joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100403e1
Capabilities:
Parse url

Disassembly:
mov eax, 0x10094075
call fcn.1004a59c
mov eax, 0x1090
call fcn.1004abc0
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10006958
and dword [ebp - 4], 0
lea ebx, [esi + 0x1c]
mov ecx, ebx
call fcn.10006958
xor eax, eax
mov edx, 0x209
mov ecx, edx
mov byte [ebp - 0x874], 0
lea edi, [ebp - 0x873]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x109c], al
push 0xe
mov ecx, edx
lea edi, [ebp - 0x109b]
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x4c], 0x3c
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
mov eax, 0x824
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x109c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x4c]
push eax
push 0x10000000
push dword [ebp + 8]
lea ecx, [ebp - 0x874]
mov byte [ebp - 4], 1
mov dword [ebp - 0x3c], ecx
call fcn.10049870
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x10040495
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.100027d4
push dword [ebp - 0x20]
mov ecx, ebx
call fcn.100027d4
mov ax, word [ebp - 0x34]
mov word [esi + 0x38], ax
mov eax, dword [ebp - 0x40]
mov dword [esi + 0x3c], eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10040f17
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x10040f22
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x10040fe5
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
inc edx
dec edi
jne 0x10040f42
pop edi
test eax, eax
je 0x10040fff
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x100a0940]
inc edx
dec eax
jne 0x10040fe9
mov eax, esi
pop esi
not eax
pop ebx
ret
Function at 0x100414d1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x10041505
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10041500
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x1004152d
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x10041516
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.10049900
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x10042578
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push edi
je 0x1004259f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1004259f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
test al, al
je 0x10042639
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x100425b9
cmp al, 0x5c
jne 0x100425bb
mov esi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100425b1
cmp esi, edi
je 0x100425ee
sub esi, edi
push esi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.10049900
lea eax, [ebp - 0x208]
push eax
push ebx
mov byte [ebp + esi - 0x208], 0
call fcn.10042578
add esp, 0x14
test ebx, ebx
mov byte [ebp - 0x104], 0
pop esi
je 0x10042609
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.1004d070
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.1004d080
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10042639
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebx
leave
ret

Function at 0x10043e69
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10043f11
cmp dword [esi + 4], 0xffffffff
jne 0x10043f11
push edi
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
call fcn.10049870
mov al, byte [eax + esi + 0x13f]
cmp al, 0x5c
pop ecx
je 0x10043eb8
cmp al, 0x2f
je 0x10043eb8
push 0x1009e114
push edi
call fcn.1004d080
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x10043eda
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10043eda
mov eax, 0x2000000
jmp 0x10043f16
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100412ff
add esp, 0x10
test eax, eax
jne 0x10043ef8
mov eax, dword [ebp + 0x10]
jmp 0x10043f16
push eax
call fcn.1004394c
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x10043f16
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x100472fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x6af90], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x6af80], 2
je 0x10047503
push edi
mov edi, 0x7fff
cmp dword [esi + 0x6af90], 3
jb 0x10047378
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, edi
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0x100473b9
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0x100473b9
mov ecx, dword [esi + 0x6af90]
lea eax, [esi + 0x6afa0]
cmp dword [eax], ecx
jbe 0x100473a0
mov dword [eax], ecx
push dword [ebp - 4]
push esi
call fcn.10044da3
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
pop ecx
pop ecx
jbe 0x100473b9
mov ebx, eax
cmp ebx, 3
jb 0x1004747d
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.100448cc
sub dword [esi + 0x6af90], ebx
add esp, 0xc
cmp ebx, dword [esi + 0x6af98]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
ja 0x1004744b
cmp eax, 3
jb 0x1004744b
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, edi
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, edi
dec ebx
mov dword [esi + edx*4 + 0x2af70], ecx
mov eax, dword [esi + 0x6af7c]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x100473f9
jmp 0x100474a0
add dword [esi + 0x6af84], ebx
mov eax, dword [esi + 0x6af84]
lea edx, [eax + esi]
movzx ecx, byte [edx + 0x1af70]
lea eax, [esi + 0x6af7c]
mov dword [eax], ecx
movzx edx, byte [edx + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, edi
mov dword [eax], edx
jmp 0x100474a6
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push 0
push esi
call fcn.100448cc
add esp, 0xc
dec dword [esi + 0x6af90]
mov dword [ebp + 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0x100474e2
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x100474bf
lea ecx, [eax + esi + 0x1af70]
jmp 0x100474c1
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.10047158
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x100474f5
push esi
call fcn.10044f3c
pop ecx
cmp dword [esi + 0x6af90], 0
jne 0x10047328
pop edi
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x10047516
lea ecx, [eax + esi + 0x1af70]
jmp 0x10047518
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.10047158
add esp, 0x10
pop esi
pop ebx
leave
ret
Function at 0x10056425
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100bb0b0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100bb798]
je 0x1005645a
inc eax
cmp eax, 0x13
jb 0x1005644b
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100bb798]
jne 0x10056580
mov eax, dword [0x100be4b4]
cmp eax, 1
je 0x10056558
cmp eax, edx
jne 0x1005648a
cmp dword [0x100be4b8], 1
je 0x10056558
cmp ecx, 0xfc
je 0x10056580
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100564c0
lea eax, [ebp - 0x80]
push 0x100a3c28
push eax
call fcn.1004d070
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x100bb79c]
push dword [esi]
call fcn.10049870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x10057c59
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x10057e2d
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x100bed20]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x10057e2d
test cl, 0x48
je 0x10057cc4
cmp byte [eax + 5], 0xa
je 0x10057cc4
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10057d16
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x10057cfe
call fcn.1004fefc
mov dword [eax], 9
call fcn.1004ff05
mov dword [eax], esi
jmp 0x10057d0e
cmp eax, 0x6d
je 0x10057e2d
push eax
call fcn.1004ff0e
pop ecx
or eax, 0xffffffff
jmp 0x10057e2f
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x10057e28
test eax, eax
je 0x10057d3d
cmp byte [ebx], 0xa
jne 0x10057d3d
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x10057d46
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x10057e22
xor eax, eax
Function at 0x10057d9a
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x10057e12
cmp al, 0xd
je 0x10057d78
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x10057e04
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x10057d92
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x10057d8d
add dword [ebp + 0x10], 2
jmp 0x10057de6
mov dword [ebp + 0x10], eax
jmp 0x10057e00
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10057dba
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10057e00
cmp dword [ebp - 0xc], 0
je 0x10057e00
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x10057ddb
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x10057de6
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x10057e03
cmp ebx, dword [ebp + 0xc]
jne 0x10057deb
cmp byte [ebp - 1], 0xa
jne 0x10057deb
mov byte [ebx], 0xa
jmp 0x10057e03
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10053798
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x10057e04
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x10057d5c
jmp 0x10057e22
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x10057e22
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x10057e2f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10058e2e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100be930], ebx
push esi
push edi
jne 0x10058eae
push 0x10099dc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10058ee9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10099db4
push edi
call esi
test eax, eax
mov dword [0x100be930], eax
je 0x10058ee9
push 0x100a3fa0
push edi
call esi
push 0x100a3f8c
push edi
mov dword [0x100be934], eax
call esi
cmp dword [0x100be678], 2
mov dword [0x100be938], eax
jne 0x10058eae
push 0x100a3f70
push edi
call esi
test eax, eax
mov dword [0x100be940], eax
je 0x10058eae
push 0x100a3f58
push edi
call esi
mov dword [0x100be93c], eax
mov eax, dword [0x100be93c]
test eax, eax
je 0x10058ef3
call eax
test eax, eax
je 0x10058eda
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100be940]
test eax, eax
je 0x10058eda
test byte [ebp - 8], 1
jne 0x10058ef3
cmp dword [0x100be684], 4
jb 0x10058eed
or byte [ebp + 0x12], 0x20
jmp 0x10058f12
xor eax, eax
jmp 0x10058f22
or byte [ebp + 0x12], 4
jmp 0x10058f12
mov eax, dword [0x100be934]
test eax, eax
je 0x10058f12
call eax
mov ebx, eax
test ebx, ebx
je 0x10058f12
mov eax, dword [0x100be938]
test eax, eax
je 0x10058f12
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100be930]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100593d0
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x100a3ff0
call fcn.10049700
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x100be958], edi
jne 0x10059414
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100593ff
mov dword [0x100be958], ebx
jmp 0x10059414
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10059414
mov dword [0x100be958], 2
mov eax, dword [0x100be958]
cmp eax, ebx
jne 0x10059434
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x100594f7
cmp eax, 2
je 0x1005943d
cmp eax, edi
jne 0x10059465
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x10059450
mov eax, dword [0x100be70c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x1005946c
xor eax, eax
jmp 0x100594f7
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.1004abc0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1005949f
cmp esi, edi
jne 0x100594b5
push dword [ebp - 0x20]
call fcn.1004aac6
pop ecx
mov esi, eax
cmp esi, edi
je 0x10059465
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100594e8
cmp dword [ebp + 0x14], edi
jne 0x100594d2
push edi
push edi
jmp 0x100594d8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x100594f4
push esi
call fcn.10049f7d
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.1004973b
ret
Function at 0x10059500
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x100a4000
call fcn.10049700
xor esi, esi
cmp dword [0x100be95c], esi
jne 0x10059544
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005952f
mov dword [0x100be95c], edi
jmp 0x10059544
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10059544
mov dword [0x100be95c], 2
mov eax, dword [0x100be95c]
cmp eax, 2
je 0x10059625
cmp eax, esi
je 0x10059625
cmp eax, 1
jne 0x10059589
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x10059572
mov eax, dword [0x100be70c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x10059590
xor eax, eax
jmp 0x10059637
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.1004abc0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x100595c6
cmp edi, esi
jne 0x100595e1
lea eax, [ebx + ebx]
push eax
call fcn.1004aac6
pop ecx
mov edi, eax
cmp edi, esi
je 0x10059589
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10059614
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x100595fe
push esi
push esi
jmp 0x10059604
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x10059620
push edi
call fcn.10049f7d
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x10059637
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.1004973b
ret
Function at 0x1005a4bd
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x1005a4d6
or eax, 0xffffffff
jmp 0x1005a537
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1005a533
push 0x3d
push esi
call fcn.1004caa5
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x1005a533
cmp esi, eax
je 0x1005a533
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x100be698]
sete cl
cmp eax, dword [0x100be69c]
mov dword [ebp - 8], ecx
jne 0x1005a519
mov edi, eax
call fcn.1005a45c
mov dword [0x100be698], eax
cmp eax, ebx
jne 0x1005a572
cmp dword [ebp + 0xc], ebx
je 0x1005a53b
cmp dword [0x100be6a0], ebx
je 0x1005a53b
call fcn.10059fdf
test eax, eax
je 0x1005a572
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x1005a544
xor eax, eax
jmp 0x1005a536
push 4
call fcn.1004aac6
cmp eax, ebx
pop ecx
mov dword [0x100be698], eax
je 0x1005a533
mov dword [eax], ebx
cmp dword [0x100be6a0], ebx
jne 0x1005a572
push 4
call fcn.1004aac6
cmp eax, ebx
pop ecx
mov dword [0x100be6a0], eax
je 0x1005a533
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x100be698]
call fcn.1005a40f
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x1005a5d3
cmp dword [esi], ebx
je 0x1005a5d3
lea esi, [esi + edi*4]
push dword [esi]
call fcn.10049f7d
cmp dword [ebp - 8], ebx
pop ecx
jne 0x1005a5b6
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x1005a614
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x1005a5ad
mov eax, edi
shl eax, 2
push eax
push dword [0x100be698]
call fcn.1004ae0b
cmp eax, ebx
pop ecx
pop ecx
je 0x1005a614
jmp 0x1005a60f
cmp dword [ebp - 8], ebx
jne 0x1005a67f
cmp edi, ebx
jge 0x1005a5e2
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x100be698]
call fcn.1004ae0b
cmp eax, ebx
pop ecx
pop ecx
je 0x1005a533
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x100be698], eax
cmp dword [ebp + 0xc], ebx
je 0x1005a669
push dword [ebp - 4]
call fcn.10049870
inc eax
inc eax
push eax
call fcn.1004aac6
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x1005a669
push dword [ebp - 4]
push esi
call fcn.1004d070
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x1005a662
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.10049f7d
pop ecx
cmp dword [ebp - 8], ebx
je 0x1005a677
push dword [ebp - 4]
call fcn.10049f7d
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x1005a536
push dword [ebp - 4]
call fcn.10049f7d
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x1005a540
Function at 0x1165ad8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1165ae2
pushal
call 0x1165ae8
pop ebp
sub ebp, 0x10
sub ebp, 0xd65ad8
jmp 0x1165afe
mov eax, 0xd65ad8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ce
mov edx, 0x2a4f61a2
xor byte [eax], dl
inc eax
dec ecx
jne 0x1165b15
jmp 0x1165b28
sub dword [edi + 0x29], ebp
sub ebx, dword [esi + 0x23a2a2a2]
arpl word [edx - 0x5e], bx
mov byte [0x1a6fa1a2], al
cmpsd dword [esi], dword es:[edi]
mov byte [0x8a18a2a2], al
mov byte [0x4055a2a2], al
mov eax, dword [0xae23296a]
mov byte [0x67a1a2a2], al
bnd retf 0x4c2
Function at 0x40176e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x130
push 0x4012a0
call fcn.00401f88
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4018a5
cmp dword [ebp - 0x9c], 2
jne 0x4018a5
push 4
pop eax
cmp dword [ebp - 0xa8], eax
jne 0x4018a5
and dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0x401290
push 0x401264
mov edi, 0x80000002
push edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
call esi
test eax, eax
jne 0x4018a5
cmp word [ebp - 0xb0], 0x300
jne 0x4018a5
mov ebx, 0x88
mov dword [ebp - 0xb4], ebx
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x401258
push 0x4011f8
push edi
call esi
test eax, eax
jne 0x4018a5
cmp dword [ebp - 0xb4], ebx
jne 0x4018a5
mov ecx, ebx
lea edi, [ebp - 0x13c]
mov esi, section..data
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40185d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4018a5
push 0x4011ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x140], eax
test eax, eax
je 0x4018a5
push 0x4011d8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401899
and dword [ebp - 4], 0
call eax
jmp 0x401895
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00401fc1
ret