joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1990a249
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
fldz
push esi
mov esi, dword [ebp + 8]
fld st(0)
fcomp qword [esi + 0x30]
push edi
fnstsw ax
test ah, 0x44
jp 0x1990a375
fcomp qword [esi + 0x38]
fnstsw ax
test ah, 0x44
jp 0x1990a377
mov eax, dword [0x19960050]
cmp eax, 0xffffffff
je 0x1990a2fb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1990a2fb
lea edi, [eax + 4]
test edi, edi
je 0x1990a2fb
fld qword [esi + 0x28]
sub esp, 0x18
fstp dword [ebp + 8]
mov ecx, edi
fld dword [ebp + 8]
fstp dword [esp + 0x14]
fld qword [esi + 0x20]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 0x10]
fld qword [esi + 0x18]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 0xc]
fld qword [esi + 8]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 8]
fld qword [esi + 0x10]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 4]
fld qword [esi]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.198f15c7
mov ecx, dword [ebp + 0xc]
push edi
call fcn.1990a145
test eax, eax
je 0x1990a371
xor al, al
jmp 0x1990a381
fld qword [esi + 0x28]
sub esp, 0x18
fstp dword [ebp + 8]
lea ecx, [ebp - 8]
fld dword [ebp + 8]
fstp dword [esp + 0x14]
fld qword [esi + 0x20]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 0x10]
fld qword [esi + 0x18]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 0xc]
fld qword [esi + 8]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 8]
fld qword [esi + 0x10]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp + 4]
fld qword [esi]
fstp dword [ebp + 8]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.1990a0ef
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.1990a145
push dword [ebp - 8]
test eax, eax
je 0x1990a36c
call sub.gdiplus.dll_GdipDeleteMatrix
jmp 0x1990a2f4
call sub.gdiplus.dll_GdipDeleteMatrix
mov al, 1
jmp 0x1990a381
fstp st(0)
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1990a1d0
pop edi
pop esi
leave
ret 8
Function at 0x1990f608
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x1996029c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x478], eax
test eax, eax
je 0x1990f7d4
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, ebx
sub esi, 0x19966fd0
mov dword [ebp - 0x47c], eax
sar esi, 4
lea eax, [esi + 0x25e]
movzx eax, ax
push 0x104
push eax
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x480], eax
test eax, eax
jne 0x1990f696
call edi
cmp eax, 0x715
je 0x1990f685
cmp eax, 0x716
jne 0x1990f7d0
push dword [ebp - 0x47c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1990f7d0
push eax
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x47c], eax
test eax, eax
je 0x1990f7d0
push dword [ebp - 0x480]
push dword [ebp - 0x478]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1990f7d0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x484], eax
test eax, eax
je 0x1990f7d0
push dword [ebp - 0x47c]
or eax, 0xffffffff
push dword [ebp - 0x484]
lea edi, [ebp - 0x474]
lea ecx, [ebp - 0x474]
stosd dword es:[edi], eax
call fcn.1990f110
test eax, eax
je 0x1990f7c4
xor edi, edi
cmp dword [ebp - 0x474], edi
mov dword [ebp - 0x478], edi
jle 0x1990f756
movzx edx, byte [ebp + edi - 0x470]
push edx
mov ecx, ebx
call fcn.1990f1e6
test eax, eax
jne 0x1990f74d
movzx eax, word [ebp + edi*2 - 0x450]
push eax
push edx
call fcn.1990f5a0
test eax, eax
je 0x1990f74d
xor eax, eax
inc eax
mov ecx, edi
shl eax, cl
or dword [ebp - 0x478], eax
inc edi
cmp edi, dword [ebp - 0x474]
jl 0x1990f719
cmp ebx, 0x19966fd0
jb 0x1990f7a2
cmp ebx, 0x19967010
jae 0x1990f7a2
push dword [ebp - 0x474]
lea eax, [ebp - 0x470]
push eax
shl esi, 5
lea eax, [esi + 0x19966f50]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x474]
add eax, eax
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [esi*2 + 0x19966e50]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x18
mov eax, dword [ebp - 0x478]
mov dword [ebx], eax
mov eax, dword [ebp - 0x484]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebx + 8], eax
xor eax, eax
inc eax
mov dword [ebx + 0xc], eax
jmp 0x1990f7d2
push dword [ebp - 0x480]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.198c5017
leave
ret 4
Function at 0x1991ac0b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1991ac1e
xor eax, eax
jmp 0x1991acf4
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x1991acd7
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x1991acf8]
inc edx
sub edi, 8
dec esi
jne 0x1991ac3c
pop ebx
test edi, edi
je 0x1991acf0
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x1991acf8]
inc edx
dec edi
jne 0x1991acdb
pop edi
not eax
pop esi
pop ebp
ret 0xc

Function at 0x1991fead
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1996029c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 4
jbe 0x1991fef9
movzx ecx, word [eax]
cmp cx, 0x6d
je 0x1991fedd
cmp cx, 0x4d
jne 0x1991fef9
movzx ecx, word [eax + 2]
cmp cx, 0x73
je 0x1991feed
cmp cx, 0x53
jne 0x1991fef9
cmp word [eax + 6], 0x3a
jne 0x1991fef9
add eax, 4
dec edi
dec edi
cmp edi, 0x100
jb 0x1991ff09
or eax, 0xffffffff
jmp 0x1991ff92
push esi
xor esi, esi
test edi, edi
jbe 0x1991ff3e
push ebx
mov ebx, eax
lea eax, [ebp - 0x204]
sub ebx, eax
push 0
lea eax, [ebx + esi*2]
movzx eax, word [ebp + eax - 0x204]
push 0
push eax
call fcn.199217bb
mov word [ebp + esi*2 - 0x204], ax
inc esi
cmp esi, edi
jb 0x1991ff1b
pop ebx
xor eax, eax
push 0x1e
mov word [ebp + edi*2 - 0x204], ax
push edi
lea eax, [ebp - 0x204]
push eax
call fcn.199201ad
mov ecx, eax
shr ecx, 0x17
movzx ecx, byte [ecx + 0x199611d0]
movzx esi, word [ecx*2 + 0x1991ffa8]
movzx eax, al
xor esi, eax
cmp esi, 0x183
jae 0x1991ff8e
push edi
lea eax, [ebp - 0x204]
push eax
push esi
call fcn.1991fe85
test al, al
je 0x1991ff8e
mov eax, esi
jmp 0x1991ff91
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.198c5017
leave
ret 8
Function at 0x19922625
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1996029c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x19960028], 0
mov eax, dword [ebp + 8]
jne 0x19922667
push 0x208
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.1992254a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1992266e
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.198c5017
leave
ret 4

Function at 0x19922770
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1996029c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x19960028], 0
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
jne 0x199227f9
push esi
push 0x208
lea ecx, [ebp - 0x414]
push ecx
push eax
mov byte [ebp - 0x108], 0
call fcn.1992254a
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1992254a
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
mov edi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.19922440
mov eax, edi
pop esi
jmp 0x19922805
push ebx
push dword [ebp + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.198c5017
leave
ret 0x10
Function at 0x199259fb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1996029c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
push 0xa
pop ecx
mov esi, 0x19925c5c
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
and dword [ebp - 0x80], 0
push 0xc
movsw word es:[edi], word [esi]
pop ecx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
mov esi, 0x19925c28
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x78], eax
mov eax, dword [ebx]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x68]
push eax
push 1
push 0
movsw word es:[edi], word [esi]
push 0x19925be0
push 0x80000002
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x19925aad
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 0x19925bcc
push dword [ebp - 0x68]
mov dword [ebp - 0x84], 4
call esi
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
call edi
cmp dword [ebp - 0x6c], 0
je 0x19925aad
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x68]
push eax
push 1
push 0
lea eax, [ebp - 0x64]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x19925aed
push ebx
push dword [ebp - 0x78]
push dword [ebp - 0x74]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
call edi
cmp dword [ebp - 0x6c], 0
jne 0x19925aed
mov al, 1
jmp 0x19925bbb
cmp dword [ebp - 0x80], 0
jne 0x19925b79
lea eax, [ebp - 0x68]
push eax
push 1
push 0
lea eax, [ebp - 0x64]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x19925b36
mov eax, dword [ebp - 0x7c]
push ebx
push dword [ebp - 0x78]
mov dword [ebx], eax
push dword [ebp - 0x74]
push 0
push dword [ebp - 0x70]
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
call edi
cmp dword [ebp - 0x6c], 0
je 0x19925ae6
lea eax, [ebp - 0x68]
push eax
push 1
push 0
lea eax, [ebp - 0x30]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x19925b79
mov eax, dword [ebp - 0x7c]
push ebx
push dword [ebp - 0x78]
mov dword [ebx], eax
push dword [ebp - 0x74]
push 0
push dword [ebp - 0x70]
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
call edi
cmp dword [ebp - 0x6c], 0
je 0x19925ae6
lea eax, [ebp - 0x68]
push eax
push 1
push 0
lea eax, [ebp - 0x30]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x19925bb9
mov eax, dword [ebp - 0x7c]
push ebx
push dword [ebp - 0x78]
mov dword [ebx], eax
push dword [ebp - 0x74]
push 0
push dword [ebp - 0x70]
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x68]
mov esi, eax
call edi
test esi, esi
je 0x19925ae6
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.198c5017
leave
ret 0x10
Function at 0x19927fe6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0x198dcbb4
mov dword [esi + 0xc], 0x198dcbe4
mov dword [esi], 0x198dccbc
mov dword [esi + 8], 0x198dcc8c
mov dword [esi + 0xc], 0x198dcc80
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
push edi
xor eax, eax
mov word [esi + 0x34], ax
mov word [esi + 0x36], ax
mov dword [esi + 0x40], ebx
push 0x14
pop eax
mov word [esi + 0x38], ax
xor eax, eax
mov word [esi + 0x44], ax
mov word [esi + 0x46], ax
push 0x14
mov dword [esi + 0x50], ebx
pop eax
mov word [esi + 0x48], ax
xor eax, eax
mov word [esi + 0x54], ax
mov word [esi + 0x56], ax
push 0x14
pop eax
mov word [esi + 0x58], ax
mov dword [esi + 0x60], ebx
xor eax, eax
mov word [esi + 0x64], ax
mov word [esi + 0x66], ax
push 0x7c
pop eax
mov word [esi + 0x68], ax
mov dword [esi + 0x70], ebx
lea eax, [esi + 0x74]
xor ecx, ecx
mov word [eax], cx
mov word [eax + 2], cx
push 0x10
pop ecx
mov word [eax + 4], cx
lea edi, [esi + 0xa4]
mov dword [eax + 0xc], ebx
mov ecx, edi
mov dword [esi + 0x84], ebx
call fcn.19927f84
or dword [esi + 0xb8], 1
lea eax, [esi + 0x8c]
push eax
mov byte [esi + 0xbc], bl
mov byte [esi + 0xbd], bl
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], 0x1e
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x19960050]
cmp eax, 0xffffffff
je 0x199280f6
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov byte [esi + 0xd0], 1
mov byte [esi + 0xd1], 1
mov eax, esi
pop esi
pop ebx
ret
Function at 0x19929e5c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 8]
lea edi, [esi + 0xc]
mov dword [esi], 0x198dccbc
mov dword [ebx], 0x198dcc8c
mov dword [edi], 0x198dcc80
mov eax, dword [0x19960050]
cmp eax, 0xffffffff
je 0x19929e8e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call fcn.1992593c
mov ecx, ebx
call fcn.19928fa7
cmp byte [esi + 0xbd], 0
je 0x19929ead
push edi
mov ecx, ebx
call fcn.1992591f
lea ecx, [esi + 0x74]
call fcn.19927f38
mov eax, dword [esi + 0x84]
movzx ebx, word [eax]
xor edi, edi
test ebx, ebx
jle 0x19929ede
mov eax, dword [esi + 0x84]
mov eax, dword [eax + 0xc]
lea ecx, [eax + edi*8]
test ecx, ecx
je 0x19929ed9
call fcn.19924950
inc edi
cmp edi, ebx
jl 0x19929ec4
mov ecx, dword [esi + 0x84]
test ecx, ecx
je 0x19929ef6
push 1
call fcn.199281e0
and dword [esi + 0x84], 0
mov eax, dword [esi + 0x88]
movzx ebx, word [eax]
xor edi, edi
test ebx, ebx
jle 0x19929f1f
mov eax, dword [esi + 0x88]
mov eax, dword [eax + 0xc]
lea ecx, [eax + edi*8]
test ecx, ecx
je 0x19929f1a
call fcn.1992497c
inc edi
cmp edi, ebx
jl 0x19929f05
mov ecx, dword [esi + 0x88]
test ecx, ecx
je 0x19929f37
push 1
call fcn.199281e0
and dword [esi + 0x88], 0
lea ebx, [esi + 0x64]
mov ecx, ebx
call fcn.19927e7c
lea ecx, [esi + 0x54]
call fcn.19927dbe
lea ecx, [esi + 0x44]
call fcn.19927dbe
lea ecx, [esi + 0x34]
call fcn.19927dbe
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x19929f6b
push 1
call fcn.199281e0
and dword [esi + 0x30], 0
mov ecx, esi
call fcn.1992594f
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x19929fa1
movzx edi, word [eax]
jmp 0x19929f9e
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x19929f9e
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jns 0x19929f8b
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x19929fb3
push 1
call fcn.199281e0
and dword [esi + 0x14], 0
lea ecx, [esi + 0xa4]
call fcn.199266dd
lea ecx, [esi + 0x74]
call fcn.199260d2
mov ecx, ebx
call fcn.199260d2
lea ecx, [esi + 0x54]
call fcn.199260d2
lea ecx, [esi + 0x44]
call fcn.199260d2
lea ecx, [esi + 0x34]
call fcn.199260d2
pop edi
mov dword [esi + 8], 0x198dcbb4
mov ecx, esi
pop esi
pop ebx
jmp fcn.1992a587
Function at 0x19929e5f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 8]
lea edi, [esi + 0xc]
mov dword [esi], 0x198dccbc
mov dword [ebx], 0x198dcc8c
mov dword [edi], 0x198dcc80
mov eax, dword [0x19960050]
cmp eax, 0xffffffff
je 0x19929e8e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call fcn.1992593c
mov ecx, ebx
call fcn.19928fa7
cmp byte [esi + 0xbd], 0
je 0x19929ead
push edi
mov ecx, ebx
call fcn.1992591f
lea ecx, [esi + 0x74]
call fcn.19927f38
mov eax, dword [esi + 0x84]
movzx ebx, word [eax]
xor edi, edi
test ebx, ebx
jle 0x19929ede
mov eax, dword [esi + 0x84]
mov eax, dword [eax + 0xc]
lea ecx, [eax + edi*8]
test ecx, ecx
je 0x19929ed9
call fcn.19924950
inc edi
cmp edi, ebx
jl 0x19929ec4
mov ecx, dword [esi + 0x84]
test ecx, ecx
je 0x19929ef6
push 1
call fcn.199281e0
and dword [esi + 0x84], 0
mov eax, dword [esi + 0x88]
movzx ebx, word [eax]
xor edi, edi
test ebx, ebx
jle 0x19929f1f
mov eax, dword [esi + 0x88]
mov eax, dword [eax + 0xc]
lea ecx, [eax + edi*8]
test ecx, ecx
je 0x19929f1a
call fcn.1992497c
inc edi
cmp edi, ebx
jl 0x19929f05
mov ecx, dword [esi + 0x88]
test ecx, ecx
je 0x19929f37
push 1
call fcn.199281e0
and dword [esi + 0x88], 0
lea ebx, [esi + 0x64]
mov ecx, ebx
call fcn.19927e7c
lea ecx, [esi + 0x54]
call fcn.19927dbe
lea ecx, [esi + 0x44]
call fcn.19927dbe
lea ecx, [esi + 0x34]
call fcn.19927dbe
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x19929f6b
push 1
call fcn.199281e0
and dword [esi + 0x30], 0
mov ecx, esi
call fcn.1992594f
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x19929fa1
movzx edi, word [eax]
jmp 0x19929f9e
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x19929f9e
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jns 0x19929f8b
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x19929fb3
push 1
call fcn.199281e0
and dword [esi + 0x14], 0
lea ecx, [esi + 0xa4]
call fcn.199266dd
lea ecx, [esi + 0x74]
call fcn.199260d2
mov ecx, ebx
call fcn.199260d2
lea ecx, [esi + 0x54]
call fcn.199260d2
lea ecx, [esi + 0x44]
call fcn.199260d2
lea ecx, [esi + 0x34]
call fcn.199260d2
pop edi
mov dword [esi + 8], 0x198dcbb4
mov ecx, esi
pop esi
pop ebx
jmp fcn.1992a587

Function at 0x1992ccdf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
invalid
Function at 0x19933947
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1996029c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
mov edx, eax
test ecx, ecx
je 0x19933983
mov bx, word [ebp + 0x10]
cmp word [eax], bx
je 0x199339ff
add eax, 8
dec dword [ebp + 0xc]
jne 0x1993396e
mov dword [ebp + 0xc], ecx
mov eax, edx
test ecx, ecx
je 0x199339af
mov edx, dword [ebp + 0x10]
mov ecx, 0x3ff
and edx, ecx
mov dword [ebp - 0x1c], edx
mov dx, word [eax]
mov ebx, ecx
and dx, bx
cmp dx, word [ebp - 0x1c]
je 0x199339ff
add eax, 8
dec dword [ebp + 0xc]
jne 0x19933999
push 0x14
lea eax, [ebp - 0x18]
push eax
movzx eax, word [ebp + 0x10]
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x199339e6
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.19921b91
mov ecx, dword [esi]
xor eax, eax
cmp dword [eax*8 + 0x198dcf0c], ecx
je 0x19933a0e
inc eax
cmp eax, 0x32
jb 0x199339d7
mov byte [edi], 1
and dword [esi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.198c5017
leave
ret 0x14
mov cl, byte [eax + 2]
mov byte [edi], cl
mov eax, dword [eax + 4]
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x199339ee
mov al, byte [eax*8 + 0x198dcf0a]
mov byte [edi], al
jmp 0x19933a09

Function at 0x19933a1e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, 0xffff
push esi
push edi
cmp word [ebp + 8], ax
je 0x19933a9e
test dword [ebp + 8], 0x3ff
je 0x19933a9e
movzx edi, word [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
push 0x58
push edi
call esi
test eax, eax
jne 0x19933a6a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x32
push 0x198dcf08
call fcn.19933947
jmp 0x19933aaa
push 0x20
lea eax, [ebp - 0x20]
push eax
push 0x58
push edi
call esi
and dword [ebp - 0xc], 0
push 3
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.199338e6
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x19933aa1
mov cl, byte [ebp - 0x40]
mov byte [eax], cl
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
jmp 0x19933aaa
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 0x10]
and dword [eax], 0
pop edi
pop esi
leave
ret 0xc
Function at 0x199559e4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1996029c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x414]
push eax
push 0x104
mov esi, ecx
call fcn.19922703
test eax, eax
jne 0x19955a21
xor al, al
jmp 0x19955adc
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x418], ebx
jmp 0x19955a7b
inc dword [0x19963278]
jne 0x19955a3f
mov dword [0x19963278], 1
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call fcn.19922681
mov edi, eax
cmp edi, 0xffffffff
jne 0x19955a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x19955ad8
inc dword [ebp - 0x418]
cmp dword [ebp - 0x418], 5
jge 0x19955ad8
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x198c15e0
lea eax, [ebp - 0x414]
push eax
call fcn.19922770
test eax, eax
je 0x19955ad8
jmp 0x19955a2d
mov ecx, esi
call fcn.199558b4
test al, al
je 0x19955aeb
cmp byte [ebp + 0x10], bl
je 0x19955aeb
lea eax, [ebp - 0x41c]
push eax
push dword [esi + 0x38]
push dword [esi + 0x34]
push ebx
push edi
call fcn.198f0b59
push edi
movzx esi, al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x19955b26
lea eax, [ebp - 0x20c]
push eax
call fcn.19922625
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.198c5017
leave
ret 0xc
push ebx
lea eax, [ebp - 0x418]
push eax
push dword [esi + 0x38]
mov dword [ebp - 0x418], ebx
push dword [esi + 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov dword [ebp - 0x41c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x41c], ebx
je 0x19955acc
mov eax, dword [esi + 0x38]
cmp eax, dword [ebp - 0x418]
jne 0x19955acc
lea eax, [ebp - 0x20c]
push eax
call fcn.19920e35
mov esi, eax
mov eax, dword [ebp + 0xc]
inc esi
cmp esi, eax
jb 0x19955b3f
lea esi, [eax - 1]
mov edi, dword [ebp - 0x420]
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.19920f63
xor eax, eax
mov word [edi + esi*2], ax
mov al, 1
jmp 0x19955ada