joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e791
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x41279f
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x2ebf6875
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x78c82301
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6acf4e79
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4e472c26
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1000665f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1005c078
call fcn.1005b9d8
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x14], 0x3c8
mov ebx, edx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x14], 0x4fa
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ecx
jle 0x100066b5
mov edi, esi
mov ebx, esi
mov esi, 0x6a5
mov eax, ebx
mov ecx, 0x10077e58
cdq
push edx
push eax
call fcn.100030bc
add ebx, edi
dec esi
jne 0x10006695
inc edi
cmp edi, 0x4644
jl 0x1000668e
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x18f
jge 0x100066f1
mov edx, str.krysppkrn_jestjzj_pvarseh
mov ecx, 0x10077e58
call fcn.1000530a
jmp 0x100066f1
cmp byte [ebp + 0xc], 0
je 0x10006709
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0
je 0x1000671f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1000671f
cmp byte [ebx], 0
je 0x1000671f
push esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push esi
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006c68
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [ebp + 8], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
je 0x10006d1e
mov dword [ebp - 8], 0x6f0d
cmp dword [ebp - 8], 0x71ef
jle 0x10006cf5
xor esi, esi
mov dword [ebp - 4], esi
xor edi, edi
mov ecx, edi
mov dword [ebp - 0xc], esi
xor ebx, ebx
sar esi, cl
mov ecx, ebx
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006cbe
mov eax, dword [eax]
push eax
call fcn.1004434f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100035c0
inc ebx
cmp ebx, 0xf4c
jl 0x10006ca3
mov esi, dword [ebp - 4]
inc edi
cmp edi, 0x4967
jl 0x10006c9a
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x75b7
jl 0x10006c98
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
je 0x10006d04
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 8], 0x6e17
jge 0x10006d96
push str.etopmnltn_hawurecvz_thr_odza
call fcn.1004434f
pop ecx
jmp 0x10006d96
mov edi, dword [ebp + 0x1c]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [ecx]
mov eax, dword [edi]
cmp eax, ecx
mov ecx, dword [edi]
mov eax, dword [edi]
setg bl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esi]
mov esi, dword [ebp + 0x10]
setg dl
xor eax, eax
cmp edx, ebx
setg al
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [edi]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp + 0x24]
setge bl
xor ecx, ecx
mov eax, dword [eax]
cmp ebx, eax
mov eax, 0xffff
setle cl
cmp eax, ecx
mov eax, dword [esi]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x10]
setne cl
xor eax, eax
sub edx, ecx
mov ecx, dword [ebp - 0xc]
cmp edx, 0x600d5493
setle al
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007a17
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1005c0fa
call fcn.1005b9d8
sub esp, 0x3c
push ebx
push esi
mov dword [ebp - 0x24], 0x5503
mov eax, edx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x24], 0x5598
mov dword [ebp - 0x20], eax
jle 0x10007a98
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [ebp - 0x14], esi
and eax, ebx
lea ecx, [ebp - 0x44]
or eax, edi
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007a63
mov eax, dword [eax]
push eax
call fcn.1004434f
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.100035c0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5bf7
jl 0x10007a4a
inc ebx
cmp ebx, 0xeae
jl 0x10007a45
inc edi
cmp edi, 0xed5
jl 0x10007a43
mov eax, dword [ebp - 0x20]
cmp byte [ebp + 8], 0
je 0x10007ad1
push 0x1313
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp - 0x24], 0x54f6
jge 0x10007ac0
push str.zxiwbz_nxkbizdh_lsnoeardc_vsllximm_tupqdloe_nyepvya_ffpdtif_hltpiyo
call fcn.1004434f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax], 0
je 0x10007aac
mov dword [ebp - 0x20], 0x4a81
cmp dword [ebp - 0x20], 0x4b54
jle 0x10007b50
mov dword [ebp - 0x14], esi
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], esi
mov ecx, ebx
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
sar edi, cl
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10077e58
and eax, esi
cdq
push edx
push eax
call fcn.100030bc
inc ebx
cmp ebx, 0x785f
jl 0x10007b03
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
push 0
pop esi
cmp ebx, 0x5e3f
jl 0x10007af3
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x45dc
jl 0x10007aee
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x750e
jl 0x10007ae9
call fcn.10011b64
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x4a5f
jge 0x10007aac
mov edx, str.urisxwne_ttuqofkf_ttr_fcf_exttbac_ligahgs_fkkbyryf_tpuxj_ufjenxeok_ccj_kmihpjx
mov ecx, 0x10077e58
call fcn.1000530a
jmp 0x10007aac
Function at 0x10007f52
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1005c116
call fcn.1005b9d8
sub esp, 0x10
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10007ff1
mov dword [ebp - 0x18], 0x2b70
cmp dword [ebp - 0x18], 0x2e22
jle 0x10007fa5
xor esi, esi
xor edi, edi
mov ebx, 0x4954
mov eax, edi
mov ecx, 0x10077e58
cdq
push edx
push eax
call fcn.100030bc
add edi, esi
dec ebx
jne 0x10007f88
inc esi
cmp esi, 0x79d7
jl 0x10007f81
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10007fb9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2a30
jge 0x10007fd5
mov edx, str.yhjctmo_ngrg_lyrjoyg
mov ecx, 0x10077e58
call fcn.1000530a
jmp 0x10008014
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10008014
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [edx]
cmp dword [edx], 2
jl 0x10008002
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100086df
Capabilities:
Get memory capacity

Disassembly:
mov eax, 0x1005c12a
call fcn.1005b9d8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
test cl, cl
je 0x1000875e
cmp byte [ebp + 0x14], 0
je 0x1000872a
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10008818
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x1febaeef
inc dword [edx]
cmp dword [edx], 1
jl 0x10008713
jmp 0x10008818
mov esi, dword [ebp + 0x1c]
xor ebx, ebx
mov eax, dword [esi]
cmp dword [esi], ebx
je 0x10008736
inc ebx
mov eax, dword [esi]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [edi]
sete cl
xor edx, edx
cmp ecx, 0x725245f5
setg dl
mov dword [eax], edx
mov eax, dword [esi]
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x10008818
mov dword [ebp - 0x18], 0x74f9
xor ebx, ebx
cmp dword [ebp - 0x18], 0x769b
jle 0x100087a0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10077e58
cdq
push edx
push eax
call fcn.100030bc
inc edi
cmp edi, 0x60f9
jl 0x1000877b
inc esi
cmp esi, 0x529f
jl 0x10008779
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x73d4
jge 0x100087bb
mov edx, str.wrd_xsnaz_vrbucpqmk_gssfhdyl_dauvuryv_wfrtamp_abkkmbc_ffn
mov ecx, 0x10077e58
call fcn.1000530a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x20], 0
je 0x10008804
mov edx, dword [ebp + 0x18]
mov dword [edx], ebx
cmp dword [edx], 2
jge 0x10008818
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], ebx
inc dword [edx]
cmp dword [edx], 2
jl 0x100087d2
jmp 0x10008818
push 1
push 0x5e63
lea ecx, [ebp - 0x11]
mov byte [ebp - 0x11], bl
call fcn.10007ba1
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008a07
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005c134
call fcn.1005b9d8
sub esp, 0x1c
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10008a5e
cmp byte [ebp + 8], 0
je 0x10008a3a
push 0
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
call fcn.10007a17
pop ecx
jmp 0x10008b61
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x12], 0
je 0x10008b61
push 0
push 0xf3a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10008b61
cmp byte [ebp + 0x14], 0
je 0x10008b32
mov dword [ebp - 0x20], 0x4d3a
cmp dword [ebp - 0x20], 0x4e89
jle 0x10008acb
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], 0x149b
mov dword [ebp - 0x18], eax
or eax, edi
mov ecx, 0x10077e58
or eax, esi
cdq
push edx
push eax
call fcn.100030bc
mov eax, dword [ebp - 0x18]
add eax, ebx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x10008a8a
inc ebx
cmp ebx, 0x6b67
jl 0x10008a7e
inc edi
cmp edi, 0x2a5d
jl 0x10008a7c
inc esi
cmp esi, 0x8c1
jl 0x10008a7a
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4a66
jge 0x10008ae7
mov edx, str.ipeyfzfi_cinohh_vtrhx_ujoqksh_lwpxjyfa_puyew_dvvpeg_sajb_ucx
mov ecx, 0x10077e58
call fcn.1000530a
mov ecx, dword [ebp + 0x18]
xor ebx, ebx
mov eax, dword [ecx]
mov eax, dword [ecx]
cmp eax, 1
mov eax, dword [ecx]
setge bl
xor edx, edx
cmp eax, 0xa5fe
mov eax, dword [ebp + 0x10]
setge dl
xor ecx, ecx
sub edx, ebx
mov eax, dword [eax]
cmp edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
setl cl
mov dword [eax], ecx
jmp 0x10008b61
mov dword [esi], 0xffffffed
jmp 0x10008b5c
push ecx
push 0x356
push ecx
mov dword [ebp - 0x24], 1
lea edx, [ebp - 0x24]
push 0x174
xor cl, cl
call fcn.10009053
add esp, 0x10
dec dword [esi]
cmp dword [esi], 0xffffffe6
jl 0x10008b3a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100091a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov byte [ebp - 8], dl
mov dword [ebp - 0x10], 0x38b
cmp dword [ebp - 0x10], 0x69d
push esi
push edi
jle 0x10009212
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x28]
or eax, esi
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100091df
mov eax, dword [eax]
push eax
call fcn.1004434f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100035c0
inc ebx
cmp ebx, 0x35e
jl 0x100091c2
inc edi
cmp edi, 0x4473
jl 0x100091c0
inc esi
cmp esi, 0x25c4
jl 0x100091be
call fcn.10011c6f
cmp byte [ebp - 8], 0
je 0x10009253
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10009263
push 0x1a35
push 0x7e7f
push 1
push 0x63e7
push 0x961
push 0x2e44
push 1
push 0x3a04
mov dl, 1
mov ecx, 0x35e8
call fcn.1000643a
add esp, 0x20
jmp 0x10009263
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x10009263
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [ebp - 0x10], 0xd6
jge 0x10009277
push str.ealpy_hjzl_ishzfnt_fzmtfkjw
call fcn.1004434f
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009715
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c15c
call fcn.1005b9d8
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], cl
je 0x10009823
test dl, dl
je 0x1000981c
mov dword [ebp - 0x20], 0x49ac
cmp dword [ebp - 0x20], 0x4c68
jle 0x100097b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp + 8], edi
xor ebx, ebx
and dword [ebp - 0x24], 0
mov eax, edi
cdq
idiv ebx
lea edi, [edx + esi]
mov esi, dword [ebp - 0x24]
mov eax, edi
mov ecx, 0x10077e58
xor eax, esi
cdq
push edx
push eax
call fcn.100030bc
inc esi
cmp esi, 0x789a
jl 0x10009778
mov esi, dword [ebp - 0x1c]
inc ebx
mov edi, dword [ebp + 8]
cmp ebx, 0x5642
jl 0x10009769
inc edi
mov dword [ebp + 8], edi
cmp edi, 0x28fe
jl 0x10009767
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5bb0
jl 0x10009762
mov byte [ebp + 0xb], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x498c
jge 0x100097d9
mov edx, str.yhohirr_uyelxsiu_wyvsniql_twhnknw_qwzwz_hhnqmjpe_iyeqhj_zqcngvotq_pgzl_awtpyj_zvrph_nmaqz
mov ecx, 0x10077e58
call fcn.1000530a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xb], 0
je 0x10009854
push 1
push 0x66b1
push 0x6fd4
push 0x248b
xor dl, dl
mov cl, 1
call fcn.1000808e
add esp, 0x10
jmp 0x10009854
mov eax, dword [ebp + 0xc]
inc dword [eax]
jmp 0x10009854
test cl, cl
je 0x1000984c
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10009854
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x91a049fe
inc dword [edx]
cmp dword [edx], 1
jl 0x10009838
jmp 0x10009854
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009865
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
push esi
push edi
mov byte [ebp - 4], dl
mov byte [ebp - 8], cl
je 0x100098cf
test cl, cl
je 0x100098b1
xor eax, eax
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], al
je 0x1000990d
push eax
push 0x38d0
push 0x4d91
push eax
push 0x190a
push 0x7eae
mov dl, 1
mov ecx, 0x2aa8
call fcn.10008947
add esp, 0x18
jmp 0x1000990d
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1000990d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x1000990d
test dl, dl
je 0x100098e7
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1000990d
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1000990d
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
jmp 0x10009907
mov ecx, dword [esi]
lea eax, [ecx + 2]
mov dword [esi], eax
call fcn.10005e61
mov ecx, dword [ebp + 0xc]
movzx eax, ax
push eax
call fcn.1000f1f7
mov eax, dword [esi]
cmp eax, dword [edi]
jb 0x100098ef
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a9c1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 8], cl
push ebx
push esi
test cl, cl
je 0x1000aaca
mov dword [ebp - 0x18], 0x1640
cmp dword [ebp - 0x18], 0xe86
jge 0x1000aaa8
jmp 0x1000aa88
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1000aaa8
lea eax, [ebp - 0xc]
push eax
push ecx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.1000f00e
pop ecx
mov ecx, eax
call fcn.1000f00e
test esi, esi
jle 0x1000aa8d
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push eax
push ecx
lea eax, [ebp - 0x10]
mov ecx, 0x10077f78
push eax
call fcn.1000f00e
pop ecx
mov ecx, eax
call fcn.1000f00e
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], ebx
jge 0x1000aa49
cmp eax, dword [ebp - 0xc]
jle 0x1000aa46
mov edx, 0x1006583c
jmp 0x1000aa74
cmp dword [ebp - 0x10], ebx
jle 0x1000aa60
cmp eax, dword [ebp - 0xc]
jle 0x1000aa57
mov edx, 0x100667d4
jmp 0x1000aa74
jge 0x1000aa60
mov edx, 0x100667d8
jmp 0x1000aa74
cmp dword [ebp - 0x10], ebx
jge 0x1000aa6f
mov edx, 0x100667dc
cmp eax, dword [ebp - 0xc]
jl 0x1000aa74
mov edx, str.divisa
mov ecx, 0x10077e58
call fcn.1000530a
push eax
call fcn.10011102
pop ecx
dec esi
jne 0x1000aa17
mov ebx, 0x10077f78
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1000f00e
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x1000a9ed
push 1
push 0x2caa
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
mov dl, 1
push 0x1405
push eax
mov cl, dl
call fcn.1000808e
add esp, 0x10
jmp 0x1000aada
push 0xb47
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ab40
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], cl
test dl, dl
je 0x1000ab83
cmp byte [ebp + 0x10], 0
je 0x1000ab73
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000ab9c
push 0
push 1
push 1
mov edx, 0x1ba5
mov ecx, 0x7daa
call fcn.100095c9
add esp, 0xc
jmp 0x1000ab9c
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000ab9c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1000ab9c
test cl, cl
je 0x1000ab92
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
jmp 0x1000ab9c
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
mov esp, ebp
pop ebp
ret
Function at 0x100149a4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c57c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10014b58
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 0x2ab3
mov dword [ebp - 0x30], str.nrlnrqg_rxoqckp_rfa_chx
cmp dword [ebp - 0x24], 0x2cc2
jle 0x10014ad1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and dword [ebp - 0x20], 0
jmp 0x10014a10
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x75ad
jge 0x10014aaf
and dword [ebp - 0x1c], 0
jmp 0x10014a2a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3553
jge 0x10014aaa
and dword [ebp - 0x14], 0
jmp 0x10014a40
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6203
jge 0x10014aa5
and dword [ebp - 0x18], 0
jmp 0x10014a56
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x43e
jge 0x10014aa3
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
and ecx, dword [ebp - 0x20]
mov eax, ecx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10001a84
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000309c
push eax
call fcn.1004434f
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.10003092
jmp 0x10014a4f
jmp 0x10014a39
jmp 0x10014a23
jmp 0x10014a09
push 0
push 0
push 0x11d0
push 0
push 0x2544
push 0
push 0x1fc6
push 0xbff
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2a89
jge 0x10014aed
push dword [ebp - 0x30]
call fcn.1004434f
pop ecx
jmp 0x10014b09
or dword [ebp - 4], 0xffffffff
jmp 0x10014b13
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10014b36
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
jmp 0x10014b56
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x10014b56
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10014b75
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push 0x417c
push 0
push dword [ebp - 0x4c]
push 0x1fa2
call fcn.10013355
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret