joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bd60
Capabilities:
Query or enumerate registry value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, 8
cmp edi, eax
jae case.0x1001bd8f.76
lea eax, [edi - 0x43]
cmp eax, 0x12
ja case.0x1001bd8f.70
movzx ecx, byte [eax + 0x1001bfb4]
jmp dword [ecx*4 + 0x1001bf90]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne case.0x1001bd8f.70
push str.___._____:_
push 0x1003455f
push eax
push 0x1003455f
push str.HG_Util
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp - 8], 0xffffffff
inc edi
jmp 0x1001bd72
mov dword [ebp - 8], 0
inc edi
jmp 0x1001bd72
cmp dword [0x1004042c], 0
jne case.0x1001bd8f.70
mov ecx, dword [0x10040428]
push 0x34
push ecx
call fcn.1001bc10
add esp, 8
mov dword [0x1004042c], eax
test eax, eax
jne case.0x1001bd8f.70
push str.wflow_act_desc_ann_expanded
jmp 0x1001bf2a
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
test eax, eax
je 0x1001bf81
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete dl
mov byte [ebp - 4], dl
inc edi
jmp 0x1001bd72
xor esi, esi
cmp byte [0x1004040d], 0
jne 0x1001be61
push 0x10014730
call fcn.100289cc
add esp, 4
test eax, eax
je 0x1001be5a
push str.IGNORE_TOKEN_RING_ERRORS
jmp 0x1001bf2a
mov byte [0x1004040d], 1
cmp dword [0x10040428], esi
jne case.0x1001bd8f.70
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.1001cdd0
add esp, 0xc
mov dword [0x10040428], eax
test eax, eax
jne case.0x1001bd8f.70
push str.ConverterAgentDeploymentFault
jmp 0x1001bf2a
mov eax, 0xb4
cmp eax, 0xde30
ja case.0x1001bd8f.70
cmp eax, 0x6fcc
ja 0x1001bf66
je 0x1001bf59
cmp eax, 0xb4
je 0x1001bedc
cmp eax, 0x3840
jne 0x1001bf6d
fcom qword [esi - 0x52]
fidiv dword [edi + edi*4 + 0x45]
add byte [eax], al
add byte [0x378c], al
jmp 0x1001be9d
cmp dword [0x10040430], 0
jne 0x1001bf4a
mov edx, dword [0x1004042c]
push 0
push 0
push 0
push 0
push 0x67
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push edx
push 0
mov dword [ebp - 0xc], 0x100018c0
mov dword [ebp - 0x10], 0x10013410
call fcn.10016ce0
add esp, 0x30
mov dword [0x10040430], eax
test eax, eax
jne 0x1001bf4a
push str.msocbvcrognavcaptiontextmouseover
push 0x1003455f
push 0
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
mov esi, 6
add esp, 0x18
mov eax, 0xb4
add eax, 0x378c
jmp 0x1001be9d
mov dword [ebp - 4], esi
add eax, 0x378c
jmp 0x1001be9d
cmp eax, 0xa758
je case.0x1001bd8f.76
add eax, 0x378c
jmp 0x1001be9d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ce50
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
lea edx, [eax + 0xa]
push esi
mov ecx, eax
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], edx
cmp eax, edx
jae case.0x1001ce93.33
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x10]
jmp 0x1001ce80
lea eax, [ecx - 0x1e]
cmp eax, 0x17
ja case.0x1001ce93.34
movzx eax, byte [eax + 0x1001cff4]
jmp dword [eax*4 + 0x1001cfcc]
out 0xd3, al
xor byte [ecx], 0x33
test edi, edi
je case.0x1001ce93.34
movzx ecx, word [esi]
mov eax, dword [ebp + 0x10]
push 0
push ecx
lea edx, [esi + 4]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edi, eax
test edi, edi
je 0x1001cef2
mov edx, dword [esi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 0x10]
and edx, 0xffff
lea eax, [edx + esi + 4]
push eax
push 0
push 0
push 2
push ecx
mov dword [ebp - 4], 0x100
call dword [sym.imp.ADVAPI32.dll_CryptSignHashA]
mov dx, word [ebp - 4]
add word [esi], dx
mov edi, eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp case.0x1001ce93.34
push 0xc
call fcn.100279e1
add esp, 4
mov ebx, eax
jmp case.0x1001ce93.34
movzx ecx, byte [esi]
mov edx, dword [ebp + 8]
push 0
push ecx
push edx
call fcn.1001cdd0
add esp, 0xc
mov dword [ebp - 8], eax
jmp case.0x1001ce93.34
test ebx, ebx
jne 0x1001cf58
push str.Numeric_maximum_compatibility
push 0x1003455f
push ebx
push 0x1003455f
push str.HG_Util
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ebx
jmp case.0x1001ce93.34
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
push ecx
push 0x9e
mov dword [ebx], 0
mov dword [ebp - 0x10], 0
call fcn.100013a0
mov edx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 8], edx
jmp case.0x1001ce93.34
mov dword [ebp - 8], edi
jmp case.0x1001ce93.34
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0x800c
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, eax
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp - 0x14]
jb 0x1001ce80
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, 0x4572752d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001cf82
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
lea edx, [eax + 0xa]
push esi
mov ecx, eax
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], edx
cmp eax, edx
jae case.0x1001ce93.33
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x10]
jmp 0x1001ce80
lea eax, [ecx - 0x1e]
cmp eax, 0x17
ja case.0x1001ce93.34
movzx eax, byte [eax + 0x1001cff4]
jmp dword [eax*4 + 0x1001cfcc]
out 0xd3, al
xor byte [ecx], 0x33
test edi, edi
je case.0x1001ce93.34
movzx ecx, word [esi]
mov eax, dword [ebp + 0x10]
push 0
push ecx
lea edx, [esi + 4]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edi, eax
test edi, edi
je 0x1001cef2
mov edx, dword [esi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 0x10]
and edx, 0xffff
lea eax, [edx + esi + 4]
push eax
push 0
push 0
push 2
push ecx
mov dword [ebp - 4], 0x100
call dword [sym.imp.ADVAPI32.dll_CryptSignHashA]
mov dx, word [ebp - 4]
add word [esi], dx
mov edi, eax
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp case.0x1001ce93.34
push 0xc
call fcn.100279e1
add esp, 4
mov ebx, eax
jmp case.0x1001ce93.34
movzx ecx, byte [esi]
mov edx, dword [ebp + 8]
push 0
push ecx
push edx
call fcn.1001cdd0
add esp, 0xc
mov dword [ebp - 8], eax
jmp case.0x1001ce93.34
test ebx, ebx
jne 0x1001cf58
push str.Numeric_maximum_compatibility
push 0x1003455f
push ebx
push 0x1003455f
push str.HG_Util
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ebx
jmp case.0x1001ce93.34
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
push ecx
push 0x9e
mov dword [ebx], 0
mov dword [ebp - 0x10], 0
call fcn.100013a0
mov edx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 8], edx
jmp case.0x1001ce93.34
mov dword [ebp - 8], edi
jmp case.0x1001ce93.34
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0x800c
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, eax
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp - 0x14]
jb 0x1001ce80
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, 0x4572752d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001df60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
lea edx, [eax + 0x2ca]
push esi
mov ecx, eax
push edi
mov dword [ebp + 8], ecx
mov dword [ebp - 0x10], edx
cmp eax, edx
jae case.0x1001dfa5.160
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 8]
jmp 0x1001df90
lea eax, [ecx - 0x3a]
cmp eax, 0xee
ja case.0x1001dfa5.59
movzx eax, byte [eax + 0x1001e164]
jmp dword [eax*4 + 0x1001e144]
push 0
push ebx
push 0
push 0x3e
call fcn.1001d9c0
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp case.0x1001dfa5.59
mov dword [ebp - 4], 0
lea ebx, [ebx]
lea eax, [ebx + 0x18]
push eax
push 0
push 0x9f
call fcn.10021740
mov esi, eax
lea eax, [ebx + 4]
push eax
push 0
lea edi, [esi + 1]
and edi, dword [ebx + 0x24]
push 0x9f
call fcn.10021740
add esp, 0x18
cmp esi, eax
je 0x1001e04f
cmp byte [ebp + 0xb], 0
je 0x1001dfd0
jmp case.0x1001dfa5.59
lea ecx, [ebx + esi*4 + 0x28]
push ecx
push 0xcb
call fcn.1000dec0
mov dword [ebp - 4], edx
add esp, 8
mov dword [ebp - 4], eax
nop
lea eax, [ebx + 0x1c]
push eax
push 0
push 0x9f
call fcn.10021740
add esp, 0xc
cmp eax, esi
jne 0x1001e020
lea edx, [ebp + 8]
push edx
lea eax, [ebx + 0x1c]
push eax
push 0x9e
mov dword [ebp + 8], edi
call fcn.100013a0
add esp, 0xc
mov dword [ebp + 8], 0xaa
jmp case.0x1001dfa5.59
mov eax, dword [ebp + 0x10]
push ebx
push eax
push 0x9b
call fcn.100086f0
add esp, 0xc
test eax, eax
jns 0x1001e0e0
push str.netlookup
call fcn.1000c050
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, 0x66
mov dword [ebp + 8], ecx
cmp ecx, dword [ebp - 0x10]
jb 0x1001df90
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0x3a
mov dword [ebp + 8], esi
nop
cmp esi, 0x3a
je 0x1001e0b7
cmp esi, 0x9be
jne 0x1001e120
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x1001e113
mov esi, 0xa9
lea esp, [esp]
cmp esi, 0xa9
je 0x1001e0e9
cmp esi, 0x279c
jne 0x1001e102
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
push str.___clang_format_off
mov dword [ecx], eax
call fcn.1000c050
add esp, 4
add esi, 0x26f3
cmp esi, 0x4de6
jbe 0x1001e0d0
mov esi, dword [ebp + 8]
push str.netlookup_failed
call fcn.1000c050
add esp, 4
add esi, 0x984
mov dword [ebp + 8], esi
cmp esi, 0x1308
jbe 0x1001e0a0
push ds
or al, 0x2f
sti
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e780
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
lea ecx, [eax - 9]
push esi
push edi
mov ebx, eax
mov dword [ebp - 0xc], ecx
cmp eax, ecx
jbe case.0x1001e7b5.50
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x10]
lea eax, [ebx - 0x20]
cmp eax, 0x13
ja case.0x1001e7b5.34
movzx eax, byte [eax + 0x1001e8f8]
jmp dword [eax*4 + 0x1001e8d0]
xor esi, esi
jmp case.0x1001e7b5.34
mov eax, dword [edi]
dec eax
jne 0x1001e7df
mov ecx, dword [0x100403d8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0x100401a8], 3
mov ebx, 0x21
jmp case.0x1001e7b5.34
mov edx, dword [0x100403d8]
push 0x100401a4
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
jmp case.0x1001e7b5.34
add ebx, ebx
cld
idiv cl
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push edx
push 0xaa
push eax
mov dword [ebp + 0x10], ecx
lea ecx, [ebp + 0x10]
push edi
push ecx
call fcn.1000c260
add esp, 0x14
mov dword [ebp + 0x10], eax
jmp case.0x1001e7b5.34
test edi, edi
jne 0x1001e854
push str.ya.country_code
push 0x1003455f
push edi
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
lea esi, [edi + 3]
jmp 0x1001e8a5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push 0x45
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.1001e260
add esp, 0x14
mov esi, eax
jmp case.0x1001e7b5.34
test esi, esi
je case.0x1001e7b5.34
cmp esi, 2
je case.0x1001e7b5.34
push str.Could_not_trigger_callbacks
push 0x1003455f
push 0
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
add esp, 0x18
mov ebx, 0x27
dec ebx
cmp ebx, dword [ebp - 0xc]
ja 0x1001e7a2
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bh, cl
pushal
pop ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f730
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x1c]
push ebx
lea ecx, [eax - 6]
push esi
push edi
mov edi, eax
mov dword [ebp - 4], ecx
cmp eax, ecx
jbe 0x1001f819
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x1c]
jmp 0x1001f760
lea eax, [edi - 0xab]
cmp eax, 6
ja case.0x1001f76f.172
jmp dword [eax*4 + 0x1001f84c]
test esi, esi
je 0x1001f80a
push str.Could_not_lookup_address
push 0x1003455f
push 0
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
jmp 0x1001f807
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jne 0x1001f7ad
push str.NULL_callback
jmp 0x1001f7ea
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x1001f7bb
push str.NULL_lookup_name
jmp 0x1001f7ea
mov edx, dword [ebp + 0x14]
push 0xbf
push ebx
push edx
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x1c]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.1001f280
add esp, 0x18
mov esi, eax
jmp case.0x1001f76f.172
xor esi, esi
jmp case.0x1001f76f.172
test ebx, ebx
jne case.0x1001f76f.172
push str.LicensedLocales
push 0x1003455f
push 0
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
mov esi, 3
add esp, 0x18
mov edi, 0xae
dec edi
cmp edi, dword [ebp - 4]
ja 0x1001f760
mov eax, dword [ebp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
lea edx, [ebp - 8]
push edx
push 0x8004667e
push eax
mov dword [ebp - 8], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020480
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
lea edx, [eax - 0xa]
push esi
mov ecx, eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], edx
cmp eax, edx
jbe case.0x100204c3.34
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
jmp 0x100204b0
lea eax, [ecx - 0x22]
cmp eax, 0x18
ja case.0x100204c3.39
movzx eax, byte [eax + 0x1002062c]
jmp dword [eax*4 + 0x10020604]
mov dword [ebp + 0xc], esi
jmp case.0x100204c3.39
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx]
push eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov dword [ebp - 8], edx
push 0xe8
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
call fcn.10020080
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
je 0x10020508
push str.Cannot_read_context_LA_from_PRCB.
jmp 0x10020529
cmp dword [ebx], 1
jne 0x10020544
mov ecx, dword [ebp + 0x10]
push 0x65
push ecx
push 0
call fcn.1000dd30
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
je 0x10020544
push str.e_napraviti_novu_fasciklu_u_muzi
push 0x1003455f
push 0
push 0x1003455f
push 0x100345f0
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp - 8], 0x24
jmp case.0x100204c3.39
mov dword [ebp - 4], 0
jmp case.0x100204c3.39
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x80]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + 0x88]
sub ecx, eax
mov dword [ebp - 0x10], ecx
jmp case.0x100204c3.39
mov eax, dword [ebx]
xor esi, esi
test eax, eax
je case.0x100204c3.39
lea esp, [esp]
mov edx, dword [ebp - 0x14]
push 0
sub eax, esi
push eax
mov eax, dword [edi]
add edx, esi
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x100205ca
add esi, eax
mov eax, dword [ebx]
cmp esi, eax
jb 0x10020580
jmp case.0x100204c3.39
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
jmp case.0x100204c3.39
mov edx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
mov ecx, dword [ebp - 8]
dec ecx
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp - 0x18]
ja 0x100204b0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 0x99
lea edx, [ebp - 0x18]
push edx
push edi
mov dword [ebp - 0x18], 0
mov dword [ebp + 0xc], 1
call fcn.10026480
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023de0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
mov eax, dword [ebp + 8]
push ebx
push esi
lea ebx, [eax - 7]
mov esi, eax
push edi
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jbe 0x10023eea
mov edi, dword [ebp + 8]
jmp 0x10023e10
lea eax, [esi - 0xae]
cmp eax, 0xa
ja case.0x10023e1f.178
jmp dword [eax*4 + 0x10023f84]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc8]
test eax, eax
je case.0x10023e1f.178
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp case.0x10023e1f.178
les edi, [ebx - 0x39]
add dword [edx - 1], esi
adc eax, sym.imp.KERNEL32.dll_GetLastError
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x930], 4
jmp case.0x10023e1f.178
mov edx, dword [ebp + 0xc]
push 0
push 0x80
push 3
push 0
push 1
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
jmp case.0x10023e1f.178
mov dword [ebp - 4], 0
jmp case.0x10023e1f.178
mov eax, dword [ebp + 0x10]
push eax
push 0x3e
lea ecx, [ebp - 0x930]
push 0
push ecx
call fcn.10023b10
add esp, 0x10
mov dword [ebp - 8], eax
cmp edi, 0xffffffff
je case.0x10023e1f.178
mov ebx, 0xcc
lea esp, [esp]
mov eax, ebx
sub eax, 0xcc
je 0x10023ef4
dec eax
jne 0x10023ecf
push edi
mov ebx, 0xcd
mov dword [ebp + 8], 0xaf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 0xce
jb 0x10023eb0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
dec esi
mov dword [ebp + 8], esi
cmp esi, ebx
ja 0x10023e10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x930]
push edx
push 0x800
lea eax, [ebp - 0x92c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10023ecf
mov edx, dword [ebp + 0x10]
xor ecx, ecx
cmp dword [ebp - 0x930], ecx
push edx
sete cl
push 0x3e
lea eax, [ebp - 0x930]
push 0
push eax
mov esi, ecx
call fcn.10023b10
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
jne 0x10023ebc
test esi, esi
jne 0x10023ebc
push esi
lea ecx, [ebp - 0x930]
push ecx
push 0x800
lea edx, [ebp - 0x92c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10023f14
jmp 0x10023ecf
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023e26
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
mov eax, dword [ebp + 8]
push ebx
push esi
lea ebx, [eax - 7]
mov esi, eax
push edi
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jbe 0x10023eea
mov edi, dword [ebp + 8]
jmp 0x10023e10
lea eax, [esi - 0xae]
cmp eax, 0xa
ja case.0x10023e1f.178
jmp dword [eax*4 + 0x10023f84]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc8]
test eax, eax
je case.0x10023e1f.178
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp case.0x10023e1f.178
les edi, [ebx - 0x39]
add dword [edx - 1], esi
adc eax, sym.imp.KERNEL32.dll_GetLastError
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x930], 4
jmp case.0x10023e1f.178
mov edx, dword [ebp + 0xc]
push 0
push 0x80
push 3
push 0
push 1
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
jmp case.0x10023e1f.178
mov dword [ebp - 4], 0
jmp case.0x10023e1f.178
mov eax, dword [ebp + 0x10]
push eax
push 0x3e
lea ecx, [ebp - 0x930]
push 0
push ecx
call fcn.10023b10
add esp, 0x10
mov dword [ebp - 8], eax
cmp edi, 0xffffffff
je case.0x10023e1f.178
mov ebx, 0xcc
lea esp, [esp]
mov eax, ebx
sub eax, 0xcc
je 0x10023ef4
dec eax
jne 0x10023ecf
push edi
mov ebx, 0xcd
mov dword [ebp + 8], 0xaf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 0xce
jb 0x10023eb0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
dec esi
mov dword [ebp + 8], esi
cmp esi, ebx
ja 0x10023e10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x930]
push edx
push 0x800
lea eax, [ebp - 0x92c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10023ecf
mov edx, dword [ebp + 0x10]
xor ecx, ecx
cmp dword [ebp - 0x930], ecx
push edx
sete cl
push 0x3e
lea eax, [ebp - 0x930]
push 0
push eax
mov esi, ecx
call fcn.10023b10
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
jne 0x10023ebc
test esi, esi
jne 0x10023ebc
push esi
lea ecx, [ebp - 0x930]
push ecx
push 0x800
lea edx, [ebp - 0x92c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10023f14
jmp 0x10023ecf
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023e5f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
mov eax, dword [ebp + 8]
push ebx
push esi
lea ebx, [eax - 7]
mov esi, eax
push edi
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jbe 0x10023eea
mov edi, dword [ebp + 8]
jmp 0x10023e10
lea eax, [esi - 0xae]
cmp eax, 0xa
ja case.0x10023e1f.178
jmp dword [eax*4 + 0x10023f84]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc8]
test eax, eax
je case.0x10023e1f.178
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp case.0x10023e1f.178
les edi, [ebx - 0x39]
add dword [edx - 1], esi
adc eax, sym.imp.KERNEL32.dll_GetLastError
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x930], 4
jmp case.0x10023e1f.178
mov edx, dword [ebp + 0xc]
push 0
push 0x80
push 3
push 0
push 1
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
jmp case.0x10023e1f.178
mov dword [ebp - 4], 0
jmp case.0x10023e1f.178
mov eax, dword [ebp + 0x10]
push eax
push 0x3e
lea ecx, [ebp - 0x930]
push 0
push ecx
call fcn.10023b10
add esp, 0x10
mov dword [ebp - 8], eax
cmp edi, 0xffffffff
je case.0x10023e1f.178
mov ebx, 0xcc
lea esp, [esp]
mov eax, ebx
sub eax, 0xcc
je 0x10023ef4
dec eax
jne 0x10023ecf
push edi
mov ebx, 0xcd
mov dword [ebp + 8], 0xaf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 0xce
jb 0x10023eb0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
dec esi
mov dword [ebp + 8], esi
cmp esi, ebx
ja 0x10023e10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x930]
push edx
push 0x800
lea eax, [ebp - 0x92c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10023ecf
mov edx, dword [ebp + 0x10]
xor ecx, ecx
cmp dword [ebp - 0x930], ecx
push edx
sete cl
push 0x3e
lea eax, [ebp - 0x930]
push 0
push eax
mov esi, ecx
call fcn.10023b10
add esp, 0x10
mov dword [ebp - 8], eax
test eax, eax
jne 0x10023ebc
test esi, esi
jne 0x10023ebc
push esi
lea ecx, [ebp - 0x930]
push ecx
push 0x800
lea edx, [ebp - 0x92c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10023f14
jmp 0x10023ecf
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret