joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408e54
mov ecx, 0x1b6410d9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x1a8f6e5f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x251322d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
mov dword [ebp - 4], eax
mov byte [ebp - 8], 0
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 4], 0
je 0x251323f9
mov eax, dword [ebp - 4]
call fcn.25131dd0
mov dword [ebp - 0x18], eax
test eax, eax
je 0x251323f9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
sub eax, edx
mov dword [ebp - 0x1c], eax
sub dword [ebp - 0x18], 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x64
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x251323f9
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov dword [ebp - 0x14], eax
cmp eax, 0x7fffffff
je 0x25132352
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.25126f50
call fcn.25127cb0
push eax
test eax, eax
jne 0x2513239a
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov ecx, 4
call fcn.25122110
cmp dword [0x25135fe0], 0
je 0x25132396
push 4
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentProcess
push eax
call dword [0x25135fe0]
mov byte [ebp - 8], 1
call fcn.251271d0
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0x7fffffff
je 0x251323be
push dword [ebp - 0x14]
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0x64
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x251323e1
cmp dword [ebp - 0x10], 0
jne 0x251323e1
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x251323ef
push dword [ebp - 0x10]
call sub.kernel32.dll_SetLastError
pop eax
test eax, eax
je 0x251323f9
call fcn.25127300
mov al, byte [ebp - 8]
leave
ret
Function at 0x25132400
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x48]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x10], 0
push 0
call sub.kernel32.dll_SetLastError
cmp dword [ebp - 0xc], 0
je 0x25132571
cmp dword [ebp - 4], 0
jne 0x25132443
push 0x8000
push 0
push dword [ebp - 0xc]
call sub.kernel32.dll_VirtualFree
mov byte [ebp - 0x10], 1
jmp 0x25132571
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.25131fe0
test al, al
je 0x25132569
mov eax, dword [ebp - 0xc]
call fcn.25131dd0
mov dword [ebp - 0x20], eax
test eax, eax
je 0x25132571
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x25132571
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov dword [ebp - 0x1c], eax
cmp eax, 0x7fffffff
je 0x251324ad
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.25126f50
call fcn.25127cb0
push eax
test eax, eax
jne 0x25132508
add dword [ebp - 0x20], 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov ecx, 5
call fcn.25122110
cmp dword [0x25135fe0], 0
je 0x251324f5
push 5
push dword [ebp - 4]
call sub.kernel32.dll_GetCurrentProcess
push eax
call dword [0x25135fe0]
push 0x8000
push 0
push dword [ebp - 0xc]
call sub.kernel32.dll_VirtualFree
mov byte [ebp - 0x10], 1
call fcn.251271d0
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], 0x7fffffff
je 0x2513252c
push dword [ebp - 0x1c]
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 5
push dword [ebp - 4]
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x2513254f
cmp dword [ebp - 0x18], 0
jne 0x2513254f
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x2513255d
push dword [ebp - 0x18]
call sub.kernel32.dll_SetLastError
pop eax
test eax, eax
je 0x25132567
call fcn.25127300
jmp 0x25132571
mov eax, dword [ebp - 0xc]
call fcn.251322d0
mov al, byte [ebp - 0x10]
leave
ret

Function at 0x25132650
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x2513267b
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x90
je 0x2513267b
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0xcc
je 0x2513267b
mov eax, 0
jmp 0x251326b1
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x251326ac
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, edx
movzx edx, byte [eax]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp dl, al
je 0x251326a6
mov eax, 0
jmp 0x251326b1
add dword [ebp - 4], 1
jmp 0x25132682
mov eax, 1
leave
ret
Function at 0x40100c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441008]
jne 0x401016
repz ret
jmp fcn.004018a0

Function at 0x40924e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004053be
and dword [ebp - 4], 0
cmp dword [0x443774], 0
mov ebx, eax
jne 0x4092ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093b0
push eax
call fcn.0040534c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443774], eax
call esi
push eax
call fcn.0040534c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x443778], eax
call esi
push eax
call fcn.0040534c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44377c], eax
call esi
push eax
call fcn.0040534c
pop ecx
mov dword [0x443784], eax
test eax, eax
je 0x4092ff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040534c
pop ecx
mov dword [0x443780], eax
mov eax, dword [0x443780]
cmp eax, ebx
je 0x409357
cmp dword [0x443784], ebx
je 0x409357
push eax
call fcn.004053c7
push dword [0x443784]
mov esi, eax
call fcn.004053c7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409357
test edi, edi
je 0x409357
call esi
test eax, eax
je 0x40934e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40934e
test byte [ebp - 0xc], 1
jne 0x409357
or dword [ebp + 0x10], 0x200000
jmp 0x409390
mov eax, dword [0x443778]
cmp eax, ebx
je 0x409390
push eax
call fcn.004053c7
pop ecx
test eax, eax
je 0x409390
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409390
mov eax, dword [0x44377c]
cmp eax, ebx
je 0x409390
push eax
call fcn.004053c7
pop ecx
test eax, eax
je 0x409390
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443774]
call fcn.004053c7
pop ecx
test eax, eax
je 0x4093b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b770
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x272b8b4], 0x930
jne 0x40b78d
push str.dubewajucasolumejacejagipimibebi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x272b8b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x272b5d0], eax
jne 0x40b7b3
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x44a6a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.00449d90
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x44a6d0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44d598
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44d5d7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44d5d7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44d5d7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44d5d7
cmp dword [ecx + 0x74], 0xe
jbe 0x44d5d7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x45a27b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045a0f1

Function at 0x461899
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004613ec

Function at 0x4682e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46830d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46830d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10020e10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x134
call fcn.10024950
call fcn.10034960
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xa
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.10020850
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret 8

Function at 0x10022f00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061b39
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1009c054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [0x1009dc98]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x1009e628]
cmp eax, dword [edx + 4]
jle 0x10022f91
push 0x1009e628
call fcn.1003b743
add esp, 4
cmp dword [0x1009e628], 0xffffffff
jne 0x10022f91
mov dword [ebp - 4], 0
push 0x100920b0
mov ecx, 0x1009e630
call fcn.1001e2c0
push 0x10062e70
call fcn.1003bd13
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x1009e628
call fcn.1003b6f9
add esp, 4
mov ecx, dword [ebp + 8]
call fcn.1001c1a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x10023014
push 0xffffffffffffffff
push 0x1009e630
mov ecx, dword [ebp + 8]
call fcn.10024780
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x10022ffe
mov ecx, dword [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x44]
push edx
mov ecx, dword [ebp + 8]
call fcn.10024730
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.10022f00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.1001c1e0
push 0
mov ecx, dword [ebp + 8]
call fcn.1001c1a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x2c], eax
jmp 0x1002303c
mov edx, dword [ebp - 0x14]
and edx, 0x10
jne 0x1002302f
mov eax, dword [ebp - 0x14]
and eax, 0x400
jne 0x1002302f
mov dword [ebp - 0x1c], 0
jmp 0x10023036
mov dword [ebp - 0x1c], 1
mov cl, byte [ebp - 0x1c]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10023920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1009c054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.1001e4f0
mov word [ebp - 0x3e], ax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x3e]
push ecx
call fcn.1001e500
add esp, 8
movzx edx, al
test edx, edx
je 0x10023965
lea eax, [ebp + 8]
push eax
call fcn.10025b20
add esp, 4
jmp 0x10023b08
mov ecx, dword [ebp - 0x38]
call fcn.10008570
test eax, eax
je 0x100239af
mov ecx, dword [ebp - 0x38]
call fcn.10008570
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.10025170
cmp esi, eax
jae 0x100239af
lea ecx, [ebp + 8]
push ecx
call fcn.1001e530
add esp, 4
mov word [ebp - 0x40], ax
mov ecx, dword [ebp - 0x38]
call fcn.1001e540
mov dx, word [ebp - 0x40]
mov word [eax], dx
mov ax, word [ebp + 8]
jmp 0x10023b08
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x100239c2
call fcn.1001e4f0
jmp 0x10023b08
mov ecx, dword [ebp - 0x38]
call fcn.10024cf0
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x10023a20
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x50], eax
lea ecx, [ebp + 8]
push ecx
call fcn.1001e530
add esp, 4
mov word [ebp - 0x42], ax
mov edx, dword [ebp - 0x50]
push edx
movzx eax, word [ebp - 0x42]
push eax
call fcn.10020920
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10023a0e
mov dx, word [ebp + 8]
mov word [ebp - 0x3a], dx
jmp 0x10023a17
call fcn.1001e4f0
mov word [ebp - 0x3a], ax
mov ax, word [ebp - 0x3a]
jmp 0x10023b08
mov dword [ebp - 0x58], 0x20
lea eax, [ebp + 8]
push eax
call fcn.1001e530
add esp, 4
mov word [ebp - 0x2c], ax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2a]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x54]
call fcn.1001ffe0
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x10023a81
cmp dword [ebp - 0x48], 1
je 0x10023a81
cmp dword [ebp - 0x48], 3
je 0x10023acf
jmp 0x10023b03
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x4c], ecx
je 0x10023ab3
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1004622b
add esp, 0x10
cmp dword [ebp - 0x4c], eax
je 0x10023ab3
call fcn.1001e4f0
jmp 0x10023b08
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3e], 1
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x34], edx
je 0x10023ac8
mov ax, word [ebp + 8]
jmp 0x10023b08
call fcn.1001e4f0
jmp 0x10023b08
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, word [ebp - 0x2c]
push edx
call fcn.10020920
add esp, 8
movzx eax, al
test eax, eax
je 0x10023af4
mov cx, word [ebp + 8]
mov word [ebp - 0x3c], cx
jmp 0x10023afd
call fcn.1001e4f0
mov word [ebp - 0x3c], ax
mov ax, word [ebp - 0x3c]
jmp 0x10023b08
call fcn.1001e4f0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b5fd
mov esp, ebp
pop ebp
ret 4
Function at 0x10024d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1009c054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x10024da7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x10024dae
mov al, 1
jmp 0x10024e9d
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x48], edx
call fcn.1001e4f0
mov word [ebp - 0x32], ax
movzx eax, word [ebp - 0x32]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x48]
mov word [ebp - 0x34], ax
call fcn.1001e4f0
mov word [ebp - 0x36], ax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x36]
push edx
call fcn.1001e500
add esp, 8
movzx eax, al
test eax, eax
je 0x10024df8
xor al, al
jmp 0x10024e9d
mov dword [ebp - 0x50], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.10020020
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x10024e3a
cmp dword [ebp - 0x3c], 1
je 0x10024e41
cmp dword [ebp - 0x3c], 3
je 0x10024e90
jmp 0x10024e9b
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3e], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x40], edx
je 0x10024e70
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x40]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.1004622b
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x10024e70
xor al, al
jmp 0x10024e9d
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3e]
test eax, eax
jne 0x10024e84
mov dword [ebp - 0x44], 1
jmp 0x10024e8b
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
jmp 0x10024e9d
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3e], 0
mov al, 1
jmp 0x10024e9d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b5fd
mov esp, ebp
pop ebp
ret
Function at 0x10027ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1009c054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x1002801a
jl 0x10028011
cmp dword [ebp + 0xc], 0
ja 0x1002801a
xor eax, eax
xor edx, edx
jmp 0x1002815b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x1002803c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10006b90
jmp 0x1002815b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.10008430
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x100280ab
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.1000bcb0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.10008590
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10009ac0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.10008510
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x1002814c
mov ecx, dword [ebp - 0x10]
call fcn.10028b40
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x1002811b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10046c49
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x10028119
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1002815b
jmp 0x100280c7
cmp dword [ebp - 8], 0
jbe 0x1002814c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.10046c49
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b5fd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10028600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1009c054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.100099a0
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.10009a00
add esp, 8
movzx edx, al
test edx, edx
je 0x10028644
lea eax, [ebp + 8]
push eax
call fcn.100099b0
add esp, 4
jmp 0x100287d5
mov ecx, dword [ebp - 0x38]
call fcn.10008570
test eax, eax
je 0x1002868a
mov ecx, dword [ebp - 0x38]
call fcn.10008570
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.100084b0
cmp esi, eax
jae 0x1002868a
lea ecx, [ebp + 8]
push ecx
call fcn.10009a40
add esp, 4
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.10008360
mov dl, byte [ebp - 0x39]
mov byte [eax], dl
mov eax, dword [ebp + 8]
jmp 0x100287d5
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x1002869d
call fcn.100099a0
jmp 0x100287d5
mov ecx, dword [ebp - 0x38]
call fcn.10028b40
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x100286f6
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 8]
push ecx
call fcn.10009a40
add esp, 4
mov byte [ebp - 0x3a], al
mov edx, dword [ebp - 0x54]
push edx
movzx eax, byte [ebp - 0x3a]
push eax
call fcn.10027ac0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100286e6
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
jmp 0x100286ee
call fcn.100099a0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x100287d5
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp + 8]
push eax
call fcn.10009a40
add esp, 4
mov byte [ebp - 0x2a], al
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x29]
push ecx
lea edx, [ebp - 0x2a]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x58]
call fcn.1001ffe0
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x10028753
cmp dword [ebp - 0x40], 1
je 0x10028753
cmp dword [ebp - 0x40], 3
je 0x100287a0
jmp 0x100287d0
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x44], ecx
je 0x10028785
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1004622b
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x10028785
call fcn.100099a0
jmp 0x100287d5
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x10028799
mov eax, dword [ebp + 8]
jmp 0x100287d5
call fcn.100099a0
jmp 0x100287d5
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.10027ac0
add esp, 8
movzx eax, al
test eax, eax
je 0x100287c3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], ecx
jmp 0x100287cb
call fcn.100099a0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x100287d5
call fcn.100099a0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b5fd
mov esp, ebp
pop ebp
ret 4