joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401534
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x401560
mov ecx, dword [0x423d58]
push edi
add eax, ecx
push edi
push eax
push dword [0x409004]
mov dword [0x4191bc], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.004013b6
cmp eax, edi
jl 0x401659
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x409004]
call ebx
test eax, eax
je 0x401655
cmp dword [ebp - 4], esi
jne 0x401655
push dword [ebp + 8]
add dword [0x4191bc], esi
call fcn.004013b6
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x401658
cmp dword [ebp + 0x10], edi
jne 0x401624
cmp dword [ebp + 8], edi
jle 0x401650
mov esi, 0x4191c0
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x4015d4
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x409004]
call ebx
test eax, eax
je 0x401655
cmp edi, dword [ebp - 4]
jne 0x401655
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401620
cmp dword [ebp + 0x14], edi
jne 0x401620
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4191bc], eax
cmp dword [ebp + 8], 0
jg 0x4015c7
jmp 0x401650
push 0xfffffffffffffffe
jmp 0x401657
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40162f
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409004]
call ebx
test eax, eax
je 0x401655
mov eax, dword [ebp - 4]
add dword [0x4191bc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x401658
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x402136
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x41d5dc], 0
jne 0x402174
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40214a
mov dword [ecx*4 + 0x41d5d8], eax
inc ecx
cmp ecx, 0x100
jl 0x402145
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4021a1
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41d5d8]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x402182
not eax
pop ebp
ret 0xc

Function at 0x4021a7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x41d9d8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x41d9d8], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4021e2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x402329
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402346
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x402349
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x402378
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4023bc
test edi, edi
jne 0x402383
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4023b6
Function at 0x4023c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402431
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402420
cmp dword [ebp + 0x14], 1
je 0x402422
cmp dword [ebp + 0x14], 2
je 0x402422
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x40267a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x41da20
push esi
call fcn.004024d9
push esi
call fcn.004022b2
mov edi, eax
test edi, edi
jne 0x40269b
xor eax, eax
jmp 0x4026f3
push edi
call fcn.004024fb
test byte [0x423d68], 0x80
je 0x4026b4
mov al, byte [edi]
test al, al
je 0x402697
cmp al, 0x5c
je 0x402697
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x4026d4
push esi
call fcn.00402595
test eax, eax
je 0x4026ce
test byte [eax], 0x10
je 0x4026f8
push esi
call fcn.00402653
push esi
call ebx
cmp eax, edi
jg 0x4026bf
push esi
call fcn.00402626
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4026f2
Function at 0x4029ac
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.004025bc
mov esi, dword [esp + 0x18]
test eax, eax
je 0x4029d0
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x402b09
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x41de20], 0x4c554e
mov edi, 0x400
mov ebp, 0x41de20
test esi, esi
je 0x402a14
push 1
push 0
push esi
call fcn.00402349
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x402b0f
cmp eax, edi
jg 0x402b0f
push edi
mov esi, 0x41e760
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x402b0f
cmp eax, edi
jg 0x402b0f
push esi
push ebp
push str._s_s_r_n
push 0x41e220
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x423d0c]
push dword [eax + 0x128]
push esi
call fcn.00402752
push 4
push 0xc0000000
push esi
call fcn.00402349
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x402b09
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x402b02
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402b02
cmp edi, dword [esp + 0x18]
jne 0x402b02
push str._Rename__r_n
push esi
call fcn.004026fc
test eax, eax
jne 0x402b16
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.004024d9
add edi, 0xa
mov eax, edi
push ebx
push 0x41e220
add eax, esi
push eax
call fcn.00402305
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x422c70]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x4075cc
add eax, 0xa
push eax
call fcn.004026fc
test eax, eax
je 0x402acd
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x402b3d
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x402b32
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x402acf
Function at 0x402b45
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0040267a
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x402b7a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x422c68], eax
jmp 0x402d0c
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x402b95
test eax, eax
je 0x402cb7
test cl, 2
je 0x402cb7
push edi
push ebx
mov esi, 0x41eb60
push esi
call fcn.004024d9
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x402bb8
push str..
push esi
call edi
jmp 0x402bbe
push ebx
call fcn.00402653
cmp byte [ebx], 0
jne 0x402bcc
cmp byte [0x41eb60], 0x5c
jne 0x402bd4
push 0x4075c8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x402cac
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.0040226e
cmp byte [eax], 0
je 0x402c17
cmp byte [ebp - 0x18], 0
je 0x402c17
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x402c2d
mov al, byte [esi + 1]
test al, al
je 0x402c8b
cmp al, 0x2e
jne 0x402c2d
cmp byte [esi + 2], 0
je 0x402c8b
push esi
push edi
call fcn.004024d9
test byte [ebp - 0x148], 0x10
je 0x402c52
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x402c8b
push dword [ebp + 0xc]
push ebx
call fcn.00402b45
jmp 0x402c8b
push ebx
call fcn.00402329
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402c83
test byte [ebp + 0xc], 4
je 0x402c7b
push ebx
push 0xfffffffffffffff1
call fcn.00403df6
push 0
push ebx
call fcn.004029ac
jmp 0x402c8b
inc dword [0x422c68]
jmp 0x402c8b
push ebx
push 0xfffffffffffffff2
call fcn.00403df6
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402bf9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x402cb6
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x402d0b
cmp dword [ebp - 8], esi
je 0x402cfb
push ebx
call fcn.00402595
test eax, eax
je 0x402d0b
push ebx
call fcn.00402626
push ebx
call fcn.00402329
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x402d03
test byte [ebp + 0xc], 4
je 0x402cfb
push ebx
push 0xfffffffffffffff1
call fcn.00403df6
push esi
push ebx
call fcn.004029ac
jmp 0x402d0b
inc dword [0x422c68]
jmp 0x402d0b
push ebx
push 0xffffffffffffffe5
call fcn.00403df6
pop esi
pop ebx
leave
ret 8
Function at 0x404baf
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x422c90]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x404c44
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x404c01
cmp dword [ebp + 0x10], ebx
jne 0x404c38
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00404baf
test eax, eax
jne 0x404c13
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x404be8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004025bc
cmp eax, ebx
je 0x404c4b
push ebx
push dword [0x422c90]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x404c44
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x422c90], ebx
jne 0x404c41
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x404c41
jmp 0x404c44
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x7e134a6
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3ac38f1
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001e92
Capabilities:
Start service

Disassembly:
mov eax, 0x10064555
call fcn.10064060
sub esp, 0x34
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x24]
push ebx
push esi
push edi
push 0x100077fd
push fcn.1000770a
push 1
push 0xc
mov ebx, ecx
mov esi, edx
push eax
mov dword [ebp - 0x14], ebx
call fcn.1004dba0
push 0x3948
push 0
push 0x4a97
push 0x59e4
lea eax, [ebp - 0x24]
xor ecx, ecx
push eax
push dword [ebp + 8]
inc ecx
mov edx, 0x5682
push esi
push 0x1b73
push ecx
mov dword [ebp - 4], ecx
call fcn.10004caa
mov dword [ebp - 0x10], 0x255a
add esp, 0x24
cmp dword [ebp - 0x10], 0x272f
jle 0x10001f80
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ebx
cdq
idiv ecx
lea ecx, [ebp - 0x3c]
xor edx, edi
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001f31
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10007f12
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, 0x6077
jl 0x10001f11
inc ebx
cmp ebx, 0x697
jl 0x10001f0c
inc edi
cmp edi, 0x3568
jl 0x10001f0a
inc esi
cmp esi, 0x4be9
jl 0x10001f08
push 0
push 0x1161
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.10007717
xor eax, eax
mov byte [ebp - 4], 0
inc eax
push 0x100077fd
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push 0xc
push eax
call fcn.1004d57b
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d24e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064b5a
call fcn.10064060
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x1474
cmp dword [ebp - 0x14], 0x15bb
push edi
mov dword [ebp - 0x10], esp
jle 0x1000d297
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10082178
xor eax, esi
cdq
push edx
push eax
call fcn.100073fb
inc edi
cmp edi, 0x77d
jl 0x1000d274
inc esi
cmp esi, 0x1f3d
jl 0x1000d272
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x139f
jge 0x1000d2b3
mov edx, str.mbdbyf_hohnzun_wdepkrme_uoafmslj_jcngsnbjy_ubferdabh_rcribj_mnpheqkhs_raowdrod_zkjft_gkrwtv_qeok_bdcdtnij_osz
mov ecx, 0x10082178
call fcn.1000bae6
cmp byte [ebp + 8], 0
je 0x1000d2f8
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1000d318
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xffff
inc dword [edx]
cmp dword [edx], 1
jl 0x1000d2ca
jmp 0x1000d318
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000d318
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 3
jl 0x1000d309
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ef1f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064bc4
call fcn.10064060
sub esp, 0x30
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ebx
je 0x1000f00a
mov dword [ebp - 0x20], 0x6c62
cmp dword [ebp - 0x20], 0x6fae
jle 0x1000efa8
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x24], esi
xor ebx, ebx
sar esi, cl
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x10082178
xor eax, esi
cdq
push edx
push eax
call fcn.100073fb
inc edi
cmp edi, 0x79f7
jl 0x1000ef66
inc ebx
cmp ebx, 0x2c12
jl 0x1000ef64
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x7914
jl 0x1000ef5b
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3151
jl 0x1000ef56
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x69b3
jge 0x1000efc4
mov edx, str.lkhhbm_kzdgfvh_zlrpdcmi_ocilrur
mov ecx, 0x10082178
call fcn.1000bae6
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1000f0b6
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 5
inc dword [edx]
cmp dword [edx], 1
jl 0x1000efd9
jmp 0x1000f0b6
mov dword [ebp - 0x1c], 0x55ef
cmp dword [ebp - 0x1c], 0x590c
jle 0x1000f085
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x3c]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f04e
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10007f12
inc ebx
cmp ebx, 0x5dc0
jl 0x1000f032
mov esi, dword [ebp - 0x20]
inc edi
cmp edi, 0x4982
jl 0x1000f029
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x3713
jl 0x1000f027
mov ebx, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], 0x542a
jge 0x1000f099
push str.svop_azfeevvbg_hilj_wibx_kccortnm_zaeja_ekrgktd_idindxxn_usay_dws_yisy_wtkknoj_pij_cmzl
call fcn.1004da5d
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x1000f0b1
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 4
jl 0x1000f0a4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100112af
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10064c6c
call fcn.10064060
sub esp, 0x1c
mov byte [ebp - 0x10], cl
push ebx
push esi
push edi
test dl, dl
je 0x100113b5
test cl, cl
je 0x100113a6
mov esi, dword [ebp + 0xc]
mov dword [esi], 0xffffffef
cmp dword [esi], 0xffffffe7
jge 0x100113ee
xor edi, edi
inc edi
mov dword [ebp - 0x14], 0xb5cabfc3
lea ecx, [ebp - 0x28]
push 2
call fcn.10007996
push 0x73
push edi
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0x2824
push edi
push 0x6725
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0x6721f7d
push eax
push 0x241f
push edi
push 0x3156
push 0x47ee
push 0x19df
push 0x2261
push 0x1d19
mov edx, 0x1ecd
mov ecx, 0x1182
call fcn.1000e863
mov edx, dword [ebp - 0x14]
add esp, 0x38
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esi]
setl cl
xor ebx, ebx
cmp ecx, eax
mov ecx, dword [ebp - 0x14]
setg bl
add ecx, dword [ebp - 0x14]
mov eax, dword [esi]
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, ebx
setle al
imul ecx, eax, 5
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], edi
or dword [ebp - 4], 0xffffffff
call fcn.100079d2
dec dword [esi]
cmp dword [esi], 0xffffffe7
jl 0x100112e7
jmp 0x100113ee
push 0x1101
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x100113ee
cmp byte [ebp + 0x18], 0
je 0x100113cb
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x100113ee
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x100113ee
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100113ee
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [edx]
cmp dword [edx], 2
jl 0x100113dc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d7a7
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065446
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002d919
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0xd03
mov dword [ebp - 0x28], str.esnun_wic_ualvntgcu_hbdrtngo
cmp dword [ebp - 0x24], 0xd9a
jle 0x1002d891
push 0
push 0
push 0x1835
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
and dword [ebp - 0x1c], 0
jmp 0x1002d814
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x32df
jge 0x1002d891
and dword [ebp - 0x20], 0
jmp 0x1002d82a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5b2
jge 0x1002d88c
and dword [ebp - 0x14], 0
jmp 0x1002d840
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2e63
jge 0x1002d88a
and dword [ebp - 0x18], 0
jmp 0x1002d856
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6684
jge 0x1002d888
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
and eax, ecx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0x10082178
call fcn.100073fb
jmp 0x1002d84f
jmp 0x1002d839
jmp 0x1002d823
jmp 0x1002d80d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xaaa
jge 0x1002d8b1
mov edx, dword [ebp - 0x28]
mov ecx, 0x10082178
call fcn.1000bae6
jmp 0x1002d8cd
or dword [ebp - 4], 0xffffffff
jmp 0x1002d8d7
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002d8fb
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov byte [eax], 1
jmp 0x1002d917
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1002d917
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1002d93f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
push 0x4dea
push 0x3295
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 1
call fcn.1002000f
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ef76
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x18], 0
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x1002efef
cmp byte [ebp + 0xc], 0
je 0x1002ef9c
push ecx
lea edx, [ebp + 0x1b]
mov byte [ebp + 0x1b], 0
call fcn.1002f282
pop ecx
jmp 0x1002f01a
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [ebp + 0x14]
test eax, eax
push ebx
setne cl
xor ebx, ebx
mov dword [ebp - 4], ecx
mov ecx, dword [edi]
mov eax, dword [edi]
add ecx, eax
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [edi]
setl bl
xor edx, edx
cmp dword [ebp - 4], eax
mov eax, dword [esi]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ebx, ecx
pop ebx
setle al
imul ecx, eax, 5
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
mov dword [eax], ecx
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x1002f01a
cmp byte [ebp + 0x10], 0
je 0x1002f014
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
jmp 0x1002f00d
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffb
inc dword [edx]
cmp dword [edx], 4
jl 0x1002f000
jmp 0x1002f01a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
pop edi
pop esi
mov esp, ebp
pop ebp
ret