joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e897e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, 0xfffff6eb
mov dword [0x10223a30], 0
mov dword [0x10223a34], 0
mov dword [0x10223a40], 0
mov dword [0x10223a2c], 0x1814
mov dword [0x10223a28], 0xccf
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x101e8b1e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
mov dword [0x10223a2c], 0x23ff
mov dword [0x10223a28], ecx
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x10223a30], edx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10223a34], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10223a38], cl
mov dword [0x10223a28], 0x1881
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x10223a28]
add edx, 0xffffe5a3
mov dword [0x10223a28], edx
mov cl, byte [0x10223a38]
mov edx, dword [0x10223a34]
mov byte [edi + edx], cl
mov edx, dword [0x10223a30]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10223a34]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x10223a2c]
mov ecx, edx
add ecx, 0xffffe0ab
mov dword [0x10223a2c], ecx
and ebx, 0xff
mov dword [0x10223a40], ebx
add edx, 0xffffef40
mov dword [0x10223a28], edx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov dword [0x10223a2c], 0x24e4
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], ch
mov dword [0x10223a28], 0x3f1
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x101e8b1e
mov eax, 0xffffee0d
mov ecx, dword [0x10223a30]
mov edx, dword [0x10223a34]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
jmp 0x101e89f3
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101e91f1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x10223a28], 0x1e9
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.101e8516
lea ecx, [0x101e8fd3]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], 0x147c00
mov edx, dword [0x10223a14]
mov dword [esp + 0x74], edx
mov edx, dword [0x10223a18]
mov dword [esp + 0x50], edx
mov edx, dword [0x10223a1c]
mov dword [esp + 0x38], edx
mov edx, dword [0x10223a20]
mov dword [esp + 0x88], edx
mov edx, dword [0x10223a24]
mov dword [esp + 0x60], edx
mov dword [0x10223a28], 0x155e
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x101e929e
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
mov dword [0x10223a2c], 0x3430
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x101e927a
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + ecx]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
cmp eax, 0x4550
jne 0x101e927a
mov eax, dword [esp + 0x18]
mov dword [esp + 0x5c], eax
mov dword [0x10223a28], 0x281
mov dword [0x10223a2c], 0xfffff2c0
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x7c], edx
call fcn.101e9a62
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x101e932e
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101e87c3
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x101e9336
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10223a34], 0
mov byte [0x10223a38], 0
mov dword [0x10223a28], 0xa7
mov dword [0x10223a30], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x101e937d
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10223a28]
add eax, 0xfffffa1a
mov dword [0x10223a2c], eax
mov eax, dword [0x10223a30]
add eax, 1
mov dword [0x10223a30], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101e937d
jmp 0x101e946a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x10223a3c], 0
mov dword [0x10223a2c], 0x12e5
mov esi, dword [0x10223a34]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x10223a3c], ebx
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x2c]
idiv ebx
mov dword [0x10223a34], edx
add ecx, 0xfffffdd7
mov dword [0x10223a2c], ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [edi + ecx]
mov byte [0x10223a38], cl
mov dword [0x10223a28], 0xb6f
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x28]
mov byte [edi + edx], cl
mov cl, byte [0x10223a38]
mov edx, dword [0x10223a34]
mov byte [edi + edx], cl
mov edx, dword [0x10223a30]
add edx, 1
mov dword [0x10223a30], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jl 0x101e9490
jmp 0x101e94a3
mov dword [0x10223a28], 0x9af
mov eax, 0x9af
xor ecx, ecx
mov dword [0x10223a30], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x101e93b7
mov eax, dword [0x10223a28]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x101e93b7
mov dword [0x10223a2c], 0x2049
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101e977d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x10223a28], 0x1a9c
mov dword [ebp - 0x10], eax
call fcn.101e8b90
xor ecx, ecx
mov edx, eax
mov dword [0x10223a28], 0x281
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x10223a2c], 0xfffff3f2
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x101e98da
jmp 0x101e980b
mov al, byte [ebp - 0x25]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x2c]
add edx, 1
mov ah, byte [ebp - 0x2d]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x34], edx
jne 0x101e9851
jmp 0x101e987e
mov eax, 0x281
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
xor esi, esi
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + eax*4]
add edx, 0xfffffd5b
mov dword [0x10223a28], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x25], bh
mov byte [ebp - 0x2d], cl
jne 0x101e97e0
mov al, byte [ebp - 0x2d]
test al, 1
jne 0x101e98b7
jmp 0x101e9887
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 2
mov edx, dword [ebp - 0x44]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x24], eax
jb 0x101e9825
jmp 0x101e98da
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x10223a28], 0x94
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101e9a62
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x34
mov dword [0x10223a28], 0x128e
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x10223a28], 0x278
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov ecx, dword [0x10223a2c]
mov edx, ecx
add edx, 0xffffe6f4
add ecx, 0xffffee35
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
jmp 0x101e9b22
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x101e9be7
mov dword [0x10223a28], 0x15d0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x101e9b7f
jmp 0x101e9abd
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff6
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x64
jne 0x101e9abd
mov dword [0x10223a28], 0x16f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x101e9ba1
jmp 0x101e9abd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, dword [ebp - 0x18]
mov esi, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], esi
je 0x101e9b5b
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], eax
jl 0x101e9b22
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [0x10223a28], ecx
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
je 0x101e9ac7
jmp 0x101e9abd
mov dword [0x10223a28], 0x19fd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x101e9ae6
jmp 0x101e9abd
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cmp word [eax], 0x6c
jne 0x101e9abd
mov eax, 1
mov dword [0x10223a2c], 0x1349
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
jne 0x101e9abd
mov eax, dword [ebp - 0x20]
add esp, 0x34
pop esi
pop ebp
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x173e3fd0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x403e77f5
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x48d34c16
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x7a0329bf
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4d913e23
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x60f44f41
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1002e578
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002e5e1
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002e5c6
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002e5c4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x1002e5df
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.10020420
or dword [eax], 0xffffffff
jmp 0x1002e622
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x5521
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x27da
call fcn.1002fe17
add esp, 0x20
mov esp, ebp
pop ebp
ret

Function at 0x1002f2bf
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002f310
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002f2f2
push 0
push 0x1275
call dword [sym.imp.USER32.dll_RemovePropA]
jmp 0x1002f30e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002f30e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1002f328
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x5f65
push dword [ebp - 0x14]
push 0
call fcn.10024f90
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002fbea
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002fc85
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002fc46
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002fc44
push 0x967
push 0x1952
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1002fc83
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002fc83
push 0x789d
push 0
push 0x3e52
push 1
push 0x510c
push 0
push 0x57f5
push 0x4f52
call fcn.100277c2
add esp, 0x20
jmp 0x1002fc93
push 0x6609
push 0
call fcn.1002947d
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10036aa2
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10036ace
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
call fcn.10037516
add esp, 0xc
jmp 0x10036b3e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10036b34
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10036b18
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10036b32
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10020420
or dword [eax], 0xffffffff
jmp 0x10036b0d
jmp 0x10036b3e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret
Function at 0x1003ae33
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003ae6c
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003ae5e
push 0x22d3
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x1003ae6a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1003ae88
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
call fcn.10029185
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1003ae8c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003aecc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push 0x21a9
push 0x6f9b
push 0xfbf
push 0x50b0
call fcn.1003af11
add esp, 0x1c
jmp 0x1003af0d
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003aef1
push 0
push 0x1172
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x1003af0d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1003af0d
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x10042608
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10042634
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push 0x7eec
push dword [ebp - 4]
push 0xb4c
call fcn.10042660
add esp, 0x10
jmp 0x1004265c
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042652
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1004265c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret

Function at 0x10043137
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100431ca
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1004317d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004317b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100431c8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100431ab
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x100431c8
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10020420
mov dword [eax], 0xa6b950ba
jmp 0x100431a0
jmp 0x100431f1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x4335
push 0x279f
push 0x461b
push 1
push 0x4ccd
push dword [ebp - 0x24]
call fcn.10041df7
add esp, 0x18
mov esp, ebp
pop ebp
ret