joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020a90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10020c1f
test ecx, ecx
je 0x10020c1f
test ebx, ebx
je 0x10020c1f
cmp dword [esi], 0x20150415
je 0x10020acc
pop esi
mov eax, 6
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x140
cmp ax, word [esi + 0x20]
jne 0x10020c1f
xor edx, edx
push edi
cmp dx, word [esi + 0x10]
jne 0x10020b05
mov edi, eax
movzx eax, word [ecx]
mov edx, eax
sar edx, 8
and edx, 0xff
shl eax, 8
or edx, eax
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x10020ae6
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x14]
mov edi, 0x102edf0c
cmp eax, 0x3e80
je 0x10020b17
mov edi, dword [ebp + 8]
cmp eax, 0x2ee0
jne 0x10020b23
mov edi, 0x102ee12c
movzx eax, word [esi + 0x20]
mov edx, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x28]
push edx
push eax
push ecx
call fcn.100201f0
mov ecx, dword [esi + 0x2c]
movzx edx, word [esi + 0x1c]
mov si, word [esi + 0x1e]
movzx eax, ax
push eax
push ecx
push edx
mov ecx, ebx
call fcn.1001f7c0
mov eax, dword [ebp + 8]
movsx edx, word [eax + 0x22]
sar edx, 1
add esp, 0x1c
xor eax, eax
mov dword [ebp - 8], edx
test edx, edx
jle 0x10020b71
mov ecx, 0x416
xor word [ebx + eax*2], cx
inc eax
cmp eax, edx
jl 0x10020b63
mov eax, edx
cmp edx, 0xc
jl 0x10020b7d
mov eax, 0xc
test eax, eax
jle 0x10020bd9
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov dword [ebp + 0xc], edx
movzx eax, word [edi]
movzx ecx, word [edi + 4]
movzx edx, word [edi + 2]
cwde
movzx esi, word [ebx + eax*2]
lea eax, [ebx + eax*2]
movsx ecx, cx
mov dword [ebp - 4], esi
movzx esi, word [ebx + ecx*2]
lea ecx, [ebx + ecx*2]
movsx edx, dx
lea edx, [ebx + edx*2]
mov dword [ebp + 0x10], esi
mov si, word [edx]
mov word [eax], si
mov ax, word [ebp + 0x10]
mov word [edx], ax
mov dx, word [ebp - 4]
add edi, 6
dec dword [ebp + 0xc]
mov word [ecx], dx
jne 0x10020b91
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ax, word [ecx + 0x10]
jne 0x10020c10
xor esi, esi
test edx, edx
jle 0x10020c10
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebx + ecx*2]
mov edi, eax
sar edi, 8
and edi, 0xff
shl eax, 8
or edi, eax
inc esi
mov word [ebx + ecx*2], di
movsx ecx, si
cmp ecx, edx
jl 0x10020bf0
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov word [eax], dx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, dword [0x1045b8f0]
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
mov edi, ecx
push edi
push str.Ild_ResDecode__x__in_
push 0xa5
push str......._source_appmsc_lualuacildild.c
push 1
push 2
push eax
mov esi, edx
call fcn.10062060
add esp, 0x28
test edi, edi
je 0x100275d3
xor ecx, ecx
cmp ecx, 0x10377400
je 0x100275d3
push ecx
push edi
lea edi, [ebp - 0x208]
call fcn.1005fc80
mov edx, edi
push 0x10377400
push edx
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10027602
mov eax, dword [0x1045b8f0]
push 0
push 0
push 0
mov ebx, 0x2dea
push ebx
push str.Ild_ResDecode_invalid_param
push 0xab
push str......._source_appmsc_lualuacildild.c
push 1
push 0
push eax
call fcn.10062060
add esp, 0x28
jmp 0x10027627
test esi, esi
je 0x10027618
push edi
push 0x80
push 1
push esi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
call fcn.10027510
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [0x1045b8f0]
push 0
push 0
push 0
push ebx
push str.Ild_ResDecode__out___d
push 0xb8
push str......._source_appmsc_lualuacildild.c
push 1
push 2
push ecx
call fcn.10062060
mov ecx, dword [ebp - 4]
add esp, 0x28
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10028da0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
mov esi, ecx
test eax, eax
je 0x10028f0d
test esi, esi
je 0x10028f0d
cmp dword [ebp + 0x18], edi
je 0x10028f0d
push 0x1037466c
push eax
call fcn.10061320
add esp, 8
test eax, eax
jne 0x10028e24
push 0x1037300c
push esi
call fcn.1005f990
mov edi, eax
add esp, 8
test edi, edi
jne 0x10028e24
push eax
push eax
push eax
push esi
push str.loadIvwResData__open_file_failed__res_path_s
push 0x359
push str......._source_appmsc_lualuacivwivw.c
push 1
push eax
mov eax, dword [0x1045b8f0]
push eax
mov dword [ebp - 4], 0x2776
call fcn.10062060
mov eax, dword [ebp - 4]
add esp, 0x28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push 0
test eax, eax
jle 0x10028e32
add eax, ebx
push eax
jmp 0x10028e33
push ebx
push edi
call dword [sym.imp.MSVCR100.dll_fseek]
mov esi, dword [ebp + 0x14]
add esp, 0xc
test esi, esi
jne 0x10028e65
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x10028e4f
sub esi, ebx
jmp 0x10028e65
push edi
call fcn.1005fa30
mov esi, eax
mov eax, dword [ebp + 8]
add esp, 4
sub esi, ebx
test eax, eax
jle 0x10028e65
sub esi, eax
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x10028e84
mov dword [ebp - 4], 0x2775
jmp 0x10028ef5
lea eax, [esi + 0x14]
push eax
push 0
push ebx
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp - 8]
add ebx, 0x10
and ebx, 0xfffffff0
add esp, 0xc
mov dword [ebx - 4], ecx
test edi, edi
je 0x10028ee1
test esi, esi
je 0x10028ee1
push edi
push esi
push 1
push ebx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x10028ec2
mov dword [ebp - 4], 0xfffffffe
jmp 0x10028ee8
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 4], 0
mov dword [eax], ebx
call fcn.1005f9f0
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
test edi, edi
je 0x10028ed7
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x277a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036c50
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [eax]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 4]
mov dword [ebp - 8], esi
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push edi
xor edx, edx
mov dword [0x10457ba0], 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0x20
lea ebx, [ebx]
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 8]
mov edi, ecx
shl edi, 4
add edi, dword [ebp - 0xc]
sub edx, 0x61c88647
xor esi, edi
lea edi, [ecx + edx]
xor esi, edi
add eax, esi
mov esi, eax
shr esi, 5
add esi, dword [ebp - 0x10]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0x14]
xor esi, edi
lea edi, [eax + edx]
xor esi, edi
add ecx, esi
dec dword [ebp - 4]
jne 0x10036c90
mov edx, dword [ebp + 8]
pop edi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10036ce0
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [esi]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push edi
mov edx, 0xc6ef3720
mov dword [0x10457bb0], 1
mov dword [ebp - 4], 0x20
lea ecx, [ecx]
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 8]
mov edi, ecx
shl edi, 4
add edi, dword [ebp - 0xc]
xor esi, edi
lea edi, [ecx + edx]
xor esi, edi
sub eax, esi
mov esi, eax
shr esi, 5
add esi, dword [ebp - 0x10]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0x14]
xor esi, edi
lea edi, [eax + edx]
xor esi, edi
sub ecx, esi
add edx, 0x61c88647
dec dword [ebp - 4]
jne 0x10036d20
mov edx, dword [ebp + 8]
pop edi
mov dword [edx], ecx
mov dword [edx + 4], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003a5e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
lea eax, [ebx + 8]
push esi
push edi
mov word [ebp - 0x628], 0xa0d
mov byte [ebp - 0x18], 0
test eax, eax
je 0x1003a7a4
xor ecx, ecx
cmp ecx, 0x103780ec
je 0x1003a7a4
push ecx
push eax
lea edi, [ebp - 0x21c]
call fcn.1005fc80
mov edx, edi
push 0x103780ec
push edx
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x630], esi
test esi, esi
je 0x1003a7a4
lea edx, [ebx + 0x4c]
mov dword [ebp - 0x634], edx
test edx, edx
je 0x1003a79a
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x1003a79a
mov edi, dword [edx]
mov eax, dword [edi]
mov dword [edx], eax
test eax, eax
jne 0x1003a688
mov dword [edx + 4], eax
dec ecx
mov dword [edx + 8], ecx
mov ebx, dword [edi + 0xc]
cmp ebx, 0x32000
jl 0x1003a69c
mov ebx, 0x32000
push ebx
push 0x10373a84
lea eax, [ebp - 0x18]
push 0x10
push eax
mov byte [ebp - 0x62c], 0x39
mov word [ebp - 0x62a], 0x5948
call fcn.1005f880
lea eax, [ebp - 0x18]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003a6c6
lea ecx, [ebp - 0x18]
sub eax, edx
test ecx, ecx
je 0x1003a6ea
test eax, eax
je 0x1003a6ea
push esi
push eax
mov edx, ecx
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
lea eax, [ebp - 0x628]
test eax, eax
je 0x1003a705
push esi
push 2
mov ecx, eax
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
lea edx, [ebp - 0x62c]
push 4
push edx
lea esi, [ebp - 0x624]
mov byte [ebp - 0x62b], bl
call fcn.1006df10
mov eax, dword [edi + 8]
push ebx
push eax
mov eax, esi
call fcn.1006dff0
mov eax, dword [edi + 8]
add esp, 0x10
test eax, eax
je 0x1003a74d
test ebx, ebx
je 0x1003a74d
mov ecx, dword [ebp - 0x630]
push ecx
push ebx
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
lea edx, [ebp - 0x628]
test edx, edx
je 0x1003a76e
mov eax, dword [ebp - 0x630]
push eax
push 2
mov ecx, edx
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov eax, dword [edi + 8]
test eax, eax
je 0x1003a77f
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 0x634]
mov esi, dword [ebp - 0x630]
add esp, 4
jmp 0x1003a668
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret

Function at 0x10040910
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push str......._source_appmsc_lualuac_speexlibspeex_nb_celp.c
push str.Fatal__internal__error_in__s__line__d:__s_n
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 0x14
push 1
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x1004c3a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b4580
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10415990]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], ebx
mov byte [esi + 0xc], bl
mov dword [ebp - 4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
lea eax, [esi + 0x1a0]
push eax
mov byte [ebp - 4], 5
call fcn.10049460
mov byte [ebp - 4], 6
push 0x3000
mov dword [esi], ebx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
push 0x3000
push ebx
push eax
mov dword [esi + 4], eax
call sub.MSVCR100.dll_memset
push 0x7530
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
push 0x7530
push ebx
push eax
mov dword [esi + 8], eax
call sub.MSVCR100.dll_memset
add esp, 0x20
push 5
push str.BLINK
lea ecx, [esi + 0xc]
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0xa
call fcn.10048340
fld dword [str._knN]
fst dword [esi + 0x138]
mov dword [esi + 0x38], 0x20
fst dword [esi + 0x13c]
mov dword [esi + 0x3c], 0x1e0
fstp dword [esi + 0x140]
mov dword [esi + 0x150], ebx
fld dword [0x10378b14]
mov byte [esi + 0x154], bl
fst dword [esi + 0x144]
fst dword [esi + 0x148]
fstp dword [esi + 0x14c]
fld dword [0x10378b10]
fstp dword [esi + 0x158]
fld dword [0x103789d8]
fstp dword [esi + 0x15c]
fld dword [0x10378b0c]
fstp dword [esi + 0x160]
fld dword [str.33s_]
fstp dword [esi + 0x174]
fld dword [0x103788dc]
fstp dword [esi + 0x164]
fld dword [0x10378b08]
fstp dword [esi + 0x168]
fld dword [0x10378b04]
fstp dword [esi + 0x16c]
xor eax, eax
fld dword [0x10378b00]
mov dword [esi + 0x178], 1
fstp dword [esi + 0x170]
mov byte [esi + 0x17290], bl
fldz
push 0xa8
fst dword [esi + 0x17c]
lea ecx, [esi + 0x40]
fst dword [esi + 0x180]
push ebx
fst dword [esi + 0x184]
push ecx
fst dword [esi + 0x188]
fstp dword [esi + 0x18c]
mov dword [esi + 0x17294], eax
mov dword [esi + 0x17298], eax
mov dword [esi + 0x1729c], eax
mov dword [esi + 0x172a0], eax
mov dword [esi + 0x172a4], eax
mov dword [esi + 0x172a8], eax
mov dword [esi + 0x172ac], eax
mov dword [esi + 0x172b0], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b4498
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x10050722
cmp byte [edi + 0x49], bl
je 0x10050722
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x10050716
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10050675
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x1005068d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x100506b6
dec eax
je 0x100506ba
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x10050711
jmp 0x1005071d
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x100506ca
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x100506f4
cmp ebx, 0x10
jae 0x100506d9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1005070e
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x1005071a
test esi, esi
jne 0x10050681
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.1004ff30
jmp 0x1005067b
lea ecx, [ebp - 0x2c]
call fcn.10048190
xor al, al
jmp 0x10050724
lea ecx, [ebp - 0x2c]
call fcn.10048190
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10050a70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3f9b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10415990]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x1028f514
call fcn.1016034a
push 4
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, eax
add esp, 4
test edi, edi
je 0x10050af1
call fcn.10160217
mov dword [edi], eax
call fcn.1015ffd4
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1016030b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10050ae7
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.10160333
jmp 0x10050af3
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10054900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b443e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10415990]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [edi], 0x103786d0
mov dword [ebp - 4], 2
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
xor esi, esi
sar eax, 2
test eax, eax
je 0x1005498b
nop
mov ecx, dword [edi + 0xc]
cmp dword [ecx + esi*4], ebx
lea eax, [ecx + esi*4]
je 0x1005497d
mov ebx, dword [eax]
test ebx, ebx
je 0x10054971
push ebx
call fcn.10055450
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edx, dword [edi + 0xc]
mov dword [edx + esi*4], 0
xor ebx, ebx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
inc esi
sar eax, 2
cmp esi, eax
jb 0x10054950
mov ecx, dword [edi + 0x10]
mov esi, dword [edi + 0xc]
cmp esi, ecx
je 0x100549b6
mov eax, ecx
sub eax, ecx
sar eax, 2
lea ebx, [eax*4]
push ebx
push ecx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
add ebx, esi
add esp, 0xc
mov dword [edi + 0x10], ebx
xor ebx, ebx
lea esi, [edi + 0x1c]
call fcn.10055260
mov eax, dword [esi]
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x100549d1
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x100549ea
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi], 0x10378660
mov dword [edi + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10056840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b470e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10415990]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebx + 4], ecx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebx], 0x103786d0
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x1c]
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
xor edi, edi
call fcn.10058690
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 2
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x10]
mov edi, dword [ebx + 0xc]
cmp edi, eax
je 0x100568de
mov ecx, eax
sub ecx, eax
sar ecx, 2
add ecx, ecx
add ecx, ecx
push ecx
push eax
push edi
mov dword [ebp - 0x10], ecx
call dword [sym.imp.MSVCR100.dll_memmove]
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, edi
mov dword [ebx + 0x10], ecx
call fcn.10055260
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005f900
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
test ecx, ecx
je 0x1005f957
mov esi, ecx
lea edx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x1005f910
sub esi, edx
test esi, esi
jle 0x1005f957
cmp esi, 0x180
jle 0x1005f92c
mov eax, 0x277b
pop esi
ret
push ecx
push 0x10447900
push 0x180
push 0x10457e08
call fcn.1005f880
mov esi, eax
mov al, 0x5c
add esp, 0x10
cmp byte [esi + 0x10457e07], al
je 0x1005f957
mov byte [esi + 0x10457e08], al
inc esi
push 0x10447904
push 0x10447908
lea eax, [esi + 0x10457e08]
push 0x40
push eax
call fcn.1005f880
add esp, 0x10
push 0
push 0x10457e08
mov byte [eax + esi + 0x10457e08], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jle 0x1005f98d
xor eax, eax
pop esi
ret

Function at 0x1005fa70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x1005fab8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1005fab8
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1005fab8
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1005fa97
mov dword [esi], 0
push ecx
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test esi, esi
je 0x1005faab
mov dword [esi], eax
sub eax, edi
neg eax
sbb eax, eax
pop esi
and eax, 0xfffffffe
pop edi
pop ebp
ret
or eax, 0xffffffff
pop edi
pop ebp
ret