joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd89cd0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
push dword [esi + 0x14]
lea eax, [esi + 0x18]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0xd89d10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [esi + 0xbc]
push eax
push dword [ebp + 0xc]
call fcn.00d8a2a0
add esp, 0xc
pop edi
pop esi
pop ebp
ret
push dword [ebp + 0xc]
push edi
call fcn.00d8a040
push 1
push dword [esi + 0x98]
call fcn.00d921e0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0xd89e40
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
jne 0xd89e64
push dword [ecx + 0x14]
lea eax, [ecx + 0x18]
push eax
push dword [ecx + 0x98]
call dword [sym.imp.WS2_32.dll_connect]
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret

Function at 0xd89e70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push 0
mov eax, dword [ebx]
push dword [ebp + 0x10]
push ecx
mov eax, dword [eax + 8]
mov dword [edi], 0
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0xd89f11
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0xd89edb
pop esi
mov dword [edi], 0x51
or eax, 0xffffffff
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.00d6e770
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.00d5d670
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x930], esi
or eax, 0xffffffff
mov dword [edi], 0x38
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
Function at 0xd8a040
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1e8]
test dword [eax + 0x44], 0x800
jne 0xd8a160
push 0x80
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x80
push 0
push eax
call fcn.00d9ac00
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0xd8a0f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00d6e770
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00d5d670
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0xf0]
push eax
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
call fcn.00d5e190
add esp, 0x10
test al, al
jne 0xd8a160
push edi
call fcn.00dae67e
mov esi, dword [eax]
call fcn.00dae67e
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00d6e770
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00d5d670
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00d491ba
mov esp, ebp
pop ebp
ret

Function at 0xd8a3b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x6e3], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0xd8a40d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d
push esi
call fcn.00d5d730
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
push dword [esi + 0x680]
mov dword [ebp - 0x10], 1
call fcn.00d5f1e0
push dword [esi + 0x684]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.00d5f1e0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0xd8a47d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
push esi
call fcn.00d5d730
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
Function at 0xd8a490
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 4
push eax
push 1
push 6
push dword [ebp + 0xc]
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0xd8a4f2
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00d6e770
push eax
push str.Could_not_set_TCP_NODELAY:__s
push esi
call fcn.00d5d730
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
Function at 0xd95db0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0xd95de3
push 0x2e
push edi
call fcn.00d9bf10
add esp, 8
test eax, eax
je 0xd95de1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0xd96100
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xd96192
lea eax, [ebp - 0xc]
mov dword [ebp - 0x18], 0x208
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0x6601
push edi
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x10], 8
call fcn.00d961f0
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.00d994a0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0xd961a4
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
mov dword [esi], ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00d491ba
mov esp, ebp
pop ebp
ret
Function at 0xd96e20
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
push 0x11
push str.WWW_Authenticate:
push esi
call fcn.00d611b0
mov edi, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0xd96e4e
mov ebx, dword [edi + 0xe8]
cmp ebx, 0x191
je 0xd96e70
push 0x13
push str.Proxy_authenticate:
push esi
call fcn.00d611b0
add esp, 0xc
test eax, eax
je 0xd96eb6
mov ebx, dword [edi + 0xe8]
cmp ebx, 0x197
jne 0xd96eb6
push esi
call fcn.00d64220
mov esi, eax
add esp, 4
test esi, esi
jne 0xd96e87
pop edi
lea eax, [esi + 0x1b]
pop esi
pop ebx
pop ebp
ret
cmp ebx, 0x197
push esi
sete al
movzx eax, al
push eax
push edi
call fcn.00d65d60
push esi
mov edi, eax
call dword [0xe3c044]
add esp, 0x10
test edi, edi
je 0xd97052
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push 0xf
push str.Content_Length:
push esi
call fcn.00d611b0
add esp, 0xc
test eax, eax
je 0xd96f11
mov ecx, dword [edi + 0xe8]
lea eax, [ecx - 0xc8]
cmp eax, 0x64
jae 0xd96ef1
push ecx
push str.Ignoring_Content_Length_in_CONNECT__03d_response
push edi
call fcn.00d5d730
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
add eax, 0x208
push eax
push 0xa
lea eax, [esi + 0xf]
push 0
push eax
call fcn.00d6f310
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 5
push str.close
push 0xb
push str.Connection:
push esi
call fcn.00d64180
add esp, 0x14
test al, al
jne 0xd97048
push 0x12
push str.Transfer_Encoding:
push esi
call fcn.00d611b0
add esp, 0xc
test eax, eax
je 0xd96faf
mov ecx, dword [edi + 0xe8]
lea eax, [ecx - 0xc8]
cmp eax, 0x64
jae 0xd96f6b
push ecx
push str.Ignoring_Transfer_Encoding_in_CONNECT__03d_response
push edi
call fcn.00d5d730
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 7
push str.chunked
push 0x12
push str.Transfer_Encoding:
push esi
call fcn.00d64180
add esp, 0x14
test al, al
je 0xd97052
push str.CONNECT_responded_chunked
push edi
call fcn.00d5d730
mov eax, dword [ebp + 0x10]
push edi
mov byte [eax + 0x214], 1
call fcn.00d8dea0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 5
push str.close
push 0x11
push str.Proxy_Connection:
push esi
call fcn.00d64180
add esp, 0x14
test al, al
jne 0xd97048
push 7
push str.HTTP_1.
push esi
call fcn.00da9a00
add esp, 0xc
test eax, eax
jne 0xd97052
mov al, byte [esi + 7]
cmp al, 0x30
je 0xd96fe9
cmp al, 0x31
jne 0xd97052
cmp byte [esi + 8], 0x20
jne 0xd97052
mov cl, byte [esi + 9]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0xd97052
mov dl, byte [esi + 0xa]
mov al, dl
sub al, 0x30
cmp al, 9
ja 0xd97052
mov bl, byte [esi + 0xb]
mov al, bl
sub al, 0x30
cmp al, 9
ja 0xd97052
mov al, byte [esi + 0xc]
cmp al, 0x30
jl 0xd9701b
cmp al, 0x39
jle 0xd97052
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, bl
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [edi + 0xe8], eax
mov dword [edi + 0xd84], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov byte [eax + 0x215], 1
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0xd986a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0xe3c040]
mov edi, eax
add esp, 4
test edi, edi
jne 0xd986cd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0xd98717
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0xd9871d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xd9877b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0xd98740
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0xd987a7
mov eax, dword [esi + 4]
push 1
push 0xde4405
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0xde4406
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0xd98780
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xd98800
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xd98832
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret

Function at 0xd994a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0xd994ed
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
and dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0xd994b2
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0xd99540
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xd9957f
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xdaf0b3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0xdaf0f2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xdaf0f2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xdaf0f2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xdaf0f2
cmp dword [ecx + 0x74], 0xe
jbe 0xdaf0f2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0xdb0b47
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00d4a480
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00da93f9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0xdb0b89
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0xdb0ce5
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00dc30c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0xe45520]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00db2cd8
mov ecx, dword [esi*4 + 0xe45520]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0xdb0cde
cmp eax, dword [ecx + edi + 0x24]
jne 0xdb0cde
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xdb0cde
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00db2cd8
add esp, 0x14
test edx, edx
jl 0xdb0cde
jg 0xdb0c54
test eax, eax
jb 0xdb0cde
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0xdb0cde
jl 0xdb0c6e
cmp dword [ebp - 0x1008], eax
ja 0xdb0cde
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0xdb0c8c
test ebx, ebx
je 0xdb0cc5
cmp ecx, edi
jae 0xdb0cc5
mov al, byte [ecx]
cmp al, 0xd
jne 0xdb0ca6
lea eax, [edi - 1]
cmp ecx, eax
jae 0xdb0cb2
cmp byte [ecx + 1], 0xa
jne 0xdb0cb2
inc ecx
jmp 0xdb0cb2
movzx eax, al
movsx eax, byte [eax + 0xe3ccf0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0xdb0c8c
cmp edx, ebx
jne 0xdb0c8c
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0xdb0ce3
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00d491ba
leave
ret
Function at 0xdb24ca
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0xde6b18
push esi
call fcn.00db0f1e
pop ecx
pop ecx
test eax, eax
jne 0xdb24f8
xor al, al
jmp 0xdb2575
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.00db21ff
mov edx, eax
add esp, 0x10
test edx, edx
jne 0xdb2532
push dword [ebp - 0x210]
call fcn.00d9e0ad
xor al, al
jmp 0xdb2573
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xdb2538
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0xdb2558
push edx
call fcn.00db2401
pop ecx
test al, al
je 0xdb2523
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0xdb2566
mov bl, 1
push dword [ebp - 0x210]
call fcn.00d9e0ad
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00d491ba
leave
ret

Function at 0xdb39dd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xde7914
push 0xde790c
push str.FlsAlloc
push 0x1f
call fcn.00db3808
mov esi, eax
add esp, 0x10
test esi, esi
je 0xdb3a11
push dword [ebp + 8]
mov ecx, esi
call dword [0xdd657c]
call esi
jmp 0xdb3a17
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0xdb3a5b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xde7924
push 0xde791c
push str.FlsGetValue
push 0x21
call fcn.00db3808
mov esi, eax
add esp, 0x10
test esi, esi
je 0xdb3a92
push dword [ebp + 8]
mov ecx, esi
call dword [0xdd657c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0xdb3a9a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xde792c
push 0xde7924
push str.FlsSetValue
push 0x22
call fcn.00db3808
mov esi, eax
add esp, 0x10
test esi, esi
je 0xdb3ad4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0xdd657c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0xdb8e1a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00db317e
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0xdb8e89
cmp esi, dword [ebp - 4]
je 0xdb8e84
cmp dword [ebp + 0xc], 0
je 0xdb8e84
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0xdb8e61
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00db896c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0xdb8e8b
xor eax, eax
inc eax
jmp 0xdb8e8b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0xdb8ef0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xe3c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00db317e
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00db317e
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0xdb8f67
cmp word [ecx], dx
je 0xdb8f67
mov eax, dword [0xde804c]
push edi
dec eax
push eax
push 0xde7f38
call fcn.00db8e8f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0xdb8fda
cmp word [eax], dx
je 0xdb8fda
mov eax, dword [edi]
test eax, eax
je 0xdb8f8b
cmp word [eax], dx
je 0xdb8f8b
lea eax, [ebp - 0x10]
push eax
call fcn.00db8872
jmp 0xdb8f94
lea eax, [ebp - 0x10]
push eax
call fcn.00db890d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0xdb9004
mov eax, dword [0xde7f34]
push dword [ebp - 0x14]
dec eax
push eax
push 0xde7c28
call fcn.00db8e8f
add esp, 0xc
test al, al
je 0xdb9004
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0xdb8fcf
cmp word [eax], di
je 0xdb8fcf
lea eax, [ebp - 0x10]
push eax
call fcn.00db8872
pop ecx
jmp 0xdb9006
lea eax, [ebp - 0x10]
push eax
call fcn.00db890d
jmp 0xdb8fcc
mov eax, dword [edi]
test eax, eax
je 0xdb8ff1
cmp word [eax], dx
je 0xdb8ff1
lea eax, [ebp - 0x10]
push eax
call fcn.00db8827
pop ecx
jmp 0xdb9004
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0xdb90cf
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00db8d14
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0xdb90cf
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0xdb90cf
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0xdb90cf
mov eax, dword [ebp - 0x18]
test eax, eax
je 0xdb905c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00db3cb5
test ebx, ebx
je 0xdb90ca
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00db3cb5
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0xdb90cf
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0xdb90cf
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00d9dfe9
add esp, 0x10
xor eax, eax
inc eax
jmp 0xdb90d1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00d491ba
leave
ret