joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e14a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c0d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x58d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
mov edx, 2
test edi, edi
mov eax, 1
cmove edi, eax
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c800e
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4e151f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4e1521
xor eax, eax
push str.boost::filesystem::current_path
push dword [ebp + 0xc]
push eax
call fcn.004e22f0
mov edi, dword [ebp + 8]
xor eax, eax
add esp, 0xc
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [esi], ax
je 0x4e1561
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e1552
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.00408b40
push esi
call fcn.004c8009
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e1590
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 8
jb 0x4e159f
mov eax, dword [esi]
jmp 0x4e15a1
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4e15c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.boost::filesystem::current_path
push dword [esp + 0x10]
push esi
push eax
call fcn.004e2210
add esp, 0x10
pop esi
ret
push str.boost::filesystem::current_path
push dword [esp + 0x10]
xor eax, eax
push esi
push eax
call fcn.004e2210
add esp, 0x10
pop esi
ret
Function at 0x4e2b30
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x4e2b40
mov eax, dword [esi]
jmp 0x4e2b42
mov eax, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x4e2b50
mov ecx, dword [edi]
jmp 0x4e2b52
mov ecx, edi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4e2b68
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4e2b6a
xor eax, eax
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.004e2120
add esp, 0x14
pop edi
pop esi
ret

Function at 0x4e2c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c358
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x58d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x4e2c51
mov eax, dword [edi]
jmp 0x4e2c53
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x4e2c72
push esi
push edi
push ebx
call fcn.004e29d0
add esp, 0xc
jmp 0x4e2d81
test eax, 0x400
je 0x4e2d3c
cmp dword [edi + 0x14], 8
jb 0x4e2c87
mov eax, dword [edi]
jmp 0x4e2c89
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a070
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp eax, 8
jb 0x4e2cd4
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00408d40
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x4e2cff
push dword [ebp - 0x34]
push edi
push ebx
call fcn.004e29d0
add esp, 0xc
jmp 0x4e2d81
push edi
call fcn.004e26e0
add esp, 4
test al, al
jne 0x4e2d2b
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.004e28c0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4e2d81
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x4e2d52
mov dword [esi], 0
mov byte [esi + 4], 0
call fcn.00408e70
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x4e2d69
mov dword [ebp - 0x30], 2
call fcn.004e28c0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c79eb
mov esp, ebp
pop ebp
ret
Function at 0x4e2da0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x14], 8
jb 0x4e2db3
mov eax, dword [esi]
jmp 0x4e2db5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4e2ddd
push dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.004e29d0
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4e2df8
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.00408e70
mov dword [edi + 8], eax
pop edi
test ebx, 0x400
je 0x4e2e22
push esi
call fcn.004e26e0
add esp, 4
mov dword [esp + 8], 4
push ebx
push esi
test al, al
jne 0x4e2e39
mov dword [esp + 0x10], 9
jmp 0x4e2e39
mov dword [esp + 8], 3
push ebx
push esi
test bl, 0x10
jne 0x4e2e39
mov dword [esp + 0x10], 2
call fcn.004e28c0
mov dword [esp + 0x14], eax
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
pop esi
mov dword [eax + 4], ecx
pop ebx
add esp, 8
ret
Function at 0x4e3e70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x4e3e96
mov eax, dword [esp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
cmp dword [esp + 4], 0
jg 0x4e3ea5
jl 0x4e3e81
cmp dword [esp], 0
jbe 0x4e3e81
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x4e3ed1
nop word [eax + eax]
inc esi
cmp esi, 3
ja 0x4e3f1c
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x4e3ec0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.00526ef0
mulsd xmm0, qword [0x544e38]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.00526ef0
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.00526d9f
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 4], 0
add esp, 0x10
ret
Function at 0x4e3fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c4d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x58d0b8]
cmp eax, 0xffffffff
jne 0x4e4006
xor ebx, ebx
jmp 0x4e400f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x4e4072
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x4e4084
test esi, esi
jne 0x4e4088
push 0x4e3910
push 0x5bf480
call fcn.004e3650
mov eax, dword [0x58d0b8]
add esp, 8
cmp eax, 0xffffffff
je 0x4e4054
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x4e4072
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4e40c8
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x4e40b5
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4e4088
cmp dword [ebx + 0x18], 0
je 0x4e4023
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4e40eb
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x4e40eb
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.004439e0
cmp dword [ebx + 0x18], 0
jne 0x4e40d2
jmp 0x4e401d

Function at 0x4e4110
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x4e4170
push 0
push 0
call fcn.004fc05c
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4e4139
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x4e4157
cmp eax, 0xffffffff
je 0x4e4157
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x501bd1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00501894

Function at 0x501bdc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00501a15

Function at 0x505027
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00504f2c
Function at 0x506dc1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050672f

Function at 0x506dcc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050696a

Function at 0x5126ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10001ba3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x30], 0x13
call fcn.1000186e
cld
invalid
dec dword [ebx - 0x7264bb24]
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.10001833
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1000186e
loopne 0x10001bd4
mov dword [eax - 0x73], ecx
inc ebp
call 0x60e87964
dec eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1000187e
push eax
push esi
push dword [ebp + 8]
call fcn.10001833
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
invalid
inc ebp
invalid
Function at 0x10002128
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1000187e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001833
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1000187e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001833
add esp, 0xc
mov dword [ebp - 0x340], eax
invalid
invalid

Function at 0x10002482
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10001833
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.1000186e
shl al, 1
loopne 0x1000246e
nop
invalid
movsd dword es:[edi], dword [esi]
in al, dx
cli
invalid
loopne 0x1000246e
nop
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
pop edx
Function at 0x1000254b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x398], 0
je 0x1000272c
cmp dword [ebp + 0xc], 1
je 0x1000272c
cmp dword [ebp + 0xc], 8
jne 0x100026f4
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1000187e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001833
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.1000186e
push edx
jp 0x100026e4
cmpsd dword [esi], dword es:[edi]
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001a4a
add esp, 0x14
call fcn.1000186e
mov al, byte [0xffe97759]
mov ch, 0x68
stc
invalid
dec dword [ebx + 0x44891c65]
and al, 0xfc
popal
add esp, 0x14
jmp dword [esp - 0x38]
call fcn.1000186e
push es
pop es
mov ah, 0xd7
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
invalid
xchg ebp, eax

Function at 0x1000604b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ecx], sym.KcDvEX.dll_const_CPrivateAddr::vftable
jmp sym.KcDvEX.dll_public_virtual:_void___thiscall_CDeviceAddr::destructor_void_
Function at 0x105f8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105f81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105f807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105f806a
add dl, dl
jne 0x105f8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105f80dc
xor eax, eax
add dl, dl
jne 0x105f8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105f817d
add dl, dl
jne 0x105f80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105f80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105f8075
mov eax, 1
add dl, dl
jne 0x105f80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105f80e1
sub eax, ebx
mov ebx, 1
jne 0x105f8128
mov ecx, 1
add dl, dl
jne 0x105f810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105f8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105f8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105f8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105f813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105f814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105f8136
cmp eax, 0x7d00
jae 0x105f816d
cmp eax, 0x500
jb 0x105f8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105f8075
cmp eax, 0x7f
ja 0x105f8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105f8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105f819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105f8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401be0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401c2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c24
test esi, esi
je 0x401c24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c00
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e10
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f38
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401e9e
cmp eax, 4
jne 0x401ec0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401eae
cmp edx, 4
je 0x401eae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e10