joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040a70
Capabilities:
Hash data using sha1

Disassembly:
cmp byte [0x100e54f8], 0
jne 0x10040a7e
call fcn.10044810
cmp byte [0x100e5502], 0
je 0x10040a9c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.10046010
add esp, 0x10
ret
jmp fcn.1003f4e0

Function at 0x100417d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
cmp eax, 4
jb 0x10041804
mov esi, eax
shr esi, 2
nop dword [eax]
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x100417f0
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
test eax, eax
je 0x100418e4
mov ebx, edi
sub ebx, edx
cmp eax, 8
jb 0x100418c3
mov ecx, eax
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
mov dword [esp + 0x1c], ecx
lea ecx, [edx + 4]
nop dword [eax]
movd xmm2, dword [edi + ebp]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 0xc]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add ebp, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [ecx - 8]
orps xmm4, xmm2
movd xmm2, dword [ebx + ecx - 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp ebp, dword [esp + 0x1c]
jb 0x10041850
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x100418e4
lea edi, [edx + ebp]
sub eax, ebp
nop dword [eax + eax]
movzx edx, byte [ebx + edi]
lea edi, [edi + 1]
movzx ecx, byte [edi - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x100418d0
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
ret
Function at 0x10041920
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x24
test eax, eax
je 0x10041ac8
mov edx, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x30]
push edi
cmp eax, 4
jb 0x10041963
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x10041948
mov dword [esp + 0x40], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ebx
test eax, eax
je 0x10041ac4
cmp eax, 8
jb 0x10041aa9
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x10041999
cmp edi, ebx
jae 0x10041aa9
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x100419aa
cmp edi, edx
jae 0x10041aa9
cmp eax, 0x40
jb 0x10041a5e
mov edi, eax
mov ecx, eax
mov eax, edx
and edi, 0x3f
sub eax, ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], eax
sub ecx, edi
mov eax, esi
mov dword [esp + 0x2c], ecx
sub eax, ebx
lea edi, [esi + 0x20]
mov dword [esp + 0x20], eax
lea ecx, [ebx + 0x10]
mov ebx, dword [esp + 0x20]
mov eax, edx
sub eax, esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
lea eax, [edx + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + 0x40]
movups xmm0, xmmword [ecx - 0x50]
lea edi, [edi + 0x40]
xorps xmm1, xmm0
movups xmmword [edi - 0x60], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [esi + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ebx + ecx - 0x40], xmm1
movups xmm1, xmmword [edx + edi - 0x40]
mov edx, dword [esp + 0x28]
movups xmm0, xmmword [ecx - 0x30]
xorps xmm1, xmm0
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x10]
add ebp, 0x40
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ebp, dword [esp + 0x2c]
jb 0x100419f5
cmp dword [esp + 0x30], 8
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jb 0x10041aa5
and eax, 0xfffffff8
lea ecx, [ebx + ebp]
mov dword [esp + 0x30], eax
sub edx, ebx
mov edi, dword [esp + 0x30]
mov eax, esi
sub eax, ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov eax, edx
mov edx, dword [esp + 0x28]
movq xmm1, qword [ecx + eax]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebp, 8
xorps xmm1, xmm0
movq qword [edx + ecx - 8], xmm1
cmp ebp, edi
jb 0x10041a80
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
cmp ebp, eax
jae 0x10041ac4
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [esi + edi - 1], cl
sub eax, 1
jne 0x10041ab2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x10041ad0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xc
test eax, eax
je 0x10041c01
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
cmp eax, 4
jb 0x10041b09
mov edi, eax
shr edi, 2
mov ecx, dword [esi]
sub eax, 4
xor dword [edx], ecx
add esi, 4
add edx, 4
sub edi, 1
jne 0x10041af3
mov dword [esp + 0x20], eax
push ebx
xor ebx, ebx
test eax, eax
je 0x10041bfe
cmp eax, 8
jb 0x10041be2
lea ecx, [esi - 1]
lea edi, [edx - 1]
add ecx, eax
add edi, eax
cmp edx, ecx
ja 0x10041b33
cmp edi, esi
jae 0x10041be2
push ebp
cmp eax, 0x40
jb 0x10041bb5
mov ebp, eax
lea edi, [esi + 0x30]
and ebp, 0x3f
mov ecx, eax
sub ecx, ebp
mov dword [esp + 0x10], ebp
mov ebp, esi
mov dword [esp + 0x18], ecx
sub ebp, edx
lea ecx, [edx + 0x10]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movups xmm0, xmmword [ecx - 0x10]
add ebx, 0x40
lea edi, [edi + 0x40]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [edi - 0x70]
xorps xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [eax + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [edi - 0x50]
xorps xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [ecx - 0x20]
movups xmm0, xmmword [edi - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp ebx, dword [esp + 0x18]
jb 0x10041b60
mov eax, dword [esp + 0x28]
cmp ebp, 8
jb 0x10041bdd
mov edi, eax
lea ecx, [ebx + edx]
mov ebp, esi
and edi, 0xfffffff8
sub ebp, edx
movq xmm1, qword [ecx + ebp]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebx, 8
xorps xmm1, xmm0
movq qword [ecx - 8], xmm1
cmp ebx, edi
jb 0x10041bc1
pop ebp
cmp ebx, eax
jae 0x10041bfe
sub esi, edx
lea edi, [ebx + edx]
sub eax, ebx
nop dword [eax]
mov cl, byte [esi + edi]
lea edi, [edi + 1]
xor byte [edi - 1], cl
sub eax, 1
jne 0x10041bf0
pop ebx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x1004c720
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [esp + 0xc]
cmovae edx, edi
test eax, eax
js 0x1004c76c
push ebx
push esi
lea ebx, [esp + 0x14]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x1004c748
pop esi
pop ebx
mov eax, edi
pop edi
ret

Function at 0x100511b0
Capabilities:
Hash data using djb2

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
mov ecx, 0x1505
test edi, edi
jne 0x100511c6
pop edi
xor eax, eax
pop esi
ret
push ebx
mov bl, byte [edi]
test bl, bl
je 0x100511f0
nop dword [eax]
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x100511d0
pop ebx
pop edi
mov eax, ecx
pop esi
ret

Function at 0x10054240
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x24]
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
push esi
mov esi, dword [esp + 0x18]
test ebp, ebp
jb 0x1005438b
push ebx
mov ebx, dword [esp + 0x28]
ja 0x1005426d
test ebx, ebx
je 0x1005438a
mov edx, dword [esp + 0x20]
push edi
test edx, edx
je 0x10054318
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
movzx eax, word [esi + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [esp + 0x28]
push 1
shr ecx, 8
xor cl, byte [edi + eax]
lea eax, [esp + 0x14]
push eax
mov byte [edi + edx], cl
mov eax, dword [esi]
not eax
mov byte [esp + 0x18], cl
push eax
call fcn.10055ff0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.10055ff0
mov edx, dword [esp + 0x3c]
not eax
add esp, 0x18
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
add edi, 1
adc eax, 0
mov dword [esp + 0x2c], eax
cmp eax, ebp
jb 0x10054286
ja 0x10054389
cmp edi, ebx
jb 0x10054286
pop edi
pop ebx
pop esi
pop ebp
add esp, 0xc
ret
movlpd qword [esp + 0x14], xmm0
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push 1
mov al, byte [edi + eax]
mov byte [esp + 0x14], al
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.10055ff0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.10055ff0
add esp, 0x18
not eax
add edi, 1
mov dword [esi + 8], eax
adc ebp, 0
cmp ebp, dword [esp + 0x30]
jb 0x10054326
ja 0x10054389
cmp edi, ebx
jb 0x10054326
pop edi
pop ebx
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x100543a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x24], 0
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x18]
movlpd qword [esp + 8], xmm0
jb 0x1005450c
push ebp
mov ebp, dword [esp + 0x28]
ja 0x100543cb
test ebp, ebp
je 0x1005450b
cmp dword [esp + 0x20], 0
push ebx
push edi
je 0x10054498
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
nop dword [eax + eax]
mov ecx, dword [esp + 0x2c]
push 1
mov bl, byte [eax + ecx]
mov ax, word [esi + 8]
or ax, 2
mov byte [esp + 0x14], bl
movzx edi, ax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.10055ff0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.10055ff0
mov edx, dword [esp + 0x40]
not eax
mov dword [esi + 8], eax
add esp, 0x18
mov eax, edi
mov ecx, edi
xor ecx, 1
imul ecx, eax
mov eax, dword [esp + 0x14]
shr ecx, 8
xor cl, bl
mov byte [eax + edx], cl
add eax, 1
mov ecx, dword [esp + 0x1c]
adc ecx, 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
cmp ecx, dword [esp + 0x34]
jb 0x100543f0
ja 0x10054509
cmp eax, ebp
jb 0x100543f0
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x10
ret
movlpd qword [esp + 0x14], xmm0
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
push 1
mov al, byte [edi + eax]
mov byte [esp + 0x14], al
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.10055ff0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.10055ff0
add esp, 0x18
not eax
add edi, 1
mov dword [esi + 8], eax
adc ebx, 0
cmp ebx, dword [esp + 0x34]
jb 0x100544a6
ja 0x10054509
cmp edi, ebp
jb 0x100544a6
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x10
ret

Function at 0x100546d0
Capabilities:
Hash data via bcrypt

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x100546ff
cmp dword [esp + 0x10], 0
ja 0x100546ff
mov ecx, dword [esp + 0xc]
jb 0x100546ea
cmp ecx, 0xffffffff
ja 0x100546ff
push 0
push ecx
push dword [esp + 0x10]
push dword [eax + 4]
call sub.bcrypt.dll_BCryptHashData
shr eax, 0x1f
xor al, 1
ret
xor al, al
ret

Function at 0x10054980
Capabilities:
Generate random numbers via winapi

Disassembly:
movzx eax, word [esp + 8]
push 2
push eax
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
shr eax, 0x1f
xor al, 1
ret
Function at 0x10057f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100580e5
cmp dword [esi + 0x20], 0
je 0x100580e5
cmp dword [esi + 0x24], 0
je 0x100580e5
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100580e5
cmp dword [eax], esi
jne 0x100580e5
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x10057fc5
cmp eax, 0x39
je 0x10057fc5
cmp eax, 0x45
je 0x10057fc5
cmp eax, 0x49
je 0x10057fc5
cmp eax, 0x5b
je 0x10057fc5
cmp eax, 0x67
je 0x10057fc5
cmp eax, 0x71
je 0x10057fc5
cmp eax, 0x29a
jne 0x100580e5
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x10057ffe
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x10058020
call fcn.10055ff0
jmp 0x10058025
call fcn.1005a7b0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.1005af70
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.10077250
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x100bfd7a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x100bfd78]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x100bfd7c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x100bfd7e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x1005d0bf
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1005d0e6
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1005d0e9
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1005d09b
pop esi
leave
ret 8

Function at 0x1006051f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
push 0x105
call fcn.1005fda4
mov edi, eax
test edi, edi
jne 0x10060546
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, esi
jmp 0x1006058f
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1006058a
test al, 0x10
je 0x1006058a
test eax, 0x400
je 0x10060586
push 0x2000000
push 0x80
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.100605a8
push dword [ebp - 4]
mov esi, eax
call fcn.1005fe0f
test esi, esi
jne 0x1006058a
xor edx, edx
jmp 0x1006058c
mov edx, ebx
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x100664e9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x1006650c
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x100664fa
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x10074983
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.1008dbc9
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100749c2
sub eax, 1
je 0x100749bd
sub eax, 1
je 0x100749b9
xor eax, eax
leave
ret
push 3
jmp 0x100749c4
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x100909c1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10090a00
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10090a00
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10090a00
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10090a00
cmp dword [ecx + 0x74], 0xe
jbe 0x10090a00
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10095fe3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c6964
push 0x100c695c
push str.FlsAlloc
push 0x1f
call fcn.10095e4e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10096017
push dword [ebp + 8]
mov ecx, esi
call dword [0x100b7234]
call esi
jmp 0x1009601d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10096061
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c6974
push 0x100c696c
push str.FlsGetValue
push 0x21
call fcn.10095e4e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10096098
push dword [ebp + 8]
mov ecx, esi
call dword [0x100b7234]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100960a0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c697c
push 0x100c6974
push str.FlsSetValue
push 0x22
call fcn.10095e4e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100960da
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100b7234]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100969e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10075e90
mov eax, dword [0x100df300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1009281d
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10096a24
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10096b80
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100af6f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100e5e98]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100977e6
mov ecx, dword [esi*4 + 0x100e5e98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10096b79
cmp eax, dword [ecx + edi + 0x24]
jne 0x10096b79
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10096b79
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100977e6
add esp, 0x14
test edx, edx
jl 0x10096b79
jg 0x10096aef
test eax, eax
jb 0x10096b79
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10096b79
jl 0x10096b09
cmp dword [ebp - 0x1008], eax
ja 0x10096b79
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10096b27
test ebx, ebx
je 0x10096b60
cmp ecx, edi
jae 0x10096b60
mov al, byte [ecx]
cmp al, 0xd
jne 0x10096b41
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10096b4d
cmp byte [ecx + 1], 0xa
jne 0x10096b4d
inc ecx
jmp 0x10096b4d
movzx eax, al
movsx eax, byte [eax + 0x100df5b8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10096b27
cmp edx, ebx
jne 0x10096b27
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10096b7e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10075013
leave
ret
Function at 0x10096c7b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100e5e98]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10096cbb
cmp byte [ebx], 0xa
jne 0x10096cbb
or byte [edi + eax + 0x28], 4
jmp 0x10096cc0
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10096dbf
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10096da2
inc eax
cmp dl, 0xd
je 0x10096cec
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10096d12
cmp eax, ecx
jae 0x10096d20
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10096cd4
jmp 0x10096dbf
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10096d9d
cmp dword [ebp - 0x10], 0
je 0x10096d9d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100e5e98]
test byte [eax + edi + 0x28], 0x48
je 0x10096d77
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10096d62
mov byte [esi], dl
jmp 0x10096d73
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100e5e98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10096dbf
cmp byte [ebp - 1], 0xa
jne 0x10096d86
cmp esi, ebx
jne 0x10096d86
mov byte [esi], 0xa
jmp 0x10096dbe
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10097804
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10096dbf
mov byte [esi], 0xd
jmp 0x10096dbe
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100e5e98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10096dbc
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10096dbf
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret