joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002d150
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.1002d150
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1002d150
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x5069d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xda000]
push edi
jmp 0x5069ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5069f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5069e0
mov eax, 1
add ebx, ebx
jne 0x506a03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x506a14
jne 0x506a33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x506a33
dec eax
add ebx, ebx
jne 0x506a20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5069f8
add ebx, ebx
jne 0x506a2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x506a85
xor ecx, ecx
sub eax, 3
jb 0x506a4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x506aba
sar eax, 1
mov ebp, eax
jmp 0x506a56
add ebx, ebx
jne 0x506a56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x506a24
inc ecx
add ebx, ebx
jne 0x506a64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x506a24
add ebx, ebx
jne 0x506a71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x506a66
jne 0x506a82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x506a66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x506aa4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x506a96
jmp 0x5069e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x506aa4
add edi, ecx
jmp 0x5069e6
pop esi
mov edi, esi
mov ecx, 0x5ee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x506ac2
cmp byte [edi], 5
jne 0x506ac2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x506ac7
lea edi, [esi + 0x104000]
mov eax, dword [edi]
or eax, eax
je 0x506b3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14c190]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14c1cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x506af4
mov ecx, edi
jns 0x506b23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14c1d4]
or eax, eax
je 0x506b39
mov dword [ebx], eax
add ebx, 4
jmp 0x506b11
call dword [esi + 0x14c1d0]
mov ebp, dword [esi + 0x14c1d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x506b73
sub esp, 0xffffff80
jmp 0x403ff8
Function at 0x10003310
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x220
push ebx
push esi
push edi
mov eax, dword [esp + 0x234]
bt dword [eax + 0x10], 6
mov edx, dword [esp + 0x234]
mov ebx, dword [edx + 0x18]
sbb ecx, ecx
neg ecx
mov esi, dword [esp + 0x234]
mov byte [esp + 0x228], cl
add esi, 0x1c
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x234]
mov edx, dword [eax + 0x10]
test edx, 0x40
mov esi, 0xf0
jne 0x10003375
mov esi, 0xc0
test edx, 1
jne 0x10003375
mov esi, 0xd8
push esi
call dword [sym.imp.GDI32.DLL_CreateSolidBrush]
mov dword [esp + 0x20], eax
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 0xf
push 5
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawEdge]
push 0x100
lea edx, [esp + 0x2c]
push edx
mov edi, dword [esp + 0x23c]
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 1
push ebx
call dword [sym.imp.GDI32.DLL_SetBkMode]
push 0xffffff
push ebx
call dword [sym.imp.GDI32.DLL_SetTextColor]
push dword [esp + 0x20]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push 0x1003f198
push 0
push 0
push 0
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1a
call dword [sym.imp.GDI32.DLL_CreateFontW]
mov dword [esp + 0x24], eax
push eax
push ebx
call dword [sym.imp.GDI32.DLL_SelectObject]
push 0x25
lea esi, [esp + 0x14]
push esi
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
cmp byte [esp + 0x228], 0
je 0x1000344e
push 0x4e
call dword [sym.imp.GDI32.DLL_CreateSolidBrush]
mov esi, eax
push eax
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.DLL_DeleteObject]
push dword [esp + 0x24]
call dword [sym.imp.GDI32.DLL_DeleteObject]
pop edi
pop esi
pop ebx
add esp, 0x220
ret

Function at 0x10003521
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
test eax, eax
je 0x10003591
lea ecx, [esp + 8]
push ecx
push 0x1003f1a8
push 0
call dword [sym.imp.ADVAPI32.DLL_LookupPrivilegeValueW]
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.DLL_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10003591
push 0x70000
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x10003597
add esp, 0x14
xor eax, eax
ret
add esp, 0x14
mov eax, 1
ret
Function at 0x1002c4c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x58]
push ebx
push ebp
push esi
mov esi, ecx
mov edx, dword [esi + 0x50]
push edi
mov dword [esi + 0x54], eax
cmp edx, dword [esi + 0x4c]
jbe 0x1002c50c
mov edi, dword [esi + 0x50]
mov ebx, dword [esi + 0x4c]
mov ebp, dword [esi + 0x44]
cmp edi, ebx
jne 0x1002c4f0
mov edx, ebp
jmp 0x1002c507
mov edx, edi
sub edx, ebx
push edx
push ebx
push ebp
call fcn.10007650
mov ecx, edi
mov edx, eax
sub ecx, ebx
add esp, 0xc
add edx, ecx
mov dword [esi + 0x50], edx
jmp 0x1002c512
mov ebx, dword [esi + 0x44]
mov dword [esi + 0x50], ebx
lea eax, [esi + 0x58]
lea ebp, [esi + 0x24]
mov dword [esp + 0x28], eax
mov edx, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
sub edx, ecx
push edx
push ecx
mov ecx, ebp
call fcn.1002cbcc
mov ebx, eax
test eax, eax
jg 0x1002c540
pop edi
mov eax, 0xffffffff
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
add dword [esi + 0x50], ebx
mov edi, dword [esi + 0x70]
mov edx, dword [esp + 0x28]
mov ecx, dword [edx]
mov dword [esp + 0x24], ecx
lea edx, [esp + 0x20]
push edx
push dword [esi + 0x40]
push dword [esi + 0x3c]
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
push dword [esi + 0x50]
push dword [esi + 0x44]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [edi]
call dword [edx + 8]
cmp eax, 3
jne 0x1002c581
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ebx, 2
cmp eax, ebx
je 0x1002c5d0
mov eax, dword [esi + 0x3c]
cmp eax, dword [esp + 0x20]
je 0x1002c59c
mov edi, dword [esi + 0x44]
cmp edi, dword [esp + 0x1c]
je 0x1002c5d0
cmp byte [esi + 0x34], 0
je 0x1002c5be
mov ecx, dword [esp + 0x20]
sub ecx, eax
test ecx, ecx
jns 0x1002c5ad
inc ecx
sar ecx, 1
imul ecx, dword [esi + 0x74]
mov edx, dword [esp + 0x1c]
sub edx, dword [esi + 0x44]
cmp ecx, edx
jne 0x1002c5d0
cmp eax, dword [esp + 0x20]
jne 0x1002c5df
mov ebx, dword [esp + 0x1c]
sub ebx, dword [esi + 0x44]
cmp ebx, dword [esi + 0x78]
jl 0x1002c5df
mov ecx, esi
call fcn.1002c4a8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
cmp eax, dword [esp + 0x20]
je 0x1002c51c
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x4c], edi
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ebx, dword [esp + 0x18]
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov ax, word [eax]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x1002c9d0
Capabilities:
Get file size

Disassembly:
push eax
push eax
lea eax, [esp + 4]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x1002c9f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1002c9f7
xor eax, eax
jmp 0x1002c9fa
mov eax, dword [esp]
add esp, 8
ret
Function at 0x1002ca84
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
mov edx, ecx
xor eax, eax
mov dword [esp + 4], ecx
mov dword [ecx], 0xffffffff
mov byte [edx + 0xc], al
mov dword [edx + 8], 0
mov byte [edx + 0xd], al
cmp dword [0x1004ca44], eax
jne 0x1002cac7
mov dword [esp + 4], edx
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0xc]
mov dword [0x1004ca44], edx
mov edx, dword [esp + 4]
mov dword [edx + 4], 0
cmp dword [0x1004ca44], 0
jne 0x1002cae1
mov dword [0x1004ca44], 0x1000
add esp, 0x2c
mov eax, edx
ret

Function at 0x1002cbcc
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test dword [edi + 8], 4
jne 0x1002cc9e
cmp dword [esp + 0x10], 0
je 0x1002cc9e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
lea ebp, [edx + ecx - 1]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x20]
cmp ebp, ecx
jb 0x1002cc7e
cmp byte [ecx], 0x1a
je 0x1002cc7e
cmp byte [ebx], 0xd
je 0x1002cc2d
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
jmp 0x1002cc74
cmp ebx, ebp
jae 0x1002cc39
cmp byte [ebx + 1], 0xa
jne 0x1002cc70
jmp 0x1002cc74
mov byte [esp + 0x14], 0x20
push 0
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x20]
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], 0
je 0x1002cc69
push 1
push 0
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esp + 0x14], 0xa
je 0x1002cc74
mov byte [esi], 0xd
inc esi
inc ebx
cmp ebx, ebp
ja 0x1002cc7e
cmp byte [ebx], 0x1a
jne 0x1002cc21
cmp ebx, ebp
ja 0x1002cc94
push 1
lea edx, [ebp + 1]
sub edx, ebx
push 0
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
sub eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x1002ccac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, 1
sub esp, 0x1000
test dword [esp], esp
dec edx
jne 0x1002ccb4
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1030], ecx
test dword [esi + 8], 1
je 0x1002cce2
push 4
mov ecx, esi
push 0
call fcn.1002ce58
test dword [esi + 8], 4
je 0x1002cd0d
push 0
lea edx, [ebp - 0x102c]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebp - 0x102c]
jmp 0x1002ce24
mov dword [ebp - 0x1030], esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ecx, [edx + ecx]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x1028]
mov dword [ebp - 0x24], ecx
mov ecx, 0x1000
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp + 0xc]
jge 0x1002cd3a
lea ecx, [ebp - 0x1c]
jmp 0x1002cd3d
lea ecx, [ebp + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
mov dword [ebp - 0x20], ecx
jle 0x1002cdc4
push dword [ebp - 0x20]
push 0xa
push edx
call fcn.1003bca0
add esp, 0xc
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1002cdc4
mov edi, dword [ebp - 0x18]
sub edi, esi
push edi
push esi
push ebx
call fcn.10007650
lea edx, [edi + 1]
add ebx, edi
mov byte [ebx], 0xd
inc ebx
add esi, edx
mov byte [ebx], 0xa
mov ecx, dword [ebp - 0x24]
sub ecx, esi
xor edx, edx
inc ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc], ecx
sub eax, ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
add esp, 0xc
cmp edx, eax
jge 0x1002cd98
lea edx, [ebp - 0x10]
jmp 0x1002cd9b
lea edx, [ebp - 0x14]
mov eax, dword [edx]
cmp eax, ecx
jge 0x1002cda3
jmp 0x1002cda6
lea edx, [ebp - 0xc]
mov ecx, dword [edx]
test ecx, ecx
mov dword [ebp - 0x20], ecx
jle 0x1002cdc4
push dword [ebp - 0x20]
push 0xa
push esi
call fcn.1003bca0
add esp, 0xc
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x1002cd5b
mov edi, dword [ebp - 0x20]
test edi, edi
jle 0x1002cdda
push edi
push esi
push ebx
call fcn.10007650
add ebx, edi
add esi, edi
add esp, 0xc
lea edx, [ebp - 0x1028]
mov edi, ebx
sub edi, edx
mov dword [ebp - 8], edx
je 0x1002ce19
push 0
lea ecx, [ebp - 4]
push ecx
push edi
mov edx, dword [ebp - 0x1030]
push dword [ebp - 8]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], edi
je 0x1002ce19
cmp dword [ebp - 4], 0
je 0x1002ce4b
sub edi, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add dword [ebp - 8], ecx
test edi, edi
jne 0x1002cde9
mov ebx, esi
mov esi, dword [ebp - 0x1030]
sub ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], ebx
jne 0x1002ce37
pop edi
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
jle 0x1002ce4b
cmp ebx, dword [ebp + 0xc]
jge 0x1002ce4b
sub dword [ebp + 0xc], ebx
add dword [ebp + 8], ebx
jmp 0x1002ccce
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002cf00
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x1002cf75
push edi
mov eax, dword [esp + 0x1c]
mov edx, eax
mov dword [esp + 0x10], eax
sar edx, 0x1f
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
xor edx, edx
push eax
mov eax, dword [esp + 0x14]
push ecx
push 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test eax, eax
je 0x1002cf68
push 1
mov edx, dword [esp + 0x1c]
lea ecx, [edx + edi]
push ecx
mov ecx, esi
call fcn.1002ce58
test eax, eax
jns 0x1002cf77
push edi
mov ecx, esi
push ebx
call fcn.1002cf84
xor ebx, ebx
jmp 0x1002cf77
xor ebx, ebx
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x1002ef00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
xor eax, eax
push 0x1002ef8c
push edx
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov dword [ebp - 0x18], ecx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
lea ecx, [ecx + 0x20]
call fcn.1001aed8
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
xor edx, edx
mov dword [ebx + 0x24], edx
lea ecx, [ebx + 0x48]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
call fcn.1002f7c8
mov dword [ebp - 4], 1
mov eax, ebx
mov dword [ebx], 0x100506f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003a728
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, 1
push esi
push edi
cmp dword [0x10063804], 0
jne 0x1003a77a
push 0
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test eax, eax
je 0x1003a780
push esi
call fcn.1000884c
add esp, 4
mov edi, eax
test eax, eax
je 0x1003a780
push esi
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1003a780
mov ecx, dword [esp + 0x18]
mov dword [ecx], edi
pop edi
mov eax, ebx
pop esi
pop ebx
ret
mov dword [0x10063804], 1
xor ebx, ebx
jmp 0x1003a77a
Function at 0x1003a790
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
push ebx
mov ebx, 1
push esi
push edi
cmp dword [0x10063804], 0
jne 0x1003a840
push 0x10
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1003a849
mov dword [esp + 0x10], ebx
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x14], ecx
mov edx, 1
cmp dword [0x1003fb74], edx
jle 0x1003a7fc
push 4
mov al, byte [esp + ebx + 0x20]
mov byte [esp + 0x1c], al
and eax, 0xff
push eax
call fcn.100072a8
add esp, 8
test eax, eax
je 0x1003a832
jmp 0x1003a818
mov cl, byte [esp + ebx + 0x1c]
mov esi, dword [0x1003fbfc]
mov byte [esp + 0x18], cl
and ecx, 0xff
test word [esi + ecx*2], 4
je 0x1003a832
mov edi, dword [esp + 0x14]
movzx edx, byte [esp + 0x18]
lea eax, [edi + edi*4]
lea eax, [edx + eax*2 - 0x30]
inc ebx
cmp ebx, 0x10
mov dword [esp + 0x14], eax
jb 0x1003a7d1
mov esi, dword [esp + 0x38]
mov cl, byte [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov byte [esi], cl
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x20
ret
mov dword [0x10063804], 1
xor ebx, ebx
jmp 0x1003a840

Function at 0x1003a858
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, 1
push esi
cmp dword [0x10063804], 0
jne 0x1003a8f4
push 0x10
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1003a8fc
mov dword [esp + 0xc], ebx
xor esi, esi
xor ebx, ebx
mov ecx, 1
cmp dword [0x1003fb74], ecx
jle 0x1003a8bc
push 4
mov dl, byte [esp + ebx + 0x18]
mov byte [esp + 0x14], dl
and edx, 0xff
push edx
call fcn.100072a8
add esp, 8
test eax, eax
je 0x1003a8ea
jmp 0x1003a8d8
mov dl, byte [esp + ebx + 0x14]
mov ecx, dword [0x1003fbfc]
mov byte [esp + 0x10], dl
and edx, 0xff
test word [ecx + edx*2], 4
je 0x1003a8ea
movzx edx, byte [esp + 0x10]
lea esi, [esi + esi*4]
inc ebx
lea esi, [edx + esi*2 - 0x30]
cmp ebx, 0x10
jb 0x1003a890
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0xc]
mov dword [ecx], esi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
mov dword [0x10063804], 1
xor ebx, ebx
jmp 0x1003a8f4