joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008d2e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e384
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x58a1
mov dword [ebp - 0x2c], str.whwpvgg_jyuvzp_amtdly_ezxvcml_mejjx_nqjzibpof_dbvq_vgsu_geur_fihxbhxbk_klstcnuas_fdo_vgiswmdi_foltai
cmp dword [ebp - 0x24], 0x5c01
jle 0x10008e1d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
and dword [ebp - 0x14], 0
jmp 0x10008d80
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1ab7
jge 0x10008e1d
and dword [ebp - 0x18], 0
jmp 0x10008d9a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2f54
jge 0x10008e18
and dword [ebp - 0x1c], 0
jmp 0x10008db0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6246
jge 0x10008e13
and dword [ebp - 0x20], 0
jmp 0x10008dc6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3bc2
jge 0x10008e11
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
shl eax, cl
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.10001b3f
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1000fdc8
push eax
call fcn.10047293
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.1000fdbe
jmp 0x10008dbf
jmp 0x10008da9
jmp 0x10008d93
jmp 0x10008d79
push 0x71d0
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x5bec
call fcn.10008e87
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x56a8
jge 0x10008e50
push dword [ebp - 0x2c]
call fcn.10047293
pop ecx
jmp 0x10008e6c
or dword [ebp - 4], 0xffffffff
jmp 0x10008e76
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008ffb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e38e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10009110
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x4136
mov dword [ebp - 0x28], str.mmpcyngyw_utzc_azuyyn_svsxrmvq_rjw_xiwkqlin_cht_oixmuql_umny_xwmiknuv_spnc
cmp dword [ebp - 0x1c], 0x4212
jle 0x100090c0
and dword [ebp - 0x14], 0
jmp 0x10009053
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x191a
jge 0x100090af
and dword [ebp - 0x18], 0
jmp 0x10009069
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5986
jge 0x100090ad
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10001b3f
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.1000fdc8
push eax
call fcn.10047293
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1000fdbe
jmp 0x10009062
jmp 0x1000904c
push 0xa19
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0x16a
push dword [ebp - 0x24]
call fcn.1000c28e
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3db3
jge 0x100090e8
push dword [ebp - 0x28]
call fcn.10047293
pop ecx
jmp 0x10009104
or dword [ebp - 4], 0xffffffff
jmp 0x1000910e
jmp 0x10009176
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1000914a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10009148
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x10009176
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10009176
push 0x14c2
push 1
push 0x40cb
push 1
call fcn.10004a00
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100096c6
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000972f
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100096f4
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1000972a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000972a
push 1
push 0x5a2
push 0
push 0x1a0d
push 0x9e
push 0x7ca8
call fcn.10008f44
add esp, 0x18
jmp 0x100097d8
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000979b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000977f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10009799
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.10010144
or dword [eax], 0xffffffff
jmp 0x10009774
jmp 0x100097d8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100097d8
push 1
push 0x70fe
push 0x480f
push 0x33d0
push 0x4167
push 1
push 0x15b9
push 0
call fcn.1000b32d
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x10013fb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1005e729
call fcn.1005dc80
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x18], 0x4cf7
mov ebx, edx
cmp dword [ebp - 0x18], 0x5040
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jle 0x1001404b
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [eax + ebx]
lea eax, [edi + esi]
shl eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001b3f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10014004
mov eax, dword [eax]
push eax
call fcn.10047293
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1001084f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x2771
jl 0x10013fe7
inc ebx
cmp ebx, 0x2cc2
jl 0x10013fe2
inc edi
cmp edi, 0x224f
jl 0x10013fe0
inc esi
cmp esi, 0x4aea
jl 0x10013fde
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 0x4c4b
jge 0x1001405f
push str.jvqngvrun_bsxst_mpjvluf_jllkjl
call fcn.10047293
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x10014114
mov dword [ebp - 0x14], 0x7bea
cmp dword [ebp - 0x14], 0x7d4d
jle 0x100140b6
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x6049
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10079ad8
cdq
push edx
push eax
call fcn.1000fde8
add ebx, edi
dec dword [ebp - 0x18]
jne 0x1001408a
inc edi
cmp edi, 0x43f2
jl 0x10014081
inc esi
cmp esi, 0x3344
jl 0x1001407f
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x7b8e
jge 0x100140d5
mov edx, str.qkz_tdwip_yyhw_imxtdo_prtpma_msd_ygttfdm_hisjg_ynyy
mov ecx, 0x10079ad8
call fcn.10012b8c
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10014116
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x10c93b4e
inc dword [edx]
cmp dword [edx], 3
jl 0x100140e6
jmp 0x10014116
dec dword [ebx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100159e3
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x1005e79d
call fcn.1005dc80
sub esp, 0x38
mov byte [ebp - 0x14], 1
push ebx
push esi
push edi
test cl, cl
je 0x10015b10
cmp byte [ebp + 8], 0
je 0x10015afe
mov dword [ebp - 0x20], 0x6fa9
cmp dword [ebp - 0x20], 0x7346
push 0
pop esi
jle 0x10015a89
call dword [sym.imp.USER32.dll_CreateMenu]
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov dword [ebp - 0x24], edi
mov ebx, edi
mov edi, esi
sar ebx, cl
mov eax, ebx
lea ecx, [ebp - 0x40]
and eax, edi
cdq
push edx
push eax
call fcn.10001b3f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10015a50
mov eax, dword [eax]
push eax
call fcn.10047293
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.1001084f
inc edi
cmp edi, 0x4d92
jl 0x10015a37
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x291d
jl 0x10015a2c
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x4734
jl 0x10015a27
cmp dword [ebp - 0x20], 0x6d68
jge 0x10015a9d
push str.drcnlwhc_zectyri_csz
call fcn.10047293
pop ecx
mov edi, dword [ebp + 0x28]
xor ecx, ecx
mov ebx, dword [ebp + 0x24]
mov eax, dword [edi]
mov edx, dword [eax]
mov eax, dword [ebx]
inc eax
imul eax, edx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 1
setl al
cmp eax, edx
jge 0x10015ac4
test edx, edx
je 0x10015ac7
xor esi, esi
inc esi
xor eax, eax
cmp esi, edx
setle al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x14]
sete cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [eax]
mov ecx, dword [edi]
cmp eax, dword [ecx]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
setl dl
mov dword [eax], edx
mov eax, dword [ebx]
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10015b21
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x10015b21
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10015b21
mov eax, dword [ebp + 0x30]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x34]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x364d64ea
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100172a3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e81b
call fcn.1005dc80
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], 1
mov esi, edx
mov dword [ebp - 0x20], 0x6eb6
cmp dword [ebp - 0x20], 0x7290
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ecx
jle 0x10017324
xor edi, edi
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x18], 0x609f
xor ebx, ebx
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10079ad8
xor eax, esi
cdq
push edx
push eax
call fcn.1000fde8
inc edi
cmp edi, 0x42f8
jl 0x100172e4
inc ebx
cmp ebx, 0xee6
jl 0x100172e2
mov edi, dword [ebp - 0x1c]
add esi, edi
dec dword [ebp - 0x18]
jne 0x100172e0
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x9af
jl 0x100172d7
mov esi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x6d7e
jge 0x1001735f
mov edx, str.bltlm_jhor_epkj_bpst_gvilxbhk_mmihareyq_bhfei
mov ecx, 0x10079ad8
call fcn.10012b8c
jmp 0x1001735f
mov edx, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x28]
mov edi, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x10017391
mov ecx, dword [ebx]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [esi]
mov eax, dword [ebx]
mov eax, dword [edx]
xor edx, edx
mov ecx, dword [esi]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp dword [eax + ecx*4], 0xfffffffa
mov eax, dword [edi]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [edi], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017c19
Capabilities:
Encode data using xor
Suspend thread

Disassembly:
mov eax, 0x1005e843
call fcn.1005dc80
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10017d13
cmp byte [ebp + 0x14], 0
je 0x10017d04
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10017c63
push 0
push 0x567f
push 0x54e0
push 1
mov dl, 1
mov ecx, 0x40d1
call fcn.100154fe
add esp, 0x10
mov dword [ebp - 0x1c], 0x5334
cmp dword [ebp - 0x1c], 0x558c
jle 0x10017ccc
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x20], eax
mov esi, eax
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x10079ad8
xor eax, esi
cdq
push edx
push eax
call fcn.1000fde8
inc edi
cmp edi, 0x7d4d
jl 0x10017c8a
inc ebx
cmp ebx, 0x54e4
jl 0x10017c88
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0xe50
jl 0x10017c7d
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x260f
jl 0x10017c78
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5200
jge 0x10017ce8
mov edx, str.xete_apbr_dhftfxjbd_yzr_equwf_ezqjgqm_xrm
mov ecx, 0x10079ad8
call fcn.10012b8c
jmp 0x10017d26
cmp byte [edx], 0
je 0x10017d26
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10017d26
cmp byte [ebp + 0x18], 0
je 0x10017d20
mov eax, dword [ebp + 0xc]
dec dword [eax]
jmp 0x10017d26
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017e61
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov ebx, edx
je 0x10017ea1
cmp byte [ebp + 8], 0
je 0x10017e89
cmp byte [ecx], 0
je 0x10017eea
push 0x157d
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x10017eea
push 0x798
xor esi, esi
push esi
push esi
push esi
push esi
push 0x1e44
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10017eea
cmp byte [ebp + 0xc], 0
je 0x10017eba
mov byte [ebp + 0x1b], 0
cmp byte [ebp + 0x1b], 0
je 0x10017eea
xor cl, cl
call fcn.1001588b
jmp 0x10017eea
mov edi, dword [ebp + 0x14]
xor esi, esi
mov dword [edi], esi
jmp 0x10017ee5
push dword [ebp + 0x10]
mov dword [ebp - 4], 0x720
lea ecx, [ebp - 4]
push esi
push edi
push 0x60f9
mov edx, ebx
call fcn.10016d16
mov eax, dword [ebx]
add esp, 0x10
dec dword [edi]
cmp dword [edi], 0xffffffee
jle 0x10017ec3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002008b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005eca1
call fcn.1005dc80
sub esp, 0xc
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
je 0x100200bd
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
mov esi, dword [eax]
mov ecx, dword [ecx]
mov eax, dword [ecx + edx*4]
mov dword [ecx + esi*4], eax
jmp 0x1002015c
mov dword [ebp - 0x14], 0x3cb
cmp dword [ebp - 0x14], 0x59b
jle 0x10020104
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10079ad8
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000fde8
inc ebx
cmp ebx, 0x5497
jl 0x100200d3
inc edi
cmp edi, 0x1af1
jl 0x100200d1
inc esi
cmp esi, 0x770e
jl 0x100200cf
mov ebx, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x1f6
jge 0x1002013f
mov edx, str.nyd_qupcqx_lsrdp_gehzq_nsd_bfuzjutjy_vloozrpoh_hwkyinxoe
mov ecx, 0x10079ad8
call fcn.10012b8c
jmp 0x1002013f
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10020157
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 1
jl 0x1002014a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020775
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1005ecbd
call fcn.1005dc80
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x18], 0x1e6e
cmp dword [ebp - 0x18], 0x201c
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
jle 0x100207d8
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x10079ad8
and eax, edi
cdq
push edx
push eax
call fcn.1000fde8
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x4500
jl 0x100207a4
inc ebx
cmp ebx, 0x6af3
jl 0x1002079f
inc edi
cmp edi, 0xb60
jl 0x1002079d
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1dd8
jge 0x100207f4
mov edx, str.jsrtktq_netofi_ycjwu
mov ecx, 0x10079ad8
call fcn.10012b8c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x100208fe
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0
je 0x100208c8
mov dword [ebp - 0x1c], 0x2e74
cmp dword [ebp - 0x1c], 0x2f2e
jle 0x1002087f
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x28], 0
mov ecx, ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edi
shl edi, cl
mov eax, edi
mov ecx, 0x10079ad8
and eax, ebx
cdq
push edx
push eax
call fcn.1000fde8
inc ebx
cmp ebx, 0x55bf
jl 0x10020836
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x4bbc
jl 0x10020828
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x7027
jl 0x10020823
push 0xa19
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x4f45
push 0x3ef
push 0x4aa0
push 1
push 0x6ee8
push 0x3c7c
mov edx, 0x2d31
xor cl, cl
call fcn.1002007b
add esp, 0x18
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x2a8e
jge 0x100208c8
mov edx, str.iymreehs_ersjgw_iivrysihh_ebwnt
mov ecx, 0x10079ad8
call fcn.10012b8c
jmp 0x10020903
mov eax, dword [ebp + 8]
dec dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100213f4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1002140b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x1002142d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10141114
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x101414a0
jl 0x1002143b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10141744
jl 0x1002147b
mov ecx, dword [0x10142490]
xor ecx, dword [0x10141114]
and ecx, edi
xor ecx, dword [0x10142490]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10141110], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10141744]
mov dword [0x10141ad0], eax
pop esi
ret
Function at 0x10023d0b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [esp + 0x24], ecx
je 0x10023e00
mov dword [esp + 0x1c], 0x1b86
cmp dword [esp + 0x1c], 0x1e42
jle 0x10023dd6
xor esi, esi
mov edi, esi
mov dword [esp + 0x18], esi
mov ebx, esi
mov dword [esp + 0x14], esi
mov eax, edi
mov ecx, esi
cdq
idiv ebx
mov dword [esp + 0x10], ecx
mov eax, edx
mov dword [esp + 0x20], eax
cdq
mov ebx, 0x4169
idiv ecx
mov edi, edx
mov eax, edi
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001b3f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023d7c
mov eax, dword [eax]
push eax
call fcn.10047293
pop ecx
push esi
push 1
lea ecx, [esp + 0x30]
call fcn.1001084f
dec edi
dec ebx
jne 0x10023d64
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x69dc
jl 0x10023d5a
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x14], ebx
cmp ebx, 0x2f14
jl 0x10023d49
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x2e4
jl 0x10023d43
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x24]
mov edx, dword [eax]
mov esi, dword [eax]
cmp dword [esp + 0x1c], 0x1b78
mov ecx, dword [ecx]
mov eax, dword [ecx + edx*4]
mov dword [ecx + esi*4], eax
jge 0x10023e0a
push str.hzfnun_foatsbik_oeq_xuandw_bgefpky_bgrplzrbc_naet
call fcn.10047293
pop ecx
jmp 0x10023e0a
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_Beep]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002427f
Capabilities:
Get disk information
Identify system language via api

Disassembly:
mov eax, 0x1005ee74
call fcn.1005dc80
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], 0x34a5
cmp dword [ebp - 0x1c], 0x37db
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
jle 0x10024306
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
lea eax, [edi + esi]
mov edi, 0x20ac
mov dword [ebp - 0x20], eax
mov esi, eax
mov eax, esi
mov ecx, 0x10079ad8
or eax, ebx
cdq
push edx
push eax
call fcn.1000fde8
dec esi
dec edi
jne 0x100242c4
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x123b
jl 0x100242b7
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x78d8
jl 0x100242b2
inc ebx
cmp ebx, 0x73fe
jl 0x100242ad
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x31c5
jge 0x10024322
mov edx, str.qngplxvdo_ymnqmep_viwv_ryffcj_gpuvhynwq_ztiq_grfirmzq_jfwehnmy_fbjptidu_ktscttix_ztfxvofvd_acrleelgg_crxmja
mov ecx, 0x10079ad8
call fcn.10012b8c
cmp byte [ebp + 0xc], 0
je 0x1002436b
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100243d0
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 8
inc dword [edx]
cmp dword [edx], 3
jl 0x1002433d
jmp 0x100243d0
mov esi, dword [ebp + 0x1c]
mov dword [esi], 0
cmp dword [esi], 0xffffffee
jg 0x100243d0
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x14], 0x720
cmp dword [ebp - 0x14], 0
je 0x10024391
mov eax, dword [ebp - 0x14]
mov eax, dword [esi]
mov eax, dword [esi]
xor edx, edx
mov dword [ebx], 0xfffffffb
mov eax, dword [esi]
imul ecx, eax, 0xfffffffb
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, 0xd2e8
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
setne dl
sub edx, eax
mov eax, dword [esi]
add eax, edx
mov dword [edi], eax
mov eax, dword [ebx]
dec dword [esi]
cmp dword [esi], 0xffffffee
jle 0x1002437f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret