joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100148d9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10014928
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10014910
push 0
push 0x1d06
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10014926
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10014944
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.10011ac5
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100176b3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100176fc
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100176e1
push 0x19b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x100176fa
push 0
push 0x15e9
push 0xf3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x10017728
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x1375
push dword [ebp - 8]
push 0
push 0x1bf4
push 0x5b96
push 0x6141
push 0x2e01
call fcn.100118d0
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x100188e8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062aae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10018a6b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100189a7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10004f01
and dword [eax], 0
jmp 0x10018965
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10004f01
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10004f01
cmp dword [eax], 0xffffffe6
je 0x100189a2
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100189a0
push 0x670f
push 0x34eb
push 1
push 1
push 0x5d02
push 0x295c
call fcn.1001692e
add esp, 0x18
jmp 0x1001894d
jmp 0x10018a69
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x2f2b
mov dword [ebp - 0x44], str.ttva_aqhck_xaymkyj_remqg_wsqq
cmp dword [ebp - 0x28], 0x321d
jle 0x10018a17
and dword [ebp - 0x18], 0
jmp 0x100189d7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5a43
jge 0x10018a17
and dword [ebp - 0x1c], 0
jmp 0x100189ed
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xa71
jge 0x10018a15
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0x1007d9f8
call fcn.10004c38
jmp 0x100189e6
jmp 0x100189d0
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10018a29
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x2b4f
jge 0x10018a43
mov edx, dword [ebp - 0x44]
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x10018a5f
or dword [ebp - 4], 0xffffffff
jmp 0x10018a69
jmp 0x10018a91
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x48]
push 0x5a7
push 0x5092
push dword [ebp - 0x4c]
push 1
call fcn.100107db
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020220
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10020251
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 0x3d79
push 0
call fcn.100320f6
add esp, 0x10
jmp 0x100202ac
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002029f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002029d
push 1
push 0x2be8
push 0
push 0x915
push 0x7ae
push 0x5432
call fcn.10021f97
add esp, 0x18
jmp 0x100202ac
push 0
push 0x10bc
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret
Function at 0x100213e6
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10021401
push 0
call fcn.10023a20
pop ecx
jmp 0x10021493
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10021448
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10021446
push 0
push 0x10bc
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10021493
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10021476
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10021493
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10004f01
mov dword [eax], 1
jmp 0x1002146b
mov esp, ebp
pop ebp
ret
Function at 0x10036406
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x18], 0
je 0x10036438
cmp byte [ebp + 0xc], 0
je 0x1003642e
xor eax, eax
mov byte [ebp + 0x1b], al
cmp byte [ebp + 0x1b], al
je 0x10036456
push eax
push eax
push 0xee6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
pop ebp
ret
mov eax, dword [ebp + 0x14]
movzx eax, byte [eax]
add dword [ecx], eax
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x10036449
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [edx]
mov dword [ecx], eax
pop ebp
ret
push 0
push 0x10bc
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
ret
Function at 0x100379fb
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x100634bd
call fcn.10061a48
sub esp, 0x18
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
je 0x10037aa4
mov ebx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ebx]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebx]
mov esi, dword [edi]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, dword [esi]
setne dl
xor ecx, ecx
add edx, dword [esi + 4]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, edx
mov eax, dword [edi]
setl cl
sub ecx, dword [eax + 8]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setg al
xor edx, edx
imul ecx, eax, 0x79cc
mov eax, dword [ebx]
cmp eax, ecx
mov eax, dword [edi]
setle dl
xor ebx, ebx
cmp edx, 0x18e50348
setle bl
xor ecx, ecx
imul ebx, dword [eax]
mov eax, dword [esi]
cmp ebx, eax
mov eax, dword [esi]
setge cl
xor edx, edx
cmp ecx, 8
mov ecx, dword [esi]
setge dl
add eax, edx
add ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x10037b58
mov dword [ebp - 0x1c], 0x7e79
cmp dword [ebp - 0x1c], 0x8092
jle 0x10037b19
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
and dword [ebp - 0x20], 0
lea ecx, [ebx + edi]
mov edi, esi
mov esi, dword [ebp - 0x20]
sar edi, cl
mov eax, edi
mov ecx, 0x1007d9f8
and eax, esi
cdq
push edx
push eax
call fcn.10004c38
inc esi
cmp esi, 0x391a
jl 0x10037ad8
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0xdb9
jl 0x10037aca
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x30cc
jl 0x10037ac8
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x161
jl 0x10037ac3
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x7cc9
jge 0x10037b35
mov edx, str.jqokvdqr_gxwdx_jpzyahg_owwjxyeaa_qly_pgvrlssot_ipcs_kmttt_qjsbko_rdpychoo_gldcqcxb
mov ecx, 0x1007d9f8
call fcn.100070aa
mov edx, dword [ebp + 0x2c]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10037b58
mov esi, dword [ebp - 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 9
inc dword [edx]
cmp dword [edx], 2
jl 0x10037b46
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037ec1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100634d1
call fcn.10061a48
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x20], 0x342
xor esi, esi
cmp dword [ebp - 0x20], 0x655
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
jle 0x10037f6b
push esi
push esi
push 0x712
push esi
push 0x1291
push esi
push 0x207b
push 0x1527
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, edi
mov ecx, esi
cdq
idiv ebx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov esi, ecx
mov edi, 0x5eb4
mov eax, esi
mov ecx, 0x1007d9f8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004c38
dec esi
dec edi
jne 0x10037f27
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x7867
jl 0x10037f20
mov ebx, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x18], ebx
push edi
mov edi, dword [ebp - 0x1c]
pop esi
cmp ebx, 0x5d11
jl 0x10037f14
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0xef8
jl 0x10037f0f
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x202
jge 0x10037f86
mov edx, str.tdtpp_mtdvwcd_rmlufbs_mqkphk_qgxp_wqjrfvfbv_lulis_oibpaycps_lmrcpms
mov ecx, 0x1007d9f8
call fcn.100070aa
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x1c], 0
je 0x1003807e
mov dword [ebp - 0x20], 0x4dc6
cmp dword [ebp - 0x20], 0x511f
jle 0x10037fe5
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [ebp - 0x40]
and eax, edi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037fc1
mov eax, dword [eax]
push eax
call fcn.1004af7c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10005365
inc ebx
cmp ebx, 0x3fc4
jl 0x10037fa8
inc edi
cmp edi, 0x66d2
jl 0x10037fa6
cmp dword [ebp - 0x20], 0x4ab6
jge 0x10037ff9
push str.bwevptc_wvnyqlcyz_sqohr_qilejli_cqv
call fcn.1004af7c
pop ecx
mov esi, dword [ebp + 0x10]
xor edx, edx
mov edi, dword [ebp - 0x24]
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov ecx, dword [esi]
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
mov dword [eax], edx
cmp dword [eax], 1
mov eax, dword [esi]
mov esi, dword [ebp + 0xc]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, 0x241a59c3
mov eax, dword [esi]
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [edi]
setl cl
xor edx, edx
cmp ecx, 0x72625aa9
setl dl
xor ecx, ecx
imul eax, edx
cmp eax, 0xfd5d
mov eax, dword [esi]
setge cl
mov dword [eax], ecx
jmp 0x1003809d
mov edx, dword [ebp + 8]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x1003809d
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xe402095d
inc dword [edx]
cmp dword [edx], 1
jl 0x1003808b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a97b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1003a992
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1003a9b4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1017c0c4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1017c450
jl 0x1003a9c2
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1017c6f4
jl 0x1003aa02
mov ecx, dword [0x1017d440]
xor ecx, dword [0x1017c0c4]
and ecx, edi
xor ecx, dword [0x1017d440]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1017c0c0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1017c6f4]
mov dword [0x1017ca80], eax
pop esi
ret

Function at 0x1003ad81
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x10063682
call fcn.10061a48
sub esp, 0xc
push ebx
push esi
mov byte [ebp - 0x14], cl
mov ebx, edx
mov dword [ebp - 0x18], 0x740d
cmp dword [ebp - 0x18], 0x7751
push edi
mov dword [ebp - 0x10], esp
jle 0x1003ade4
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007d9f8
or eax, esi
cdq
push edx
push eax
call fcn.10004c38
inc edi
cmp edi, 0x1351
jl 0x1003adad
inc esi
cmp esi, 0x5d91
jl 0x1003adab
push 0
push 0x189d
push 0
push 0x2612
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
cmp byte [ebp - 0x14], 0
je 0x1003adfe
cmp byte [ebx], 0
je 0x1003ae03
push 0
push 0x10bc
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1003ae03
mov eax, dword [ebp + 8]
inc dword [eax]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x73d8
jge 0x1003ae1f
mov edx, str.dif_xvfkmp_upzl_eipjdv_ncgemri
mov ecx, 0x1007d9f8
call fcn.100070aa
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c45c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x1003c46d
mov eax, dword [ebp + 0xc]
and dword [eax], 0
pop ebp
ret
cmp byte [ecx], 0
je 0x1003c47a
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
ret

Function at 0x1003c8cf
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 0x18], 0
push esi
push edi
mov byte [ebp - 4], dl
je 0x1003c95b
cmp byte [ebp + 0xc], 0
je 0x1003c948
mov esi, dword [ebp + 0x10]
mov dword [esi], 0xffffffef
cmp dword [esi], 0xffffffea
jne 0x1003c971
mov edi, dword [ebp + 0x14]
mov dword [ebp - 8], 0x664d
xor ecx, ecx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
sub eax, 0x12645f82
je 0x1003c918
mov dword [edi], 0x85fa
inc ecx
mov eax, dword [esi]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor eax, eax
test ecx, ecx
push 0x67e2
setg al
lea ecx, [ebp + 0x1b]
mov dword [ebp - 0xc], eax
mov byte [ebp + 0x1b], 0
push 0
call fcn.1003c45c
dec dword [esi]
cmp dword [esi], 0xffffffea
pop ecx
pop ecx
je 0x1003c8f7
jmp 0x1003c971
push 0x112
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1003c971
test dl, dl
je 0x1003c964
add dword [ecx], 4
jmp 0x1003c971
push 0x1527
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003cd9e
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x1006370e
call fcn.10061a48
sub esp, 0x14
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x14], cl
je 0x1003cdf8
cmp byte [ebp + 0x14], 0
je 0x1003cde6
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x1003cee2
push ecx
mov edx, 0x14c3
mov cl, 1
call fcn.1003d902
pop ecx
jmp 0x1003cee2
push 0
push 0x10bc
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1003cee2
test cl, cl
je 0x1003cedd
mov dword [ebp - 0x1c], 0x49d7
cmp dword [ebp - 0x1c], 0x4cc7
jle 0x1003ce79
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp + 0x10], 0x56b1
xor esi, esi
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1007d9f8
or eax, ebx
cdq
push edx
push eax
call fcn.10004c38
inc esi
cmp esi, 0x39d3
jl 0x1003ce2c
mov esi, dword [ebp - 0x18]
add edi, esi
dec dword [ebp + 0x10]
jne 0x1003ce2a
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x289
jl 0x1003ce21
inc ebx
cmp ebx, 0xb70
jl 0x1003ce1c
push 0x1280
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov edi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x47d9
jge 0x1003ceb4
mov edx, str.yptrpgdb_qtnaw_tglzsbkby_uefqg_shan_eiadda_slzw_ose_vphz
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x1003ceb4
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0xc]
jmp 0x1003ced5
mov ecx, dword [esi]
lea eax, [ecx + 2]
mov dword [esi], eax
call fcn.1003ad49
mov ecx, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.1001bb92
mov eax, dword [esi]
cmp eax, dword [edi]
jb 0x1003cebd
jmp 0x1003cee2
mov eax, dword [ebp + 0x18]
dec dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ddb3
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x10063778
call fcn.10061a48
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1003de92
mov dword [ebp + 0xc], 0x6f0a
xor esi, esi
cmp dword [ebp + 0xc], 0x7014
jle 0x1003de1d
push 0x112
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov edi, esi
mov ebx, esi
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1007d9f8
cdq
push edx
push eax
call fcn.10004c38
inc ebx
cmp ebx, 0x7d32
jl 0x1003ddf2
inc edi
cmp edi, 0x17c
jl 0x1003ddf0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], 0x6e2d
jge 0x1003de56
mov edx, str.yitnpgnp_hfp_srz_dgmc_ccjxhijf_rwdxhnr_voghqoq_rccxo_plfr_tqqabsw_kzmowsp
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x1003de56
cmp byte [ebp + 0x10], 0
je 0x1003de7a
mov edx, dword [ebp + 0x20]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x1003deae
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x1003de69
jmp 0x1003deae
push esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x1003deae
cmp byte [ebp + 0x1c], 0
je 0x1003de9f
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x1003deae
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
sub eax, dword [edx]
sar eax, 1
push eax
call fcn.1000dee2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e601
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1003e712
mov dword [esp + 0x18], 0x4dc1
cmp dword [esp + 0x18], 0x4dd8
push 0
pop esi
jle 0x1003e6d2
push 0xc18
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CombineRgn]
mov edi, esi
mov dword [esp + 0x14], esi
mov ebx, esi
mov dword [esp + 0x10], esi
mov eax, edi
mov ecx, esi
cdq
idiv ebx
mov dword [esp + 0xc], ecx
mov eax, edx
mov dword [esp + 0x1c], eax
mov ebx, eax
mov edi, esi
xor ebx, ecx
mov eax, ebx
lea ecx, [esp + 0x20]
or eax, edi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e67b
mov eax, dword [eax]
push eax
call fcn.1004af7c
pop ecx
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.10005365
inc edi
cmp edi, 0x4d59
jl 0x1003e661
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x58b1
jl 0x1003e65b
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0x2e2e
jl 0x1003e64a
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x4912
jl 0x1003e644
cmp dword [esp + 0x18], 0x4d4a
jge 0x1003e6e7
push str.bfzp_gcvjp_dsd_jelnl_szgricwp_wdc_wmqi_ojqpcgp_qndwzo_mudp_xkfct
call fcn.1004af7c
pop ecx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003e724
push 0x384e
push 1
push 0x15eb
push esi
push 0xe52
mov dl, 1
mov ecx, 0x7865
call fcn.1003e7f3
add esp, 0x14
jmp 0x1003e724
xor esi, esi
push esi
push 0x118b
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e7f3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100637a8
call fcn.10061a48
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov byte [ebp - 0x14], dl
je 0x1003e852
test dl, dl
je 0x1003e837
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [eax]
cmp eax, 0xfffa
sete cl
mov dword [esi], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1003e826
push 0
push 0x1d06
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1003e826
cmp byte [ebp + 0x14], 0
je 0x1003e86b
push 0
push 0
push 0x118d
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
jmp 0x1003e826
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003e87b
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [ebp - 0x18], 0x3e08
cmp dword [ebp - 0x18], 0x4145
jle 0x1003e8d7
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor esi, esi
mov dword [ebp + 0xc], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1007d9f8
and eax, esi
cdq
push edx
push eax
call fcn.10004c38
inc esi
cmp esi, 0x76f4
jl 0x1003e8a5
mov esi, dword [ebp + 0xc]
inc edi
cmp edi, 0xb56
jl 0x1003e898
inc esi
mov dword [ebp + 0xc], esi
cmp esi, 0x6fdc
jl 0x1003e896
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3c14
jge 0x1003e826
mov edx, str.obdxltrak_jvqizkp_cstjlwfbb_oljzyz_gerbomjpl_smv_bshl_cferdf_mpyi_hzgkcebgt
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x1003e826