joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404861
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
xor esi, esi
cmp dword [0x281bb74], 0x400
push edi
jne 0x404943
push esi
call dword [sym.imp.USER32.dll_WindowFromDC]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0x40418c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
push esi
call fcn.004057a0
push esi
push esi
call fcn.004050c9
push esi
call fcn.00405725
add esp, 0x14
push esi
call fcn.00405a3a
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00404c00
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404d80
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405210
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404eb0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405470
fstp st(0)
push esi
call fcn.00405aae
add esp, 0xc
push esi
push esi
call fcn.00404fcd
push esi
call fcn.0040584d
add esp, 0xc
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor edi, edi
cmp edi, 0xacd
jge 0x404969
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45be410
jg 0x40498b
inc edi
cmp edi, 0x33309e9
jl 0x40494b
xor edi, edi
cmp edi, 0x16d2a
jge 0x40499c
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x4049ba
inc edi
cmp edi, 0x3011b
jl 0x40498d
mov eax, dword [0x42dc94]
mov dword [0x281bb74], eax
call fcn.0040456a
mov edi, 0x2ec37
cmp dword [0x281bb74], 0x51f
jne 0x4049e6
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x4049ce
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x407cec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a7dc]
jne 0x407cf6
repz ret
jmp fcn.0040cedc
Function at 0x4111da
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a7dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004066fa
and dword [ebp - 0x14], 0
cmp dword [0x438b64], 0
mov dword [ebp - 0x18], eax
jne 0x41128d
push 0x403e80
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411335
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e74
push ebx
call edi
test eax, eax
je 0x411335
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e64
push ebx
mov dword [0x438b64], eax
call edi
push eax
call esi
push 0x403e50
push ebx
mov dword [0x438b68], eax
call edi
push eax
call esi
push 0x403e34
push ebx
mov dword [0x438b6c], eax
call edi
push eax
call esi
mov dword [0x438b74], eax
test eax, eax
je 0x41128d
push 0x403e1c
push ebx
call edi
push eax
call esi
mov dword [0x438b70], eax
mov eax, dword [0x438b70]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4112e6
cmp dword [0x438b74], ecx
je 0x4112e6
push eax
call esi
push dword [0x438b74]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4112e6
test ebx, ebx
je 0x4112e6
call edi
test eax, eax
je 0x4112dd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4112dd
test byte [ebp - 8], 1
jne 0x4112e6
or dword [ebp + 0x10], 0x200000
jmp 0x411319
mov eax, dword [0x438b68]
cmp eax, dword [ebp - 0x18]
je 0x411319
push eax
call esi
test eax, eax
je 0x411319
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411319
mov eax, dword [0x438b6c]
cmp eax, dword [ebp - 0x18]
je 0x411319
push eax
call esi
test eax, eax
je 0x411319
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x438b64]
call esi
test eax, eax
je 0x411335
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411337
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407cec
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001870
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100076bb
push eax
mov eax, dword [sym.omnithread_rt.dll_int_omni_thread::init_t::count]
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, ecx
mov ecx, eax
inc eax
push esi
push edi
test ecx, ecx
mov dword [sym.omnithread_rt.dll_int_omni_thread::init_t::count], eax
jne 0x100019ca
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x1000b988], eax
jne 0x100018cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0xc]
push 0x10008e70
push edx
mov dword [esp + 0x14], eax
call fcn.1000290a
push 0x18
call fcn.1000249c
add esp, 4
test eax, eax
je 0x100018e2
mov ecx, eax
call sym.omnithread_rt.dll_public:_void___thiscall_omni_mutex::constructor_void_
jmp 0x100018e4
xor eax, eax
push 0x54
mov dword [sym.omnithread_rt.dll_class_omni_mutex__omni_thread::next_id_mutex], eax
call fcn.1000249c
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x10001912
push 1
push 0
mov ecx, eax
call sym.omnithread_rt.dll_protected:_void___thiscall_omni_thread::constructor_void___enum_omni_thread::priority_t_
mov esi, eax
jmp 0x10001914
xor esi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
lea edi, [esi + 0x38]
push 0
push 0
push edi
mov dword [esp + 0x30], 0xffffffff
mov dword [esi + 0x1c], 1
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
pop ebx
jne 0x10001965
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 0x10008e70
push eax
call fcn.1000290a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov ecx, dword [0x1000b988]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10001999
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0xc]
push 0x10008e70
push edx
mov dword [esp + 0x14], eax
call fcn.1000290a
push 1
call sym.omnithread_rt.dll_private:_static_int___cdecl_omni_thread::nt_priority_enum_omni_thread::priority_t_
add esp, 4
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x100019ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push 0x10008e70
push ecx
mov dword [esp + 0x18], eax
call fcn.1000290a
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10001d50
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x10007758
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 0x14], edi
call sym.omnithread_rt.dll_public:_void___thiscall_omni_mutex::lock_void_
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], 0
test eax, eax
je 0x10001da0
mov al, byte [esp + 0xb]
lea ecx, [esp + 0xb]
push 0x10008fe0
push ecx
mov byte [esp + 0x13], al
call fcn.1000290a
lea edx, [esp + 0xc]
push edx
push 4
push esi
push 0x100019e0
push 0
push 0
call fcn.10002ad7
mov ecx, dword [esp + 0x24]
add esp, 0x18
test eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
jne 0x10001de0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x10008e70
push edx
mov dword [esp + 0x18], eax
call fcn.1000290a
mov ecx, dword [esi + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10001e08
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x10008e70
push edx
mov dword [esp + 0x18], eax
call fcn.1000290a
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10001e30
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push 0x10008e70
push ecx
mov dword [esp + 0x18], eax
call fcn.1000290a
mov ecx, edi
mov dword [esi + 0x1c], 1
call sym.omnithread_rt.dll_public:_void___thiscall_omni_mutex::unlock_void_
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x10002ad7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x10002af4
call fcn.100041a6
mov dword [eax], 0x16
xor eax, eax
jmp 0x10002b5e
push esi
push 0x88
push 1
call fcn.10004222
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10002b49
push esi
call fcn.10003d25
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x10002b27
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x10002a33
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10002b5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.100033cb
test ebx, ebx
pop ecx
je 0x10002b5b
push ebx
call fcn.100041af
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002b62
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10002c4a
mov eax, 0x94
call fcn.10004a30
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10002cbf
mov ecx, dword [esi + 0x10]
mov dword [0x1000b9b8], ecx
mov eax, dword [esi + 4]
mov dword [0x1000b9c4], eax
mov edx, dword [esi + 8]
mov dword [0x1000b9c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1000b9bc], esi
je 0x10002bcd
or esi, 0x8000
mov dword [0x1000b9bc], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1000b9c0], eax
call fcn.1000495d
test eax, eax
pop ecx
je 0x10002cbf
call fcn.10003f14
test eax, eax
jne 0x10002bfa
call fcn.100049ae
jmp 0x10002cbf
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1000c194], eax
call fcn.1000481d
mov dword [0x1000b9a4], eax
call fcn.100042e5
test eax, eax
jl 0x10002c43
call fcn.1000477b
test eax, eax
jl 0x10002c3e
call fcn.1000452f
test eax, eax
jl 0x10002c3e
call fcn.10002fb7
test eax, eax
jne 0x10002c3e
inc dword [0x1000b9a0]
jmp 0x10002cd0
call fcn.100044e3
call fcn.10003d07
jmp 0x10002bf0
test eax, eax
jne 0x10002c7a
cmp dword [0x1000b9a0], eax
jle 0x10002cbf
dec dword [0x1000b9a0]
cmp dword [0x1000b9f4], eax
jne 0x10002c69
call fcn.100030e7
call fcn.100044e3
call fcn.10003d07
call fcn.100049ae
jmp 0x10002cd0
cmp eax, 2
jne 0x10002cc3
push 0x88
push 1
call fcn.10004222
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10002cbf
push esi
push dword [0x1000b1e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x10002cb9
call fcn.10003d25
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10002cd0
call fcn.100033cb
pop ecx
xor eax, eax
jmp 0x10002cd3
cmp eax, 3
jne 0x10002cd0
push 0
call fcn.10003da9
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x10004a73
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x1000b410]
je 0x10004a93
inc eax
cmp eax, 0x12
jb 0x10004a84
shl eax, 3
cmp edx, dword [eax + 0x1000b410]
mov dword [ebp + 8], eax
jne 0x10004c31
mov ecx, dword [0x1000b9ac]
cmp ecx, 1
je 0x10004c06
test ecx, ecx
jne 0x10004ac5
cmp dword [0x1000b9b0], 1
je 0x10004c06
cmp edx, 0xfc
je 0x10004c31
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10004b00
push 5
pop ecx
mov esi, str._program_name_unknown_
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004b0f
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x10004b47
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004b27
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x10008600
push ebx
call fcn.10006450
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004b4c
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1000b414]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004b63
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.10004a30
mov edx, esp
push 6
pop ecx
mov esi, str.Runtime_Error__n_nProgram:
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004b8f
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10004b9b
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10004bb4
mov eax, dword [ebp + 8]
mov esi, 0x100085e0
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x1000b414]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004bcf
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10004bdb
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.10006356
add esp, 0xc
jmp 0x10004c31
mov ecx, dword [eax + 0x1000b414]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004c11
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006356
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1000bc84], ebx
push esi
push edi
jne 0x100063d6
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10006411
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x1000bc84], eax
je 0x10006411
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1000bc88], eax
call esi
cmp dword [0x1000b9b8], 2
mov dword [0x1000bc8c], eax
jne 0x100063d6
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1000bc94], eax
je 0x100063d6
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1000bc90], eax
mov eax, dword [0x1000bc90]
test eax, eax
je 0x1000641b
call eax
test eax, eax
je 0x10006402
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1000bc94]
test eax, eax
je 0x10006402
test byte [ebp - 8], 1
jne 0x1000641b
cmp dword [0x1000b9c4], 4
jb 0x10006415
or byte [ebp + 0x12], 0x20
jmp 0x1000643a
xor eax, eax
jmp 0x1000644a
or byte [ebp + 0x12], 4
jmp 0x1000643a
mov eax, dword [0x1000bc88]
test eax, eax
je 0x1000643a
call eax
mov ebx, eax
test ebx, ebx
je 0x1000643a
mov eax, dword [0x1000bc8c]
test eax, eax
je 0x1000643a
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1000bc84]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000705a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.10004a30
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100070ef
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1000b9b8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x100070ef
cmp eax, 1
je 0x10007107
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100070ef
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x100070c4
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x100070eb
xor eax, eax
inc eax
jmp 0x10007123
cmp esi, ebx
jae 0x100070f3
xor eax, eax
jmp 0x10007123
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1000b9b8]
jmp 0x10007109
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100023e5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov byte [ebp - 4], dl
mov dword [ebp - 8], 0x640
cmp dword [ebp - 8], 0x7b9
push 0
pop eax
jle 0x10002446
mov esi, eax
mov edi, esi
mov ebx, 0x4f24
mov eax, edi
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001aa5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002424
mov eax, dword [eax]
push eax
call fcn.1004c12c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1000bdc4
dec edi
dec ebx
jne 0x1000240d
inc esi
cmp esi, 0x32cd
jl 0x10002406
xor eax, eax
cmp byte [ebp - 4], 0
je 0x1000246a
push 0x107e
push eax
push 0x11ad
push eax
push 0x14b7
push 0x1a0d
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x10002478
push 0x9f
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp - 8], 0x50e
jge 0x1000248c
push str.gttol_rkntpd_xazbb_ior_xmotemk_dsq_fuz_wvkop_uftuotqsk_iqsep_hwypk_hzubjmon
call fcn.1004c12c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100037e8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov byte [ebp - 8], dl
test dl, dl
je 0x1000382c
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1000381a
push 0x2a3b
sub esp, 0xc
mov edx, 0x326
xor cl, cl
call fcn.10002d07
add esp, 0x10
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10003839
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10003839
push ebx
push ebx
push 0x1e90
call dword [sym.imp.ADVAPI32.dll_CopySid]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006274
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
cmp byte [ebp + 0x18], 0
mov eax, edx
push esi
push edi
mov dword [esp + 0x10], eax
je 0x10006320
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x100062ac
push 0
push ecx
push ecx
mov edx, 0x1aec
call fcn.10002768
add esp, 0xc
mov dword [esp + 0xc], 0x68e0
cmp dword [esp + 0xc], 0x6920
jle 0x10006308
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x18]
or eax, esi
cdq
push edx
push eax
call fcn.10001aa5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100062dc
mov eax, dword [eax]
push eax
call fcn.1004c12c
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000bdc4
inc edi
cmp edi, 0x28d3
jl 0x100062c2
inc esi
cmp esi, 0x118c
jl 0x100062c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp dword [esp + 0xc], 0x6677
jge 0x100063c6
push str.tokr_yheufnqgt_ribob_jozmu_bckvre_nxfols_vvtzbk_vnlibgtrd_nula_rhez
jmp 0x100063c0
mov dword [esp + 0x14], 0xff7
cmp dword [esp + 0x14], 0x1069
jle 0x10006390
xor esi, esi
xor edi, edi
xor eax, eax
mov dword [esp + 0xc], eax
and eax, edi
lea ecx, [esp + 0x30]
or eax, esi
cdq
push edx
push eax
call fcn.10001aa5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006356
mov eax, dword [eax]
push eax
call fcn.1004c12c
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.1000bdc4
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x6c1f
jl 0x1000633c
inc edi
cmp edi, 0x5670
jl 0x10006336
inc esi
cmp esi, 0x29bb
jl 0x10006334
mov eax, dword [esp + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x100063ac
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0xd017
inc dword [edx]
mov eax, dword [esp + 0x10]
cmp dword [edx], 2
jl 0x1000639b
cmp dword [esp + 0x14], 0xedb
jge 0x100063c6
push str.wjjwunhv_yhdbrc_gopgr_bfj_cpjtrzg_zskmu_qxwdifxg
call fcn.1004c12c
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret