 0x67
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, esi
mov ebx, eax
call fcn.1001cd7c
mov edi, dword [esi + 0x12c]
mov edx, dword [edi]
mov esi, dword [edx + 0x14]
mov ecx, esi
call dword [0x1004d3bc]
mov ecx, edi
call esi
mov edi, eax
mov esi, dword [edi]
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [esi + 0x10]
sub eax, ebx
push eax
call dword [0x1004d3bc]
mov ecx, edi
call dword [esi + 0x10]
mov esi, dword [ebp - 0x14]
cmp byte [esi + 0x128], 0
je 0x1001cc0e
xor eax, eax
jmp 0x1001cd76
mov edi, dword [esi + 0x70]
lea ebx, [esi + 4]
mov eax, dword [ebx]
add edi, 0xca8
mov dword [ebp - 0x10], eax
push dword [edi + 0x84]
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [edi + 0x7c]
push eax
push dword [esi + 0x104]
lea ecx, [ebp - 0x10]
call fcn.1003e175
lea eax, [edi + 0xa0]
push eax
push 0x6f
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
lea ecx, [ebp - 0x10]
call fcn.1003e175
lea eax, [edi + 0xb4]
push eax
push 0x70
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
lea ecx, [ebp - 0x10]
call fcn.1003e175
lea eax, [edi + 0xc8]
push eax
push dword [esi + 0x9c]
lea ecx, [ebp - 0x10]
call fcn.1003e175
lea eax, [edi + 0xdc]
push eax
push dword [esi + 0xd0]
lea ecx, [ebp - 0x10]
call fcn.1003e175
lea eax, [edi + 0x1c]
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebx]
lea ecx, [esi + 0x148]
call fcn.1002441e
xor eax, eax
mov ecx, ebx
cmp byte [esi + 0x128], al
setne al
lea eax, [eax*2 + 1]
push eax
call fcn.1003e175
push ecx
mov ecx, dword [edi + 8]
mov esi, esp
sub ecx, 0x10
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
call fcn.1002d987
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
push ecx
mov ecx, dword [edi + 4]
mov esi, esp
sub ecx, 0x10
mov dword [ebp - 0x18], esi
call fcn.1002d987
or dword [ebp - 4], 0xffffffff
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.10023fb2
mov eax, dword [esi + 0x70]
lea ecx, [ebp - 0x3c]
add eax, 0xddc
push eax
push edi
call fcn.100138a8
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetParent]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1003e175
push 0x67
push 0xfffffffffffffff4
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [ebx]
mov esi, dword [esi + 0x58]
call dword [sym.imp.USER32.dll_GetParent]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
push 0x6f5
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x3c]
call fcn.10015189
mov eax, edi
call fcn.1003ef84
ret
Function at 0x1001d4e3
Capabilities:
Hide graphical window

Disassembly:
push 0x20
mov eax, 0x10042537
call fcn.1003efaa
mov ebx, ecx
mov byte [ebp - 0xd], 0
call fcn.1002d823
push eax
lea ecx, [ebp - 0x18]
call fcn.1003e175
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x12c]
mov edi, dword [ebx + 0x12c]
mov eax, dword [eax]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1004d3bc]
mov ecx, edi
call esi
push eax
mov eax, dword [edi]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x1004d3bc]
mov ecx, edi
call esi
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.1001bc13
test eax, eax
js 0x1001d66e
mov eax, dword [ebp - 0x28]
test eax, eax
jle 0x1001d66e
xor esi, esi
mov dword [ebp - 0x14], esi
test eax, eax
jle 0x1001d662
push esi
lea ecx, [ebp - 0x2c]
call fcn.1003e175
mov eax, dword [eax + 8]
cmp dword [eax - 0xc], 0
je 0x1001d5eb
push esi
lea ecx, [ebp - 0x2c]
call fcn.1003e175
mov al, byte [eax + 0xc]
test al, al
je 0x1001d5eb
push esi
lea ecx, [ebp - 0x2c]
call fcn.1003e175
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x20], esi
mov ecx, dword [eax + 8]
sub ecx, 0x10
call fcn.1002d987
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov edi, dword [ebx + 0x12c]
push 3
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x1004d3bc]
mov ecx, edi
call esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10026e86
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push esi
call fcn.1003e175
push dword [eax + 8]
jmp 0x1001d644
push esi
lea ecx, [ebp - 0x2c]
call fcn.1003e175
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
mov ecx, dword [eax + 4]
sub ecx, 0x10
call fcn.1002d987
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
mov edi, dword [ebx + 0x12c]
push 3
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x1004d3bc]
mov ecx, edi
call esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10026e86
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push esi
call fcn.1003e175
push dword [eax + 4]
lea eax, [ebp - 0x18]
push 0x10008860
push eax
call fcn.1003e175
add esp, 0xc
inc esi
mov dword [ebp - 0x14], esi
cmp esi, dword [ebp - 0x28]
jl 0x1001d56e
mov eax, dword [ebx + 0x134]
mov byte [ebp - 0xd], 1
jmp 0x1001d674
mov eax, dword [ebx + 0x130]
push eax
push 1
push 0x172
push 0x6f
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov esi, dword [ebp - 0x18]
push esi
push dword [ebx + 0x9c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [ebp - 0xd], 0
je 0x1001d6af
push 1
push dword [ebx + 0x9c]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
jmp 0x1001d6bf
xor edi, edi
push edi
push dword [ebx + 0x9c]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push dword [ebx + 0x9c]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [ebp - 0xd], 0
je 0x1001d6d5
xor eax, eax
jmp 0x1001d6db
mov al, byte [ebx + 0x128]
lea ecx, [ebp - 0x2c]
mov byte [ebx + 0x128], al
call fcn.10024ec7
lea ecx, [esi - 0x10]
call fcn.1002d9fa
call fcn.1003ef84
ret
Function at 0x10024e2b
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x10042f10
call fcn.1003efde
mov esi, ecx
mov dword [ebp - 0x220], esi
xor edi, edi
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], edi
call fcn.10031290
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.10027aaa
mov dword [ebp - 4], edi
mov ecx, esi
mov dword [ebp - 0x21c], 1
call fcn.1002913e
mov eax, esi
call fcn.1003ef99
ret
Function at 0x10026b2e
Capabilities:
Check os version

Disassembly:
push 0x120
mov eax, 0x10042f86
call fcn.1003efde
mov esi, ecx
mov dword [ebp - 0x128], esi
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], ecx
mov dword [ebp - 0x12c], esi
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
push 0x58
lea eax, [esi + 0x20]
mov dword [ebp - 4], ecx
push ecx
push eax
call fcn.10031290
xor eax, eax
lea edi, [esi + 0x27c]
xor ecx, ecx
mov word [edi], ax
mov word [esi + 0x7c], cx
and dword [esi + 0x78], eax
lea eax, [ebp - 0x120]
push 0x110
push ecx
push eax
mov dword [esi + 0x20], 0x58
call fcn.10031290
add esp, 0x18
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
je 0x10026bd1
cmp dword [ebp - 0x120], 5
jae 0x10026bd8
cmp dword [ebp - 0x120], 4
jne 0x10026bd1
cmp dword [ebp - 0x11c], 0x5a
jae 0x10026bd8
mov dword [esi + 0x20], 0x4c
mov dword [esi + 0x3c], edi
lea eax, [esi + 0x7c]
mov dword [esi + 0x44], eax
mov ecx, 0x104
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x5c], 0x100098a4
mov dword [esi + 0x48], 0x100
mov dword [esi + 0x54], 0x880426
mov eax, dword [0x1004c824]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x64], 0x10029c90
mov dword [esi + 0x24], eax
test ebx, ebx
je 0x10026c31
push 0xffffffffffffffff
push ebx
push ecx
push edi
call fcn.1003e175
add esp, 0x10
mov ecx, eax
call fcn.1002d07e
mov eax, esi
call fcn.1003ef99
ret 0x18
Function at 0x10029b04
Capabilities:
Accept command line arguments

Disassembly:
push 0x34
mov eax, 0x100432ba
call fcn.1003efaa
mov ebx, ecx
mov dword [ebp - 0x28], ebx
and dword [ebp - 0x1c], 0
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.1002d823
push eax
mov ecx, ebx
call fcn.1003e175
mov dword [ebp - 0x1c], esi
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x40]
call fcn.100103be
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x40]
call fcn.10010764
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1002d9fa
test esi, esi
je 0x10029c3e
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
call fcn.10010764
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
push dword [eax]
call fcn.10027aaa
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1002d987
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
call fcn.1002d823
push eax
lea ecx, [ebp - 0x18]
call fcn.1003e175
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x24]
call fcn.1003e175
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push edi
call fcn.10027aaa
mov byte [ebp - 4], 9
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x10029c17
lea ecx, [ebp - 0x20]
call fcn.100109e8
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xa
call fcn.1003e175
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.1003e175
jmp 0x10029c22
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.1003e175
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
lea ecx, [edi - 0x10]
call fcn.1002d9fa
mov byte [ebp - 4], 2
lea ecx, [esi - 0x10]
jmp 0x10029c5c
lea ecx, [ebp - 0x24]
call fcn.100109e8
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.1003e175
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
push dword [ebp + 8]
mov ecx, ebx
call fcn.1003e175
lea ecx, [ebp - 0x40]
call fcn.10010740
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1002d9fa
mov eax, ebx
call fcn.1003ef84
ret 4
Function at 0x1003e175
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1003e184
pop dword [ebp - 0x2c]
mov eax, 0xca1d7de3
add eax, 0x45e663a1
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x40163
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x618f8ee
add ecx, 0xf9e748ca
mov edx, eax
mov esi, 0xc2933d30
sub esi, 0xb28de130
add esi, dword [ebp - 0x2c]
mov ebx, 0x544a06fa
add ebx, 0x410f7809
mov edi, dword [esi]
xor dword [ebp - 0x20], ebx
add edi, ebx
sub dword [ebp - 0x1c], 0x29f4581f
mov dword [edx], edi
xor dword [ebp - 0x14], edi
add edx, 0xfa1a05be
add edx, 0x5e5fa46
add esi, 0xbe508ada
add esi, 0x41af752a
loop 0x1003e1de
add eax, 0x38349a56
sub eax, 0x3833a0a3
mov ebx, eax
add eax, 0x845b8688
add eax, 0x7ba4797d
mov ecx, 0x59359fca
sub ecx, 0x49359fca
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10001f13
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x10001f32
call dword [sym.imp.KERNEL32.dll_FreeConsole]
xor ecx, ecx
push ecx
push ecx
push ecx
push 0x10001c2a
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
ret 0xc

Function at 0x1000eb71
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000ebb0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ebb0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ebb0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000ebb0
cmp dword [ecx + 0x74], 0xe
jbe 0x1000ebb0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001395d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023fd8
push 0x10023fd0
push str.FlsAlloc
push 0x1f
call fcn.100137c8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013991
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002015c]
call esi
jmp 0x10013997
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100139db
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023fe8
push 0x10023fe0
push str.FlsGetValue
push 0x21
call fcn.100137c8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013a12
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002015c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10013a1a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023ff0
push 0x10023fe8
push str.FlsSetValue
push 0x22
call fcn.100137c8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013a54
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002015c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100160b7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10016154
push ebx
push esi
call fcn.10016080
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10014e55
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10016101
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10016153
push edi
push eax
call fcn.10011833
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10016121
call fcn.100117f9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10016152
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10014e55
add esp, 0x20
test eax, eax
jne 0x10016140
push edi
call fcn.100117f9
jmp 0x10016148
push ebx
call fcn.100117f9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10018a2b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1000fe49
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10018a9a
cmp esi, dword [ebp - 4]
je 0x10018a95
cmp dword [ebp + 0xc], 0
je 0x10018a95
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10018a72
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1001857d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10018a9c
xor eax, eax
inc eax
jmp 0x10018a9c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10018b01
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1002d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1000fe49
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1000fe49
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10018b78
cmp word [ecx], dx
je 0x10018b78
mov eax, dword [0x10024454]
push edi
dec eax
push eax
push 0x10024340
call fcn.10018aa0
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10018beb
cmp word [eax], dx
je 0x10018beb
mov eax, dword [edi]
test eax, eax
je 0x10018b9c
cmp word [eax], dx
je 0x10018b9c
lea eax, [ebp - 0x10]
push eax
call fcn.10018483
jmp 0x10018ba5
lea eax, [ebp - 0x10]
push eax
call fcn.1001851e
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10018c15
mov eax, dword [0x1002433c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10024030
call fcn.10018aa0
add esp, 0xc
test al, al
je 0x10018c15
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10018be0
cmp word [eax], di
je 0x10018be0
lea eax, [ebp - 0x10]
push eax
call fcn.10018483
pop ecx
jmp 0x10018c17
lea eax, [ebp - 0x10]
push eax
call fcn.1001851e
jmp 0x10018bdd
mov eax, dword [edi]
test eax, eax
je 0x10018c02
cmp word [eax], dx
je 0x10018c02
lea eax, [ebp - 0x10]
push eax
call fcn.10018438
pop ecx
jmp 0x10018c15
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10018ce0
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10018925
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10018ce0
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10018ce0
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10018ce0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10018c6d
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10013b5a
test ebx, ebx
je 0x10018cdb
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10013b5a
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10018ce0
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10018ce0
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1001cd28
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10018ce2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005a47
leave
ret
Function at 0x1001edf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ee1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ee1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret