joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e02b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
xor esi, esi
mov edx, 0x10153540
mov eax, esi
mov ecx, 8
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec ecx
jne 0x100e02c0
mov dword [edx], eax
add edx, 4
inc esi
cmp edx, 0x10153940
jl 0x100e02b9
cmp esi, 0x800
jae 0x100e031a
lea ecx, [esi*4 + 0x10153540]
mov eax, dword [ecx - 0x400]
add ecx, 4
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x10153540]
xor edx, eax
cmp ecx, 0x10155540
mov dword [ecx - 4], edx
jl 0x100e02f2
mov dword [0x10150120], fcn.100e0dc0
call fcn.100e0fa0
pop edi
pop esi
test eax, eax
jne 0x100e0339
mov dword [0x10150120], 0x100e0e70
ret

Function at 0x100e0dc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
mov eax, ecx
test edi, edi
mov ecx, edx
jbe 0x100e0df4
test cl, 3
je 0x100e0df4
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [esi + edx*4]
xor eax, edx
dec edi
inc ecx
test edi, edi
ja 0x100e0dd3
cmp edi, 4
jb 0x100e0e42
push ebp
mov ebp, edi
shr ebp, 2
mov edx, dword [ecx]
xor ebx, ebx
xor eax, edx
xor edx, edx
mov dword [esp + 0x14], eax
mov dl, ah
mov bl, byte [esp + 0x16]
sub edi, 4
mov edx, dword [esi + edx*4 + 0x800]
add ecx, 4
xor edx, dword [esi + ebx*4 + 0x400]
mov ebx, eax
and ebx, 0xff
shr eax, 0x18
xor edx, dword [esi + ebx*4 + 0xc00]
mov ebx, dword [esi + eax*4]
xor edx, ebx
dec ebp
mov eax, edx
jne 0x100e0dff
pop ebp
test edi, edi
jbe 0x100e0e60
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [esi + edx*4]
xor eax, edx
inc ecx
dec edi
jne 0x100e0e46
pop edi
pop esi
pop ebx
ret 8
Function at 0x100ec230
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x100ec4dc
test edx, edx
je 0x100ec4dc
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x100ec3f0
cmp ecx, 0xc0
je 0x100ec310
cmp ecx, 0x80
jne 0x100ec4e4
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.100ec2f6
aeskeygenassist xmm1, xmm0, 2
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 4
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 8
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.100ec2f0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.100ec2f0
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.100ec390
aeskeygenassist xmm1, xmm2, 2
call fcn.100ec3d0
aeskeygenassist xmm1, xmm2, 4
call fcn.100ec380
aeskeygenassist xmm1, xmm2, 8
call fcn.100ec3d0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.100ec380
aeskeygenassist xmm1, xmm2, 0x20
call fcn.100ec3d0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.100ec380
aeskeygenassist xmm1, xmm2, 0x80
call fcn.100ec3d0
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.100ec4a6
aeskeygenassist xmm1, xmm0, 1
call fcn.100ec4c0
aeskeygenassist xmm1, xmm2, 2
call fcn.100ec4a0
aeskeygenassist xmm1, xmm0, 2
call fcn.100ec4c0
aeskeygenassist xmm1, xmm2, 4
call fcn.100ec4a0
aeskeygenassist xmm1, xmm0, 4
call fcn.100ec4c0
aeskeygenassist xmm1, xmm2, 8
call fcn.100ec4a0
aeskeygenassist xmm1, xmm0, 8
call fcn.100ec4c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.100ec4a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.100ec4c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.100ec4a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.100ec4c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.100ec4a0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x100ec510
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.100ec230
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x100ec571
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x100ec542
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x100ecb20
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x100ecb40
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x403680
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x140c
call fcn.0040e970
mov eax, dword [0x2c75c04]
mov ecx, dword [0x2c75b78]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403791
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2c75c04], 0x959
jne 0x403777
push 0
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0x402db8
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea ecx, [esp + 0x420]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea edx, [esp + 0xc1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402dfc
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0x402e04
push 0x402e38
call esi
push 0
push 0x402e94
push 0x402eac
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004034c0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4036c4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140c
ret
Function at 0x4061fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x51baac]
jne 0x406205
repz ret
jmp fcn.0040b07c

Function at 0x40bfdb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004089d8
and dword [ebp - 4], 0
cmp dword [0x51f0b0], 0
mov ebx, eax
jne 0x40c08c
push 0x401c2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c13d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c20
push edi
call esi
test eax, eax
je 0x40c13d
push eax
call fcn.00408966
mov dword [esp], 0x401c10
push edi
mov dword [0x51f0b0], eax
call esi
push eax
call fcn.00408966
mov dword [esp], 0x401bfc
push edi
mov dword [0x51f0b4], eax
call esi
push eax
call fcn.00408966
mov dword [esp], 0x401be0
push edi
mov dword [0x51f0b8], eax
call esi
push eax
call fcn.00408966
pop ecx
mov dword [0x51f0c0], eax
test eax, eax
je 0x40c08c
push 0x401bc8
push edi
call esi
push eax
call fcn.00408966
pop ecx
mov dword [0x51f0bc], eax
invalid
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x1003a98
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1003af0
call fcn.01003b0c
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1003ae7
cmp ecx, 0xffffffff
je 0x1003ae7
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x1003ae0
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x1003ae0
cmp edx, 0x10000000
jae 0x1003ae0
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x1006d0b
mov dword [ebp - 4], 0xfffffffe
call fcn.010023d0
ret 4
je 0x1006d56
outsb dx, byte [esi]
je 0x1006d75
jb 0x1006d7c
dec esp
and ch, byte [edx]
Function at 0x10002da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10002db9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002df4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10002df0
lea ebx, [ebx]
cmp esi, eax
jae 0x10002df4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10002de0
cmp esi, eax
jb 0x10002dfa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x100040a0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1804]
mov eax, 0x1804
call fcn.10013cc0
push 0xffffffffffffffff
push 0x10023550
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1002eb3c]
xor eax, ebp
mov dword [ebp + 0x1800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, edx
push 0x800
xor ebx, ebx
push ebx
lea eax, [ebp + 0x800]
push eax
call fcn.100131f0
push 0x800
push ebx
lea ecx, [ebp + 0x1000]
push ecx
call fcn.100131f0
push 0x800
push ebx
lea edx, [ebp]
push edx
call fcn.100131f0
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [esi], ebx
je 0x1000412a
mov al, 1
jmp 0x10004202
push 0x800
lea eax, [ebp + 0x800]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10004152
mov byte [ebp - 0x12], bl
push 0x1002b0e0
lea ecx, [ebp - 0x12]
push ecx
call fcn.100117d0
push 0x5c
lea edx, [ebp + 0x800]
push edx
call fcn.10010db5
add esp, 8
mov edi, eax
cmp edi, ebx
je 0x1000416e
add edi, 2
jmp 0x10004173
mov edi, 0x10028910
lea eax, [ebp + 0x1000]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea ecx, [ebp + 0x1000]
push ecx
push str._s_s.log
lea edx, [ebp]
call fcn.10003eb0
add esp, 0xc
push ebx
push 0x80
push 4
push ebx
mov ebx, 1
push ebx
push 0xc0000000
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
setne al
mov byte [ebp - 0x11], al
mov byte [esi + 0x208], bl
push 0x10028418
push 0x100
lea ecx, [esi + 8]
push ecx
call fcn.100110d5
add esp, 0xc
mov ecx, esi
call fcn.10004570
lea edx, [ebp]
push edx
call fcn.10003f10
add esp, 4
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1800]
xor ecx, ebp
call fcn.100109d1
add ebp, 0x1804
mov esp, ebp
pop ebp
ret
Function at 0x10004260
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023520
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x4008
call fcn.10013cc0
mov eax, dword [0x1002eb3c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
cmp dword [esi], 0
je 0x1000436c
mov dword [ebp - 4], 0
push 0x2000
push 0
lea eax, [ebp - 0x2014]
push eax
call fcn.100131f0
push 0x2000
push 0
lea ecx, [ebp - 0x4014]
push ecx
call fcn.100131f0
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x1000
lea ecx, [ebp - 0x2014]
push ecx
call fcn.10010b5d
add esp, 0x28
test edi, edi
je 0x1000433e
push 0
push 0
lea edx, [ebp - 0x4018]
push edx
push 0x409
push edi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x4018]
test eax, eax
je 0x1000433e
push eax
push edi
lea eax, [esi + 8]
push eax
push str.___s___Error_Code___d_:_s
lea edx, [ebp - 0x4014]
call fcn.10004080
add esp, 0x10
mov ecx, dword [ebp - 0x4018]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea edx, [ebp - 0x2014]
mov ecx, esi
call fcn.10004480
test edi, edi
je 0x10004365
lea edx, [ebp - 0x4014]
mov ecx, esi
call fcn.10004480
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100109d1
mov esp, ebp
pop ebp
ret

Function at 0x10004830
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.10013cc0
push 0xffffffffffffffff
push 0x10023460
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1002eb3c]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ebx, edx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, dword [edi]
cmp esi, eax
jne 0x10004894
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi], eax
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x100048fb
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x1000
push 0
lea eax, [ebp]
push eax
call fcn.100131f0
add esp, 0xc
push 0
push 0
push 0x1000
lea ecx, [ebp]
push ecx
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100048d1
sub eax, edx
push 0
lea edx, [ebp - 0x18]
push edx
push eax
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.100109d1
add ebp, 0x1004
mov esp, ebp
pop ebp
ret
Function at 0x10004950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100233e0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1002eb3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x10004ab1
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100049a0
sub eax, edx
sar eax, 1
je 0x10004ab1
cmp dword [ebp + 0xc], ebx
je 0x10004ab1
cmp dword [ebp + 0x10], ebx
je 0x10004ab1
cmp esi, ebx
je 0x10004a0e
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100049d0
sub eax, edx
sar eax, 1
je 0x10004a0e
lea eax, [ebp - 0x18]
push eax
push 0x20019
push ebx
push esi
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x10004a14
mov dword [ebp - 0x24], eax
push 0x1002b078
lea edx, [ebp - 0x24]
push edx
call fcn.100117d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.100052d7
mov esi, eax
mov dword [ebp - 0x20], esi
mov edx, dword [ebp + 0x10]
push edx
push ebx
push esi
call fcn.100131f0
add esp, 0x10
cmp esi, ebx
jne 0x10004a49
mov dword [ebp - 0x28], 0xe
push 0x1002b078
lea eax, [ebp - 0x28]
push eax
call fcn.100117d0
lea ecx, [ebp + 0x10]
push ecx
push esi
lea edx, [ebp - 0x1c]
push edx
push ebx
push edi
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
je 0x10004a78
mov dword [ebp - 0x2c], edi
push 0x1002b078
lea ecx, [ebp - 0x2c]
push ecx
call fcn.100117d0
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x10004a91
cmp eax, 2
jne 0x10004aa8
mov eax, dword [ebp + 0x10]
push eax
push esi
push eax
mov edx, dword [ebp + 0xc]
push edx
jmp 0x10004a9b
mov eax, dword [ebp + 0x10]
push eax
push esi
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.1001052d
add esp, 0x10
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
jmp 0x10004af2
mov dword [ebp - 0x30], 0x57
push 0x1002b078
lea ecx, [ebp - 0x30]
push ecx
call fcn.100117d0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10004aed
ret
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x10004b05
cmp eax, dword [ebp + 8]
je 0x10004b05
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x10004b15
push eax
call fcn.100052dc
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004b30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100233c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1002eb3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov esi, edx
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
cmp esi, eax
je 0x10004c3d
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004b80
sub eax, edx
sar eax, 1
je 0x10004c3d
test ebx, ebx
je 0x10004c3d
test edi, edi
je 0x10004bef
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004ba6
sub eax, edx
sar eax, 1
je 0x10004bef
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x10004bf5
mov dword [ebp - 0x20], eax
push 0x1002b078
lea eax, [ebp - 0x20]
push eax
call fcn.100117d0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
push edx
push ebx
mov eax, dword [ebp + 0x14]
push eax
push 0
push esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10004c28
cmp eax, dword [ebp + 8]
je 0x10004c28
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x57
push 0x1002b078
lea edx, [ebp - 0x24]
push edx
call fcn.100117d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10004c65
ret
Function at 0x10006da4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1002eb3c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x10006de1
push 0x10024b10
push 4
push eax
call fcn.100110d5
push eax
call fcn.10002e10
add esp, 0x10
jmp 0x10006df3
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10006e5e
push edi
call fcn.10011890
mov edi, dword [eax]
call fcn.10011890
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.10011836
add esp, 0x18
mov ebx, eax
call fcn.10011890
cmp dword [eax], 0
je 0x10006e3e
call fcn.10011890
push dword [eax]
call fcn.100053f9
pop ecx
jmp 0x10006e45
call fcn.10011890
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x10006e5e
cmp ebx, esi
jae 0x10006e5e
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x10006e60
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100109d1
leave
ret