joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592429
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x652300]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x592469
cmp byte [ebx], 0xa
jne 0x592469
or byte [eax + edi + 0x28], 4
jmp 0x59246e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x59256c
mov al, byte [edx]
cmp al, 0x1a
je 0x59254e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x59249d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x5924c2
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x5924cc
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x59247f
jmp 0x59256c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x592549
cmp dword [ebp - 0xc], 0
je 0x592549
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x652300]
test byte [eax + edi + 0x28], 0x48
je 0x592523
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x59250e
mov byte [esi], dl
jmp 0x59251f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x652300]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x59256c
cmp byte [ebp - 1], 0xa
jne 0x592532
cmp esi, ebx
jne 0x592532
mov byte [esi], 0xa
jmp 0x59256b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.005932a4
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x59256c
mov byte [esi], 0xd
jmp 0x59256b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x652300]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x592568
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x59256c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x592575
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x652300]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5925b8
cmp word [esi], dx
jne 0x5925b8
or byte [edi + eax + 0x28], 4
jmp 0x5925bd
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x5926f6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x5926d6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x5925ff
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x592635
cmp eax, edx
jae 0x592641
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x5925d7
jmp 0x5926f6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5926d2
cmp dword [ebp - 0x14], 0
je 0x5926d2
mov eax, dword [ebx*4 + 0x652300]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x5926aa
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x5926f0
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x652300]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x652300]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x652300]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x5926f3
pop ebx
cmp word [ebp - 4], bx
jne 0x5926bb
cmp esi, dword [ebp + 0xc]
jne 0x5926bb
mov word [esi], bx
jmp 0x5926f3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.005932a4
add esp, 0x10
cmp word [ebp - 4], bx
je 0x5926f6
push 0xd
jmp 0x5926ef
mov ecx, dword [ebx*4 + 0x652300]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x5926ed
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x5926f6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x59872d
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x645300]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x598778
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00598b07
test al, al
jne 0x598772
sub edx, 2
cmp edx, edi
jne 0x598758
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x59879a
lea eax, [edi + 2]
cmp edx, eax
je 0x59879a
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005983f4
add esp, 0x10
jmp 0x598894
push esi
lea ecx, [ebp - 0x255]
call fcn.00598b07
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5987dd
push dword [ebp - 0x25c]
jmp 0x59878a
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x59881a
cmp word [ebp - 0x226], 0
je 0x59883b
cmp word [ebp - 0x226], ax
jne 0x59881a
cmp word [ebp - 0x224], 0
je 0x59883b
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.005983f4
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x598887
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x5987f4
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x59886f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x598894
push 0x597f13
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.005a48a0
add esp, 0x10
jmp 0x598864
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00543bb1
leave
ret
Function at 0x599c81
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x599d1e
push ebx
push esi
call fcn.00599c3d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00592098
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x599ccb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x599d1d
push edi
push eax
call fcn.0058f014
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x599ceb
call fcn.0058d7d0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x599d1c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00592098
add esp, 0x20
test eax, eax
jne 0x599d0a
push edi
call fcn.0058d7d0
jmp 0x599d12
push ebx
call fcn.0058d7d0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x599d21
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x599d32
pop esi
ret
push ebx
push edi
push esi
call fcn.00599c3d
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0058f014
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x599d5a
push ebx
push esi
push edi
call fcn.00546220
add esp, 0xc
push 0
call fcn.0058d7d0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x59a630
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00599fcd

Function at 0x59aa3f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059a913
Function at 0x5a638d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005a61ad
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x5a6505
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x5a6505
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5a64b4
jg 0x5a63e6
test eax, eax
je 0x5a64aa
push 1
push 0x1000
call fcn.0058d76d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5a640c
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x5a64a1
push 0x8000
push ebx
call fcn.0058b44b
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5a6438
jg 0x5a6433
cmp ecx, 0x1000
jb 0x5a6438
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00590224
add esp, 0x10
cmp eax, 0xffffffff
je 0x5a647d
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5a6433
jl 0x5a6464
test ecx, ecx
jne 0x5a6425
push dword [ebp - 0xc]
push ebx
call fcn.0058b44b
push esi
call fcn.0058d7d0
add esp, 0xc
xor edi, edi
jmp 0x5a6516
cmp byte [edi + 0x24], 0
je 0x5a6494
cmp dword [edi + 0x20], 5
jne 0x5a6494
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5a649f
mov edi, dword [edi + 0x18]
jmp 0x5a64a1
xor edi, edi
push esi
call fcn.0058d7d0
pop ecx
jmp 0x5a6516
test ecx, ecx
jg 0x5a6476
jl 0x5a64b4
test eax, eax
jae 0x5a6476
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005932a4
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5a64d7
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x5a6476
jmp 0x5a650e
push ebx
call fcn.0059ae71
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5a6476
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x5a6516
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x5a6513
mov edi, dword [edi + 0x18]
jmp 0x5a6516
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005932a4
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5a8a80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a8aad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a8aad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x13]
xor ebx, ebx
push 1
push eax
mov dword [esp + 0x1c], ebx
mov edi, 0xffff
mov dword [esp + 0x20], ebx
call ecx
add esp, 8
cmp ax, 1
jne 0x100014b5
mov ebp, dword [esp + 0x20]
jmp 0x10001344
mov ebx, dword [esp + 0x14]
lea eax, [ebx - 2]
cmp eax, 4
ja case.default.0x10001350
jmp dword [eax*4 + 0x100014f4]
mov bl, byte [esp + 0x13]
xor dl, dl
and bl, 0xf
mov ecx, 0x10047bb8
xor al, al
cmp al, bl
je 0x10001377
mov al, byte [ecx + 2]
add ecx, 2
inc dl
cmp al, 0xff
jne 0x10001367
mov byte [ebp], dl
cmp byte [ecx], 0xff
jne 0x10001386
inc dword [esi + 0x14]
mov byte [ebp], 8
cmp byte [ecx + 1], 0
je 0x100013a1
mov al, byte [esp + 0x13]
shr al, 5
and al, 3
cmp byte [esi + 0xd], al
je 0x100013a1
inc dword [esi + 0x10]
mov byte [ebp], 7
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x100013ae
call fcn.10030190
push 1
lea edx, [esp + 0x17]
push edx
push edi
call fcn.10008cd0
mov ebx, dword [esp + 0x20]
add esp, 0xc
movzx edi, ax
jmp case.default.0x10001350
push 1
lea eax, [esp + 0x17]
push eax
push edi
call fcn.10008cd0
add esp, 0xc
cmp byte [esp + 0x13], 0x10
movzx edi, ax
je 0x10001462
cmp dword [esp + 0x24], 0
je case.default.0x10001350
push 1
lea ecx, [esp + 0x17]
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.100300f0
cmp ax, 1
je case.default.0x10001350
inc dword [esi + 0x18]
pop edi
pop esi
mov byte [ebp], 5
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
cmp byte [esp + 0x13], 0x10
jne 0x10001438
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10001438
push 1
lea edx, [esp + 0x17]
push edx
call fcn.100300f0
cmp ax, 1
jne 0x10001401
push 1
lea eax, [esp + 0x17]
push eax
push edi
call fcn.10008cd0
add esp, 0xc
movzx edi, ax
jmp case.default.0x10001350
movzx cx, byte [esp + 0x13]
movzx edx, cx
mov dword [esp + 0x18], edx
mov al, byte [esp + 0x13]
cmp al, 0x10
jne 0x1000146c
movzx eax, byte [ebx*4 + 0x10047bcc]
jmp 0x10001498
cmp al, 2
jne 0x1000147e
movzx ecx, byte [ebx*4 + 0x10047bcd]
mov dword [esp + 0x14], ecx
jmp 0x1000149c
cmp al, 3
jne 0x10001490
movzx edx, byte [ebx*4 + 0x10047bce]
mov dword [esp + 0x14], edx
jmp 0x1000149c
movzx eax, byte [ebx*4 + 0x10047bcf]
mov dword [esp + 0x14], eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0x13]
push 1
push ecx
call edx
add esp, 8
cmp ax, 1
je 0x10001340
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
movzx ax, byte [esp + 0x13]
shl ax, 8
or ax, word [esp + 0x18]
mov ecx, 0xffff
xor ax, di
cmp ax, cx
je 0x100014e4
inc dword [esi + 0x1c]
mov byte [ebp], 6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
Function at 0x10001710
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x1003edbc
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x10059794]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10059794]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov eax, dword [esp + 0x14c]
xor ebp, ebp
lea ecx, [eax - 1]
xor esi, esi
mov dword [esp + 0x144], ebp
cmp ecx, 0xfe
ja 0x100017d2
push eax
lea edx, [esp + 0x18]
push str..COM_d
push edx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
push esi
call fcn.1002f460
add esp, 4
push ebp
lea ecx, [esp + 0x18]
lea esi, [ebx + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push esi
call fcn.1000f460
mov edx, dword [ebx]
add esp, 0xc
cmp eax, 0xffffffa6
mov eax, dword [edx + 0x6c]
mov ecx, ebx
jne 0x10001875
call eax
lea ecx, [esp + 0x14]
mov dword [ebx + 0x90], eax
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor eax, eax
jmp 0x100018d0
cmp eax, 0x100
jl 0x10001788
mov eax, dword [ebx]
mov edx, dword [eax + 0x6c]
mov ecx, ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call edx
mov dword [esp + 0x88], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
sub esp, 0x118
mov ecx, 0x46
lea esi, [esp + 0x140]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.1000db80
add esp, 0x120
test eax, eax
je 0x10001867
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x28]
push ecx
call sub.FHid.dll_HidGetRegisterdDevice
test eax, eax
je 0x1000185c
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
mov esi, 3
call dword [sym.imp.mfc90.dll_Ordinal_820]
jmp 0x10001788
push 0x10047c1c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor eax, eax
jmp 0x100018d0
mov dword [ebx + 0x168], ebp
call eax
push 0x10047bfd
push 0x65
push esi
mov esi, dword [sym.imp.MSVCR90.dll_strcpy_s]
mov dword [ebx + 0x90], eax
call esi
push 0x10047bfd
lea ecx, [ebx + 0xca]
push 0x32
push ecx
call esi
push 0x10047bfd
lea edx, [ebx + 0xfc]
push 0x32
push edx
call esi
mov eax, dword [ebx]
mov edx, dword [eax + 0x58]
add esp, 0x24
push 1
mov ecx, ebx
call edx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 1
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.1003dc2c
add esp, 0x134
ret 4
Function at 0x1000b690
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x1003fca0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10059794]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x10059794]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
push 5
lea eax, [esp + 0x34]
push eax
push 0xc
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esi + 0x264]
call dword [sym.imp.mfc90.dll_Ordinal_820]
cmp dword [esp + 0x58], 0
mov ecx, ebx
jne 0x1000b72c
push 0x1021
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x28]
call sub.mfc90.dll_Ordinal_403
push edi
lea edx, [esp + 0x24]
push edx
mov ecx, esi
mov dword [esp + 0x4c], 0
call dword [sym.imp.fv4_glas.dll_public:_int___thiscall_CGXGridCore::CopyTextToFile_class_CFile___class_CGXRange_const__]
lea ecx, [esp + 0x20]
jmp 0x1000b76e
push 0x3021
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
lea ecx, [esp + 0x18]
call sub.mfc90.dll_Ordinal_403
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x30]
push 2
push 0
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x50], 1
call edx
push edi
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call dword [sym.imp.fv4_glas.dll_public:_int___thiscall_CGXGridCore::CopyTextToFile_class_CFile___class_CGXRange_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0xffffffff
call sub.mfc90.dll_Ordinal_663
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1003dc2c
add esp, 0x38
ret
Function at 0x1000cb60
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x410
mov eax, dword [0x10059794]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push ebp
mov ebp, dword [0x10059b7c]
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp dword [0x10059bb4], 0x400
mov dword [esp + 0x18], ebx
jle 0x1000cba7
push str._n___________________nRequest_data_is_too_long_n_____________________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x10059bb4], 0x400
mov eax, dword [0x10059b7c]
mov byte [eax], bl
cmp dword [0x10059bb0], ebx
mov dword [esp + 0x14], ebx
jle 0x1000ccc3
mov edi, edi
lea ecx, [esp + 0x1c]
push 0x400
push ecx
call fcn.10030230
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x1000cc9c
add ebx, esi
cmp ebx, dword [0x10059b80]
mov dword [esp + 0x10], ebx
jg 0x1000cca3
mov ebx, dword [0x10059b94]
test ebx, ebx
je 0x1000cc49
cmp dword [esp + 0x14], 0
jne 0x1000cc49
cmp esi, 1
jl 0x1000cc49
mov edx, dword [0x10059b90]
test edx, edx
jne 0x1000cc1a
mov edx, 0x1004aed4
mov dword [0x10059b90], edx
mov ecx, dword [0x10059b8c]
test ecx, ecx
jne 0x1000cc2f
mov ecx, 0x10049e10
mov dword [0x10059b8c], ecx
cmp esi, 2
mov al, byte [esp + 0x1c]
jl 0x1000ccad
cmp byte [edx], al
jne 0x1000ccad
mov dl, byte [ecx]
cmp dl, byte [esp + 0x1d]
jne 0x1000ccad
mov edi, 2
mov eax, esi
sub eax, edi
push eax
lea ecx, [esp + edi + 0x20]
push ecx
push ebp
call sub.MSVCR90.dll_memcpy
mov edx, esi
sub edx, edi
add ebp, edx
add esp, 0xc
mov byte [ebp], 0
cmp dword [0x10059bd0], 3
jne 0x1000cc81
cmp esi, 1
jne 0x1000cc7b
cmp byte [esp + 0x1c], 4
je 0x1000ccbf
inc dword [0x10059bb0]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
inc eax
cmp eax, dword [0x10059bb0]
mov dword [esp + 0x14], eax
jl 0x1000cbc0
jmp 0x1000ccc3
mov eax, 0xffffff9c
jmp 0x1000cccf
mov dword [esp + 0x18], 0xffffffa2
jmp 0x1000ccc3
xor ecx, ecx
cmp byte [ebx], al
setne cl
dec ecx
and ecx, 5
add ecx, 0xffffffa2
mov dword [esp + 0x18], ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub ebx, edi
mov dword [0x10059bb0], ebx
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003dc2c
add esp, 0x410
ret

Function at 0x1000d060
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x10059bbc]
push ebx
xor ebx, ebx
push esi
mov esi, dword [0x10059b7c]
test eax, eax
jle 0x1000d091
push eax
push esi
mov ebx, eax
call fcn.1002f9d0
add esp, 8
test eax, eax
jne 0x1000d08b
pop esi
mov eax, 0xffffff9c
pop ebx
ret
add esi, dword [0x10059bbc]
push edi
xor edi, edi
cmp dword [0x10059bb0], edi
jle 0x1000d0c9
mov eax, dword [0x10059bb4]
add ebx, eax
cmp ebx, dword [0x10059b80]
jg 0x1000d0cf
push eax
push esi
call fcn.1002f9d0
add esp, 8
test eax, eax
je 0x1000d0d8
mov eax, dword [0x10059bb4]
inc edi
add esi, eax
cmp edi, dword [0x10059bb0]
jl 0x1000d0a1
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 0xffffffa2
pop ebx
ret
mov eax, dword [0x10059b84]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call esi
push str._failed_binary_read_n
call esi
pop edi
pop esi
mov eax, 0xffffff9c
pop ebx
ret
Function at 0x1000d810
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x1fc
mov eax, dword [0x10059794]
xor eax, esp
mov dword [esp + 0x1f8], eax
push esi
xor esi, esi
jmp 0x1000d830
lea eax, [esp + 4]
push 0x1f4
push eax
call fcn.1002f970
add esp, 8
test eax, eax
je 0x1000d940
inc esi
cmp esi, 0x14
jg 0x1000d95b
mov ecx, dword [0x10059b94]
push ecx
lea edx, [esp + 8]
push edx
call fcn.1000d1c0
add esp, 8
test eax, eax
je 0x1000d830
mov ecx, dword [0x10059b94]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1000d875
sub ecx, esi
push edi
lea edi, [ecx + eax]
mov eax, dword [0x10059b90]
mov ecx, eax
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1000d890
mov edx, dword [0x10059b98]
sub ecx, esi
lea esi, [edx + 1]
push ebx
mov bl, byte [edx]
inc edx
test bl, bl
jne 0x1000d8a3
sub edx, esi
lea esi, [eax + 1]
nop
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x1000d8b0
sub eax, esi
mov byte [eax + edi], bl
mov esi, dword [0x10059b90]
mov eax, edi
mov bl, byte [eax]
cmp bl, byte [esi]
jne 0x1000d8e4
test bl, bl
je 0x1000d8e0
mov bl, byte [eax + 1]
cmp bl, byte [esi + 1]
jne 0x1000d8e4
add eax, 2
add esi, 2
test bl, bl
jne 0x1000d8c4
xor eax, eax
jmp 0x1000d8e9
sbb eax, eax
sbb eax, 0xffffffff
pop ebx
test eax, eax
jne 0x1000d924
cmp dword [0x10059bb0], eax
jne 0x1000d90b
lea eax, [edx + ecx]
mov edx, dword [0x10059b7c]
add eax, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x1000d901
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.1003dc2c
add esp, 0x1fc
ret
pop edi
mov eax, 0xffffffa2
pop esi
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.1003dc2c
add esp, 0x1fc
ret
mov eax, 0xffffff9c
pop esi
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.1003dc2c
add esp, 0x1fc
ret
push 0x1004af58
mov esi, 0xffffff9c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x1fc]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003dc2c
add esp, 0x1fc
ret