joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4460
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4a44a9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4a4920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d66a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004a44d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004a4550
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004a4550
lea ecx, [esi + 0xc]
call fcn.004c7108
lea ecx, [esi + 0x10]
call fcn.004c7108
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004a5ae0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004a5ae0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004a5ae0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004c717d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004c717d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4ab720
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x348
push ebx
push esi
push edi
mov edi, ecx
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
lea eax, [esp + 0xc]
push 7
and esi, 0xffff
push eax
push 0x1004
push esi
call ebx
lea ecx, [esp + 0xc]
push ecx
call fcn.004b3838
add esp, 4
lea edx, [esp + 0x14c]
mov dword [edi + 4], eax
push 0x104
push edx
push 0x1002
push esi
call ebx
lea eax, [esp + 0x14c]
lea ecx, [edi + 0xc]
push eax
call fcn.004c72ba
lea ecx, [esp + 0xc]
push 7
push ecx
push 5
push esi
call ebx
lea edx, [esp + 0xc]
push edx
call fcn.004b3838
add esp, 4
mov dword [edi + 0x10], eax
lea eax, [esp + 0x3c]
push 0x64
push eax
push 0x1003
push esi
call ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [edi + 0x14]
call fcn.004c72ba
lea edx, [esp + 0x3c]
push 0x64
push edx
push 0x20
push esi
call ebx
lea eax, [esp + 0x3c]
lea ecx, [edi + 8]
push eax
call fcn.004c72ba
lea ecx, [esp + 0x14]
push 7
push ecx
push 0x14
push esi
call ebx
lea edx, [esp + 0x14]
lea ecx, [edi + 0x18]
push edx
call fcn.004c72ba
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea ecx, [esp + 0x250]
push 0x104
and eax, 0xffff
push ecx
push eax
call sub.VERSION.dll_VerLanguageNameA
cmp eax, 0x104
ja 0x4ab824
lea edx, [esp + 0x250]
lea ecx, [edi + 0x1c]
push edx
call fcn.004c72ba
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x4ab85f
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x1c]
push ecx
push 0x620de0
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [edi + 0x20]
push eax
call fcn.004c72ba
pop edi
pop esi
pop ebx
add esp, 0x348
ret

Function at 0x4c954b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c9583
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c75d8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c75b0
jmp 0x4c958f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4cac40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cac82
call fcn.004d09f4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4cac82
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4cac79
xor eax, eax
jmp 0x4cac8a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cac90
pop edi
pop esi
pop ebx
ret 4
Function at 0x4d0f24
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d0f52
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d0f70
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d0e8a
jmp 0x4d0f70
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d0f70
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d0e8a
test edi, edi
mov eax, edi
jne 0x4d0f5a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401b20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401b64
test esi, esi
je 0x401b64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b40
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401e74
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401dde
cmp eax, 4
jne 0x401e00
test esi, esi
je 0x401df2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401de4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401e3f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401e31
cmp ecx, 0x40
je 0x401df2
cmp ecx, 4
je 0x401df2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d50
lea esi, [esi]

Function at 0x8abe50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8abe5a
pushal
call 0x8abe60
pop ebp
sub ebp, 0x10
sub ebp, 0x3abe50
jmp 0x8abe76
mov eax, 0x3abe50
add eax, ebp
add eax, 0x4c
mov ecx, 0x608
mov edx, 0x82cebf31
xor byte [eax], dl
inc eax
dec ecx
jne 0x8abe8d
jmp 0x8abea0
mov edx, 0xdb8bafc
xor dword [ecx], esi
xor dword [eax + 0x3131c9f0], esi
xor dword [edx], esi
cld
mov dword [eax], edi
xor dword [ecx], esi
xor dword [ebx + 0x31313119], ecx
invalid
Function at 0x10624058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106241a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1062407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1062406a
add dl, dl
jne 0x10624089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106240dc
xor eax, eax
add dl, dl
jne 0x10624096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1062417d
add dl, dl
jne 0x106240a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106240b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106240bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106240c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106240d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10624075
mov eax, 1
add dl, dl
jne 0x106240ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106240f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106240e1
sub eax, ebx
mov ebx, 1
jne 0x10624128
mov ecx, 1
add dl, dl
jne 0x1062410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10624119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10624105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10624075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1062413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1062414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10624136
cmp eax, 0x7d00
jae 0x1062416d
cmp eax, 0x500
jb 0x10624168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10624075
cmp eax, 0x7f
ja 0x10624170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10624075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1062419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10624075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1002f6e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x1009ba87
call fcn.10094b6a
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10084ad6
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10084ad6
lea esi, [eax + 0x10]
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002f756
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push 0
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002f756
mov byte [ebp - 0xd], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
call fcn.10084b37
lea eax, [edi - 0x10]
call fcn.10084b37
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10084b37
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10084b37
mov al, byte [ebp - 0xd]
call fcn.10094c56
ret 0xc
Function at 0x10037c38
Capabilities:
Identify system language via api

Disassembly:
push 0x24
mov eax, 0x100a6179
call fcn.10094b6a
mov esi, ecx
push 0x10008730
lea eax, [ebp - 0x14]
push eax
call fcn.1005f361
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push esi
lea edi, [ebp - 0x14]
call fcn.1002d5ae
mov eax, dword [ebp - 0x10]
mov ebx, eax
mov dword [ebp - 0x30], ebx
test eax, eax
je 0x10037c7a
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x10037c90
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10084b37
mov eax, dword [ebx]
push ebx
call dword [eax + 0x28]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
call fcn.1002d7a7
jmp 0x10037d2f
push dword [ebp + 0xc]
lea edi, [ebp - 0x24]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 0x18], esp
call fcn.1002d400
call fcn.10037d6a
mov edx, eax
mov dword [ebp - 0x18], edx
cmp edx, 0xfffffffd
jne 0x10037ce1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
mov dword [ebp - 0x18], edx
test edx, edx
je 0x10037d12
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
xor edi, edi
test ecx, ecx
jle 0x10037cff
mov eax, dword [esi]
cmp dword [eax], edx
je 0x10037d02
inc edi
add eax, 4
cmp edi, ecx
jl 0x10037cf3
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x10037d12
lea ebx, [ebp - 0x18]
call fcn.1006b4f9
mov ebx, dword [ebp - 0x30]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10037d23
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
call fcn.1002d7a7
mov byte [ebp - 4], 3
cmp dword [ebp - 0x24], 0
setne al
test al, al
jne 0x10037cb3
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10037d53
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
call fcn.10094c56
ret 8
Function at 0x10059051
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 0x34
mov eax, 0x1009f4b7
call fcn.10094b6a
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [esi], 0x1001cd5c
lea edi, [esi + 8]
mov dword [ebp - 4], 1
push dword [edi]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x20], edi
call fcn.1005f361
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100590a7
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1001d3bc
xor ebx, ebx
mov eax, edi
call fcn.10084807
add esi, 0xc
push dword [esi]
lea eax, [ebp - 0x10]
push eax
call fcn.1005f361
mov byte [ebp - 4], 3
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10059188
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10059188
mov eax, dword [esi]
mov edi, dword [eax - 0xc]
lea eax, [edi + 1]
push eax
call fcn.100849b4
mov edx, eax
xor eax, eax
mov word [edx + edi*2 + 2], ax
push 6
pop ecx
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
and dword [ebp - 0x40], 0
and dword [ebp - 0x34], 0
mov eax, 0x414
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x38], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, eax
or eax, 0xffffffff
call fcn.1008472b
test edi, edi
je 0x10059177
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
mov byte [ebp - 4], 4
push dword [esi]
lea eax, [ebp - 0x14]
push 0x10011b28
push eax
call fcn.100847a7
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
add esp, 0x10
push edi
push 1
call dword [eax + 4]
lea eax, [edi - 0x10]
mov byte [ebp - 4], 3
call fcn.10084b37
push 0x1001d3bc
xor ebx, ebx
mov eax, esi
call fcn.10084807
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10084b37
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10084b37
mov eax, dword [esi]
sub eax, 0x10
call fcn.10084b37
mov eax, dword [edi]
sub eax, 0x10
call fcn.10084b37
call fcn.10094c56
ret

Function at 0x1005b131
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x18]
xor eax, eax
push eax
push eax
push eax
add esi, 0x10
push esi
call fcn.1002b0b1
test eax, eax
js 0x1005b15d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1005b15d
pop esi
jmp fcn.100845fb
pop esi
ret
Function at 0x1005bb83
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x100a371d
call fcn.10094b6a
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.1005f361
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.10028e20
mov eax, dword [eax]
push ebx
push 0x80
push 3
push 1
push SysReAllocStringLen
push eax
lea edi, [ebp - 0x2c]
call fcn.1002b029
mov edi, eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10084b37
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10084b37
cmp edi, ebx
jge 0x1005bc80
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.1005f361
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push 0x100121a0
push eax
call fcn.100847a7
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, 0xfffffff0
call fcn.10084b37
push dword [ebp - 0x14]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002b2a7
mov esi, 0x1001afc0
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.1002d336
mov dword [ebp - 0x34], esi
push 0x100aad5c
lea eax, [ebp - 0x34]
push eax
call fcn.1008e3d9
push ebx
lea eax, [ebp - 0x24]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x1005bca0
call fcn.100845fb
cmp byte [ebp - 0x10], 0xff
jne 0x1005bcc2
cmp byte [ebp - 0xf], 0xfe
jne 0x1005bcc2
cmp dword [ebp - 0x2c], ebx
je 0x1005bcba
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10094c56
ret 4
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x100121f0
push eax
call fcn.100847a7
mov eax, dword [esi]
add esp, 0xc
push dword [ebp - 0x14]
mov ecx, esi
push ebx
call dword [eax + 4]
push 0x1000593c
lea eax, [ebp + 8]
push eax
call fcn.1005f361
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.1002b306
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10084b37
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.1002d2f2
push 0x100aac28
lea eax, [ebp - 0x20]
jmp 0x1005bc7a
Function at 0x1005c159
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x100a36bd
call fcn.10094b6a
lea eax, [ebp - 0x14]
push eax
call fcn.10028c22
and dword [ebp - 4], 0
push 0x10012540
lea eax, [ebp - 0x1c]
push eax
lea edi, [ebp - 0x14]
call fcn.1005fcf3
push 0x100124f0
lea ecx, [ebp - 0x18]
push ecx
mov edi, eax
mov byte [ebp - 4], 1
call fcn.1005fcf3
push 0x10012490
lea ecx, [ebp - 0x10]
push ecx
mov edi, eax
mov byte [ebp - 4], 2
call fcn.1005fcf3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10084b37
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10084b37
push dword [ebp - 0x10]
mov eax, dword [esi]
push dword [ebp + 8]
mov ecx, esi
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10026b5d
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 6
call fcn.10026ee3
test al, al
jne 0x1005c216
push 0
push 0x10003658
lea eax, [ebp - 0x30]
push eax
call fcn.100266fe
test al, al
jne 0x1005c216
push 0x10
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x34]
call fcn.10026eb8
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10084b37
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10084b37
call fcn.10094c56
ret 4
Function at 0x1005e88a
Capabilities:
Accept command line arguments

Disassembly:
push 0xc4
mov eax, 0x1009f2f2
call fcn.10094bdd
mov ebx, 0x10003594
push ebx
lea eax, [ebp - 0xc4]
push eax
call fcn.1005f361
and dword [ebp - 4], 0
mov edi, 0x10012e54
push edi
lea eax, [ebp - 0xd0]
push eax
call fcn.1005f361
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc4]
push ebx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], esi
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
mov byte [ebp - 4], 2
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0xc0]
push 0x10012e7c
push eax
call fcn.100847a7
mov edi, dword [ebp - 0xc0]
mov eax, dword [esi]
add esp, 0xc
push edi
push 7
mov ecx, esi
call dword [eax + 4]
and dword [ebp - 0xbc], 0
push 0xa8
lea eax, [ebp - 0xb8]
push 0
push eax
call fcn.1008a7e0
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 1
jne 0x1005e960
lea eax, [ebp - 0xb8]
jmp 0x1005e968
cmp eax, 2
jne 0x1005e9b7
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xc0]
push 0x10012ea0
push eax
call fcn.100847a7
mov eax, dword [esi]
add esp, 0xc
push dword [ebp - 0xc0]
mov ecx, esi
push 7
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
lea eax, [ebp - 0xc0]
push 0x10012ebc
push eax
call fcn.100847a7
mov edi, dword [ebp - 0xc0]
mov eax, dword [esi]
add esp, 0xc
push edi
push 7
mov ecx, esi
call dword [eax + 4]
lea eax, [edi - 0x10]
call fcn.10084b37
lea eax, [ebp - 0xd0]
push eax
mov byte [ebp - 4], 0
call fcn.10026646
mov eax, dword [ebp - 0xc4]
add eax, 0xfffffff0
call fcn.10084b37
call fcn.10094c6f
ret
Function at 0x10078001
Capabilities:
Check if file exists

Disassembly:
push 0x54
mov eax, 0x100a09c9
call fcn.10094b6a
lea eax, [ebp - 0x10]
push eax
call fcn.10028b91
and dword [ebp - 4], 0
push 0x100189a0
lea eax, [ebp - 0x10]
call fcn.1005fec1
mov dword [ebp - 0x60], 0x100189b4
mov dword [ebp - 0x5c], 0x100189c8
mov dword [ebp - 0x58], 0x100189dc
mov dword [ebp - 0x54], 0x100189f0
mov dword [ebp - 0x50], 0x10018a04
mov dword [ebp - 0x4c], 0x10018a18
mov dword [ebp - 0x48], 0x10018a34
mov dword [ebp - 0x44], 0x10018a58
mov dword [ebp - 0x40], 0x10018a70
mov dword [ebp - 0x3c], 0x10018a88
mov dword [ebp - 0x38], 0x10018aa0
mov dword [ebp - 0x34], 0x10018ab8
mov dword [ebp - 0x30], 0x10018ad0
mov dword [ebp - 0x2c], 0x10018ae8
mov dword [ebp - 0x28], 0x10018b00
xor esi, esi
push dword [ebp + esi*4 - 0x60]
lea eax, [ebp - 0x10]
call fcn.1005fec1
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100780ca
lea eax, [ebp - 0x10]
call fcn.1005ffe4
inc esi
cmp esi, 0xf
jb 0x10078092
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10084b37
call fcn.10094c56
ret
mov eax, dword [0x100bcf90]
mov ecx, 0x100bcf90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10084ad6
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
push esi
lea eax, [ebp - 0x14]
push 0x10018b18
push eax
mov byte [ebp - 4], 2
call fcn.100847a7
add esp, 0xc
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.10084b37
push dword [ebp - 0x14]
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1002b2a7
mov esi, 0x1001afc0
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.1002d336
push 0x100aad5c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], esi
call fcn.1008e3d9
int3