joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ac0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xbb8
push esi
push 0x40b0dc
push eax
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x406ae9
xor al, al
pop esi
add esp, 0xbb8
ret
push esi
push 0xbb8
lea ecx, [esp + 0xc]
push 1
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 0x800
push esi
je 0x406b18
call sub.MSVCRT.dll_fclose
add esp, 4
xor al, al
pop esi
add esp, 0xbb8
ret
call sub.MSVCRT.dll_fclose
mov eax, dword [esp + 0xbcc]
add esp, 4
test eax, eax
je 0x406b2e
mov byte [eax], 1
mov eax, dword [esp + 0xbc4]
lea edx, [esp + 4]
push edx
push eax
call fcn.00406b50
add esp, 8
pop esi
add esp, 0xbb8
ret

Function at 0x406b50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0xbc0
xor eax, eax
push ebx
push ebp
push esi
push edi
mov esi, dword [esp + 0xbd8]
mov ecx, 0x200
lea edi, [esp + 0x18]
cmp eax, 1
mov dword [esp + 0x14], eax
rep movsd dword es:[edi], dword [esi]
jne 0x406ba3
push 0x531717e
push 0x4a812a7
call fcn.00406a40
add esp, 8
xor esi, esi
call fcn.00406a80
mov dl, byte [esp + esi + 0x18]
xor dl, al
mov byte [esp + esi + 0x18], dl
inc esi
cmp esi, 0x800
jl 0x406b8b
mov esi, 3
lea eax, [esp + 0x18]
xor ecx, ecx
sub esi, eax
lea eax, [esp + ecx + 0x18]
mov bl, byte [eax]
lea edx, [esi + eax]
and edx, 0xff
mov dl, byte [edx*4 + 0x40b6c0]
sub bl, dl
inc ecx
cmp ecx, 0x800
mov byte [eax], bl
jl 0x406bb0
mov eax, 0x7ff
mov cl, byte [esp + eax + 0x17]
mov dl, byte [esp + eax + 0x18]
xor dl, cl
mov byte [esp + eax + 0x18], dl
dec eax
jne 0x406bd8
mov eax, dword [0x40bac0]
xor edi, edi
test eax, eax
mov byte [esp + 0x13], 0
je 0x406c4b
mov ebp, dword [esp + 0x814]
mov esi, 0x40bac0
xor ecx, ecx
xor edx, edx
mov ebx, eax
mov dl, byte [esp + ecx + 0x18]
and ebx, 0xff
xor edx, ebx
sar eax, 8
mov edx, dword [edx*4 + 0x40b6c0]
and eax, 0xffffff
xor eax, edx
inc ecx
cmp ecx, 0x7fc
jl 0x406c07
cmp ebp, eax
je 0x406c46
cmp ebp, dword [esi]
je 0x406c4b
mov eax, dword [esi + 4]
add esi, 4
inc edi
test eax, eax
jne 0x406c05
jmp 0x406c4b
mov byte [esp + 0x13], 1
mov eax, dword [edi*4 + 0x40bac0]
test eax, eax
jne 0x406c68
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x406ca6
mov eax, 1
jmp 0x406b5c
xor ecx, ecx
mov al, byte [esp + ecx + 0x18]
mov dl, al
sar dl, 4
and dl, 0xf
shl al, 4
or dl, al
mov byte [esp + ecx + 0x18], dl
inc ecx
cmp ecx, 0x800
jl 0x406c6a
cmp byte [esp + 0x18], 1
jl 0x406cb3
cmp byte [esp + 0x19], 0x12
jl 0x406cb3
mov al, byte [esp + 0x13]
test al, al
je 0x406ca6
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x406cb3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xbc0
ret
mov ecx, dword [esp + 0xbd4]
lea eax, [esp + 0x18]
push 0x800
push eax
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc0
ret
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401c66
pop dword [ebp - 0x3c]
mov eax, 0x783742e1
sub eax, 0x77f7267b
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xa91e5b08
sub dword [ebp - 0x4c], 0x5acc15bd
mov dword [ebp - 0x48], 0x80f684cc
sub dword [ebp - 0x48], 0x4ec33887
mov dword [ebp - 0x44], 0x13a8e0b7
add dword [ebp - 0x44], 0x38a36377
mov dword [ebp - 0x40], 0x8a85eb27
add dword [ebp - 0x40], 0x757a14d9
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xff49f28b
add eax, 0xf63dc9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xb4f4c7a9
sub dword [ebp - 0x4c], 0x40825e53
mov dword [ebp - 0x48], 0xc75fa525
add dword [ebp - 0x48], 0x7a0cbc50
mov dword [ebp - 0x44], 0x608fabf5
sub dword [ebp - 0x44], 0xfd203f89
mov dword [ebp - 0x40], 0x5bb4c804
add dword [ebp - 0x40], 0xa44b37fc
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3530e
push 0
call eax
mov ecx, 0x42d7
xor esi, esi
add esi, eax
mov edi, 0x61c6e2e1
add edi, 0x9e798d1f
add edi, dword [ebp - 0x3c]
mov ebx, 0x2b7ba4e
add ebx, 0xc0fb7471
xor dword [ebp - 4], 0x983ab0bd
mov edx, dword [edi]
xor dword [ebp - 0x34], 0xa36a99a4
sub edx, ebx
mov dword [ebp - 0x28], 0x87446f4c
mov dword [esi], edx
xor dword [ebp - 0x24], 0x49554c
add esi, 0x66fa3448
add esi, 0x9905cbbc
add edi, 0x79490788
add edi, 0x86b6f87c
loop 0x401d7f
add eax, 0xeb5de0ce
sub eax, 0xeb5ce29f
xor ebx, ebx
add ebx, eax
add eax, 0x1816ab4c
add eax, 0xe7e954b9
mov ecx, 0xc645774d
add ecx, 0x39fa88b3
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1001faa
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 3]
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax]
push ebx
push esi
movzx esi, byte [eax + 6]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 7]
shl ecx, 8
or ecx, esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 4]
shl ecx, 8
or ecx, esi
push edi
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0x10]
movzx esi, byte [eax + 3]
movzx edi, byte [eax + 2]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 1]
shl esi, 8
or esi, edi
movzx edi, byte [eax]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 6]
mov dword [ebp - 0x10], esi
movzx esi, byte [eax + 7]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 5]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 4]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
mov dword [ebp - 0xc], esi
movzx esi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 9]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xe]
mov dword [ebp - 8], esi
movzx esi, byte [eax + 0xf]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xd]
movzx eax, byte [eax + 0xc]
shl esi, 8
or esi, edi
shl esi, 8
or esi, eax
push 0x20
mov dword [ebp - 4], esi
mov eax, 0xc6ef3720
pop esi
mov edi, edx
shr edi, 5
mov ebx, edx
shl ebx, 4
xor edi, ebx
mov ebx, eax
shr ebx, 0xb
and ebx, 3
mov ebx, dword [ebp + ebx*4 - 0x10]
add ebx, eax
add edi, edx
xor edi, ebx
sub ecx, edi
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add eax, 0x61c88647
mov ebx, eax
and ebx, 3
mov ebx, dword [ebp + ebx*4 - 0x10]
add edi, ecx
add ebx, eax
xor edi, ebx
dec esi
sub edx, edi
test esi, esi
jg 0x1002085
mov esi, dword [ebp + 0xc]
mov eax, edx
shr eax, 8
mov byte [esi + 1], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 2], al
mov eax, ecx
shr eax, 8
mov byte [esi + 5], al
mov eax, ecx
mov byte [esi], dl
shr edx, 0x18
mov byte [esi + 4], cl
shr eax, 0x10
shr ecx, 0x18
pop edi
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], cl
pop esi
pop ebx
leave
ret 0xc
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40915c
nop
mov ecx, 0x5d6f7c02
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2371578d
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000a190
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x10037490], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x1003748c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x10037490], edx
cmp eax, 0x26f
jl 0x1000a198
mov dword [0x1002b980], 0x270
ret

Function at 0x1000a1d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x10037494]
mov ebx, dword [eax*4 + 0x10037490]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x10037ac4]
mov dword [eax*4 + 0x10037490], edx
cmp eax, 0xe2
jl 0x1000a1d8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x10037494]
mov ebx, dword [eax*4 + 0x10037490]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x10037104]
mov dword [eax*4 + 0x10037490], edx
cmp eax, 0x26e
jl 0x1000a228
mov edx, dword [0x10037490]
mov ecx, dword [0x10037e4c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10037ac0]
mov dword [0x10037e4c], eax
mov dword [0x1002b980], 0
pop ebx
ret

Function at 0x1000a2b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x1002b980]
add dword [0x1002b980], 1
mov eax, dword [0x10036020]
cmp eax, dword [0x1002b4a0]
jne 0x1000a2d3
cmp ebx, 0x271
jb 0x1000a2f4
mov eax, dword [0x10036020]
call fcn.1000a190
not dword [0x10036020]
mov eax, dword [0x10036020]
mov dword [0x1002b4a0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x1000a310
call fcn.1000a1d0
xor ebx, ebx
mov dword [0x1002b980], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x10037490]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x1000bda0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x1002b1d0]
cmp ax, 0xcb
je 0x1000beac
cmp ax, 0xcc
je 0x1000beac
lea esi, [esi]
mov edx, dword [0x10038090]
test edx, edx
je 0x1000bdd5
mov eax, dword [0x10037f40]
call edx
mov ebx, eax
jmp 0x1000bdda
mov ebx, 0x10037f44
cmp word [0x10037f30], 0
jle 0x1000be00
mov eax, 0x10037f10
call fcn.1000c010
mov eax, ebx
call fcn.1000b960
mov eax, ebx
call fcn.1000b9d0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x1000be22
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x1000be1d
mov edx, edi
mov eax, ebx
call fcn.1000add0
jmp 0x1000be20
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x1000be08
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x10037f30], 0
jle 0x1000beac
mov edx, 0x10037e50
mov eax, ebx
call fcn.1000af10
mov edi, eax
test edi, edi
je 0x1000be7c
mov eax, dword [0x10037ee4]
mov dword [edi + 0xc], eax
cmp dword [0x10037ee4], 0
je 0x1000be70
mov eax, dword [0x10037ee4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x10037ee4], eax
nop
sub word [0x10037f30], 1
cmp word [0x10037f30], 0
sete bl
mov eax, 0x10037f10
call fcn.1000c030
test bl, bl
je 0x1000beac
mov eax, 0x10037f10
call fcn.1000c000
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x1000dd90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x10037260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.1000df70
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x10037260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.10002390
call sub.kernel32.dll_GetCommandLineA
mov dword [0x1002b260], eax
mov ebx, eax
jmp 0x1000df33
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x1000de18
cmp byte [ebx], 0
je 0x1000df3c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x1000de93
mov al, byte [ebx]
cmp al, 1
jb 0x1000de88
sub al, 0x20
jbe 0x1000de58
sub al, 2
je 0x1000de6c
jmp 0x1000de88
mov al, byte [ebp - 0x114]
test al, al
je 0x1000de98
add dword [ebp - 0x110], 1
jmp 0x1000de90
cmp byte [ebx + 1], 0x22
je 0x1000de83
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x1000de90
add ebx, 1
jmp 0x1000de90
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x1000de48
test dword [ebp - 0x10c], 0xffffffff
je 0x1000df2c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.1000df70
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x10037260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x1000df23
mov al, byte [ebx]
cmp al, 1
jb 0x1000df18
sub al, 0x20
jbe 0x1000dee8
sub al, 2
je 0x1000defc
jmp 0x1000df18
mov al, byte [ebp - 0x114]
test al, al
je 0x1000df28
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x1000df20
cmp byte [ebx + 1], 0x22
je 0x1000df13
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x1000df20
add ebx, 1
jmp 0x1000df20
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x1000ded8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x1000de1b
mov ebx, dword [ebp - 0x10c]
mov dword [0x10037250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x10037260
call fcn.1000bbe0
mov eax, dword [0x10037260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.10002af0
mov byte [0x1002b220], 1
mov eax, dword [0x100372e0]
mov dword [0x1002ba20], eax
mov dword [ebp - 8], 0
mov eax, dword [0x100372e0]
test eax, eax
je 0x1000e13c
sub eax, 1
je 0x1000e064
sub eax, 1
je 0x1000e0dc
sub eax, 1
je 0x1000e10c
jmp 0x1000e188
call sub.kernel32.dll_GetCurrentThreadId
mov dword [0x100380b0], eax
mov eax, 0x10038170
call fcn.10002a40
test eax, eax
jne 0x1000e0c0
xor eax, eax
push 0x1000e0aa
push ebp
push 0x1000f0a0
push dword fs:[eax]
mov dword fs:[eax], esp
call dword [0x10037334]
mov dword [ebp - 8], 0xffffffff
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x1000e188
cmp dword [0x10036010], 0
sete al
and eax, 0xff
neg eax
mov dword [ebp - 8], eax
jmp 0x1000e188
call fcn.1000c230
mov eax, 0x1000000
call fcn.1000beb0
cmp dword [0x1002b470], 0
je 0x1000e188
mov eax, dword [0x100372f0]
call dword [0x1002b470]
nop
jmp 0x1000e188
cmp dword [0x1002b480], 0
je 0x1000e120
mov eax, dword [0x100372f0]
call dword [0x1002b480]
mov eax, dword [0x1002b9c0]
push dword [eax]
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x1000e188
call fcn.1000bf80
lea esi, [esi]
jmp 0x1000e188
cmp dword [0x100380b0], 0
je 0x1000e192
lea esi, [esi]
mov eax, 0x10038170
call fcn.10002a40
test eax, eax
jne 0x1000e174
cmp dword [0x1002b460], 0
je 0x1000e16c
mov eax, dword [0x100372f0]
call dword [0x1002b460]
mov esi, esi
call fcn.1000a5b0
lea esi, [esi]
call fcn.1000c350
call fcn.1000c2d0
mov dword [0x100380b0], 0
mov dword [0x1002ba20], 0xffffffff
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015270
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.10015260
push ebp
push 0x1000ed20
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x100387ac]
xor edx, edx
call fcn.10005e30
mov dword [ebx*4 + 0x100387cc], 0xffffffff
cmp ebx, 7
jl 0x10015298
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x10015324
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.10006820
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.1000fd60
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x10015324
push 4
push ebx
push esi
mov eax, 0x10015140
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x100151d0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10015260
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015a70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push fcn.10015a40
push ebp
push 0x1000ed20
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
call fcn.1000f9b0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.10005e30
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.100071e0
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.10005e30
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x1c], eax
mov ebx, eax
jmp 0x10015b7c
lea ecx, [ebp - 8]
mov eax, ebx
xor dx, dx
call fcn.10006780
mov eax, dword [ebp - 8]
test eax, eax
je 0x10015b07
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.100071e0
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.10006d60
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.10006c00
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.1000f9b0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.100069a0
test eax, eax
jne 0x10015b74
push dword [ebp - 0x18]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10015b63
mov eax, dword [eax - 4]
sub eax, esi
mov ecx, eax
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.10006c00
jmp 0x10015b85
lea eax, [ebx + edi]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x10015af0
push dword [ebp - 0x1c]
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10015a40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015bc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x10038810], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x10038670], eax
mov eax, dword [ebp - 0x90]
mov dword [0x10038680], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x10038690], eax
mov eax, dword [ebp - 0x88]
mov dword [0x100386a0], eax
mov edx, 0x100386b1
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.10002390
lea eax, [ebp - 0x80]
call fcn.10002ef0
mov byte [0x100386b0], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x10038820], eax
test eax, eax
je 0x10015c60
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x10038820]
call sub.kernel32.dll_GetProcAddress
mov dword [0x10038810], eax
nop
cmp dword [0x10038680], 6
jae 0x10015c74
mov dword [0x1002bbc0], 0
nop
cmp dword [0x10038680], 6
jb 0x10015c90
cmp dword [0x10038690], 1
jb 0x10015c90
mov dword [0x1002bbd0], 2
mov esp, ebp
pop ebp
ret