joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403011
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x403038
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40303b
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00402fed
pop esi
leave
ret 8

Function at 0x403c8f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403cce
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403cce
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403cce
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403cce
cmp dword [ecx + 0x74], 0xe
jbe 0x403cce
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x404260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x404287
mov ecx, 5
int 0x29
push 2
call fcn.00403d33
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x404392
test esi, esi
jne 0x404392
push 2
call fcn.00403d33
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00403436
mov esp, ebp
pop ebp
ret

Function at 0x4046c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004046f0
mov esi, dword [ebp + 8]
test al, al
je 0x4046de
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.00404700
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40488c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40488c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40488c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40488c
cmp dword [ecx + 0x74], 0xe
jbe 0x40488c
cmp dword [ecx + 0xe8], 0
je 0x40488c
push dword [ebp + 8]
call fcn.00404700
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x4095f0
call fcn.004044d0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x4048c1
push dword [ebp + 8]
call fcn.004046c0
mov esp, ebp
pop ebp
ret

Function at 0x404900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40495c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40495c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40495c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40495c
cmp dword [ecx + 0x74], 0xe
jbe 0x40495c
cmp dword [ecx + 0xe8], 0
je 0x40495c
push dword [ebp + 8]
call fcn.00404700
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x4095f0
call fcn.004044d0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x404991
push dword [ebp + 8]
call fcn.004046c0
mov esp, ebp
pop ebp
ret

Function at 0x4049b0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x4049da
mov eax, 2
pop ebp
ret
push esi
call fcn.004040c0
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x4049fa
jmp dword [eax*4 + 0x404a30]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.004041f0
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4013dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
cmp dword [0x1dddd30], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x401412
push 0
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4192f8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4192fc]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x28], eax
call fcn.004013d2
mov ecx, dword [str.H3L_bB]
mov eax, dword [0x419304]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x1dddd30], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1dddd2c]
cmove eax, edx
xor edx, edx
cmp dword [0x1dddd30], 0x3eb
mov dword [0x1dddd2c], eax
mov eax, dword [0x1ddd71c]
cmove eax, edx
add ecx, ebx
mov dword [0x1ddd71c], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x1dddd30]
xor eax, edx
mov dword [0x1dddd28], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x401546
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1dddd30]
sub edi, eax
cmp ecx, 0xc
jne 0x401554
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.004013d9
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x4015a0
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
jmp 0x401450
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d76d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4187a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408e17
mov dword [ebp - 0x14], eax
cmp dword [0x817b38], esi
jne 0x40d860
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d7ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d940
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d940
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d940
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x817b38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x817b3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x817b40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x817b48], eax
test eax, eax
je 0x40d85d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x817b44], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d885
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d878
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d89a
push 4
pop eax
jmp 0x40d942
cmp dword [ebp - 0x14], esi
je 0x40d89a
push dword [0x817b38]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d87f
mov eax, dword [0x817b44]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d8f8
cmp dword [0x817b48], edi
je 0x40d8f8
push eax
call ebx
push dword [0x817b48]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d8f8
test eax, eax
je 0x40d8f8
call ecx
test eax, eax
je 0x40d8ed
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d8ed
test byte [ebp - 8], 1
jne 0x40d8f8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d928
mov eax, dword [0x817b3c]
cmp eax, edi
je 0x40d925
push eax
call ebx
test eax, eax
je 0x40d925
call eax
mov esi, eax
test esi, esi
je 0x40d925
mov eax, dword [0x817b40]
cmp eax, edi
je 0x40d925
push eax
call ebx
test eax, eax
je 0x40d925
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x817b38]
call ebx
test eax, eax
je 0x40d940
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d942
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004041ee
mov esp, ebp
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100062fa
pop dword [ebp - 0x50]
mov eax, 0x100062fa
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3dbb4
push 0
mov eax, 0xf3095b4d
sub eax, 0xe3081ae9
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xb988dfeb
add ecx, 0x46777aeb
xor edi, edi
add edi, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x50]
mov edx, 0xda32ea21
sub dword [ebp - 0x44], 0x9d0c8aaa
mov esi, dword [ebx]
sub dword [ebp - 0xc], esi
xor esi, edx
mov dword [edi], esi
add dword [ebp - 0x34], ebx
add edi, 0xcb501003
add edi, 0x34aff001
add ebx, 0x1ac9839c
add ebx, 0xe5367c68
loop 0x1000634a
add eax, 0xe054989f
add eax, 0x1facc58c
mov ebx, eax
add eax, 0xb21ea714
add eax, 0x4de158f1
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10022c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004081c
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x484], ebx
cmp byte [esi + 0x28], bl
je 0x10022de1
mov edx, dword [esi + 4]
push ebx
lea eax, [ebp - 0x480]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x480], ebx
call edi
cmp eax, ebx
jne 0x10022d19
call dword [sym.imp.kernel32.dll_GetLastError]
push str.MailSlotRead
push eax
lea ecx, [ebp - 0x47c]
call fcn.1002d1c0
push 0x1005d268
lea eax, [ebp - 0x47c]
push eax
call sub.MSVCR100.dll__CxxThrowException
cmp dword [ebp - 0x480], ebx
jne 0x10022d2a
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.1002d1c0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10036db0
mov edx, dword [esi]
mov edx, dword [edx + 8]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call edx
cmp al, bl
je 0x10022d99
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
mov ecx, esi
call fcn.1002d1c0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10035170
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 4
call sym.AdobeLinguistic.dll_public:_void___thiscall_devtech::RCPtr_struct_devtech::LM_UniString::StringValue_::destructor_void_
cmp dword [ebp - 0x420], 0x10
jb 0x10022dcf
mov edx, dword [ebp - 0x434]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret

Function at 0x1003ba10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
test eax, eax
je 0x1003ba3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003ba3b
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1003ba3b
mov ecx, dword [esp + 4]
nop
cmp dword [eax], ecx
je 0x1003ba3e
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x1003ba30
xor eax, eax
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x1003bc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bc57
push eax
call edi
test eax, eax
jne 0x1003bc8d
push esi
call fcn.1002d1c0
push 0x1003b950
push 0x1006bd64
mov esi, eax
call fcn.1002d1c0
mov eax, dword [0x1006bd68]
add esp, 8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [0x1006bd68]
pop esi
test eax, eax
jne 0x1003bc8a
pop edi
ret
push eax
call edi
pop edi
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x29a09125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x29a09134
pop dword [ebp - 0x38]
mov eax, 0xf16f10f5
add eax, 0x3831803f
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa2bc576c
add dword [ebp - 0x48], 0xab95eddf
mov dword [ebp - 0x44], 0x472719d4
add dword [ebp - 0x44], 0xeb0c3271
mov dword [ebp - 0x40], 0x73a04311
sub dword [ebp - 0x40], 0x2753fee3
mov dword [ebp - 0x3c], 0x45082f80
sub dword [ebp - 0x3c], 0x45082f80
lea eax, [ebp - 0x48]
push eax
mov eax, 0xbd248ffd
add eax, 0x6c7cb08f
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd2a722a1
sub dword [ebp - 0x48], 0x5e34b94b
mov dword [ebp - 0x44], 0x2f7dfdb1
add dword [ebp - 0x44], 0x11ee63c4
mov dword [ebp - 0x40], 0xb0aacc99
sub dword [ebp - 0x40], 0x4d3b602d
mov dword [ebp - 0x3c], 0xc728c96e
sub dword [ebp - 0x3c], 0xc728c96e
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x3749ff5d
add eax, 0xf25740e7
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c1cf
push 0
call eax
mov ecx, 0xf1ed8323
add ecx, 0xe12cc44
mov ebx, eax
mov edx, 0xad16335b
add edx, 0x7c8beca5
add edx, dword [ebp - 0x38]
mov edi, 0xf56702da
add edi, 0xf84b1d9c
add dword [ebp - 0x1c], 0x607deb15
mov esi, dword [edx]
xor dword [ebp - 4], 0xb20acc25
sub esi, edi
add dword [ebp - 0x14], 0x6645ed5e
mov dword [ebx], esi
add dword [ebp - 0x24], edi
add ebx, 0xd9c31b6f
sub ebx, 0xd9c31b6b
add edx, 4
loop 0x29a09256
add eax, 0x70d189e1
add eax, 0x8f2fa68e
mov ebx, eax
add eax, 0xf1ce174f
sub eax, 0xf1ce174a
mov ecx, 0xa7133f9f
sub ecx, 0x7d733f9f
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x100115c6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100115d5
pop dword [ebp - 0x48]
mov eax, 0xb94abd7a
add eax, 0x56b6585b
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x41866
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xb3cb5728
add ecx, 0x4c34f585
mov edx, eax
mov edi, 0x1004ac00
add edi, dword [ebp - 0x48]
mov esi, 0x8d969c2e
add esi, 0xd971715d
sub dword [ebp - 4], 0x549a6ddb
mov ebx, dword [edi]
sub dword [ebp - 0x28], 0xce7f92b3
xor ebx, esi
sub dword [ebp - 0x38], edi
mov dword [edx], ebx
xor dword [ebp - 0x10], 0xe70c9399
add edx, 0x58a81902
sub edx, 0x58a818fe
add edi, 0x21fbe630
add edi, 0xde0419d4
loop 0x10011629
add eax, 0x12587
xor ebx, ebx
add ebx, eax
add eax, 0x7aed3f10
add eax, 0x8512c0f5
mov ecx, 0x9354c187
add ecx, 0x7cab3e79
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.100115c6
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100115c6
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100115c6
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.100115c6
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.100115c6
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret