joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10021e2d
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8

Function at 0x10021e2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10021e3c
pop dword [ebp - 0x44]
mov eax, 0xfe8f0ef0
add eax, 0x11730f4c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xbd541402
add dword [ebp - 0x54], 0x90fe3149
mov dword [ebp - 0x50], 0x33502f35
sub dword [ebp - 0x50], 0x11ce2f0
mov dword [ebp - 0x4c], 0x2ab68c97
add dword [ebp - 0x4c], 0x2195b797
mov dword [ebp - 0x48], 0xab723f1d
add dword [ebp - 0x48], 0x548dc0e3
lea eax, [ebp - 0x54]
push eax
mov eax, 0xaf68eab7
add eax, 0x609965cd
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xc3925f27
add dword [ebp - 0x54], 0xb0e00a2f
mov dword [ebp - 0x50], 0xc9862e83
add dword [ebp - 0x50], 0x77e632f2
mov dword [ebp - 0x4c], 0x4443d452
add dword [ebp - 0x4c], 0x1f2b981a
mov dword [ebp - 0x48], 0xd3a02546
add dword [ebp - 0x48], 0x2c5fdaba
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xcf983f2
sub eax, 0xfcf73376
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x390a1
push 0
call eax
mov ecx, 0x3e71
mov edi, eax
mov esi, 0x10030c00
add esi, dword [ebp - 0x44]
mov ebx, 0x6d9d6e21
add ebx, 0x9de9d665
xor dword [ebp - 0x40], 0x425ffa9c
mov edx, dword [esi]
sub dword [ebp - 0x20], 0xd0e78c1d
xor edx, ebx
mov dword [ebp - 8], 0xc3a37048
mov dword [edi], edx
mov dword [ebp - 0x40], 0x2ae3e4a5
add edi, 0x7076095a
sub edi, 0x70760956
add esi, 0x773f8e28
add esi, 0x88c071dc
loop 0x10021f52
add eax, 0xec97
mov ebx, eax
add eax, 0x6ca56238
add eax, 0x935a9dcd
mov ecx, 0x6c9ac175
add ecx, 0xa3653e8b
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40417b
Capabilities:
Encode data using xor

Disassembly:
add dword [eax - 0x2efdfc80], 0x80180
adc dword [eax], eax
wait
or cl, byte [edx - 0x7780f2ff]
mov al, byte [ecx]
invalid
jg 0x404108
mov al, byte [ecx]
or eax, 0x7b887f
jnp 0x404182
inc ecx
and bh, 0x37
add byte [esi], dh
and byte [ebx - 0x78], 0x41
add byte [eax], bh
add byte [ebx], 0x2d
add byte [edi], dh
or byte [ecx], 2
inc esp
add byte [edx], 0x2d
add byte [ecx], dh
add byte [eax], dh
add dh, dl
xor al, 0x80
add dword [ecx + 0x4804209], eax
xor al, 0x80
jg 0x40416d
or ebp, dword [eax + 0x40460030]
add eax, 0x45044037
rol byte [eax], 0x11
inc ecx
or dword [eax], esi
add byte [ebp + 0x40], bh
dec ebp
salc
salc
jmp 0x4041c5
dec ecx
mov esp, 0x9743f231
mov edx, 0x19e540e4
in al, 0xdd
xchg dword [eax - 0x40], ebp
xchg byte [ecx + eax*2 + 0x40], dh
das
jae 0x4041dc
cmp al, byte [eax]
das
inc eax
add byte [ecx + 0x55], ah
rcl byte [edx + 0x6d], 0x40
mov ah, byte [esi - 0x40]
mov esp, dword [ecx - 0x3e]
push eax
bound edx, qword [ecx + 0x40]
add byte cs:[ebx + 0x40], ah
push ebx
insd dword es:[edi], dx
mov byte [edi], 0x2d
stosd dword es:[edi], eax
inc eax
or bl, cl
xchg edi, eax
jae 0x4041c2
push es
ja 0x4041c5
outsb dx, byte ds:[esi]
rol byte [ecx], 0x36
push edx
inc eax
or al, 0xc1
push cs
rcl byte gs:[edx], 0xdd
mov byte [0x80000000], al
cvttps2pi mm1, qword [edx]
or dword [ebx], 0xffffffd7
add dword [eax + eax + 0x4e], edi
add dword [ebp - 0x40], esi
add ch, al
add dword [ebx + eax + 0x2b6d0187], eax
shl dword [edi + 0x40e8a9c1], 0xa2
int 0xc4
test eax, 0xe6a6e947
jmp [ecx + 0x46280]
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10013a33
pop dword [ebp - 0x40]
mov eax, 0xc1942fcf
add eax, 0x4e6d0a64
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb40969bf
sub dword [ebp - 0x50], 0x65b72474
mov dword [ebp - 0x4c], 0xc8134e9a
add dword [ebp - 0x4c], 0x6a1ffdab
mov dword [ebp - 0x48], 0x4a2ab04b
add dword [ebp - 0x48], 0x22193e3
mov dword [ebp - 0x44], 0xbb4a742f
sub dword [ebp - 0x44], 0xbb4a742f
lea eax, [ebp - 0x50]
push eax
mov eax, 0x6fad5528
add eax, 0xa0546b58
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x6621f2ad
add dword [ebp - 0x50], 0xe5076a9
mov dword [ebp - 0x4c], 0xd2b8aa11
sub dword [ebp - 0x4c], 0x914c489c
mov dword [ebp - 0x48], 0x2e4f5cb7
add dword [ebp - 0x48], 0x35200fb5
mov dword [ebp - 0x44], 0x8690ba76
add dword [ebp - 0x44], 0x796f458a
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xcdacac5c
add eax, 0x425513a4
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3cc11
push 0
call eax
mov ecx, 0xb51ab384
sub ecx, 0xb51a5625
mov edi, eax
mov ebx, 0x10026800
add ebx, dword [ebp - 0x40]
mov edx, 0xf52800fd
sub edx, 0xc3331282
mov dword [ebp - 0x3c], 0xfa2ab988
mov esi, dword [ebx]
xor dword [ebp - 0x3c], 0xcc336411
xor esi, edx
mov dword [ebp - 0x28], 0x817d9e63
mov dword [edi], esi
add dword [ebp - 0x30], esi
add edi, 0xde5a5cd0
sub edi, 0xde5a5ccc
add ebx, 0xdf3099bb
sub ebx, 0xdf3099b7
loop 0x10013b4f
add eax, 0x1c788fb
add eax, 0xfe39df54
mov ebx, eax
add eax, 0x6b8db280
sub eax, 0x6b8db27b
mov ecx, 0xa8d15a14
invalid
invalid
adc al, 0x5a
invalid
Function at 0x10002d2c
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10020990]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
cmp esi, ebx
jne 0x10002d6a
push 0x57
pop edi
jmp 0x10002e05
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push 1
push eax
mov dword [esi], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x10002dae
call dword [sym.imp.GDI32.dll_GdiEndPageEMF]
mov edi, eax
mov eax, dword [0x10020994]
cmp eax, 0x10020994
je 0x10002df7
test byte [eax + 0x1c], 4
je 0x10002df7
push edi
push 0x10019dc0
push 0xf
jmp 0x10002de5
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10002df2
call dword [sym.imp.GDI32.dll_GdiEndPageEMF]
mov edi, eax
mov eax, dword [0x10020994]
cmp eax, 0x10020994
je 0x10002df7
test byte [eax + 0x1c], 4
je 0x10002df7
push edi
push 0x10019dc0
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.100027a4
jmp 0x10002df7
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
cmp dword [ebp - 0x10], ebx
je 0x10002e05
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005064
leave
ret 8

Function at 0x10005576
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6bff3c90
push 0x6bff2560
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x6bff4000]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0x55], 0xec83ec8b
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
Function at 0x10007014
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10007104
mov eax, 0x94
call fcn.10009770
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10007179
mov ecx, dword [esi + 0x10]
mov dword [0x100242f4], ecx
mov eax, dword [esi + 4]
mov dword [0x10024300], eax
mov edx, dword [esi + 8]
mov dword [0x10024304], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100242f8], esi
je 0x1000707f
or esi, 0x8000
mov dword [0x100242f8], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100242fc], eax
call fcn.1000777a
test eax, eax
pop ecx
je 0x10007179
call fcn.10008ed2
test eax, eax
jne 0x100070ac
call fcn.100077cb
jmp 0x10007179
call fcn.100096d9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100249dc], eax
call fcn.100095b7
mov dword [0x10024178], eax
call fcn.10009098
test eax, eax
jl 0x100070fd
call fcn.10009515
test eax, eax
jl 0x100070f8
call fcn.100092e2
test eax, eax
jl 0x100070f8
push 0
call fcn.10008b39
test eax, eax
pop ecx
jne 0x100070f8
inc dword [0x10024174]
jmp 0x1000718a
call fcn.10009296
call fcn.10008caf
jmp 0x100070a2
test eax, eax
jne 0x10007134
cmp dword [0x10024174], eax
jle 0x10007179
dec dword [0x10024174]
cmp dword [0x10024330], eax
jne 0x10007123
call fcn.10008c88
call fcn.10009296
call fcn.10008caf
call fcn.100077cb
jmp 0x1000718a
cmp eax, 2
jne 0x1000717d
push 0x8c
push 1
call fcn.10008fc1
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10007179
push esi
push dword [0x10022008]
call dword [0x10024340]
test eax, eax
push esi
je 0x10007173
call fcn.10008ccc
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1000718a
call fcn.1000690e
pop ecx
xor eax, eax
jmp 0x1000718d
cmp eax, 3
jne 0x1000718a
push 0
call fcn.10008e97
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x10008ba3
Capabilities:
Terminate process

Disassembly:
push 8
push 0x1001aed8
call fcn.1000896c
push 8
call fcn.100079bb
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x10024334], esi
jne 0x10008bd7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x10024330], esi
mov al, byte [ebp + 0x10]
mov byte [0x1002432c], al
cmp dword [ebp + 0xc], edi
jne 0x10008c21
cmp dword [0x100249a8], edi
je 0x10008c11
mov eax, dword [0x100249a4]
sub eax, 4
mov dword [0x100249a4], eax
cmp eax, dword [0x100249a8]
jb 0x10008c11
mov eax, dword [eax]
cmp eax, edi
je 0x10008bf2
call eax
jmp 0x10008bf2
push 0x1001e020
mov eax, 0x1001e01c
call fcn.10008b03
pop ecx
push 0x1001e028
mov eax, 0x1001e024
call fcn.10008b03
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10008c52
cmp dword [ebp + 0x10], edi
jne 0x10008c60
mov dword [0x10024334], esi
push dword [ebp + 8]
call fcn.10008ac1
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10008c5f
push 8
call fcn.100078ee
pop ecx
ret
call fcn.100089a7
ret
Function at 0x10009958
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x100225a0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100220b8]
je 0x1000998f
inc eax
cmp eax, 0x13
jb 0x10009980
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100220b8]
jne 0x10009ab2
mov eax, dword [0x10024180]
cmp eax, 1
je 0x10009a8d
cmp eax, edx
jne 0x100099bf
cmp dword [0x10024184], 1
je 0x10009a8d
cmp ecx, 0xfc
je 0x10009ab2
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100099f5
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.1000b1f0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.1000b2f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10009a29
mov eax, edi
push eax
call fcn.1000b2f0
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x1001b358
push edi
call fcn.1000b480
add esp, 0x10
push edi
call fcn.1000b2f0
push dword [esi + 0x100220bc]
mov ebx, eax
call fcn.1000b2f0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10009770
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.1000b1f0
push edi
push ebx
call fcn.1000b200
push 0x1001b338
push ebx
call fcn.1000b200
push dword [esi + 0x100220bc]
push ebx
call fcn.1000b200
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.1000b37b
add esp, 0x2c
jmp 0x10009ab2
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x100220bc]
push dword [esi]
call fcn.1000b2f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.1000b5d5
add ebp, 0x90
leave
ret
Function at 0x1000b37b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100244c4], ebx
push esi
push edi
jne 0x1000b3fb
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1000b436
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x100244c4], eax
je 0x1000b436
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x100244c8], eax
call esi
cmp dword [0x100242f4], 2
mov dword [0x100244cc], eax
jne 0x1000b3fb
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x100244d4], eax
je 0x1000b3fb
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x100244d0], eax
mov eax, dword [0x100244d0]
test eax, eax
je 0x1000b440
call eax
test eax, eax
je 0x1000b427
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100244d4]
test eax, eax
je 0x1000b427
test byte [ebp - 8], 1
jne 0x1000b440
cmp dword [0x10024300], 4
jb 0x1000b43a
or byte [ebp + 0x12], 0x20
jmp 0x1000b45f
xor eax, eax
jmp 0x1000b46f
or byte [ebp + 0x12], 4
jmp 0x1000b45f
mov eax, dword [0x100244c8]
test eax, eax
je 0x1000b45f
call eax
mov ebx, eax
test ebx, ebx
je 0x1000b45f
mov eax, dword [0x100244cc]
test eax, eax
je 0x1000b45f
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100244c4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000eb2e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10009770
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000ebc9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100242f4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x1000ebc9
cmp eax, 1
je 0x1000ebea
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000ebc9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x1000eb96
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1000ebc5
xor eax, eax
inc eax
jmp 0x1000ec09
cmp edi, eax
jae 0x1000ebcd
xor eax, eax
jmp 0x1000ec09
cmp eax, esi
jae 0x1000ebd4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100242f4]
jmp 0x1000ebed
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f680
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1001cd70
call fcn.1000896c
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x10024618], edi
jne 0x1000f6c4
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000f6af
mov dword [0x10024618], ebx
jmp 0x1000f6c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000f6c4
mov dword [0x10024618], 2
mov eax, dword [0x10024618]
cmp eax, ebx
jne 0x1000f6e4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000f7a7
cmp eax, 2
je 0x1000f6ed
cmp eax, edi
jne 0x1000f715
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x1000f700
mov eax, dword [0x10024520]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1000f71c
xor eax, eax
jmp 0x1000f7a7
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.10009770
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1000f74f
cmp esi, edi
jne 0x1000f765
push dword [ebp - 0x20]
call fcn.10007353
pop ecx
mov esi, eax
cmp esi, edi
je 0x1000f715
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1000f798
cmp dword [ebp + 0x14], edi
jne 0x1000f782
push edi
push edi
jmp 0x1000f788
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x1000f7a4
push esi
call fcn.1000690e
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.100089a7
ret
Function at 0x1000f7b0
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1001cd80
call fcn.1000896c
xor esi, esi
cmp dword [0x1002461c], esi
jne 0x1000f7f4
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000f7df
mov dword [0x1002461c], edi
jmp 0x1000f7f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000f7f4
mov dword [0x1002461c], 2
mov eax, dword [0x1002461c]
cmp eax, 2
je 0x1000f8d5
cmp eax, esi
je 0x1000f8d5
cmp eax, 1
jne 0x1000f839
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x1000f822
mov eax, dword [0x10024520]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x1000f840
xor eax, eax
jmp 0x1000f8e7
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.10009770
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x1000f876
cmp edi, esi
jne 0x1000f891
lea eax, [ebx + ebx]
push eax
call fcn.10007353
pop ecx
mov edi, eax
cmp edi, esi
je 0x1000f839
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000f8c4
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x1000f8ae
push esi
push esi
jmp 0x1000f8b4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1000f8d0
push edi
call fcn.1000690e
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x1000f8e7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.100089a7
ret
Function at 0x100100b7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x100100d0
or eax, 0xffffffff
jmp 0x10010131
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x1001012d
push 0x3d
push esi
call fcn.100102b8
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x1001012d
cmp esi, eax
je 0x1001012d
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x10024314]
sete cl
cmp eax, dword [0x10024318]
mov dword [ebp - 4], ecx
jne 0x10010113
mov edi, eax
call fcn.10010056
mov dword [0x10024314], eax
cmp eax, ebx
jne 0x1001016c
cmp dword [ebp + 0xc], ebx
je 0x10010135
cmp dword [0x1002431c], ebx
je 0x10010135
call fcn.1000fbd3
test eax, eax
je 0x1001016c
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x1001013e
xor eax, eax
jmp 0x10010130
push 4
call fcn.10007353
cmp eax, ebx
pop ecx
mov dword [0x10024314], eax
je 0x1001012d
mov dword [eax], ebx
cmp dword [0x1002431c], ebx
jne 0x1001016c
push 4
call fcn.10007353
cmp eax, ebx
pop ecx
mov dword [0x1002431c], eax
je 0x1001012d
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x10024314]
sub edi, esi
push esi
call fcn.10010009
mov edi, eax
test edi, edi
pop ecx
jl 0x100101d3
cmp dword [ebx], 0
je 0x100101d3
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.1000690e
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x100101b3
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x10010214
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x100101aa
mov eax, edi
shl eax, 2
push eax
push dword [0x10024314]
call fcn.1000b5e3
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x10010214
jmp 0x1001020f
cmp dword [ebp - 4], 0
jne 0x1001027b
test edi, edi
jge 0x100101e3
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x10024314]
call fcn.1000b5e3
test eax, eax
pop ecx
pop ecx
je 0x1001012d
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x10024314], eax
cmp dword [ebp + 0xc], 0
je 0x10010266
push esi
call fcn.1000b2f0
inc eax
inc eax
push eax
call fcn.10007353
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x10010266
push esi
push edi
call fcn.1000b1f0
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x1001025f
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.1000690e
pop ecx
cmp dword [ebp - 4], 0
je 0x10010273
push esi
call fcn.1000690e
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x10010130
push esi
call fcn.1000690e
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x1001013a
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x43155f1
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0xd75db
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219