joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100250a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x100250f9
nop dword [eax]
add ecx, ecx
movsx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movsx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x100250c0
cmp ecx, edi
jne 0x1002510e
test bl, 1
jne 0x1002510e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x10025151
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
movzx edi, word [esi + ecx*2]
movsx eax, di
movd xmm1, eax
movsx eax, word [ebx]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x10025145
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x10025116
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret

Function at 0x10025170
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x100251c9
nop dword [eax]
add ecx, ecx
movzx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movzx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x10025190
cmp ecx, edi
jne 0x100251de
test bl, 1
jne 0x100251de
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x1002521e
mov ebx, dword [esp + 0x20]
movzx eax, word [ebx]
lea ecx, [edx - 1]
sar ecx, 1
movd xmm0, eax
movzx edi, word [esi + ecx*2]
cvtdq2pd xmm0, xmm0
movd xmm1, edi
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x10025212
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x100251e6
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
Function at 0x10025230
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x10025285
nop
add ecx, ecx
xor eax, eax
movd xmm1, dword [esi + ecx*4 + 8]
movd xmm0, dword [esi + ecx*4 + 4]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x10025250
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x10025296
test al, 1
jne 0x10025296
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x100252d1
mov edi, dword [esp + 0x20]
nop
movd xmm0, dword [edi]
lea eax, [edx - 1]
sar eax, 1
cvtdq2pd xmm0, xmm0
mov ecx, dword [esi + eax*4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x100252c7
mov dword [esi + edx*4], ecx
mov edx, eax
cmp ebx, eax
jl 0x100252a0
mov eax, dword [edi]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x100252e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x1002534d
nop dword [eax]
add ecx, ecx
mov eax, dword [esi + ecx*4 + 8]
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x1008f6c0]
mov eax, dword [esi + ecx*4 + 4]
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x1008f6c0]
xor eax, eax
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x10025300
cmp ecx, edi
jne 0x10025360
test bl, 1
jne 0x10025360
mov eax, dword [esi + ebx*4 - 4]
mov dword [esi + edx*4], eax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x100253b5
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov edi, dword [esi + ecx*4]
mov eax, edi
shr eax, 0x1f
movd xmm1, edi
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x1008f6c0]
mov eax, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008f6c0]
comisd xmm1, xmm0
jbe 0x100253ab
mov dword [esi + edx*4], edi
mov edx, ecx
cmp ebp, ecx
jl 0x10025368
mov eax, dword [ebx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x100253d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x10025423
nop
add ecx, ecx
xor eax, eax
movss xmm1, dword [esi + ecx*4 + 8]
movss xmm0, dword [esi + ecx*4 + 4]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x100253f0
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x10025434
test al, 1
jne 0x10025434
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x1002546f
mov ecx, dword [esp + 0x20]
nop dword [eax]
movss xmm0, dword [ecx]
lea eax, [edx - 1]
sar eax, 1
cvtps2pd xmm0, xmm0
movss xmm2, dword [esi + eax*4]
cvtps2pd xmm1, xmm2
comisd xmm1, xmm0
jbe 0x10025465
movss dword [esi + edx*4], xmm2
mov edx, eax
cmp ebx, eax
jl 0x10025440
mov eax, dword [ecx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x10025480
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edx
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, edx
push edi
lea edi, [ecx - 1]
sar edi, 1
cmp edx, edi
jge 0x100254ce
nop dword [eax]
lea ecx, [eax + eax]
xor eax, eax
movsd xmm0, qword [esi + ecx*8 + 0x10]
comisd xmm0, xmmword [esi + ecx*8 + 8]
seta al
xor eax, 1
inc eax
add eax, ecx
movsd xmm0, qword [esi + eax*8]
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp eax, edi
jl 0x100254a0
mov ecx, dword [esp + 0x18]
cmp eax, edi
jne 0x100254e5
test cl, 1
jne 0x100254e5
movsd xmm0, qword [esi + ecx*8 - 8]
movsd qword [esi + edx*8], xmm0
lea edx, [ecx - 1]
cmp ebx, edx
jge 0x10025518
mov ecx, dword [esp + 0x1c]
nop dword [eax]
lea eax, [edx - 1]
sar eax, 1
movsd xmm0, qword [esi + eax*8]
comisd xmm0, xmmword [ecx]
jbe 0x1002550b
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp ebx, eax
jl 0x100254f0
movsd xmm0, qword [ecx]
pop edi
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
movsd xmm0, qword [eax]
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
Function at 0x10065940
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x18
test eax, eax
je 0x10065b1e
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
cmp edx, 1
jne 0x1006596d
cmp eax, 2
jne 0x10065964
xor ecx, ecx
jmp 0x10065977
cmp eax, 1
jne 0x10065977
mov ecx, eax
jmp 0x10065977
cmp edx, 2
jne 0x10065977
cmp eax, edx
cmove ecx, edx
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
cmp eax, 5
jne 0x10065a32
mov ebp, dword [esp + 0x30]
xor edx, edx
cmp ecx, 2
sete dl
xor eax, eax
inc edx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x10065b1a
mov esi, dword [esp + 0x34]
nop word [eax + eax]
mov ebx, edx
cmp edx, eax
ja 0x10065a18
lea ecx, [esi - 1]
mov dword [esp + 0x18], ecx
nop dword [eax]
mov eax, ecx
cmp eax, ebx
jl 0x10065a03
mov edi, dword [ebp + eax*4]
mov esi, edi
mov ecx, dword [ebp + eax*4 - 4]
sub edi, dword [ebp + eax*4 - 4]
and ecx, 0xff800000
sub esi, ecx
xor edi, esi
and edi, 0x7fffff
xor edi, esi
mov dword [ebp + eax*4], edi
dec eax
cmp eax, ebx
jge 0x100659d6
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jle 0x100659d0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
lea ebx, [esi*4]
add ebp, ebx
sub ecx, 1
mov dword [esp + 0x3c], ecx
jne 0x100659c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp eax, 6
jne 0x10065b1a
mov edx, dword [esp + 0x30]
xor ebx, ebx
cmp ecx, 2
mov dword [esp + 0x3c], edx
sete bl
xor eax, eax
inc ebx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x24], ebx
inc eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x10065b1a
mov esi, dword [esp + 0x34]
mov dword [esp + 0x14], ebx
mov ebp, ebx
cmp ebx, eax
ja 0x10065b00
lea ecx, [esi - 1]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jl 0x10065ae7
nop
mov esi, dword [edx + ecx*8 - 4]
mov eax, esi
mov edi, dword [edx + ecx*8]
and eax, 0xfffff
mov ebx, dword [edx + ecx*8 + 4]
mov edx, edi
mov ebp, dword [esp + 0x3c]
sub edx, dword [ebp + ecx*8 - 8]
mov ecx, ebx
sbb ecx, eax
and esi, 0xfff00000
sub edi, 0
sbb ebx, esi
xor eax, eax
xor ebx, ecx
xor eax, edx
and ebx, 0xfff00000
mov edx, ebp
mov ebp, dword [esp + 0x14]
xor ebx, ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], ebx
dec ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jge 0x10065a90
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, eax
jle 0x10065a86
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
lea ebp, [esi*8]
add edx, ebp
sub ecx, 1
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], ecx
jne 0x10065a71
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1006b439
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x1006b45a
jl 0x1006b451
test edi, edi
jne 0x1006b45a
xor eax, eax
xor edx, edx
jmp 0x1006b51b
cmp dword [ebx + 0x38], 0
je 0x1006b46f
push eax
push edi
push dword [ebp + 8]
call fcn.1006b521
jmp 0x1006b51b
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1006b4b6
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x1006b4b6
cmp eax, edi
jb 0x1006b490
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.1006e070
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x1006b4bc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x1006b510
mov ecx, ebx
call fcn.1006ac84
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x1006b4fb
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10075b5f
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x1006b510
jmp 0x1006b4ce
test edx, edx
je 0x1006b510
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10075b5f
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x10078702
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10078741
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10078741
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10078741
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10078741
cmp dword [ecx + 0x74], 0xe
jbe 0x10078741
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1007cd31
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100939ac
push 0x100939a4
push str.FlsAlloc
push 0x1f
call fcn.1007cb9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1007cd65
push dword [ebp + 8]
mov ecx, esi
call dword [0x1008f190]
call esi
jmp 0x1007cd6b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1007cdaf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100939bc
push 0x100939b4
push str.FlsGetValue
push 0x21
call fcn.1007cb9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1007cde6
push dword [ebp + 8]
mov ecx, esi
call dword [0x1008f190]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1007cdee
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100939c4
push 0x100939bc
push str.FlsSetValue
push 0x22
call fcn.1007cb9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1007ce28
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1008f190]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1007eac6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1006cbd0
mov eax, dword [0x1009e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1007a379
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1007eb08
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1007ec64
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1008b810
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1009ffa8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1007fac3
mov ecx, dword [esi*4 + 0x1009ffa8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1007ec5d
cmp eax, dword [ecx + edi + 0x24]
jne 0x1007ec5d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007ec5d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1007fac3
add esp, 0x14
test edx, edx
jl 0x1007ec5d
jg 0x1007ebd3
test eax, eax
jb 0x1007ec5d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1007ec5d
jl 0x1007ebed
cmp dword [ebp - 0x1008], eax
ja 0x1007ec5d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1007ec0b
test ebx, ebx
je 0x1007ec44
cmp ecx, edi
jae 0x1007ec44
mov al, byte [ecx]
cmp al, 0xd
jne 0x1007ec25
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1007ec31
cmp byte [ecx + 1], 0xa
jne 0x1007ec31
inc ecx
jmp 0x1007ec31
movzx eax, al
movsx eax, byte [eax + 0x1009e310]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1007ec0b
cmp edx, ebx
jne 0x1007ec0b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1007ec62
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1006c6ec
leave
ret
Function at 0x1007ef5b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1009ffa8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1007ef9b
cmp byte [ebx], 0xa
jne 0x1007ef9b
or byte [edi + eax + 0x28], 4
jmp 0x1007efa0
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1007f09f
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1007f082
inc eax
cmp dl, 0xd
je 0x1007efcc
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1007eff2
cmp eax, ecx
jae 0x1007f000
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1007efb4
jmp 0x1007f09f
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007f07d
cmp dword [ebp - 0x10], 0
je 0x1007f07d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1009ffa8]
test byte [eax + edi + 0x28], 0x48
je 0x1007f057
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1007f042
mov byte [esi], dl
jmp 0x1007f053
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1009ffa8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1007f09f
cmp byte [ebp - 1], 0xa
jne 0x1007f066
cmp esi, ebx
jne 0x1007f066
mov byte [esi], 0xa
jmp 0x1007f09e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1007fae1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1007f09f
mov byte [esi], 0xd
jmp 0x1007f09e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1009ffa8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1007f09c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1007f09f
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1007f0a8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1009ffa8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1007f0ee
cmp word [ebx], dx
jne 0x1007f0ee
or byte [eax + edi + 0x28], 4
jmp 0x1007f0f3
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1007f256
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1007f236
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1007f134
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1007f16a
cmp eax, edx
jae 0x1007f178
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1007f10f
jmp 0x1007f256
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007f231
cmp dword [ebp - 0x18], 0
je 0x1007f231
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1009ffa8]
test byte [eax + edi + 0x28], 0x48
je 0x1007f207
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1007f1cb
mov word [esi], cx
jmp 0x1007f202
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1009ffa8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1009ffa8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1009ffa8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1007f256
pop eax
cmp word [ebp - 4], ax
jne 0x1007f217
cmp esi, ebx
jne 0x1007f217
mov word [esi], ax
jmp 0x1007f253
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1007fae1
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1007f256
push 0xd
pop eax
jmp 0x1007f212
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1009ffa8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1007f250
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1007f256
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10081f92
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1008202f
push ebx
push esi
call fcn.10081f5b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10080cce
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10081fdc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1008202e
push edi
push eax
call fcn.10079479
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10081ffc
call fcn.1007943f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1008202d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10080cce
add esp, 0x20
test eax, eax
jne 0x1008201b
push edi
call fcn.1007943f
jmp 0x10082023
push ebx
call fcn.1007943f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10085feb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1007a846
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1008605a
cmp esi, dword [ebp - 4]
je 0x10086055
cmp dword [ebp + 0xc], 0
je 0x10086055
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10086032
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10085b3d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1008605c
xor eax, eax
inc eax
jmp 0x1008605c
xor eax, eax
pop edi
pop esi
leave
ret