joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a389c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x5a38d8
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x5a38c8
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xcb
jne 0x5a38f4
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x5a3977
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
push esi
push 0x40011
push eax
call fcn.005a509c
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.005a5468
add esp, 0x14
mov dword [esp], 2
mov eax, dword [ebp - 0x48]
lea edi, [esp + 4]
mov dword [edi], eax
mov eax, dword [ebp - 0x44]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [edi + 8], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
mov eax, dword [ebp - 0x3c]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ecx + 0xc], eax
lea eax, [0x852570]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
call fcn.005a4194
jmp 0x5a38d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x28]
push esi
push 0x40012
push eax
call fcn.005a509c
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.005a5468
add esp, 0x14
mov dword [esp], 2
mov edx, dword [ebp - 0x28]
lea eax, [esp + 4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov esi, dword [ebp - 0x20]
lea ecx, [0x852570]
mov dword [eax + 8], esi
lea edx, [esp + 0x14]
mov edi, dword [ebp - 0x1c]
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ecx]
lea eax, [esp + 0x24]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
call fcn.005a4194
jmp 0x5a38ea
Function at 0x5bc0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
lea edi, [ebp - 0xe8]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x14]
xor ecx, 3
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5bc1b8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
test eax, eax
jbe 0x5bc112
mov dword [ebp - 0xe8], 1
jmp 0x5bc11c
mov dword [ebp - 0xe8], 0
cmp dword [ebp - 0xe8], 0
je 0x5bc1b8
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
cmp ecx, 8
jne 0x5bc14a
push 0xfffffffffffffffd
mov eax, dword [ebp - 8]
add eax, 0x68
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bc0b0
add esp, 0xc
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
xor ecx, 3
and ecx, dword [ebp - 0x20]
je 0x5bc183
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf8
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x14]
and eax, 3
movzx edx, al
or ecx, edx
mov eax, dword [ebp - 8]
mov byte [eax + 5], cl
mov eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
jmp 0x5bc1b3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x1c]
jne 0x5bc1a3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005bc1d0
add esp, 8
jmp 0x5bc0e4
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.0074703b
mov esp, ebp
pop ebp
ret
Function at 0x5c5600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x70], 0
je 0x5c5646
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x70]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x44], edx
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x70]
add ecx, 4
push ecx
call fcn.0074686c
jmp 0x5c568d
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0xc]
mov byte [eax + 6], cl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x58], 0
je 0x5c5686
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005c56b0
add esp, 8
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x58]
call eax
add esp, 4
cmp esi, esp
call fcn.0074703b
push 1
call fcn.00744edc
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.0074703b
mov esp, ebp
pop ebp
ret
Function at 0x5d6060
Capabilities:
Get file size

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov esi, ecx
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
cmp eax, 1
je 0x5d60dd
cmp eax, 2
jne 0x5d6086
mov eax, 1
jmp 0x5d60e6
cmp eax, 4
jne 0x5d60cc
lea eax, [esp + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp], eax
cmp eax, 0xffffffff
jne 0x5d60aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5d60b3
mov edx, dword [esp]
mov edi, dword [esp + 4]
jmp 0x5d60b7
xor edx, edx
xor edi, edi
xor eax, eax
xor ecx, ecx
sub eax, ebp
sbb ecx, ebx
sub edx, eax
sbb edi, ecx
jl 0x5d60cc
mov eax, 2
jmp 0x5d60e6
mov eax, 0xffffffff
mov edx, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
mov eax, ebx
sub eax, 0
jl 0x5d60cc
xor eax, eax
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
lea edx, [esp + 0xc]
push eax
push edx
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x5d6110
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5d6122
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 0xc
mov eax, 0xffffffff
mov edx, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 0xc

Function at 0x5d61a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x3c
mov ebp, ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x5d61bd
xor eax, eax
add esp, 0x3c
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov esi, dword [esp + 0x50]
test esi, esi
jl 0x5d61b1
push esi
call fcn.0074b32d
pop ecx
mov ebx, eax
cmp ebx, dword [0x7a0250]
je 0x5d61b1
mov eax, dword [esp + 0x54]
test eax, eax
je 0x5d61e6
mov dword [ebp + 4], eax
jmp 0x5d62a6
mov edx, esi
sar edx, 5
mov edi, dword [edx*4 + 0x87f760]
and esi, 0x1f
shl esi, 2
lea ecx, [esi + esi*8]
movzx edx, byte [ecx + edi + 4]
lea edi, [esp + 0x38]
xor eax, eax
mov esi, edx
and esi, 0x20
shr esi, 2
and edx, 0x80
mov ecx, esi
or esi, 0x8000
or ecx, 0x4000
cmp edx, 0
cmovne esi, ecx
lea edx, [esp + 0x34]
push eax
push edi
push eax
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
lea ecx, [esp + 0x34]
lea eax, [esp + 0x38]
xor edx, edx
push edx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test edi, edi
je 0x5d625b
test eax, eax
je 0x5d625f
or esi, 2
jmp 0x5d6262
test eax, eax
jne 0x5d6262
or esi, 1
mov eax, esi
and eax, 3
je 0x5d6286
cmp eax, 1
jne 0x5d6275
mov ecx, 0x10
jmp 0x5d628b
mov ecx, 0x18
cmp eax, 2
je 0x5d628b
mov ecx, 0
jmp 0x5d628b
mov ecx, 8
mov edx, ecx
or edx, 1
mov eax, esi
and esi, 0x8000
and eax, 8
cmovne ecx, edx
shr esi, 0xd
or ecx, esi
mov dword [ebp + 4], ecx
lea edx, [esp]
push edx
push ebx
mov dword [ebp], ebx
mov eax, 1
mov word [ebp + 8], ax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x5d62ce
mov eax, dword [esp]
not eax
and eax, 0x10
shr eax, 4
jmp 0x5d62d0
xor eax, eax
mov byte [ebp + 0xa], al
mov eax, 1
add esp, 0x3c
pop ebx
pop ebp
pop esi
pop edi
ret 8
Function at 0x5d9020
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 4]
mov dword [0x8394f0], eax
add esp, 0x24
ret
Function at 0x608350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x776630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
push edi
mov dword [esp], 0x90
call fcn.00742a45
pop ecx
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x6084c6
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [esi], 0x8953a0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x1c]
call fcn.005d4e70
mov dword [ebp - 4], 2
mov dword [esi], 0x895364
lea ecx, [esi + 0x20]
call fcn.005d6590
lea ecx, [ebp - 0x30]
xor eax, eax
mov dword [esi + 0x30], eax
mov word [esi + 0x34], ax
mov byte [esi + 0x36], al
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov edx, 1
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], edx
call fcn.005d4e70
mov dword [ebp - 4], 3
push 0x83990c
lea ecx, [ebp - 0x30]
call fcn.005d4740
test eax, eax
jne 0x60845a
xor eax, eax
mov dword [esi + 0x74], eax
mov edi, 1
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], edi
mov byte [esi + 0x31], al
mov byte [esi + 0x30], al
jmp 0x6084a7
push 0x83990c
lea ecx, [ebp - 0x30]
call fcn.005d4710
mov dword [esi + 0x74], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ebx, eax
mov ecx, dword [esi + 0x74]
mov eax, 1
cmp ebx, 1
cmovg eax, ebx
mov dword [esi + 0x78], eax
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov ecx, dword [esi + 0x74]
mov dword [esi + 0x7c], eax
mov edi, 1
xor eax, eax
cmp ebx, 0
cmovg eax, edi
mov byte [esi + 0x30], al
mov edx, dword [ecx]
call dword [edx + 0x14]
mov byte [esi + 0x31], al
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.005d4770
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], 0
jmp 0x6084c8
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
add esi, 0x20
push dword [eax + 0x10]
mov ecx, esi
call fcn.005d61a0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x28]
test edx, edx
je 0x608515
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
push 1
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x608570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x776650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
push edi
mov dword [esp], 0x88
call fcn.00742a45
pop ecx
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x6086e6
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [esi], 0x893e40
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x1c]
call fcn.005d4e70
mov dword [ebp - 4], 2
mov dword [esi], 0x893e04
lea ecx, [esi + 0x20]
call fcn.005d6590
lea ecx, [ebp - 0x30]
xor eax, eax
mov dword [esi + 0x30], eax
mov word [esi + 0x34], ax
mov byte [esi + 0x36], al
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov edx, 1
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], edx
call fcn.005d4e70
mov dword [ebp - 4], 3
push 0x839910
lea ecx, [ebp - 0x30]
call fcn.005d4740
test eax, eax
jne 0x60867a
xor eax, eax
mov dword [esi + 0x74], eax
mov edi, 1
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], edi
mov byte [esi + 0x31], al
mov byte [esi + 0x30], al
jmp 0x6086c7
push 0x839910
lea ecx, [ebp - 0x30]
call fcn.005d4710
mov dword [esi + 0x74], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ebx, eax
mov ecx, dword [esi + 0x74]
mov eax, 1
cmp ebx, 1
cmovg eax, ebx
mov dword [esi + 0x78], eax
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov ecx, dword [esi + 0x74]
mov dword [esi + 0x7c], eax
mov edi, 1
xor eax, eax
cmp ebx, 0
cmovg eax, edi
mov byte [esi + 0x30], al
mov edx, dword [ecx]
call dword [edx + 0x14]
mov byte [esi + 0x31], al
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.005d4770
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], 0
jmp 0x6086e8
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
add esi, 0x20
push dword [eax + 0x10]
mov ecx, esi
call fcn.005d61a0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x28]
test edx, edx
je 0x608735
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
push 1
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x60a180
Capabilities:
Get geographical location

Disassembly:
push esi
mov eax, dword [esp + 8]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
push esi
push 0x51
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, esi
pop esi
ret

Function at 0x60a1a0
Capabilities:
Get geographical location

Disassembly:
push esi
mov eax, dword [esp + 8]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
push esi
push 0x50
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, esi
pop esi
ret

Function at 0x60a1c0
Capabilities:
Get geographical location

Disassembly:
push esi
mov eax, dword [esp + 8]
mov esi, dword [esp + 0xc]
push dword [esp + 0x10]
push esi
push 0x15
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, esi
pop esi
ret

Function at 0x60ab20
Capabilities:
Get geographical location

Disassembly:
push esi
mov eax, dword [esp + 8]
mov edx, dword [eax]
cmp edx, 0x7f
je 0x60ab48
lea eax, [esp]
push 2
push eax
push 0x53
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp]
push eax
call fcn.007444a5
add esp, 8
ret
mov eax, 0x7f
pop ecx
ret

Function at 0x60abd0
Capabilities:
Get geographical location

Disassembly:
push esi
mov eax, dword [esp + 8]
mov edx, dword [eax]
cmp edx, 0x7f
je 0x60abf8
lea eax, [esp]
push 2
push eax
push 0x52
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp]
push eax
call fcn.007444a5
add esp, 8
ret
mov eax, 0x7f
pop ecx
ret
Function at 0x627e70
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7771f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], fcn.00628310
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], 5
push ebx
push dword [0x83c270]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x627f37
call fcn.00629330
test eax, eax
je 0x627fb2
push 0
push str.Can_not_start_thread:_error_writing_TLS.
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push edi
mov dword [esp], eax
call fcn.006304c0
pop ecx
mov dword [ebp - 4], 0xffffffff
movzx eax, byte [ebp - 0x30]
test eax, eax
jne 0x627f1b
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x28]
push edi
mov dword [esp], eax
call dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
mov dword [ebp - 4], 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
movzx edx, byte [ebp - 0x30]
mov dword [ebp - 0x24], eax
test edx, edx
jne 0x627f84
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
push edi
mov dword [esp], eax
call dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, str.Can_not_start_thread:_error_writing_TLS.
jmp 0x627ee2
Function at 0x628e10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628f20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov eax, dword [0x84cd00]
mov dword [ebp - 0x14], eax
call fcn.00629330
test eax, eax
je 0x628e69
call fcn.00629330
mov eax, dword [eax + 0xc]
push edi
call fcn.00628d44
pop ecx
test eax, eax
je 0x628e69
mov edx, dword [eax + 0xc]
shl edx, 0xa
or edx, dword [eax + 8]
movzx ecx, dx
jmp 0x628e6e
mov ecx, 0x400
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov eax, dword [0x83b878]
mov dword [ebx], eax
cmp edx, 1
jne 0x628ee6
lea edx, [ebp - 0x220]
push pe_nt_image_headers32
push edx
xor eax, eax
mov word [ebp - 0x220], ax
push 0xe
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x628ec5
push 0x7a2700
call fcn.007444aa
pop ecx
mov ecx, dword [ebp + 8]
push eax
push 0x7a2700
push eax
call fcn.006203c0
jmp 0x628ee3
lea eax, [ebp - 0x220]
push eax
call fcn.007444aa
pop ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x220]
push eax
push edx
push eax
call fcn.006203c0
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
call fcn.007470f0
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x630a40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
movzx eax, word [edx]
test eax, eax
je 0x630a79
xor ecx, ecx
add eax, ecx
add edx, 2
mov ecx, eax
shl ecx, 0xa
add eax, ecx
mov ecx, eax
shr ecx, 6
xor ecx, eax
movzx eax, word [edx]
test eax, eax
jne 0x630a4d
lea eax, [ecx + ecx*8]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 0xf
add eax, ecx
ret
xor ecx, ecx
jmp 0x630a67
Function at 0x6381d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov eax, dword [0x83b878]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20]
push dword [ebp + 0xc]
call fcn.0061f880
push 1
push 0x7a8404
lea ecx, [ebp - 0x20]
push 0x7a8400
call fcn.0061ff60
push 1
push 0x7a8418
lea ecx, [ebp - 0x20]
push 0x790564
call fcn.0061ff60
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff4
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x638261
dec eax
mov dword [ecx], eax
jne 0x638261
call fcn.0061ff50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x639b14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x639b2a
not eax
and eax, 0x10
shr eax, 4
ret
xor eax, eax
ret

Function at 0x63ab5d
Capabilities:
Copy file

Disassembly:
push edi
push esi
mov esi, edx
mov edi, eax
movzx ecx, cl
mov eax, 1
xor edx, edx
cmp ecx, 0
cmove edx, eax
push edx
push dword [esi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x63ab8a
mov eax, 1
pop esi
pop edi
ret
call fcn.00629330
test eax, eax
je 0x63abb3
push 0
push str.Failed_to_copy_the_file__s_to__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [esi]
push dword [edi]
push eax
call fcn.006304c0
xor eax, eax
add esp, 0xc
pop esi
pop edi
ret
mov eax, str.Failed_to_copy_the_file__s_to__s
jmp 0x63aba1

Function at 0x63aec0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x63aee9
mov edx, dword [edi]
cmp edx, 0xffffffff
je 0x63aee9
push dword [esp + 0xc]
push eax
push edx
call fcn.0074f1e7
add esp, 0xc
cmp eax, 0xffffffff
je 0x63aeef
pop edi
ret 8
xor eax, eax
pop edi
ret 8
call fcn.00629330
test eax, eax
je 0x63af1a
push 0
push str.cant_read_from_file_descriptor__d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [edi]
push eax
call fcn.006304c0
mov eax, 0xffffffff
add esp, 8
pop edi
ret 8
mov eax, str.cant_read_from_file_descriptor__d
jmp 0x63af06