joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011300
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, edx
mov edx, dword [0x10065ba8]
mov dword [ebp - 0xc], edx
push edi
mov edi, ecx
test esi, esi
jne 0x10011329
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10011320
sub esi, ecx
test edx, edx
je 0x10011333
inc dword [edx + 0x374]
lea eax, [esi + 1]
push ebx
push eax
call fcn.1003aa00
push esi
push edi
push eax
lea ebx, [eax + esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
call fcn.1002d4d0
mov esi, dword [ebp - 0x10]
xor edx, edx
add esp, 0x10
mov byte [ebx], 0
xor edi, edi
mov dword [ebp - 4], edx
mov ecx, esi
cmp esi, ebx
jae 0x100114c4
nop dword [eax + eax]
mov al, byte [ecx]
cmp al, 0xa
je 0x100114f1
cmp al, 0xd
je 0x100114f1
mov esi, ecx
cmp ecx, ebx
jae 0x10011397
mov al, byte [esi]
cmp al, 0xa
je 0x10011397
cmp al, 0xd
je 0x10011397
inc esi
cmp esi, ebx
jb 0x10011388
mov byte [esi], 0
mov al, byte [ecx]
cmp al, 0x3b
je 0x100114b6
cmp al, 0x5b
jne 0x10011495
cmp esi, ecx
jbe 0x10011495
cmp byte [esi - 1], 0x5d
lea ebx, [esi - 1]
jne 0x10011492
inc ecx
mov byte [ebx], 0
mov eax, ebx
mov dword [ebp - 0x18], ecx
sub eax, ecx
push eax
push 0x5d
push ecx
call fcn.1002da50
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100114b0
lea ecx, [eax + 1]
sub ebx, ecx
push ebx
push 0x5b
push ecx
call fcn.1002da50
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x100114b0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [0x10065ba8]
mov byte [eax], 0
lea eax, [ecx + 1]
mov cl, byte [edi]
inc edi
mov dword [ebp - 0x14], eax
or eax, 0xffffffff
test cl, cl
je 0x1001144e
or ebx, 0xffffffff
cmp cl, 0x23
jne 0x1001142f
cmp byte [edi], cl
jne 0x1001142f
cmp byte [edi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [edi]
inc edi
xor eax, dword [edx*4 + 0x1005a070]
test cl, cl
jne 0x10011420
mov ebx, dword [0x10065ba8]
mov edx, dword [ebx + 0x2d90]
xor ecx, ecx
not eax
test edx, edx
jle 0x1001146f
mov edi, dword [ebx + 0x2d98]
cmp dword [edi + 4], eax
je 0x10011478
inc ecx
add edi, 0x18
cmp ecx, edx
jl 0x10011462
xor edi, edi
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x100114b3
test edi, edi
je 0x10011471
push dword [ebp - 0x14]
mov eax, dword [edi + 8]
push edi
push dword [ebp - 0xc]
call eax
mov edx, eax
add esp, 0xc
mov dword [ebp - 4], edx
jmp 0x100114b3
mov ebx, dword [ebp - 8]
test edi, edi
je 0x100114b6
test edx, edx
je 0x100114b6
mov eax, dword [edi + 0xc]
push ecx
push edx
push edi
push dword [ebp - 0xc]
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
jmp 0x100114b6
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
lea ecx, [esi + 1]
cmp ecx, ebx
jb 0x10011370
mov esi, dword [ebp - 0x10]
pop ebx
test esi, esi
je 0x100114d8
mov eax, dword [0x10065ba8]
test eax, eax
je 0x100114d8
dec dword [eax + 0x374]
push esi
call fcn.10035c40
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
mov byte [eax + 0x2d7c], 1
pop esi
mov esp, ebp
pop ebp
ret
inc ecx
jmp 0x10011370
Function at 0x10020f00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10064040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x10065ba8]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push dword [0x10065c7c]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
movd xmm1, eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x30]
mov ecx, edi
sub ecx, dword [0x10065c80]
mov esi, dword [esp + 0x34]
mov edx, esi
sbb edx, dword [0x10065c84]
call fcn.1004ec00
mov edx, dword [0x10065c8c]
mov ecx, dword [0x10065c88]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x28], xmm0
call fcn.1004ec00
movss xmm1, dword [esp + 0x28]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x10065c84], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10065c80], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0x100], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0x101], al
call esi
mov ecx, dword [0x10065ba8]
shr eax, 0xf
and al, 1
mov byte [ebx + 0x103], 0
mov byte [ebx + 0x102], al
cmp byte [ecx + 0x35b], 0
lea esi, [ecx + 0xe8]
je 0x1002103a
cvttss2si eax, dword [esi]
mov dword [esp + 0x28], eax
cvttss2si eax, dword [ecx + 0xec]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push dword [0x10065c7c]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100210a6
mov ecx, dword [0x10065c7c]
cmp eax, ecx
je 0x10021067
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x100210a6
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100210a6
lea eax, [esp + 0x10]
push eax
push dword [0x10065c7c]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100210a6
movd xmm0, dword [esp + 0x10]
movd xmm1, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xb0], 0
je 0x100210b4
or eax, 0xffffffff
jmp 0x100210bf
mov eax, dword [0x10065ba8]
mov eax, dword [eax + 0x1d84]
cmp dword [0x10064cc0], eax
je 0x100210d1
mov dword [0x10064cc0], eax
call fcn.10020b50
call fcn.10020c80
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ab5b
mov esp, ebp
pop ebp
ret
Function at 0x10028e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10028e9a
sub eax, 1
je 0x10028e66
xor eax, eax
pop ebp
ret 0xc
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push edi
push 0x100287f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edi
push 0x10026e80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov eax, 1
pop ebp
ret 0xc

Function at 0x1002a730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x24], 0
je 0x1002a8c3
movaps xmm5, xmmword [0x1005e9b0]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x1005ef80]
mov edx, 0xffffffbd
movups xmm4, xmmword [0x1005e9d0]
mov dword [ebp - 8], ecx
sub edx, ebx
mov ecx, 0xffffffbb
mov dword [ebp - 4], 0xffffffb6
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffba
sub edi, ebx
mov esi, 0xffffffbc
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffb2
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x20
jb 0x1002a7a4
mov ebx, dword [ebp - 0x20]
pop edi
cmp eax, 0x23
jae 0x1002a8bf
lea edx, [ebx + eax]
lea ecx, [eax - 0x4a]
inc eax
xor byte [edx], cl
cmp eax, 0x23
jb 0x1002a8b1
mov byte [ebx + 0x24], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x23]
push eax
push ebx
call fcn.1002aa90
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x2a], 0
je 0x1002aa73
movaps xmm5, xmmword [0x1005e9b0]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x1005ef80]
mov edx, 0xffffffbd
movups xmm4, xmmword [0x1005e9d0]
mov dword [ebp - 8], ecx
sub edx, ebx
mov ecx, 0xffffffbb
mov dword [ebp - 4], 0xffffffb6
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffba
sub edi, ebx
mov esi, 0xffffffbc
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffb2
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x20
jb 0x1002a954
mov ebx, dword [ebp - 0x20]
pop edi
cmp eax, 0x29
jae 0x1002aa6f
lea edx, [ebx + eax]
lea ecx, [eax - 0x4a]
inc eax
xor byte [edx], cl
cmp eax, 0x29
jb 0x1002aa61
mov byte [ebx + 0x2a], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x29]
push eax
push ebx
call fcn.1002aa90
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10030995
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.1004e6b0
mov eax, dword [0x10064040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1003d938
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100309d7
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10030b4e
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1004e600
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1014], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100657e0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1003db47
mov ecx, dword [esi*4 + 0x100657e0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x1020], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10030b47
cmp eax, dword [edi + ecx + 0x24]
jne 0x10030b47
xor esi, esi
lea eax, [ebp - 0x101c]
push esi
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10030b47
push dword [ebp - 0x100c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1003db47
add esp, 0x14
cmp edx, esi
jl 0x10030b47
jg 0x10030aa2
cmp eax, esi
jb 0x10030b47
mov ebx, dword [ebp - 0x1014]
mov eax, dword [ebp - 0x101c]
cmp ebx, esi
jg 0x10030b47
jl 0x10030ac4
cmp dword [ebp - 0x1008], eax
ja 0x10030b47
lea edi, [ebp - 0x1004]
xorps xmm0, xmm0
add edi, eax
movlpd qword [ebp - 0x1018], xmm0
lea ecx, [ebp - 0x1004]
cmp dword [ebp - 0x1008], esi
jne 0x10030ae9
cmp ebx, esi
je 0x10030b2e
mov edx, dword [ebp - 0x1014]
mov esi, dword [ebp - 0x1018]
cmp ecx, edi
jae 0x10030b2e
mov al, byte [ecx]
cmp al, 0xd
jne 0x10030b0f
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10030b1b
cmp byte [ecx + 1], 0xa
jne 0x10030b1b
inc ecx
jmp 0x10030b1b
movzx eax, al
movsx eax, byte [eax + 0x100642c0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10030af5
cmp edx, ebx
jne 0x10030af5
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x1020]
jmp 0x10030b4c
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002ab5b
leave
ret

Function at 0x1003b0ec
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1003b12b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003b12b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003b12b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1003b12b
cmp dword [ecx + 0x74], 0xe
jbe 0x1003b12b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1003f830
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov ecx, edx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
sar ecx, 6
and eax, 0x3f
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100657e0]
mov dword [ebp - 0x18], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1003f872
cmp byte [ebx], 0xa
jne 0x1003f872
or byte [edi + eax + 0x28], 4
jmp 0x1003f877
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1003f97a
mov cl, byte [eax]
cmp cl, 0x1a
je 0x1003f955
lea ebx, [eax + 1]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
cmp cl, 0xd
je 0x1003f8a6
mov eax, dword [ebp - 8]
jmp 0x1003f8c6
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 8], edx
mov edx, dword [ebp + 8]
jae 0x1003f8e2
mov ebx, dword [ebp - 8]
cmp byte [ebx], 0xa
jne 0x1003f8c0
add eax, 2
mov cl, 0xa
jmp 0x1003f8c3
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov byte [esi], cl
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jb 0x1003f888
jmp 0x1003f97a
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003f950
cmp dword [ebp - 0x10], 0
je 0x1003f950
mov edx, dword [ebp - 0x18]
mov eax, dword [edx*4 + 0x100657e0]
test byte [eax + edi + 0x28], 0x48
je 0x1003f92f
mov cl, byte [ebp - 1]
cmp cl, 0xa
jne 0x1003f91f
mov byte [esi], 0xa
jmp 0x1003f979
mov byte [esi], 0xd
mov eax, dword [edx*4 + 0x100657e0]
mov byte [eax + edi + 0x2a], cl
jmp 0x1003f979
cmp byte [ebp - 1], 0xa
jne 0x1003f939
cmp esi, ebx
je 0x1003f91a
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1003db65
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1003f97a
mov byte [esi], 0xd
jmp 0x1003f979
mov eax, edx
and edx, 0x3f
sar eax, 6
imul edx, edx, 0x38
mov edi, dword [eax*4 + 0x100657e0]
mov al, byte [edi + edx + 0x28]
test al, 0x40
jne 0x1003f977
or al, 2
mov byte [edi + edx + 0x28], al
jmp 0x1003f97a
mov byte [esi], cl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1003f983
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
push ebx
mov ebx, dword [ebp + 0xc]
sar edx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [edx*4 + 0x100657e0]
mov dword [ebp - 8], edx
mov edx, dword [eax + edi + 0x18]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1003f9c7
push 0xa
pop esi
cmp word [ebx], si
jne 0x1003f9c7
or byte [eax + edi + 0x28], 4
jmp 0x1003f9cc
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + edx*2]
mov eax, ebx
mov dword [ebp - 0x10], edx
mov esi, ebx
cmp ebx, edx
jae 0x1003fb37
movzx edx, word [eax]
mov ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
cmp edx, 0x1a
je 0x1003fb0f
lea ebx, [eax + 2]
mov dword [ebp - 4], ebx
push 0xd
pop ebx
cmp dx, bx
mov ebx, dword [ebp + 0xc]
je 0x1003fa19
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 4]
movzx ebx, bx
mov dword [ebp - 4], ebx
jmp 0x1003fa43
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x1003fa62
push 0xa
pop ebx
cmp word [edx], bx
jne 0x1003fa30
push ebx
add eax, 4
pop edx
jmp 0x1003fa38
mov eax, edx
mov edx, dword [ebp - 0xc]
movzx edx, dx
movzx edx, dx
mov dword [ebp - 4], edx
mov edx, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
mov word [esi], cx
mov esi, dword [ebp - 0xc]
add esi, edx
cmp eax, dword [ebp - 0x10]
jb 0x1003f9de
jmp 0x1003fb37
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003fb0a
cmp dword [ebp - 0x14], 0
je 0x1003fb0a
mov eax, dword [ebp - 8]
push 0xa
mov eax, dword [eax*4 + 0x100657e0]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x1003fae6
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x1003faae
mov word [esi], ax
jmp 0x1003fb34
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebp - 8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov eax, dword [eax*4 + 0x100657e0]
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100657e0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100657e0]
pop ecx
mov byte [eax + edi + 0x2c], cl
jmp 0x1003fb34
cmp word [ebp - 4], ax
jne 0x1003faf0
cmp esi, ebx
je 0x1003faa6
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1003db65
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1003fb37
push 0xd
pop eax
jmp 0x1003faa6
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
mov edi, dword [eax*4 + 0x100657e0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x1003fb31
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x1003fb37
mov word [esi], dx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10042080
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x1004209a
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x100420b1
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x10042109
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.10046e9c
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x10042109
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10042109
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10042109
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x10042103
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x10042105
xor bl, bl
mov al, bl
jmp 0x1004210b
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x10044e9a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10044f37
push ebx
push esi
call fcn.10044e63
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10044df9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10044ee4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10044f36
push edi
push eax
call fcn.10042680
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10044f04
call fcn.10040700
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10044f35
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10044df9
add esp, 0x20
test eax, eax
jne 0x10044f23
push edi
call fcn.10040700
jmp 0x10044f2b
push ebx
call fcn.10040700
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10048fd8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1003dfed
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10049047
cmp esi, dword [ebp - 4]
je 0x10049042
cmp dword [ebp + 0xc], 0
je 0x10049042
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1004901f
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10048b2d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10049049
xor eax, eax
inc eax
jmp 0x10049049
xor eax, eax
pop edi
pop esi
leave
ret