joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4dc956
jmp 0x4dc990
mov eax, dword [0x57a120]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x170]
cmp eax, dword [edx + 0x24]
je 0x4dc96b
jmp 0x4dc990
mov eax, dword [0x57a120]
cmp byte [eax + 0x11c], 0
je 0x4dc97b
jmp 0x4dc990
mov eax, dword [0x57a5a0]
mov edx, dword [0x57a5a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x57a5a0]
mov edx, dword [0x57a5a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx]
je 0x4dc9ac
jmp 0x4dca8a
mov eax, dword [0x57a120]
cmp byte [eax + 0x11c], 0
je 0x4dc9bf
jmp 0x4dca8a
mov eax, dword [0x57a5a0]
mov edx, dword [0x57a5a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00552980
mov eax, dword [0x57a120]
cmp dword [eax + 0x170], 0
jne 0x4dc9e4
jmp 0x4dca50
push 0x10
push 0
mov eax, dword [0x57a120]
mov eax, dword [eax + 0x170]
push dword [eax + 0x254]
mov eax, dword [0x57a120]
mov eax, dword [eax + 0x170]
push dword [eax + 0x248]
mov eax, dword [0x57a120]
mov eax, dword [eax + 0x170]
push dword [eax + 0x12c]
push 0
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x57a120]
mov eax, dword [eax + 0x170]
call fcn.004fe020
test al, al
jne 0x4dca3d
jmp 0x4dca50
push 0
mov eax, dword [0x57a120]
call fcn.00421bb0
push eax
call sub.user32.dll_ShowWindow
nop
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x57a120]
call fcn.004250f0
jmp 0x4dcb28
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4dca95
jmp 0x4dcae2
mov eax, dword [ebp - 4]
mov edx, dword [0x57a120]
mov eax, dword [eax + 0x24]
cmp eax, dword [edx + 0x170]
je 0x4dcaab
jmp 0x4dcae2
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x57a120]
call fcn.004250f0
jmp 0x4dcb28
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4dcaed
jmp 0x4dcb28
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
test dword [eax + 0x48c], 8
jne 0x4dcb01
jmp 0x4dcb28
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x57a5a0]
mov edx, dword [0x57a5a0]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e37d0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
jne 0x4e37fe
jmp 0x4e386c
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jg 0x4e381a
jmp 0x4e386c
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.004e37b0
push ebp
push 0x414aa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004e37b0
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e3f70
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004e3f50
push ebp
push 0x414aa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e3fc3
jmp 0x4e4040
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0046d850
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.0046d7a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.0046df60
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0046f410
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4e4097
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.004e3f30
push ebp
push 0x414aa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004e3f30
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004e3f50
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50f6a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x50f6bb
jmp 0x50f6c8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x50f6d0
jmp 0x50f6d8
jmp 0x50f78a
xor eax, eax
push 0x50f767
push ebp
push 0x414e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.0040d380
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x50f749
jmp 0x50f75c
cmp dword [ebp - 8], 0
jne 0x50f751
jmp 0x50f75c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x50f78a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x552dd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00552db0
push ebp
push 0x414aa0
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040aa10
cmp dword [ebp - 0xc], 0
jg 0x552e1c
jmp 0x552e3c
mov eax, dword [ebp - 0xc]
lea eax, [eax + 1]
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x552e2f
mov eax, 0x6642f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
nop
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040aa10
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040b340
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x552e65
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x552e71
mov eax, 0x6642f0
call fcn.00431830
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00552db0
mov esp, ebp
pop ebp
ret
Function at 0x5544d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x653b30
call fcn.0040ea90
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.005544c0
push ebp
push 0x414aa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408b80
mov eax, dword [ebp - 0xc]
mov edx, fcn.004e0b10
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.004094d0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408b80
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00552440
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00554b60
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x5545d5
jmp 0x5545f4
mov eax, dword [ebp - 4]
call fcn.00502f40
test al, al
je 0x5545e3
jmp 0x5545f4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005544c0
mov esp, ebp
pop ebp
ret
Function at 0x572c80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret
Function at 0x1000190d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ecx + 4], edx
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, edx, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10001924
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10001ea5
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x9c4]
mov ebx, 0xe3
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
shr ecx, 1
xor eax, ecx
mov dword [edi - 0x9c4], eax
dec ebx
jne 0x10001eb5
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
shr ecx, 1
xor eax, ecx
mov dword [edi - 0x9c4], eax
dec ebx
jne 0x10001ef3
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
pop edi
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
shr ecx, 1
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x10001f61
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
shr ecx, 1
xor eax, ecx
mov dword [edx + 0x9b8], eax
dec esi
jne 0x10001f6a
pop esi
ret
Function at 0x10012110
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100371d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1000951f
mov dword [ebp - 0x14], eax
cmp dword [0x10039164], edi
jne 0x10012201
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1001218e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100122e1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100122e1
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100122e1
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x10039164], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x10039168], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x1003916c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10039174], eax
test eax, eax
je 0x100121fe
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10039170], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10012226
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10012219
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1001223b
push 4
pop eax
jmp 0x100122e3
cmp dword [ebp - 0x14], edi
je 0x1001223b
push dword [0x10039164]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10012220
mov eax, dword [0x10039170]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10012299
cmp dword [0x10039174], esi
je 0x10012299
push eax
call ebx
push dword [0x10039174]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10012299
test eax, eax
je 0x10012299
call ecx
test eax, eax
je 0x1001228e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1001228e
test byte [ebp - 8], 1
jne 0x10012299
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x100122c9
mov eax, dword [0x10039168]
cmp eax, esi
je 0x100122c6
push eax
call ebx
test eax, eax
je 0x100122c6
call eax
mov edi, eax
test edi, edi
je 0x100122c6
mov eax, dword [0x1003916c]
cmp eax, esi
je 0x100122c6
push eax
call ebx
test eax, eax
je 0x100122c6
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x10039164]
call ebx
test eax, eax
je 0x100122e1
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x100122e3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100041cb
leave
ret
Function at 0x10020f8d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100089d3
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10020fc5
xor eax, eax
jmp 0x10020ff1
cmp esi, dword [ebp - 4]
je 0x10020fee
cmp dword [ebp + 0xc], 0
je 0x10020fee
push dword [edi + 0x9c]
call fcn.10020b9b
push dword [edi + 0x9c]
mov esi, eax
call fcn.100120aa
pop ecx
pop ecx
cmp esi, eax
je 0x10020fc1
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x100222be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [ebp + 0x14]
push ebx
mov dword [0x10039600], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [0x10039608], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x3ff
xor ebx, ebx
push esi
mov dword [0x10039604], eax
lea eax, [ebp - 0x863]
push ebx
push eax
mov byte [ebp - 0x864], bl
call fcn.1000af00
push esi
lea eax, [ebp - 0x463]
push ebx
push eax
mov byte [ebp - 0x464], bl
call fcn.1000af00
lea ecx, [ebp - 0x864]
call fcn.10023a89
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
inc esi
lea eax, [ebp - 0x464]
push esi
push eax
mov word [ebp - 0x64], 0x4f5c
mov dword [ebp - 0x52], 0x6674742e
mov dword [ebp - 0x61], 0x61536e65
mov word [ebp - 0x57], 0x6269
mov word [ebp - 0x54], 0x646c
mov word [ebp - 0x59], 0x6d65
mov word [ebp - 0x5c], 0x2d73
mov byte [ebp - 0x55], 0x6f
mov byte [ebp - 0x5d], 0x6e
mov byte [ebp - 0x5a], 0x53
mov byte [ebp - 0x4e], bl
mov byte [ebp - 0x62], 0x70
mov dword [ebp - 0x41], 0x6c756765
mov dword [ebp - 0x45], 0x522d736e
mov word [ebp - 0x3b], 0x742e
mov dword [ebp - 0x4a], 0x536e6570
mov word [ebp - 0x38], 0x66
mov word [ebp - 0x4c], 0x4f5c
mov byte [ebp - 0x46], 0x61
mov word [ebp - 0x3d], 0x7261
mov byte [ebp - 0x39], 0x74
mov word [ebp - 0x34], 0x4f5c
mov word [ebp - 0x24], 0x742e
mov dword [ebp - 0x29], 0x696c6174
mov word [ebp - 0x31], 0x6e65
mov byte [ebp - 0x32], 0x70
mov word [ebp - 0x21], 0x66
mov word [ebp - 0x2e], 0x6e61
mov byte [ebp - 0x2f], 0x53
mov word [ebp - 0x2b], 0x492d
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x22], 0x74
mov dword [ebp - 0x1a], 0x536e6570
mov dword [ebp - 0xe], 0x6674742e
mov dword [ebp - 0x13], 0x6c6f422d
mov word [ebp - 0x1c], 0x4f5c
mov word [ebp - 0x15], 0x736e
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], bl
mov dword [ebp - 7], 0x732573
mov byte [ebp - 8], 0x25
call fcn.10002a2b
lea ecx, [ebp - 0x464]
call fcn.10024b9a
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push esi
push eax
call fcn.10002a2b
add esp, 0x48
lea ecx, [ebp - 0x464]
call fcn.10024b9a
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push esi
push eax
call fcn.10002a2b
lea ecx, [ebp - 0x464]
call fcn.10024b9a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x464]
push esi
push eax
call fcn.10002a2b
add esp, 0x30
lea ecx, [ebp - 0x464]
call fcn.10024b9a
pop esi
pop ebx
leave
ret
Function at 0x10023adb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [ecx]
or edx, 0xffffffff
test al, al
je 0x10023b08
push esi
movzx eax, al
push 7
xor edx, eax
pop esi
mov eax, edx
and eax, 1
neg eax
and eax, 0xedb88320
shr edx, 1
xor edx, eax
dec esi
jns 0x10023aed
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10023ae5
pop esi
not edx
mov eax, edx
ret

Function at 0x10024220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xe], 0x61706c68
mov dword [ebp - 7], 0x6c6c64
mov word [ebp - 0xa], 0x6970
mov word [ebp - 0x10], 0x7049
mov byte [ebp - 8], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x10024250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x61766441
mov dword [ebp - 7], 0x6c6c64
mov word [ebp - 9], 0x2e32
mov word [ebp - 0xc], 0x6970
mov byte [ebp - 0xa], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret

Function at 0x100242a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xa], 0x3233
mov dword [ebp - 0xf], 0x656e7265
mov byte [ebp - 0xb], 0x6c
mov dword [ebp - 7], 0x6c6c64
mov byte [ebp - 8], 0x2e
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
leave
ret

Function at 0x10024303
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.100242d9
mov esi, eax
test esi, esi
je 0x10024365
lea eax, [ebp - 0x10]
push eax
push esi
mov word [ebp - 7], 0x7542
mov dword [ebp - 0xd], 0x776f4c72
mov word [ebp - 0xf], 0x6168
mov word [ebp - 4], 0x4166
mov byte [ebp - 5], 0x66
mov byte [ebp - 0x10], 0x43
mov word [ebp - 9], 0x7265
mov byte [ebp - 2], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002435e
push 0x104
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1002436c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0xb], 0x636f7250
mov dword [ebp - 0x12], 0x6e696d72
mov word [ebp - 0xd], 0x6574
mov dword [ebp - 7], 0x737365
mov word [ebp - 0x14], 0x6554
mov byte [ebp - 0xe], 0x61
call fcn.100242a7
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100243b7
push ebx
push esi
call eax
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
leave
ret