joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a450
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.00401160
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 0xc]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
xor ecx, ecx
dec ecx
test eax, eax
cmovs eax, ecx
lea edi, [eax + 1]
lea ebx, [eax + eax]
add ebx, 2
push ebx
call fcn.0044f9c3
add esp, 4
mov esi, eax
push ebx
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [ebp + 0x18]
mov dword [ebp - 0x18], ebx
call fcn.00401160
push ebx
xor ecx, ecx
push ecx
push dword [ebp + 0xc]
push edi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push eax
call fcn.00451d80
add esp, 0x10
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
lea ebx, [eax + eax]
add ebx, 2
cmp eax, 0xffffffff
mov eax, 0xffffffff
cmovl ebx, eax
push ebx
call fcn.0044f9c3
add esp, 4
mov edi, eax
push ebx
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
call fcn.00451de0
add esp, 0x1c
push dword [ebp + 8]
push ebx
call dword [sym.imp.advapi32.dll_RegisterEventSourceW]
test eax, eax
je 0x42a57f
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x463450]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.advapi32.dll_ReportEventW]
push ebx
call dword [sym.imp.advapi32.dll_DeregisterEventSource]
push edi
call fcn.0044f120
add esp, 4
push esi
call fcn.0044f120
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b650
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov ebx, ecx
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452fa0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
jae 0x42b7e1
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 8
jb 0x42b6bc
mov ecx, dword [ebp - 0x28]
jmp 0x42b6bf
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042ae40
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x42b6ea
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42b7ee
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 8
jb 0x42b70a
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
mov edi, dword [ebp - 0x48]
jb 0x42b760
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b756
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b810
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044f9c3
add esp, 8
cmp dword [ebp - 0x14], 8
jb 0x42b76b
mov eax, dword [ebp - 0x28]
jmp 0x42b76e
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [edi], edx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42b7cd
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b7c3
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b810
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044f9c3
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00455620
jmp 0x42b6cc
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.004530b0
jmp 0x42b720
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x4388e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov al, 1
cmp byte [ecx + 4], 0
jne 0x4389b0
mov esi, ecx
mov edi, dword [ecx]
test edi, edi
jne 0x438925
xor eax, eax
push str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x43891b
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi], edi
test edi, edi
je 0x4389b4
push 0xbb8
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x438969
cmp eax, 0x80
je 0x438988
test eax, eax
je 0x4389a5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xbb
push str.Acquire
push str.Failed_to_wait_on_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x14
jmp 0x4389a9
push 0xae
push str.Acquire
push str.Timed_out_waiting_for_registry_mutex
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x10
jmp 0x4389a9
push 0xb5
push str.Acquire
push str.Found_abandoned_registry_mutex._Continuing...
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x10
mov byte [esi + 4], 1
cmp byte [esi + 4], 0
setne al
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xa4
push str.Acquire
push str.Couldnt_open_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042a450
add esp, 0x14
xor eax, eax
jmp 0x4389b0
Function at 0x4394a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x14]
mov dword [ebx], edi
push ebx
push 0x20019
push edi
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x43955b
lea eax, [ebp - 0x18]
mov dword [eax], edi
lea ecx, [ebp - 0x1c]
mov dword [ecx], edi
sub esp, 0x30
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
mov edi, 2
test eax, eax
jne 0x439552
lea ecx, [ebp - 0x20]
mov dword [ecx], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [eax], 4
xor edi, edi
push eax
push ecx
push edi
push 0x10
push esi
push edi
push ebx
call dword [sym.imp.advapi32.dll_RegGetValueW]
xor ecx, ecx
lea edx, [ebp - 0x20]
cmp dword [edx], edi
sete cl
test eax, eax
mov edi, 2
cmove edi, ecx
push ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x439560
mov edi, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44e9c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov eax, dword [0x4a0150]
test eax, eax
je 0x44ead3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44e9f1
cmp dword [eax + 4], 0
mov esi, eax
je 0x44e9f1
add esi, 4
jmp 0x44eacb
mov eax, dword [0x4a0150]
test eax, eax
je 0x44eae5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x44eac9
mov esi, eax
test eax, eax
jne 0x44ea53
mov al, byte [0x4a06e5]
push 4
push 0x20
call fcn.00415040
add esp, 8
test eax, eax
je 0x44eb09
mov dword [eax], 0x4a0150
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4a0150]
test eax, eax
je 0x44eaf7
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
add esi, 4
test eax, eax
je 0x44ea8c
mov ecx, dword [eax]
mov dword [eax], 0
test ecx, ecx
je 0x44ea8c
movsd xmm0, qword [eax + 0x14]
movsd xmm2, qword [eax + 4]
movsd xmm1, qword [eax + 0xc]
movsd qword [ebp - 0xc], xmm0
movsd qword [ebp - 0x14], xmm1
movsd qword [ebp - 0x1c], xmm2
mov dword [ebp - 0x20], ecx
jmp 0x44ea98
lea eax, [ebp - 0x20]
push eax
call fcn.0044e790
add esp, 4
movsd xmm1, qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x20]
cmp dword [esi], 0
movsd qword [esi + 8], xmm1
movsd xmm1, qword [ebp - 0x10]
movsd qword [esi + 0x10], xmm1
mov eax, dword [ebp - 8]
movsd qword [esi], xmm0
mov dword [esi + 0x18], eax
je 0x44eacb
lock dec dword [0x4a0700]
jmp 0x44eacb
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop ebp
ret
push 0x4a0150
call fcn.004515e0
add esp, 4
jmp 0x44e9d5
push 0x4a0150
call fcn.004515e0
add esp, 4
jmp 0x44e9ff
push 0x4a0150
call fcn.004515e0
add esp, 4
jmp 0x44ea4b
push 0x20
push 4
call fcn.00451c70
int3
Function at 0x44eb20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [0x4a0708]
test ebx, ebx
jne 0x44ec36
push 0x475431
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x44eb75
mov edi, eax
push str.WaitOnAddress
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x44eb75
mov esi, eax
push str.WakeByAddressSingle
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x44eb75
mov edi, eax
mov dword [ebp - 0x10], 0
jmp 0x44ebe9
push 0x4753ec
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x44ec40
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x44ec40
mov ebx, eax
push str.NtReleaseKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x44ec40
mov edi, eax
push str.NtWaitForKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x44ec40
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0x10], edi
call dword [section..00cfg]
xor eax, eax
lea ecx, [ebp - 0x14]
push eax
push eax
push 0xc0000000
push ecx
call ebx
test eax, eax
jne 0x44ec40
mov edi, dword [ebp - 0x14]
mov al, byte [0x4a06e5]
push 4
push 0xc
call fcn.00415040
add esp, 8
test eax, eax
je 0x44ec45
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
xor eax, eax
lock cmpxchg dword [0x4a0708], ebx
je 0x44ec36
cmp dword [ebx], 0
mov esi, eax
je 0x44ec27
push dword [ebx + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 4
push 0xc
push ebx
call fcn.004150b0
add esp, 0xc
mov ebx, esi
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0045cb70
push 0xc
push 4
call fcn.00451c70
int3

Function at 0x44f9c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x44f9d2
pop dword [ebp - 8]
mov eax, 0x44f9d2
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3b848
push 0
mov eax, 0x27f5c5c4
sub eax, 0x27abf798
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xe73fda79
add ecx, 0x18c075eb
xor ebx, ebx
add ebx, eax
mov esi, 0x487df729
add esi, 0xb7cc84d7
add esi, dword [ebp - 8]
mov edi, 0xef456480
add dword [ebp - 4], ebx
mov edx, dword [esi]
xor dword [ebp - 4], edi
add edx, edi
xor dword [ebp - 4], 0x2cf3ea0b
mov dword [ebx], edx
xor dword [ebp - 4], ebx
add ebx, 4
add esi, 4
loop 0x44fa28
add eax, 0xbec0f1a6
add eax, 0x414042bd
mov ebx, eax
add eax, 0x89185bd4
add eax, 0x76e7a431
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4515e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x45165a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x451695
cmp dword [esp + 4], 0
je 0x45167c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4516b8
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x4a026c]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x4a026c], edi
jne 0x451640
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x45168c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x4516ff
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x451680
mov esi, dword [esp]
jmp 0x45168c
mov esi, dword [edi]
jmp 0x45168b
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x461c80
push 0x461cb4
push eax
call fcn.00451230
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x461cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x4603d0
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x461ce0
push eax
call fcn.00450c40
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x461cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x4603d0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00451290
ud2
Function at 0x451e40
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x4a0088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x451e92
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
add eax, 0xffffff07
cmp eax, 0xfffffefc
jae 0x451eab
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f7d0
mov eax, ebx
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
push str.control.exe
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
test eax, eax
je 0x451e94
lea esi, [ebp - 0x220]
mov dword [esi], ebx
mov ecx, esi
call fcn.00451c90
mov eax, dword [esi]
mov dword [ebp - 0x278], eax
mov ecx, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push ecx
call fcn.00451d80
add esp, 8
lea ecx, [eax + 1]
mov dword [ebp - 0x27c], ecx
lea ecx, [eax + eax]
add ecx, 2
xor esi, esi
dec esi
cmp eax, 0xffffffff
cmovge esi, ecx
push esi
call fcn.0044f9c3
add esp, 4
push esi
push ebx
mov esi, eax
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0x278]
mov eax, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push 0xffffffffffffffff
push dword [ebp - 0x27c]
push esi
call fcn.00451de0
add esp, 0x14
xorps xmm0, xmm0
lea eax, [ebp - 0x264]
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0xa
lea ecx, [ebp - 0x274]
movups xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
setne bl
je 0x451fa5
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x274]
call edi
push dword [ebp - 0x270]
call edi
push esi
call fcn.0044f120
add esp, 4
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x451e94
push eax
call fcn.0044f120
add esp, 4
jmp 0x451e94
Function at 0x1000d839
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000d898
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x14c2
push dword [ebp - 0x14]
push 1
push 0x2054
push 0x6d16
push 0x1881
mov eax, dword [ebp - 0x18]
push dword [eax]
call fcn.1000c251
add esp, 0x20
jmp 0x1000d8a9
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x1000f253
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000f26d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1000f2b8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000f29b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1000f2b8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10012a38
mov dword [eax], 0xdbf0cf86
jmp 0x1000f290
mov esp, ebp
pop ebp
ret
Function at 0x1001274d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10012771
xor eax, eax
jmp 0x100128e4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1001278f
xor eax, eax
jmp 0x100128e4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.100122a9
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x100127ae
xor eax, eax
jmp 0x100128e4
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push 0x73b
push 0x236a
push 0x7c28
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.10012118
add esp, 0x24
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x49e1
lea eax, [ebp - 4]
push eax
push 0x2c45
push 1
call fcn.100122fe
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10012837
push 0x38c7
push 0x2768
push 0x718a
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push 0x1b9a
push 0x4494
push 0x26d
call fcn.1001239f
add esp, 0x24
push dword [ebp - 4]
call fcn.10011942
pop ecx
test eax, eax
jne 0x1001284b
xor eax, eax
jmp 0x100128e4
push 0x3c73
lea eax, [ebp - 4]
push eax
push 0x2e2c
push 1
push 0x30d
push 0x77a7
push 0x14db
push 0x299a
push 0x2bf7
call fcn.10012520
add esp, 0x24
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100128cc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1001289b
xor eax, eax
jmp 0x100128e4
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100128b4
xor eax, eax
jmp 0x100128e4
lea eax, [ebp - 4]
push eax
push 1
push 0x6038
push 0x4101
call fcn.100126d9
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100128dd
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100128e1
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100294fd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029525
push 0
push 0x610
push 0
push 0
push 0x193d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10029570
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10029553
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10029570
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10012a38
mov dword [eax], 8
jmp 0x10029548
mov esp, ebp
pop ebp
ret
Function at 0x1002c3ed
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002c416
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1002c431
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002c431
push 0x3f6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret