joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042d30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10042dda
call fcn.100429a0
sub eax, 0x14
je 0x10042d94
sub eax, 2
jne 0x10042e01
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov dword [esi + 0x9c0], 1
mov edx, dword [esi + 0x9c0]
mov ecx, dword [esi + edx*4 - 4]
shr ecx, 0x1e
xor ecx, dword [esi + edx*4 - 4]
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [esi + edx*4], ecx
inc dword [esi + 0x9c0]
cmp dword [esi + 0x9c0], 0x270
jb 0x10042d62
pop esi
pop ecx
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ecx, 0x6b842128
test eax, eax
cmove eax, ecx
mov dword [esi], eax
mov dword [esi + 0x9c0], 1
lea ecx, [ecx]
mov eax, dword [esi + 0x9c0]
lea ecx, [esi + eax*4]
mov eax, dword [ecx - 4]
imul eax, eax, 0x10dcd
mov dword [ecx], eax
inc dword [esi + 0x9c0]
cmp dword [esi + 0x9c0], 0x270
jb 0x10042db0
pop esi
pop ecx
pop ebp
ret
push str.rand___NULL
push 0x139
push str.......glibgrand.c
push str.file__s:_line__d:_assertion___s_failed
push 8
push str.Glib
call sym.glib_2.dll_g_log
add esp, 0x18
pop esi
pop ecx
pop ebp
ret
push 0
push 0x100e937c
push 0x156
push str.......glibgrand.c
push str.Glib
call sym.glib_2.dll_g_assertion_message
int3

Function at 0x10042f20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x10043027
cmp dword [edx + 0x9c0], 0x270
jb 0x10042fed
xor esi, esi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
inc esi
and ecx, 0x7fffffff
xor ecx, dword [edx + esi*4 - 4]
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x100a1bd0]
xor ecx, dword [edx + esi*4 + 0x630]
mov dword [edx + esi*4 - 4], ecx
cmp esi, 0xe3
jl 0x10042f41
cmp esi, 0x26f
jge 0x10042fb3
lea esp, [esp]
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
inc esi
and ecx, 0x7fffffff
xor ecx, dword [edx + esi*4 - 4]
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x100a1bd0]
xor ecx, dword [edx + esi*4 - 0x390]
mov dword [edx + esi*4 - 4], ecx
cmp esi, 0x26f
jl 0x10042f80
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
and eax, 1
shr ecx, 1
mov eax, dword [eax*4 + 0x100a1bd0]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], 0
mov eax, dword [edx + 0x9c0]
inc eax
mov ecx, dword [edx + eax*4 - 4]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop ebp
ret
push str.rand___NULL
push 0x1ac
push str.......glibgrand.c
push str.file__s:_line__d:_assertion___s_failed
push 8
push str.Glib
call sym.glib_2.dll_g_log
add esp, 0x18
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1004c440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov ecx, 0x10100198
call fcn.100786a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1004c4e5
push 0x10101518
call dword [0x101015e0]
cmp dword [0x101012e4], 0
jne 0x1004c475
call fcn.1004c100
push 0x10101518
call dword [0x101015e8]
mov ebx, dword [0x101012f4]
lea ebx, [ebx - 0x18]
shr ebx, 6
mov edi, ebx
shl edi, 4
add edi, 8
je 0x1004c4c4
push edi
push 1
call dword [0x100ffd88]
mov esi, eax
add esp, 8
test esi, esi
jne 0x1004c4c6
push edi
push str.......glibgmem.c:195
push str._s:_failed_to_allocate__u_bytes
push 4
push str.Glib
call sym.glib_2.dll_g_log
add esp, 0x14
jmp 0x1004c4c2
xor esi, esi
lea edx, [esi + 8]
mov dword [esi], edx
lea edx, [edx + ebx*8]
push esi
mov ecx, 0x10100198
mov dword [esi + 4], edx
call fcn.100786a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x1004e930
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
call sym.glib_2.dll_g_utf8_to_utf16
mov edi, eax
add esp, 0x14
xor esi, esi
test edi, edi
jne 0x1004e966
call dword [0x100a11cc]
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 0xc]
call sym.glib_2.dll_g_utf8_to_utf16
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1004e9a0
push edi
call dword [0x100ffd84]
add esp, 4
call dword [0x100a11cc]
pop ebx
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1004e9b3
mov dword [ebp - 4], esi
jmp 0x1004e9f9
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0xb5
ja case.0x1004e9d1.4
movzx eax, byte [eax + 0x1004ea30]
jmp dword [eax*4 + 0x1004ea1c]
mov esi, 2
jmp 0x1004e9f9
mov esi, 0xd
jmp 0x1004e9f9
mov esi, 0x12
jmp 0x1004e9f9
mov esi, 0x11
jmp 0x1004e9f9
mov esi, 5
push edi
call dword [0x100ffd84]
push ebx
call dword [0x100ffd84]
add esp, 8
call dword [0x100a11cc]
pop ebx
mov dword [eax], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10056b50
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10056bad
push esi
mov ecx, 0x101001d0
call fcn.100786a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x10101550
call dword [0x101015e0]
push 0x10101550
call dword [0x101015e8]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10056b9b
push eax
call dword [0x100ffd84]
add esp, 4
mov dword [esi + 0x18], 0
push dword [esi + 4]
mov eax, dword [esi]
call eax
add esp, 4
mov dword [esi + 0x1c], eax
xor eax, eax
pop esi
pop ebp
ret
push str.data
push str.g_thread_proxy
push 0x30b
push str.......glibgthread.c
push str.Glib
call sym.glib_2.dll_g_assertion_message_expr
int3
Function at 0x10056cf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, 0x101001d0
call fcn.100786a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10056d4a
push 0x20
call sym.glib_2.dll_g_slice_alloc
mov esi, eax
add esp, 4
test esi, esi
je 0x10056d31
xorps xmm0, xmm0
movq qword [esi], xmm0
movq qword [esi + 8], xmm0
movq qword [esi + 0x10], xmm0
movq qword [esi + 0x18], xmm0
push esi
mov ecx, 0x101001d0
mov dword [esi + 0x10], 1
call fcn.100786a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [esi + 0x14], 0
jne 0x10056d66
push str.attempt_to_g_thread_exit___a_thread_not_created_by_GLib
push 4
push str.Glib
call sym.glib_2.dll_g_log
add esp, 0xc
jmp 0x10056d64
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], eax
pop esi
mov dword [ebp + 8], 0
pop ebp
jmp dword [0x100a12d8]

Function at 0x10056e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov ecx, 0x101001d0
call fcn.100786a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10056e67
push 0x20
call sym.glib_2.dll_g_slice_alloc
mov esi, eax
add esp, 4
test esi, esi
je 0x10056e4c
xorps xmm0, xmm0
movq qword [esi], xmm0
movq qword [esi + 8], xmm0
movq qword [esi + 0x10], xmm0
movq qword [esi + 0x18], xmm0
push esi
mov ecx, 0x101001d0
mov dword [esi + 0x10], 1
call fcn.100786a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
Function at 0x1005ff10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1005ffa7
push esi
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push 0xffffffffffffffff
push eax
call sym.glib_2.dll_g_utf16_to_utf8
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1005ff73
push 0x100ec370
call sym.glib_2.dll_g_strdup
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009967c
mov esp, ebp
pop ebp
ret
push esi
call sym.glib_2.dll_g_path_skip_root
mov cl, byte [eax - 1]
lea edx, [eax - 1]
add esp, 4
cmp cl, 0x5c
je 0x1005ff8c
cmp cl, 0x2f
jne 0x1005ff93
cmp byte [eax - 2], 0x3a
cmovne eax, edx
mov byte [eax], 0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009967c
mov esp, ebp
pop ebp
ret
push 0x100ec370
call sym.glib_2.dll_g_strdup
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.1009967c
mov esp, ebp
pop ebp
ret
Function at 0x100609b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1010158c
call dword [0x101015e0]
mov esi, dword [0x101013bc]
test esi, esi
jne 0x10060a84
lea eax, [ebp - 0x214]
push eax
push 0x1c
push esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x10060a30
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10060a24
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
call sym.glib_2.dll_g_utf16_to_utf8
add esp, 0x14
mov esi, eax
push dword [ebp - 0x214]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
je 0x10060a39
cmp byte [esi], 0
jne 0x10060a7e
mov eax, dword [0x101013e0]
test eax, eax
jne 0x10060a4c
call fcn.1005ffd0
mov eax, dword [0x101013e0]
mov ecx, dword [0x101013c0]
push 0
push str.share
push str..local
test ecx, ecx
je 0x10060a6d
push ecx
call sym.glib_2.dll_g_build_filename
add esp, 0x10
jmp 0x10060a7c
push dword [0x101013a4]
push eax
call sym.glib_2.dll_g_build_filename
add esp, 0x14
mov esi, eax
mov dword [0x101013bc], esi
push 0x1010158c
call dword [0x101015e8]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1009967c
mov esp, ebp
pop ebp
ret

Function at 0x10060aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101013cc], 0
jne 0x10060b6a
push esi
lea eax, [ebp - 0x214]
push eax
push 0x1c
xor esi, esi
push esi
mov dword [ebp - 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x10060b1a
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10060b0e
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
call sym.glib_2.dll_g_utf16_to_utf8
add esp, 0x14
mov esi, eax
push dword [ebp - 0x214]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
je 0x10060b23
cmp byte [esi], 0
jne 0x10060b63
mov eax, dword [0x101013e0]
test eax, eax
jne 0x10060b36
call fcn.1005ffd0
mov eax, dword [0x101013e0]
mov ecx, dword [0x101013c0]
push 0
push str..config
test ecx, ecx
je 0x10060b52
push ecx
call sym.glib_2.dll_g_build_filename
add esp, 0xc
jmp 0x10060b61
push dword [0x101013a4]
push eax
call sym.glib_2.dll_g_build_filename
add esp, 0x10
mov esi, eax
mov dword [0x101013cc], esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009967c
mov esp, ebp
pop ebp
ret
Function at 0x10060bb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1010158c
call dword [0x101015e0]
mov esi, dword [0x101013d8]
test esi, esi
jne 0x10060c7f
lea eax, [ebp - 0x214]
push eax
push 0x20
push esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x10060c30
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10060c24
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
call sym.glib_2.dll_g_utf16_to_utf8
add esp, 0x14
mov esi, eax
push dword [ebp - 0x214]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
je 0x10060c39
cmp byte [esi], 0
jne 0x10060c79
mov eax, dword [0x101013e0]
test eax, eax
jne 0x10060c4c
call fcn.1005ffd0
mov eax, dword [0x101013e0]
mov ecx, dword [0x101013c0]
push 0
push str..cache
test ecx, ecx
je 0x10060c68
push ecx
call sym.glib_2.dll_g_build_filename
add esp, 0xc
jmp 0x10060c77
push dword [0x101013a4]
push eax
call sym.glib_2.dll_g_build_filename
add esp, 0x10
mov esi, eax
mov dword [0x101013d8], esi
push 0x1010158c
call dword [0x101015e8]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1009967c
mov esp, ebp
pop ebp
ret
Function at 0x10061730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1010158c
call dword [0x101015e0]
mov esi, dword [0x101013e4]
test esi, esi
jne 0x100617ef
push edi
lea eax, [ebp - 0x214]
push eax
push 0x23
xor edi, edi
push edi
mov dword [ebp - 0x214], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x100617d2
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100617a7
push edi
push edi
push edi
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
call sym.glib_2.dll_g_utf16_to_utf8
add esp, 0x14
mov edi, eax
push dword [ebp - 0x214]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
je 0x100617d2
push 0
push 0x100eb1e4
push edi
call sym.glib_2.dll_g_strsplit
push edi
mov esi, eax
call dword [0x100ffd84]
add esp, 0x10
jmp 0x100617e8
push 0
push 0x100eb1e4
push 0x100e2aa5
call sym.glib_2.dll_g_strsplit
add esp, 0xc
mov esi, eax
mov dword [0x101013e4], esi
pop edi
push 0x1010158c
call dword [0x101015e8]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1009967c
mov esp, ebp
pop ebp
ret

Function at 0x100750f0
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x1000
test word [edx + 6], ax
push esi
mov esi, dword [0x100a1234]
push edi
mov edi, ecx
push 0
lea eax, [ebp - 8]
je 0x10075187
push 0
push eax
push 0
lea eax, [ebp - 1]
push eax
push dword [edi + 0x40]
call esi
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1007513b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1007513b
xor eax, eax
jmp 0x10075140
mov eax, 1
shl eax, 3
xor eax, dword [edi + 0x34]
push 0
and eax, 8
xor dword [edi + 0x34], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 1]
push eax
push dword [edi + 0x40]
call esi
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
test eax, eax
mov eax, dword [edi + 0x34]
setne cl
and eax, 0xffffffcf
and ecx, 1
shl ecx, 4
or ecx, eax
mov dword [edi + 0x34], ecx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push eax
push 0
lea eax, [ebp - 1]
push eax
push dword [edi + 0x40]
call esi
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
setne cl
push 0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 1]
push eax
push dword [edi + 0x40]
shl ecx, 3
xor ecx, dword [edi + 0x34]
and ecx, 8
xor dword [edi + 0x34], ecx
call esi
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
test eax, eax
mov eax, dword [edi + 0x34]
setne cl
and eax, 0xffffffef
and ecx, 1
or ecx, 2
shl ecx, 4
or ecx, eax
mov dword [edi + 0x34], ecx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100786a0
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
test esi, esi
jne 0x1007871c
push 0x10101610
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi]
test esi, esi
jne 0x10078711
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x10078721
cmp dword [edi + 4], 0
je 0x10078703
push ebx
push 0xc
call dword [0x100a11dc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1007872d
mov dword [ebx], esi
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [0x101015b8]
push eax
push ebx
push 0x101015b8
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, dword [ebx + 8]
pop ebx
jne 0x1007873f
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x1007874b
push 0x10101610
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret
mov edx, 0x100f08f0
xor ecx, ecx
call fcn.10078210
call dword [0x100a11cc]
mov ecx, dword [eax]
mov edx, 0x100f08fc
call fcn.10078210
mov edx, str.g_private_get_impl_1_
xor ecx, ecx
call fcn.10078210
mov edx, str.g_private_get_impl_2_
xor ecx, ecx
call fcn.10078210
int3

Function at 0x100787a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.100786a0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100787c9
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100787c9
push eax
call ecx
add esp, 4
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebp
ret

Function at 0x100789e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push dword [0x1010160c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10078a2c
push 0xc
call dword [0x100a11dc]
mov esi, eax
add esp, 4
test esi, esi
je 0x10078a30
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi], eax
test eax, eax
je 0x10078a42
push esi
push dword [0x1010160c]
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x100f08fc
mov ecx, eax
call fcn.10078210
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.CreateEvent
mov ecx, eax
call fcn.10078210
int3
Function at 0x100791d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0x100a122c]
push 0x100e2e88
xor esi, esi
call edi
add esp, 4
test eax, eax
je 0x100791fd
cmp byte [eax], 0
jne 0x10079223
push 0x100e2e98
call edi
add esp, 4
test eax, eax
je 0x10079210
cmp byte [eax], 0
jne 0x10079223
push 0x100e2e90
call edi
add esp, 4
test eax, eax
je 0x10079229
cmp byte [eax], 0
je 0x10079229
push eax
jmp 0x100792bd
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov edi, eax
push 0xa
lea eax, [ebp - 0x1c]
push eax
push 0x59
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100792b8
push 0xa
lea eax, [ebp - 0x10]
push eax
push 0x5a
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100792b8
movzx ecx, di
mov eax, ecx
and ecx, 0x3ff
shr eax, 0xa
cmp ecx, 0x1a
je 0x10079281
cmp ecx, 0x2c
je 0x10079274
cmp ecx, 0x43
jne 0x10079290
dec eax
je 0x1007928b
dec eax
jne 0x10079290
mov esi, str._Cyrl
jmp 0x10079290
sub eax, 2
je 0x1007928b
sub eax, 4
jne 0x10079290
mov esi, str._Latn
push 0
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push 0x100f0be0
push eax
call sym.glib_2.dll_g_strconcat
add esp, 0x14
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009967c
mov esp, ebp
pop ebp
ret
push 0x100e2ea4
call sym.glib_2.dll_g_strdup
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.1009967c
mov esp, ebp
pop ebp
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x14e34cc0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x44e57421
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x62d33b7f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x655156ec
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x43b652
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
mov ecx, dword [esp]
add esp, 4
or ebx, ebx
call fcn.0043b68d
mov ebx, 0x1a809cff
mov eax, eax
xor dword [edi], ecx
sub ebx, 0xe9f9e25f
inc edi
and eax, eax
or ebx, eax
add ebx, 0x297e0ce
cmp edi, esi
jne fcn.0043b652
add eax, eax
ret