joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462b04
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x462b0c
push ecx
xor eax, eax
push ebp
push 0x462d17
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x46abd8], eax
cmp dword [0x46abd8], 0xffffffff
jne 0x462b7b
mov eax, dword [0x46abd4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov edx, 0x462d30
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_closesocket
mov byte [ebp - 1], 0
jmp 0x462cfc
mov word [ebp - 0x14], 2
push 0x462d54
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov eax, dword [0x46ac24]
cmp eax, 0xffff
jbe 0x462b9f
call fcn.00403428
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00402efc
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x462c24
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x1c]
call fcn.0046160c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x462d68
call fcn.004045f8
mov edx, dword [ebp - 0x18]
mov eax, dword [0x46abd4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_closesocket
mov byte [ebp - 1], 0
jmp 0x462cfc
push 5
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_listen
test eax, eax
je 0x462c89
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x24]
call fcn.0046160c
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x462d68
call fcn.004045f8
mov edx, dword [ebp - 0x20]
mov eax, dword [0x46abd4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_closesocket
mov byte [ebp - 1], 0
jmp 0x462cfc
push 0x29
push 0x401
mov eax, dword [0x46abd4]
call fcn.004401e4
push eax
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_WSAAsyncSelect
test eax, eax
je 0x462cfc
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x2c]
call fcn.0046160c
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x462d68
call fcn.004045f8
mov edx, dword [ebp - 0x28]
mov eax, dword [0x46abd4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [0x46abd8]
push eax
call sub.wsock32.dll_closesocket
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462d1e
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00404310
ret
Function at 0x465428
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040479c
xor eax, eax
push ebp
push 0x4654e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.wsock32.dll_ioctlsocket
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.wsock32.dll_ioctlsocket
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.wsock32.dll_closesocket
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.wsock32.dll_closesocket
mov eax, dword [ebp - 4]
add eax, 0x68
mov edx, dword [ebp - 8]
call fcn.00404340
mov eax, dword [ebp - 4]
push eax
push 0x4653f0
mov eax, dword [ebp - 4]
call fcn.0041a824
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4654e9
lea eax, [ebp - 8]
call fcn.004042ec
ret
Function at 0x10035b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10035b6f
pop dword [ebp - 0x18]
mov eax, 0x963ccc69
sub eax, 0x863970fa
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x63d77
push 0
mov eax, 0xfd3a88a3
add eax, 0x12d05851
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x2176747
sub ecx, 0x2171aa1
xor esi, esi
add esi, eax
mov edi, 0x1012ac00
add edi, dword [ebp - 0x18]
mov ebx, 0xfbafe5a9
xor dword [ebp - 0x14], ebx
mov edx, dword [edi]
add dword [ebp - 4], ecx
add edx, ebx
add dword [ebp - 0x10], ecx
mov dword [esi], edx
add dword [ebp - 0x14], 0x6f61fc49
add esi, 4
add edi, 4
loop 0x10035bc4
add eax, 0x1256b
xor ebx, ebx
add ebx, eax
add eax, 0x5bfbaaa0
add eax, 0xa4045565
mov ecx, sym.msoidcliL.dll_Ordinal_9
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10047e50
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a56a9
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x1010df64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov eax, dword [0x1010df30]
mov ecx, 0x1010df30
mov byte [ebp - 4], 1
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x128], esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
mov dword [ebp - 0x124], 0
call fcn.10013bd0
mov ecx, eax
call fcn.10013cd0
mov eax, dword [ebp + 8]
mov edi, dword [eax - 0xc]
test edi, edi
jns 0x10047efa
push 0x80070057
call fcn.10035b60
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, edi
or ecx, edx
jge 0x10047f17
push edi
lea ecx, [ebp + 8]
call fcn.10035b60
mov eax, dword [ebp + 8]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.10035b60
mov eax, dword [ebp + 8]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x10047ef0
mov dword [eax - 0xc], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax + edi*2], cx
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push str.wstrUserName_s
push str.IDCRL::DeleteUserAllExtendedProperties
push eax
push str.d:_bt20572clientwlidsspwlidsvccorecredentialbag.cpp_40
lea eax, [ebp - 0x11c]
push 2
push eax
call fcn.10035b60
add esp, 0x1c
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
je 0x10048004
lea eax, [ebp - 0x124]
push eax
push 0x20006
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov edi, eax
test edi, edi
je 0x10047fa6
jg 0x10047f95
mov dword [ebp - 0x120], edi
jmp 0x1004800a
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x120], edi
jmp 0x1004800a
push 0x39
push str.SoftwareMicrosoftMSOIdentityCRLUserExtendedProperties_
lea ecx, [ebp - 0x128]
call fcn.10035b60
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x128]
push dword [eax - 0xc]
push eax
call fcn.10035b60
mov esi, dword [ebp - 0x128]
push esi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x10047ff8
cmp eax, 2
je 0x10047ff8
test eax, eax
jle 0x10047ff2
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x120], eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 2
call fcn.10035b60
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 1
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10048039
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x1004805a
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001e17
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bac0
Capabilities:
Write file on windows

Disassembly:
call fcn.10035b60
call fcn.1000ddf0
mov ecx, eax
call fcn.1000d310
mov ecx, dword [0x1011169c]
test ecx, ecx
je 0x1004bb06
push esi
call fcn.10035b60
mov esi, dword [0x1011169c]
test esi, esi
je 0x1004bafb
mov ecx, esi
call fcn.10035b60
push esi
call fcn.1000863f
add esp, 4
mov dword [0x1011169c], 0
pop esi
jmp fcn.1004de70
Function at 0x46a7c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x46000]
push edi
or ebp, 0xffffffff
jmp 0x46a7e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46a7e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46a7d8
mov eax, 1
add ebx, ebx
jne 0x46a7fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46a7f0
jne 0x46a80c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46a7f0
xor ecx, ecx
sub eax, 3
jb 0x46a820
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46a892
mov ebp, eax
add ebx, ebx
jne 0x46a82b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x46a838
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46a85c
inc ecx
add ebx, ebx
jne 0x46a848
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46a83d
jne 0x46a859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46a83d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46a87c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46a86d
jmp 0x46a7de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46a87c
add edi, ecx
jmp 0x46a7de
pop esi
mov edi, esi
mov ecx, 0x299f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46a89a
cmp byte [edi], 0xc
jne 0x46a89a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46a89f
lea edi, [esi + 0x68000]
mov eax, dword [edi]
or eax, eax
je 0x46a917
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6b3d0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6b40c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46a8cc
mov ecx, edi
jns 0x46a8fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6b414]
or eax, eax
je 0x46a911
mov dword [ebx], eax
add ebx, 4
jmp 0x46a8e9
call dword [esi + 0x6b410]
mov ebp, dword [esi + 0x6b418]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46a94b
sub esp, 0xffffff80
jmp 0x4052f8
Function at 0x4681ec
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468063

Function at 0x4510c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x436015
lea edi, [esi - 0x35015]
push edi
jmp 0x4510da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4510e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4510d0
mov eax, 1
add ebx, ebx
jne 0x4510f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4510e8
jne 0x451104
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4510e8
xor ecx, ecx
sub eax, 3
jb 0x451118
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45118a
mov ebp, eax
add ebx, ebx
jne 0x451123
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x451130
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x451154
inc ecx
add ebx, ebx
jne 0x451140
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x451135
jne 0x451151
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x451135
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x451174
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x451165
jmp 0x4510d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x451174
add edi, ecx
jmp 0x4510d6
pop esi
mov edi, esi
mov ecx, 0x22a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x451192
cmp byte [edi], 5
jne 0x451192
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x451197
lea edi, [esi + 0x4f000]
mov eax, dword [edi]
or eax, eax
je 0x451206
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x517a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x51828]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4511c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x51830]
or eax, eax
je 0x451200
mov dword [ebx], eax
add ebx, 4
jmp 0x4511e1
call dword [esi + 0x5182c]
mov ebp, dword [esi + 0x51834]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45123a
sub esp, 0xffffff80
jmp 0x404280
Function at 0x10012bf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10012c07
pop dword [ebp - 0xc]
mov eax, 0xb810c750
add eax, 0x57f064b7
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xf6e73eb2
add dword [ebp - 0x1c], 0x576b0699
mov dword [ebp - 0x18], 0xfdbb37a6
sub dword [ebp - 0x18], 0xcb87eb61
mov dword [ebp - 0x14], 0x913e9c50
sub dword [ebp - 0x14], 0x44f25822
mov dword [ebp - 0x10], 0xcfecaede
sub dword [ebp - 0x10], 0xcfecaede
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x38bc575f
add eax, 0xd745a8a5
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xaec3c4bd
sub dword [ebp - 0x1c], 0x3a515b67
mov dword [ebp - 0x18], 0xfc23018e
sub dword [ebp - 0x18], 0xbab6a019
mov dword [ebp - 0x14], 0x7eecddbd
add dword [ebp - 0x14], 0xe4828eaf
mov dword [ebp - 0x10], 0xbbce11d9
sub dword [ebp - 0x10], 0xbbce11d9
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d3b6
push 0
call eax
mov ecx, 0x49b1
xor edi, edi
add edi, eax
mov ebx, 0x1002bc00
add ebx, dword [ebp - 0xc]
mov edx, 0x4acfb88d
xor dword [ebp - 4], edx
mov esi, dword [ebx]
sub dword [ebp - 8], esi
add esi, edx
add dword [ebp - 8], ecx
mov dword [edi], esi
add dword [ebp - 4], 0xc08ce5f9
add edi, 4
add ebx, 0x5359b370
add ebx, 0xaca64c94
loop 0x10012d14
add eax, 0x30e50193
sub eax, 0x30e3e7fc
xor ebx, ebx
add ebx, eax
add eax, 0x378f0c62
sub eax, 0x378f0c5d
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x452c60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x42f00d
lea edi, [esi - 0x2e00d]
push edi
or ebp, 0xffffffff
jmp 0x452c82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x452c89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452c78
mov eax, 1
add ebx, ebx
jne 0x452c9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x452cac
jne 0x452ccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452ccb
dec eax
add ebx, ebx
jne 0x452cb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x452c90
add ebx, ebx
jne 0x452cc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x452d1d
xor ecx, ecx
sub eax, 3
jb 0x452ce3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x452d52
sar eax, 1
mov ebp, eax
jmp 0x452cee
add ebx, ebx
jne 0x452cee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452cbc
inc ecx
add ebx, ebx
jne 0x452cfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452cbc
add ebx, ebx
jne 0x452d09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x452cfe
jne 0x452d1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x452cfe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x452d3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x452d2e
jmp 0x452c7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x452d3c
add edi, ecx
jmp 0x452c7e
pop esi
mov edi, esi
mov ecx, 0x545
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x452d5a
cmp byte [edi], 0x13
jne 0x452d5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x452d5f
lea edi, [esi + 0x4e000]
mov eax, dword [edi]
or eax, eax
je 0x452dd7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x52080]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x452d8c
mov ecx, edi
jns 0x452dbb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x52088]
or eax, eax
je 0x452dd1
mov dword [ebx], eax
add ebx, 4
jmp 0x452da9
call dword [esi + 0x52084]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x452e08
cmp al, 0xef
ja 0x452dfb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x452ddd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x452dea
mov ebp, dword [esi + 0x5208c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x452e3c
sub esp, 0xffffff80
jmp 0x409210
Function at 0x10032b90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101fe4b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x10032c7f
push 0x55
push 0x101fe4b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10032c68
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.10108310
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x101fe4b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10032c13
inc edx
cmp edx, 0x55
jl 0x10032bf0
mov byte [ebp - 8], 0
push 0x41
call fcn.1011f274
mov esi, eax
add esp, 4
test esi, esi
je 0x10032c67
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.1011f274
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x10032c5e
push 0x10032340
push 0x15
mov byte [eax + esi], 0
mov dword [0x101fe4b0], esi
mov byte [0x101fe4b4], 1
call fcn.1011f274
add esp, 8
jmp 0x10032c67
push esi
call fcn.1011f274
add esp, 4
pop esi
mov eax, dword [0x101fe4b0]
mov ecx, 0x10166518
test eax, eax
cmovne ecx, eax
mov dword [0x101fe4b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
Function at 0x100342a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x101fac9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x358], 0
push edi
push 0x1b0
push eax
mov dword [ebp - 0xc], eax
xor edi, edi
mov word [ebp - 8], ax
mov word [ebp - 0x35c], ax
mov byte [ebp - 0x35a], al
lea eax, [ebp - 0x354]
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.10108310
push 0x80
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.10108310
add esp, 0x24
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.kernel32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
je 0x100343be
push 0x10
call dword [sym.imp.kernel32.dll_GetUserGeoID]
push edi
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.kernel32.dll_GetGeoInfoW]
mov ebx, eax
lea eax, [ebp - 0x358]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x35c]
push 3
push eax
call fcn.1011f274
lea eax, [ebp - 0x358]
push eax
push str.windowsZones
push edi
call fcn.1011f274
mov esi, eax
lea eax, [ebp - 0x358]
push eax
push esi
push str.mapTimezones
push esi
call fcn.1011f274
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2a8]
push eax
push edi
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.1011f274
add esp, 0x4c
cmp dword [ebp - 0x358], edi
jle 0x100343d1
test esi, esi
je 0x100343be
push esi
call fcn.1011f274
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e580b
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x2a8], di
je 0x100344b6
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::constructor_void_
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.1011f274
add esp, 0x10
cmp dword [ebp - 0x358], edi
jg 0x100344ab
test ebx, ebx
je 0x10034441
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.1011f274
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x1003446b
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], edi
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x1a4]
push 0x101684d4
push eax
call fcn.1011f274
add esp, 0x10
mov ecx, eax
cmp dword [ebp - 0x358], edi
jg 0x100344ab
movzx eax, word [ecx]
xor edx, edx
test ax, ax
je 0x100344a3
mov ebx, eax
nop
cmp bx, 0x20
je 0x1003449b
add ecx, 2
mov byte [ebp + edx - 0x8c], bl
inc edx
movzx eax, word [ecx]
mov ebx, eax
test ax, ax
jne 0x10034480
cmp edx, 0x80
jae 0x100344f0
mov byte [ebp + edx - 0x8c], 0
lea ecx, [ebp - 0x1a4]
call sym.icuuc67.dll_public:_void___thiscall_icu_67::StackUResourceBundle::destructor_void_
cmp byte [ebp - 0x8c], 0
je 0x100344d0
lea eax, [ebp - 0x8c]
push eax
call fcn.1011f274
add esp, 4
mov edi, eax
test esi, esi
je 0x100344dd
push esi
call fcn.1011f274
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e580b
mov esp, ebp
pop ebp
ret
call fcn.1011f274
int3