joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021909
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push ebx
lea ebx, [edx + eax - 0x21524111]
push esi
mov eax, ebx
push edi
mov esi, ebx
mov dword [ebp - 4], eax
cmp edx, 0xc
jbe 0x100219fb
lea eax, [edx - 0xd]
push 0xc
xor edx, edx
pop edi
div edi
inc eax
mov dword [ebp - 8], eax
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
movzx edi, byte [ecx + 4]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
add edi, esi
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 0xa]
shl eax, 8
add edi, eax
movzx eax, byte [ecx + 0xb]
movzx esi, byte [ecx + 3]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, ebx
movzx ebx, byte [ecx + 2]
shl esi, 8
add esi, ebx
movzx ebx, byte [ecx + 1]
shl esi, 8
add esi, ebx
movzx ebx, byte [ecx]
shl esi, 8
add esi, ebx
shl eax, 8
add eax, edx
sub esi, eax
add esi, dword [ebp - 4]
mov edx, eax
rol edx, 4
xor edx, esi
add eax, edi
sub edi, edx
mov esi, edx
rol esi, 6
xor esi, edi
add edx, eax
sub eax, esi
mov edi, esi
add esi, edx
rol edi, 8
xor edi, eax
sub edx, edi
mov eax, edi
rol eax, 0x10
xor eax, edx
add edi, esi
sub esi, eax
mov edx, eax
ror edx, 0xd
xor esi, edx
mov edx, dword [ebp + 8]
add eax, edi
mov ebx, esi
sub edi, esi
rol ebx, 4
sub edx, 0xc
xor ebx, edi
add esi, eax
add ecx, 0xc
dec dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edx
jne 0x10021939
cmp edx, 0xc
ja 0x10021a64
jmp dword [edx*4 + 0x110eb5]
xor ebx, esi
mov ecx, esi
rol ecx, 0xe
sub ebx, ecx
mov edx, ebx
rol edx, 0xb
mov ecx, ebx
xor ecx, eax
sub ecx, edx
xor esi, ecx
mov eax, ecx
ror eax, 7
sub esi, eax
xor ebx, esi
mov eax, esi
rol eax, 0x10
sub ebx, eax
mov eax, ebx
mov edi, eax
mov edx, eax
xor edx, ecx
rol edi, 4
sub edx, edi
mov ecx, edx
rol ecx, 0xe
xor esi, edx
sub esi, ecx
mov ecx, esi
ror ecx, 8
xor eax, esi
sub eax, ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10022088
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [0x11507c]
push edi
call esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x9c0], 0x270
jl 0x10022181
call esi
xor esi, esi
lea edx, [edi + esi*4 + 0x634]
mov eax, dword [edx - 0x630]
lea ecx, [edi + esi*4]
xor eax, dword [ecx]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x11f02c]
xor eax, dword [edx]
inc esi
mov dword [ecx], eax
cmp esi, 0xe3
jl 0x100220b0
mov dword [ebp + 8], esi
cmp esi, 0x26f
jge 0x1002214b
jmp 0x100220f4
mov esi, dword [ebp + 8]
mov ebx, esi
lea eax, [edi + ebx*4 - 0x38c]
mov esi, dword [eax + 0x390]
xor esi, dword [edi + ebx*4]
push 9
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
push 0x115578
push 0
and esi, 0x7fffffff
xor esi, dword [edi + ebx*4]
push 0
call dword [0x115074]
mov eax, esi
and eax, 1
shr esi, 1
xor esi, dword [eax*4 + 0x11f02c]
mov eax, dword [ebp - 4]
xor esi, dword [eax]
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x26f
mov dword [edi + ebx*4], esi
jl 0x100220f1
mov eax, dword [edi + 0x9bc]
xor eax, dword [edi]
and eax, 0x7fffffff
xor eax, dword [edi + 0x9bc]
mov ecx, eax
and ecx, 1
mov ecx, dword [ecx*4 + 0x11f02c]
xor ecx, dword [edi + 0x630]
shr eax, 1
xor ecx, eax
and dword [edi + 0x9c0], 0
mov dword [edi + 0x9bc], ecx
mov eax, dword [edi + 0x9c0]
mov ebx, dword [edi + eax*4]
inc eax
mov dword [edi + 0x9c0], eax
mov eax, ebx
shr eax, 0xb
push 0x115568
xor ebx, eax
call dword [0x115064]
cmp eax, 0x1f
jbe 0x100221ab
push 0x1f
pop eax
mov edi, eax
shr edi, 2
xor esi, esi
test edi, edi
je 0x100221cd
test esi, esi
je 0x100221c0
call dword [0x115088]
cmp esi, 0x22db
ja 0x100221cd
inc esi
cmp esi, edi
jb 0x100221b6
mov eax, ebx
and eax, 0xff3a58ad
shl eax, 7
xor ebx, eax
mov eax, ebx
and eax, 0xffffdf8c
shl eax, 0xf
xor ebx, eax
mov eax, ebx
pop edi
shr eax, 0x12
pop esi
xor eax, ebx
pop ebx
leave
ret

Function at 0x100221f1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x1c
mov dword [esi], eax
push 0x115588
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x5a
call dword [0x115068]
mov dword [esi + 0x9c0], 1
mov ecx, dword [esi + 0x9c0]
lea eax, [esi + ecx*4]
mov edx, dword [eax - 4]
mov edi, edx
shr edi, 0x1e
xor edi, edx
imul edi, edi, 0x6c078965
add edi, ecx
mov dword [eax], edi
inc dword [esi + 0x9c0]
cmp dword [esi + 0x9c0], 0x270
jl 0x10022223
pop edi
pop esi
leave
ret
Function at 0x10019c10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100453bb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1005ae50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
fldz
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
fstp qword [esi + 0x20]
xor ebx, ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
push 0x3c0
mov dword [esi + 0x34], eax
lea eax, [esi + 0x40]
push ebx
push eax
call fcn.10032630
xor eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov byte [esi + 0x28], 0x63
mov dword [esi + 0x74], 1
mov dword [esi + 0x37c], 0xffffff9c
mov ecx, dword [str.dummy]
mov dword [esi + 0x7c], ecx
mov dx, word [0x1004795c]
mov word [esi + 0x80], dx
mov byte [esi + 0x400], bl
mov dword [esi + 0x428], ebx
mov byte [esi + 0x430], bl
mov byte [esi + 0x431], bl
mov dword [esi + 0x404], ebx
mov dword [esi + 0x408], 8
mov dword [esi + 0x40c], 3
mov byte [esi + 0x410], bl
mov dword [esi + 0x414], eax
mov dword [esi + 0x418], eax
mov dword [esi + 0x41c], eax
mov dword [esi + 0x420], eax
push 0x1c
mov byte [esi + 0x424], bl
mov byte [esi + 0x425], bl
mov dword [esi + 0x448], ebx
mov dword [esi + 0x44c], ebx
mov dword [esi + 0x450], ebx
mov dword [ebp - 4], ebx
call fcn.100318d4
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x24], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x10019d33
call fcn.1002fc00
jmp 0x10019d35
xor eax, eax
cmp eax, ebx
mov byte [ebp - 4], bl
mov dword [esi + 0x438], eax
jne 0x10019d57
push 0x1004e9b0
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x3a98
call fcn.100317ab
mov ecx, esi
mov dword [esi + 0x440], ebx
mov dword [esi + 0x444], ebx
call fcn.10018940
cmp eax, ebx
je 0x10019d7f
push 0x1004e9b0
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], eax
call fcn.100317ab
mov ecx, esi
call fcn.100189f0
cmp eax, ebx
je 0x10019d9b
push 0x1004e9b0
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], eax
call fcn.100317ab
mov byte [esi + 0x454], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002afa0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x98
push 0xffffffffffffffff
push 0x100464c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1005ae50]
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0xa4]
mov edi, dword [ebp + 0xac]
mov esi, dword [ebp + 0xa8]
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], eax
je 0x1002b10f
cmp dword [esi], eax
je 0x1002b10f
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp]
push eax
mov dword [ebp], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp + 0x10], 2
jne 0x1002b0e4
cmp dword [ebp + 4], 6
jb 0x1002b0e4
cmp dword [ebp + 0xa0], 1
jne 0x1002b0e4
mov ecx, dword [esi + 0xc]
push 4
push 3
push ecx
call fcn.1002a2e0
mov ecx, eax
mov eax, 0x100000
cdq
idiv ecx
add esp, 0xc
mov ebx, eax
add ebx, 1
xor edi, edi
mov eax, dword [esi + 0x10]
cmp edi, eax
jge 0x1002b10a
sub eax, edi
cmp eax, ebx
mov dword [ebp - 0x18], eax
jl 0x1002b079
mov dword [ebp - 0x18], ebx
mov edx, dword [esi + 0xc]
push 4
push 3
push edx
call fcn.1002a2e0
imul eax, edi
add eax, dword [esi]
mov edx, dword [ebp - 0x18]
add esp, 0xc
push 0
lea ecx, [esi + 8]
push ecx
mov ecx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x10]
push edx
push edi
push 0
push 0
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
mov ecx, dword [ebp - 0x24]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
add dword [ebp - 0x1c], eax
add edi, ebx
jmp 0x1002b062
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
push 0
lea ecx, [esi + 8]
push ecx
mov ecx, dword [edi + 4]
push edx
mov edx, dword [edi]
push eax
push 0
push 0
push 0
push eax
mov eax, dword [esi + 0xc]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
mov eax, dword [ebp - 0x14]
jmp 0x1002b114
mov eax, 0x3c8c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.10031d05
add ebp, 0x98
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100302d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046b80
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1005ae50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
cmp byte [edi + 0x20c], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
je 0x1003031e
cmp dword [edi + 0x208], ebx
lea esi, [edi + 0x208]
jne 0x10030352
push 2
lea eax, [edi + 4]
push 0x80000000
push eax
call fcn.10030210
add esp, 0xc
cmp eax, ebx
lea esi, [edi + 0x208]
mov dword [esi], eax
jne 0x10030352
push 0x10055b64
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], 0x1772
call fcn.100317ab
mov edx, dword [esi]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x18], ebx
jne 0x1003036d
mov dword [ebp - 0x14], 0x1772
cmp byte [edi + 0x20c], 0
jne 0x100303a8
push esi
call fcn.10030250
add esp, 4
test al, al
jne 0x100303a8
push 0x10055b64
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x1772
call fcn.100317ab
mov dword [ebp - 0x14], 0x1772
mov eax, 0x100303a5
ret
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100303d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1005ae50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x14], ebx
jne 0x10030420
mov eax, 0x17d4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [edi + 0x20c], 0
mov dword [ebp - 4], ebx
je 0x1003043a
cmp dword [edi + 0x208], ebx
lea esi, [edi + 0x208]
jne 0x1003046e
push 2
lea eax, [edi + 4]
push 0x80000000
push eax
call fcn.10030210
add esp, 0xc
cmp eax, ebx
lea esi, [edi + 0x208]
mov dword [esi], eax
jne 0x1003046e
push 0x10055b64
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], 0x1772
call fcn.100317ab
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
push ebx
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 8]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10030490
cmp ebx, dword [ebp - 0x18]
je 0x10030497
mov dword [ebp - 0x14], 0x1772
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100304a3
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
cmp byte [edi + 0x20c], 0
jne 0x100304db
push esi
call fcn.10030250
add esp, 4
test al, al
jne 0x100304db
push 0x10055b64
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x1772
call fcn.100317ab
mov dword [ebp - 0x14], 0x1772
mov eax, 0x100304db
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10030500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1005ae50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x14], edi
mov dword [esi], edi
jne 0x10030555
mov eax, 0x17d4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
lea edx, [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
push eax
mov eax, dword [ecx + 0x208]
push eax
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
jne 0x100305d1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x27
je 0x1003059f
call esi
cmp eax, 0x70
je 0x1003059f
push 0x1004e9b0
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], 0x1772
call fcn.100317ab
push 0x1004e9b0
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 0x17e4
call fcn.100317ab
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, 0x100305c0
ret
mov ecx, dword [ebp + 0xc]
mov dword [esi], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10030660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov al, 1
jne 0x10030677
mov al, bl
pop ebx
ret

Function at 0x10030800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10030743
xor al, al
ret
shr al, 4
and al, 1
ret
jmp 0x10030730

Function at 0x10031d05
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005ae50]
jne 0x10031d0f
repz ret
jmp fcn.10035a9c
Function at 0x1003884b
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1005b680]
je 0x10038866
inc edi
cmp edi, 0x17
jb 0x10038857
cmp edi, 0x17
jae 0x100389e6
push ebp
push 3
call fcn.1003f65b
cmp eax, 1
pop ecx
je 0x100389b2
push 3
call fcn.1003f65b
test eax, eax
pop ecx
jne 0x1003889a
cmp dword [0x1005cb94], 1
je 0x100389b2
cmp ebx, 0xfc
je 0x100389e5
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1005cf28
push ebp
call fcn.100339da
add esp, 0xc
test eax, eax
je 0x100388d0
push esi
push esi
push esi
push esi
push esi
call fcn.100323cf
add esp, 0x14
push 0x104
mov esi, 0x1005cf41
push esi
push 0
mov byte [0x1005d045], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10038914
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.100339da
add esp, 0xc
test eax, eax
je 0x10038914
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.100323cf
add esp, 0x14
push esi
call fcn.10033f90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10038959
push esi
call fcn.10033f90
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1005d23c
push 0x1004912c
sub ecx, eax
push ecx
push eax
call fcn.100316f3
add esp, 0x14
test eax, eax
je 0x10038959
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.100323cf
add esp, 0x14
jmp 0x1003895b
xor esi, esi
push 0x10049128
push ebx
push ebp
call fcn.1003e260
add esp, 0xc
test eax, eax
je 0x1003897b
push esi
push esi
push esi
push esi
push esi
call fcn.100323cf
add esp, 0x14
push dword [edi*8 + 0x1005b684]
push ebx
push ebp
call fcn.1003e260
add esp, 0xc
test eax, eax
je 0x1003899d
push esi
push esi
push esi
push esi
push esi
call fcn.100323cf
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1003f49e
add esp, 0xc
jmp 0x100389e5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100389e5
cmp ebp, 0xffffffff
je 0x100389e5
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1005b684]
push dword [esi]
call fcn.10033f90
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1003f49e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100354fe
xor ebx, ebx
cmp dword [0x1005d560], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1003f574
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1003f654
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1003f654
push eax
call fcn.10035490
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1005d560], eax
call esi
push eax
call fcn.10035490
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1005d564], eax
call esi
push eax
call fcn.10035490
mov dword [0x1005d568], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003b4e1
test eax, eax
pop ecx
pop ecx
je 0x1003f542
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100323cf
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1003f574
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10035490
cmp eax, ebx
pop ecx
mov dword [0x1005d570], eax
je 0x1003f574
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10035490
pop ecx
mov dword [0x1005d56c], eax
mov eax, dword [0x1005d56c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1003f5f9
cmp dword [0x1005d570], ecx
je 0x1003f5f9
push eax
call fcn.10035507
push dword [0x1005d570]
mov esi, eax
call fcn.10035507
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1003f5f9
cmp edi, ebx
je 0x1003f5f9
call esi
cmp eax, ebx
je 0x1003f5c6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003f5c6
test byte [ebp - 0x18], 1
jne 0x1003f5f9
lea eax, [ebp - 0x10]
push eax
call fcn.1003b518
test eax, eax
pop ecx
je 0x1003f5e1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100323cf
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1003f5f0
or dword [ebp + 0x10], 0x200000
jmp 0x1003f634
or dword [ebp + 0x10], 0x40000
jmp 0x1003f634
mov eax, dword [0x1005d564]
cmp eax, dword [ebp - 8]
je 0x1003f634
push eax
call fcn.10035507
cmp eax, ebx
pop ecx
je 0x1003f634
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003f634
mov eax, dword [0x1005d568]
cmp eax, dword [ebp - 8]
je 0x1003f634
push eax
call fcn.10035507
cmp eax, ebx
pop ecx
je 0x1003f634
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1005d560]
call fcn.10035507
cmp eax, ebx
pop ecx
je 0x1003f654
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003f656
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7003567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x7003576
pop dword [ebp - 0x2c]
mov eax, 0x33168ed6
sub eax, 0x2c165960
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe34d738a
sub dword [ebp - 0x3c], 0x94fb2e3f
mov dword [ebp - 0x38], 0x2756b04
add dword [ebp - 0x38], 0x2fbde141
mov dword [ebp - 0x34], 0x4f04b9e4
add dword [ebp - 0x34], 0xfd478a4a
mov dword [ebp - 0x30], 0xab4b6e68
sub dword [ebp - 0x30], 0xab4b6e68
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xa5ac80f3
add eax, 0x6154af3d
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x64fcf702
sub dword [ebp - 0x3c], 0xf08a8dac
mov dword [ebp - 0x38], 0x2d287d72
add dword [ebp - 0x38], 0x1443e403
mov dword [ebp - 0x34], 0x18550767
add dword [ebp - 0x34], 0x4b1a6505
mov dword [ebp - 0x30], 0x355455d8
add dword [ebp - 0x30], 0xcaabaa28
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x6ffe5c5c
add eax, 0x9702d3d8
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b82b
push 0
call eax
mov ecx, 0x7249bb8b
sub ecx, 0x7249704a
mov edi, eax
mov ebx, 0x5a732472
sub ebx, 0x53712272
add ebx, dword [ebp - 0x2c]
mov esi, 0xd468be54
add esi, 0x9ef2fc43
xor dword [ebp - 0x20], 0xa132e119
mov edx, dword [ebx]
add dword [ebp - 0xc], esi
add edx, esi
xor dword [ebp - 0x20], edx
mov dword [edi], edx
add dword [ebp - 0x10], edx
add edi, 4
add ebx, 0xdd4562af
sub ebx, 0xdd4562ab
loop 0x7003698
add eax, 0x304edfbf
add eax, 0xcfb24018
xor ebx, ebx
add ebx, eax
add eax, 0x5aa6d4ff
sub eax, 0x5aa6d4fa
mov ecx, 0x80ef7d0
add ecx, 0xfef10830
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003567
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003567
int3