joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438625
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x4386f8
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x43855c
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x43860e
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x43860e
push eax
or eax, 0x15d0e
pop eax
push eax
call fcn.004385a0
add byte [edi], dh
xor eax, 0x49474432
aaa
inc esp
add esp, 4
and eax, 0x16c0d
call 0x4385b7
add byte [ecx + 0x43], al
inc esi
xor eax, 0x443f3746
add esp, 4
pop eax
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
cmp ecx, eax
je 0x438600
mov ecx, dword [ebp - 0x708]
add ecx, dword [ebp - 0x184]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x184]
movsx ecx, byte [ebp + eax - 0x804]
cmp edx, ecx
jne 0x438607
jmp 0x43854d
jmp 0x43860e
push edi
sub edi, 0x47be
call 0x438625
add byte [edi + 0x41], al
inc ecx
dec ecx
cmp dl, byte [eax + 0x4b]
dec esi
inc ecx
inc edx
add esp, 4
or edi, 0x14f77
call 0x43863c
add byte [edx], dh
dec edi
dec ebp
inc eax
cmp byte [eax + 0x4e], cl
dec ebp
add esp, 4
pop edi
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x43866d
mov dword [ebp - 0xc40], 0
jmp 0x4386dc
push edi
and edi, 0x1791c
xor edi, 0x64ad
pop edi
push ebx
push edx
add esp, 4
add ebx, 0x85c
add ebx, 0xcb05
add ebx, 0xa933
jmp 0x438697
pop ebx
push edi
jmp 0x43869e
pop edi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x4386d2
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x4386dc
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x4386f3
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x438704
jmp 0x4384dd
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x738], eax
Function at 0x43863c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x4386f8
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x43855c
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x43860e
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x43860e
push eax
or eax, 0x15d0e
pop eax
push eax
call fcn.004385a0
add byte [edi], dh
xor eax, 0x49474432
aaa
inc esp
add esp, 4
and eax, 0x16c0d
call 0x4385b7
add byte [ecx + 0x43], al
inc esi
xor eax, 0x443f3746
add esp, 4
pop eax
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
cmp ecx, eax
je 0x438600
mov ecx, dword [ebp - 0x708]
add ecx, dword [ebp - 0x184]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x184]
movsx ecx, byte [ebp + eax - 0x804]
cmp edx, ecx
jne 0x438607
jmp 0x43854d
jmp 0x43860e
push edi
sub edi, 0x47be
call 0x438625
add byte [edi + 0x41], al
inc ecx
dec ecx
cmp dl, byte [eax + 0x4b]
dec esi
inc ecx
inc edx
add esp, 4
or edi, 0x14f77
call 0x43863c
add byte [edx], dh
dec edi
dec ebp
inc eax
cmp byte [eax + 0x4e], cl
dec ebp
add esp, 4
pop edi
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x43866d
mov dword [ebp - 0xc40], 0
jmp 0x4386dc
push edi
and edi, 0x1791c
xor edi, 0x64ad
pop edi
push ebx
push edx
add esp, 4
add ebx, 0x85c
add ebx, 0xcb05
add ebx, 0xa933
jmp 0x438697
pop ebx
push edi
jmp 0x43869e
pop edi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x4386d2
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x4386dc
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x4386f3
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x438704
jmp 0x4384dd
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x738], eax
Function at 0x438730
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x437fff
add byte [ebp + 0x4c], cl
dec ecx
inc esp
inc esi
dec edx
dec ecx
add esp, 4
pop edx
push eax
push ebx
add esp, 4
or eax, 0x1a0
pop eax
push ebx
sub ebx, 0x133a4
pop ebx
mov dword [ebp - 0x738], 0
jmp 0x438710
push esi
push esi
add esp, 4
add esi, 0x1220
jmp 0x438723
call 0x438730
add byte [ecx + 0x3a], cl
dec edx
inc ebp
inc eax
push eax
add esp, 4
sub esi, 0x142d8
pop esi
push eax
xor eax, 0xbfc6
pop eax
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push edi
sub edi, 0x16334
jmp 0x438760
xor edi, 0x17a53
pop edi
push ecx
push edx
add esp, 4
call 0x438779
add byte [eax + 0x43], al
dec edx
dec eax
inc esi
xor edi, dword [ebx + eax*4]
les eax, [ecx + eax*4]
jmp 0x445ceb
xchg edx, eax
jmp 0x904860f4

Function at 0x438779
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x437fff
add byte [ebp + 0x4c], cl
dec ecx
inc esp
inc esi
dec edx
dec ecx
add esp, 4
pop edx
push eax
push ebx
add esp, 4
or eax, 0x1a0
pop eax
push ebx
sub ebx, 0x133a4
pop ebx
mov dword [ebp - 0x738], 0
jmp 0x438710
push esi
push esi
add esp, 4
add esi, 0x1220
jmp 0x438723
call 0x438730
add byte [ecx + 0x3a], cl
dec edx
inc ebp
inc eax
push eax
add esp, 4
sub esi, 0x142d8
pop esi
push eax
xor eax, 0xbfc6
pop eax
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push edi
sub edi, 0x16334
jmp 0x438760
xor edi, 0x17a53
pop edi
push ecx
push edx
add esp, 4
call 0x438779
add byte [eax + 0x43], al
dec edx
dec eax
inc esi
xor edi, dword [ebx + eax*4]
les eax, [ecx + eax*4]
jmp 0x445ceb
xchg edx, eax
jmp 0x904860f4

Function at 0x4388fc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43890b
add byte [edi], dh
inc edi
inc esi
dec edx
xor eax, 0x5904c483
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ebx
push edi
add esp, 4
or ebx, 0x3a8e
and ebx, 0x7a0
jmp 0x438950
pop ebx
push esi
push edi
add esp, 4
jmp 0x43895b
and esi, 0xe10a
sub esi, 0x4198
pop esi
cmp dword [ebp - 0x150c], 0
jne 0x438980
mov dword [ebp - 0x2a8], 0
jmp 0x438c27
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push ebx
jmp 0x43899a
call fcn.004389a8
add byte [esi + 0x3c], cl
xor eax, 0x323f3934
dec esi
Function at 0x43890b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43890b
add byte [edi], dh
inc edi
inc esi
dec edx
xor eax, 0x5904c483
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ebx
push edi
add esp, 4
or ebx, 0x3a8e
and ebx, 0x7a0
jmp 0x438950
pop ebx
push esi
push edi
add esp, 4
jmp 0x43895b
and esi, 0xe10a
sub esi, 0x4198
pop esi
cmp dword [ebp - 0x150c], 0
jne 0x438980
mov dword [ebp - 0x2a8], 0
jmp 0x438c27
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push ebx
jmp 0x43899a
call fcn.004389a8
add byte [esi + 0x3c], cl
xor eax, 0x323f3934
dec esi

Function at 0x4389a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0x7d37
sub ebx, 0xe3c4
pop ebx
push edx
push edx
add esp, 4
and edx, 0x9d59
pop edx
cmp dword [ebp - 0xc4c], 0
jne 0x4389dc
mov dword [ebp - 0x2a8], 0
jmp 0x438c27
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
Function at 0x4394fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x43955e
push ecx
push edx
add esp, 4
sub ecx, 0xbbdc
pop ecx
push esi
and esi, 0x17a6b
pop esi
push eax
push eax
add esp, 4
or eax, 0x20e0
pop eax
push esi
push esi
add esp, 4
les eax, [ecx + eax*4]
into
lodsb al, byte [esi]
push cs
add byte [eax], al
Function at 0x439760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
push eax
push ecx
add esp, 4
and eax, 0x17efd
xor eax, 0xc21d
jmp 0x43977a
sub eax, 0x339e
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x43979e
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x4397f8
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4396c6
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4396c6
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4397e2
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4397ec
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x439841
push edx
push ebx
add esp, 4
or edx, 0xea38
pop edx
push esi
push esi
add esp, 4
jmp 0x43981b
xor esi, 0x5152
call 0x43982f
add byte [eax + 0x40], cl
cmp al, 0x45
dec eax
dec esi
inc ebp
add esp, 4
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4398a9
push ecx
push edi
add esp, 4
or ecx, 0x1568b
add ecx, 0x7d30
add byte [eax], al
xor ecx, 0x5940
and ecx, 0xea69
pop ecx
push ecx
call 0x43986f
add byte [esi], bh
xor al, 0x43
inc esi
cmp dword [edi], edi
inc esp
inc esi
push eax
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x43989f
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x43966a
mov dword [ebp - 0x2a8], 0

Function at 0x43982f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
push eax
push ecx
add esp, 4
and eax, 0x17efd
xor eax, 0xc21d
jmp 0x43977a
sub eax, 0x339e
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x43979e
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x4397f8
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4396c6
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4396c6
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4397e2
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4397ec
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x439841
push edx
push ebx
add esp, 4
or edx, 0xea38
pop edx
push esi
push esi
add esp, 4
jmp 0x43981b
xor esi, 0x5152
call 0x43982f
add byte [eax + 0x40], cl
cmp al, 0x45
dec eax
dec esi
inc ebp
add esp, 4
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4398a9
push ecx
push edi
add esp, 4
or ecx, 0x1568b
add ecx, 0x7d30
add byte [eax], al
xor ecx, 0x5940
and ecx, 0xea69
pop ecx
push ecx
call 0x43986f
add byte [esi], bh
xor al, 0x43
inc esi
cmp dword [edi], edi
inc esp
inc esi
push eax
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x43989f
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x43966a
mov dword [ebp - 0x2a8], 0
Function at 0x43986f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
push eax
push ecx
add esp, 4
and eax, 0x17efd
xor eax, 0xc21d
jmp 0x43977a
sub eax, 0x339e
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x43979e
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x4397f8
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4396c6
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4396c6
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4397e2
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4397ec
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x439841
push edx
push ebx
add esp, 4
or edx, 0xea38
pop edx
push esi
push esi
add esp, 4
jmp 0x43981b
xor esi, 0x5152
call 0x43982f
add byte [eax + 0x40], cl
cmp al, 0x45
dec eax
dec esi
inc ebp
add esp, 4
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4398a9
push ecx
push edi
add esp, 4
or ecx, 0x1568b
add ecx, 0x7d30
add byte [eax], al
xor ecx, 0x5940
and ecx, 0xea69
pop ecx
push ecx
call 0x43986f
add byte [esi], bh
xor al, 0x43
inc esi
cmp dword [edi], edi
inc esp
inc esi
push eax
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x43989f
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x43966a
mov dword [ebp - 0x2a8], 0
Function at 0x4734e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x496028]
jne 0x4734f0
repz ret
jmp fcn.00473a8e

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x1000b10d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000b1b4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000b18b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000b16f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1000b189
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1002106f
or dword [eax], 0xffffffff
jmp 0x1000b164
jmp 0x1000b1b2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1000b1b2
push 0x55d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1000b1d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push 0
push dword [ebp - 0x2c]
push 0xd11
push dword [ebp - 0x30]
call fcn.10011f48
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1000ce07
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ce34
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 0x38fd
push 0x676c
push dword [ebp - 4]
push 0
call fcn.10012345
add esp, 0x10
jmp 0x1000ce9d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000ce7a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1000ce9d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1000ce9d
push 0x281
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x100204e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10020529
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 0x4ba6
push dword [ebp - 0x20]
push 1
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
call fcn.10020639
add esp, 0x14
jmp 0x10020635
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10020628
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100205ae
mov eax, dword [ebp - 4]
cmp dword [eax], 6
jne 0x10020594
mov dword [ebp - 8], 1
jmp 0x10020598
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add eax, 0x13a23
cmp eax, 0xfffffff7
je 0x100205ae
mov dword [ebp - 0xc], 1
jmp 0x100205b2
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
dec eax
mov ecx, dword [ebp - 4]
sub eax, dword [ecx]
mov dword [ebp - 0x10], eax
push 1
mov ecx, dword [ebp - 0x48]
call fcn.1002106f
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp - 0x10], 0
je 0x100205e5
mov eax, 0xd5be
test eax, eax
je 0x100205e5
mov dword [ebp - 0x14], 1
jmp 0x100205e9
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
imul ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
jl 0x10020602
mov dword [ebp - 0x18], 1
jmp 0x10020606
and dword [ebp - 0x18], 0
imul eax, dword [ebp - 0x18], 0xfffffff9
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jle 0x1002061a
mov dword [ebp - 0x1c], 1
jmp 0x1002061e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x10020635
push 0x281
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x10020661
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100206fa
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100206d1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x14]
call fcn.100125f2
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push dword [ebp - 0x1c]
call fcn.100204a7
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1002071b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100206f8
push 0x55d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1002071b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push 0x5aec
push dword [ebp - 0x34]
push 0
call fcn.1000d450
add esp, 0x10
mov esp, ebp
pop ebp
ret