joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101038a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101997a0
call fcn.1014e9b0
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.1014e980
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
and eax, 0x8000
je 0x101038fb
mov esi, esp
push 0x23
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1014e980
call fcn.10109770
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret

Function at 0x10104000
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10191a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10199808
call fcn.1014e9b0
mov ecx, dword [ebp + 8]
call fcn.1013edb0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.1012f250
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x10]
push edx
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x101040ae
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.100d6d50
mov esi, esp
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, esp
call fcn.1014e980
cmp dword [ebp - 0x2c], 0
je 0x101040a8
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, esp
call fcn.1014e980
mov al, 1
jmp 0x101040b0
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x101040e0]
call fcn.1014e920
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014e9f0
add esp, 0xf0
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x10104740
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
lea edi, [ebp - 0x10]
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101997a0
call fcn.1014e9b0
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1014e980
cwde
and eax, 0x8000
je 0x10104787
mov byte [ebp - 0xcd], 1
jmp 0x1010478e
mov byte [ebp - 0xcd], 0
mov cl, byte [ebp - 0xcd]
mov byte [ebp - 5], cl
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0
push 0
push 0
push 0
push 2
call dword [sym.imp.USER32.dll_mouse_event]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0
push 0
push 0
push 0
push 4
call dword [sym.imp.USER32.dll_mouse_event]
cmp esi, esp
call fcn.1014e980
movzx eax, byte [ebp - 5]
test eax, eax
je 0x10104812
mov esi, esp
push 0
push 0
push 0
push 0
push 2
call dword [sym.imp.USER32.dll_mouse_event]
cmp esi, esp
call fcn.1014e980
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x10109770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
lea edi, [ebp - 0x10]
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101997a0
call fcn.1014e9b0
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.1014e980
cwde
and eax, 0x8000
je 0x101097b7
mov byte [ebp - 0xcd], 1
jmp 0x101097be
mov byte [ebp - 0xcd], 0
mov cl, byte [ebp - 0xcd]
mov byte [ebp - 5], cl
mov esi, esp
push 0
push 0
push 0
push 0
push 2
call dword [sym.imp.USER32.dll_mouse_event]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0
push 0
push 0
push 0
push 4
call dword [sym.imp.USER32.dll_mouse_event]
cmp esi, esp
call fcn.1014e980
movzx eax, byte [ebp - 5]
test eax, eax
je 0x1010981a
mov esi, esp
push 0
push 0
push 0
push 0
push 2
call dword [sym.imp.USER32.dll_mouse_event]
cmp esi, esp
call fcn.1014e980
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x1010a700
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push ebx
push esi
push edi
lea edi, [ebp - 0x1c]
mov ecx, 7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10191a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x101997a0
call fcn.1014e9b0
mov ecx, dword [ebp + 0xc]
call fcn.1013edb0
mov dword [ebp - 0xc], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1014e980
test eax, eax
je 0x1010a793
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.1012f250
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VCRUNTIME140D.dll_memcpy
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1014e980
push edx
mov ecx, ebp
push eax
lea edx, [0x1010a7c4]
call fcn.1014e920
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014e9f0
add esp, 0xdc
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x1010ab00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
lea edi, [ebp - 0x60]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10191a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x101997a0
call fcn.1014e9b0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xf8]
push ecx
mov ecx, 0x10198080
call fcn.100df330
mov dword [ebp - 0x114], eax
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x118], edx
lea eax, [ebp - 0x10c]
push eax
mov ecx, 0x10198080
call fcn.10132010
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
push edx
mov ecx, dword [ebp - 0x118]
call fcn.100fb410
mov byte [ebp - 0xe1], al
lea ecx, [ebp - 0x10c]
call fcn.100f51f0
lea ecx, [ebp - 0xf8]
call fcn.100f51f0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1010aca1
lea eax, [ebp + 8]
push eax
mov ecx, 0x10198080
call fcn.100fc120
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call fcn.1013edb0
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
mov esi, esp
lea ecx, [ebp - 0x18]
push ecx
push 0x40
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1014e980
test eax, eax
je 0x1010ac93
mov ecx, dword [ebp - 0xc]
call fcn.1013edb0
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0xc]
call fcn.1012f250
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call sub.VCRUNTIME140D.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0xc]
call fcn.1013edb0
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x11c], ecx
mov esi, esp
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1014e980
lea eax, [ebp + 8]
push eax
mov ecx, 0x10198080
call fcn.10133150
push edx
mov ecx, ebp
push eax
lea edx, [0x1010acd0]
call fcn.1014e920
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014e9f0
add esp, 0x120
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x10114f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x6c]
mov ecx, 0x1b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10191a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov ecx, 0x101997a3
call fcn.1014e9b0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x10114fb8
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10114fbf
mov al, 1
jmp 0x101150fa
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x120], edx
call fcn.100069e0
mov dword [ebp - 0x124], eax
mov esi, esp
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0xc]
call dword [ebp - 0x120]
cmp esi, esp
call fcn.1014e980
mov dword [ebp - 0x128], eax
call fcn.100069e0
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
call fcn.10006a20
add esp, 8
movzx eax, al
test eax, eax
je 0x10115026
xor al, al
jmp 0x101150fa
mov dword [ebp - 0x18], 0x20
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x120], ecx
mov esi, esp
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x40
push edx
mov ecx, dword [ebp - 0x120]
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
cmp esi, esp
call fcn.1014e980
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x10115084
cmp dword [ebp - 0x124], 1
je 0x1011508b
cmp dword [ebp - 0x124], 3
je 0x101150ed
jmp 0x101150f8
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x40]
sub eax, ecx
mov dword [ebp - 0x58], eax
je 0x101150c4
mov esi, esp
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x58]
push edx
push 1
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp esi, esp
call fcn.1014e980
cmp dword [ebp - 0x58], eax
je 0x101150c4
xor al, al
jmp 0x101150fa
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x101150db
mov dword [ebp - 0x120], 1
jmp 0x101150e5
mov dword [ebp - 0x120], 0
mov al, byte [ebp - 0x120]
jmp 0x101150fa
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x101150fa
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x1011512c]
call fcn.1014e920
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014e9f0
add esp, 0x12c
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x101160d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10199719
call fcn.1014e9b0
mov dword [ebp - 8], 0
jmp 0x10116107
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x1011612a
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
imul eax, dword [ebp + 8], 0x1000193
mov dword [ebp + 8], eax
jmp 0x101160fe
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret

Function at 0x101366d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
mov edi, ebp
xor ecx, ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10199809
call fcn.1014e9b0
call fcn.10136750
call fcn.10134800
call fcn.10108720
call fcn.101046c0
push 0x10136180
push 0x10197c44
push 8
call fcn.100b0a00
add esp, 0xc
mov esi, esp
push 0
push 0
push 0
push 0x10103910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1014e980
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret

Function at 0x10136750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
mov edi, ebp
xor ecx, ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101997a0
call fcn.1014e9b0
push 0x3c
push 1
call fcn.10108aa0
add esp, 8
movzx eax, al
test eax, eax
je 0x10136786
jmp 0x10136797
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1014e980
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x10136b60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
lea edi, [ebp - 0x148]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10191a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x101997a0
call fcn.1014e9b0
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov esi, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, esp
call fcn.1014e980
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x10136c36
mov esi, esp
push 0x100
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp esi, esp
call fcn.1014e980
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x138]
call fcn.10004910
push 0
push str.Dynast.io
lea ecx, [ebp - 0x138]
call fcn.10134460
cmp eax, 0xffffffff
je 0x10136c2b
mov byte [ebp - 0x201], 1
lea ecx, [ebp - 0x138]
call fcn.10005120
mov al, byte [ebp - 0x201]
jmp 0x10136c38
lea ecx, [ebp - 0x138]
call fcn.10005120
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x10136c68]
call fcn.1014e920
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014e9f0
add esp, 0x208
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret
Function at 0x10141230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2c]
mov ecx, 0xb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101997a3
call fcn.1014e9b0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10141286
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
cmp esi, esp
call fcn.1014e980
jmp 0x10141398
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov esi, esp
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
cmp esi, esp
call fcn.1014e980
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp + 0x10], 0
jl 0x10141340
jg 0x101412c0
cmp dword [ebp + 0xc], 0
jbe 0x10141340
cmp dword [ebp - 0x24], 0
jl 0x10141340
jg 0x101412ce
cmp dword [ebp - 0x28], 0
jbe 0x10141340
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x24]
jg 0x101412ec
jl 0x101412e0
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x28]
jae 0x101412ec
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov esi, esp
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp esi, esp
call fcn.1014e980
push eax
call fcn.10006880
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x24]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x28]
mov esi, esp
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp esi, esp
call fcn.1014e980
cmp dword [ebp + 0x10], 0
jl 0x1014138c
jg 0x1014134e
cmp dword [ebp + 0xc], 0
jbe 0x1014138c
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1014138c
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp esi, esp
call fcn.1014e980
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
sbb edx, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0xec
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret 0xc
Function at 0x101413b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10199809
call fcn.1014e9b0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x1014148e
cmp dword [ebp - 0xc4], 1
je 0x101413f9
jmp 0x10141493
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x101037d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x101095d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x101033f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1014e980
mov esi, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x10105280
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1014e980
jmp 0x10141493
call fcn.100b1220
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.1014e980
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1014bf90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1014bfbc
mov dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.1014bf50
mov esp, ebp
pop ebp
ret 8
Function at 0x401440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42d0ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [0x43a56c]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x150], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0x30]
push 0x105
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x15c]
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x158], 3
mov edx, dword [ecx + 4]
push edx
call dword [0x430260]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x14]
push eax
push 0x4380f8
push ecx
call int.00426db6
add esp, 0xc
lea ecx, [esp + 0x14]
push 0x5c
call fcn.00426a61
inc eax
lea edx, [esp + 0x10]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004269e9
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], 4
call fcn.004275e1
lea ecx, [esp + 0x10]
mov byte [esp + 0x150], 3
call fcn.004274f4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
call fcn.004275e1
push 0x438120
lea ecx, [esp + 0x10]
call fcn.004276f5
mov ecx, dword [esp + 0xc]
push 0
push ecx
call dword [0x430264]
mov edx, dword [0x43a56c]
mov dword [esp + 0x20], edx
lea eax, [esp + 0x10]
mov bl, 5
push eax
mov byte [esp + 0x154], bl
call fcn.00426e12
mov ecx, dword [eax]
lea edx, [esp + 0x10]
mov dword [esp + 0x28], ecx
push 0x4380d8
push edx
lea ecx, [esp + 0x30]
call fcn.00426e25
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x154], 6
call fcn.004275e1
mov byte [esp + 0x150], bl
lea ecx, [esp + 0x10]
call fcn.004274f4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x20]
push str.aL
push edx
call int.00426db6
mov eax, dword [0x43a56c]
add esp, 0x10
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push 0x438108
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x158], 8
call fcn.00426e25
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x154], 9
call fcn.004275e1
lea ecx, [esp + 0x10]
mov byte [esp + 0x150], 8
call fcn.004274f4
mov ecx, dword [esp + 0x18]
push 0x4380c8
push ecx
call fcn.0041e3d0
mov esi, eax
add esp, 8
test esi, esi
je 0x401643
mov edx, dword [esp + 0x1c]
push edx
push 0x438100
push esi
call fcn.0041e287
mov ecx, dword [esp + 0x168]
lea eax, [esp + 0x16c]
push eax
push ecx
push esi
call fcn.0041e24c
push 0x4380fc
push esi
call fcn.0041e287
push esi
call fcn.0041e0e6
push esi
call fcn.0041e069
add esp, 0x28
lea ecx, [esp + 0x1c]
mov byte [esp + 0x150], 7
call fcn.004274f4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x150], bl
call fcn.004274f4
lea ecx, [esp + 0x20]
mov byte [esp + 0x150], 3
call fcn.004274f4
lea ecx, [esp + 0x18]
mov byte [esp + 0x150], 2
call fcn.004274f4
lea ecx, [esp + 0x24]
mov byte [esp + 0x150], 1
call fcn.004274f4
lea ecx, [esp + 0xc]
mov byte [esp + 0x150], 0
call fcn.004274f4
lea ecx, [esp + 0x14]
mov dword [esp + 0x150], 0xffffffff
call fcn.004274f4
mov ecx, dword [esp + 0x148]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret