joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bb80
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 4
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [eax + 0x9924], 0
mov dword [eax + 0x9920], 0
mov dword [eax + 0x991c], 0
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x9918], 0
cmp dword [ecx + 0x14], 0
jne 0x1001bbe1
add ecx, 4
mov dword [esp + 0x10], ecx
cmp dword [ecx], 0
je 0x1001bbd9
mov edx, dword [eax + 0x990c]
jmp 0x1001bbff
mov edx, dword [eax + 0x9908]
jmp 0x1001bbff
mov ecx, dword [esp + 0x18]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp dword [ecx], 0
je 0x1001bbf9
mov edx, dword [eax + 0x9914]
jmp 0x1001bbff
mov edx, dword [eax + 0x9910]
mov ecx, 0xffffffff
mov dword [edx + 8], ecx
mov ebp, 1
lea ebx, [edx + 0x18]
mov dword [edx + 4], ecx
mov dword [edx], ecx
xor ecx, ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x14], ecx
mov edi, ebx
mov esi, edx
mov ecx, 6
add ebx, 0x18
rep movsd dword es:[edi], dword [esi]
mov dword [ebx - 4], ebp
inc ebp
cmp ebp, 0x100
jl 0x1001bc1f
mov ecx, dword [esp + 0x10]
cmp dword [ecx], 0
mov ecx, dword [esp + 0x18]
jne 0x1001bc8a
cmp dword [ecx + 0x14], 0
jne 0x1001bc65
mov dword [eax + 0x9918], 1
cmp dword [ecx], 1
jbe 0x1001bc65
mov dword [eax + 0x991c], 1
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x18], 0
je 0x1001bcaf
mov dword [eax + 0x9920], 1
cmp dword [ecx], 1
jbe 0x1001bcaf
mov dword [eax + 0x9924], 1
jmp 0x1001bcaf
cmp dword [ecx + 0x14], 1
sbb ecx, ecx
xor esi, esi
neg ecx
mov dword [eax + 0x991c], ecx
mov ecx, dword [esp + 0x18]
cmp esi, dword [ecx + 0x18]
mov ecx, 1
adc ecx, 0xffffffff
mov dword [eax + 0x9924], ecx
cmp dword [eax + 0x991c], 0
je 0x1001bccb
mov edi, dword [eax + 0x990c]
cmp edi, edx
je 0x1001bccb
mov esi, edx
mov ecx, 0x600
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x9920], 0
je 0x1001bce7
mov edi, dword [eax + 0x9910]
cmp edi, edx
je 0x1001bce7
mov esi, edx
mov ecx, 0x600
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x9924], 0
je 0x1001bd03
mov edi, dword [eax + 0x9914]
cmp edi, edx
je 0x1001bd03
mov esi, edx
mov ecx, 0x600
rep movsd dword es:[edi], dword [esi]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x1001bd10
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x810
mov eax, dword [0x1002b150]
push ebx
push esi
push edi
xor esi, esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x10], eax
add eax, 0x6914
cmp dword [eax], 0
je 0x1001bd44
add eax, 0x18
inc esi
cmp esi, 0x100
jl 0x1001bd31
jmp 0x1001bd45
inc esi
cmp esi, 0x100
jl 0x1001bd5d
mov eax, 0xffffffc2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x810
ret
xor eax, eax
test esi, esi
jle 0x1001bd6c
mov dword [esp + eax*4 + 0x20], eax
inc eax
cmp eax, esi
jl 0x1001bd63
mov dword [esp + 0x18], esi
cmp esi, 1
jle 0x1001beb2
lea eax, [esi + esi*2]
mov ecx, dword [esp + 0x10]
lea edi, [ecx + eax*8 + 0x6908]
lea eax, [esp + esi*4 + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 4]
mov eax, dword [esp + 0x10]
lea edx, [ecx + ecx*2]
mov ecx, dword [esp + 0x14]
mov dword [eax + edx*8 + 0x6908], esi
mov edx, dword [ecx]
mov ecx, dword [esp + 0x10]
lea eax, [edx + edx*2]
mov dword [ecx + eax*8 + 0x6908], esi
lea ebx, [ecx + eax*8]
mov eax, dword [esp + 0x14]
sub eax, 4
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
mov dword [edi + 4], eax
mov dword [edi + 8], edx
lea edx, [eax + eax*2]
mov eax, dword [ecx + edx*8 + 0x6914]
lea ebp, [ecx + edx*8]
add eax, dword [ebx + 0x6914]
mov dword [edi + 0xc], eax
jns 0x1001be25
mov eax, dword [0x1002b150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x6914
mov ecx, 0x200
mov edx, dword [eax]
cmp edx, 1
jne 0x1001be0b
mov dword [eax], 1
jmp 0x1001be10
shr edx, 1
mov dword [eax], edx
add eax, 0x18
dec ecx
jne 0x1001bdfc
mov eax, dword [ebp + 0x6914]
add eax, dword [ebx + 0x6914]
mov dword [edi + 0xc], eax
mov ecx, dword [ebp + 0x6918]
mov eax, dword [ebx + 0x6918]
cmp ecx, eax
jg 0x1001be37
mov ecx, eax
inc ecx
mov dword [edi + 0x10], ecx
cmp ecx, 0x10
jle 0x1001be4d
push esi
call fcn.1001bee0
add esp, 4
test eax, eax
je 0x1001becc
mov ebx, dword [esp + 0x18]
sub ebx, 3
js 0x1001be83
lea edx, [esp + ebx*4 + 0x20]
mov eax, dword [edi + 0xc]
mov ecx, dword [edx]
lea ebp, [ecx + ecx*2]
mov ecx, dword [esp + 0x10]
cmp dword [ecx + ebp*8 + 0x6914], eax
jg 0x1001be82
mov ecx, dword [edx]
sub edx, 4
dec ebx
mov dword [edx + 8], ecx
lea ecx, [esp + 0x20]
cmp edx, ecx
jae 0x1001be5d
jmp 0x1001be83
inc ebx
test ebx, ebx
jge 0x1001be89
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
add edi, 0x18
mov dword [esp + ebx*4 + 0x20], esi
inc esi
mov dword [eax], 0
mov dword [esp + 0x14], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jg 0x1001bd8f
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x824]
pop ebp
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
add esp, 0x810
ret
mov eax, 0xffffffc2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x810
ret
Function at 0x1001c130
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [eax + 0x6918]
mov ecx, 0x200
mov dword [edx], 0xffffffff
add edx, 0x18
dec ecx
jne 0x1001c14a
mov ecx, dword [esp + 0x10]
lea esi, [eax + 0x6908]
xor edi, edi
cmp ecx, 0xffffffff
je 0x1001c196
lea eax, [ecx + ecx*2]
lea ebx, [esi + eax*8]
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x1001c181
lea eax, [eax + eax*2]
mov eax, dword [esi + eax*8 + 0x10]
inc eax
mov dword [ebx + 0x10], eax
jmp 0x1001c184
mov dword [ebx + 0x10], edi
mov eax, dword [ebx + 4]
push eax
push esi
call fcn.1001c1f0
add esp, 8
mov ecx, dword [ebx + 8]
jmp 0x1001c162
push 0x1001c0e0
push 0x18
push 0x200
xor edi, edi
push esi
call fcn.100267c8
mov eax, dword [esp + 0x24]
add esp, 0x10
lea ecx, [eax + 0x10]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
cmp dword [esi + 4], 0xffffffff
jne 0x1001c1e5
mov ebx, 0xffffffff
cmp dword [esi + 0xc], edi
je 0x1001c1e5
mov edx, dword [esi + 0x10]
inc ecx
add esi, 0x18
inc byte [edx + eax - 1]
mov dl, byte [esi - 4]
mov byte [ecx - 1], dl
cmp dword [esi + 4], ebx
je 0x1001c1ca
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x1001cd60
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push ebx
mov eax, dword [0x1002b150]
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push eax
call ebx
mov esi, dword [eax + 0x5e80]
mov edi, dword [eax + 0x5e78]
sub esi, dword [eax + 0x180]
mov eax, dword [0x1002b150]
push eax
call ebx
mov eax, dword [eax + 0x180]
cmp esi, eax
jbe 0x1001cdab
add edi, eax
sub esi, eax
mov eax, esi
dec esi
test eax, eax
je 0x1001cdab
xor byte [edi], 0x80
inc edi
mov eax, esi
dec esi
test eax, eax
jne 0x1001cda0
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1001d480
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1001ce91
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1001d45d
call fcn.1001cf20
out 0x54, al
invalid
Function at 0x100200b0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x100200d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1002b150], eax
cmp eax, 0xffffffff
jne 0x100200d0
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 1
push 0x9a50
call sub.LTKRN70N.dll_Ordinal_204
mov ebx, eax
test ebx, ebx
jne 0x100200e8
xor eax, eax
pop edi
pop esi
pop ebx
ret
push ebx
mov eax, dword [0x1002b150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebx + 0x4868]
lea ecx, [ebx + 0x5868]
mov byte [ebx + 0x5c0], 0xff
mov eax, 0x20
mov dword [ecx], edx
add ecx, 4
add edx, 0x80
dec eax
jne 0x1002010d
mov esi, 0x10033c18
lea edi, [ebx + 0x5a18]
mov ecx, 0x58
rep movsd dword es:[edi], dword [esi]
mov esi, 0x10033d78
lea edi, [ebx + 0x5b78]
mov ecx, 0x36
rep movsd dword es:[edi], dword [esi]
mov esi, 0x10033e50
lea edi, [ebx + 0x5c4]
mov ecx, 0x42
push 0x1800
rep movsd dword es:[edi], dword [esi]
call sub.LTKRN70N.dll_Ordinal_203
push 0x1800
mov dword [ebx + 0x9908], eax
call sub.LTKRN70N.dll_Ordinal_203
push 0x1800
mov dword [ebx + 0x990c], eax
call sub.LTKRN70N.dll_Ordinal_203
push 0x1800
mov dword [ebx + 0x9910], eax
call sub.LTKRN70N.dll_Ordinal_203
pop edi
mov dword [ebx + 0x9914], eax
xor eax, eax
pop esi
mov dword [ebx + 0x68fc], eax
mov dword [ebx + 0x9a34], eax
mov dword [ebx + 0x9a38], eax
mov eax, 1
pop ebx
ret

Function at 0x100201b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov eax, dword [0x1002b150]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [esp + 0xc]
test edi, edi
je 0x10020202
test esi, esi
jne 0x10020206
mov eax, dword [edi + 0x9908]
push eax
call sub.LTKRN70N.dll_Ordinal_208
mov eax, dword [edi + 0x990c]
push eax
call sub.LTKRN70N.dll_Ordinal_208
mov eax, dword [edi + 0x9910]
push eax
call sub.LTKRN70N.dll_Ordinal_208
mov eax, dword [edi + 0x9914]
push eax
call sub.LTKRN70N.dll_Ordinal_208
push edi
call sub.LTKRN70N.dll_Ordinal_208
test esi, esi
je 0x10020212
mov eax, dword [0x1002b150]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
pop edi
pop esi
ret
Function at 0x10027f7c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.10028007
mov dword [0x10035f64], 1
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov byte [0x10035f60], bl
jne 0x10027fdd
cmp dword [0x1002b464], 0
je 0x10027fcb
mov esi, dword [0x1002b460]
sub esi, 4
cmp esi, dword [0x1002b464]
jb 0x10027fcb
mov eax, dword [esi]
test eax, eax
je 0x10027fc0
call eax
sub esi, 4
cmp esi, dword [0x1002b464]
jae 0x10027fb8
push 0x10037744
push 0x10037740
call fcn.1002801d
add esp, 8
push 0x1003774c
push 0x10037748
call fcn.1002801d
add esp, 8
test ebx, ebx
je 0x10027ffa
call fcn.10028012
jmp 0x10028004
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret

Function at 0x1002803d
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.10029412
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10035f68], eax
cmp eax, 0xffffffff
je 0x1002809a
push 0x70
push 1
call fcn.1002950a
add esp, 8
mov esi, eax
test esi, esi
je 0x1002809a
push esi
mov eax, dword [0x10035f68]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1002809a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], 0x10037180
mov dword [esi + 0x14], 1
jmp 0x1002809c
xor eax, eax
pop esi
ret

Function at 0x10028938
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 4
xor ecx, ecx
mov eax, 0x100369a8
push edi
cmp dword [eax], edx
je 0x10028956
add eax, 8
inc ecx
cmp eax, 0x10036a20
jb 0x10028947
cmp dword [ecx*8 + 0x100369a8], edx
lea eax, [ecx*8]
jne 0x1002898f
mov edx, dword [eax + 0x100369ac]
push 0
lea eax, [esp + 8]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, dword [0x100362c0]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
add esp, 4
ret
Function at 0x16bd3008
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.16bd4324
test esi, esi
jne 0x16bd303e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.16bd4414
jmp 0x16bd305c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.16bd2f0c
mov edi, eax
test esi, esi
je 0x16bd305c
cmp dword [ebx], 0
je 0x16bd305c
dec esi
jmp 0x16bd3045
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x16bd3090
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x16bea008], 0x8088405
inc edx
mov dword [ebx + 0x16bea008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x16bd36d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x16bea018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x16bd376c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x16bd374c
xor eax, eax
push ebp
push 0x16bd3745
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x16bd3788
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bd374c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x16bea018]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x16bea018], ax
mov esp, ebp
pop ebp
ret

Function at 0x16bd41a4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x16c04044], 0
je 0x16bd4205
cmp word [0x16c04218], 0xd7b2
jne 0x16bd41cd
cmp dword [0x16c04220], 0
jbe 0x16bd41cd
mov eax, 0x16c04214
call dword [0x16c04230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x16bd422c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x16bea024], 0
jne 0x16bd4221
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x16bd50c4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x16bd52f4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x16bd5147
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x16bd52f4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x16bd5147
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x16bd5310
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x16bd51d0
xor eax, eax
push ebp
push 0x16bd51c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.16bd4f00
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x16bd51ae
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x16bd5330
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x16bd51ae
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bd51d0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x16bd52ea
cmp byte [ebp - 0xd], 0
jne 0x16bd5217
cmp byte [ebp - 0x12], 0
je 0x16bd52ea
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x16bd5230
dec ebx
cmp byte [ebx], 0x2e
je 0x16bd523f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x16bd522f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x16bd52ea
inc ebx
cmp byte [ebp - 0x12], 0
je 0x16bd527c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x16bd52ea
cmp byte [ebp - 0xd], 0
je 0x16bd52ea
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x16bd52ea
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x16bd51d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x16bd52f4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x16bd5147
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x16bd52f4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x16bd5147
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x16bd5310
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x16bd51d0
xor eax, eax
push ebp
push 0x16bd51c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.16bd4f00
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x16bd51ae
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x16bd5330
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x16bd51ae
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bd51d0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x16bd52ea
cmp byte [ebp - 0xd], 0
jne 0x16bd5217
cmp byte [ebp - 0x12], 0
je 0x16bd52ea
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x16bd5230
dec ebx
cmp byte [ebx], 0x2e
je 0x16bd523f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x16bd522f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x16bd52ea
inc ebx
cmp byte [ebp - 0x12], 0
je 0x16bd527c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x16bd52ea
cmp byte [ebp - 0xd], 0
je 0x16bd52ea
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x16bd52ea
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x16bd59f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ecx, 0x16bea7b0
mov ebx, ecx
cmp dword [ecx + 0x18448], 0
je 0x16bd5a2d
mov edx, ecx
xor eax, eax
mov esi, eax
add esi, esi
add esi, esi
inc esi
imul esi, dword [ecx + 0x18448]
xor dword [edx], esi
add edx, 4
inc eax
cmp eax, 0x6112
jne 0x16bd5a0a
xor eax, eax
mov dword [ecx + 0x18448], eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x16bd5d44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, edx
mov ebp, eax
xor edi, edi
call fcn.16bd5b68
test esi, esi
je 0x16bd5d92
test ebp, ebp
je 0x16bd5d92
mov eax, esi
call fcn.16bd2c94
mov edi, eax
test edi, edi
je 0x16bd5d92
mov edx, esi
dec edx
test edx, edx
jb 0x16bd5d92
inc edx
xor eax, eax
mov ecx, esi
dec ecx
sub ecx, eax
movzx ecx, byte [ebp + ecx]
mov ebx, eax
imul bx, word [0x16c02c58]
add bl, 0xda
xor cl, bl
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x16bd5d72
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x16bd62dc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x104
call fcn.16bd31b0
push 0x104
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.16bd4790
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.16bd4414
add esp, 0x104
pop esi
pop ebx
ret