joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov esi, edx
mov edi, ecx
mov edx, 2
mov dword [ebp - 4], edx
cmp edi, 8
jle 0x41bb42
push dword [ebx + 8]
mov edx, esi
call fcn.0041bcb0
add esp, 4
mov edx, 8
mov dword [ebp - 4], edx
cmp edi, 0x20
jle 0x41bb42
mov dword [ebp - 4], 0x20
nop dword [eax]
push dword [ebx + 8]
mov ecx, edi
push esi
call fcn.0041c180
mov edx, dword [ebp - 4]
add esp, 8
lea eax, [edx*4]
mov dword [ebp - 4], eax
cmp eax, edi
jl 0x41bb20
mov dword [ebp - 4], edx
lea eax, [edx*4]
cmp eax, edi
jne 0x41bc44
xor ecx, ecx
test edx, edx
jle 0x41bca5
lea eax, [edx + edx*2]
lea edi, [esi + eax*8]
lea eax, [esi + edx*8]
mov dword [ebp - 0xc], eax
mov eax, edx
shl eax, 4
add eax, esi
nop
mov edx, dword [ebp - 0xc]
movsd xmm3, qword [esi + ecx*8]
movsd xmm6, qword [eax]
movsd xmm5, qword [esi + ecx*8 + 8]
movsd xmm7, qword [edx]
movsd xmm2, qword [edx + 8]
addsd xmm7, xmm3
subsd xmm3, qword [edx]
xorps xmm5, xmmword [0x44cb90]
movsd xmm4, qword [eax + 8]
subsd xmm5, xmm2
subsd xmm2, qword [esi + ecx*8 + 8]
movsd qword [ebp - 0x10], xmm3
movaps xmm3, xmm6
addsd xmm3, qword [edi]
subsd xmm6, qword [edi]
movsd qword [ebp - 0x18], xmm2
movaps xmm2, xmm4
addsd xmm2, qword [edi + 8]
subsd xmm4, qword [edi + 8]
movaps xmm0, xmm3
addsd xmm0, xmm7
subsd xmm7, xmm3
movsd qword [esi + ecx*8], xmm0
movaps xmm0, xmm5
subsd xmm0, xmm2
addsd xmm2, xmm5
movsd qword [esi + ecx*8 + 8], xmm0
add ecx, 2
movsd xmm0, qword [ebp - 0x10]
subsd xmm0, xmm4
movsd qword [eax], xmm7
addsd xmm4, qword [ebp - 0x10]
movsd qword [eax + 8], xmm2
add eax, 0x10
movsd qword [edx], xmm0
movsd xmm0, qword [ebp - 0x18]
subsd xmm0, xmm6
addsd xmm6, qword [ebp - 0x18]
movsd qword [edx + 8], xmm0
add edx, 0x10
movsd qword [edi], xmm4
movsd qword [edi + 8], xmm6
add edi, 0x10
mov dword [ebp - 0xc], edx
cmp ecx, dword [ebp - 4]
jl 0x41bb70
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
test edx, edx
jle 0x41bca5
movsd xmm5, qword [0x44cb90]
lea ecx, [esi + edx*8]
nop word [eax + eax]
movsd xmm3, qword [esi + eax*8]
movsd xmm0, qword [esi + eax*8 + 8]
movaps xmm4, xmm3
addsd xmm3, qword [ecx]
movsd xmm2, qword [ecx + 8]
subsd xmm4, qword [ecx]
subsd xmm2, xmm0
xorps xmm0, xmm5
movsd qword [esi + eax*8], xmm3
subsd xmm0, qword [ecx + 8]
movsd qword [esi + eax*8 + 8], xmm0
add eax, 2
movsd qword [ecx], xmm4
movsd qword [ecx + 8], xmm2
add ecx, 0x10
cmp eax, edx
jl 0x41bc60
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x41d230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, edx
mov edi, ecx
mov edx, 2
mov dword [ebp - 4], edx
cmp edi, 8
jle 0x41d292
push dword [ebp + 8]
mov edx, esi
call fcn.0041d3f0
add esp, 4
mov edx, 8
mov dword [ebp - 4], edx
cmp edi, 0x20
jle 0x41d292
mov dword [ebp - 4], 0x20
nop word [eax + eax]
push dword [ebp + 8]
mov ecx, edi
push esi
call fcn.0041d8b0
mov edx, dword [ebp - 4]
add esp, 8
lea eax, [edx*4]
mov dword [ebp - 4], eax
cmp eax, edi
jl 0x41d270
mov dword [ebp - 4], edx
lea eax, [edx*4]
cmp eax, edi
jne 0x41d391
xor ecx, ecx
test edx, edx
jle 0x41d3e7
lea eax, [edx + edx*2]
lea eax, [esi + eax*4]
mov dword [ebp - 0xc], eax
lea edi, [esi + edx*4]
lea eax, [esi + edx*8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
movss xmm3, dword [esi + ecx*4]
movss xmm7, dword [edi]
mov edx, dword [ebp - 8]
addss xmm7, xmm3
subss xmm3, dword [edi]
movss xmm5, dword [esi + ecx*4 + 4]
movss xmm2, dword [edi + 4]
movss xmm6, dword [edx]
xorps xmm5, xmmword [0x44cba0]
movss xmm4, dword [edx + 4]
subss xmm5, xmm2
subss xmm2, dword [esi + ecx*4 + 4]
movss dword [ebp - 0xc], xmm3
movaps xmm3, xmm6
addss xmm3, dword [eax]
subss xmm6, dword [eax]
movss dword [ebp - 0x10], xmm2
movaps xmm2, xmm4
addss xmm2, dword [eax + 4]
subss xmm4, dword [eax + 4]
movaps xmm0, xmm3
addss xmm0, xmm7
subss xmm7, xmm3
movss dword [esi + ecx*4], xmm0
movaps xmm0, xmm5
subss xmm0, xmm2
addss xmm2, xmm5
movss dword [esi + ecx*4 + 4], xmm0
add ecx, 2
movss xmm0, dword [ebp - 0xc]
subss xmm0, xmm4
movss dword [edx], xmm7
addss xmm4, dword [ebp - 0xc]
movss dword [edx + 4], xmm2
add edx, 8
mov dword [ebp - 8], edx
movss dword [edi], xmm0
movss xmm0, dword [ebp - 0x10]
subss xmm0, xmm6
addss xmm6, dword [ebp - 0x10]
movss dword [edi + 4], xmm0
add edi, 8
movss dword [eax], xmm4
movss dword [eax + 4], xmm6
add eax, 8
cmp ecx, dword [ebp - 4]
jl 0x41d2c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
test edx, edx
jle 0x41d3e7
movss xmm5, dword [0x44cba0]
lea ecx, [esi + edx*4]
movss xmm3, dword [esi + eax*4]
movss xmm0, dword [esi + eax*4 + 4]
movaps xmm4, xmm3
addss xmm3, dword [ecx]
movss xmm2, dword [ecx + 4]
subss xmm4, dword [ecx]
subss xmm2, xmm0
xorps xmm0, xmm5
movss dword [esi + eax*4], xmm3
subss xmm0, dword [ecx + 4]
movss dword [esi + eax*4 + 4], xmm0
add eax, 2
movss dword [ecx], xmm4
movss dword [ecx + 4], xmm2
add ecx, 8
cmp eax, edx
jl 0x41d3a2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4204a0
Capabilities:
Terminate process

Disassembly:
call fcn.00421510
cmp byte [0x873571], 0
je 0x4204c7
push dword [0x8735c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x454b20
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push dword [0x454ae8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x421510
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
cmp byte [0x873572], 0
push esi
je 0x4216b9
mov ecx, dword [0x456da0]
xor esi, esi
push edi
test ecx, ecx
jle 0x42155f
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
nop word [eax + eax]
mov eax, dword [esi*4 + 0x456e24]
test eax, eax
je 0x42155a
push 0
push 0
push 0x10
push eax
call edi
mov ecx, dword [0x456da0]
inc esi
cmp esi, ecx
jl 0x421540
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
jle 0x4216ae
mov esi, 0x455da0
mov dword [ebp - 8], esi
push ebx
mov ebx, dword [eax*4 + 0x456da4]
xorps xmm0, xmm0
push ecx
mov dword [esp], 0
push 0
push 0
push 0
mov byte [ebp - 0x24], 0
movups xmmword [ebp - 0x23], xmm0
mov word [ebp - 0xb], 0
movq qword [ebp - 0x13], xmm0
mov byte [ebp - 9], 0
mov eax, dword [ebx + 4]
push 0x48
push ebx
call eax
add esp, 0x14
lea eax, [ebp - 0x24]
mov dword [esp], 0
push eax
mov eax, dword [ebx + 4]
push 0
push 0
push 5
push ebx
call eax
add esp, 0x18
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ecx + 0x455b98]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x226], ax
test ax, ax
jne 0x4215d0
mov edx, esi
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4215f0
lea edi, [ebp - 0x224]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x421606
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421630
sub ecx, edx
xor eax, eax
sar ecx, 1
push eax
mov word [ebp + ecx*2 - 0x22c], ax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebp - 0x224]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x421660
mov ecx, 6
lea eax, [ebp - 0x24]
mov esi, str.current.tmp
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
movsw word es:[edi], word [esi]
call fcn.00421c90
mov eax, dword [ebp - 4]
add esp, 0xc
mov esi, dword [ebp - 8]
inc eax
add esi, 0x100
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
cmp eax, dword [0x456da0]
jl 0x421575
pop ebx
mov dword [0x456da0], 0
pop edi
push dword [0x557544]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [0x557540]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x55753c]
call esi
push dword [0x557538]
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x425320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push 1
lea eax, [ebx + 3]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebx + 2]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebx + 1]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43282d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004324ed
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x5bcf02b3
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x51797504
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401451
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147f
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x40149a
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ee
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ee
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f2
xor eax, eax
jmp 0x401504
cmp dword [ebp - 4], edi
je 0x401501
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x401944
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
xor esi, esi
call edi
test eax, eax
jbe 0x40197b
push ebx
mov ebx, ebp
sub ebx, str.svchost.exe
mov al, byte [ebx + esi + str.svchost.exe]
push ebp
xor al, 1
mov byte [esi + str.svchost.exe], al
inc esi
call edi
cmp esi, eax
jb 0x401963
pop ebx
and byte [esi + str.svchost.exe], 0
pop edi
pop esi
mov eax, str.svchost.exe
pop ebp
ret

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
fcomp qword [ebx]
push 0x2abacb3f
aas
add dword [ecx], esi
push edi
xor dword [ecx + edi*4], 0xaeca7e23
mov ebx, 0xd6544000
aam 0x63
scasb al, byte es:[edi]
ror dword [ecx], 0xf6
pop ebp
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
mov ebp, 0xd4c5f8b4
xor byte [edi - 0x40], bh
xor eax, 0x77d2ee39
push ecx
push esp
fmul qword ss:[ebx]
cmp byte [esi], 0xcb
add esi, edx
inc esp
mov dword [edi + 0x613479c1], ebp
jge 0x4153c1
mov ss, word [ebp + 0xe]
xor dword [ecx + ebp*8], 0x7e
mov al, 0x75
push ecx
salc
nop
retf
Function at 0x10010020
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004e70d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x80
mov eax, dword [0x10062040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push 0x44
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.1002fd00
mov ecx, dword [0x10064598]
lea eax, [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x30], 0x5b
xorps xmm0, xmm0
movups xmmword [ebp - 0x88], xmm0
push eax
call fcn.10010700
push eax
lea ecx, [ebp - 0x2c]
call fcn.10011440
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.10011260
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
cmp eax, 1
jb 0x100100d5
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
mov word [ecx + eax], 0x22
jmp 0x100100f3
push 1
push 0x100596f0
mov byte [ebp - 0x8d], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x8d]
push 1
call fcn.10012570
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10010151
push edi
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x84]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x88]
call esi
mov byte [ebp - 0x89], 1
jmp 0x10010158
mov byte [ebp - 0x89], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x10010188
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001017e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100101ac
push ecx
push edx
call fcn.1002e314
add esp, 8
mov al, byte [ebp - 0x89]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002dfbc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1003396b
int3
Function at 0x100101c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x10062040]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
call fcn.10011f90
mov ecx, dword [0x10064598]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x9a
lea ecx, [ecx + 8]
call fcn.100105a0
mov esi, eax
cmp dword [esi + 0x10], 1
jbe 0x100102a4
mov ecx, dword [0x10064598]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x9c
lea ecx, [ecx + 8]
call fcn.100105a0
mov ecx, dword [0x10064598]
mov edi, eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9b
push eax
lea ecx, [ecx + 8]
call fcn.100105a0
cmp dword [eax + 0x14], 7
jbe 0x1001024e
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 2
push 0
push 0
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100102a4
cmp dword [edi + 0x14], 7
mov eax, dword [edi + 0x10]
lea eax, [eax*2 + 2]
jbe 0x10010281
mov edi, dword [edi]
cmp dword [esi + 0x14], 7
jbe 0x10010289
mov esi, dword [esi]
push eax
push edi
push 1
push 0
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x10064598]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x59
call fcn.10010700
cmp dword [eax + 0x10], 1
jbe 0x100102ce
mov edx, 0x2710
mov ecx, eax
call fcn.10010020
mov ecx, dword [0x10064598]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x5a
call fcn.10010700
cmp dword [eax + 0x10], 1
jbe 0x100102f8
mov edx, 0x2710
mov ecx, eax
call fcn.10010020
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001030b
push 1
push eax
call fcn.1002e314
add esp, 8
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002dfbc
mov esp, ebp
pop ebp
ret
Function at 0x1002d935
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.1003940f
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x1002d974
sub eax, 1
je 0x1002d96f
sub eax, 1
je 0x1002d96b
xor eax, eax
leave
ret
push 3
jmp 0x1002d976
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x1003c4b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1003c4f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003c4f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003c4f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1003c4f7
cmp dword [ecx + 0x74], 0xe
jbe 0x1003c4f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100418b6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10055d08
push 0x10055d00
push str.FlsAlloc
push 0x1f
call fcn.10041721
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100418ea
push dword [ebp + 8]
mov ecx, esi
call dword [0x10051164]
call esi
jmp 0x100418f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10041934
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10055d18
push 0x10055d10
push str.FlsGetValue
push 0x21
call fcn.10041721
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004196b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10051164]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10041973
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10055d20
push 0x10055d18
push str.FlsSetValue
push 0x22
call fcn.10041721
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100419ad
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10051164]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1004445b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100444f8
push ebx
push esi
call fcn.10044424
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10042b98
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100444a5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100444f7
push edi
push eax
call fcn.1003f266
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100444c5
call fcn.1003f22c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100444f6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10042b98
add esp, 0x20
test eax, eax
jne 0x100444e4
push edi
call fcn.1003f22c
jmp 0x100444ec
push ebx
call fcn.1003f22c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100444fb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1004450c
pop esi
ret
push ebx
push edi
push esi
call fcn.10044424
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003f266
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10044534
push ebx
push esi
push edi
call fcn.1002f780
add esp, 0xc
push 0
call fcn.1003f22c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10044904
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10044549

Function at 0x10046e52
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1003d87c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10046ec1
cmp esi, dword [ebp - 4]
je 0x10046ebc
cmp dword [ebp + 0xc], 0
je 0x10046ebc
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10046e99
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100469a4
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10046ec3
xor eax, eax
inc eax
jmp 0x10046ec3
xor eax, eax
pop edi
pop esi
leave
ret