joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406451
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e9c3
call fcn.0040d3d4
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166f0]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4065c3
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4065c3
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4065c3
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4065c3
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40653b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4065b1
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4065b1
mov ecx, 0x1234
cmp cx, ax
jne 0x4065b1
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x40658e
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
je 0x4065c1
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4064a9
jmp 0x4065c3
xor edi, edi
mov eax, edi
call fcn.0040d38f
ret 4

Function at 0x40c819
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40c828
pop dword [ebp - 0x38]
mov eax, 0xe9d1df52
sub eax, 0xe991172a
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x391c6
push 0
mov eax, 0x2919b09
sub eax, 0x250aa79
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4a7e
xor esi, esi
add esi, eax
mov edi, 0x41aa00
add edi, dword [ebp - 0x38]
mov edx, 0x54455e21
sub edx, 0xa2b6fb29
mov ebx, dword [edi]
mov dword [ebp - 0x34], 0xbc3e1da8
xor ebx, edx
add dword [ebp - 0xc], ebx
mov dword [esi], ebx
add dword [ebp - 0x28], 0xf0ab9fb2
add esi, 0x25979d07
sub esi, 0x25979d03
add edi, 4
loop 0x40c87d
add eax, 0xba995b1c
sub eax, 0xba983e51
mov ebx, eax
add eax, 0x6ae151b8
sub eax, 0x6ae151b3
mov ecx, 0xc2beaa
sub ecx, 0x82beaa
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401b00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401b44
test esi, esi
je 0x401b44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b20
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401e54
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401dbe
cmp eax, 4
jne 0x401de0
test esi, esi
je 0x401dd2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401dc4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401e1f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401e11
cmp ecx, 0x40
je 0x401dd2
cmp ecx, 4
je 0x401dd2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d30
lea esi, [esi]
Function at 0xfdab8c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x9e1fa176]
arpl word [esi], dx
or edx, dword [eax]
pop esi
and eax, dword [edi]
salc
and eax, 0xa654f351
push ebx
out dx, eax
dec ebx
mov dl, 0xb0
adc byte [edx], dl
mov fs, word [edi + edx*8]
leave
invalid
mov bl, 0x9b
into
dec esi
push esp
xor dl, byte [ecx + 0x5a]
push edi
add ecx, dword [ecx + 0x56]
xor al, 0x3c
jb 0xfdab1b
cmc
jmp 0xfdabef
jmp 0xfdab96
pushal
call 0xfdab9c
pop ebp
sub ebp, 0x10
sub ebp, 0xbdab8c
jmp 0xfdabb2
mov eax, 0xbdab8c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
mov edx, 0x619d4881
xor byte [eax], dl
inc eax
dec ecx
jne 0xfdabc9
jmp 0xfdabdc
or cl, byte [edx + ecx + 8]
mov ebp, 0x818181
inc eax
jns 0xfdab69
add dword [ecx - 0x7ac6b37e], 0x3b818181
test eax, 0x76818181
arpl word [edx - 0x72fff5b7], ax
add dword [ecx + 0xc448281], 0x87da5e5
add dword [ecx - 0x7e7e56c5], 0x82637681
dec ecx
or al, byte [eax]
lea eax, [ecx + 0x44828181]
or al, 0xe5
movsd dword es:[edi], dword [esi]
jge 0xfdac0f
test dword [ebp - 0x36b2162f], esp
mov al, byte [0xe33fe981]
sbb eax, 0xa5ad8081
jmp 0xea269b97
jmp 0x821b8f53
Function at 0x10003100
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push ebx
push esi
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax*2 + 2]
mov dword [esp + 0xc], eax
push ecx
call fcn.1000cf14
mov ebx, eax
mov eax, dword [esp + 0x10]
lea edx, [eax + 1]
push edx
push ebx
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push esi
push ebx
call fcn.1000c17c
push ebx
call fcn.1000cf4c
add esp, 8
mov eax, dword [esp + 0x18]
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x10003732
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x220
push ebx
push esi
push edi
mov eax, dword [esp + 0x234]
bt dword [eax + 0x10], 6
mov edx, dword [esp + 0x234]
mov ebx, dword [edx + 0x18]
sbb ecx, ecx
neg ecx
mov esi, dword [esp + 0x234]
mov byte [esp + 0x228], cl
add esi, 0x1c
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x234]
mov edx, dword [eax + 0x10]
test edx, 0x40
mov esi, 0xf0
jne 0x10003797
mov esi, 0xc0
test edx, 1
jne 0x10003797
mov esi, 0xd8
push esi
call dword [sym.imp.GDI32.DLL_CreateSolidBrush]
mov dword [esp + 0x20], eax
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 0xf
push 5
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawEdge]
push 0x100
lea edx, [esp + 0x2c]
push edx
mov edi, dword [esp + 0x23c]
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 1
push ebx
call dword [sym.imp.GDI32.DLL_SetBkMode]
push 0xffffff
push ebx
call dword [sym.imp.GDI32.DLL_SetTextColor]
push dword [esp + 0x20]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push 0x100431d0
push 0
push 0
push 0
push 0
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1a
call dword [sym.imp.GDI32.DLL_CreateFontW]
mov dword [esp + 0x24], eax
push eax
push ebx
call dword [sym.imp.GDI32.DLL_SelectObject]
push 0x25
lea esi, [esp + 0x14]
push esi
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
cmp byte [esp + 0x228], 0
je 0x10003870
push 0x4e
call dword [sym.imp.GDI32.DLL_CreateSolidBrush]
mov esi, eax
push eax
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.DLL_DeleteObject]
push dword [esp + 0x24]
call dword [sym.imp.GDI32.DLL_DeleteObject]
pop edi
pop esi
pop ebx
add esp, 0x220
ret
Function at 0x10003943
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
test eax, eax
je 0x100039b3
lea ecx, [esp + 8]
push ecx
push 0x100431e0
push 0
call dword [sym.imp.ADVAPI32.DLL_LookupPrivilegeValueW]
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.DLL_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100039b3
push 0x70000
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x100039b9
add esp, 0x14
xor eax, eax
ret
add esp, 0x14
mov eax, 1
ret
Function at 0x1002df18
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
xor eax, eax
push 0x1002dfa4
push edx
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov dword [ebp - 0x18], ecx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
lea ecx, [ecx + 0x20]
call fcn.10016004
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
xor edx, edx
mov dword [ebx + 0x24], edx
lea ecx, [ebx + 0x48]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
call fcn.1002e7e0
mov dword [ebp - 4], 1
mov eax, ebx
mov dword [ebx], 0x1004ee20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003cec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x58]
push ebx
push ebp
push esi
mov esi, ecx
mov edx, dword [esi + 0x50]
push edi
mov dword [esi + 0x54], eax
cmp edx, dword [esi + 0x4c]
jbe 0x1003cf04
mov edi, dword [esi + 0x50]
mov ebx, dword [esi + 0x4c]
mov ebp, dword [esi + 0x44]
cmp edi, ebx
jne 0x1003cee8
mov edx, ebp
jmp 0x1003ceff
mov edx, edi
sub edx, ebx
push edx
push ebx
push ebp
call fcn.1000ca40
mov ecx, edi
mov edx, eax
sub ecx, ebx
add esp, 0xc
add edx, ecx
mov dword [esi + 0x50], edx
jmp 0x1003cf0a
mov ebx, dword [esi + 0x44]
mov dword [esi + 0x50], ebx
lea eax, [esi + 0x58]
lea ebp, [esi + 0x24]
mov dword [esp + 0x28], eax
mov edx, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
sub edx, ecx
push edx
push ecx
mov ecx, ebp
call fcn.1003d5c4
mov ebx, eax
test eax, eax
jg 0x1003cf38
pop edi
mov eax, 0xffffffff
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
add dword [esi + 0x50], ebx
mov edi, dword [esi + 0x70]
mov edx, dword [esp + 0x28]
mov ecx, dword [edx]
mov dword [esp + 0x24], ecx
lea edx, [esp + 0x20]
push edx
push dword [esi + 0x40]
push dword [esi + 0x3c]
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
push dword [esi + 0x50]
push dword [esi + 0x44]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [edi]
call dword [edx + 8]
cmp eax, 3
jne 0x1003cf79
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ebx, 2
cmp eax, ebx
je 0x1003cfc8
mov eax, dword [esi + 0x3c]
cmp eax, dword [esp + 0x20]
je 0x1003cf94
mov edi, dword [esi + 0x44]
cmp edi, dword [esp + 0x1c]
je 0x1003cfc8
cmp byte [esi + 0x34], 0
je 0x1003cfb6
mov ecx, dword [esp + 0x20]
sub ecx, eax
test ecx, ecx
jns 0x1003cfa5
inc ecx
sar ecx, 1
imul ecx, dword [esi + 0x74]
mov edx, dword [esp + 0x1c]
sub edx, dword [esi + 0x44]
cmp ecx, edx
jne 0x1003cfc8
cmp eax, dword [esp + 0x20]
jne 0x1003cfd7
mov ebx, dword [esp + 0x1c]
sub ebx, dword [esi + 0x44]
cmp ebx, dword [esi + 0x78]
jl 0x1003cfd7
mov ecx, esi
call fcn.1003cea0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
cmp eax, dword [esp + 0x20]
je 0x1003cf14
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x4c], edi
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ebx, dword [esp + 0x18]
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov ax, word [eax]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x1003d3c8
Capabilities:
Get file size

Disassembly:
push eax
push eax
lea eax, [esp + 4]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x1003d3ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1003d3ef
xor eax, eax
jmp 0x1003d3f2
mov eax, dword [esp]
add esp, 8
ret
Function at 0x1003d47c
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
mov edx, ecx
xor eax, eax
mov dword [esp + 4], ecx
mov dword [ecx], 0xffffffff
mov byte [edx + 0xc], al
mov dword [edx + 8], 0
mov byte [edx + 0xd], al
cmp dword [0x1006185c], eax
jne 0x1003d4bf
mov dword [esp + 4], edx
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0xc]
mov dword [0x1006185c], edx
mov edx, dword [esp + 4]
mov dword [edx + 4], 0
cmp dword [0x1006185c], 0
jne 0x1003d4d9
mov dword [0x1006185c], 0x1000
add esp, 0x2c
mov eax, edx
ret

Function at 0x1003d5c4
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test dword [edi + 8], 4
jne 0x1003d696
cmp dword [esp + 0x10], 0
je 0x1003d696
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
lea ebp, [edx + ecx - 1]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x20]
cmp ebp, ecx
jb 0x1003d676
cmp byte [ecx], 0x1a
je 0x1003d676
cmp byte [ebx], 0xd
je 0x1003d625
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
jmp 0x1003d66c
cmp ebx, ebp
jae 0x1003d631
cmp byte [ebx + 1], 0xa
jne 0x1003d668
jmp 0x1003d66c
mov byte [esp + 0x14], 0x20
push 0
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x20]
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], 0
je 0x1003d661
push 1
push 0
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esp + 0x14], 0xa
je 0x1003d66c
mov byte [esi], 0xd
inc esi
inc ebx
cmp ebx, ebp
ja 0x1003d676
cmp byte [ebx], 0x1a
jne 0x1003d619
cmp ebx, ebp
ja 0x1003d68c
push 1
lea edx, [ebp + 1]
sub edx, ebx
push 0
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
sub eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x1003d6a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, 1
sub esp, 0x1000
test dword [esp], esp
dec edx
jne 0x1003d6ac
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1030], ecx
test dword [esi + 8], 1
je 0x1003d6da
push 4
mov ecx, esi
push 0
call fcn.1003d850
test dword [esi + 8], 4
je 0x1003d705
push 0
lea edx, [ebp - 0x102c]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebp - 0x102c]
jmp 0x1003d81c
mov dword [ebp - 0x1030], esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ecx, [edx + ecx]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x1028]
mov dword [ebp - 0x24], ecx
mov ecx, 0x1000
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp + 0xc]
jge 0x1003d732
lea ecx, [ebp - 0x1c]
jmp 0x1003d735
lea ecx, [ebp + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
mov dword [ebp - 0x20], ecx
jle 0x1003d7bc
push dword [ebp - 0x20]
push 0xa
push edx
call fcn.1003fe60
add esp, 0xc
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1003d7bc
mov edi, dword [ebp - 0x18]
sub edi, esi
push edi
push esi
push ebx
call fcn.1000ca40
lea edx, [edi + 1]
add ebx, edi
mov byte [ebx], 0xd
inc ebx
add esi, edx
mov byte [ebx], 0xa
mov ecx, dword [ebp - 0x24]
sub ecx, esi
xor edx, edx
inc ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc], ecx
sub eax, ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
add esp, 0xc
cmp edx, eax
jge 0x1003d790
lea edx, [ebp - 0x10]
jmp 0x1003d793
lea edx, [ebp - 0x14]
mov eax, dword [edx]
cmp eax, ecx
jge 0x1003d79b
jmp 0x1003d79e
lea edx, [ebp - 0xc]
mov ecx, dword [edx]
test ecx, ecx
mov dword [ebp - 0x20], ecx
jle 0x1003d7bc
push dword [ebp - 0x20]
push 0xa
push esi
call fcn.1003fe60
add esp, 0xc
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x1003d753
mov edi, dword [ebp - 0x20]
test edi, edi
jle 0x1003d7d2
push edi
push esi
push ebx
call fcn.1000ca40
add ebx, edi
add esi, edi
add esp, 0xc
lea edx, [ebp - 0x1028]
mov edi, ebx
sub edi, edx
mov dword [ebp - 8], edx
je 0x1003d811
push 0
lea ecx, [ebp - 4]
push ecx
push edi
mov edx, dword [ebp - 0x1030]
push dword [ebp - 8]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], edi
je 0x1003d811
cmp dword [ebp - 4], 0
je 0x1003d843
sub edi, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add dword [ebp - 8], ecx
test edi, edi
jne 0x1003d7e1
mov ebx, esi
mov esi, dword [ebp - 0x1030]
sub ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], ebx
jne 0x1003d82f
pop edi
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
jle 0x1003d843
cmp ebx, dword [ebp + 0xc]
jge 0x1003d843
sub dword [ebp + 0xc], ebx
add dword [ebp + 8], ebx
jmp 0x1003d6c6
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003d8f8
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x1003d96d
push edi
mov eax, dword [esp + 0x1c]
mov edx, eax
mov dword [esp + 0x10], eax
sar edx, 0x1f
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
xor edx, edx
push eax
mov eax, dword [esp + 0x14]
push ecx
push 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test eax, eax
je 0x1003d960
push 1
mov edx, dword [esp + 0x1c]
lea ecx, [edx + edi]
push ecx
mov ecx, esi
call fcn.1003d850
test eax, eax
jns 0x1003d96f
push edi
mov ecx, esi
push ebx
call fcn.1003d97c
xor ebx, ebx
jmp 0x1003d96f
xor ebx, ebx
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x1003e718
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, 1
push esi
push edi
cmp dword [0x10067c08], 0
jne 0x1003e76a
push 0
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
test eax, eax
je 0x1003e770
push esi
call fcn.1000f138
add esp, 4
mov edi, eax
test eax, eax
je 0x1003e770
push esi
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1003e770
mov ecx, dword [esp + 0x18]
mov dword [ecx], edi
pop edi
mov eax, ebx
pop esi
pop ebx
ret
mov dword [0x10067c08], 1
xor ebx, ebx
jmp 0x1003e76a

Function at 0x1003e780
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
push ebx
mov ebx, 1
push esi
push edi
cmp dword [0x10067c08], 0
jne 0x1003e830
push 0x10
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1003e839
mov dword [esp + 0x10], ebx
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x14], ecx
mov edx, 1
cmp dword [0x10044120], edx
jle 0x1003e7ec
push 4
mov al, byte [esp + ebx + 0x20]
mov byte [esp + 0x1c], al
and eax, 0xff
push eax
call fcn.1000f8bc
add esp, 8
test eax, eax
je 0x1003e822
jmp 0x1003e808
mov cl, byte [esp + ebx + 0x1c]
mov esi, dword [0x100441a8]
mov byte [esp + 0x18], cl
and ecx, 0xff
test word [esi + ecx*2], 4
je 0x1003e822
mov edi, dword [esp + 0x14]
movzx edx, byte [esp + 0x18]
lea eax, [edi + edi*4]
lea eax, [edx + eax*2 - 0x30]
inc ebx
cmp ebx, 0x10
mov dword [esp + 0x14], eax
jb 0x1003e7c1
mov esi, dword [esp + 0x38]
mov cl, byte [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov byte [esi], cl
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x20
ret
mov dword [0x10067c08], 1
xor ebx, ebx
jmp 0x1003e830
Function at 0x1003e848
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, 1
push esi
cmp dword [0x10067c08], 0
jne 0x1003e8e4
push 0x10
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1003e8ec
mov dword [esp + 0xc], ebx
xor esi, esi
xor ebx, ebx
mov ecx, 1
cmp dword [0x10044120], ecx
jle 0x1003e8ac
push 4
mov dl, byte [esp + ebx + 0x18]
mov byte [esp + 0x14], dl
and edx, 0xff
push edx
call fcn.1000f8bc
add esp, 8
test eax, eax
je 0x1003e8da
jmp 0x1003e8c8
mov dl, byte [esp + ebx + 0x14]
mov ecx, dword [0x100441a8]
mov byte [esp + 0x10], dl
and edx, 0xff
test word [ecx + edx*2], 4
je 0x1003e8da
movzx edx, byte [esp + 0x10]
lea esi, [esi + esi*4]
inc ebx
lea esi, [edx + esi*2 - 0x30]
cmp ebx, 0x10
jb 0x1003e880
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0xc]
mov dword [ecx], esi
pop esi
mov eax, ebx
pop ebx
add esp, 0x1c
ret
mov dword [0x10067c08], 1
xor ebx, ebx
jmp 0x1003e8e4
Function at 0x10040300
Capabilities:
Get file size

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
push 0x20
push 0
push ebx
call fcn.1000cfc4
mov word [ebx + 6], 1
add esp, 0xc
mov eax, dword [esp + 0x28]
push dword [eax*4 + 0x10065a20]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x10040346
mov di, word [esp + 0x28]
mov edx, 0x2180
mov word [ebx], di
mov word [ebx + 0xc], di
jmp 0x100403c2
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
mov edx, dword [esp + 0x34]
push dword [edx*4 + 0x10065a20]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x10040375
call fcn.100136a8
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x18
ret
lea esi, [esp + 0x1c]
push esi
call fcn.100403ec
test eax, eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x18], eax
jne 0x10040398
pop edi
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x14], 0x8180
xor ecx, ecx
push ecx
mov edx, dword [esp + 0x2c]
mov word [ebx], cx
mov word [ebx + 0xc], cx
push dword [edx*4 + 0x10065a20]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x14]
mov dword [ebx + 0x10], eax
mov esi, edx
and esi, 0x1c0
mov dword [esp + 0x10], esi
sar esi, 3
mov eax, dword [esp + 0x10]
or esi, edx
sar eax, 6
or esi, eax
mov word [ebx + 4], si
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x18
ret