joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ebce
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 0xffffffff
mov ecx, str.DisabledPendingAutoUpdateConsent
mov edx, 4
push 4
push eax
call fcn.1000e809
add esp, 8
test eax, eax
jne 0x1000ec0b
xor ebx, ebx
cmp dword [ebp - 0x1c], 0
jne 0x1000ec5f
call fcn.1000e959
mov ebx, eax
call fcn.1000eac6
mov byte [ebp - 0x21], bl
test bl, bl
jne 0x1000ec73
test al, al
jne 0x1000ec73
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov ecx, str.RedirectionMode
mov edx, 4
push 4
push esi
call fcn.1000e809
add esp, 8
mov edx, dword [esi]
xor ecx, ecx
inc ecx
cmp edx, 2
mov ebx, edx
cmove ebx, ecx
cmp byte [ebp - 0x21], 0
cmove ebx, edx
cmp edx, 3
cmovae ebx, ecx
test eax, eax
cmovne ebx, ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, 0xffffffe8
xor edi, edi
lea ebx, [ebp - 0x14]
jmp 0x1000eca7
xor ebx, ebx
cmp dword [ebp - 0x28], 0
setne bl
jmp 0x1000ec5f
push ebx
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
mov ebx, edi
mov edi, 0
je 0x1000ec7f
add esi, 0xc
je 0x1000ec22
mov eax, dword [esi + 0x1005f81c]
mov ecx, dword [esi + str.RedirectionMode]
mov dword [ebp - 0x14], edi
push ebx
push 0x20119
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ec9e
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
xor edx, edx
dec edx
mov dword [ebp - 0x20], edx
mov eax, dword [esi + 0x1005f820]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 4
mov edi, ecx
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x18]
xor ecx, 4
or ecx, eax
setne cl
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
test ebx, ebx
jne 0x1000ec8a
test cl, cl
jmp 0x1000ec95

Function at 0x1000ed19
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
lea ebx, [ebp - 0x14]
mov dword [ebx], esi
push ebx
push 0x20119
push esi
push str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000ed71
xor ebx, ebx
xor eax, eax
cmp esi, 2
cmovae esi, eax
test bl, bl
cmove esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
lea esi, [ebp - 0x18]
mov dword [esi], 0xffffffff
mov dword [ebp - 0x14], 4
push ebx
push ecx
push esi
push eax
push str.LastCustomerType
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
lea eax, [ebp - 0x1c]
mov esi, dword [eax]
test edi, edi
je 0x1000ed50
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000ed50
Function at 0x1000edb7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
sub esp, 0x1c
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x1005f300]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
call fcn.100043cc
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x1000ee3c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ecx], eax
mov eax, 4
push eax
push ecx
push eax
push 0
push str.LastCustomerType
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000ee4a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002bd4a
mov eax, esi
add esp, 0x14
pop esi
pop ebp
ret

Function at 0x1000f102
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x9c
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
xor esi, esi
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax - 4], 0xc
push esi
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x1000f15a
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test eax, eax
je 0x1000f171
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, esi
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x1000f151
lea ebx, [ebp - 0xa8]
mov ecx, ebx
push 2
push 0x3d3
push str....._third_partyie_to_edge_bhoie_to_edge_util.cc
call fcn.1000f99c
mov ecx, ebx
call fcn.10002820
push 0x1e
push str.Failed_to_create_mutex_named:
push eax
call fcn.100065e4
add esp, 0xc
mov ebx, eax
push edi
call fcn.100419e7
add esp, 4
push eax
push edi
push ebx
call fcn.100065e4
add esp, 0xc
push 8
push str._Error:
push eax
call fcn.100065e4
add esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
push eax
call fcn.10001dc0
lea ecx, [ebp - 0xa8]
call fcn.1000fcf8
jmp 0x1000f151
Function at 0x1000f250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1006aa20]
mov ecx, dword [0x10069d98]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000f29a
mov esi, dword [0x1006aa1c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1006aa20
call fcn.1002b337
add esp, 4
cmp dword [0x1006aa20], 0xffffffff
jne 0x1000f280
mov esi, 0xffffffe8
xor edi, edi
jmp 0x1000f2cd
test ebx, ebx
je 0x1000f2c4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xc
je 0x1000f34d
mov eax, dword [esi + 0x1005fd5c]
mov ecx, dword [esi + str.InternetExplorerIntegrationLevel]
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x14]
push edx
push 0x20119
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000f2c4
mov ebx, dword [ebp - 0x14]
xor ecx, ecx
dec ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [esi + 0x1005fd60]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000f2b9
cmp dword [ebp - 0x18], 4
jne 0x1000f2b9
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 2
sete cl
add ecx, ecx
cmp eax, 1
cmove ecx, eax
mov esi, ecx
test ebx, ebx
je 0x1000f34f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000f34f
xor esi, esi
mov dword [0x1006aa1c], esi
push 0x1006aa20
call fcn.1002b3ad
add esp, 4
jmp 0x1000f280
Function at 0x1000f704
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x218]
mov dword [ebx], 0xffffffff
push ebx
push str.Logging
call fcn.1000e7ef
add esp, 8
xor ecx, ecx
test eax, eax
jne 0x1000f740
mov ecx, dword [ebp - 0x218]
mov dword [0x1006aafc], ecx
test cl, 0x20
jne 0x1000f760
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bd4a
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], esi
push esi
push 3
push 6
call fcn.10053bce
add esp, 0xc
test al, al
jne 0x1000f7db
mov dword [ebp - 0x218], esi
push ebx
push esi
push esi
push 0x10055050
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x1000f7b3
xor eax, eax
push ebx
push eax
push eax
push 0x10055060
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1000f914
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x1000f934
lea ecx, [ebp - 0x224]
push eax
call fcn.10029d78
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1000f813
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.1002ef60
add esp, 0xc
push esi
push 0x1c
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000f914
lea ecx, [ebp - 0x224]
push edi
call fcn.10029d78
lea esi, [ebp - 0x224]
mov ecx, esi
push 0xa
push 0x10060074
call fcn.10029da0
cmp byte [eax + 0xb], 0
jns 0x1000f82f
mov eax, dword [eax]
xor edi, edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, esi
push 8
push str.EdgeBho
call fcn.10029da0
cmp byte [eax + 0xb], 0
jns 0x1000f84f
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, esi
push 1
push 0x1006009c
call fcn.10029da0
mov ecx, esi
push dword [ebp + 8]
call fcn.10029ff0
test byte [0x1006aafd], 0x20
je 0x1000f8d8
lea edi, [ebp - 0x224]
mov ecx, edi
push 1
push 0x100600a0
call fcn.10029da0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
call fcn.10053db3
add esp, 8
movzx eax, byte [ebp - 0x20d]
test al, al
js 0x1000f8ac
and eax, 0x7f
jmp 0x1000f8b8
mov eax, dword [ebp - 0x214]
mov ebx, dword [ebp - 0x218]
mov ecx, edi
push eax
push ebx
call fcn.10029da0
cmp byte [ebp - 0x20d], 0
jns 0x1000f8d8
push dword [ebp - 0x218]
call fcn.1002b2c4
add esp, 4
mov ecx, esi
push 4
push 0x100600a4
call fcn.10029da0
xor eax, eax
bt dword [0x1006aafc], 0xc
setae al
shl eax, 5
or eax, 0x10
cmp byte [ebp - 0x219], 0
jns 0x1000f908
mov esi, dword [ebp - 0x224]
mov ecx, 0x1006aa44
push eax
push esi
call fcn.10010a26
cmp byte [ebp - 0x219], 0
jns 0x1000f74b
push dword [ebp - 0x224]
call fcn.1002b2c4
add esp, 4
jmp 0x1000f74b
push str.string::assign_received_nullptr
push str.__s___nullptr
push 0xa51
push str....._third_partylibc_srcinclude_string
push str._s:_d:_assertion__s_failed:__s_n
call fcn.1002a56c
Function at 0x100182c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x10029230
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov edi, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [edi + 4], 1
jne 0x10018356
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x2c]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x1001834c
shr al, 7
mov edi, dword [ebp + 8]
mov dword [edi], ebx
test al, al
je 0x10018341
push ecx
call fcn.1002b2c4
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
lea esi, [ebp - 0x28]
mov ecx, edi
push esi
call fcn.10011a6a
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x1006b0c4
call fcn.10024174
mov esi, eax
mov edi, dword [ebp - 0x28]
cmp edi, 0x1006afd4
mov ebx, dword [ebp + 0xc]
je 0x100183ab
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x100183ab
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
dec eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [esi]
mov dl, byte [ebp + 0x18]
xor dl, 1
movzx edx, dl
mov edi, dword [ecx + edx*4 + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x28]
push eax
call edi
movzx eax, byte [ebp - 0x1d]
test al, al
js 0x100183f0
mov edx, eax
and edx, 0x7f
jmp 0x100183f3
shr al, 7
jmp 0x10018332
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
test edx, edx
je 0x100183e8
test al, al
lea eax, [ebp - 0x28]
cmovns ecx, eax
mov edi, ecx
jmp 0x10018419
mov esi, dword [ebp - 0x24]
mov edx, ecx
add edx, esi
inc edi
cmp edi, edx
je 0x1001832c
test ebx, ebx
je 0x10018444
mov al, byte [edi]
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x1c]
je 0x10018448
lea edx, [ecx + 1]
mov dword [ebx + 0x18], edx
mov byte [ecx], al
movzx eax, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x28]
test al, al
js 0x10018409
mov esi, eax
and esi, 0x7f
lea edx, [ebp - 0x28]
jmp 0x1001840e
xor ebx, ebx
jmp 0x1001842f
mov dword [ebp - 0x2c], edi
movzx edi, al
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x30], ebx
mov ecx, ebx
push edi
call esi
xor ebx, ebx
cmp eax, 0xffffffff
je 0x1001847b
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
jmp 0x1001842f
Function at 0x10039069
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100390a8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100390a8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100390a8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100390a8
cmp dword [ecx + 0x74], 0xe
jbe 0x100390a8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100401ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1002c4d0
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100464c3
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100401fc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10040358
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1004d6e0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1006a530]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1004caa0
mov ecx, dword [esi*4 + 0x1006a530]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10040351
cmp eax, dword [ecx + edi + 0x24]
jne 0x10040351
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10040351
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004caa0
add esp, 0x14
test edx, edx
jl 0x10040351
jg 0x100402c7
test eax, eax
jb 0x10040351
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10040351
jl 0x100402e1
cmp dword [ebp - 0x1008], eax
ja 0x10040351
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100402ff
test ebx, ebx
je 0x10040338
cmp ecx, edi
jae 0x10040338
mov al, byte [ecx]
cmp al, 0xd
jne 0x10040319
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10040325
cmp byte [ecx + 1], 0xa
jne 0x10040325
inc ecx
jmp 0x10040325
movzx eax, al
movsx eax, byte [eax + 0x10068790]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100402ff
cmp edx, ebx
jne 0x100402ff
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10040356
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002bd4a
leave
ret

Function at 0x10042de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10042e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10042e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10043f66
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x10058664
push str.FlsAlloc
push 0x1f
call fcn.10044419
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043f9a
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10043fa0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10043fe4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x10058688
push str.FlsGetValue
push 0x21
call fcn.10044419
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004401b
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10044023
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x1005869c
push str.FlsSetValue
push 0x22
call fcn.10044419
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004405d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10048357
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1004376a
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1004376a
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100483ce
cmp word [ecx], dx
je 0x100483ce
mov eax, dword [0x1005905c]
push edi
dec eax
push eax
push 0x10058f48
call fcn.10048547
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10048441
cmp word [eax], dx
je 0x10048441
mov eax, dword [edi]
test eax, eax
je 0x100483f2
cmp word [eax], dx
je 0x100483f2
lea eax, [ebp - 0x10]
push eax
call fcn.100485a8
jmp 0x100483fb
lea eax, [ebp - 0x10]
push eax
call fcn.100488a3
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1004846b
mov eax, dword [0x10058f44]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10058c38
call fcn.10048547
add esp, 0xc
test al, al
je 0x1004846b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10048436
cmp word [eax], di
je 0x10048436
lea eax, [ebp - 0x10]
push eax
call fcn.100485a8
pop ecx
jmp 0x1004846d
lea eax, [ebp - 0x10]
push eax
call fcn.100488a3
jmp 0x10048433
mov eax, dword [edi]
test eax, eax
je 0x10048458
cmp word [eax], dx
je 0x10048458
lea eax, [ebp - 0x10]
push eax
call fcn.100489e5
pop ecx
jmp 0x1004846b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10048536
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10048ad7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10048536
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10048536
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10048536
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100484c3
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1004425c
test ebx, ebx
je 0x10048531
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1004425c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10048536
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10048536
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10050467
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10048538
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002bd4a
leave
ret
Function at 0x10048bdd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1004376a
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10048c4c
cmp esi, dword [ebp - 4]
je 0x10048c47
cmp dword [ebp + 0xc], 0
je 0x10048c47
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10048c24
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10048ca6
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10048c4e
xor eax, eax
inc eax
jmp 0x10048c4e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100498b0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1004994d
push ebx
push esi
call fcn.1004999e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100497b4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100498fa
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004994c
push edi
push eax
call fcn.10045778
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1004991a
call fcn.100430f4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004994b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100497b4
add esp, 0x20
test eax, eax
jne 0x10049939
push edi
call fcn.100430f4
jmp 0x10049941
push ebx
call fcn.100430f4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10049950
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10049961
pop esi
ret
push ebx
push edi
push esi
call fcn.1004999e
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10045778
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10049989
push ebx
push esi
push edi
call fcn.1002e9e0
add esp, 0xc
push 0
call fcn.100430f4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100499d5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100499e0