joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c161
Capabilities:
Modify service

Disassembly:
mov byte [ebp - 0x28], 1
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test esi, esi
je 0x1002c36f
cmp dword [esi], 0xe06d7363
jne 0x1002c12d
cmp dword [esi + 0x10], 3
jne 0x1002c12d
cmp dword [esi + 0x14], 0x19930520
je 0x1002c123
cmp dword [esi + 0x14], 0x19930521
je 0x1002c123
cmp dword [esi + 0x14], 0x19930522
jne 0x1002c12d
cmp dword [esi + 0x1c], 0
je 0x1002c36f
call fcn.10058cc2
cmp dword [eax + 0x1c], 0
je 0x1002c179
call fcn.10058ccd
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x20], eax
call fcn.10058cd8
push dword [ebp - 0x20]
push esi
and dword [eax + 0x1c], 0
call fcn.10057a24
pop ecx
pop ecx
test al, al
jne 0x1002c179
push dword [ebp - 0x20]
call fcn.10057ace
add al, byte [eax]
pop ecx
test al, al
je 0x1002c36f
jmp 0x100578e5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp dword [esi], 0xe06d7363
jne 0x1002c33b
cmp dword [esi + 0x10], 3
jne 0x1002c33b
cmp dword [esi + 0x14], 0x19930520
je 0x1002c1b4
cmp dword [esi + 0x14], 0x19930521
je 0x1002c1b4
cmp dword [esi + 0x14], 0x19930522
jne 0x1002c33b
cmp dword [edi + 0xc], 0
jbe 0x1002c2c2
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp + 0x20]
push edi
call fcn.1005847d
mov edx, dword [ebp - 0x18]
add esp, 0x14
cmp edx, dword [ebp - 0x2c]
jae 0x1002c2c2
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
cmp dword [edi + 0xc], 0
jbe 0x1002c35d
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x3c], eax
add byte [ebp + 0x5589e455], cl
loopne 0x100578a5
or byte [eax], al
add byte [eax], al
imul ecx, eax, 0
mov edx, dword [ebp - 0x20]
mov dword [edx + ecx], 1
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x20]
mov dword [edx + ecx + 4], 0x64
mov eax, 8
shl eax, 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + eax], 1
mov edx, 8
shl edx, 0
mov eax, dword [ebp - 0x20]
mov dword [eax + edx + 4], 0x64
mov ecx, 8
shl ecx, 1
mov edx, dword [ebp - 0x20]
mov dword [edx + ecx], 1
mov eax, 8
shl eax, 1
mov ecx, dword [ebp - 0x20]
mov dword [ecx + eax + 4], 0x64
lea edx, [ebp - 0x30]
push edx
push 2
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x34]
Function at 0x1002d5c6
Capabilities:
Query or enumerate registry value

Disassembly:
js 0x1002d62e
jle 0x1002d61f
mov eax, dword [ebp + 8]
cmp dword [eax], 0xe06d7363
jne 0x1002d60c
cmp dword [0x10064354], 0
je 0x1002d60c
push 0x10064354
call 0x100728b8
add al, 0
add esp, 4
test eax, eax
je 0x1002d609
mov esi, dword [0x10064354]
mov eax, dword [ebp + 8]
mov edx, eax
mov ecx, esi
call fcn.1005a483
cmp dword [esi + 0xc], edi
je 0x1002d686
jmp fcn.1002d674
mov edi, ebx
cmp ebx, 0xfffffffe
je 0x1002d63a
mov ebx, dword [ebp - 8]
jmp 0x10059fcf
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], 0
jmp 0x1002d65e
test cl, cl
je 0x1002d66a
mov ebx, dword [ebp - 8]
jmp 0x1002d65e
push dword [ebp - 0x14]
push ebx
call 0x10059f67
add esp, 8
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xc], ebx
lea ebx, [esi + 0x10]
push ebx
push dword [ebp - 8]
call fcn.10059f95
mov ecx, dword [ebp - 0x10]
add esp, 8
mov edx, ebx
mov ecx, dword [ecx + 8]
call fcn.1005a4fa
int3
dec ebp
invalid

Function at 0x1003d0dd
Capabilities:
Read file on windows

Disassembly:
or dh, byte [ebp + 7]
or byte [eax + edi + 0x28], 4
jmp 0x1003d0ec
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x1003d1f2
lea eax, [edx + 1]
mov cl, byte [ebx]
invalid
stc

Function at 0x1003d19e
Capabilities:
Read file on windows

Disassembly:
push es
mov byte [esi], 0xa
inc esi
jmp 0x1003d1c3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ebx, ecx
jb 0x1003d101
jmp 0x1003d1f2
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003d310
Capabilities:
Read file on windows

Disassembly:
jne 0x1003d317
mov word [esi], ax
jmp 0x1003d37e
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x1008fb58]
push 0xa
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ecx*4 + 0x1008fb58]
mov byte [eax + edi + 0x2b], dh
mov eax, dword [ecx*4 + 0x1008fb58]
pop edx
mov byte [eax + edi + 0x2c], dl
sub al, 0xeb
invalid
Function at 0x1003d359
Capabilities:
Read file on windows

Disassembly:
movzx ecx, word [ebx]
mov dword [ebp - 0xc], ecx
cmp ecx, 0x1a
mov ecx, dword [ebp - 8]
je 0x1003d38f
push 0xd
pop edx
cmp word [ebp - 0xc], dx
mov edx, dword [ebp + 0xc]
je 0x1003d28d
mov ecx, dword [ebp - 0xc]
add ebx, 2
mov word [esi], cx
add esi, 2
add eax, 2
jmp 0x10079a11
cmp eax, dword [ebp - 0x10]
jae 0x1003d2c5
push 0xa
pop edx
cmp word [eax], dx
mov edx, dword [ebp + 0xc]
jne 0x1003d2b1
push 0xa
pop ecx
add ebx, 4
mov word [esi], cx
add eax, 4
add esi, 2
jmp 0x10079a35
push 0xd
pop edx
mov word [esi], dx
add ebx, 2
add esi, 2
add eax, 2
jmp 0x10079a46
add eax, 2
add ebx, 2
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je fcn.1003d375
cmp dword [ebp - 0x18], 0
je fcn.1003d375
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x1008fb58]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x1003d343
mov dx, word [ebp - 4]
cmp dx, ax
cmp word [ebp - 4], ax
jne 0x1003d35b
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x1003d35b
mov word [esi], ax
add esi, 2
mov eax, dword [ebp - 0xc]
jmp 0x1003d384
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call 0x1007bb08
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1003d37e
invalid
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 0x10]
jb 0x1003d25b
jmp 0x1003d3af
mov ecx, dword [ecx*4 + 0x1008fb58]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1003d3a6
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1003d3af
mov cx, word [ebx]
invalid
invalid
Function at 0x1003d374
Capabilities:
Read file on windows

Disassembly:
movzx ecx, word [ebx]
mov dword [ebp - 0xc], ecx
cmp ecx, 0x1a
mov ecx, dword [ebp - 8]
je 0x1003d38f
push 0xd
pop edx
cmp word [ebp - 0xc], dx
mov edx, dword [ebp + 0xc]
je 0x1003d28d
mov ecx, dword [ebp - 0xc]
add ebx, 2
mov word [esi], cx
add esi, 2
add eax, 2
jmp 0x10079a11
cmp eax, dword [ebp - 0x10]
jae 0x1003d2c5
push 0xa
pop edx
cmp word [eax], dx
mov edx, dword [ebp + 0xc]
jne 0x1003d2b1
push 0xa
pop ecx
add ebx, 4
mov word [esi], cx
add eax, 4
add esi, 2
jmp 0x10079a35
push 0xd
pop edx
mov word [esi], dx
add ebx, 2
add esi, 2
add eax, 2
jmp 0x10079a46
add eax, 2
add ebx, 2
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je fcn.1003d375
cmp dword [ebp - 0x18], 0
je fcn.1003d375
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x1008fb58]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x1003d343
mov dx, word [ebp - 4]
cmp dx, ax
cmp word [ebp - 4], ax
jne 0x1003d35b
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x1003d35b
mov word [esi], ax
add esi, 2
mov eax, dword [ebp - 0xc]
jmp 0x1003d384
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call 0x1007bb08
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1003d37e
invalid
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 0x10]
jb 0x1003d25b
jmp 0x1003d3af
mov ecx, dword [ecx*4 + 0x1008fb58]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1003d3a6
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1003d3af
mov cx, word [ebx]
invalid
invalid

Function at 0x1003d375
Capabilities:
Read file on windows

Disassembly:
push 0xd
pop eax
mov word [esi], ax
add esi, 2

Function at 0x1003d59b
Capabilities:
Read file on windows

Disassembly:
cmp ebx, 0xfffffffe
jne 0x1003d5b8
call 0x1007097f
and dword [eax], 0
call 0x1007099a
in eax, dx
xor eax, dword [ebx]
add bh, al
add byte [ecx], cl
add byte [eax], al
add cl, ch
cmp cl, ch
add eax, dword [eax]

Function at 0x1003d5a9
Capabilities:
Read file on windows

Disassembly:
in eax, dx
xor eax, dword [ebx]
add bh, al
add byte [ecx], cl
add byte [eax], al
add cl, ch
cmp cl, ch
add eax, dword [eax]
test ebx, ebx
js 0x1003d922
cmp ebx, dword [0x1008fd58]
jae 0x1003d922
mov eax, ebx
mov dword [ebp - 0x14], 1
and eax, 0x3f
mov edi, ebx
sar edi, 6
imul edx, eax, 0x30
mov dword [ebp - 0x10], edi

Function at 0x1003d5e3
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edi*4 + 0x1008fb58]
mov dword [ebp - 0x18], edx
mov cl, byte [edx + eax + 0x28]
mov byte [ebp - 1], cl
test cl, 1
je 0x1003d922
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x7fffffff
jbe 0x1003d620
call 0x100709e7
and dword [eax], 0
call 0x10070a02
invalid
add byte [esi], dl
invalid
Function at 0x1003d717
Capabilities:
Read file on windows

Disassembly:
mov dword [ebp - 0x20], ebx
test byte [edx + ebx + 0x28], 0x48
mov ebx, dword [ebp + 8]
je 0x1003d7f6
mov ebx, dword [ebp - 0x20]
mov bl, byte [edx + ebx + 0x2a]
mov byte [ebp - 2], bl
inc byte [eax + 0x5d8b0afb]
or byte [edi], cl
invalid
invalid
add byte [eax], al
invalid
test ecx, ecx
je 0x1003d7f6
mov bl, byte [ebp - 2]
mov edi, dword [ebp - 0x14]
mov byte [eax], bl
inc eax
mov ebx, dword [ebp + 8]
dec ecx
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax*4 + 0x1008fb58]
mov byte [edx + eax + 0x2a], 0xa
je 0x1003d7f6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x1008fb58]
mov al, byte [edx + eax + 0x2b]
mov byte [ebp - 2], al
cmp al, 0xa
je 0x1003d7f6
test ecx, ecx
je 0x1003d7f6
mov eax, dword [ebp - 8]
mov bl, byte [ebp - 2]
push 2
pop edi
mov byte [eax], bl
sbb byte [eax - 0x75], al
pop ebp
or byte [ecx - 0x77], cl
inc ebp
clc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax*4 + 0x1008fb58]
mov byte [edx + eax + 0x2b], 0xa
mov al, byte [ebp - 1]
cmp al, byte [ebp - 0x14]
jne 0x1003d7f6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x1008fb58]
mov al, byte [edx + eax + 0x2c]
mov byte [ebp - 2], al
cmp al, 0xa
je 0x1003d7f6
test ecx, ecx
je 0x1003d7f6
mov eax, dword [ebp - 8]
mov bl, byte [ebp - 2]
push 3
pop edi
mov byte [eax], bl
inc eax
mov ebx, dword [ebp + 8]
dec ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax*4 + 0x1008fb58]
mov byte [edx + eax + 0x2c], 0xa
push ebx
call 0x1007f517
pop ecx
test eax, eax
je 0x1003d872
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax*4 + 0x1008fb58]
test byte [ecx + eax + 0x28], 0x80
je 0x1003d872
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
invalid
test eax, eax
je 0x1003d872
cmp byte [ebp - 1], 2
jne 0x1003d876
push eax
call 0x10070c0b
pop ecx
or edi, 0xffffffff
mov byte [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003d8ea
mov ecx, dword [ebp + 0x10]
cmp dword [ebp - 0x20], ecx
ja 0x1003d8ea
add edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax*4 + 0x1008fb58]
test byte [edx + eax + 0x28], 0x80
je 0x1003d858
cmp byte [ebp - 1], 2
je 0x1003d8cc
shr edi, 1
cmp byte [ebp - 0x14], 0
push edi
push dword [ebp - 0x24]
push ebx
je 0x1003d8e3
call 0x1007a1eb
add esp, 0xc
call 0x10079ee5
jmp 0x1003d8de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop edi
cmp eax, edi
jne 0x1003d90e
call 0x10070ce9
mov dword [eax], 9
call 0x10070ce1
mov dword [eax], edi
jmp 0x1007a563
add eax, dword [eax]
cmp eax, 0x6d
jne 0x1003d84e
xor edi, edi
jmp 0x1007a576

Function at 0x1003d731
Capabilities:
Read file on windows

Disassembly:
inc byte [eax + 0x5d8b0afb]
or byte [edi], cl
test byte [eax - 0x7b000000], bh
leave
Function at 0x1003d795
Capabilities:
Read file on windows

Disassembly:
sbb byte [eax - 0x75], al
pop ebp
or byte [ecx - 0x77], cl
inc ebp
clc

Function at 0x1003dc9c
Capabilities:
Get thread local storage value

Disassembly:
add al, 0
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 4], eax

Function at 0x1003dcae
Capabilities:
Get thread local storage value

Disassembly:
push esi
push 0x100671ac
push 0x100671a4
push str.FlsGetValue
push 5
call 0x1007ab33
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x1003dcdd
invalid
mov ecx, esi
call dword [0x100622f0]
call esi
jmp 0x1003dce3
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call 0x100657af
mov esp, ebp
pop ebp
ret 4

Function at 0x1003dcf6
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100671b4
jno 0x1003dd0f
adc byte [eax - 0x54], ch
jno fcn.1003dd14
invalid

Function at 0x1003dd14
Capabilities:
Set thread local storage value

Disassembly:
jno 0x1003dd0f
adc byte [eax - 0x54], ch
jno fcn.1003dd14
adc byte [eax - 0x1c], ch
xor byte [esi], al
adc byte [edx + 6], ch
push 6
push str.FlsSetValue

Function at 0x1003dd5a
Capabilities:
Get geographical location

Disassembly:
mov dword [ebp - 4], eax
push esi
push 0x100671c4
push 0x100671bc
mov esp, 0x68100671
and al, 0x34
push es
adc byte [edx + 0xd], ch

Function at 0x1003e824
Capabilities:
Write file on windows

Disassembly:
loopne 0x1003e865
sar ecx, 6
push ebx
imul ebx, eax, 0x30
push esi
mov eax, dword [ecx*4 + 0x1008fb58]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax + ebx + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
add eax, edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
cmp edi, ecx
inc esi
or byte [ebx], bh
stc
jae 0x1003e9ac

Function at 0x1003e87f
Capabilities:
Write file on windows

Disassembly:
mov ch, byte [edi]
xor eax, eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x1b], ch
mov edx, dword [eax*4 + 0x1008fb58]
test dword [eax - 5], ebx
or byte [eax], dl
pop eax
sti
or byte [eax], dl
mov cl, byte [edx + ebx + 0x2d]
test cl, 4
je 0x1003e8a6
mov al, byte [edx + ebx + 0x2e]
and cl, 0xfb
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push 2
mov byte [ebp - 0xb], ch
mov byte [edx + ebx + 0x2d], cl
dec esp
invalid
invalid
push eax
jmp 0x1003e8e0
call 0x10074f2f
movzx ecx, byte [edi]
mov edx, 0x8000
test word [eax + ecx*2], dx
je 0x1003e8dd
invalid
cmp edi, dword [ebp - 0x24]
jae 0x1003e983
push 2
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.10038aa5
add esp, 0xc
cmp eax, 0xffffffff
je 0x1003e9ac
inc edi
jmp 0x1003e8f5
invalid
push 1
push edi
invalid
Function at 0x1003e880
Capabilities:
Write file on windows

Disassembly:
mov ch, byte [edi]
xor eax, eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x1b], ch
mov edx, dword [eax*4 + 0x1008fb58]
test dword [eax - 5], ebx
or byte [eax], dl
pop eax
sti
or byte [eax], dl
mov cl, byte [edx + ebx + 0x2d]
test cl, 4
je 0x1003e8a6
mov al, byte [edx + ebx + 0x2e]
and cl, 0xfb
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push 2
mov byte [ebp - 0xb], ch
mov byte [edx + ebx + 0x2d], cl
dec esp
invalid
invalid
push eax
jmp 0x1003e8e0
call 0x10074f2f
movzx ecx, byte [edi]
mov edx, 0x8000
test word [eax + ecx*2], dx
je 0x1003e8dd
invalid
cmp edi, dword [ebp - 0x24]
jae 0x1003e983
push 2
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.10038aa5
add esp, 0xc
cmp eax, 0xffffffff
je 0x1003e9ac
inc edi
jmp 0x1003e8f5
invalid
push 1
push edi
invalid

Function at 0x1003e8b8
Capabilities:
Write file on windows

Disassembly:
mov ch, byte [edi]
xor eax, eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x1b], ch
mov edx, dword [eax*4 + 0x1008fb58]
test dword [eax - 5], ebx
or byte [eax], dl
pop eax
sti
or byte [eax], dl
mov cl, byte [edx + ebx + 0x2d]
test cl, 4
je 0x1003e8a6
mov al, byte [edx + ebx + 0x2e]
and cl, 0xfb
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push 2
mov byte [ebp - 0xb], ch
mov byte [edx + ebx + 0x2d], cl
dec esp
invalid
invalid
push eax
jmp 0x1003e8e0
call 0x10074f2f
movzx ecx, byte [edi]
mov edx, 0x8000
test word [eax + ecx*2], dx
je 0x1003e8dd
invalid
cmp edi, dword [ebp - 0x24]
jae 0x1003e983
push 2
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.10038aa5
add esp, 0xc
cmp eax, 0xffffffff
je 0x1003e9ac
inc edi
jmp 0x1003e8f5
invalid
push 1
push edi
invalid

Function at 0x1003e8be
Capabilities:
Write file on windows

Disassembly:
mov ch, byte [edi]
xor eax, eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x1b], ch
mov edx, dword [eax*4 + 0x1008fb58]
test dword [eax - 5], ebx
or byte [eax], dl
pop eax
sti
or byte [eax], dl
mov cl, byte [edx + ebx + 0x2d]
test cl, 4
je 0x1003e8a6
mov al, byte [edx + ebx + 0x2e]
and cl, 0xfb
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push 2
mov byte [ebp - 0xb], ch
mov byte [edx + ebx + 0x2d], cl
dec esp
invalid
invalid
push eax
jmp 0x1003e8e0
call 0x10074f2f
movzx ecx, byte [edi]
mov edx, 0x8000
test word [eax + ecx*2], dx
je 0x1003e8dd
invalid
cmp edi, dword [ebp - 0x24]
jae 0x1003e983
push 2
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.10038aa5
add esp, 0xc
cmp eax, 0xffffffff
je 0x1003e9ac
inc edi
jmp 0x1003e8f5
invalid
push 1
push edi
invalid
Function at 0x1003e956
Capabilities:
Write file on windows

Disassembly:
sbb byte [edx + 1], ch
xor ecx, ecx
lea eax, [ebp - 0x14]
push ecx
push ecx
push 5
push eax
push 1
lea eax, [ebp - 0x18]
dec edi
sub eax, 0xc875ff55
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1003e9ac
push 0
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003e9a4
mov eax, dword [esi + 8]
sub eax, dword [ebp - 0x30]
add eax, edi
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x20], eax
jb 0x1003e9ac
cmp byte [ebp - 0x1b], 0xa
jne 0x1003e978
push 0xd
pop eax
push 0
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
inc ebp
loopne 0x1003e9a9
push 1
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
adc eax, sym.imp.KERNEL32.dll_WriteFile
test eax, eax
je 0x1003e9a4
cmp dword [ebp - 0x20], 1
jb 0x1003e9ac
inc dword [esi + 8]
inc dword [esi + 4]
cmp edi, dword [ebp - 0x24]
jb 0x1003e86f
out dx, al
invalid
invalid
invalid
jmp 0x1003e9ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax

Function at 0x1003eb12
Capabilities:
Write file on windows

Disassembly:
cmp ebx, eax
jae fcn.1003eb23
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x1003eb13
inc dword [esi + 8]
mov byte [edi], 0xd
inc edi
mov byte [edi], al
lea eax, [ebp - 5]
inc edi
cmp edi, eax
mov eax, dword [ebp - 0x1408]
jb 0x1003eb01

Function at 0x1003eb23
Capabilities:
Write file on windows

Disassembly:
lea eax, [ebp - 0x1404]
sub edi, eax
lea eax, [ebp - 0x140c]
push 0
push eax
push edi
lea eax, [ebp - 0x1404]
push eax

Function at 0x1003ebe3
Capabilities:
Write file on windows

Disassembly:
lea edi, [ebp - 0x1404]
cmp ebx, eax
jae 0x1003ec0e
movzx eax, word [ebx]
add ebx, 2
cmp eax, 0xa
jne 0x1003ebfb
add dword [esi + 8], 2
push 0xd
pop edx
mov word [edi], dx
add edi, 2
mov word [edi], ax
lea eax, [ebp - 6]
add edi, 2
cmp edi, eax
mov eax, dword [ebp - 0x1408]
invalid

Function at 0x1003ecc9
Capabilities:
Write file on windows

Disassembly:
jae 0x1003ed89
mov esi, dword [ebp - 0x140c]
lea eax, [ebp - 0x6b0]

Function at 0x1003ecdb
Capabilities:
Write file on windows

Disassembly:
cmp edi, esi
jae 0x1003ed00
movzx ecx, word [edi]
add edi, 2
cmp ecx, 0xa
jne 0x1003ecf3
push 0xd
pop edx
mov word [eax], dx
add eax, 2
mov word [eax], cx
push ebx
push ebx
push 0xd55
lea ecx, [ebp - 0x1408]
push ecx
lea ecx, [ebp - 0x6b0]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
push ebx
push 0x3e220e9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1418], eax
test eax, eax
je 0x1003ed81
push 0
lea ecx, [ebp - 0x1410]
sub eax, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx

Function at 0x1003ecf6
Capabilities:
Write file on windows

Disassembly:
add eax, 2
lea ecx, [ebp - 8]
cmp eax, ecx
jb fcn.1003ecdb
Function at 0x1003ed40
Capabilities:
Write file on windows

Disassembly:
push eax
lea eax, [ebp - 0x1408]
add eax, ebx
push eax
invalid
mov ch, 0xec

Function at 0x1003eeea
Capabilities:
Write file on windows

Disassembly:
add al, 0x9d
pop eax
sti
or byte [eax], dl
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], edx
mov bl, byte [eax + edx + 0x29]
cmp bl, 2
je 0x1003ef04
cmp bl, 1
jne 0x1003ef2c
mov eax, ecx
not eax
test al, 1
jne 0x1003ef29
call 0x100722eb
and dword [eax], 0
call 0x10072306
mov dword [eax], 0x16
call 0x1006eb9a
jmp 0x1007d3a3
mov eax, dword [ebp - 0x2c]
test byte [eax + edx + 0x28], 0x20
je 0x1003ef42
push 2
push 0
push 0
push esi
call 0x1007d6de
add esp, 0x10
push esi
call 0x1007cd74
pop ecx
test al, al
je 0x1003ef86
invalid

Function at 0x1003f1a8
Capabilities:
Clear file content

Disassembly:
push edi
call 0x1007d948
add byte [ebx - 0xfba7638], cl
and ecx, edx
mov dword [ebp - 0xc], edx
add esp, 0x10
cmp ecx, 0xffffffff
jne 0x1003f1c7
call 0x100725ad
mov eax, dword [eax]
jmp 0x1007d8e2
push 2
push esi
push esi
push edi
call 0x1007d970
mov ecx, eax
add esp, 0x10
and ecx, edx
cmp ecx, 0xffffffff
je 0x1003f1bb
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x1003f2c9
jg 0x1003f1fb
cmp ebx, esi
jbe 0x1003f2c9
push 1
push 0x1000
call 0x1007582e
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1003f21f
call 0x10072601
mov dword [eax], 0xc
jmp 0x1007d8d6
push 0x8000
push edi
call 0x1007d6e9
mov edi, 0x590003e4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
pop ecx
cmp eax, esi
jg 0x1003f282
jl 0x1003f2d3
cmp ebx, esi
jae 0x1003f282
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call 0x1007da7f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x1003f299
push edi
call 0x1007ce92
mov byte [0x590003db], al

Function at 0x1003f2ec
Capabilities:
Clear file content

Disassembly:
mov byte [0x590003db], al
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1003f282
call 0x100726ee
mov dword [eax], 0xd
call 0x100726e6
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x1003f299

Function at 0x10044118
Capabilities:
Get geographical location

Disassembly:
mov al, 0xe7
add dword [eax], eax
jmp 0x10044110
mov esi, dword [ebp + 8]
push edi
call 0x1007c4b4
add byte [ebx - 0x7c641728], cl
add eax, dword [eax]

Function at 0x10044120
Capabilities:
Get geographical location

Disassembly:
push esi
mov edi, dword [eax + 0x34c]
call 0x1008794d
pop ecx
mov ecx, dword [ebx + 0x64]
mov esi, eax
neg ecx
lea eax, [ebp - 0xf4]
push 0x78
sbb ecx, ecx
and ecx, 0xfffff005
add eax, 0x50fffff0
add ecx, 0x1002
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
invalid
jne 0x10044162
lea eax, [ebp - 0xf4]
push eax
push dword [ebx + 0x54]
call 0x100795c9
and dword [ebp - 0xf8], 0
pop ecx
pop ecx
test eax, eax