joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b846
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067fa5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000b9f0
mov dword [ebp - 0x28], 0x1b4c
cmp dword [ebp - 0x28], 0xaec
jge 0x1000b98e
lea eax, [ebp - 0x14]
push eax
push 0x10007ed8
call fcn.1004f52b
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x2c], 0
je 0x1000b98e
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x10007edc
call fcn.1004f52b
add esp, 0xc
lea ecx, [ebp - 0x60]
call fcn.1002a597
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
jmp 0x1000b8d6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x30]
jge 0x1000b900
lea eax, [ebp - 0x34]
push eax
push 0x10007ed8
call fcn.1004f52b
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x60]
call fcn.1002a5ac
jmp 0x1000b8cf
cmp dword [ebp - 0x1c], 1
jne 0x1000b939
lea ecx, [ebp - 0x60]
call fcn.1002a5f3
cmp eax, 1
jbe 0x1000b91c
mov dword [ebp - 0x20], 1
jmp 0x1000b920
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
shl eax, 1
xor ecx, ecx
inc ecx
sub ecx, eax
push ecx
push 0x10007ee4
call fcn.1004fe4e
pop ecx
pop ecx
jmp 0x1000b97d
lea ecx, [ebp - 0x60]
call fcn.1002a5f3
mov ecx, dword [ebp - 0x1c]
lea eax, [eax + ecx - 3]
mov ecx, dword [ebp - 0x1c]
dec ecx
xor edx, edx
div ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x1000b961
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
jmp 0x1000b968
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x10007ee4
call fcn.1004fe4e
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.1002a5ca
jmp 0x1000b891
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1000b9cd
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1000b9cb
push 0x1688
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x1000b9ee
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x1000b9ee
push 0x13eb
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1000ba0c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x54]
push 0
push dword [ebp - 0x58]
call fcn.1001af67
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000d245
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000d299
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000d276
push 0x13eb
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x1000d297
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000d297
push 0x20a3
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x1000d2b6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 0x16a1
push dword [ebp - 0x14]
push 0x4949
push 0
call fcn.10022fd6
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1001a66d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001a749
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001a729
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push 8
pop ecx
imul ecx, ecx, 5
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jbe 0x1001a727
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jbe 0x1001a727
push 1
push 0x792d
push 0x93a
push 0x5a51
push 0x50a2
push 1
push 0x4d42
push 0x5629
push 0x424e
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x24]
push dword [eax]
push 1
call fcn.1000efd5
add esp, 0x34
jmp 0x1001a6e0
jmp 0x1001a747
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001a747
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1001a78a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1001a77f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001a77d
push 0xf0e
push 0
push 0
push 0
push 0
push 0x2686
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001a78a
push 0x280
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret
Function at 0x1001b06a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001b0ef
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001b0e1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001b0c2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1001b0df
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1002a571
mov dword [eax], 0x811fc80
jmp 0x1001b0b7
jmp 0x1001b0ed
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x1001b119
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
push 0x7adf
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
call fcn.1000a6e6
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10021e8a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10021ed8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10021eb6
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x10021ed6
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10021ed6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10021ef9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push 0x681b
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.1000b404
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10022b12
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10022b73
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10022b58
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10022b56
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10022b71
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10022b71
push 0xb8b
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x10022b9b
push 1
push 0x70e6
push 0x7cb5
push 0x1dc2
push 0x6239
push 0x254c
push 0x2b25
call fcn.10020c9c
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x10022f37
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10022f68
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0x63bf
push dword [ebp - 0xc]
push 1
call fcn.10022fd6
add esp, 0x10
jmp 0x10022fd2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10022fc8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 3
jmp 0x10022fb2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x10022fc6
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
je 0x10022fc4
jmp 0x10022fc6
jmp 0x10022fa7
jmp 0x10022fd2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10023417
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002342f
push 1
call fcn.100234a6
pop ecx
jmp 0x100234a2
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10023498
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10023479
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10023496
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1002a571
mov dword [eax], 1
jmp 0x1002346e
jmp 0x100234a2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esp, ebp
pop ebp
ret

Function at 0x100238d6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10023923
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 0x6d18
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x6cfb
push 0x568b
call fcn.10023953
add esp, 0x20
jmp 0x1002394f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002393f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002394f
push 0x5ea
push 0x136b
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov esp, ebp
pop ebp
ret
Function at 0x1002bf5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10067f55
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x1002c081
cmp byte [ebx + 0x45], 0
je 0x1002c081
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1002bfa7
xor al, al
jmp 0x1002c083
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.1002d601
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1002c00c
dec eax
je 0x1002c010
dec eax
dec eax
je 0x1002c06e
xor bl, bl
jmp 0x1002c070
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x1002c04f
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10050700
add esp, 0x10
cmp esi, eax
jne 0x1002c008
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x1002c06e
test esi, esi
jne 0x1002bfd2
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.1002b5f2
jmp 0x1002bfca
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1002b863
mov al, bl
jmp 0x1002c083
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037fb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10068d3c
call fcn.100678b8
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x169f
cmp dword [ebp - 0x18], 0x19d9
push edi
mov dword [ebp - 0x10], esp
jle 0x10038019
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x10659e90
xor eax, esi
cdq
push edx
push eax
call fcn.1002a368
inc esi
cmp esi, 0xd4a
jl 0x10037fe7
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0xbe0
jl 0x10037fda
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xee0
jl 0x10037fd8
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x165c
jge 0x10038035
mov edx, 0x10008418
mov ecx, 0x10659e90
call fcn.1002f64f
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100380f7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10068d50
call fcn.100678b8
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x24dd
cmp dword [ebp - 0x1c], 0x27ca
push edi
mov dword [ebp - 0x10], esp
jle 0x10038169
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0x1a72
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10659e90
xor eax, edi
cdq
push edx
push eax
call fcn.1002a368
dec esi
dec dword [ebp - 0x14]
jne 0x1003812d
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x502b
jl 0x10038123
inc ebx
cmp ebx, 0x4ebb
jl 0x1003811e
inc edi
cmp edi, 0x6881
jl 0x1003811c
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x21c0
jge 0x10038185
mov edx, 0x100084f0
mov ecx, 0x10659e90
call fcn.1002f64f
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10063e15
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006e750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10053b08
mov dword [ebp - 0x14], eax
cmp dword [0x1065af70], esi
jne 0x10063f08
push 0x800
push esi
push 0x10007d6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10063e95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10063fe8
push esi
push esi
push 0x10007d6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10063fe8
push 0x10007d84
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10063fe8
push eax
call ebx
push 0x10007d90
push edi
mov dword [0x1065af70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007da0
push edi
mov dword [0x1065af74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007db4
push edi
mov dword [0x1065af78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065af80], eax
test eax, eax
je 0x10063f05
push 0x10007dd0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065af7c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10063f2d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10063f20
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10063f42
push 4
pop eax
jmp 0x10063fea
cmp dword [ebp - 0x14], esi
je 0x10063f42
push dword [0x1065af70]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10063f27
mov eax, dword [0x1065af7c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10063fa0
cmp dword [0x1065af80], edi
je 0x10063fa0
push eax
call ebx
push dword [0x1065af80]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10063fa0
test eax, eax
je 0x10063fa0
call ecx
test eax, eax
je 0x10063f95
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10063f95
test byte [ebp - 8], 1
jne 0x10063fa0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10063fd0
mov eax, dword [0x1065af74]
cmp eax, edi
je 0x10063fcd
push eax
call ebx
test eax, eax
je 0x10063fcd
call eax
mov esi, eax
test esi, esi
je 0x10063fcd
mov eax, dword [0x1065af78]
cmp eax, edi
je 0x10063fcd
push eax
call ebx
test eax, eax
je 0x10063fcd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065af70]
call ebx
test eax, eax
je 0x10063fe8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10063fea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10051a61
mov esp, ebp
pop ebp
ret
Function at 0x403512
Capabilities:
Terminate process

Disassembly:
jmp 0x4528d4
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4528e5
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405763
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40362a
Capabilities:
Query environment variable

Disassembly:
jmp 0x499e14
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x499e25
pop esi
ret
push ebx
push edi
push esi
call fcn.00499cfb
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403eae
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x499e4d
push ebx
push esi
push edi
call fcn.00405560
add esp, 0xc
push 0
call fcn.0040605f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x405619
Capabilities:
Parse pe header

Disassembly:
jmp 0x441581
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4415c0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4415c0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4415c0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4415c0
cmp dword [ecx + 0x74], 0xe
jbe 0x4415c0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43f926
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00403684
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x43f965
sub eax, 1
je 0x43f960
sub eax, 1
je 0x43f95c
xor eax, eax
leave
ret
push 3
jmp 0x43f967
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x4844c9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x484508
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x484508
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x484508
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x484508
cmp dword [ecx + 0x74], 0xe
jbe 0x484508
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x493cf6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401d4d
mov eax, dword [0x4cb040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405c8b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x493d38
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x493e94
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00405dd5
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4ce940]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004031c0
mov ecx, dword [esi*4 + 0x4ce940]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x493e8d
cmp eax, dword [ecx + edi + 0x24]
jne 0x493e8d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x493e8d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004031c0
add esp, 0x14
test edx, edx
jl 0x493e8d
jg 0x493e03
test eax, eax
jb 0x493e8d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x493e8d
jl 0x493e1d
cmp dword [ebp - 0x1008], eax
ja 0x493e8d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x493e3b
test ebx, ebx
je 0x493e74
cmp ecx, edi
jae 0x493e74
mov al, byte [ecx]
cmp al, 0xd
jne 0x493e55
lea eax, [edi - 1]
cmp ecx, eax
jae 0x493e61
cmp byte [ecx + 1], 0xa
jne 0x493e61
inc ecx
jmp 0x493e61
movzx eax, al
movsx eax, byte [eax + 0x4cb3a8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x493e3b
cmp edx, ebx
jne 0x493e3b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x493e92
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00402fa4
leave
ret