joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f5b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10044020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea ebx, [esi + 5]
call fcn.1000f6c0
mov eax, dword [eax]
mov dword [eax + 0x10], 5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000f6c0
mov eax, dword [eax]
add eax, 0xc
push eax
push 0x40
push 5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esi]
xor edi, edi
cmp al, 0xe8
je 0x1000f618
cmp al, 0xe9
je 0x1000f618
cmp al, 0xff
jne 0x1000f61d
mov eax, dword [esi + 2]
mov edi, dword [eax]
jmp 0x1000f61d
mov edi, dword [esi + 1]
add edi, ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000f6c0
mov eax, dword [eax]
cmp dword [eax + 0x10], 0
je 0x1000f665
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000f6c0
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000f6c0
push 0
push esi
mov ecx, dword [eax]
push dword [ecx + 0x10]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001365b
mov esp, ebp
pop ebp
ret
Function at 0x1000f6c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031555
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10044020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.1000fa70
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000f743
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1000f8a4
cmp dword [0x10046f94], 0xccccccc
je 0x1000f8ba
mov dword [ebp - 0x28], 0x10046f90
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x24], 0
call fcn.10013669
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov ecx, dword [ebx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov ecx, dword [0x10046f94]
mov ebx, dword [0x10046fa8]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1003e760]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1003e760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x10046f8c]
comiss xmm1, xmm0
jbe 0x1000f853
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.1002c410
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1002db60
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1000f833
cmp ebx, 0x200
jae 0x1000f831
shl ebx, 3
cmp ebx, ecx
jae 0x1000f833
mov ebx, ecx
push ebx
call fcn.1000f8f0
push dword [ebp - 0x1c]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1000fa70
mov ecx, dword [0x10046f94]
mov edx, dword [eax]
jmp 0x1000f856
mov edx, dword [ebp - 0x18]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x10046f94], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x10046fa4]
and eax, dword [ebp - 0x1c]
mov ecx, dword [0x10046f98]
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x10046f90]
jne 0x1000f888
mov dword [ecx + eax*8], esi
jmp 0x1000f897
cmp edi, edx
jne 0x1000f891
mov dword [ecx + eax*8], esi
jmp 0x1000f89b
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1000f89b
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10012857
int3
Function at 0x1000f8f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1000fa5d
lea eax, [ecx - 1]
mov esi, dword [0x10046f90]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x10046f98
lea eax, [edi + edi]
push eax
call fcn.10002700
mov eax, dword [0x10046f90]
lea ebx, [edi - 1]
mov dword [0x10046fa4], ebx
mov dword [0x10046fa8], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1000fa54
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x10046f98]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1000f9b2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1000fa1f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1000f9ec
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1000f9e4
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1000fa1f
cmp ebx, edx
je 0x1000f9fc
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1000fa30
cmp ebx, edx
jne 0x1000f9f0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1000fa54
mov ebx, dword [0x10046fa4]
jmp 0x1000f960
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1000fa1f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.10012857
int3
Function at 0x100100c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10044020]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebx + 8]
push esi
push edi
mov edi, ecx
mov ecx, dword [0x10044aa0]
mov eax, dword [ecx]
cmp edx, 0x78
jne 0x10010190
test eax, eax
je 0x10010273
movss xmm0, dword [edi + 0x24]
movss xmm1, dword [edi + 0x28]
cmp eax, 3
jne 0x10010273
comiss xmm1, xmm0
jb 0x1001017b
cmp byte [edi + 0x48], 0
mov edx, dword [0x7f94cc]
je 0x10010273
mov eax, dword [edi + 0x20]
mov dword [edx + 0x74], eax
mov dword [edi + 0x24], 0
cmp dword [ecx], 3
jne 0x10010143
mov dword [ecx], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4db8ce
call esi
mov eax, dword [edi + 0x48]
mov ecx, 0x4db8ce
mov dword [ecx], eax
mov ax, word [edi + 0x4c]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call esi
jmp 0x10010273
xorps xmm1, xmmword [0x1003e790]
movss dword [ebp - 8], xmm1
addss xmm0, xmm1
jmp 0x1001021a
cmp edx, 0xffffff88
jne 0x10010273
test eax, eax
jne 0x10010206
mov eax, dword [0x7f94cc]
lea esi, [edi + 0x48]
mov dword [ecx], 3
mov eax, dword [eax + 0x74]
mov dword [edi + 0x20], eax
xor eax, eax
cmp byte [esi], al
cmovne esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4db8ce
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
je 0x100101e0
mov ecx, 0x4db8ce
mov eax, dword [ecx]
mov dword [esi], eax
mov ax, word [ecx + 4]
mov word [esi + 4], ax
mov eax, 0x4db8ce
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push 0x4db8ce
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1001020b
cmp eax, 3
jne 0x10010273
movss xmm0, dword [edi + 0x28]
movss dword [ebp - 8], xmm0
addss xmm0, dword [edi + 0x24]
movss xmm1, dword [0x1003e734]
comiss xmm0, xmm1
movss dword [edi + 0x24], xmm0
jbe 0x10010236
mov dword [edi + 0x24], 0x42c80000
movaps xmm0, xmm1
xorps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x10010245
mov dword [edi + 0x24], 0
mov ecx, edi
call fcn.1000fca0
test al, al
je 0x10010273
movss xmm1, dword [ebp - 8]
comiss xmm1, dword [0x1003e6cc]
jbe 0x10010273
movss xmm0, dword [edi + 0x24]
mov ecx, edi
subss xmm0, xmm1
movss dword [edi + 0x24], xmm0
call fcn.1000fca0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001365b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x10010290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10044020]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
mov edx, dword [0x7f94cc]
push esi
push edi
lea edi, [ecx + 0x48]
je 0x10010305
mov eax, dword [0x10044aa0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [eax], 3
mov eax, dword [edx + 0x74]
mov dword [ecx + 0x20], eax
xor eax, eax
cmp byte [edi], al
cmovne edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4db8ce
call esi
test edi, edi
je 0x100102f3
mov ecx, 0x4db8ce
mov eax, dword [ecx]
mov dword [edi], eax
mov ax, word [ecx + 4]
mov word [edi + 4], ax
mov eax, 0x4db8ce
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
jmp 0x1001034d
cmp byte [edi], 0
je 0x1001035d
mov eax, dword [ecx + 0x20]
mov dword [edx + 0x74], eax
mov eax, dword [0x10044aa0]
mov dword [ecx + 0x24], 0
cmp dword [eax], 3
jne 0x10010327
mov dword [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4db8ce
call esi
mov eax, dword [edi]
mov ecx, 0x4db8ce
mov dword [ecx], eax
mov ax, word [edi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push 0x4db8ce
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001365b
mov esp, ebp
pop ebp
ret 4
Function at 0x10010820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100315f5
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10044020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x10044aa0]
lea ecx, [ebp - 0x48]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push str.MouseSmoothing
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 8]
mov byte [edi + 0x14], al
mov eax, dword [0x10046f54]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
mov esi, dword [eax + 4]
call fcn.10002e20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push 0x1003e524
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
call fcn.10002e20
lea eax, [edi + 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1000ec70
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x100108fe
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100108f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100109e8
push ecx
push edx
call fcn.1001369e
add esp, 8
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0x10
jb 0x10010944
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001093a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100109e8
push ecx
push edx
call fcn.1001369e
add esp, 8
lea eax, [edi + 0x14]
mov dword [ebp - 0x38], 0
mov al, byte [eax]
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
test al, al
je 0x1001096f
cmp dword [ebp - 0x18], 3
jne 0x1001096f
push eax
mov ecx, edi
call fcn.10010290
jmp 0x100109cb
cmp byte [edi + 0x48], 0
mov ecx, dword [0x7f94cc]
je 0x100109cb
mov eax, dword [edi + 0x20]
mov dword [ecx + 0x74], eax
mov eax, dword [0x10044aa0]
mov dword [edi + 0x24], 0
cmp dword [eax], 3
jne 0x10010998
mov dword [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
push 0x4db8ce
call esi
mov eax, dword [edi + 0x48]
mov ecx, 0x4db8ce
mov dword [ecx], eax
mov ax, word [edi + 0x4c]
mov word [ecx + 4], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 6
push ecx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001365b
mov esp, ebp
pop ebp
ret 4
call fcn.100186a9
int3
Function at 0x10012230
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031930
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x128
mov eax, dword [0x10044020]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x14], 0x10
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
jb 0x1001227d
mov ecx, dword [ecx]
cmp dword [eax + 0x14], 0x10
jb 0x10012285
mov eax, dword [eax]
cmp dword [edx + 0x14], 0x10
jb 0x1001228d
mov edx, dword [edx]
push ecx
push pe_nt_image_headers32
lea ecx, [ebp - 0x118]
push ecx
push 0x1003df0f
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x100122b2
xor al, al
jmp 0x1001234e
xorps xmm0, xmm0
mov dword [ebp - 0x124], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x120], 0
movups xmmword [ebp - 0x134], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100122e0
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.10002e20
mov edx, str.TRUE
lea ecx, [ebp - 0x134]
call fcn.10007d60
mov ecx, dword [ebp - 0x120]
mov byte [ebp - 0x119], al
cmp ecx, 0x10
jb 0x1001234e
mov edx, dword [ebp - 0x134]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001233e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001236c
push ecx
push edx
call fcn.1001369e
mov al, byte [ebp - 0x119]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001365b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.100186a9
int3

Function at 0x10012610
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10044020]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [0x7f94cc]
cmp byte [edi + 0x48], 0
je 0x10012681
mov eax, dword [edi + 0x20]
mov dword [ecx + 0x74], eax
mov eax, dword [0x10044aa0]
mov dword [edi + 0x24], 0
cmp dword [eax], 3
jne 0x1001264c
mov dword [eax], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4db8ce
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0x48]
mov ecx, 0x4db8ce
mov dword [ecx], eax
mov ax, word [edi + 0x4c]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x58
push edi
call fcn.1001369e
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, edi
xor ecx, ebp
pop edi
call fcn.1001365b
mov esp, ebp
pop ebp
ret 4

Function at 0x1001ca7b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001caba
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001caba
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001caba
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001caba
cmp dword [ecx + 0x74], 0xe
jbe 0x1001caba
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10020184
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036044
push 0x1003603c
push str.FlsAlloc
push 0x1f
call fcn.1002000c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100201b8
push dword [ebp + 8]
mov ecx, esi
call dword [0x10032160]
call esi
jmp 0x100201be
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10020202
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036054
push 0x1003604c
push str.FlsGetValue
push 0x21
call fcn.1002000c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10020239
push dword [ebp + 8]
mov ecx, esi
call dword [0x10032160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10020241
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003605c
push 0x10036054
push str.FlsSetValue
push 0x22
call fcn.1002000c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002027b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10032160]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10025a47
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10025ae4
push ebx
push esi
call fcn.10025a10
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002480c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10025a91
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10025ae3
push edi
push eax
call fcn.100205a4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10025ab1
call fcn.1001fcd0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10025ae2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002480c
add esp, 0x20
test eax, eax
jne 0x10025ad0
push edi
call fcn.1001fcd0
jmp 0x10025ad8
push ebx
call fcn.1001fcd0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10027d61
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1001e02c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10027dd0
cmp esi, dword [ebp - 4]
je 0x10027dcb
cmp dword [ebp + 0xc], 0
je 0x10027dcb
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10027da8
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100278b3
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10027dd2
xor eax, eax
inc eax
jmp 0x10027dd2
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10027e37
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10044020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1001e02c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1001e02c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10027eae
cmp word [ecx], dx
je 0x10027eae
mov eax, dword [0x100368e4]
push edi
dec eax
push eax
push 0x100367d0
call fcn.10027dd6
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10027f21
cmp word [eax], dx
je 0x10027f21
mov eax, dword [edi]
test eax, eax
je 0x10027ed2
cmp word [eax], dx
je 0x10027ed2
lea eax, [ebp - 0x10]
push eax
call fcn.100277b9
jmp 0x10027edb
lea eax, [ebp - 0x10]
push eax
call fcn.10027854
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10027f4b
mov eax, dword [0x100367cc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100364c0
call fcn.10027dd6
add esp, 0xc
test al, al
je 0x10027f4b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10027f16
cmp word [eax], di
je 0x10027f16
lea eax, [ebp - 0x10]
push eax
call fcn.100277b9
pop ecx
jmp 0x10027f4d
lea eax, [ebp - 0x10]
push eax
call fcn.10027854
jmp 0x10027f13
mov eax, dword [edi]
test eax, eax
je 0x10027f38
cmp word [eax], dx
je 0x10027f38
lea eax, [ebp - 0x10]
push eax
call fcn.1002776e
pop ecx
jmp 0x10027f4b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10028016
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10027c5b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10028016
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10028016
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10028016
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10027fa3
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10020381
test ebx, ebx
je 0x10028011
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10020381
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10028016
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10028016
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1002c044
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10028018
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001365b
leave
ret
Function at 0x1002d5a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002d5cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002d5cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret