joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e300
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x1004e453
call fcn.1003b167
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1000e140
add esp, 4
test eax, eax
jne 0x1000e34d
mov dword [ebp - 0xc], 9
jmp 0x1000e3bb
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1000e3bb
mov dword [ebp - 4], 0
jmp 0x1000e367
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x1000e3bb
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e3b9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.1000dfb0
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e35e
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1000e3d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x1004e453
call fcn.1003b167
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1000e44e
mov dword [ebp - 4], 0
jmp 0x1000e3fa
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1000e43a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e438
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000e3f1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x1004d14c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esp, ebp
pop ebp
ret
Function at 0x1000e460
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1004a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1004e453
call fcn.1003b167
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1004d4d0]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1000e4b8
mov eax, dword [ebp - 0x10]
sub eax, 5
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000e4da
mov eax, 0xa
jmp 0x1000e5c1
cmp dword [ebp + 0xc], 0
je 0x1000e526
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x10]
add ecx, 5
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 0xc]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x1000e524
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x1c]
mov byte [edx + 1], 0xf9
jmp 0x1000e562
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1000e54d
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.100214a0
add esp, 0xc
jmp 0x1000e562
push 5
mov edx, dword [ebp - 0xc]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.100214a0
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 0xc]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x14], cl
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001da46
mov esp, ebp
pop ebp
ret
Function at 0x1000ecd0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1004e453
call fcn.1003b167
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1000ed23
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x1000ed23
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x1000ed23
xor eax, eax
jmp 0x1000ed64
mov dword [ebp - 4], 1
jmp 0x1000ed35
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000ed5f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1000ed5d
xor eax, eax
jmp 0x1000ed64
jmp 0x1000ed2c
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10012120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov ecx, 0x1004f3b4
call fcn.1003b167
mov byte [ebp - 0x48], 0x41
mov byte [ebp - 0x47], 0x80
mov byte [ebp - 0x46], 0x8b
mov byte [ebp - 0x45], 0x82
mov byte [ebp - 0x44], 0x83
mov byte [ebp - 0x43], 0x45
mov byte [ebp - 0x42], 0x84
mov byte [ebp - 0x41], 0x88
mov byte [ebp - 0x40], 0x85
mov byte [ebp - 0x3f], 0x85
mov byte [ebp - 0x3e], 0x4b
mov byte [ebp - 0x3d], 0x87
mov byte [ebp - 0x3c], 0x4d
mov byte [ebp - 0x3b], 0x48
mov byte [ebp - 0x3a], 0x4f
mov byte [ebp - 0x39], 0x8c
mov byte [ebp - 0x38], 0x50
mov byte [ebp - 0x37], 0x43
mov byte [ebp - 0x36], 0x8f
mov byte [ebp - 0x35], 0x59
mov byte [ebp - 0x34], 0x81
mov byte [ebp - 0x33], 0x58
mov byte [ebp - 0x32], 0x89
mov byte [ebp - 0x31], 0x8d
mov byte [ebp - 0x30], 0x8e
mov byte [ebp - 0x2f], 0x8a
mov byte [ebp - 0x2e], 0x90
mov byte [ebp - 0x2d], 0x91
mov byte [ebp - 0x2c], 0x92
mov byte [ebp - 0x2b], 0x93
mov byte [ebp - 0x2a], 0x94
mov byte [ebp - 0x29], 0x95
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x97
mov byte [ebp - 0x26], 0xa2
mov byte [ebp - 0x25], 0x99
mov byte [ebp - 0x24], 0x9a
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x9b
mov byte [ebp - 0x21], 0x9f
mov byte [ebp - 0x20], 0x9c
mov byte [ebp - 0x1f], 0x9d
mov byte [ebp - 0x1e], 0x6b
mov byte [ebp - 0x1d], 0x9e
mov byte [ebp - 0x1c], 0xaf
mov byte [ebp - 0x1b], 0xae
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0xa3
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0xa6
mov byte [ebp - 0x15], 0x79
mov byte [ebp - 0x14], 0x81
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0x89
mov byte [ebp - 0x11], 0xa4
mov byte [ebp - 0x10], 0xa5
mov byte [ebp - 0xf], 0xa1
mov byte [ebp - 0xe], 0xa7
mov byte [ebp - 0xd], 0xa8
mov byte [ebp - 0xc], 0xa9
mov byte [ebp - 0xb], 0xaa
mov byte [ebp - 0xa], 0xab
mov byte [ebp - 9], 0xac
mov dword [ebp - 8], 0
jmp 0x10012242
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jae 0x100122c4
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0xb8
jne 0x10012267
mov byte [ebp - 1], 0xe5
jmp 0x10012277
movzx edx, byte [ebp - 1]
cmp edx, 0xa8
jne 0x10012277
mov byte [ebp - 1], 0xc5
movzx eax, byte [ebp - 1]
cmp eax, 0xc0
jl 0x1001229e
movzx ecx, byte [ebp - 1]
cmp ecx, 0xff
jg 0x1001229e
movzx edx, byte [ebp - 1]
mov al, byte [ebp + edx - 0x108]
mov byte [ebp - 1], al
jmp 0x100122b4
movzx ecx, byte [ebp - 1]
cmp ecx, 0x20
jl 0x100122b0
movzx edx, byte [ebp - 1]
cmp edx, 0x7e
jle 0x100122b4
mov byte [ebp - 1], 0x3f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [eax], cl
jmp 0x10012239
mov esp, ebp
pop ebp
ret
Function at 0x100132a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1004e7ac
call fcn.1003b167
mov dword [ebp - 4], 0
jmp 0x100132c0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jae 0x100132e3
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
imul ecx, dword [ebp + 8], 0x1000193
mov dword [ebp + 8], ecx
jmp 0x100132b7
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1001ffe9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x1002000a
jl 0x10020001
test edi, edi
jne 0x1002000a
xor eax, eax
xor edx, edx
jmp 0x100200cb
cmp dword [ebx + 0x38], 0
je 0x1002001f
push eax
push edi
push dword [ebp + 8]
call fcn.100200d1
jmp 0x100200cb
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10020066
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10020066
cmp eax, edi
jb 0x10020040
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.100214a0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x1002006c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x100200c0
mov ecx, ebx
call fcn.1001f716
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x100200ab
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10028671
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x100200c0
jmp 0x1002007e
test edx, edx
je 0x100200c0
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10028671
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x100272be
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100272fd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100272fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100272fd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100272fd
cmp dword [ecx + 0x74], 0xe
jbe 0x100272fd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1002cfc0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10041028
push 0x10041020
push str.FlsAlloc
push 0x1f
call fcn.1002ce88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002cff4
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003d188]
call esi
jmp 0x1002cffa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1002d03e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10041038
push 0x10041030
push str.FlsGetValue
push 0x21
call fcn.1002ce88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002d075
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003d188]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002d07d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10041040
push 0x10041038
push str.FlsSetValue
push 0x22
call fcn.1002ce88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002d0b7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003d188]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10030087
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10030124
push ebx
push esi
call fcn.10030050
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002ffe4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100300d1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10030123
push edi
push eax
call fcn.1002d65c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100300f1
call fcn.1002cba9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10030122
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002ffe4
add esp, 0x20
test eax, eax
jne 0x10030110
push edi
call fcn.1002cba9
jmp 0x10030118
push ebx
call fcn.1002cba9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10031945
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1003ae40
mov eax, dword [0x1004a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1002e55c
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10031987
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10031ae3
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1003acd0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1004cde8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100326ea
mov ecx, dword [esi*4 + 0x1004cde8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10031adc
cmp eax, dword [ecx + edi + 0x24]
jne 0x10031adc
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10031adc
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100326ea
add esp, 0x14
test edx, edx
jl 0x10031adc
jg 0x10031a52
test eax, eax
jb 0x10031adc
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10031adc
jl 0x10031a6c
cmp dword [ebp - 0x1008], eax
ja 0x10031adc
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10031a8a
test ebx, ebx
je 0x10031ac3
cmp ecx, edi
jae 0x10031ac3
mov al, byte [ecx]
cmp al, 0xd
jne 0x10031aa4
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10031ab0
cmp byte [ecx + 1], 0xa
jne 0x10031ab0
inc ecx
jmp 0x10031ab0
movzx eax, al
movsx eax, byte [eax + 0x1004a820]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10031a8a
cmp edx, ebx
jne 0x10031a8a
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10031ae1
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001da46
leave
ret
Function at 0x10031b82
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1004cde8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10031bc2
cmp byte [ebx], 0xa
jne 0x10031bc2
or byte [edi + eax + 0x28], 4
jmp 0x10031bc7
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10031cc6
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10031ca9
inc eax
cmp dl, 0xd
je 0x10031bf3
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10031c19
cmp eax, ecx
jae 0x10031c27
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10031bdb
jmp 0x10031cc6
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10031ca4
cmp dword [ebp - 0x10], 0
je 0x10031ca4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1004cde8]
test byte [eax + edi + 0x28], 0x48
je 0x10031c7e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10031c69
mov byte [esi], dl
jmp 0x10031c7a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1004cde8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10031cc6
cmp byte [ebp - 1], 0xa
jne 0x10031c8d
cmp esi, ebx
jne 0x10031c8d
mov byte [esi], 0xa
jmp 0x10031cc5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10032708
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10031cc6
mov byte [esi], 0xd
jmp 0x10031cc5
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1004cde8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10031cc3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10031cc6
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10031ccf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1004cde8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10031d15
cmp word [ebx], dx
jne 0x10031d15
or byte [eax + edi + 0x28], 4
jmp 0x10031d1a
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10031e7d
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10031e5d
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10031d5b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10031d91
cmp eax, edx
jae 0x10031d9f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10031d36
jmp 0x10031e7d
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10031e58
cmp dword [ebp - 0x18], 0
je 0x10031e58
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1004cde8]
test byte [eax + edi + 0x28], 0x48
je 0x10031e2e
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10031df2
mov word [esi], cx
jmp 0x10031e29
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1004cde8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1004cde8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1004cde8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10031e7d
pop eax
cmp word [ebp - 4], ax
jne 0x10031e3e
cmp esi, ebx
jne 0x10031e3e
mov word [esi], ax
jmp 0x10031e7a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10032708
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10031e7d
push 0xd
pop eax
jmp 0x10031e39
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1004cde8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10031e77
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10031e7d
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100361fb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1002b19c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1003626a
cmp esi, dword [ebp - 4]
je 0x10036265
cmp dword [ebp + 0xc], 0
je 0x10036265
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10036242
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10035d4d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1003626c
xor eax, eax
inc eax
jmp 0x1003626c
xor eax, eax
pop edi
pop esi
leave
ret