joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011a4c2
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push esi
push edi
xor esi, esi
mov edi, edx
push esi
push 0x100080
push 3
or dword [edi], 0xffffffff
push esi
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1011a513
push esi
push esi
push esi
push 2
push esi
push eax
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x1011a513
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
ret
Function at 0x1012044c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1012056e
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1012056e
xor edi, edi
cmp dword [esi + 8], edi
jne 0x1012047c
xor eax, eax
inc eax
jmp 0x10120578
push edi
xor edx, edx
call fcn.1012748c
mov ebx, eax
test ebx, ebx
jne 0x10120491
push 0x66
jmp 0x10120570
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x128], edi
jne 0x10120561
mov edx, ebx
mov ecx, esi
call fcn.10120585
test eax, eax
je 0x1012055c
mov edx, ebx
mov ecx, esi
call fcn.1012072d
test eax, eax
je 0x1012055c
mov eax, dword [ebx + 0x28]
mov dword [ebp - 4], 1
mov ecx, dword [eax + 4]
lea edi, [eax + 0x14]
test ecx, ecx
je 0x10120561
dec ecx
cmp dword [edi + 0x10], 0
mov dword [ebp - 8], ecx
je 0x1012054a
cmp dword [edi + 0x24], 0
je 0x10120511
push dword [edi + 0x1c]
mov edx, ebx
mov ecx, edi
push dword [ebx + 0x2c]
push esi
call fcn.100ff122
cmp eax, 0x80004001
je 0x10120547
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 4], ecx
test eax, eax
js 0x10120557
jmp 0x10120547
test byte [edi + 0x3c], 0x20
je 0x1012051c
mov eax, dword [edi + 0x54]
jmp 0x10120529
push 5
pop edx
mov ecx, edi
call fcn.10138916
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1012054a
push dword [edi + 0x1c]
mov ecx, eax
push dword [ebx + 0x2c]
push esi
push ebx
call dword [0x101d880c]
call dword [ebp - 0xc]
test eax, eax
je 0x10120553
mov ecx, dword [ebp - 8]
add edi, 0x78
test ecx, ecx
jne 0x101204da
jmp 0x10120557
and dword [ebp - 4], 0
mov esi, dword [ebp - 4]
jmp 0x10120564
mov dword [ebp - 4], edi
jmp 0x10120557
xor esi, esi
inc esi
push ebx
call fcn.10127420
mov eax, esi
jmp 0x10120578
push 0x65
push esi
call fcn.1010116a
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10123086
Capabilities:
Create directory
Delete file
Get common file path
Move file
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
xor esi, esi
cmp dword [ebx], 0xffffffff
jne 0x101230a1
xor eax, eax
inc eax
jmp 0x101231a6
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
call fcn.101049f2
mov dword [ebp - 8], eax
test eax, eax
je 0x101231a4
push edi
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x1012318f
push esi
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], esi
push esi
push 0x8100000
push 2
push esi
push esi
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x1012315d
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10123137
push edi
push esi
push 0x1002d804
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1012318f
push 1
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1012318f
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1012318f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 2
jb 0x101230db
jmp 0x1012318f
cmp dword [ebp - 4], esi
je 0x10123176
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10123179
push esi
lea eax, [ebp - 4]
push eax
push 0x1000
push edi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10123142
jmp 0x10123179
xor esi, esi
inc esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1012318f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x101231a3
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1012748c
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
and al, 0x10
mov dword [ebp - 4], ecx
movzx eax, al
neg eax
push esi
sbb eax, eax
push edi
and eax, 0x4e0
mov edi, edx
add eax, 0x50
mov dword [ebp - 0x10], edi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1012763d
mov ecx, edi
test edi, edi
jne 0x101274d3
mov ecx, 0x1001db2c
call fcn.10133cc3
mov dword [esi + 0xc], eax
test eax, eax
je 0x1012763d
mov dword [esi + 8], esi
mov dword [esi + 0x14], ebx
test bl, 5
je 0x10127512
mov eax, ebx
and al, 4
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x101d5f00
push eax
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.WINSPOOL.DRV_OpenPrinterW]
test eax, eax
je 0x1012763d
mov eax, dword [ebp - 4]
mov dword [esi + 0x10], eax
test bl, 2
je 0x10127571
mov ecx, dword [ebp - 4]
push 2
pop edx
mov dword [ebp - 8], 0x603
call fcn.101341c4
xor edi, edi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10127554
cmp dword [eax], edi
jne 0x1012755b
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov edx, 0x1002aa08
call fcn.1013536b
test eax, eax
mov eax, dword [ebp - 0xc]
jne 0x1012755b
mov dword [ebp - 8], edi
test eax, eax
je 0x10127565
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 8]
cmp edi, 0x603
jne 0x1012763d
mov ecx, dword [ebp - 4]
push 3
call fcn.101343ed
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x1012763d
test bl, 8
je 0x1012759f
mov ecx, dword [ebp - 4]
mov edx, 0x1002aa08
push 0x603
call fcn.1013564c
test bl, 0x40
je 0x101275c4
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x101275c4
call fcn.1017c769
mov edi, eax
test edi, edi
je 0x101275c4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x10]
lea edi, [esi + 0x20]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push edi
push eax
push ebx
call fcn.10125954
cmp dword [ebp - 8], 0
mov dword [esi + 0x18], eax
je 0x101275ea
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esi + 0x18]
test edx, edx
je 0x1012763d
mov eax, dword [edi]
test eax, eax
je 0x1012763d
mov ecx, dword [eax + 0x2c]
add eax, ecx
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x24], ecx
je 0x1012763d
mov edx, dword [edx + 0x10]
push edx
mov edx, dword [edx + 0x14]
call fcn.10138339
mov dword [esi + 0x28], eax
test eax, eax
je 0x1012763d
mov dword [eax], esi
mov ecx, esi
mov edx, dword [esi + 0x28]
push 1
call fcn.101387c0
test eax, eax
je 0x1012763d
mov dword [esi], 8
mov eax, esi
mov dword [esi + 4], 0x100062bc
jmp 0x10127645
push esi
call fcn.10127420
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10127652
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
push ebx
xor ebx, ebx
inc ebx
push esi
test eax, eax
je 0x101277f3
cmp dword [ebp + 8], ebx
je 0x10127679
cmp dword [ebp + 8], 2
jne 0x101277f3
mov edx, dword [eax]
xor ecx, ecx
push 0x104c
call fcn.1012748c
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x101277fb
push edi
mov ecx, esi
call fcn.10123009
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 8]
call fcn.10179abc
mov edi, eax
test edi, edi
je 0x101276c1
push dword [ebp - 8]
mov ecx, dword [esi + 0x10]
mov edx, edi
call fcn.10179c91
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, esi
call fcn.10127809
mov ecx, dword [esi + 0x10]
call fcn.10109c37
mov ecx, esi
call fcn.101092d1
test eax, eax
je 0x101276f9
mov ecx, esi
call fcn.10126ecf
test eax, eax
je 0x101276f9
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x134], 0
je 0x101276f9
mov edx, esi
call fcn.101325d5
cmp dword [esi + 0x38], 0
je 0x10127703
or dword [esi + 0x48], 0xc
mov eax, dword [esi + 0x28]
lea edi, [eax + 0x14]
mov eax, dword [eax + 4]
test eax, eax
je 0x101277c2
mov esi, dword [ebp + 0xc]
dec eax
cmp dword [edi + 0x10], 0
mov dword [ebp - 4], eax
je 0x101277b0
cmp dword [edi + 0x24], 0
je 0x10127746
mov edx, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.100ff1ff
cmp eax, 0x80004001
je 0x101277ad
xor ebx, ebx
test eax, eax
setns bl
jmp 0x101277ad
cmp byte [edi + 0x3c], 0
jge 0x10127751
mov eax, dword [edi + 0x5c]
jmp 0x1012775b
push 7
pop edx
mov ecx, edi
call fcn.10138916
mov dword [ebp - 8], eax
test eax, eax
je 0x10127777
push esi
push dword [ebp + 8]
mov ecx, eax
call dword [0x101d880c]
call dword [ebp - 8]
neg eax
sbb eax, eax
and ebx, eax
test byte [edi + 0x3d], 4
je 0x10127782
mov eax, dword [edi + 0x68]
jmp 0x1012778c
push 0xa
pop edx
mov ecx, edi
call fcn.10138916
mov dword [ebp - 8], eax
test eax, eax
je 0x101277ad
push fcn.1010a8e0
push esi
push dword [ebp + 8]
mov ecx, eax
call dword [0x101d880c]
call dword [ebp - 8]
neg eax
sbb eax, eax
and ebx, eax
mov eax, dword [ebp - 4]
add edi, 0x78
test eax, eax
jne 0x10127717
mov esi, dword [ebp - 0xc]
test ebx, ebx
je 0x101277e8
test dword [esi + 0x48], 0x100
je 0x101277e8
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
and eax, 0x100000
push eax
push ecx
push dword [esi + 0x34]
mov ecx, dword [esi + 0x10]
call fcn.10135554
mov ebx, eax
push esi
call fcn.10127420
mov eax, ebx
pop edi
jmp 0x101277fd
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x101279c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov dword [ebp - 0xc], edx
mov ecx, dword [esi + 0x4f8]
mov eax, dword [esi + 0x4f4]
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x101279f0
mov dword [esi + 0x4d0], eax
jmp 0x101279fc
cmp dword [esi + 0x4d0], eax
jne 0x10127b07
mov ebx, dword [esi + 0x28]
mov eax, dword [ebx + 4]
test eax, eax
je 0x10127b5b
add ebx, 0x14
dec eax
cmp dword [ebx + 0x10], 0
mov dword [ebp - 8], eax
je 0x10127b50
cmp dword [ebx + 0x24], 0
jne 0x10127a49
test byte [ebx + 0x3c], 4
je 0x10127a2c
mov edx, dword [ebx + 0x48]
jmp 0x10127a3e
push 2
pop edx
mov ecx, ebx
call fcn.10138916
mov ecx, dword [ebp - 4]
mov edx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edx
test edx, edx
je 0x10127b50
mov edi, dword [ebx + 0x14]
test edi, edi
jne 0x10127aaa
test ecx, ecx
jne 0x10127b50
push 0x3c
push 8
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10127b07
mov dword [ebx + 0x14], edi
mov dword [edi], 0x3c
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 0x10]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x4d4]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x4d0]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x2c], eax
cmp dword [ebx + 0x24], 0
mov eax, dword [edi + 0x30]
mov ecx, dword [esi + 0x54]
mov dword [ebp - 0x10], eax
push edi
je 0x10127b0e
xor edx, edx
test ecx, ecx
mov ecx, ebx
setne dl
inc edx
call fcn.100ff0c1
cmp eax, 0x80004001
jne 0x10127afd
push edi
push 0
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [ebx + 0x14], 0
mov ecx, dword [ebp - 4]
jmp 0x10127b4d
test eax, eax
jns 0x10127b27
cmp dword [ebp - 4], 0
je 0x10127ae8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 0xc]
setne al
inc eax
push eax
call dword [0x101d880c]
call dword [ebp - 0xc]
test eax, eax
je 0x10127b01
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10127b44
mov eax, dword [edi + 0x30]
cmp dword [ebp - 0x10], eax
jne 0x10127b07
imul eax, eax, 0x34
add ecx, eax
add dword [esi + 0x4f8], eax
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x30]
add dword [esi + 0x4f4], eax
mov eax, dword [ebp - 8]
add ebx, 0x78
test eax, eax
jne 0x10127a0d
xor eax, eax
inc eax
jmp 0x10127b09
Function at 0x10127b66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
mov edi, dword [ebx + 0x28]
mov eax, dword [edi + 4]
test eax, eax
je 0x10127c51
add edi, 0x14
dec eax
cmp dword [edi + 0x10], 0
mov dword [ebp - 4], eax
je 0x10127c46
cmp dword [edi + 0x24], 0
mov ecx, dword [ebx + 0x54]
je 0x10127baf
test ecx, ecx
jne 0x10127ba8
mov esi, 0x1010a5c0
jmp 0x10127be1
mov esi, 0x1010a630
jmp 0x10127be1
mov dl, byte [edi + 0x3c]
test ecx, ecx
jne 0x10127bc4
test dl, 8
je 0x10127bc0
mov esi, dword [edi + 0x4c]
jmp 0x10127bdd
push 3
jmp 0x10127bd0
test dl, 0x10
je 0x10127bce
mov esi, dword [edi + 0x50]
jmp 0x10127bdd
push 4
pop edx
mov ecx, edi
call fcn.10138916
mov esi, eax
mov eax, dword [ebp - 4]
test esi, esi
je 0x10127c46
push 0x2c
push 8
push dword [ebx + 0x44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x10127c59
mov dword [edx], 0x2c
mov ecx, dword [ebx + 0x28]
push edx
push esi
push 5
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
mov ecx, dword [ebx + 0x10]
mov dword [edx + 8], ecx
mov eax, dword [ebx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 0x44]
mov dword [edx + 0x14], eax
mov eax, dword [ebx + 0x2c]
mov dword [edx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], edi
mov esi, dword [ebx + 0x6c]
mov ecx, esi
push dword [ebx + 0x70]
call dword [0x101d880c]
call esi
mov eax, dword [ebp - 4]
add edi, 0x78
test eax, eax
jne 0x10127b86
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x10127c54
Function at 0x1012c9bf
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [esi], ecx
push edi
mov edi, ecx
test ebx, ebx
je 0x1012cb90
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x1012cb90
cmp dword [eax + 4], ecx
je 0x1012cb90
lea ecx, [ebp - 0xc]
push ecx
push dword [eax + 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1012ca8d
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x1012ca4e
mov esi, 0x8007000e
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x1012ca3c
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov dword [ebx], eax
test edi, edi
je 0x1012ca47
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x1012cb95
push edi
push dword [ebp - 0x10]
xor eax, eax
push eax
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x10]
push dword [eax + 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1012ca8d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x1001d750
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1012ca8d
cmp dword [ebp - 0x14], 0x14
jae 0x1012caa9
mov esi, 0x8000ffff
jmp 0x1012ca28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1012caa4
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1012ca28
mov esi, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x18]
jne 0x1012cab5
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x59]
push eax
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x10], eax
mov dword [esi], eax
test eax, eax
je 0x1012ca23
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
mov eax, dword [ebx + 0x18]
shr edx, 0x10
push edx
mov eax, dword [eax + 0x10]
push dword [eax + 4]
mov eax, dword [ebp - 0x18]
push 0x1002e8f8
push 0x1002bb80
inc eax
push eax
push dword [ebp - 0x10]
call fcn.10045113
mov esi, eax
add esp, 0x24
test esi, esi
js 0x1012ca28
mov ecx, dword [ebx + 0x18]
xor ebx, ebx
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1012cb36
mov ebx, dword [ebp - 4]
sub ecx, edx
sar ecx, 1
mov eax, dword [ebx]
add eax, 0x74
xor ebx, ebx
jmp 0x1012cb86
test ecx, ecx
je 0x1012ca3c
movzx edx, word [eax]
cmp edx, 0x41
jb 0x1012cb66
cmp edx, 0x5a
jbe 0x1012cb80
cmp edx, 0x61
jb 0x1012cb70
cmp edx, 0x7a
jbe 0x1012cb80
cmp edx, 0x30
jb 0x1012cb7a
cmp edx, 0x39
jbe 0x1012cb80
push 0x5f
pop edx
mov word [eax], dx
add eax, 2
sub ecx, 2
cmp word [eax], bx
jne 0x1012cb51
jmp 0x1012ca3c
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10134a79
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x10134a9e
movzx eax, byte [ecx]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1002f400]
inc ecx
sub edx, 1
jne 0x10134a86
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10134be0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
test edi, edi
je 0x10134c6f
test esi, esi
je 0x10134c5f
push 0
push 0x100080
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x10134c5f
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10134c2c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x10134c5f
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x10134c5f
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
jne 0x10134c76
cmp dword [edi], 0xffffffff
je 0x10134c6f
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0xffffffff
test esi, esi
je 0x10134c76
and dword [esi], 0
mov eax, dword [esi]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10134cf0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x210], esi
lea eax, [ebp - 0x210]
mov edi, 0x103
mov edx, edi
mov ecx, 0x1002f800
push eax
call fcn.10134ca9
test eax, eax
js 0x10134dbf
lea ebx, [edi + 1]
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10134dbf
cmp eax, edi
jae 0x10134dbf
mov ecx, dword [ebp - 0x210]
add ecx, eax
cmp ecx, edi
jae 0x10134dbf
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x20c], cx
mov edx, ebx
push 0x1002f800
lea ecx, [ebp - 0x20c]
call fcn.10045073
test eax, eax
js 0x10134dbf
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x101d6f44], eax
test eax, eax
je 0x10134dc5
push 0x1002f818
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10134dc5
push 2
mov ecx, edi
call dword [0x101d880c]
call edi
mov esi, eax
jmp 0x10134dc5
mov dword [0x101d6f44], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x101d6f48], esi
xor ecx, ebp
pop esi
pop ebx
call fcn.101885f0
leave
ret
Function at 0x10135d7d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
xor edi, edi
push 5
inc edi
push 0x800
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 4], eax
test eax, eax
jle 0x10135e00
add eax, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x10135e00
push dword [ebp - 4]
push ebx
push 5
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp - 4], eax
jne 0x10135dd3
push ebx
call sub.msvcrt.dll__wtol
pop ecx
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, edi
je 0x10135e00
cmp esi, 2
je 0x10135e00
lea eax, [esi - 0x32]
cmp eax, 9
ja 0x10135df0
cmp esi, 0x37
jne 0x10135e00
cmp esi, 0x1f4
jl 0x10135e02
cmp esi, 0x258
jge 0x10135e02
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x101387c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, edx
mov dword [ebp - 0xc], ecx
push esi
push edi
mov edi, dword [ebx + 4]
test edi, edi
je 0x10138906
lea esi, [ebx + 0x14]
mov eax, dword [esi + 4]
dec edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x101388b1
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 8
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi + 0x10], eax
test eax, eax
je 0x10138855
cmp dword [ebp + 8], 1
jne 0x101388b1
mov ecx, dword [ebp - 0xc]
mov edx, esi
call fcn.100fec33
test eax, eax
jne 0x10138832
and dword [esi + 0x24], eax
test byte [esi + 0x3c], 1
je 0x1013885c
mov edi, dword [esi + 0x40]
jmp 0x10138867
cmp dword [esi + 0x24], 0
je 0x10138827
lea ecx, [ebp - 4]
xor edx, edx
push ecx
push ecx
lea eax, [esi + 0xc]
inc edx
push eax
mov ecx, esi
call fcn.100ff058
test eax, eax
js 0x10138855
cmp dword [esi + 0xc], 0
jne 0x101388b1
xor eax, eax
jmp 0x10138909
xor edx, edx
mov ecx, esi
call fcn.10138916
mov edi, eax
test edi, edi
je 0x10138855
lea eax, [ebp - 4]
mov ecx, edi
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 2
call dword [0x101d880c]
call edi
test eax, eax
je 0x10138855
cmp dword [ebp - 0x10], 0x10000
jne 0x10138855
lea ecx, [ebp - 4]
push ecx
push 4
lea eax, [esi + 0xc]
mov ecx, edi
push eax
push 1
call dword [0x101d880c]
call edi
test eax, eax
je 0x10138855
cmp dword [esi + 0xc], 0
je 0x10138855
mov edi, dword [ebp - 0x14]
add esi, 0x78
test edi, edi
jne 0x101387de
cmp dword [ebp + 8], 1
jne 0x10138906
inc edi
cmp dword [ebx + 4], 1
jbe 0x10138906
lea esi, [ebx + 0x8c]
cmp dword [esi + 0x10], 0
je 0x101388fd
xor eax, eax
test edi, edi
je 0x101388fd
mov edx, dword [esi + 0xc]
lea ecx, [ebx + 0x20]
cmp dword [ecx], edx
je 0x101388ef
inc eax
add ecx, 0x78
cmp eax, edi
jb 0x101388e1
jmp 0x101388fd
xor edx, edx
mov ecx, esi
inc edx
call fcn.101386d9
and dword [esi + 0xc], 0
inc edi
add esi, 0x78
cmp edi, dword [ebx + 4]
jb 0x101388cf
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4