joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f5e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x40f602
xor eax, eax
jmp 0x40f728
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x40f621
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x40f625
inc esi
cmp esi, ecx
jb 0x40f618
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x40f715
cmp ecx, 2
jbe 0x40f6af
xor edx, edx
movzx ecx, byte [esi + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x40f709
movzx eax, byte [esi + 3]
mov ebx, dword [ebp + 0x10]
shl ecx, 8
add ebx, edi
or ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
add ecx, ebx
sub eax, ebx
cmp dword [ebp + 0x18], 0
cmove ecx, eax
mov dword [ebp - 4], ecx
mov ebx, ecx
test edx, edx
je 0x40f6e3
and edx, 6
mov eax, ecx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x40f6e1
mov eax, dword [ebp + 0x10]
mov ebx, 0x100
shl ebx, cl
add eax, edi
dec ebx
xor ebx, dword [ebp - 4]
cmp dword [ebp + 0x18], 0
je 0x40f6df
add ebx, eax
jmp 0x40f6e1
shr edx, cl
test edx, edx
je 0x40f63f
cmp edx, 4
ja 0x40f6d1
cmp edx, 3
je 0x40f6d1
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x40f63f
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x40f613
sub ebx, eax
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
push 5
mov byte [esi + 4], bl
mov ebx, dword [ebp + 8]
pop eax
jmp 0x40f711
or edx, 8
xor eax, eax
shr edx, 1
inc eax
add edi, eax
jmp 0x40f6d7
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x644e046b
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x533647f6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x407b78
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x407c08
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x407c08
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x407bbb
test edx, 3
jne 0x407baa
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x407bb5
jmp 0x407bbb
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x407bbb
cmp dword [ecx - 8], 1
je 0x407bc5
mov edx, ebx
or edx, 3
call fcn.004050c0
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x407bd7
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004049f4

Function at 0x407c14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x407ca4
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x407ca4
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x407c57
test edx, 3
jne 0x407c46
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x407c51
jmp 0x407c57
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x407c57
cmp dword [ecx - 8], 1
je 0x407c61
mov edx, ebx
or edx, 3
call fcn.004050c0
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x407c73
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004049f4
Function at 0x40ed74
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov dword [ebp - 0x308], ecx
mov ebx, edx
mov dword [ebp - 0x304], eax
test byte [ebx + 1], 0x20
jne 0x40ed9e
mov eax, 0x80070057
call fcn.0040e91c
movzx eax, word [ebx]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x40ef25
test ah, 0x40
je 0x40edc4
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x314], eax
jmp 0x40edcd
mov eax, dword [ebx + 8]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40ee52
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_SetEvent
call fcn.0040e91c
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_SetFilePointer
call fcn.0040e91c
mov eax, dword [ebp - 0x320]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x320]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x40edf0
lea eax, [ebp - 0x300]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0xc
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
test esi, esi
jne 0x40ee72
call fcn.0040e674
mov eax, dword [ebp - 0x304]
call fcn.0040eccc
mov eax, dword [ebp - 0x304]
mov word [eax], 0x200c
mov eax, dword [ebp - 0x304]
mov dword [eax + 8], esi
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x40eeb6
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x40eea9
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.0040ece8
pop ecx
test al, al
je 0x40ef16
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_VirtualQuery
call fcn.0040e91c
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x100]
push eax
push esi
call sub.KERNEL32.DLL_VirtualQuery
call fcn.0040e91c
mov eax, dword [ebp - 0x318]
mov edx, eax
mov eax, dword [ebp - 0x31c]
call dword [ebp - 0x308]
push ebp
mov eax, ebx
call fcn.0040ed18
pop ecx
test al, al
jne 0x40eeb6
jmp 0x40ef37
push ebx
mov eax, dword [ebp - 0x304]
push eax
call sub.KERNEL32.DLL_ReadFile
call fcn.0040e91c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418990
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x418aaa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4189d9
mov ecx, 0x418ac4
mov dl, 1
mov eax, dword [0x406f84]
call fcn.0040b780
call fcn.0040443c
xor eax, eax
push ebp
push 0x418a8d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, ebx
call fcn.00404e94
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x418a1c
mov ecx, 0x418ac4
mov dl, 1
mov eax, dword [0x406f84]
call fcn.0040b780
call fcn.0040443c
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x418a6d
lea eax, [ebp - 0x14]
push eax
call fcn.00406e48
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x418ae0
call fcn.00408c84
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x406f84]
call fcn.0040b780
call fcn.0040443c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418a94
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegFlushKey
ret

Function at 0x418b04
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x418b3d
mov ecx, 0x418bdc
mov dl, 1
mov eax, dword [0x406f84]
call fcn.0040b780
call fcn.0040443c
xor eax, eax
push ebp
push 0x418bc4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, ebx
call fcn.00404e94
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x418b80
mov ecx, 0x418bf8
mov dl, 1
mov eax, dword [0x406f84]
call fcn.0040b780
call fcn.0040443c
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x418ba4
mov ecx, 0x418c14
mov dl, 1
mov eax, dword [0x406f84]
call fcn.0040b780
call fcn.0040443c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418bcb
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegFlushKey
ret
Function at 0x418c30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x418c63
xor ecx, ecx
mov dl, 1
mov eax, dword [0x406f84]
call fcn.0040b780
call fcn.0040443c
xor eax, eax
push ebp
push 0x418cb2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, ebx
call fcn.00404e94
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418cb9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegFlushKey
ret

Function at 0x419bd0
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e84
mov eax, dword [ebp - 8]
call fcn.00404e84
xor eax, eax
push ebp
push 0x419c5c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004085a4
mov eax, dword [ebp - 0xc]
call fcn.00408338
test al, al
jne 0x419c1f
mov eax, dword [ebp - 0xc]
call fcn.0040835c
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404e94
push eax
mov eax, dword [ebp - 4]
call fcn.00404e94
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419c63
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a18
ret

Function at 0x419f54
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e84
xor eax, eax
push ebp
push 0x41a02d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41857c]
call fcn.00418628
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41a010
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004186c8
xor eax, eax
push ebp
push 0x419fe8
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x41a044
mov eax, dword [ebp - 8]
call fcn.0041872c
test bl, bl
je 0x419fd3
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00418870
jmp 0x419fde
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00418850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x419ff2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a017
mov eax, dword [ebp - 8]
call fcn.00418698
mov eax, dword [ebp - 8]
call fcn.00403ca4
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40633c
pop dword [ebp - 0x3c]
mov eax, 0xe6e5ad7
add eax, 0xf1d20865
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xeb0d32a0
add dword [ebp - 0x4c], 0x634512ab
mov dword [ebp - 0x48], 0xae723dd1
add dword [ebp - 0x48], 0x83c10e74
mov dword [ebp - 0x44], 0x7c47045e
add dword [ebp - 0x44], 0xd0053fd0
mov dword [ebp - 0x40], 0xf95615b3
add dword [ebp - 0x40], 0x6a9ea4d
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x29e35c59
add dword [ebp - 0x4c], 0x4a8f0cfd
mov dword [ebp - 0x48], 0xa317ed93
add dword [ebp - 0x48], 0x9e5473e2
mov dword [ebp - 0x44], 0x3e1edf4
add dword [ebp - 0x44], 0x5f8d7e78
mov dword [ebp - 0x40], 0x1d201499
add dword [ebp - 0x40], 0xe2dfeb67
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xcbbaaa74
sub eax, 0xcb7a3974
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34029
push 0
call eax
mov ecx, 0x9a3b26e3
add ecx, 0x65c516ae
xor esi, esi
add esi, eax
mov edi, 0x77de7e3a
add edi, 0x886281c6
add edi, dword [ebp - 0x3c]
mov edx, 0xbe7a32b2
sub edx, 0x812ef6bd
xor dword [ebp - 0xc], 0xcd5b2d60
mov ebx, dword [edi]
add dword [ebp - 0x10], 0x77ea2581
sub ebx, edx
add dword [ebp - 0x28], 0x937827c2
mov dword [esi], ebx
xor dword [ebp - 4], ecx
add esi, 4
add edi, 0x65cb20e9
sub edi, 0x65cb20e5
loop 0x40645b
add eax, 0x6105935f
add eax, 0x9efb55b8
xor ebx, ebx
add ebx, eax
add eax, 0x2fb53016
sub eax, 0x2fb53011
mov ecx, 0x6d64abda
add ecx, 0x92db5426
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x10009590
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test byte [0x1008a028], 8
jne 0x100096a0
cmp dword [ebx + 0x28], 0x101
ja 0x100095f8
cmp esi, 0x7ff90003
je 0x100095d0
mov eax, 0x800a13a7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sym._to_jsdisp
test eax, eax
je 0x100095c0
mov edx, dword [eax + 0x20]
cmp dword [edx], 1
jne 0x100095c0
add dword [eax + 4], 1
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x10009614
lea eax, [ebp - 0x1c]
mov edx, edi
mov ecx, esi
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
mov eax, ebx
call sym._get_length
test eax, eax
js 0x100095c5
lea esi, [ebp - 0x16]
mov dword [esp + 0xc], 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
test eax, eax
je 0x100096d0
lea ecx, [eax - 1]
mov edx, eax
mov edi, 0x20
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x20]
mov word [ebp + ecx*2 - 0x16], di
xor ecx, ecx
mov word [ebp + eax*2 - 0x16], cx
mov eax, dword [ebp + 0x20]
mov dword [esp + 8], sym._to_locale_string
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, ebx
mov dword [esp], esi
call sym._array_join
mov ecx, dword [ebp - 0x20]
sub dword [ecx + 4], 1
jne 0x100095c5
mov dword [esp], ecx
mov dword [ebp - 0x24], eax
call sym._jsdisp_free
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x1008c18c
mov dword [esp + 8], str.Array_toLocaleString
mov dword [esp + 4], 0x1008a028
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x100095af
mov edi, 0x2c
mov edx, 2
mov ecx, 1
mov eax, 2
mov word [ebp - 0x16], di
jmp 0x10009647

Function at 0x100170a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
test byte [0x1008a068], 8
jne 0x100170d0
add esp, 0x14
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop ebp
jmp sym._create_utc_string.isra.0
mov dword [esp + 0xc], 0x1008d820
mov dword [esp + 8], str.Date_toUTCString
mov dword [esp + 4], 0x1008a068
mov dword [esp], 3
mov dword [ebp - 0xc], ecx
call sym._wine_dbg_log.constprop.0_3
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop ebp
jmp sym._create_utc_string.isra.0
Function at 0x10017110
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
test byte [0x1008a068], 8
jne 0x10017140
add esp, 0x14
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop ebp
jmp sym._create_utc_string.isra.0
mov dword [esp + 0xc], 0x1008d820
mov dword [esp + 8], str.Date_toGMTString
mov dword [esp + 4], 0x1008a068
mov dword [esp], 3
mov dword [ebp - 0xc], ecx
call sym._wine_dbg_log.constprop.0_3
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop ebp
jmp sym._create_utc_string.isra.0
Function at 0x1001ac40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
and esp, 0xfffffff8
sub esp, 8
movsd xmm0, qword [eax + 0x30]
movsd qword [esp], xmm0
call dword [sym.imp.ucrtbase.dll__dclass]
cmp ax, 2
je 0x1001ac78
lea esp, [ebp - 8]
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp sym._dateobj_to_date_string.part.0
test esi, esi
je 0x1001ac8a
call sym._jsstr_nan
mov dword [esi + 4], 0x7ff90004
mov dword [esi], eax
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret

Function at 0x1001aca0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
cmp dword [ebp + 0x10], 0x7ff90003
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
je 0x1001acc8
add esp, 4
mov eax, 0x800a138e
pop ebx
pop ebp
ret
mov dword [esp], eax
call sym._to_jsdisp
test eax, eax
je 0x1001acb6
mov edx, dword [eax + 0x20]
cmp dword [edx], 3
jne 0x1001acb6
add esp, 4
mov edx, ebx
pop ebx
pop ebp
jmp sym._dateobj_to_date_string
Function at 0x1001f500
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
and esp, 0xfffffff8
sub esp, 0x18
movsd xmm0, qword [eax + 0x30]
movsd qword [esp + 8], xmm0
call sym._daylight_saving_ta
pxor xmm1, xmm1
movsd xmm0, qword [esp + 8]
mov eax, ebx
cvtsi2sd xmm1, dword [ebx + 0x38]
fstp qword [esp + 0x10]
movsd xmm2, qword [esp + 0x10]
addsd xmm2, xmm1
movsd qword [esp], xmm1
mulsd xmm2, qword [0x1008e8e8]
subsd xmm0, xmm2
movsd qword [esp + 8], xmm0
call sym._daylight_saving_ta
movsd xmm1, qword [esp]
movsd xmm0, qword [esp + 8]
mov ecx, esi
fstp qword [esp + 0x10]
addsd xmm1, qword [esp + 0x10]
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
cvttsd2si edx, xmm1
jmp sym._date_to_string

Function at 0x1001f590
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x20]
test byte [0x1008a068], 8
jne 0x1001f5e8
cmp esi, 0x7ff90003
je 0x1001f5c0
add esp, 0x10
mov eax, 0x800a138e
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sym._to_jsdisp
test eax, eax
je 0x1001f5b3
mov edx, dword [eax + 0x20]
cmp dword [edx], 3
jne 0x1001f5b3
add esp, 0x10
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp sym._dateobj_to_string
mov dword [esp + 0xc], 0x1008d820
mov dword [esp + 8], str.Date_toString
mov dword [esp + 4], 0x1008a068
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1001f5ab
Function at 0x10028a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov ebx, dword [ebp + 0x10]
test byte [0x1008a0fc], 8
jne 0x10028b08
test ebx, 0xffffff0
je 0x10028a7e
test byte [0x1008a0fc], 1
jne 0x10028b50
mov eax, dword [ebp + 0xc]
and ebx, 8
mov dword [ebp - 0x18], ebx
movzx eax, word [eax]
test ax, ax
je 0x10028bc0
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
xor ebx, ebx
nop
mov dword [esp], eax
rol ebx, 4
add edi, 2
call esi
movzx eax, ax
xor ebx, eax
movzx eax, word [edi]
test ax, ax
jne 0x10028aa0
lea eax, [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call sym._find_prop_name
mov ebx, eax
test eax, eax
js 0x10028af9
mov eax, dword [ebp - 0x14]
xor ebx, ebx
test eax, eax
je 0x10028b80
cmp dword [eax + 8], 2
je 0x10028af9
test byte [eax + 0xd], 0x10
je 0x10028af9
lea edx, [ebp - 0x10]
call sym._delete_prop.part.0
add esp, 0x28
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x1008f1e2
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x1008f9ac
mov dword [esp + 4], 0x1008a0fc
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x10028a69
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Unsupported_grfdex__lx_n
mov dword [esp + 8], 0x1008f9ac
mov dword [esp + 4], 0x1008a0fc
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0_5
jmp 0x10028a7e
test byte [0x1008a0fc], 8
je 0x10028af9
mov dword [esp + 0xc], str.not_found_n
mov dword [esp + 8], 0x1008f9ac
mov dword [esp + 4], 0x1008a0fc
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_5
jmp 0x10028af9
xor ebx, ebx
jmp 0x10028ab8
Function at 0x10029160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov edx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x38
mov dword [ebp - 0x30], eax
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x10029213
mov dword [esp], edx
call eax
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10029213
mov dword [ebp - 0x2c], 0
mov esi, dword [sym.imp.ucrtbase.dll_towlower]
lea esi, [esi]
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x1008f232
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym._swprintf_1
movzx eax, word [ebp - 0x24]
test ax, ax
je 0x10029220
lea edi, [ebp - 0x24]
xor ebx, ebx
mov dword [esp], eax
rol ebx, 4
add edi, 2
call esi
movzx eax, ax
xor ebx, eax
movzx eax, word [edi]
test ax, ax
jne 0x100291d0
lea eax, [ebp - 0x28]
mov dword [esp], 0
lea ecx, [ebp - 0x24]
mov edx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
call sym._find_prop_name
test eax, eax
js 0x10029215
add dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x34], eax
jne 0x100291a0
xor eax, eax
add esp, 0x38
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
jmp 0x100291e8