joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0xe
push 0xa86f8bb2
mov edx, 0xf
mov edi, ecx
call fcn.004052c0
add esp, 8
push 0
push 2
call eax
mov ebx, eax
mov dword [ebp - 0x250], ebx
test ebx, ebx
je 0x41b57c
push 0xd
push 0x5e57b014
mov edx, 0xf
mov dword [ebp - 0x230], 0x22c
call fcn.004052c0
add esp, 8
lea ecx, [ebp - 0x230]
push ecx
push ebx
call eax
test eax, eax
jne 0x41b3d2
push 0x5b
push 0xca528872
lea edx, [eax + 0xf]
call fcn.004052c0
add esp, 8
push ebx
call eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c264
mov esp, ebp
pop ebp
ret
push esi
nop dword [eax]
nop word [eax + eax]
mov byte [ebp - 0x24c], 0
mov byte [ebp - 0x24b], 0xe
mov byte [ebp - 0x24a], 0x5c
mov byte [ebp - 0x249], 0x47
mov byte [ebp - 0x248], 0x5c
mov byte [ebp - 0x247], 0x2f
mov byte [ebp - 0x246], 0x5c
mov byte [ebp - 0x245], 0x23
mov byte [ebp - 0x244], 0x5c
mov byte [ebp - 0x243], 0x2c
mov byte [ebp - 0x242], 0x5c
mov byte [ebp - 0x241], 0x35
mov byte [ebp - 0x240], 0x5c
mov byte [ebp - 0x23f], 0xe
mov byte [ebp - 0x23e], 0x5c
mov byte [ebp - 0x23d], 0x35
mov byte [ebp - 0x23c], 0x5c
mov byte [ebp - 0x23b], 0x67
mov byte [ebp - 0x23a], 0x5c
mov byte [ebp - 0x239], 0xe
mov byte [ebp - 0x238], 0x5c
mov byte [ebp - 0x237], 0x47
mov byte [ebp - 0x236], 0x5c
mov byte [ebp - 0x235], 0xe
mov byte [ebp - 0x234], 0x5c
mov byte [ebp - 0x233], 0x5c
mov byte [ebp - 0x232], 0x5c
mov al, byte [ebp - 0x24b]
cmp byte [ebp - 0x24c], 0
jne 0x41b4e1
xor esi, esi
lea ebx, [esi + 0x7f]
mov al, byte [ebp + esi - 0x24b]
mov ecx, 0x5c
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x2a
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + esi - 0x24b], dl
inc esi
cmp esi, 0x1a
jb 0x41b4b1
mov ebx, dword [ebp - 0x250]
push 0x51
push 0xcd7328ca
mov edx, 0xf
call fcn.004052c0
add esp, 8
lea ecx, [ebp - 0x24b]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
call eax
test eax, eax
jne 0x41b53e
push 0xc
call fcn.0041e634
xorps xmm0, xmm0
add esp, 4
movq qword [eax], xmm0
mov dword [eax + 8], 0
test eax, eax
je 0x41b564
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 8], ecx
mov ecx, dword [edi + 4]
mov dword [ecx], eax
add eax, 4
mov dword [edi + 4], eax
push 0xc
push 0xc9a81ce0
mov edx, 0xf
call fcn.004052c0
add esp, 8
lea ecx, [ebp - 0x230]
push ecx
push ebx
call eax
test eax, eax
jne 0x41b3e0
push 0x5b
push 0xca528872
mov edx, 0xf
call fcn.004052c0
add esp, 8
push ebx
call eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041c264
mov esp, ebp
pop ebp
ret
Function at 0x40671a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40673e
xor eax, eax
test eax, eax
je 0x406751
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406751
xor ecx, ecx
jmp 0x406754
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40687d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068b4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40688e
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406889
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4068e5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068c7
pop edi
not eax
pop esi
ret 0xc

Function at 0x41139d
Capabilities:
Connect socket

Disassembly:
jmp 0x4194a9
jmp dword [sym.imp.WS2_32.dll_connect]
Function at 0x4063e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x8100bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4046b4
call fcn.00407041
push 4
mov dword [esp + 0x18], 0
call fcn.00407ee6
mov edi, eax
add esp, 4
test edi, edi
je 0x406454
push ebx
call fcn.00406f19
mov dword [edi], eax
call fcn.00406cd8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407002
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406448
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040702a
pop ebx
jmp 0x406456
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408951
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x813520]
jne 0x40895b
repz ret
jmp fcn.0040d0ac
Function at 0x411cf2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x813520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b051
and dword [ebp - 0x14], 0
cmp dword [0x818a94], 0
mov dword [ebp - 0x18], eax
jne 0x411da5
push FindFirstFileW
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411e4d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403918
push ebx
call edi
test eax, eax
je 0x411e4d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403908
push ebx
mov dword [0x818a94], eax
call edi
push eax
call esi
push WriteConsoleInputA
push ebx
mov dword [0x818a98], eax
call edi
push eax
call esi
push 0x4038d8
push ebx
mov dword [0x818a9c], eax
call edi
push eax
call esi
mov dword [0x818aa4], eax
test eax, eax
je 0x411da5
push 0x4038c0
push ebx
call edi
push eax
call esi
mov dword [0x818aa0], eax
mov eax, dword [0x818aa0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411dfe
cmp dword [0x818aa4], ecx
je 0x411dfe
push eax
call esi
push dword [0x818aa4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411dfe
test ebx, ebx
je 0x411dfe
call edi
test eax, eax
je 0x411df5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411df5
test byte [ebp - 8], 1
jne 0x411dfe
or dword [ebp + 0x10], 0x200000
jmp 0x411e31
mov eax, dword [0x818a98]
cmp eax, dword [ebp - 0x18]
je 0x411e31
push eax
call esi
test eax, eax
je 0x411e31
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411e31
mov eax, dword [0x818a9c]
cmp eax, dword [ebp - 0x18]
je 0x411e31
push eax
call esi
test eax, eax
je 0x411e31
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [GetCommandLineA]
call esi
test eax, eax
je 0x411e4d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411e4f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408951
leave
ret
Function at 0x80ebc0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0xb9d820], 0x37
jne 0x80ec60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0x404164
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x4041a0
push 0x404238
push 0x4042b8
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0xb9d824]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x81d884]
mov byte [ecx + esi], al
add esp, 0xc0c
ret
Function at 0x80eed0
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb9d820]
sub esp, 0x434
push ebx
push ebp
push esi
shr eax, 3
xor ebx, ebx
push edi
mov edi, dword [0x81d884]
cmp eax, ebx
jbe 0x80f0b8
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
jmp 0x80ef06
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [0xb9d820], 0x1c
jne 0x80ef1d
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [edi + 4]
mov edx, dword [0x814700]
mov eax, dword [0x814704]
mov esi, dword [edi]
mov ebp, dword [0x814708]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x81470c]
mov edi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], 0x20
jmp 0x80ef5a
xor ebx, ebx
mov eax, esi
mov edx, esi
shl eax, 4
shr edx, 5
add edx, dword [esp + 0x28]
add eax, ebp
lea ecx, [edi + esi]
xor eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov dword [0xb9c7a4], ebx
mov eax, dword [esp + 0x18]
add dword [0xb9c7a4], eax
mov edx, dword [0xb9c7a4]
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x34]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
shl ecx, 4
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0xb9d820], 0x1be
mov eax, dword [esp + 0x14]
lea ebx, [edi + eax]
jne 0x80eff4
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0xb9d820], 0x979
mov dword [0xb9c7a8], 0xff6b3619
mov dword [0xb9c7ac], 0xffffffff
mov dword [esp + 0x18], eax
jne 0x80f038
push 0
lea eax, [esp + 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [0xb9d820]
sub esi, dword [esp + 0x10]
cmp eax, 0x93
je 0x80f05a
add edi, 0x61c88647
dec dword [esp + 0x20]
jne 0x80ef58
cmp eax, 0x8d4
jne 0x80f071
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], ecx
cmp dword [0xb9d820], 0x17
jne 0x80f0a7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea edx, [esp + 0x40]
push edx
push 0x4040f0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add edi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], edi
jne 0x80ef00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x434
ret
Function at 0x10001d10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x270]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x270], 0
xor eax, eax
push fcn.10001cf0
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10001e78
mov eax, dword [ebp - 4]
test eax, eax
je 0x10001d65
mov eax, dword [eax - 4]
test eax, eax
jle 0x10001e78
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.1003bbd0
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10001d8b
mov eax, 0x100a0310
push eax
call fcn.100318a0
mov dword [ebp - 0x268], eax
call fcn.10031650
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x268], 0xffffffff
je 0x10001e48
xor eax, eax
push fcn.10001cd0
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
nop word [eax + eax]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x238]
mov cl, 1
mov edx, 0x103
call fcn.1001d470
mov edx, dword [ebp - 0x270]
mov ecx, 0x100864dc
mov eax, dword [ebp - 0x10]
call fcn.1003b300
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10001e19
cmp dword [eax - 4], 0
jle 0x10001e19
push dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp - 8]
call dword [ebx]
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x268]
call fcn.100318b0
test eax, eax
jne 0x10001dc8
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.10001cd0
jmp 0x10001e78
cmp dword [ebp - 0x26c], 2
je 0x10001e78
cmp dword [ebp - 0x268], 0xffffffff
setne al
movzx eax, al
neg eax
push eax
push dword [ebp - 0xc]
push 0
xor edx, edx
mov eax, str.ProcessAllFileNameMatches
mov ecx, dword [ebp - 0x26c]
call fcn.10034f00
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.10001cf0
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100118b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.10011890
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x18], 0
je 0x10011999
lea eax, [ebp - 4]
xor cx, cx
mov edx, 0x4000
call fcn.1001ba30
nop
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x10011917
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10011924
mov eax, 0x100a0310
push eax
push dword [esi + 0x18]
call fcn.10031700
mov ebx, eax
cmp dword [ebp - 8], 0
seta al
test ebx, ebx
setne dl
and al, dl
setne al
movzx eax, al
neg eax
je 0x10011983
cmp dword [esi + 0x3c], 0
je 0x10011983
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.1001bbc0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.1001cdf0
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x3c]
mov ecx, 0xff0000
mov edi, dword [esi + 0x3c]
mov edi, dword [edi]
call dword [edi + 0xc]
test ebx, ebx
je 0x10011999
cmp dword [ebp - 8], 0
sete al
movzx eax, al
neg eax
je 0x10011900
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10011890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021680
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x10066910]
cmp ax, 0xcb
je 0x1002177f
cmp ax, 0xcc
je 0x1002177f
mov edx, dword [0x100a06d0]
test edx, edx
je 0x100216b2
mov eax, dword [0x100a0580]
call edx
mov ebx, eax
jmp 0x100216b7
mov ebx, 0x100a0584
cmp word [0x100a0570], 0
jle 0x100216da
mov eax, 0x100a0550
call fcn.100218f0
mov eax, ebx
call fcn.10021250
mov eax, ebx
call fcn.100212d0
mov esi, dword [ebx]
jmp 0x100216fd
mov edi, dword [esi + 4]
test byte [esi], 1
jne 0x100216f8
mov edx, esi
mov eax, ebx
call fcn.100206d0
jmp 0x100216fb
and dword [esi], 0xfffffffe
mov esi, edi
test esi, esi
jne 0x100216e0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x100a0570], 0
jle 0x1002177f
mov edx, 0x100a0490
mov eax, ebx
call fcn.10020820
mov esi, eax
test eax, eax
je 0x10021752
mov eax, dword [0x100a0524]
mov dword [esi + 0xc], eax
cmp dword [0x100a0524], 0
je 0x10021747
mov eax, dword [0x100a0524]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x94]
mov dword [0x100a0524], eax
sub word [0x100a0570], 1
cmp word [0x100a0570], 0
sete bl
mov eax, 0x100a0550
call fcn.10021900
test bl, bl
je 0x1002177f
mov eax, 0x100a0550
call fcn.100218e0
pop edi
pop esi
pop ebx
ret
Function at 0x10023d20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.100168a0
mov byte [0x10066960], 1
mov eax, dword [0x100a02d0]
mov dword [0x10067580], eax
mov dword [ebp - 8], 0
mov eax, dword [0x100a02d0]
test eax, eax
je 0x10023e60
sub eax, 1
je 0x10023d80
sub eax, 1
je 0x10023e00
sub eax, 1
je 0x10023e30
jmp 0x10023eb0
call sub.kernel32.dll_GetCurrentThreadId
mov dword [0x100a0700], eax
mov eax, 0x100a07d0
call fcn.100167f0
test eax, eax
jne 0x10023de0
xor eax, eax
push 0x10023dc6
push ebp
push 0x10024f10
push dword fs:[eax]
mov dword fs:[eax], esp
call dword [0x100a0334]
mov dword [ebp - 8], 0xffffffff
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x10023eb0
cmp dword [0x1009f030], 0
sete al
movzx eax, al
neg eax
mov dword [ebp - 8], eax
jmp 0x10023eb0
call fcn.10021a60
mov eax, 0x1000000
call fcn.10021790
cmp dword [0x10066ba0], 0
je 0x10023eb0
mov eax, dword [0x100a02e0]
call dword [0x10066ba0]
jmp 0x10023eb0
cmp dword [0x10066bb0], 0
je 0x10023e44
mov eax, dword [0x100a02e0]
call dword [0x10066bb0]
mov eax, dword [0x10067510]
push dword [eax]
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x10023eb0
call fcn.10021860
jmp 0x10023eb0
cmp dword [0x100a0700], 0
je 0x10023eba
mov eax, 0x100a07d0
call fcn.100167f0
test eax, eax
jne 0x10023e90
cmp dword [0x10066b90], 0
je 0x10023e8b
mov eax, dword [0x100a02e0]
call dword [0x10066b90]
call fcn.1001fe10
call fcn.10021b80
call fcn.10021b00
mov dword [0x100a0700], 0
nop word [eax + eax]
nop
mov dword [0x10067580], 0xffffffff
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002ffc0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.1002ffb0
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test eax, eax
jle 0x10030030
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.1001d670
cmp ebx, 1
jle 0x1003001a
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.1001cd70
jmp 0x1003003b
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.1001ad10
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.1002ffb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100304b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.100304a0
push ebp
push 0x10024b40
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
nop dword [eax + eax]
lea eax, [ebx*4 + 0x100a0e0c]
xor edx, edx
call fcn.1001ad10
mov dword [ebx*4 + 0x100a0e2c], 0xffffffff
add ebx, 1
cmp ebx, 7
jle 0x100304e0
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x10030568
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.1001b7a0
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.10029600
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x10030568
push 4
push ebx
push esi
mov eax, 0x10030370
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x10030410
push eax
call sub.kernel32.dll_EnumCalendarInfoA
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.100304a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030ca0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x100a0e70], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x100a0cd0], eax
mov eax, dword [ebp - 0x90]
mov dword [0x100a0ce0], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x100a0cf0], eax
mov eax, dword [ebp - 0x88]
mov dword [0x100a0d00], eax
mov edx, 0x100a0d11
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.10016010
lea eax, [ebp - 0x80]
call fcn.10016ce0
mov byte [0x100a0d10], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x100a0e80], eax
test eax, eax
je 0x10030d3f
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x100a0e80]
call sub.kernel32.dll_GetProcAddress
mov dword [0x100a0e70], eax
cmp dword [0x100a0ce0], 6
jae 0x10030d5b
mov dword [0x100677b0], 0
cmp dword [0x100a0ce0], 6
jb 0x10030d6e
cmp dword [0x100a0cf0], 1
jb 0x10030d6e
mov dword [0x100677c0], 2
cmp dword [0x100a0e80], 0
je 0x10030d96
cmp dword [0x100a0ce0], 6
jb 0x10030d96
mov eax, str.GetTimeZoneInformationForYear
push eax
push dword [0x100a0e80]
call sub.kernel32.dll_GetProcAddress
mov dword [0x10067980], eax
mov esp, ebp
pop ebp
ret

Function at 0x10031830
Capabilities:
Create process on windows

Disassembly:
jmp dword [sym.imp.kernel32.dll_CreateProcessW]
jmp 0x10001580

Function at 0x10031880
Capabilities:
Get file attributes

Disassembly:
jmp dword [sym.imp.kernel32.dll_GetFileAttributesW]
jmp 0x100011d0
Function at 0x10034af0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x10034b14
mov eax, dword [ebp - 0xc]
mov edx, eax
call dword [eax + 0x34]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10034c7e
xor eax, eax
push 0x10034c63
push ebp
push 0x10024f10
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov edx, dword [ebp - 4]
call fcn.1001cfc0
mov edx, dword [ebp - 0xc]
mov al, byte [ebp + 0x14]
mov byte [edx + 0x28], al
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x2c], edx
movzx eax, byte [ebp + 8]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.10034580
mov eax, dword [ebp - 4]
test eax, eax
je 0x10034b90
cmp dword [eax - 4], 0
jle 0x10034b90
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10034b82
mov eax, 0x100a0310
mov dword [ebp - 0x14], eax
jmp 0x10034b97
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp + 0xc]
call fcn.100317a0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
jne 0x10034c37
call fcn.10031650
mov dword [ebp - 0x10], eax
cmp eax, 5
je 0x10034bf0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
setne al
movzx eax, al
neg eax
push eax
push dword [ebp - 0xc]
push 0
xor edx, edx
mov eax, 0x10091b9c
mov ecx, dword [ebp - 0x10]
call fcn.10034f00
jmp 0x10034c37
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10034bfc
mov eax, 0x100a0310
push eax
push 0
push 0x100000
call fcn.100317f0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
setne al
movzx eax, al
neg eax
push eax
push dword [ebp - 0xc]
push 0
call fcn.10031650
mov ecx, eax
xor edx, edx
mov eax, 0x10091bc0
call fcn.10034f00
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0xc], 0
setne al
cmp dword [ebp - 8], 0
setne dl
and al, dl
je 0x10034c58
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x10034c7e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10