joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e037e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051386e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e04a1
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffb9e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e04b8
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffaae
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ffc8e
Capabilities:
Encode data using xor

Disassembly:
les edx, [esi]
insb byte es:[edi], dx
mov bh, 0xe4
push ss
inc esp
or dword [edi - 0x24], ebx
jb 0x4ffcc2
mov ch, 0x89
cli
invalid
jns 0x4ffcda
push edi
into
invalid
push 0xc
push es
sbb ch, byte [edx + ebp - 0x4576c075]
mov ecx, 0xffb91c81
cmp byte [esi + 0x6c32dac2], 0x1e
aas
mov dword [edx - 0x46e37e47], edi
inc dword [eax + 0x32dac2be]
insb byte es:[edi], dx
push ds
sub eax, 0xb75bc778
and cl, dl
insd dword es:[edi], dx
adc ah, byte [ebp - 0x35]
test al, 0x44
les ebx, [eax - 0x2f]
xchg ebx, eax
add edi, dword [edx + 0x46]
nop
fadd dword [ecx]
lodsb al, byte [esi]
or al, 0x8f
xor ecx, eax
inc edi
jp 0x4ffce1
psubsb mm7, qword [edx + 0x1345aaa]
ja 0x4ffd1a
or bh, byte [edi + edx - 0xdb87308]
push esp
or ah, byte [ebx - 0x5ed0a16d]
sub esp, dword [edi + 0x300fd707]
add eax, 0x91880864
and eax, 0xde116d3
add dl, cl
xor byte [ebx + 0x45], bl
cmp al, byte [esi]
adc byte [edi], 0xa8
popal
and eax, 0x932891ca
lahf
invalid
Function at 0x50ad1e
Capabilities:
Encode data using xor

Disassembly:
clc
jle 0x50acc1
test byte [0xb4a86d6a], dh
dec eax
fstp xword [ebp + 0x4d1c36f4]
adc eax, 0xf4aa62ff
dec eax
adc dh, byte [esi + ebx]
push edx
dec ebx
leave
retf 0xdd84
imul esp, dword [0x6ab54cf9], 0x3b
fbstp tbyte [edx + esi*4 + 0x5d]
test al, 0x9d
xor byte [eax + 0x3b], 0x80
test al, 0x30
ficom dword [esi - 0x25]
fild qword [eax - 0x70]
invalid
xchg ebx, eax
push cs
aam 0x7e
sub ah, byte [ecx - 0x1e7373e6]
sahf
in eax, dx
invalid
sbb cl, byte [esp + ecx*4 - 0xf12611f]
jo 0x50acfc
xchg dword [ecx], edx
js 0x50ac9e
rcr dl, 0xd2
lock or byte [edx], bl
jns 0x50ad8d
jno 0x50ad02
daa
sub ecx, edi
dec edx
jecxz 0x50ad0d
stosd dword es:[edi], eax
pop dword [esi - 0x3277cc71]
ret
pop eax
wait
sub bl, bl
lcall 0xefb3, 0xffeb2027
out dx, eax
dec ebx
dec eax
sub dword [eax + 0x39], ecx
aas
push esp
cmp dl, bl
mov ch, 0xb8
inc ebp
pop ebx
sub byte [edi - 5], ch
pushal
stosd dword es:[edi], eax
sar byte [esi + 0x484bea9a], 0xe7
jle 0x50ad83
push esp
fidivr dword [edi + 0x44]
movsd dword es:[edi], dword [esi]
in eax, dx
or edi, dword [ebx + 0x7423c821]
dec ecx
test byte [esi - 0x46], 0x6a
shr dword [esi], cl
out dx, eax
ljmp 0x7bc4

Function at 0x529aae
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cf9e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529bd1
push ecx
lea ecx, [esi + 0x18]
call 0x5492ce
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529be8
push ecx
lea ecx, [esi + 0x24]
call fcn.005491de
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55ccce
Capabilities:
Encode data using xor

Disassembly:
pop ds
movsb byte es:[edi], byte [esi]
jecxz 0x55cd26
js 0x55cd50
inc edi
dec ebp
pop esi
pushfd
inc ecx
movsb byte es:[edi], byte [esi]
dec ecx
pop ecx
sbb byte [edi + 0x16], dh
push 0xbffdffac
and dword [edx - 0x67], edx
mov ebp, 0xada789f5
aaa
mov ch, 0x5b
pop esp
dec ecx
rcl dword [ecx], cl
je 0x55cd45
inc ecx
nop
cmp byte [edx], dh
xor al, 0x39
into
pop ss
cmp al, 0xc5
dec eax
invalid
xchg edx, eax
pop ss
fstp xword [edx - 0x250f4651]
add ah, byte [esi - 0x49]
aad 0x75
sahf
dec ebp
invalid
mov ebp, 0x30adc9d5
sub dword [edx], 0x269a1d92
arpl word [0x6ee35e98], bp
push es
and dh, byte [ebx + 0x4a1b1b07]
outsb dx, byte [si]
pop ecx
fld st(1)
loopne 0x55cd91
clc
lodsb al, byte [esi]
xor eax, 0xe0ec6f73
std
xchg ecx, eax
scasb al, byte es:[edi]
sub dword [ebx + 0x7a662837], edx
inc edx
push 4
nop
daa
sbb esp, dword [ecx]
xor edi, esp
jl 0x55cd65
adc al, 0xd3
enter 0x4db2, 0x77
in eax, dx
xor al, 0x2c
cdq
loop 0x55cd9a
mov edi, 0xf687f6e9
add byte [ecx - 0x63], bl
pop ecx
popfd
dec esp
push 0xffffffffffffffac
pop edx
sar byte [esi], 1
cmc
daa
invalid

Function at 0x5730be
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a65ae
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5731e1
push ecx
lea ecx, [esi + 0x18]
call fcn.005928de
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5731f8
push ecx
lea ecx, [esi + 0x24]
call 0x5927ee
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5926be
Capabilities:
Encode data using xor

Disassembly:
adc edx, dword [ecx - 0x4b]
xor eax, 0xc484e723
sub ecx, edx
jb 0x59271e
pop edi
invalid
into
movsb byte es:[edi], byte [esi]
or dword [ebp - 0x66], edx
popal
clc
int1
clc
nop
dec edx
iretd
Function at 0x5db6ee
Capabilities:
Check for vm using instruction vpcext

Disassembly:
daa
in al, 0x82
xchg byte [edx + 0x31], bh
mov byte [0x785e7ae7], al
adc ch, byte [eax - 0x1d1f8022]
lahf
pop ebx
pop ss
cli
push es
or ch, byte [edi]
add edx, dword [esi + 0x38]
push edi
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
or edi, dword [edi + 0x72]
jns 0x5db773
je 0x5db734
push es
xor ah, byte [ecx + 0x3e7081b4]
ljmp 0xe59c
adc eax, 0xb360f1a2
das
mov bl, 0x2f
adc ecx, ebx
mov cl, byte [ebx - 0x9494d6a]
fdivrp st(5)
cmp dh, byte [ebx - 0x40]
or byte [esi + 0x64b0ab3d], dl
dec esp
aaa
pop es
jns 0x5db6ed
and al, 0xc1
jae 0x5db730
adc al, 0xef
sub esp, dword [edx]
add ch, byte [edi + ebx*8]
push ebx
rep stosb byte es:[edi], al
sal byte [edx - 0x28], 1
mov al, byte [0x3af8a197]
nop
inc edx
pop ss
push ss
int1
clc
cmp dl, byte [eax - 0xee9e8be]
push es
mov byte [0xd50744c8], al
add dh, byte [ecx]
xchg esp, eax
xor bh, byte [edi - 0x4f694ae4]
add byte [ebp - 0x4e7571ae], 0xc1
mov eax, dword [0x6112761f]
sub al, 0x86
sub dword [edx + 0x1b], esp
or ch, dh
fcomp qword [0x2151]
cdq
push ebp
xor dword [esi - 0x7ededd9c], 0xffffffdd
jmp 0x5db7ce
adc ebp, ecx
mov dl, byte [0x976ee8af]
sub al, 0x3d
add cl, dl
fist dword [ecx - 0x3a]
mul dword [edi - 0xdf7390a]
loop 0x5db7bf
mov al, byte [0x26bfe58c]
adc eax, 0xe50aa26
in eax, 0xbf
adc eax, 0xe50aa26
inc edi
xor edx, dword [esi - 0x7f]
mul dl
xchg ebx, eax
loop 0x5db763
jbe 0x5db82c
and dword fs:[edx - 0x25403d55], esp
les bp, [edi + esi*8 - 5]
push ss
loop 0x5db804
rcl dword [edi], cl
add esp, dword [eax - 0xc]
lodsb al, byte [esi]
push es
pushal
adc al, byte [edi + 0x3e2b6022]
mov dl, 0x8b
xchg ebx, eax
in eax, 0xbc
ja 0x5db7a6
enter 0xfffffffffffffb55, 0xffffffffffffffd2
or eax, 0x2f60e1ea
cmpsd dword [esi], dword es:[edi]
cwde
xchg esi, eax
and dh, byte [0x13eb3522]
xor eax, 0x13eb3522
pop ebx
rol byte [ebx + edi*2 + 0x60], cl
invalid
ror dword [ebp + edi*2 + 0x70], cl
sahf
std
adc dl, byte [ebx - 0x52e9de64]
dec esp
arpl word [eax], si
push eax
iretd

Function at 0x630a6e
Capabilities:
Encode data using xor

Disassembly:
inc esi
add byte [ecx + 0x7d], ch
mov dh, 0x8e
inc esp
out dx, eax
out dx, al
fidiv dword [ecx]
cmp dword [ecx], esi
mov bl, 0x52
cmpsb byte [esi], byte es:[edi]
cmc
sub esp, dword [ecx]
dec eax
loop 0x630aaf
invalid
jbe 0x630b2f
push 0xc763f4b
adc dword [ecx - 0x59], eax
popfd
xlatb
sub al, 0xc2
inc esp
adc edx, edi
dec edx
lahf
jne 0x630b2f
mov al, byte [eax]
push 0xe8b03912
pushal
xchg di, ax
jb 0x630b2c
invalid
invalid
xchg edx, eax
shl byte [ebp - 0x39], 1
dec edi
rol edi, 1
test eax, 0x371aae57
xor byte [esi - 0x63], cl
add eax, 0xf31f03cc
adc ecx, ecx
add dword [eax + 0x29], ecx
outsd dx, dword [esi]
int3
Function at 0x64d9fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6563a8
cmp edx, dword [eax]
je 0x64da1f
add eax, 8
inc ecx
cmp eax, 0x656438
jl 0x64da10
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6563a8]
jne 0x64db4d
mov eax, dword [0xa59d00]
cmp eax, 1
je 0x64db27
test eax, eax
jne 0x64da50
cmp dword [0x6562d4], 1
je 0x64db27
cmp edx, 0xfc
je 0x64db4d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64da87
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e3e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e870
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64daca
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e870
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652b4c
push edi
call fcn.00650740
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e3e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e3f0
lea eax, [ebp - 0xa0]
push 0x652b2c
push eax
call fcn.0064e3f0
push dword [esi + 0x6563ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e3f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006506b4
add esp, 0x2c
pop edi
jmp 0x64db4d
lea eax, [ebp + 8]
lea esi, [esi + 0x6563ac]
push 0
push eax
push dword [esi]
call fcn.0064e870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4073f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add esp, 0xfffffffc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x38]
call sub.msvcrt.dll__read
leave
ret

Function at 0x40aac4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40aae9
mov dword [0x413164], eax
add esp, 0xfffffff8
push 0x40aa88
push eax
call fcn.0040f2ec
jmp 0x40aaee
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40ab04
mov dword [0x41231c], 0x40abe8
jmp 0x40ab0e
mov dword [0x41231c], 0x40ab9c
leave
ret
Function at 0x10001527
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x100389dc
push eax
call fcn.1001f6e0
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10001671
push dword [ebp - 0x78]
jmp 0x10001676
push 0x100389e4
push 0x20
push eax
call fcn.1001f6e0
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14
Function at 0x10007dfb
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x10039320
push eax
call fcn.1001f6e0
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10007f45
push dword [ebp - 0x78]
jmp 0x10007f4a
push 0x10039328
push 0x20
push eax
call fcn.1001f6e0
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14

Function at 0x10008ee6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f34
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10008f45
push 0xd
pop eax
jmp 0x10008f6f
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10008f48
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x1000c26f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1001f6e0
mov ebx, eax
cmp ebx, esi
je 0x1000c2e2
lea ecx, [ebp - 0x74]
call fcn.1000135a
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000c2fa
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000c26f
cmp eax, esi
jne 0x1000c32c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000c2ea
lea ecx, [ebp - 0x74]
call fcn.1000135a
push dword [ebp - 0x78]
mov ecx, edi
call fcn.10008dd7
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.1000135a
mov eax, esi
jmp 0x1000c2c8