joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10111180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101be6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x10251b9c]
mov byte [eax + 0x154], 0
movzx ecx, byte [ebp - 0x14d]
push ecx
push str.The_file_is_corrupted._Please_contact_with_administrator._n
lea ecx, [ebp - 0x14c]
call fcn.10112c50
mov ecx, eax
call fcn.101113b0
push eax
lea ecx, [ebp - 0x64]
call fcn.10045f80
mov byte [ebp - 4], 1
movzx edx, byte [ebp - 0x14e]
push edx
push str.If_you_constantly_see_this_message_
lea ecx, [ebp - 0x110]
call fcn.10113340
mov ecx, eax
call fcn.100bf7d0
push eax
lea ecx, [ebp - 0x48]
call fcn.10045f80
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x14f]
push eax
push str.disable_the_anti_virus_program.
lea ecx, [ebp - 0xe8]
call fcn.101137a0
mov ecx, eax
call fcn.100612e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.10045f80
mov byte [ebp - 4], 3
push 0x101f5177
lea ecx, [ebp + 8]
push ecx
call fcn.10084d80
add esp, 8
movzx edx, al
test edx, edx
je 0x1011130b
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x9c]
push edx
call fcn.100a0c30
add esp, 0xc
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x15c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x15c]
push edx
lea eax, [ebp - 0x80]
push eax
call fcn.100ee330
add esp, 0xc
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x164], ecx
mov byte [ebp - 4], 5
push 0x30
movzx edx, byte [ebp - 0x150]
push edx
push str.KnightOnline.exe
lea ecx, [ebp - 0xb0]
call fcn.10113b70
mov ecx, eax
call fcn.10074a40
push eax
mov ecx, dword [ebp - 0x164]
call fcn.10045c30
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x80]
call fcn.10045ea0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9c]
call fcn.10045ea0
jmp 0x1011133e
push 0x30
movzx eax, byte [ebp - 0x151]
push eax
push 0x10211568
lea ecx, [ebp - 0xc4]
call fcn.10113d70
mov ecx, eax
call fcn.10074a40
push eax
lea ecx, [ebp + 8]
call fcn.10045c30
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.1017a3f0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.10045ea0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.10045ea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.10045ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10045ea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret
Function at 0x101117e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10211518]
mov dword [ebp - 0xc], eax
mov cx, word [0x1021151c]
mov word [ebp - 8], cx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x10]
sub edx, 5
mov dword [ebp - 0xb], edx
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xc], 0xe9
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.10157720
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret
Function at 0x10112980
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x101129a5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10251b98], eax
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x10251ba8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10112a50
push 0x10251b94
push 0
push 0
push 0x8004
mov eax, dword [0x10251ba8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10112a50
push 1
push 0x1d
movzx ecx, byte [ebp - 0x39]
push ecx
push str._A_dq1DPVFgVs1Aez_VS3R0hge_NvM_TJvblD4.af0h_r4bUzp
lea ecx, [ebp - 0x38]
call fcn.10115690
mov ecx, eax
call fcn.10112aa0
push eax
mov edx, dword [0x10251b94]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10112a50
push 0x10251b84
push 0x800000
mov eax, dword [0x10251b94]
push eax
push 0x6801
mov ecx, dword [0x10251ba8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10112a50
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x101128b0
push 0x468e60
call fcn.100020f0
mov dword [0x10251ba0], eax
push 0x10112960
push 0x468eb6
call fcn.100020f0
jmp 0x10112a85
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret

Function at 0x101169f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x10116840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10116a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x10116a10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1012c890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x1012c7e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x1012eb80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 9
ja case.0x1012eb9c.0
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x1012ed10]
push 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
push 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
push 0
lea edx, [ebp - 4]
push edx
push 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
push 0
lea edx, [ebp - 4]
push edx
push 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
push 0
lea edx, [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
push 0
lea edx, [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x101f52c7
mov ecx, dword [ebp - 0xc]
call fcn.10045e10
cmp dword [ebp - 8], 0
jle 0x1012eca8
push 0x20
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100b51e0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
mov ecx, dword [ebp - 0xc]
call fcn.1007eda0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
push 0
lea ecx, [ebp - 4]
push ecx
push 4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
push 0
lea ecx, [ebp - 4]
push ecx
push 8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1012ed03
mov ecx, 1
test ecx, ecx
je 0x1012ecff
push 0x110
push str.C:UsersAdministratorDownloadsCompressedHSACSX1_HSACSX_AntiCheat_SourceHSACSGuardN3BASEN3TableBase.h
push 0x101f52ca
push 0x1021befc
call fcn.100a8090
add esp, 0x10
xor eax, eax
jmp 0x1012ed08
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10130d70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x58]
mov dword [0x10251e10], ecx
cmp dword [ebp + 8], 0
je 0x10130d95
cmp dword [ebp + 8], 0
je 0x10130d95
cmp dword [ebp + 0xc], 1
je 0x10130da1
xor al, al
jmp 0x10130ee7
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x6c]
jne 0x10130e1b
mov ecx, dword [0x10251b9c]
cmp dword [ecx + 0x46c], 0
jne 0x10130dce
mov edx, dword [0x10251b9c]
mov ecx, dword [edx + 0x468]
call fcn.1013aa90
jmp 0x10130e16
mov eax, dword [0x10251b9c]
mov ecx, dword [eax + 0x46c]
mov edx, dword [ecx + 0xd0]
push edx
mov ecx, dword [0x10251b9c]
call fcn.100e1a30
movzx eax, al
test eax, eax
je 0x10130e05
mov ecx, dword [0x10251b9c]
mov ecx, dword [ecx + 0x46c]
call fcn.1007bf60
jmp 0x10130e16
mov edx, dword [0x10251b9c]
mov ecx, dword [edx + 0x46c]
call fcn.1007bf30
jmp 0x10130ee5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x74]
jne 0x10130e4a
push 1
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x3c
call fcn.10045c30
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x10130ee5
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x60]
jne 0x10130e7f
mov ecx, dword [ebp - 4]
call fcn.10131140
mov ecx, dword [0x10251b9c]
cmp dword [ecx + 0x508], 0
je 0x10130e7d
mov edx, dword [0x10251b9c]
mov ecx, dword [edx + 0x508]
call fcn.1008b130
jmp 0x10130ee5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x64]
jne 0x10130eb3
mov ecx, dword [ebp - 4]
call fcn.101310c0
mov edx, dword [0x10251b9c]
cmp dword [edx + 0x504], 0
je 0x10130eb1
mov eax, dword [0x10251b9c]
mov ecx, dword [eax + 0x504]
call fcn.1005c760
jmp 0x10130ee5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x68]
jne 0x10130ee5
mov ecx, dword [ebp - 4]
call fcn.10131100
mov eax, dword [0x10251b9c]
cmp dword [eax + 0x50c], 0
je 0x10130ee5
mov ecx, dword [0x10251b9c]
mov ecx, dword [ecx + 0x50c]
call fcn.10057b00
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10136a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b7a4d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1024bdac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x30]
call fcn.10045a30
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x214
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.10053ec0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x30]
call fcn.10053ec0
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x30]
push edx
call fcn.10053f30
push 0xf3690c
mov ecx, dword [0x10251b9c]
call fcn.100e1030
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
jne 0x10136ad2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10053ee0
jmp 0x10136b29
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xd], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0xc], 0
mov ecx, dword [ebp - 0x10]
call fcn.10136b40
mov ecx, dword [ebp - 0x10]
call fcn.10136cd0
push 0
push 0
push 0
push 0x101369c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10136950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10053ee0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1013fac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov edx, dword [ebp - 0x24]
sub eax, dword [edx + 0x30]
sbb ecx, dword [edx + 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0
jg 0x1013fafd
jl 0x1013faf8
cmp dword [ebp - 0x38], 0x14
ja 0x1013fafd
jmp 0x1013fc0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
mov eax, dword [ebp - 0x24]
add eax, 0x14
push eax
call fcn.10046070
mov ecx, dword [0x10251b9c]
add ecx, 0xb0
call fcn.100e7d40
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
jne 0x1013fb58
mov edx, dword [ebp - 0x24]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x42], 0
jmp 0x1013fc0e
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 4], 0
jne 0x1013fb66
jmp 0x1013fc0e
mov edx, dword [ebp - 0x24]
movzx eax, byte [edx + 0x42]
test eax, eax
jne 0x1013fb76
jmp 0x1013fc0e
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x10251b9c]
call fcn.100e12d0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, 0x102ce694
call fcn.100508b0
lea ecx, [ebp - 0x20]
call fcn.10045ea0
mov ecx, 0x102ce694
call fcn.10045c10
test eax, eax
ja 0x1013fbc6
mov edx, dword [ebp - 0x24]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x42], 0
jmp 0x1013fc0e
mov ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0x20]
cmp edx, 0x14
jne 0x1013fbeb
push 0xffdf3434
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [0x10251b9c]
call fcn.100e3ce0
jmp 0x1013fc0e
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + 0x20]
cmp eax, 0x15
jne 0x1013fc0e
push 0xffff0000
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [0x10251b9c]
call fcn.100e3ce0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret
Function at 0x1015b500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1015b120
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1015b532
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101c23e8]
call dword [ebp - 8]
jmp 0x1015b53c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10190a20
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10156900
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x102508e8]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10190bf8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10190b47
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10190b47
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10190b25
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x10190aa9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10190bb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10190c18
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10190bf3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10190c18
jmp 0x10190a82
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret
Function at 0x10190c30
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10156900
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x102508e8]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x10190e1b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10190d66
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10190d66
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10190d42
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x10190cb9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10190dd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10190e3b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x10190e16
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x10190e3b
jmp 0x10190c92
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret
Function at 0x10193100
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10192860
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10193134
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101c23e8]
call dword [ebp - 8]
jmp 0x1019313a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10193190
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.101928a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101931c4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101c23e8]
call dword [ebp - 8]
jmp 0x101931ce
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x101931e0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.101928c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10193218
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x101c23e8]
call dword [ebp - 8]
jmp 0x10193226
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x10193230
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10192940
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10193270
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x101c23e8]
call dword [ebp - 8]
jmp 0x1019328e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.101934d0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x101932a0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.10192980
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101932d8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x101c23e8]
call dword [ebp - 8]
jmp 0x101932e6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret 8