joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f3a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
cmp word [esp + 0x44], 0x24
jb 0x1002f579
mov eax, dword [esp + 0x4c]
cmp word [eax], 0x10
jb 0x1002f579
push esi
lea ecx, [eax + 3]
push edi
lea eax, [esp + 0xa]
mov esi, 2
jmp 0x1002f3d0
movzx edx, byte [ecx - 1]
mov edi, edx
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
mov word [eax], dx
movzx edx, byte [ecx]
mov word [eax - 2], di
mov edi, edx
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
mov word [eax + 4], dx
movzx edx, byte [ecx + 1]
mov word [eax + 2], di
mov edi, edx
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
mov word [eax + 8], dx
movzx edx, byte [ecx + 2]
mov word [eax + 6], di
mov edi, edx
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
mov word [eax + 0xc], dx
movzx edx, byte [ecx + 3]
mov word [eax + 0xa], di
mov edi, edx
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
mov word [eax + 0x10], dx
movzx edx, byte [ecx + 4]
mov word [eax + 0xe], di
mov edi, edx
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
mov word [eax + 0x14], dx
movzx edx, byte [ecx + 5]
mov word [eax + 0x12], di
mov edi, edx
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
mov word [eax + 0x18], dx
movzx edx, byte [ecx + 6]
mov word [eax + 0x16], di
mov edi, edx
shr edi, 4
mov di, word [edi*2 + str.0123456789abcdef]
and edx, 0xf
mov dx, word [edx*2 + str.0123456789abcdef]
mov word [eax + 0x1a], di
mov word [eax + 0x1c], dx
add ecx, 8
add eax, 0x20
dec esi
jne 0x1002f3d0
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 8]
lea ecx, [eax + 2]
mov dword [ecx], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x14]
mov dword [ecx + 0xc], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x1e], edx
mov edx, dword [esp + 0x24]
mov ecx, 0x2d
mov dword [eax + 0x22], edx
mov edx, dword [esp + 0x28]
mov word [eax + 0x12], cx
mov word [eax + 0x1c], cx
mov word [eax + 0x26], cx
mov word [eax + 0x30], cx
lea edi, [eax + 0x32]
mov dword [eax + 0x28], edx
mov edx, dword [esp + 0x2c]
mov ecx, 6
lea esi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [eax + 0x2c], edx
mov word [eax], 0x24
xor al, al
pop esi
add esp, 0x40
ret 0xc
call fcn.1001d680
mov al, 1
add esp, 0x40
ret 0xc
Function at 0x1003e080
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1003def7
cmp word [eax + 8], 0
jbe 0x1003def7
mov word [ecx], 0x5d
add dword [eax + 4], 2
dec word [eax + 8]
ret
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, byte [ebx + 6]
mov edx, dword [eax*4 + 0x1008a4e8]
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
call fcn.1003df00
movzx eax, byte [ebx + 6]
cmp eax, 0x12
ja case.default.0x1003e0ad
movzx ecx, byte [eax + 0x1003e23c]
push esi
jmp dword [ecx*4 + 0x1003e210]
mov edx, dword [ebx + 8]
push edx
push edi
call fcn.1003e080
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebx
jmp 0x1003dee0
mov eax, dword [ebx + 0xc]
push eax
push edi
call fcn.1003e080
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebx
jmp 0x1003dee0
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov cx, word [ebx + 0x14]
mov esi, edi
push ecx
call fcn.1003e010
add esp, 4
pop esi
pop edi
pop ebx
ret
movzx edx, word [ebx + 0xa]
mov eax, dword [edi]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx]
test edx, edx
je case.0x1003e0ad.10
mov eax, dword [edi + 4]
test eax, eax
je 0x1003e120
cmp word [edi + 8], 0
jbe 0x1003e120
mov word [eax], 0x28
add dword [edi + 4], 2
dec word [edi + 8]
mov eax, edi
call fcn.1003df90
mov eax, dword [edi + 4]
test eax, eax
je 0x1003e142
cmp word [edi + 8], 0
jbe 0x1003e142
mov word [eax], 0x2c
add dword [edi + 4], 2
dec word [edi + 8]
mov si, word [ebx + 0xc]
mov dx, word [ebx + 0xa]
mov eax, edi
call fcn.1003dfd0
mov eax, dword [edi + 4]
test eax, eax
je 0x1003e16c
cmp word [edi + 8], 0
jbe 0x1003e16c
mov word [eax], 0x29
add dword [edi + 4], 2
dec word [edi + 8]
pop esi
pop edi
pop ebx
ret
mov edx, dword [ebx + 0xc]
push edx
push edi
call fcn.1003e080
mov eax, edi
call fcn.1003dec0
mov eax, dword [ebx + 0x10]
push eax
push edi
call fcn.1003e080
add esp, 0x10
pop esi
mov eax, edi
pop edi
pop ebx
jmp 0x1003dee0
mov ecx, dword [ebx + 0xc]
push ecx
push edi
call fcn.1003e080
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebx
jmp 0x1003dee0
mov edx, dword [ebx + 0x14]
push edx
push edi
call fcn.1003e080
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebx
jmp 0x1003dee0
xor eax, eax
mov ax, word [ebx + 8]
mov esi, edi
push eax
mov eax, dword [ebx + 0x10]
call fcn.1003e010
add esp, 4
pop esi
pop edi
pop ebx
ret
mov ecx, dword [ebx + 0x10]
push ecx
push edi
call fcn.1003e080
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebx
jmp 0x1003dee0
mov edx, dword [ebx + 0x10]
push edx
push edi
call fcn.1003e080
add esp, 8
pop esi
mov eax, edi
pop edi
pop ebx
jmp 0x1003dee0
Function at 0x1003f790
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1003f8c8
movzx ecx, byte [esi + 6]
push ebx
push ebp
push edi
xor eax, eax
xor ebx, ebx
xor ebp, ebp
xor edi, edi
cmp ecx, 0x12
ja case.0x1003f7bc.1
movzx ecx, byte [ecx + 0x1003f8f8]
jmp dword [ecx*4 + 0x1003f8cc]
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi + 0x10]
mov edi, 0x1c
jmp 0x1003f8a2
mov edx, dword [esi + 0x34]
push edx
call fcn.10045440
mov eax, dword [esi + 0x28]
push eax
call fcn.10045440
mov eax, dword [esi + 0x2c]
mov edi, 0x38
jmp case.0x1003f7bc.1
mov ecx, dword [esi + 0x28]
push ecx
call fcn.10045440
mov edx, dword [esi + 0x30]
push edx
call fcn.10045440
mov eax, dword [esi + 0x34]
push eax
call fcn.10045440
mov eax, dword [esi + 0x2c]
mov edi, 0x38
jmp case.0x1003f7bc.1
mov ecx, dword [esi + 0x18]
push ecx
call fcn.10045440
mov edx, dword [esi + 0x1c]
push edx
call fcn.10045440
mov eax, dword [esi + 0x20]
push eax
call fcn.10045440
mov ecx, dword [esi + 0x24]
push ecx
call fcn.10045440
mov edx, dword [esi + 0x28]
push edx
call fcn.10045440
mov eax, dword [esi + 0x2c]
push eax
call fcn.10045440
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 8]
mov edi, 0x38
jmp case.0x1003f7bc.1
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov edi, 0x14
jmp case.0x1003f7bc.1
mov eax, dword [esi + 0x10]
mov edi, 0x14
jmp case.0x1003f7bc.1
mov ecx, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
push ecx
call fcn.10045440
mov edx, dword [esi + 0x1c]
push edx
call fcn.10045440
mov edi, 0x20
jmp 0x1003f8a2
mov ebx, dword [esi + 0xc]
mov edi, 0x10
jmp case.0x1003f7bc.1
mov ebx, dword [esi + 0x14]
mov edi, 0x24
mov eax, dword [esi + 0x18]
push eax
call fcn.10045440
push ebx
call fcn.1003f790
push ebp
call fcn.1003f790
test di, di
pop edi
pop ebp
pop ebx
je 0x1003f8c8
push esi
call fcn.1005abf0
add esp, 4
pop esi
ret 4

Function at 0x1003fed0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
movzx eax, byte [esi + 6]
cmp eax, 0x12
ja case.default.0x1003fef7
push ebx
mov ebx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
lea esp, [esp]
movzx eax, byte [eax + 0x1003ff94]
jmp dword [eax*4 + 0x1003ff78]
mov ecx, dword [esi + 0xc]
push ebx
push ecx
push edi
call fcn.1003fed0
mov esi, dword [esi + 0x10]
add esp, 0xc
jmp 0x1003ff49
mov edx, dword [esi + 0xc]
push ebx
push edx
push edi
call fcn.1003fed0
mov esi, dword [esi + 0x10]
add esp, 0xc
jmp 0x1003ff49
mov eax, dword [esi + 0x28]
call fcn.1003feb0
mov esi, dword [esi + 8]
jmp 0x1003ff49
mov eax, dword [esi + 0x14]
call fcn.1003feb0
mov eax, dword [esi + 0x18]
call fcn.1003feb0
mov esi, dword [esi + 0x10]
jmp 0x1003ff49
mov esi, dword [esi + 0xc]
movzx eax, byte [esi + 6]
cmp eax, 0x12
jbe 0x1003fef0
pop edi
pop ebx
pop esi
ret
mov ecx, dword [edi + 0x40]
movzx eax, word [esi + 4]
add eax, dword [ecx + 0x14]
test bl, bl
push eax
je 0x1003ff6e
call sym.ulrtw9.dll__ULTableUseSupplyNulls_4
pop edi
pop ebx
pop esi
ret
call sym.ulrtw9.dll__ULTableUseSupplyNonNulls_4
pop edi
pop ebx
pop esi
ret
Function at 0x100446f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
mov cl, byte [eax]
cmp cl, 0xc
je 0x10044700
cmp cl, 0x15
jne 0x10044705
mov eax, dword [eax + 8]
jmp 0x100446f4
movzx ecx, byte [eax]
add ecx, 0xfffffffe
cmp ecx, 0x13
ja case.0x10044717.3
movzx ecx, byte [ecx + 0x10044744]
jmp dword [ecx*4 + 0x10044738]
test byte [eax + 2], 8
jne case.0x10044717.3
mov dword [esp + 8], eax
jmp fcn.10045900
mov dword [esp + 8], eax
jmp fcn.10044670

Function at 0x1004f8c0
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [0x10090b28]
test al, al
jne 0x1004f8fc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
call fcn.10029900
mov eax, dword [esp + 0x18]
mov ax, word [eax + 6]
mov ecx, dword [esp + 0x10]
movzx edx, ax
mov word [ecx + 0x48], ax
mov eax, dword [0x10090b30]
add esp, 0xc
inc edx
mov dword [eax + 0x70], edx
xor al, al
ret 0x14

Function at 0x1004f910
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [eax]
mov al, byte [0x10090b28]
test al, al
jne 0x1004f94f
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.10029900
mov ecx, dword [esp + 0x1c]
mov ax, word [ecx + 6]
movzx edx, ax
mov word [esi + 0x48], ax
mov eax, dword [0x10090b30]
add esp, 0xc
inc edx
mov dword [eax + 0x70], edx
xor al, al
pop esi
ret 0x14

Function at 0x1004fa50
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [0x10090b28]
test al, al
jne 0x1004fa94
movzx eax, word [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.10029ad0
mov ecx, dword [esp + 0x1c]
mov ax, word [ecx + 6]
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
movzx edx, ax
mov word [ecx + 0x48], ax
mov eax, dword [0x10090b30]
add esp, 0x10
inc edx
mov dword [eax + 0x70], edx
xor al, al
ret 0x18
Function at 0x100548f0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0x10]
movzx ecx, byte [esi + 6]
add ecx, 0xfffffffe
xor al, al
cmp ecx, 0x10
ja case.default.0x10054911
movzx ecx, byte [ecx + 0x10054a10]
push ebx
push ebp
push edi
jmp dword [ecx*4 + 0x100549f8]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov edx, dword [esi + 0xc]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edi
push ebx
push edx
push ebp
push eax
call fcn.100548f0
add esp, 0x14
test al, al
je 0x1005495b
mov ecx, dword [esi + 0x10]
mov edx, dword [esp + 0x14]
push edi
push ebx
push ecx
push ebp
push edx
call fcn.100548f0
add esp, 0x14
test al, al
je 0x1005495b
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
ret
pop edi
pop ebp
pop ebx
xor al, al
pop esi
ret
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov eax, dword [esi + 0xc]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edi
push ebx
push eax
push ebp
push ecx
call fcn.100548f0
add esp, 0x14
test al, al
je 0x1005495b
mov edx, dword [esi + 0x10]
mov eax, dword [esp + 0x14]
push edi
push ebx
push edx
push ebp
push eax
jmp 0x10054948
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
call fcn.100548f0
add esp, 0x14
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push eax
push ecx
push esi
mov esi, dword [esp + 0x20]
push edx
call fcn.10053e20
add esp, 0x10
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.10053f50
add esp, 8
pop edi
pop ebp
pop ebx
pop esi
ret
int3
Function at 0x10057db0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [edx]
test ebx, ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
je 0x10057eb5
mov esi, ebx
push esi
mov edi, esi
call fcn.10044650
mov esi, eax
cmp byte [esi], 8
jne 0x10057de4
mov esi, dword [esi + 8]
cmp edi, esi
jne 0x10057dd2
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x18]
mov ebp, dword [ecx + 0x18]
test ebp, ebp
mov dword [esp + 0x10], 0
je 0x10057e9d
mov eax, ebp
push eax
mov edi, eax
call fcn.10044650
cmp byte [eax], 8
jne 0x10057e14
mov eax, dword [eax + 8]
cmp edi, eax
jne 0x10057e04
mov edx, dword [esp + 0x14]
push eax
push esi
push edx
call fcn.10044f30
test al, al
jne 0x10057e3a
mov ecx, dword [esp + 0x10]
mov ebp, dword [ebp + 0xc]
inc ecx
test ebp, ebp
mov dword [esp + 0x10], ecx
jne 0x10057e02
jmp 0x10057e9d
mov eax, dword [ebx + 8]
cmp byte [eax], 8
lea esi, [ebx + 8]
jne 0x10057e48
lea esi, [eax + 8]
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
movzx edx, cx
push ecx
mov ecx, dword [eax + edx*4]
mov edx, dword [edi + 4]
push ecx
push edx
call fcn.10052c70
test al, al
je 0x10057ebf
mov eax, dword [edi + 4]
push eax
call fcn.100447b0
mov byte [eax], 0x13
mov byte [eax + 1], 0
mov ecx, dword [esi]
mov dx, word [ecx + 6]
mov cl, byte [eax + 2]
push eax
and cl, 0x7f
push esi
mov word [eax + 6], dx
mov byte [eax + 2], cl
call fcn.100455a0
and byte [ebx + 2], 0x7f
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov ebx, dword [eax + 0xc]
add eax, 0xc
test ebx, ebx
mov dword [esp + 0x20], eax
jne 0x10057dd0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret

Function at 0x10058510
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 4]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esi]
push edi
call fcn.10044780
test al, al
je 0x100585da
add ebp, 0x14
mov dword [esi], 0
mov esi, dword [ebp]
test esi, esi
mov dword [esp + 0x14], 0
je 0x10058566
push esi
push edi
push ebx
call fcn.10044f30
test al, al
jne 0x10058584
mov ecx, dword [esp + 0x14]
lea ebp, [esi + 0xc]
mov esi, dword [ebp]
inc ecx
test esi, esi
mov dword [esp + 0x14], ecx
jne 0x10058547
push 0x29
push ebx
mov dword [ebx + 8], edi
call fcn.10045dd0
test al, al
je 0x100585e1
push ebx
call fcn.100447b0
or byte [eax + 2], 0x80
mov dword [ebp], eax
jmp 0x1005858c
push edi
call fcn.10045440
mov edi, esi
push 0x10
call fcn.1005ac20
add esp, 4
test eax, eax
je 0x100585e1
mov cx, word [esp + 0x14]
mov dword [eax + 8], 0
mov word [eax + 0xc], cx
mov byte [eax], 0x13
mov byte [eax + 1], 0
mov byte [eax + 2], 0
mov dl, byte [edi + 3]
mov byte [eax + 3], dl
mov cx, word [edi + 4]
mov word [eax + 4], cx
mov dx, word [edi + 6]
mov word [eax + 6], dx
push ebx
mov dword [ebx + 8], eax
call fcn.100447b0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x1005aae0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push 0
lea eax, [esp + 8]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005ab0d
cmp dword [esp + 4], esi
jne 0x1005ab0d
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret

Function at 0x1005ab20
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push 0
lea eax, [esp + 8]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1005ab4d
cmp dword [esp + 4], esi
jne 0x1005ab4d
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret
Function at 0x1006ddf0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20
cmp eax, 0x80
je 0x1006de12
cmp eax, 0xc0
je 0x1006de12
cmp eax, 0x100
je 0x1006de12
xor eax, eax
add esp, 0x20
ret
cdq
push ebx
and edx, 0x1f
add eax, edx
push ebp
sar eax, 5
add eax, 6
push esi
push edi
mov edi, dword [esp + 0x34]
lea ecx, [eax - 6]
mov dword [edi], eax
lea eax, [ecx - 1]
test eax, eax
jl 0x1006de4e
mov edx, dword [esp + 0x38]
lea esi, [esp + 0x10]
sub edx, esi
lea esp, [esp]
lea esi, [edx + eax*4]
dec eax
mov esi, dword [esp + esi + 0x10]
mov dword [esp + eax*4 + 0x14], esi
jns 0x1006de40
xor esi, esi
xor edx, edx
xor eax, eax
test ecx, ecx
jle 0x1006de85
mov ebx, dword [edi]
inc ebx
cmp esi, ebx
jge 0x1006de85
cmp eax, ecx
jge 0x1006de79
cmp edx, 4
jge 0x1006de7c
mov ebp, dword [esp + eax*4 + 0x10]
lea ebx, [edx + esi*4]
inc eax
inc edx
cmp eax, ecx
mov dword [edi + ebx*4 + 4], ebp
jl 0x1006de63
cmp edx, 4
jne 0x1006de81
inc esi
xor edx, edx
cmp eax, ecx
jl 0x1006de58
mov eax, dword [edi]
inc eax
cmp esi, eax
jge 0x1006dfed
mov dword [esp + 0x3c], 0x1008c550
jmp 0x1006dea0
movzx ebx, byte [esp + ecx*4 + 0xd]
mov al, byte [esp + 0x10]
xor al, byte [ebx + str.cw]
mov byte [esp + 0x10], al
movzx ebx, byte [esp + ecx*4 + 0xe]
mov bl, byte [ebx + str.cw]
xor byte [esp + 0x11], bl
movzx ebx, byte [esp + ecx*4 + 0xf]
mov bl, byte [ebx + str.cw]
xor byte [esp + 0x12], bl
movzx ebx, byte [esp + ecx*4 + 0xc]
mov bl, byte [ebx + str.cw]
xor byte [esp + 0x13], bl
mov ebx, dword [esp + 0x3c]
xor al, byte [ebx]
inc ebx
cmp ecx, 8
mov byte [esp + 0x10], al
mov dword [esp + 0x3c], ebx
mov eax, 1
je 0x1006df20
cmp ecx, eax
jle 0x1006dfa4
mov ebp, dword [esp + eax*4 + 0x10]
mov ebx, dword [esp + eax*4 + 0xc]
xor ebp, ebx
mov dword [esp + eax*4 + 0x10], ebp
inc eax
cmp eax, ecx
jl 0x1006df01
jmp 0x1006dfa4
mov ebp, dword [esp + eax*4 + 0x10]
mov ebx, dword [esp + eax*4 + 0xc]
xor ebp, ebx
mov dword [esp + eax*4 + 0x10], ebp
inc eax
cmp eax, 4
jl 0x1006df20
movzx eax, byte [esp + 0x1c]
mov al, byte [eax + str.cw]
mov bl, byte [esp + 0x20]
xor bl, al
movzx eax, byte [esp + 0x1d]
mov al, byte [eax + str.cw]
mov byte [esp + 0x20], bl
mov bl, byte [esp + 0x21]
xor bl, al
movzx eax, byte [esp + 0x1e]
mov al, byte [eax + str.cw]
mov byte [esp + 0x21], bl
mov bl, byte [esp + 0x22]
xor bl, al
movzx eax, byte [esp + 0x1f]
mov al, byte [eax + str.cw]
mov byte [esp + 0x22], bl
xor byte [esp + 0x23], al
mov eax, 5
jmp 0x1006df90
mov ebp, dword [esp + eax*4 + 0x10]
mov ebx, dword [esp + eax*4 + 0xc]
xor ebp, ebx
mov dword [esp + eax*4 + 0x10], ebp
inc eax
cmp eax, 8
jl 0x1006df90
xor eax, eax
test ecx, ecx
jle 0x1006dfe2
lea ebx, [ebx]
mov ebx, dword [edi]
inc ebx
cmp esi, ebx
jge 0x1006dfe2
cmp eax, ecx
jge 0x1006dfd6
jmp 0x1006dfc0
cmp edx, 4
jge 0x1006dfd9
mov ebp, dword [esp + eax*4 + 0x10]
lea ebx, [edx + esi*4]
inc eax
inc edx
cmp eax, ecx
mov dword [edi + ebx*4 + 4], ebp
jl 0x1006dfc0
cmp edx, 4
jne 0x1006dfde
inc esi
xor edx, edx
cmp eax, ecx
jl 0x1006dfb0
mov eax, dword [edi]
inc eax
cmp esi, eax
jl 0x1006dea0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x1006e860
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], 0
mov byte [esp + 0x13], 0
mov eax, dword [esi]
push 0
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, ebp
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
je 0x1006e8bb
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006e8bb
cmp dword [esp + 0x14], edi
je 0x1006e8d2
lea eax, [esp + 0x13]
push eax
call fcn.1006e580
add esp, 4
test al, al
je 0x1006e8dc
inc byte [esp + 0x13]
jmp 0x1006e884
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret

Function at 0x1006e8f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], 0
mov byte [esp + 0x13], 0
mov eax, dword [esi]
push 0
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, ebp
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
je 0x1006e94b
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006e94b
cmp dword [esp + 0x14], edi
je 0x1006e962
lea eax, [esp + 0x13]
push eax
call fcn.1006e580
add esp, 4
test al, al
je 0x1006e96c
inc byte [esp + 0x13]
jmp 0x1006e914
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret

Function at 0x1006e9d0
Capabilities:
Get file size

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
mov byte [esp + 0x13], 0
call edi
cmp eax, 0xffffffff
jne 0x1006ea11
mov edi, edi
lea ecx, [esp + 0xb]
push ecx
call fcn.1006e580
add esp, 4
test al, al
je 0x1006ea1d
inc byte [esp + 0xb]
mov edx, dword [esi]
push 0
push edx
call edi
cmp eax, 0xffffffff
je 0x1006e9f0
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], eax
mov al, 1
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x1007048f
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x1007057c
mov eax, 0x94
call fcn.1006ee30
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100705f1
mov ecx, dword [esi + 0x10]
mov dword [0x10090b7c], ecx
mov eax, dword [esi + 4]
mov dword [0x10090b88], eax
mov edx, dword [esi + 8]
mov dword [0x10090b8c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x10090b80], esi
je 0x100704fa
or esi, 0x8000
mov dword [0x10090b80], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x10090b84], eax
call fcn.10073079
test eax, eax
pop ecx
je 0x100705f1
call fcn.10070ee7
test eax, eax
jne 0x10070527
call fcn.100730ca
jmp 0x100705f1
call fcn.10074d35
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1009135c], eax
call fcn.10074c13
mov dword [0x10090b64], eax
call fcn.100746f4
test eax, eax
jl 0x10070575
call fcn.10074b71
test eax, eax
jl 0x10070570
call fcn.1007493e
test eax, eax
jl 0x10070570
call fcn.1007087f
test eax, eax
jne 0x10070570
inc dword [0x10090b60]
jmp 0x10070602
call fcn.100748f2
call fcn.10070cda
jmp 0x1007051d
test eax, eax
jne 0x100705ac
cmp dword [0x10090b60], eax
jle 0x100705f1
dec dword [0x10090b60]
cmp dword [0x10090bb8], eax
jne 0x1007059b
call fcn.100709c8
call fcn.100748f2
call fcn.10070cda
call fcn.100730ca
jmp 0x10070602
cmp eax, 2
jne 0x100705f5
push 0x88
push 1
call fcn.10074639
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x100705f1
push esi
push dword [0x1008c924]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x100705eb
call fcn.10070cf8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10070602
call fcn.1006fe69
pop ecx
xor eax, eax
jmp 0x10070605
cmp eax, 3
jne 0x10070602
push 0
call fcn.10070d7c
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc