joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x41d704]
cmp word [0x41d4e0], 0
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
jne 0x40825f
lea edx, [ebp - 0x10]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [ebp - 0x10], 8
mov dword [esp + 8], edx
mov dword [ebp - 0xc], 0x4b0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call ebx
mov edx, eax
sub esp, 0x10
mov eax, dword [0x41d704]
test edx, edx
je 0x408360
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb8
mov dword [esp], eax
call ebx
sub esp, 0x10
test eax, eax
je 0x408360
cmp word [0x41d4e0], 0
mov ebx, 0x41caa0
movzx eax, word [0x41caa0]
jne 0x408370
test ax, ax
je 0x4083b0
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4082b0
sub eax, ebx
sar eax, 1
cmp word [0x41c8a0], 0
je 0x4082e3
mov edx, 0x41c8a0
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4082d0
sub edx, 0x41c8a0
sar edx, 1
add eax, edx
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_calloc]
mov esi, eax
test eax, eax
je 0x4083fc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x41c8a0
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [0x41d708]
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0x33
mov dword [esp + 8], 0x411d38
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
sub esp, 0x10
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
cmp ebx, 6
je 0x4083c0
xor eax, eax
cmp ebx, 7
sete al
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x41d4e0
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x408378
cmp ebx, 0x41d4e0
jbe 0x4083b0
lea esi, [esi]
cmp ax, 0x5c
je 0x4083f0
cmp ax, 0x2f
je 0x4083f0
sub ebx, 2
movzx eax, word [ebx]
cmp ebx, 0x41d4e0
ja 0x408390
jmp 0x4082a1
xor eax, eax
jmp 0x4082bd
cmp word [0x41d4e0], 0
je 0x4083e0
mov edx, dword [0x410284]
lea esp, [ebp - 8]
mov eax, 0x41d4e0
pop ebx
pop esi
pop ebp
jmp fcn.00407e10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp fcn.00408040
movzx eax, word [ebx + 2]
add ebx, 2
jmp 0x4082a1
xor eax, eax
jmp 0x408350
Function at 0x40ef10
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call 0x40ef80
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.0040efd0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]

Function at 0x40efd0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call fcn.0040efc0
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40f05f
cmp al, 9
je 0x40f050
cmp al, 0x20
je 0x40f050
xor esi, esi
mov dword [ebp - 0x6c], 0
lea esi, [esi]
cmp al, 0x5c
je 0x40f0b8
cmp al, 0x22
je 0x40f0c8
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x40f05f
cmp al, 9
sete dl
cmp al, 0x20
sete cl
or dl, cl
je 0x40f010
test esi, 1
jne 0x40f010
lea esi, [esi]
nop
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x40f050
cmp al, 0x20
je 0x40f050
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x40f07a
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040de20
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x40f027
and dword [ebp - 0x6c], 1
jne 0x40f020
xor esi, 1
jmp 0x40f027
Function at 0x114c280
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x9c], 0
mov esp, ebp
pop ebp
ret
Function at 0x1159c60
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0xdf30e0]
test eax, eax
je 0x1159c9f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1159c9f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1159c9f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1159c9f
cmp dword [ecx + 0x74], 0xe
jbe 0x1159c9f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x117f1f0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x117f352
cmp edi, esi
je 0x117f352
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x117f342
add edi, 4
jmp 0x117f2a3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x117f2b8
mov dword [ebp - 4], 2
jmp 0x117f2d9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x117f2cf
mov dword [ebp - 4], 1
jmp 0x117f2d9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x117f352
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x117f310
mov byte [ecx + 2], 0x3d
jmp 0x117f31d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x117f32c
mov byte [ecx], 0x3d
jmp 0x117f332
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x117f2a0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1318507
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp edi
xor ebx, edx
cmp edx, 0x58705b4b
add edi, edx
jmp 0x1180f2c
push ebp
xchg bp, bp
movsx ebp, bx
push esi
movzx ebp, dx
push ebx
pushfd
mov si, sp
movzx ebp, ax
push edx
push ecx
btr ebp, 0x8e
push edi
push eax
movzx esi, ax
mov ecx, 0x9a0000
cdq
push ecx
cwde
rdtsc
mov ebp, dword [esp + 0x28]
bts ebx, ecx
ror ebp, 3
lea ebp, [ebp + 0x3f0e400f]
neg ebp
cbw
rol ebp, 1
shr dx, cl
neg ebp
lea ebp, [ebp + ecx]
sar ax, cl
mov di, si
cmp si, 0x1ddd
mov esi, esp
ror ah, 0xfa
bt edx, 0xfc
btc edx, 0xa
sub esp, 0xc0
rdtsc
mov ebx, ebp
or ah, dl
sal al, cl
inc di
mov eax, 0x9a0000
movzx edx, ax
sub ebx, eax
test si, cx
lea edi, [0xf9ff84]
lea ebp, [ebp - 4]
mov edx, dword [ebp]
xor edx, ebx
neg edx
rol edx, 1
jmp 0x13eec4d
inc edx
ror edx, 3
neg edx
jmp 0x11d2107

Function at 0x10010dc
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x1002040
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x100110e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2713
call fcn.01001439
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x10010ac
jmp 0x1001121
cmp al, 0x73
jne 0x1001142
xor ebx, ebx
inc ebx
push esi
push edi
push dword [ebp + 8]
call fcn.01001475
cmp eax, 0xffffffff
jne 0x100111a
mov eax, dword [0x1002004]
cmp dword [edi + eax*4], 0
je 0x1001154
push 0x2714
jmp 0x1001147
push 0x2710
push 2
call fcn.010013ca
pop ecx
pop ecx
push 1
jmp 0x10011d0
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jge 0x100117d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2712
call fcn.01001439
jmp 0x1001150
test ebx, ebx
je 0x1001199
lea eax, [ebp - 0x400]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x1001199
and byte [eax], 0
lea eax, [ebp - 0x400]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011a2
sub eax, edx
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.msvcrt.dll_puts]
pop ecx
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x100044b0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, ecx
push esi
push 0
push 0
push 0x26
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
js 0x10004503
push 0x104
push str.GoogleChromeApplicationchrome.exe
push 0x104
push esi
call fcn.10013576
add esp, 0x10
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100045ef
push esi
push 0
push 0
push 0x2a
push 0
call edi
test eax, eax
js 0x10004545
push 0x104
push str.GoogleChromeApplicationchrome.exe
push 0x104
push esi
call fcn.10013576
add esp, 0x10
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100045ef
sub esp, 8
mov ecx, esi
push SysReAllocString
call fcn.10004620
test al, al
jne 0x1000460d
sub esp, 8
mov ecx, esi
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10004620
test al, al
jne 0x1000460d
push esi
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x100045b1
push 0x104
push str.GoogleChromeApplicationchrome.exe
push 0x104
push esi
call fcn.10013576
add esp, 0x10
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100045ef
push esi
push 0
push 0
push 0x1c
push 0
call edi
test eax, eax
js 0x100045fa
push 0x104
push str.GoogleChromeApplicationchrome.exe
push 0x104
push esi
call fcn.10013576
add esp, 0x10
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push esi
call ebx
cmp eax, 0xffffffff
je 0x100045fa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret
push str.chrome.exe
push 0x104
push esi
call fcn.10013581
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x10004620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, dword [ebp + 8]
xor bl, bl
push esi
mov esi, ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 1
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Pathschrome.exe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100046b7
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x208
push eax
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10004686
xor eax, eax
mov word [esi], ax
jmp 0x100046ae
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x100046a5
xor bl, bl
jmp 0x100046ae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e942
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10038cfc]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx], 0
test eax, eax
jne 0x1000b8b3
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x10038cfc], eax
mov edi, dword [ebp + 8]
mov ecx, edi
shr ecx, 4
inc ecx
push 0
movzx esi, cx
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x1000b909
push 0x409
push esi
push 6
push dword [0x10038cfc]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x1000b909
push 8
call fcn.1000eb8b
push 0x100333f8
push 4
push eax
mov dword [ebx], eax
call fcn.10013581
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
push eax
push dword [0x10038cfc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, edi
mov esi, eax
and ecx, 0xfffffff0
xor eax, eax
dec ecx
movzx eax, ax
inc ecx
lea esi, [esi + eax*2]
movzx eax, word [esi]
add esi, 2
cmp ecx, edi
jb 0x1000b927
mov edi, eax
xor ecx, ecx
mov edx, 2
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000eb8b
add edi, edi
mov dword [ebx], eax
push edi
push esi
push eax
call fcn.10010120
mov eax, dword [ebx]
add esp, 0x10
xor ecx, ecx
mov word [edi + eax], cx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10018688
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100186c7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100186c7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100186c7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100186c7
cmp dword [ecx + 0x74], 0xe
jbe 0x100186c7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001d95e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002f1a8
push 0x1002f1a0
push str.FlsAlloc
push 0x1f
call fcn.1001d826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d992
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002b1f0]
call esi
jmp 0x1001d998
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001d9dc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002f1b8
push 0x1002f1b0
push str.FlsGetValue
push 0x21
call fcn.1001d826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001da13
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002b1f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001da1b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002f1c0
push 0x1002f1b8
push str.FlsSetValue
push 0x22
call fcn.1001d826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001da55
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002b1f0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10021206
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100212a3
push ebx
push esi
call fcn.100211cf
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001ffa4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10021250
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100212a2
push edi
push eax
call fcn.100199bf
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10021270
call fcn.10019985
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100212a1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001ffa4
add esp, 0x20
test eax, eax
jne 0x1002128f
push edi
call fcn.10019985
jmp 0x10021297
push ebx
call fcn.10019985
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10024e4c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1001adb9
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10024ebb
cmp esi, dword [ebp - 4]
je 0x10024eb6
cmp dword [ebp + 0xc], 0
je 0x10024eb6
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10024e93
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1002499e
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10024ebd
xor eax, eax
inc eax
jmp 0x10024ebd
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10024f22
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1001adb9
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1001adb9
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10024f99
cmp word [ecx], dx
je 0x10024f99
mov eax, dword [0x1002f67c]
push edi
dec eax
push eax
push 0x1002f568
call fcn.10024ec1
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002500c
cmp word [eax], dx
je 0x1002500c
mov eax, dword [edi]
test eax, eax
je 0x10024fbd
cmp word [eax], dx
je 0x10024fbd
lea eax, [ebp - 0x10]
push eax
call fcn.100248a4
jmp 0x10024fc6
lea eax, [ebp - 0x10]
push eax
call fcn.1002493f
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10025036
mov eax, dword [0x1002f564]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1002f258
call fcn.10024ec1
add esp, 0xc
test al, al
je 0x10025036
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10025001
cmp word [eax], di
je 0x10025001
lea eax, [ebp - 0x10]
push eax
call fcn.100248a4
pop ecx
jmp 0x10025038
lea eax, [ebp - 0x10]
push eax
call fcn.1002493f
jmp 0x10024ffe
mov eax, dword [edi]
test eax, eax
je 0x10025023
cmp word [eax], dx
je 0x10025023
lea eax, [ebp - 0x10]
push eax
call fcn.10024859
pop ecx
jmp 0x10025036
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10025101
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10024d46
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10025101
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10025101
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10025101
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1002508e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001db5b
test ebx, ebx
je 0x100250fc
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001db5b
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10025101
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10025101
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1002810d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10025103
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e942
leave
ret
Function at 0x10025a8e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100388b8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10025ace
cmp byte [ebx], 0xa
jne 0x10025ace
or byte [edi + eax + 0x28], 4
jmp 0x10025ad3
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10025bd2
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10025bb5
inc eax
cmp dl, 0xd
je 0x10025aff
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10025b25
cmp eax, ecx
jae 0x10025b33
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10025ae7
jmp 0x10025bd2
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10025bb0
cmp dword [ebp - 0x10], 0
je 0x10025bb0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100388b8]
test byte [eax + edi + 0x28], 0x48
je 0x10025b8a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10025b75
mov byte [esi], dl
jmp 0x10025b86
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100388b8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10025bd2
cmp byte [ebp - 1], 0xa
jne 0x10025b99
cmp esi, ebx
jne 0x10025b99
mov byte [esi], 0xa
jmp 0x10025bd1
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100259fe
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10025bd2
mov byte [esi], 0xd
jmp 0x10025bd1
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100388b8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10025bcf
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10025bd2
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret