joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ec1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10008ed0
pop dword [ebp - 0x18]
mov eax, 0x10008ed0
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x14ec9c0d
add dword [ebp - 0x28], 0x3965a93e
mov dword [ebp - 0x24], 0x40ccbba
sub dword [ebp - 0x24], 0xd1d97f75
mov dword [ebp - 0x20], 0x7a6a33b6
add dword [ebp - 0x20], 0xd1e21078
mov dword [ebp - 0x1c], 0x776501d8
sub dword [ebp - 0x1c], 0x776501d8
lea eax, [ebp - 0x28]
push eax
mov eax, 0x347fc42f
add eax, 0xdb821c21
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x9f2d2d01
sub dword [ebp - 0x28], 0x2abac3ab
mov dword [ebp - 0x24], 0x8c87afb2
sub dword [ebp - 0x24], 0x4b1b4e3d
mov dword [ebp - 0x20], 0x300727f7
add dword [ebp - 0x20], 0x33684475
mov dword [ebp - 0x1c], 0x711ab620
add dword [ebp - 0x1c], 0x8ee549e0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x7c5b7743
sub eax, 0x6c599713
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4bc
push 0
call eax
mov ecx, 0xf65b9bb1
sub ecx, 0xf65b5b77
xor ebx, ebx
add ebx, eax
mov edi, 0xb7e83af0
add edi, 0x581aa110
add edi, dword [ebp - 0x18]
mov edx, 0xad16f565
add dword [ebp - 0x14], edi
mov esi, dword [edi]
add dword [ebp - 0x10], 0xad5b58ad
xor esi, edx
add dword [ebp - 4], ebx
mov dword [ebx], esi
sub dword [ebp - 8], eax
add ebx, 0xc8b03e72
sub ebx, 0xc8b03e6e
add edi, 0x1a5c7b74
sub edi, 0x1a5c7b70
loop 0x10008fe9
add eax, 0xf3bb
xor ebx, ebx
add ebx, eax
add eax, 0x74c6943b
add eax, 0x8b396bca
mov ecx, 0xc3853033
sub ecx, 0xb3853033
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x402b00
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x461040], 0x8088405
inc edx
mov dword [0x461040], edx
mul edx
mov eax, edx
ret

Function at 0x417408
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41740e
ret

Function at 0x44f4b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], al
xor eax, eax
mov al, byte [ebp - 1]
xor eax, dword [0x4629b4]
and eax, 0xff
mov edx, dword [0x460b20]
mov eax, dword [edx + eax*4]
mov edx, dword [0x4629b4]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [0x4629b4], eax
mov eax, dword [0x4629b4]
and eax, 0xff
add dword [0x4629b8], eax
imul eax, dword [0x4629b8], 0x8088405
inc eax
mov dword [0x4629b8], eax
mov eax, dword [0x4629b8]
shr eax, 0x18
xor eax, dword [0x4629bc]
and eax, 0xff
mov edx, dword [0x460b20]
mov eax, dword [edx + eax*4]
mov edx, dword [0x4629bc]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [0x4629bc], eax
pop ecx
pop ebp
ret

Function at 0x44f60c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
jle 0x44f648
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
call fcn.0044f5d8
mov edx, dword [ebp - 4]
xor byte [edx], al
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0044f4b0
inc dword [ebp - 4]
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x44f629
mov esp, ebp
pop ebp
ret

Function at 0x44f64c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
jle 0x44f694
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 1
call fcn.0044f5d8
and eax, 0xff
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0044f4b0
mov al, byte [ebp - 0xe]
mov edx, dword [ebp - 4]
xor byte [edx], al
inc dword [ebp - 4]
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x44f669
mov esp, ebp
pop ebp
ret
Function at 0x44f6c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.00403edc
xor eax, eax
push ebp
push 0x44f790
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
cmp dword [ebp + 8], 0
je 0x44f77a
mov eax, dword [ebp + 8]
call fcn.0044f53c
test eax, eax
jne 0x44f77a
mov byte [ebp - 0xe], 0
call fcn.0044f5d8
xor edx, edx
mov dl, byte [ebp - 0xe]
mov ecx, dword [ebp - 4]
xor al, byte [ecx + edx + 0xc]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0xf]
call fcn.0044f4b0
xor eax, eax
mov al, byte [ebp - 0xe]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xf]
mov byte [edx + eax], cl
inc byte [ebp - 0xe]
cmp byte [ebp - 0xe], 0xc
jne 0x44f708
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xb]
mov byte [ebp - 0x10], al
mov ax, word [ebp - 6]
and ax, 8
cmp ax, 8
je 0x44f768
mov eax, dword [ebp - 0xc]
call fcn.0040716c
call fcn.00407170
cmp al, byte [ebp - 0x10]
sete byte [ebp - 0xd]
jmp 0x44f77a
xor eax, eax
mov al, byte [ebp - 0x10]
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f797
lea eax, [ebp + 8]
call fcn.00403aa8
ret

Function at 0x453ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x453f0c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
xor eax, edx
and eax, 0xff
mov edx, dword [0x460b5c]
movzx eax, word [edx + eax*2]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shr edx, 8
xor eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
inc dword [ebp - 4]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jg 0x453ed5
mov esp, ebp
pop ebp
ret

Function at 0x4561cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x460880]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x456244
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 8]
dec eax
test al, al
jb 0x45623a
inc eax
mov byte [ebp - 0x15], al
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
xor eax, dword [ebp - 0xc]
and eax, 0xff
mov edx, dword [0x460b20]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0xc]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x14]
inc byte [ebp - 0xd]
dec byte [ebp - 0x15]
jne 0x456207
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45624e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dceb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9a000]
push edi
jmp 0x4dceca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4dced1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcec0
mov eax, 1
add ebx, ebx
jne 0x4dcee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4dcef4
jne 0x4dcf13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcf13
dec eax
add ebx, ebx
jne 0x4dcf00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4dced8
add ebx, ebx
jne 0x4dcf0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4dcf65
xor ecx, ecx
sub eax, 3
jb 0x4dcf2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4dcf9a
sar eax, 1
mov ebp, eax
jmp 0x4dcf36
add ebx, ebx
jne 0x4dcf36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcf04
inc ecx
add ebx, ebx
jne 0x4dcf44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dcf04
add ebx, ebx
jne 0x4dcf51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4dcf46
jne 0x4dcf62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4dcf46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4dcf84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4dcf76
jmp 0x4dcec6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4dcf84
add edi, ecx
jmp 0x4dcec6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4dcfa2
cmp byte [edi], 0x13
jne 0x4dcfa2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4dcfa7
lea edi, [esi + 0xd8000]
mov eax, dword [edi]
or eax, eax
je 0x4dd01f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x107e04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x107f58]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4dcfd4
mov ecx, edi
jns 0x4dd003
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x107f5c]
or eax, eax
je 0x4dd019
mov dword [ebx], eax
add ebx, 4
jmp 0x4dcff1
call dword [esi + 0x107f6c]
mov ebp, dword [esi + 0x107f60]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4dd053
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x494c90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5c000]
push edi
jmp 0x494caa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x494cb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x494ca0
mov eax, 1
add ebx, ebx
jne 0x494cc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x494cd4
jne 0x494cf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x494cf3
dec eax
add ebx, ebx
jne 0x494ce0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x494cb8
add ebx, ebx
jne 0x494cef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x494d45
xor ecx, ecx
sub eax, 3
jb 0x494d0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x494d7a
sar eax, 1
mov ebp, eax
jmp 0x494d16
add ebx, ebx
jne 0x494d16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x494ce4
inc ecx
add ebx, ebx
jne 0x494d24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x494ce4
add ebx, ebx
jne 0x494d31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x494d26
jne 0x494d42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x494d26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x494d64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x494d56
jmp 0x494ca6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x494d64
add edi, ecx
jmp 0x494ca6
pop esi
mov edi, esi
mov ecx, 0x2cc0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x494d82
cmp byte [edi], 0x1a
jne 0x494d82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x494d87
lea edi, [esi + 0x91000]
mov eax, dword [edi]
or eax, eax
je 0x494dff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x962a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x963b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x494db4
mov ecx, edi
jns 0x494de3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x963bc]
or eax, eax
je 0x494df9
mov dword [ebx], eax
add ebx, 4
jmp 0x494dd1
call dword [esi + 0x963cc]
mov ebp, dword [esi + 0x963c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x494e33
sub esp, 0xffffff80
jmp 0x454d3d
Function at 0x402540
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 2
add eax, 8
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40256e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x4019a5], eax
ret
Function at 0x10001527
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x100389dc
push eax
call fcn.10031ab2
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10001671
push dword [ebp - 0x78]
jmp 0x10001676
push 0x100389e4
push 0x20
push eax
call fcn.10031ab2
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14
Function at 0x10007dfb
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x10039320
push eax
call fcn.10031ab2
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10007f45
push dword [ebp - 0x78]
jmp 0x10007f4a
push 0x10039328
push 0x20
push eax
call fcn.10031ab2
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14

Function at 0x10008ee6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f34
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10008f45
push 0xd
pop eax
jmp 0x10008f6f
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10008f48
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x1000c26f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10031ab2
mov ebx, eax
cmp ebx, esi
je 0x1000c2e2
lea ecx, [ebp - 0x74]
call fcn.1000135a
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000c2fa
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000c26f
cmp eax, esi
jne 0x1000c32c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000c2ea
lea ecx, [ebp - 0x74]
call fcn.1000135a
push dword [ebp - 0x78]
mov ecx, edi
call fcn.10008dd7
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.1000135a
mov eax, esi
jmp 0x1000c2c8
Function at 0x1000dbda
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0xac], eax
mov eax, dword [ebp + 0xb8]
push esi
mov esi, dword [ebp + 0xbc]
push 0x10039ee8
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.10031ab2
add esp, 0xc
test eax, eax
jne 0x1000dd31
push esi
call fcn.10031ab2
pop ecx
test eax, eax
jne 0x1000dd31
push edi
xor edi, edi
inc edi
jmp 0x1000dd04
cmp dword [ebp - 0x78], 0x4034b50
jne 0x1000dd27
cmp word [ebp - 0x70], 0
jne 0x1000dd27
push dword [ebp - 0x7c]
movzx eax, word [ebp - 0x5e]
movzx esi, word [ebp - 0x5e]
push eax
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.10031ab2
add esp, 0x10
cmp eax, esi
jne 0x1000dd27
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + esi - 0x58], 0
call fcn.10031ab2
cmp word [ebp - 0x5c], 0
pop ecx
jbe 0x1000dc9c
movzx eax, word [ebp - 0x5c]
push edi
push eax
push dword [ebp - 0x7c]
call fcn.1002011f
add esp, 0xc
test eax, eax
jne 0x1000dd27
movzx eax, word [ebp - 0x5e]
cmp byte [ebp + eax - 0x59], 0x2f
je 0x1000dd04
push 0x10039eec
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.10031ab2
add esp, 0xc
test eax, eax
jne 0x1000dd27
push dword [ebp - 0x62]
call fcn.10031ab2
push dword [ebp - 0x7c]
mov esi, eax
push dword [ebp - 0x62]
push edi
push esi
call fcn.10031ab2
add esp, 0x14
cmp eax, dword [ebp - 0x62]
jne 0x1000dd20
push dword [ebp - 0x80]
push dword [ebp - 0x62]
push edi
push esi
call fcn.1002001b
add esp, 0x10
push esi
cmp eax, dword [ebp - 0x62]
jne 0x1000dd21
call fcn.10031ab2
push dword [ebp - 0x80]
call fcn.1001fe50
pop ecx
pop ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push edi
push 0x1e
push eax
call fcn.10031ab2
add esp, 0x10
cmp eax, edi
je 0x1000dc34
jmp 0x1000dd27
push esi
call fcn.10031ab2
pop ecx
push dword [ebp - 0x7c]
call fcn.1001fe50
pop ecx
pop edi
mov ecx, dword [ebp + 0xac]
xor ecx, ebp
pop esi
call fcn.1001d742
add ebp, 0xb0
leave
ret
Function at 0x1000dd47
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x10d0]
mov eax, 0x1150
call fcn.1001e5c0
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x10cc], eax
mov eax, dword [ebp + 0x10d8]
push ebx
push esi
push edi
mov esi, 0x7ff
xor edi, edi
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x8cd]
push edi
push eax
mov dword [ebp - 0x78], edi
mov byte [ebp + 0x8cc], 0
call fcn.1001d760
push esi
lea eax, [ebp + 0xcd]
push edi
push eax
mov byte [ebp + 0xcc], 0
call fcn.1001d760
inc esi
push str.SOFTWAREMozillaMozilla_Firefox
lea eax, [ebp + 0x8cc]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.10031ab2
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0x24
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x8cc]
push eax
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call edi
test eax, eax
je 0x1000dde3
xor eax, eax
jmp 0x1000decd
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xcc]
push eax
push 0
push 0
push 0x10039f14
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
test eax, eax
je 0x1000de0f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000dddc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xcc]
push eax
lea eax, [ebp + 0x8cc]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x8cc]
push eax
push ebx
call edi
test eax, eax
jne 0x1000dddc
mov ebx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0
push 0
push 0x10039f50
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
test eax, eax
jne 0x1000de07
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000de72
sub eax, esi
cmp byte [eax + ebx - 1], 0x5c
je 0x1000de94
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000de85
mov esi, 0x10039f64
movsw word es:[edi], word [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000de97
mov esi, str.extensions
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x74]
push eax
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x1000dee5
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
je 0x1000dddc
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x10d0
leave
ret
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [ebp - 0x74], 0x10
jmp 0x1000dec4