joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454990
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4549c3
push esi
call fcn.00457a90
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4549bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x454a49
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x454a32
mov eax, dword [esi + 8]
test eax, eax
je 0x4549e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x454a2e
cmp eax, 2
je 0x454a32
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4549da
cmp eax, 3
je 0x454a0d
cmp eax, 1
jne 0x4549da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4549da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4549da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00454a70
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x454a58
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00454a70
add esp, 4
pop esi
ret

Function at 0x460b20
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x460bc3
test eax, eax
jbe 0x460bc3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x460bc3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x460b6e
xor esi, esi
jmp 0x460b74
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x460b9f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004644a0
add esi, eax
push esi
mov ebx, esi
call fcn.004644a0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x460b80
pop ebp
test edi, edi
pop edi
jne 0x460bc3
test ebx, ebx
je 0x460bc3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00473a00
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x460d05
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x460e1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x460e1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048540c
mov esi, eax
test esi, esi
je 0x460e1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x460e1d
mov ecx, esi
call fcn.00460c70
cmp edi, eax
jge 0x460e1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x460da3
mov dword [esp + 0x34], 1
jmp 0x460dfe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x460e1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004601c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4646c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x464726
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x464726
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x464707
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x465200
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x465249
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4656c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4946d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00465270
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004652f0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004652f0
lea ecx, [esi + 0xc]
call fcn.00483921
lea ecx, [esi + 0x10]
call fcn.00483921
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00466880
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00466880
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00466880
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00483996
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00483996
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x485db0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x485de8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00483e3d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00483e15
jmp 0x485df4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48749e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4874e0
call fcn.0048d270
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4874e0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4874d7
xor eax, eax
jmp 0x4874e8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004874ee
pop edi
pop esi
pop ebx
ret 4

Function at 0x48d7a0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48d7ce
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48d7ec
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048d706
jmp 0x48d7ec
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48d7ec
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048d706
test edi, edi
mov eax, edi
jne 0x48d7d6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000b3a0
Capabilities:
Delete file

Disassembly:
jmp 0x1002a6a0
sub esp, 0x218
mov eax, dword [0x1003ec70]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100433b4], 0
mov eax, dword [esp + 0x21c]
je 0x1002a6e2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1002b4aa
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1002a250
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1002a730
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1002a730
cmp dword [esp + 4], 0xffffffff
je 0x1002a730
push eax
call fcn.1002dbc2
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1002b4aa
add esp, 0x218
ret 4
Function at 0x1000bf00
Capabilities:
Read .ini file

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
xor ecx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ebp
mov word [eax], cx
push edi
mov byte [esp + 0x13], 0
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1000bf20
sub esi, ecx
sar esi, 1
lea ebx, [esi*2 + 1]
push ebx
call fcn.1000ae30
mov edi, eax
test edi, edi
je 0x1000bfbb
push 0
push 0
push ebx
push edi
lea eax, [esi + 1]
push eax
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [esp + 0x20]
lea ecx, [esi + 2]
mov edi, edi
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1000bf60
sub esi, ecx
sar esi, 1
lea ebp, [esi*2 + 1]
push ebp
call fcn.1000ae30
mov ebx, eax
test ebx, ebx
je 0x1000bfb5
push 0
push 0
push ebp
push ebx
lea eax, [esi + 1]
push eax
push dword [esp + 0x34]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x28]
inc eax
push eax
mov dword [esp + 0x20], eax
call fcn.1000ae30
mov ebp, eax
test ebp, ebp
jne 0x1000bfc6
push ebx
call fcn.1000afb0
push edi
call fcn.1000afb0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0x14
mov esi, dword [esp + 0x18]
lea ecx, [esi + 2]
lea ecx, [ecx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1000bfd0
sub esi, ecx
sar esi, 1
lea eax, [esi*2 + 1]
push eax
call fcn.1000ae30
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1000c011
push ebx
call fcn.1000afb0
push edi
call fcn.1000afb0
push ebp
call fcn.1000afb0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0x14
push 0
push 0
lea ecx, [esi*2 + 1]
push ecx
push eax
lea eax, [esi + 1]
push eax
push dword [esp + 0x2c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x13]
push esi
push dword [esp + 0x2c]
push ebp
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
mov dword [esp + 0x24], eax
call fcn.1000afb0
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c056
push dword [esp + 0x1c]
sub ecx, edx
push dword [esp + 0x28]
lea eax, [ecx + 1]
push eax
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
call fcn.1000afb0
push ebx
call fcn.1000afb0
push edi
call fcn.1000afb0
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x14
Function at 0x10019b20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x158
mov eax, dword [0x1003ec70]
xor eax, esp
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x160]
lea ecx, [esp + 0x10]
push esi
mov esi, dword [esp + 0x160]
push 0x41
push ecx
push 0x41
push eax
call fcn.10008d50
lea ecx, [esp + 0x14]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019b60
sub ecx, edx
cmp byte [esp + ecx + 0x13], 0x2e
jne 0x10019b7a
dec ecx
cmp ecx, 0x41
jae 0x10019bea
mov byte [esp + ecx + 0x14], al
push pe_nt_image_headers32
lea eax, [esp + 0x5c]
push eax
push pe_nt_image_headers32
push esi
call fcn.10008d50
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 4]
push 0x10001d9c
push 0x10
push eax
push 0x10001d7c
push 0
lea eax, [esp + 0x28]
push eax
call esi
lea eax, [esp + 0x58]
push eax
push 0x10
lea eax, [esp + 0xc]
push eax
push 0x10001d7c
push 0
lea eax, [esp + 0x28]
push eax
call esi
mov ecx, dword [esp + 0x158]
xor eax, eax
cmp byte [esp + 4], al
pop esi
setne al
xor ecx, esp
call fcn.1002b4aa
add esp, 0x158
ret 8
call fcn.1002bee3
int3

Function at 0x1001fc40
Capabilities:
Get file size

Disassembly:
cmp dword [esp + 0xc], 3
push esi
push edi
jne 0x1001fcac
mov edi, dword [esp + 0x10]
lea esi, [edi + 4]
push esi
push 0x12
push dword [esp + 0x14]
call fcn.1001d240
mov ecx, eax
test ecx, ecx
je 0x1001fc84
cmp ecx, 0xfffffffb
jne 0x1001fd00
push esi
push 0x10
push dword [esp + 0x14]
mov dword [edi + 8], 1
call fcn.1001d240
mov ecx, eax
test ecx, ecx
jne 0x1001fd00
push 0
push 2
push dword [esi]
call fcn.1001d440
lea ecx, [edi + 0x14]
push ecx
push dword [esi]
call fcn.1001d220
push 0
push 0
push dword [esi]
call fcn.1001d440
pop edi
xor eax, eax
pop esi
ret 0xc
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push esi
push 0x12
push edi
call fcn.1000b760
mov ecx, eax
test ecx, ecx
je 0x1001fcde
cmp ecx, 0xfffffffb
jne 0x1001fd00
push esi
push 0x10
push edi
mov dword [esi + 8], 1
call fcn.1000b760
mov ecx, eax
test ecx, ecx
jne 0x1001fd00
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
jne 0x1001fca5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, 0xfffffbf8
pop esi
ret 0xc
cmp ecx, 0xfffffffc
jne 0x1001fd0f
pop edi
mov eax, 0xfffff8f1
pop esi
ret 0xc
cmp ecx, 0xfffffffe
jne 0x1001fd1e
pop edi
mov eax, 0xfffff8ed
pop esi
ret 0xc
cmp ecx, 0xfffffffd
mov eax, 0xfffffbf8
mov edx, 0xfffffc01
pop edi
cmove eax, edx
pop esi
ret 0xc
Function at 0x10020680
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1018
call fcn.1002c970
mov eax, dword [0x1003ec70]
xor eax, esp
mov dword [esp + 0x1014], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1028]
mov eax, 4
push edi
mov edi, dword [esp + 0x1030]
mov ebp, dword [esi + 0x20c]
add esi, 0x210
mov dword [esp + 0x18], ebp
mov ecx, dword [esi + 0x14]
cmp edi, 0xd698
je 0x100206cf
mov eax, 2
cmp ecx, eax
push 0
cmovg ecx, eax
mov eax, dword [esi + 0x14]
push 0
sub eax, ecx
mov dword [esp + 0x18], ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100208a3
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100208aa
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
jne 0x100208aa
push dword [esi + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea eax, [esi + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push edi
call fcn.10029280
test eax, eax
jne 0x100208aa
mov eax, dword [esp + 0x10]
movzx eax, word [esi + eax*2 + 0x22]
cmp eax, 0xa
je 0x1002075e
cmp eax, 0xd
je 0x1002075e
xor ebx, ebx
jmp 0x10020763
mov ebx, 1
push 0x1000
push dword [esi + 0x14]
call fcn.1002d1a4
add esp, 8
shl eax, 0xc
mov dword [esp + 0x20], edx
mov dword [esi + 0x2080], eax
push 0
push 0
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100208a3
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0x2080]
push eax
lea eax, [esp + 0x30]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100208aa
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0x2080]
cmp dword [esp + 0x14], eax
jne 0x100208aa
push dword [esi + 0x10]
xor eax, eax
mov ecx, 0x1000
cmp edi, 0xd698
cmove eax, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push edi
call fcn.10029280
test eax, eax
jne 0x100208aa
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2084], ecx
test ebx, ebx
jne 0x100208ad
mov dword [esi + 0x202c], ebx
lea ebx, [ebp + 0x44]
push eax
push dword [ebx]
add ebp, 0x3a
push ebp
push esi
call fcn.10020440
test eax, eax
js 0x100208ad
push 0
push edi
push esi
call fcn.10020c00
test eax, eax
js 0x100208ad
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x28]
push eax
push ebx
push ebp
push edi
call fcn.100291b0
test eax, eax
js 0x100208ad
mov eax, dword [esp + 0x10]
mov ebx, 1
add dword [esi + 0x14], eax
push 0x1000
push dword [esi + 0x14]
call fcn.1002d1a4
add esp, 8
shl eax, 0xc
mov dword [esi + 0x2080], eax
mov dword [esp + 0x20], edx
push 0
push 0
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [esp + 0x18]
cmp eax, 0xffffffff
jne 0x10020796
mov eax, 0xfffffc02
jmp 0x100208ad
or eax, 0xffffffff
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002b4aa
add esp, 0x1018
ret 8
Function at 0x100208d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 1
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10020925
push 0
lea eax, [esp + 0x20]
mov dword [esi + 0x2080], ebp
push eax
push 0x1000
lea ebx, [esi + 0x2ce4]
mov dword [esi + 0x2ca4], 0
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020934
mov dword [esi + 0x2ca4], eax
or ebx, 0xffffffff
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 8
mov edi, dword [esp + 0x1c]
cmp edi, 0x1000
jae 0x1002094a
mov dword [esi + 0x2ca4], 1
test edi, edi
jne 0x1002095f
pop edi
pop esi
mov ebx, 0xfffff9bd
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 8
cmp dword [esp + 0x20], 0xd698
jne 0x100209a9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
push eax
push ebx
call fcn.100223d0
mov ebx, eax
test ebx, ebx
jne 0x10020928
mov ebx, dword [esp + 0x10]
cmp ebx, edi
je 0x100209a9
push 1
push eax
mov eax, ebx
sub eax, edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10020925
mov edi, ebx
mov dword [esi + 0x2080], ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], 0x1000
test ebp, ebp
jne 0x100209c1
mov dword [esi + 0x2ccc], ebp
mov dword [esi + 0x2cd0], ebp
mov ecx, dword [esi + 0x2cd0]
test ecx, ecx
je 0x100209d1
add edi, ecx
mov dword [esp + 0x1c], edi
mov eax, dword [esi + 0x2ccc]
lea edx, [esi + 0x2ccc]
mov dword [esi + 0x2cb4], eax
mov dword [esi + 0x2cb8], ecx
test ecx, ecx
je 0x100209fd
movdqu xmm0, xmmword [esi + 0x2cd4]
movdqu xmmword [esi + 0x2cbc], xmm0
push dword [esi + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, esi
sub eax, ecx
add eax, 0x2ce4
push eax
push edx
push dword [esp + 0x38]
call fcn.10029280
sub edi, dword [esp + 0x1c]
mov ebx, eax
mov dword [esi + 0x2cd0], edi
je 0x10020a4b
mov ecx, esi
sub ecx, edi
push edi
lea eax, [ecx + 0x3ce4]
push eax
lea eax, [ecx + 0x2ce4]
push eax
call fcn.1002b6f0
add esp, 0xc
test ebx, ebx
jne 0x10020925
mov eax, dword [esp + 0x14]
mov dword [esi + 0x2028], eax
cmp eax, 0x1000
jae 0x10020a6c
mov dword [esi + 0x20a8], eax
jmp 0x10020a76
mov dword [esi + 0x20a8], 0xffffffff
cmp dword [esi + 0x2024], 0
jne 0x10020928
push 0x2000
call fcn.1000ae30
mov dword [esi + 0x2024], eax
test eax, eax
jne 0x10020aa8
pop edi
pop esi
mov ebx, 0xfffffc0d
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 8
pop edi
mov dword [esi + 0x2030], 0x1000
mov eax, ebx
mov dword [esi + 0x20a8], 0xffffffff
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10020c00
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x202c]
lea ebp, [edi + 0x202c]
shl eax, 3
push eax
mov dword [esp + 0x10], eax
call fcn.1000ae30
mov ebx, eax
test ebx, ebx
jne 0x10020c33
pop edi
pop ebp
mov eax, 0xfffffc0d
pop ebx
pop ecx
ret 0xc
push esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
push dword [edi + 0x2024]
push dword [esp + 0x2c]
call fcn.100291b0
mov esi, eax
test esi, esi
js 0x10020cf4
cmp dword [esp + 0x1c], 0x4b0
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x10020c8c
cmp dword [esp + 0x20], 0
je 0x10020c8c
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
push 0x10002a30
push dword [edi]
call eax
test eax, eax
je 0x10020cef
cmp dword [esp + 0x18], 2
jne 0x10020cef
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x18]
push ebx
push dword [edi]
call eax
test eax, eax
je 0x10020cef
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
jne 0x10020cef
mov eax, dword [ebp]
push 1
push 0
push 0
push dword [edi]
mov dword [edi + 0x2084], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10020cdc
push ebx
mov dword [edi + 0x2080], eax
call fcn.1000afb0
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
or esi, 0xffffffff
call fcn.1000afb0
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
mov esi, 0xfffffc02
push ebx
call fcn.1000afb0
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x100299a0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x104
mov eax, dword [0x1003ec70]
xor eax, esp
mov dword [esp + 0x100], eax
push ebp
mov ebp, dword [esp + 0x110]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x118]
push 0xff
push eax
push 0x1004
push dword [esp + 0x11c]
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100299fb
lea eax, [esp + 8]
push eax
call fcn.1002ca4d
add esp, 4
mov dword [ebp], eax
push 0xff
lea eax, [esp + 0xc]
mov dword [esi], 0
push eax
push 0xb
push dword [esp + 0x11c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10029a2d
lea eax, [esp + 8]
push eax
call fcn.1002ca4d
add esp, 4
mov dword [esi], eax
mov ecx, dword [esp + 0x108]
xor eax, eax
pop esi
pop ebp
xor ecx, esp
call fcn.1002b4aa
add esp, 0x104
ret 0xc

Function at 0x1002a4e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x1003ec70]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100433b4], 0
mov eax, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x224]
je 0x1002a52c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1002b4aa
add esp, 0x218
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1002a250
cmp dword [esp + 0x214], 0x104
jl 0x1002a564
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1002a571
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1002a596
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1002a596
cmp dword [esp + 4], 0xffffffff
je 0x1002a596
push edx
call fcn.1002dbc2
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1002b4aa
add esp, 0x218
ret 8

Function at 0x1002a6a0
Capabilities:
Delete file

Disassembly:
jmp 0x1002a6a0
sub esp, 0x218
mov eax, dword [0x1003ec70]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100433b4], 0
mov eax, dword [esp + 0x21c]
je 0x1002a6e2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1002b4aa
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1002a250
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1002a730
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1002a730
cmp dword [esp + 4], 0xffffffff
je 0x1002a730
push eax
call fcn.1002dbc2
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1002b4aa
add esp, 0x218
ret 4