joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100050e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
mov byte [ebp - 0x1c], 0x42
mov byte [ebp - 0x1b], 0x25
mov byte [ebp - 0x1a], 0x23
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0x2b
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x2d
mov byte [ebp - 0x14], 0x2c
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0x11], 0x27
mov byte [ebp - 0x10], 0x30
mov byte [ebp - 0xf], 0x2d
mov byte [ebp - 0xe], 0x2b
mov byte [ebp - 0xd], 0x26
mov byte [ebp - 0xc], 0x31
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x21
mov byte [ebp - 9], 0x2d
mov byte [ebp - 8], 0x2f
mov byte [ebp - 7], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x10], ecx
mov dx, word [ebp - 8]
mov word [eax + 0x14], dx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x10005180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x40], 0x2e
mov byte [ebp - 0x3f], 1
mov byte [ebp - 0x3e], 0x49
mov byte [ebp - 0x3d], 0x41
mov byte [ebp - 0x3c], 0x5d
mov byte [ebp - 0x3b], 0
mov byte [ebp - 0x3a], 0x5e
mov byte [ebp - 0x39], 0x46
mov byte [ebp - 0x38], 0x5e
mov byte [ebp - 0x37], 0x11
mov byte [ebp - 0x36], 0x4f
mov byte [ebp - 0x35], 0x5e
mov byte [ebp - 0x34], 0x5e
mov byte [ebp - 0x33], 0x13
mov byte [ebp - 0x32], 0x4d
mov byte [ebp - 0x31], 0x41
mov byte [ebp - 0x30], 0x5c
mov byte [ebp - 0x2f], 0x4b
mov byte [ebp - 0x2e], 8
mov byte [ebp - 0x2d], 0x43
mov byte [ebp - 0x2c], 0x41
mov byte [ebp - 0x2b], 0x4a
mov byte [ebp - 0x2a], 0x5b
mov byte [ebp - 0x29], 0x42
mov byte [ebp - 0x28], 0x4b
mov byte [ebp - 0x27], 0x13
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x25], 0x42
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x4c
mov byte [ebp - 0x22], 0x4f
mov byte [ebp - 0x21], 0x42
mov byte [ebp - 0x20], 8
mov byte [ebp - 0x1f], 0x5d
mov byte [ebp - 0x1e], 0x4b
mov byte [ebp - 0x1d], 0x4d
mov byte [ebp - 0x1c], 0x5a
mov byte [ebp - 0x1b], 0x47
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x40
mov byte [ebp - 0x18], 0x13
mov byte [ebp - 0x17], 0x42
mov byte [ebp - 0x16], 0x41
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x40
mov byte [ebp - 0x12], 8
mov byte [ebp - 0x11], 0x4a
mov byte [ebp - 0x10], 0x41
mov byte [ebp - 0xf], 0x13
mov byte [ebp - 0xe], 0x5e
mov byte [ebp - 0xd], 0x5c
mov byte [ebp - 0xc], 0x41
mov byte [ebp - 0xb], 0x4d
mov byte [ebp - 0xa], 0x4b
mov byte [ebp - 9], 0x5d
mov byte [ebp - 8], 0x5d
mov byte [ebp - 7], 0
mov ecx, 0xe
lea esi, [ebp - 0x40]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov byte [ebp - 0x10], 0x28
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xe], 0x5d
mov byte [ebp - 0xd], 0x5c
mov byte [ebp - 0xc], 0x40
mov byte [ebp - 0xb], 0x77
mov byte [ebp - 0xa], 0x43
mov byte [ebp - 9], 0x4d
mov byte [ebp - 8], 0x51
mov byte [ebp - 7], 0x15
mov byte [ebp - 6], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov cx, word [ebp - 8]
mov word [eax + 8], cx
mov dl, byte [ebp - 6]
mov byte [eax + 0xa], dl
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x100053f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov byte [ebp - 0x14], 0x18
mov byte [ebp - 0x13], 0x3e
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0x11], 0x68
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x47
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0x7d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x76
mov byte [ebp - 9], 0x79
mov byte [ebp - 8], 0x75
mov byte [ebp - 7], 0x7d
mov byte [ebp - 6], 0x25
mov byte [ebp - 5], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x100054e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov byte [ebp - 0x14], 0x21
mov byte [ebp - 0x13], 7
mov byte [ebp - 0x12], 0x48
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xf], 0x7e
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 0xd], 0x40
mov byte [ebp - 0xc], 0x52
mov byte [ebp - 0xb], 0x52
mov byte [ebp - 0xa], 0x56
mov byte [ebp - 9], 0x4e
mov byte [ebp - 8], 0x53
mov byte [ebp - 7], 0x45
mov byte [ebp - 6], 0x1c
mov byte [ebp - 5], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x10005550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x37
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x28
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x28
mov byte [ebp - 0xd], 0x27
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x37
mov byte [ebp - 0xa], 8
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov dx, word [ebp - 8]
mov word [eax + 0xc], dx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x100058b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 4
mov byte [ebp - 0x27], 0x41
mov byte [ebp - 0x26], 0x76
mov byte [ebp - 0x25], 0x76
mov byte [ebp - 0x24], 0x6b
mov byte [ebp - 0x23], 0x76
mov byte [ebp - 0x22], 0x24
mov byte [ebp - 0x21], 0x77
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x6a
mov byte [ebp - 0x1e], 0x60
mov byte [ebp - 0x1d], 0x6d
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x24
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x77
mov byte [ebp - 0x16], 0x77
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x24
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x24
mov byte [ebp - 0xe], 0x77
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x76
mov byte [ebp - 8], 0x35
mov byte [ebp - 7], 0
mov ecx, 8
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100059b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x5f
mov byte [ebp - 0x27], 0x1a
mov byte [ebp - 0x26], 0x2d
mov byte [ebp - 0x25], 0x2d
mov byte [ebp - 0x24], 0x30
mov byte [ebp - 0x23], 0x2d
mov byte [ebp - 0x22], 0x7f
mov byte [ebp - 0x21], 0x2c
mov byte [ebp - 0x20], 0x3a
mov byte [ebp - 0x1f], 0x31
mov byte [ebp - 0x1e], 0x3b
mov byte [ebp - 0x1d], 0x36
mov byte [ebp - 0x1c], 0x31
mov byte [ebp - 0x1b], 0x38
mov byte [ebp - 0x1a], 0x7f
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x18], 0x3a
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x2c
mov byte [ebp - 0x15], 0x3e
mov byte [ebp - 0x14], 0x38
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x7f
mov byte [ebp - 0x11], 0x2b
mov byte [ebp - 0x10], 0x30
mov byte [ebp - 0xf], 0x7f
mov byte [ebp - 0xe], 0x2c
mov byte [ebp - 0xd], 0x3a
mov byte [ebp - 0xc], 0x2d
mov byte [ebp - 0xb], 0x29
mov byte [ebp - 0xa], 0x3a
mov byte [ebp - 9], 0x2d
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0
mov ecx, 8
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x7a
mov byte [ebp - 0x27], 0x3f
mov byte [ebp - 0x26], 8
mov byte [ebp - 0x25], 8
mov byte [ebp - 0x24], 0x15
mov byte [ebp - 0x23], 8
mov byte [ebp - 0x22], 0x5a
mov byte [ebp - 0x21], 9
mov byte [ebp - 0x20], 0x1f
mov byte [ebp - 0x1f], 0x14
mov byte [ebp - 0x1e], 0x1e
mov byte [ebp - 0x1d], 0x13
mov byte [ebp - 0x1c], 0x14
mov byte [ebp - 0x1b], 0x1d
mov byte [ebp - 0x1a], 0x5a
mov byte [ebp - 0x19], 0x17
mov byte [ebp - 0x18], 0x1f
mov byte [ebp - 0x17], 9
mov byte [ebp - 0x16], 9
mov byte [ebp - 0x15], 0x1b
mov byte [ebp - 0x14], 0x1d
mov byte [ebp - 0x13], 0x1f
mov byte [ebp - 0x12], 0x5a
mov byte [ebp - 0x11], 0xe
mov byte [ebp - 0x10], 0x15
mov byte [ebp - 0xf], 0x5a
mov byte [ebp - 0xe], 9
mov byte [ebp - 0xd], 0x1f
mov byte [ebp - 0xc], 8
mov byte [ebp - 0xb], 0xc
mov byte [ebp - 0xa], 0x1f
mov byte [ebp - 9], 8
mov byte [ebp - 8], 0x49
mov byte [ebp - 7], 0
mov ecx, 8
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x50], 0x67
mov byte [ebp - 0x4f], 0x24
mov byte [ebp - 0x4e], 8
mov byte [ebp - 0x4d], 9
mov byte [ebp - 0x4c], 0x13
mov byte [ebp - 0x4b], 2
mov byte [ebp - 0x4a], 9
mov byte [ebp - 0x49], 0x13
mov byte [ebp - 0x48], 0x4a
mov byte [ebp - 0x47], 0x33
mov byte [ebp - 0x46], 0x1e
mov byte [ebp - 0x45], 0x17
mov byte [ebp - 0x44], 2
mov byte [ebp - 0x43], 0x5d
mov byte [ebp - 0x42], 0x47
mov byte [ebp - 0x41], 6
mov byte [ebp - 0x40], 0x17
mov byte [ebp - 0x3f], 0x17
mov byte [ebp - 0x3e], 0xb
mov byte [ebp - 0x3d], 0xe
mov byte [ebp - 0x3c], 4
mov byte [ebp - 0x3b], 6
mov byte [ebp - 0x3a], 0x13
mov byte [ebp - 0x39], 0xe
mov byte [ebp - 0x38], 8
mov byte [ebp - 0x37], 9
mov byte [ebp - 0x36], 0x48
mov byte [ebp - 0x35], 0x1f
mov byte [ebp - 0x34], 0x4a
mov byte [ebp - 0x33], 0x10
mov byte [ebp - 0x32], 0x10
mov byte [ebp - 0x31], 0x10
mov byte [ebp - 0x30], 0x4a
mov byte [ebp - 0x2f], 1
mov byte [ebp - 0x2e], 8
mov byte [ebp - 0x2d], 0x15
mov byte [ebp - 0x2c], 0xa
mov byte [ebp - 0x2b], 0x4a
mov byte [ebp - 0x2a], 0x12
mov byte [ebp - 0x29], 0x15
mov byte [ebp - 0x28], 0xb
mov byte [ebp - 0x27], 2
mov byte [ebp - 0x26], 9
mov byte [ebp - 0x25], 4
mov byte [ebp - 0x24], 8
mov byte [ebp - 0x23], 3
mov byte [ebp - 0x22], 2
mov byte [ebp - 0x21], 3
mov byte [ebp - 0x20], 0x6a
mov byte [ebp - 0x1f], 0x6d
mov byte [ebp - 0x1e], 0x24
mov byte [ebp - 0x1d], 6
mov byte [ebp - 0x1c], 4
mov byte [ebp - 0x1b], 0xf
mov byte [ebp - 0x1a], 2
mov byte [ebp - 0x19], 0x4a
mov byte [ebp - 0x18], 0x24
mov byte [ebp - 0x17], 8
mov byte [ebp - 0x16], 9
mov byte [ebp - 0x15], 0x13
mov byte [ebp - 0x14], 0x15
mov byte [ebp - 0x13], 8
mov byte [ebp - 0x12], 0xb
mov byte [ebp - 0x11], 0x5d
mov byte [ebp - 0x10], 0x47
mov byte [ebp - 0xf], 9
mov byte [ebp - 0xe], 8
mov byte [ebp - 0xd], 0x4a
mov byte [ebp - 0xc], 4
mov byte [ebp - 0xb], 6
mov byte [ebp - 0xa], 4
mov byte [ebp - 9], 0xf
mov byte [ebp - 8], 2
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6d
mov byte [ebp - 5], 0
mov ecx, 0x13
lea esi, [ebp - 0x50]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x66
mov byte [ebp - 0x27], 0x23
mov byte [ebp - 0x26], 0x14
mov byte [ebp - 0x25], 0x14
mov byte [ebp - 0x24], 9
mov byte [ebp - 0x23], 0x14
mov byte [ebp - 0x22], 0x46
mov byte [ebp - 0x21], 0x15
mov byte [ebp - 0x20], 3
mov byte [ebp - 0x1f], 8
mov byte [ebp - 0x1e], 2
mov byte [ebp - 0x1d], 0xf
mov byte [ebp - 0x1c], 8
mov byte [ebp - 0x1b], 1
mov byte [ebp - 0x1a], 0x46
mov byte [ebp - 0x19], 0xb
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x17], 0x15
mov byte [ebp - 0x16], 0x15
mov byte [ebp - 0x15], 7
mov byte [ebp - 0x14], 1
mov byte [ebp - 0x13], 3
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x12
mov byte [ebp - 0x10], 9
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xe], 0x15
mov byte [ebp - 0xd], 3
mov byte [ebp - 0xc], 0x14
mov byte [ebp - 0xb], 0x10
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 0x14
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x48
mov byte [ebp - 6], 0x57
mov byte [ebp - 5], 0
mov ecx, 9
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10005fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x28], 0x2a
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x58
mov byte [ebp - 0x25], 0x58
mov byte [ebp - 0x24], 0x45
mov byte [ebp - 0x23], 0x58
mov byte [ebp - 0x22], 0xa
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4f
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x1e], 0x4e
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], 0x4d
mov byte [ebp - 0x1a], 0xa
mov byte [ebp - 0x19], 0x47
mov byte [ebp - 0x18], 0x4f
mov byte [ebp - 0x17], 0x59
mov byte [ebp - 0x16], 0x59
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0x12], 0xa
mov byte [ebp - 0x11], 0x5e
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0xa
mov byte [ebp - 0xe], 0x59
mov byte [ebp - 0xd], 0x4f
mov byte [ebp - 0xc], 0x58
mov byte [ebp - 0xb], 0x5c
mov byte [ebp - 0xa], 0x4f
mov byte [ebp - 9], 0x58
mov byte [ebp - 8], 0x1e
mov byte [ebp - 7], 0
mov ecx, 8
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b640
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10037018]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
call fcn.10002e00
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0x10]
call fcn.10002cd0
lea ecx, [ebp - 0x10]
call fcn.10002d30
movzx edx, al
test edx, edx
je 0x1000b6c2
lea ecx, [ebp - 0x10]
call fcn.10002d60
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x1c], 0
je 0x1000b6c2
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.10002d80
push eax
call fcn.1000d9a0
add esp, 4
cmp eax, 0x3285501
jne 0x1000b6c0
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.10002db0
jmp 0x1000b6d3
jmp 0x1000b681
lea ecx, [ebp - 0x14]
call fcn.10002e20
movzx ecx, al
test ecx, ecx
jne 0x1000b658
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ef90
mov esp, ebp
pop ebp
ret

Function at 0x100170e0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001711f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001711f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001711f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001711f
cmp dword [ecx + 0x74], 0xe
jbe 0x1001711f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001c275
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002d098
push 0x1002d090
push str.FlsAlloc
push 0x1f
call fcn.1001c13d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c2a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x10029128]
call esi
jmp 0x1001c2af
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001c2f3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002d0a8
push 0x1002d0a0
push str.FlsGetValue
push 0x21
call fcn.1001c13d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c32a
push dword [ebp + 8]
mov ecx, esi
call dword [0x10029128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001c332
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002d0b0
push 0x1002d0a8
push str.FlsSetValue
push 0x22
call fcn.1001c13d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c36c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10029128]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001fe3f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001fedc
push ebx
push esi
call fcn.1001fe08
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001ebaa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001fe89
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001fedb
push edi
push eax
call fcn.100183ec
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001fea9
call fcn.100183b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001feda
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001ebaa
add esp, 0x20
test eax, eax
jne 0x1001fec8
push edi
call fcn.100183b2
jmp 0x1001fed0
push ebx
call fcn.100183b2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10023e9e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100197ce
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10023f0d
cmp esi, dword [ebp - 4]
je 0x10023f08
cmp dword [ebp + 0xc], 0
je 0x10023f08
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10023ee5
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100239f0
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10023f0f
xor eax, eax
inc eax
jmp 0x10023f0f
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10023f74
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10037018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100197ce
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100197ce
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10023feb
cmp word [ecx], dx
je 0x10023feb
mov eax, dword [0x1002d6ec]
push edi
dec eax
push eax
push 0x1002d5d8
call fcn.10023f13
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002405e
cmp word [eax], dx
je 0x1002405e
mov eax, dword [edi]
test eax, eax
je 0x1002400f
cmp word [eax], dx
je 0x1002400f
lea eax, [ebp - 0x10]
push eax
call fcn.100238f6
jmp 0x10024018
lea eax, [ebp - 0x10]
push eax
call fcn.10023991
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10024088
mov eax, dword [0x1002d5d4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1002d2c8
call fcn.10023f13
add esp, 0xc
test al, al
je 0x10024088
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10024053
cmp word [eax], di
je 0x10024053
lea eax, [ebp - 0x10]
push eax
call fcn.100238f6
pop ecx
jmp 0x1002408a
lea eax, [ebp - 0x10]
push eax
call fcn.10023991
jmp 0x10024050
mov eax, dword [edi]
test eax, eax
je 0x10024075
cmp word [eax], dx
je 0x10024075
lea eax, [ebp - 0x10]
push eax
call fcn.100238ab
pop ecx
jmp 0x10024088
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10024153
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10023d98
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10024153
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10024153
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10024153
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100240e0
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001c472
test ebx, ebx
je 0x1002414e
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001c472
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10024153
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10024153
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10026aa8
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10024155
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ef90
leave
ret
Function at 0x402af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45bd14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x402b27
cmp dword [ebp - 0xc], 0
jne 0x402b31
mov eax, 1
jmp 0x402b97
inc word [0x46423e]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x402b5b
push 4
mov eax, dword [ebp - 0x10]
push eax
call main
add esp, 8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402b7d
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10]
push eax
call main
add esp, 4
dec word [0x46423e]
xor eax, eax
jmp 0x402b97
pop edi
pop esi
pop ebx
leave
ret