joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e230
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.100535d0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x1005e262
mov dword [esp + 0x2c], 0
jmp 0x1005e27d
mov ecx, ebp
call fcn.100535d0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.100535d0
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.100535e0
cmp eax, esi
jae 0x1005e2bd
mov ecx, ebp
call fcn.100535e0
mov dword [esp + 0x10], eax
jmp 0x1005e2c1
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.10053400
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x1005e32d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x1005e328
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.100547f0
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x1005e31b
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.10054c60
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x1005e2e8
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x1005e2d6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x1008e3c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov al, byte [edi + 0xe48]
test al, al
jne 0x1008e3dd
push edi
call fcn.1008e420
add esp, 4
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
jle 0x1008e414
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor edx, edx
mov ebx, esi
mov dl, byte [eax + ebp]
and ebx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edi + edx*4 + 0xa48]
xor esi, edx
inc eax
cmp eax, ecx
jl 0x1008e3ed
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret

Function at 0x1008e420
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor ecx, ecx
lea edx, [edi + 0xa48]
mov eax, ecx
mov esi, 8
test al, 1
je 0x1008e442
shr eax, 1
xor eax, 0xedb88320
jmp 0x1008e444
shr eax, 1
dec esi
jne 0x1008e435
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x100
jl 0x1008e42e
mov byte [edi + 0xe48], 1
pop edi
pop esi
ret
Function at 0x100b3ea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
test eax, eax
je 0x100b3f45
mov eax, dword [esp + 0x14]
mov ecx, 0x101927fc
imul eax, eax, 0x2e90edd
inc eax
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x1019280c
jl 0x100b3eb6
mov eax, dword [0x10192804]
mov esi, dword [0x101927fc]
mov ecx, dword [0x10192808]
xor eax, esi
shr eax, 0x1f
lea edx, [ecx + ecx]
or eax, edx
mov dword [0x10192808], eax
mov eax, 0x10192800
mov ecx, dword [eax - 4]
mov edx, dword [eax + 4]
mov esi, dword [eax]
xor ecx, edx
mov edx, dword [eax + 8]
add eax, 4
xor edx, esi
shl ecx, 1
shr edx, 0x1f
or ecx, edx
cmp eax, 0x101929ec
mov dword [eax + 8], ecx
jl 0x100b3eef
mov esi, dword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [0x10192798], ecx
mov eax, dword [ecx*4 + 0x101927fc]
push eax
call esi
mov ecx, dword [0x10192798]
mov dword [ecx*4 + 0x101927fc], eax
inc ecx
cmp ecx, 0x7f
mov dword [0x10192798], ecx
jb 0x100b3f20
jmp 0x100b3f4b
mov ecx, dword [0x10192798]
mov eax, dword [esp + 0xc]
mov edx, eax
dec eax
test edx, edx
je 0x100b3fa2
mov edx, dword [esp + 8]
push ebx
push edi
lea esi, [eax + 1]
lea eax, [ecx - 0x3f]
lea edi, [ecx + 1]
and eax, 0x7f
and edi, 0x7f
and ecx, 0x7f
add edx, 4
mov eax, dword [eax*4 + 0x101927fc]
mov ebx, dword [edi*4 + 0x101927fc]
xor eax, ebx
mov dword [ecx*4 + 0x101927fc], eax
mov ecx, dword [edx - 4]
xor ecx, eax
mov dword [edx - 4], ecx
mov ecx, dword [0x10192798]
inc ecx
dec esi
mov dword [0x10192798], ecx
jne 0x100b3f5f
pop edi
pop ebx
pop esi
ret
Function at 0x100b82f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x400b8
call fcn.1002f510
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x100b8322
push str.AHD_interpolation..._n
push 0x1016ee30
call fcn.10030c0b
add esp, 8
xor edi, edi
lea ebx, [esp + 0xc4]
mov dword [esp + 0x10], edi
Function at 0x100bd7d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
mov edx, dword [esi + 4]
mov ax, word [esi + 0x6244]
mov ecx, dword [esi]
push ebp
push edi
push edx
mov dword [esp + 0x18], ebp
mov word [esp + 0x24], ax
call dword [ecx + 8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push ecx
call dword [eax + 0x1c]
add esp, 0x10
test eax, eax
jne 0x100bd9b2
mov eax, dword [esi + 4]
mov edx, dword [esi]
push eax
call dword [edx + 0x1c]
add esp, 4
sub eax, 0x4d
jne 0x100bd9b2
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push edx
call dword [ecx + 0x1c]
add esp, 4
sub eax, 0x52
jne 0x100bd9b2
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push ecx
call dword [eax + 0x1c]
mov edx, eax
push esi
shl edx, 8
add edx, eax
mov word [esi + 0x6244], dx
call fcn.100ab8e0
mov ecx, dword [esi + 4]
lea edi, [eax + edi + 8]
mov eax, dword [esi]
push ecx
mov dword [esp + 0x30], edi
call dword [eax + 0x18]
add esp, 0xc
cmp eax, edi
mov dword [esp + 0x20], eax
jge 0x100bd993
push ebx
xor edi, edi
mov ebx, 4
mov eax, dword [esi + 4]
mov edx, dword [esi]
push eax
call dword [edx + 0x1c]
shl edi, 8
add esp, 4
or edi, eax
dec ebx
jne 0x100bd87e
push esi
call fcn.100ab8e0
add esp, 4
cmp edi, 0x505244
mov dword [esp + 0x18], eax
je 0x100bd930
cmp edi, 0x545457
je 0x100bd911
cmp edi, 0x574247
jne 0x100bd95e
push esi
call fcn.100ab8e0
lea ecx, [esi + 0x6495]
push str.A200
push ecx
call fcn.1002ff40
mov ebx, eax
add esp, 0xc
neg ebx
sbb ebx, ebx
and ebx, 3
xor edi, edi
push esi
call fcn.100ab840
mov edx, edi
and eax, 0xffff
sar edx, 1
mov dword [esp + 0x18], eax
xor edx, edi
fild dword [esp + 0x18]
add esp, 4
xor edx, ebx
inc edi
fstp dword [esi + edx*4 + 0xe6bc]
cmp edi, 4
jl 0x100bd8e4
jmp 0x100bd95e
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push ecx
call dword [eax + 0x18]
push eax
push esi
call fcn.100bd1e0
mov edx, dword [esp + 0x34]
add esp, 0xc
mov dword [esi + 0x658c], edx
jmp 0x100bd95e
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push 1
push 8
push ecx
call dword [eax + 8]
push esi
call fcn.100ab840
mov bp, ax
push esi
and ebp, 0xffff
call fcn.100ab840
add esp, 0x14
and eax, 0xffff
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
push 0
lea eax, [ecx + eax + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [edx + 8]
mov eax, dword [esi + 4]
mov edx, dword [esi]
push eax
call dword [edx + 0x18]
mov ecx, dword [esp + 0x38]
add esp, 0x10
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x100bd877
pop ebx
mov cx, word [esp + 0xc]
mov dx, word [esp + 0x18]
mov word [esi + 0x65f8], bp
mov word [esi + 0x65fa], cx
mov word [esi + 0x6244], dx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x100bee70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
push ecx
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edx
call dword [eax + 8]
push esi
call fcn.100ab8e0
add esp, 0x10
cmp eax, 0xff
ja 0x100befc4
mov ecx, eax
dec eax
test ecx, ecx
je 0x100befac
push ebx
inc eax
push ebp
push edi
mov dword [esp + 0x14], eax
push esi
call fcn.100ab840
mov di, ax
push esi
and edi, 0xffff
call fcn.100ab840
mov edx, dword [esi]
mov bx, ax
mov eax, dword [esi + 4]
and ebx, 0xffff
push eax
call dword [edx + 0x18]
add esp, 0xc
cmp edi, 0x100
mov ebp, eax
jne 0x100bef02
push esi
call fcn.100ab840
push esi
mov word [esi + 0x65f8], ax
call fcn.100ab840
add esp, 8
mov word [esi + 0x65fa], ax
jmp 0x100bef89
cmp edi, 0x121
jne 0x100bef38
push esi
call fcn.100ab840
push esi
mov word [esi + 0x65fc], ax
call fcn.100ab840
add esp, 8
cmp ax, 0x10bc
mov word [esi + 0x65fe], ax
jne 0x100bef89
mov word [esi + 0x65fe], 0x10bf
jmp 0x100bef89
cmp edi, 0x130
jne 0x100bef57
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push edx
call dword [ecx + 0x1c]
add esp, 4
sar eax, 7
mov dword [esi + 0x65b0], eax
jmp 0x100bef89
cmp edi, 0x2ff0
jne 0x100bef89
xor edi, edi
push esi
call fcn.100ab840
and eax, 0xffff
add esp, 4
mov dword [esp + 0x18], eax
mov eax, edi
fild dword [esp + 0x18]
xor eax, 1
inc edi
cmp edi, 4
fstp dword [esi + eax*4 + 0xe6bc]
jb 0x100bef61
mov edx, dword [esi + 4]
mov ecx, dword [esi]
add ebp, ebx
push 0
push ebp
push edx
call dword [ecx + 8]
mov eax, dword [esp + 0x20]
add esp, 0xc
dec eax
mov dword [esp + 0x14], eax
jne 0x100beeac
pop edi
pop ebp
pop ebx
mov ax, word [esi + 0x65b0]
mov cx, ax
shl word [esi + 0x65fc], cl
shr word [esi + 0x65fe], cl
pop esi
ret
Function at 0x100c6670
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x100c66a0
push esi
call fcn.100c6d40
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x100c6699
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100c6723
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x100c670f
mov eax, dword [esi + 8]
test eax, eax
je 0x100c66c4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x100c670b
cmp eax, 2
je 0x100c670f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100c66b7
cmp eax, 3
je 0x100c66ea
cmp eax, 1
jne 0x100c66b7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100c66b7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100c66b7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.100c6750
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x100c6743
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.100c6750
add esp, 4
pop esi
ret
Function at 0x1011d260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1011d280
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10032a68
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x1011d2a3
test byte [esp + 8], 2
je 0x1011d2a3
call fcn.10032a56
mov dword [eax], 0xd
call fcn.10032a5f
mov dword [eax], 5
jmp 0x1011d27c
xor eax, eax
ret

Function at 0x1012042d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x1012044f
cmp dword [edi + 0x3c], 0
jne 0x1012044f
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.10128313
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.1012047c
pop edi
pop esi
pop ebx
ret 8
Function at 0x101207c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1012d538
call fcn.100316d8
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.10128313
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x10120806
call fcn.10128313
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10120814
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10120822
or eax, 0xffffffff
jmp 0x1012090a
mov ecx, esi
call fcn.1012073d
mov dword [ebp - 0x14], eax
call fcn.101214fe
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x10120859
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10120859
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.101214b2
push dword [ebp - 0x14]
call fcn.10121052
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.101204ca
cmp eax, edi
je 0x101208cc
test byte [esi + 0x24], 0x10
je 0x1012089a
push 4
mov ecx, esi
pop ebx
call fcn.101237d5
test ah, 1
je 0x10120892
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.10123197
cmp dword [esi + 0x1c], edi
je 0x101208cc
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.1012384b
jmp 0x101208cc
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x101208e0
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x101208f9
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x101208f9
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.10120777
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x101219ae
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x101219e6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.101201d1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.101201a8
jmp 0x101219f2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x101219f6
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x1018fc10
mov ecx, edi
call fcn.1011feaa
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x10121a49
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x10121a5c
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.101201d1
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.101201a8
jmp 0x10121a5c
mov ecx, esi
call fcn.1012371b
test eax, eax
je 0x10121a5c
push edi
mov ecx, eax
call fcn.101219ae
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x10122ffc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1012303e
call fcn.10128313
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x1012303e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10123035
xor eax, eax
jmp 0x10123046
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1012304c
pop edi
pop esi
pop ebx
ret 4
Function at 0x10018590
Capabilities:
Query environment variable

Disassembly:
endbr32
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0xe4
lea eax, [ebp - 0xf0]
push 0xd0
push 0
push eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.10061620
add esp, 0xc
xor eax, eax
push eax
push eax
push str.FOR_TYPE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
push eax
push str.FOR_PRINT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
push eax
push str.FOR_ACCEPT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
push eax
push str.FOR_READ
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x191]
mov dword [ebp - 0x14], eax
and eax, 0x18
shr eax, 3
je 0x1001874d
cmp eax, 2
je 0x10018898
mov eax, dword [edx + 0x118]
add eax, 4
cmp eax, 0xa
ja 0x10018658
movzx eax, word [eax*2 + 0x1020d1c8]
add eax, 0x10018647
notrack jmp eax
push 0x4e3
push str.for_open.c
push 2
push 8
call fcn.10022aa0
mov edx, dword [ebp + 8]
add esp, 0x10
jmp 0x1001874d
test byte [edx + 0x194], 0x10
jne 0x10018774
jmp 0x100187ac
mov eax, dword [edx + 0x114]
mov ecx, dword [edx + 0xf0]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb4], ecx
mov eax, dword [edx + 0x68]
movsx ecx, byte [edx + 0x17f]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xf0], edi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x6c], 1
cmp ebx, 1
je 0x100187e9
jmp 0x10018880
movsx eax, byte [edx + 0x181]
test eax, eax
je 0x10018810
cmp eax, 0x27
jne 0x10018802
mov dword [ebp - 0x7c], 1
jmp 0x10018817
cmp eax, 0x22
jne 0x10018817
mov dword [ebp - 0x7c], 3
jmp 0x10018817
mov dword [ebp - 0x7c], 2
test byte [edx + 0x193], 0x20
je 0x1001882c
mov dword [ebp - 0xe4], 2
jmp 0x10018836
mov dword [ebp - 0xe4], 0
test byte [edx + 0x196], 2
jne 0x10018848
test byte [edx + 0x190], 2
je 0x10018851
mov dword [ebp - 0x78], 2
jmp 0x10018858
mov dword [ebp - 0x78], 1
movzx eax, byte [edx + 0x187]
movzx ecx, byte [edx + 0x189]
movzx ebx, byte [edx + 0x18b]
movzx esi, byte [edx + 0x18d]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
push edx
lea eax, [ebp - 0xf0]
push eax
call fcn.10034840
add esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
cmp edi, 0xffffffff
jne 0x1001874d
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10025630
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10c
mov eax, dword [0x10234e38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1024069c
call fcn.1003e800
add esp, 4
mov eax, dword [0x102406a0]
test eax, eax
je 0x10025660
xor esi, esi
jmp 0x100256cb
push 0x105
mov dword [0x102406a0], 1
lea edi, [ebp - 0x118]
push edi
push str.FORT0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x10025697
cmp eax, 0x105
jae 0x10025697
movsx eax, byte [ebp - 0x118]
xor esi, esi
jmp 0x100256a2
xor eax, eax
mov byte [ebp - 0x118], 0
xor esi, esi
test eax, eax
je 0x100256cb
cmp dword [0x102372a0], 0
je 0x100256ee
mov ebx, dword [0x10237408]
mov eax, dword [0x102372b8]
call eax
add eax, 0x40
push eax
push 0x102138c0
push edi
call ebx
add esp, 0xc
mov dword [0x1024069c], esi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
xor ecx, ebp
cmp ecx, dword [0x10234e38]
jne 0x100256e9
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.101a6152
call fcn.10061c60
mov ebx, dword [0x10237408]
cmp dword [0x102372a0], 0
jne 0x100256b5
call fcn.10061c60
jmp 0x100256b5
Function at 0x1002dc50
Capabilities:
Query environment variable

Disassembly:
endbr32
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x110
mov eax, dword [0x10234e38]
mov edx, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
test edx, edx
je 0x1002dd5e
push 0x105
lea edi, [ebp - 0x118]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x1002dc96
cmp eax, 0x105
jae 0x1002dc96
inc eax
jmp 0x1002dc9d
mov byte [ebp - 0x118], 0
test eax, eax
jne 0x1002dca8
xor eax, eax
jmp 0x1002dd36
movsx ebx, byte [ebp - 0x118]
cmp ebx, 0x54
je 0x1002dd31
cmp ebx, 0x59
je 0x1002dd31
cmp ebx, 0x74
je 0x1002dd31
cmp ebx, 0x79
je 0x1002dd31
test ebx, ebx
je 0x1002dca1
movzx eax, bl
lea esi, [ebp - 0x117]
push eax
call fcn.101be796
add esp, 4
test eax, eax
je 0x1002dcf5
movsx ebx, byte [esi]
inc esi
movzx eax, bl
push eax
call fcn.101be796
add esp, 4
test eax, eax
jne 0x1002dce1
test ebx, ebx
jne 0x1002dca1
mov dword [ebp - 0x11c], 0
cmp dword [0x102372a0], 0
je 0x1002dd52
mov edx, dword [0x10237320]
lea eax, [ebp - 0x11c]
push eax
push 0x102145c0
push edi
call edx
add esp, 0xc
cmp dword [ebp - 0x11c], 0
je 0x1002dca1
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x10234e38]
jne 0x1002dd59
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.10061c60
jmp 0x1002dd0c
call fcn.101a6152
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x10234e38]
jne 0x1002dd59
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10033020
Capabilities:
Get common file path
Identify system language via api
Query environment variable

Disassembly:
endbr32
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x10038e30
Capabilities:
Clear file content

Disassembly:
endbr32
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x50]
mov ebx, dword [esi + 0x4c]
test edx, edx
je 0x10038e4e
sub ebx, edx
jmp 0x10038e53
mov edx, dword [esi + 0x48]
sub ebx, edx
lea edx, [ebx + 4]
cmp edx, dword [esi + 0x104]
ja 0x100392d4
movzx edx, word [esi + 0x17a]
test edx, edx
jg 0x10039089
movsx edx, byte [esi + 0x17c]
cmp edx, 8
ja 0x1003901f
movzx eax, word [edx*2 + 0x10214c60]
add eax, 0x10038e91
notrack jmp eax
push 0x360
push str.for_put.c
push 2
push 8
call fcn.10022aa0
add esp, 0x10
mov edx, dword [esi + 0x50]
test edx, edx
je 0x100392b2
mov eax, esi
mov ecx, ebx
call fcn.100393a0
and byte [esi + 0x194], 0xbf
cmp eax, 0xffffffff
je 0x10039299
test byte [esi + 0x195], 8
je 0x100390a6
push dword [esi + 0xfc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x10039283
xor eax, eax
and byte [esi + 0x195], 0xf7
test eax, eax
jne 0x10039366
jmp 0x100390a6
mov edx, dword [esi + 0x50]
test edx, edx
je 0x100392c3
mov eax, esi
mov ecx, ebx
call fcn.100393a0
cmp eax, 0xffffffff
je 0x10039299
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov eax, 0x26
jmp 0x10039078
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov eax, 0x26
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x48]
call fcn.100393a0
jmp 0x10039049
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x48]
call fcn.100393a0
jmp 0x1003909d
push 0x200
push esi
call fcn.1002d960
add esp, 8
test eax, eax
je 0x10038e62
push 4
push esi
call fcn.1002d960
add esp, 8
test eax, eax
je 0x10038e62
cmp ebx, dword [esi + 0x104]
ja 0x10039312
cmp byte [esi + 0x17c], 1
je 0x10038e62
mov edx, dword [esi + 0x20]
test edx, edx
je 0x1003936e
test byte [edx + 0x44], 2
je 0x10039349
mov ecx, 0x42
mov dword [edx + 0x38], ecx
mov edx, dword [esi + 0x20]
mov dword [edx + 0x3c], ecx
mov edx, dword [esi + 0x78]
test edx, edx
je 0x1003933c
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x78], ecx
mov eax, 0x42
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov edx, 0x42
push edx
movzx ecx, byte [esi + 0x194]
push edx
and ecx, 7
push ecx
push 0xffffffffffffffff
push esi
call fcn.1002c750
add esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
mov eax, 0x42
push eax
push eax
push 1
call fcn.10021950
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10039390
Capabilities:
Write file on windows

Disassembly:
endbr32
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]