joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009eede
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x104234ac]
sub esp, 0x14
push esi
push edi
test eax, eax
jne 0x1009f009
mov esi, dword [ebp + 8]
xor edx, edx
inc edx
cmp dword [ebp + 0xc], eax
je 0x1009ef04
add esi, 7
or edx, 0xffffffff
mov cl, byte [esi]
movzx edi, byte [esi]
add esi, edx
shr cl, 7
and edi, 0x7f
mov byte [ebp - 1], cl
shl edi, 4
movzx ecx, byte [esi]
add esi, edx
mov eax, ecx
and ecx, 0xf
shr eax, 4
or edi, eax
shl ecx, 0x18
cmp edi, 0x7ff
jne 0x1009ef4e
push str.cant_unpack_IEEE_754_special_value_on_non_IEEE_platform
push dword [sym.extension.dll_PyExc_ValueError]
call sym.extension.dll_PyErr_SetString
fld qword [0x10286740]
pop ecx
pop ecx
jmp 0x1009f04c
movzx eax, byte [esi]
add esi, edx
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi]
add esi, edx
shl eax, 8
or ecx, eax
movzx eax, byte [esi]
add esi, edx
or ecx, eax
mov dword [ebp - 8], ecx
movzx ecx, byte [esi]
add esi, edx
shl ecx, 0x10
movzx edx, byte [edx + esi]
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, dword [ebp - 8]
or edx, ecx
movd xmm0, eax
movd xmm1, edx
cvtdq2pd xmm1, xmm1
shr edx, 0x1f
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm1, qword [edx*8 + 0x1028a030]
addsd xmm0, qword [eax*8 + 0x1028a030]
mulsd xmm1, qword [0x102a9340]
addsd xmm1, xmm0
mulsd xmm1, qword [0x1029e1c0]
test edi, edi
jne 0x1009efcc
mov edi, 0xfffffc02
jmp 0x1009efda
addsd xmm1, qword [0x101e8248]
sub edi, 0x3ff
push edi
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.101bac98
add esp, 0xc
cmp byte [ebp - 1], 0
fst qword [ebp - 0xc]
je 0x1009f04c
movsd xmm0, qword [ebp - 0xc]
fstp st(0)
xorpd xmm0, xmmword [0x10286870]
movsd qword [ebp - 0xc], xmm0
jmp 0x1009f049
mov ecx, dword [ebp + 0xc]
cmp eax, 2
jne 0x1009f015
test ecx, ecx
je 0x1009f01e
cmp eax, 1
jne 0x1009f038
test ecx, ecx
je 0x1009f038
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xd]
push 8
pop esi
mov al, byte [edx]
mov byte [ecx], al
dec ecx
inc edx
dec esi
jne 0x1009f027
push 8
lea eax, [ebp - 0x14]
push eax
jmp 0x1009f03d
push 8
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.101b8700
add esp, 0xc
fld qword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a3def
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov ecx, dword [edx + 8]
lea edi, [ebp - 0xa]
test ecx, ecx
mov dword [ebp + 8], ecx
push 0xa
sets al
mov dword [ebp - 8], eax
xor eax, eax
test ecx, ecx
sete al
mov dword [ebp - 4], eax
pop eax
cmp ebx, eax
jne 0x100a3e2c
push edx
call fcn.100a4ba0
jmp 0x100a3ec6
push esi
mov eax, ecx
cdq
idiv ebx
push 0x57
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, esi
imul ecx, ebx
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
dec edi
pop ecx
cmp al, 0xa
push 0x30
pop edx
cmovl ecx, edx
add cl, al
mov byte [edi], cl
mov ecx, esi
mov dword [ebp + 8], ecx
test esi, esi
jne 0x100a3e2d
pop esi
cmp ebx, 2
jne 0x100a3e68
mov byte [edi - 1], 0x62
jmp 0x100a3e8b
cmp ebx, 8
jne 0x100a3e82
cmp dword [ebp + 0x10], 0
je 0x100a3e79
mov byte [edi - 1], 0x6f
jmp 0x100a3e8b
cmp dword [ebp - 4], 0
jne 0x100a3eaf
dec edi
jmp 0x100a3e8e
cmp ebx, 0x10
jne 0x100a3e92
mov byte [edi - 1], 0x78
sub edi, 2
mov byte [edi], dl
jmp 0x100a3eaf
mov eax, ebx
mov byte [edi - 1], 0x23
push 0xa
pop ecx
cdq
sub edi, 2
idiv ecx
add dl, 0x30
mov byte [edi], dl
cmp ebx, ecx
jle 0x100a3eaf
dec edi
add al, 0x30
mov byte [edi], al
cmp dword [ebp - 8], 0
je 0x100a3eb9
dec edi
mov byte [edi], 0x2d
lea eax, [ebp - 0xa]
sub eax, edi
push eax
push edi
call sym.extension.dll_PyString_FromStringAndSize
pop ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a823b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
push esi
mov esi, dword [eax + 8]
test esi, esi
jns 0x100a8250
neg esi
test esi, esi
jne 0x100a825f
mov eax, dword [ebp + 0xc]
fldz
and dword [eax], 0
jmp 0x100a83e2
movzx eax, word [eax + esi*2 + 0xa]
push edi
push eax
call fcn.100a9640
pop ecx
mov ecx, eax
xor edi, edi
mov eax, 0x8888889
cmp esi, eax
jl 0x100a8288
jg 0x100a839c
cmp ecx, 7
jg 0x100a839c
imul eax, esi, 0xf
add ecx, 0xfffffff1
push 0x37
add eax, ecx
pop ecx
mov dword [ebp - 4], eax
push 0xf
cmp eax, ecx
jg 0x100a8305
sub ecx, eax
mov eax, ecx
cdq
pop ecx
idiv ecx
test eax, eax
jle 0x100a82be
mov dword [ebp - 8], eax
lea edi, [ebp - 0x18]
mov ecx, eax
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 8]
push edx
add eax, 0xc
push esi
push eax
lea eax, [ebp - 0x18]
lea eax, [eax + edi*2]
push eax
call fcn.100a9761
add edi, esi
movzx eax, ax
add esp, 0x10
mov word [ebp + edi*2 - 0x18], ax
inc edi
xor edx, edx
mov eax, dword [ebp - 0x18]
and eax, 7
mov ax, word [eax*4 + 0x102aa274]
add word [ebp - 0x18], ax
dec edi
movzx eax, word [ebp + edi*2 - 0x18]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
jmp 0x100a8375
add eax, 0xffffffc9
mov edi, esi
cdq
pop ecx
idiv ecx
mov dword [ebp - 8], eax
mov esi, eax
mov eax, dword [ebp + 8]
sub edi, esi
push edx
push edi
lea eax, [eax + esi*2]
add eax, 0xc
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
call fcn.100a97a1
add esp, 0x10
test ax, ax
je 0x100a833c
or word [ebp - 0x18], 1
jmp 0x100a82e1
test esi, esi
jle 0x100a82e1
mov eax, dword [ebp - 8]
xor edx, edx
lea eax, [eax - 2]
dec esi
cmp word [eax], dx
jne 0x100a8354
test esi, esi
jg 0x100a8345
jmp 0x100a82e3
or word [ebp - 0x18], 1
jmp 0x100a82e3
movzx eax, word [ebp + edi*2 - 0x1a]
dec edi
mulsd xmm1, qword [0x102aa6b8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
test edi, edi
jg 0x100a835b
mulsd xmm1, qword [0x102aa6b0]
mov ecx, dword [ebp - 4]
ucomisd xmm1, qword [0x101e8248]
lahf
test ah, 0x44
jp 0x100a83c4
cmp ecx, 0x7fffffff
jne 0x100a83bb
xor edi, edi
push str.huge_integer:_number_of_bits_overflows_a_Py_ssize_t
push dword [sym.extension.dll_PyExc_OverflowError]
call sym.extension.dll_PyErr_SetString
mov eax, dword [ebp + 0xc]
fld qword [0x10286740]
pop ecx
pop ecx
mov dword [eax], edi
jmp 0x100a83e1
movsd xmm1, qword [0x102866b8]
inc ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 8], edx
jge 0x100a83d9
xorpd xmm1, xmmword [0x10286870]
movsd qword [ebp - 0xc], xmm1
fld qword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a8e65
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
xor esi, esi
test eax, eax
jne 0x100a8e81
push esi
call sym.extension.dll_PyLong_FromLong
pop ecx
jmp 0x100a8fb9
push ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
je 0x100a8e9f
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ebx
lea ecx, [edx - 1]
mov edx, ebx
add ecx, eax
jmp 0x100a8eb0
mov ecx, dword [ebp + 8]
lea edx, [eax - 1]
add edx, ecx
mov dword [ebp - 8], edx
or edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x100a8ec0
cmp byte [ecx], 0x80
sbb ebx, ebx
inc ebx
mov dword [ebp + 0x14], ebx
push edi
mov edi, edx
neg edi
test ebx, ebx
sete dl
dec dl
mov byte [ebp + 0xf], dl
mov edx, esi
test eax, eax
je 0x100a8ee6
mov bl, byte [ebp + 0xf]
cmp byte [ecx], bl
jne 0x100a8ee3
inc edx
add ecx, edi
cmp edx, eax
jb 0x100a8ed8
mov ebx, dword [ebp + 0x14]
mov edi, eax
sub edi, edx
test ebx, ebx
je 0x100a8ef3
cmp edi, eax
jae 0x100a8ef3
inc edi
cmp edi, 0xffffffe
jbe 0x100a8f13
push str.byte_array_too_long_to_convert_to_int
push dword [sym.extension.dll_PyExc_OverflowError]
call sym.extension.dll_PyErr_SetString
pop ecx
xor eax, eax
jmp 0x100a8fb6
push 0xf
pop ecx
xor edx, edx
lea eax, [edi*8 + 0xe]
div ecx
push eax
call sym.extension.dll__PyLong_New
mov dword [ebp - 0xc], eax
pop ecx
test eax, eax
je 0x100a8fb7
mov edx, esi
mov ecx, esi
test edi, edi
je 0x100a8fa1
add eax, 0xc
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test ebx, ebx
je 0x100a8f5f
xor eax, 0xff
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
shr dword [ebp - 4], 8
and eax, 0xff
shl eax, cl
add ecx, 8
or edx, eax
cmp ecx, 0xf
jb 0x100a8f86
mov ebx, dword [ebp + 0xc]
mov eax, edx
add dword [ebp + 0xc], 2
and eax, 0x7fff
inc esi
shr edx, 0xf
sub ecx, 0xf
mov word [ebx], ax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
dec edi
jne 0x100a8f44
test ecx, ecx
mov ecx, dword [ebp - 0xc]
je 0x100a8fa4
mov word [ecx + esi*2 + 0xc], dx
inc esi
jmp 0x100a8fa4
mov ecx, dword [ebp - 0xc]
mov eax, esi
neg eax
test ebx, ebx
push ecx
cmovne esi, eax
mov dword [ecx + 8], esi
call fcn.100a9584
pop ecx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100abe23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], 1
test ecx, ecx
jle 0x100abe6b
mov edx, dword [ebp + 8]
push ebx
push esi
mov si, word [ebp - 4]
mov ebx, 0x7fff
push edi
mov edi, dword [ebp + 0xc]
sub edi, edx
mov eax, ebx
xor ax, word [edi + edx]
add si, ax
mov word [ebp - 4], si
mov eax, dword [ebp - 4]
and eax, ebx
shr si, 0xf
mov word [edx], ax
lea edx, [edx + 2]
dec ecx
jne 0x100abe49
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b6814
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 4], 0x103fb398
je 0x100b6860
push esi
call sym.extension.dll_PyObject_Str
mov esi, eax
pop ecx
test esi, esi
jne 0x100b683c
or eax, 0xffffffff
jmp 0x100b69a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.100b6814
add esp, 0xc
mov edi, eax
dec dword [esi]
jne 0x100b6859
mov ecx, dword [esi + 4]
push esi
call dword [ecx + 0x18]
pop ecx
mov eax, edi
jmp 0x100b69a5
test byte [ebp + 0x10], 1
push ebx
je 0x100b68cf
lea edi, [esi + 0x14]
mov esi, dword [esi + 8]
call sym.extension.dll_PyEval_SaveThread
mov dword [ebp + 8], eax
cmp esi, 0x7fffffff
jle 0x100b68b3
lea eax, [esi - 0x80000000]
xor edx, edx
mov ecx, 0x7fffc000
div ecx
lea ebx, [eax + 1]
imul ecx, ebx, 0x80004000
add esi, ecx
push dword [ebp + 0xc]
push 0x7fffc000
push 1
push edi
call fcn.101b8671
add esp, 0x10
add edi, 0x7fffc000
dec ebx
jne 0x100b6897
push dword [ebp + 0xc]
push esi
push 1
push edi
call fcn.101b8671
push dword [ebp + 8]
call sym.extension.dll_PyEval_RestoreThread
add esp, 0x14
jmp 0x100b69a2
push 0x27
pop edi
push dword [esi + 8]
lea ebx, [esi + 0x14]
push edi
push ebx
mov dword [ebp - 4], ebx
call fcn.101b9c00
add esp, 0xc
test eax, eax
je 0x100b6901
push dword [esi + 8]
push 0x22
pop eax
push eax
push ebx
call fcn.101b9c00
add esp, 0xc
test eax, eax
push 0x22
pop eax
cmove edi, eax
mov eax, dword [esi + 8]
mov dword [ebp + 8], eax
call sym.extension.dll_PyEval_SaveThread
mov esi, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], eax
call fcn.101c6223
xor ebx, ebx
pop ecx
pop ecx
cmp dword [ebp + 8], ebx
jle 0x100b6990
mov eax, dword [ebp - 4]
mov cl, byte [eax + ebx]
movsx edx, cl
cmp edx, edi
je 0x100b697b
cmp cl, 0x5c
je 0x100b697b
cmp cl, 9
jne 0x100b6940
push 0x102abc0c
jmp 0x100b6956
cmp cl, 0xa
jne 0x100b694c
push 0x102abc10
jmp 0x100b6956
cmp cl, 0xd
jne 0x100b695e
push 0x102abc14
push esi
call fcn.101be493
jmp 0x100b696c
lea eax, [ecx - 0x20]
cmp al, 0x5e
ja 0x100b6970
push esi
push edx
call fcn.101c6223
pop ecx
pop ecx
jmp 0x100b698a
movzx eax, cl
push eax
push str.x_02x
jmp 0x100b6981
push edx
push 0x102abc08
push esi
call fcn.101be493
add esp, 0xc
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x100b6922
push esi
push edi
call fcn.101c6223
push dword [ebp - 8]
call sym.extension.dll_PyEval_RestoreThread
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100d6cb3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x10409808]
mov byte [ebp - 1], 0
call fcn.101baf90
push dword [ebp + 8]
mov esi, eax
call fcn.101baf90
add eax, 0x25
pop ecx
add esi, eax
pop ecx
mov eax, esi
call fcn.101c23a0
mov ebx, esp
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
push dword [0x10409808]
push str.SoftwarePythonPythonCore_sModules_s_s
push esi
push ebx
call sym.extension.dll_PyOS_snprintf
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 8]
mov esi, dword [ebp + 0x14]
add esp, 0x18
mov dword [ebp - 8], esi
push eax
push edi
push ebx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x100d6d36
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push edi
push ebx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x100d6d8b
mov esi, dword [0x10428984]
mov eax, dword [esi]
test eax, eax
je 0x100d6d8b
push eax
call fcn.101baf90
pop ecx
mov ecx, dword [ebp - 8]
cmp ecx, eax
jbe 0x100d6d67
push eax
push dword [esi]
sub ecx, eax
lea eax, [edi - 1]
add eax, ecx
push eax
call fcn.101deb48
add esp, 0xc
test eax, eax
je 0x100d6d70
add esi, 0xc
mov eax, dword [esi]
test eax, eax
jne 0x100d6d42
cmp dword [esi], 0
je 0x100d6d8b
push dword [esi + 4]
push edi
call fcn.101be47e
pop ecx
pop ecx
test eax, eax
je 0x100d6d8d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
jmp 0x100d6d8d
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e4840
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100e4856
push str.PyEval_AcquireThread:_NULL_new_thread_state
call sym.extension.dll_Py_FatalError
add esp, 4
push 1
push dword [0x10427e14]
call sym.extension.dll_PyThread_acquire_lock
push dword [ebp + 8]
call sym.extension.dll_PyThreadState_Swap
add esp, 0xc
test eax, eax
je 0x100e487f
mov dword [ebp + 8], str.PyEval_AcquireThread:_non_NULL_old_thread_state
pop ebp
jmp sym.extension.dll_Py_FatalError
pop ebp
ret

Function at 0x100f55c5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100f55df
test al, 0x10
je 0x100f55df
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100f7cb7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
call fcn.100f964d
mov esi, eax
pop ecx
lea ecx, [esi - 1]
cmp ecx, 0x3ffff
ja 0x100f7d13
cmp esi, 0x7fffffff
ja 0x100f7d13
xor ecx, ecx
inc ecx
test esi, esi
cmovne ecx, esi
push ecx
call fcn.101b93cc
mov edi, eax
pop ecx
test edi, edi
je 0x100f7d13
push dword [ebp + 8]
push esi
push 1
push edi
call fcn.101b846c
push eax
push edi
call sym.extension.dll_PyMarshal_ReadObjectFromString
push edi
mov esi, eax
call fcn.101b9394
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebp
ret
pop edi
pop esi
pop ebp
jmp sym.extension.dll_PyMarshal_ReadObjectFromFile
Function at 0x100f7dd1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
je 0x100f7df1
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.101b8671
add esp, 0x10
jmp 0x100f7e31
push ebx
mov ebx, dword [ebp + 0xc]
dec ebx
js 0x100f7e30
push edi
mov edi, dword [ebp + 8]
cmp dword [esi], 0
je 0x100f7e0e
push dword [esi]
movsx eax, byte [edi]
push eax
call fcn.101c6223
jmp 0x100f7e29
mov ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
je 0x100f7e1f
mov al, byte [edi]
mov byte [ecx], al
inc dword [esi + 0x10]
jmp 0x100f7e2b
movsx eax, byte [edi]
push esi
push eax
call fcn.100f7d67
pop ecx
pop ecx
inc edi
dec ebx
jns 0x100f7dfc
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x100f7f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100f7ea0
pop ecx
pop ecx
pop ebp
jmp fcn.100f7dd1

Function at 0x100f8943
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
test eax, eax
je 0x100f8963
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.101b846c
add esp, 0x10
jmp 0x100f8987
mov ecx, dword [edi + 0x14]
sub ecx, dword [edi + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp ecx, esi
cmovl esi, ecx
push esi
push dword [edi + 0x10]
push dword [ebp + 8]
call fcn.101b8700
add esp, 0xc
mov eax, esi
add dword [edi + 0x10], esi
pop esi
pop edi
pop ebp
ret

Function at 0x1010681d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.Fatal_Python_error:__s_n
call fcn.101bdd08
add eax, 0x40
push eax
call fcn.101be493
call fcn.101bdd08
add eax, 0x40
push eax
call fcn.101c5982
push esi
call fcn.101baf90
mov ebx, eax
add esp, 0x14
lea eax, [ebx*2 + 2]
call fcn.101c23a0
mov edi, esp
xor edx, edx
movsx cx, byte [edx + esi]
mov word [edi + edx*2], cx
inc edx
cmp edx, ebx
jbe 0x10106863
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Fatal_Python_error:
call esi
push edi
call esi
push 0x102ba088
call esi
call fcn.101c1d99
int3

Function at 0x101082f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x102b5128
push dword [ebp + 0x10]
call fcn.101ba150
pop ecx
pop ecx
test eax, eax
je 0x10108388
push 0x102b5180
push dword [ebp + 0x10]
call fcn.101ba150
pop ecx
pop ecx
test eax, eax
je 0x10108388
cmp dword [ebp + 0x14], 0
je 0x10108384
push esi
push edi
call sym.extension.dll_PyImport_GetMagicNumber
push dword [ebp + 8]
mov edi, eax
xor esi, esi
and edi, 0xffff
call fcn.101c39ec
pop ecx
test eax, eax
jne 0x1010837e
push ebx
push dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 4]
push 2
inc ebx
push ebx
push eax
call fcn.101b846c
add esp, 0x10
cmp eax, 2
jne 0x10108374
mov ax, word [ebp - 4]
movzx ecx, ah
shl ecx, 8
movzx eax, al
or ecx, eax
cmp ecx, edi
cmove esi, ebx
push dword [ebp + 8]
call fcn.101c7290
pop ecx
pop ebx
pop edi
mov eax, esi
pop esi
jmp 0x1010838b
xor eax, eax
jmp 0x1010838b
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x1010cb76
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x10428fcc], 0
jne 0x1010cb88
call sym.extension.dll_PyThread_init_thread
push ebx
push esi
push 8
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x1010cba7
or eax, 0xffffffff
jmp 0x1010cbf4
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x1010cdf7
push dword [0x10428fc8]
push ebx
call fcn.101c7a67
add esp, 0x18
test eax, eax
jne 0x1010cbea
call fcn.101ba41b
or dword [ebp - 4], 0xffffffff
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1010cbf1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010e4d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
inc eax
mov dword [sym.extension.dll_Py_IgnoreEnvironmentFlag], eax
mov dword [sym.extension.dll_Py_NoSiteFlag], eax
push ebx
push esi
call sym.extension.dll_Py_Initialize
call sym.extension.dll_PyEval_InitThreads
mov esi, 0x3f5
xor ebx, ebx
push esi
push ebx
push ebx
push 0x10419878
push str.meterpreter_stdout
call sym.extension.dll_Py_InitModule4
add esp, 0x14
test eax, eax
je 0x1010e525
push eax
push str.stdout
call sym.extension.dll_PySys_SetObject
pop ecx
pop ecx
push esi
push ebx
push ebx
push 0x104198a8
push str.meterpreter_stderr
call sym.extension.dll_Py_InitModule4
add esp, 0x14
test eax, eax
je 0x1010e54b
push eax
push str.stderr
call sym.extension.dll_PySys_SetObject
pop ecx
pop ecx
call fcn.1001f5a7
call fcn.10034e07
call fcn.10041c9b
call fcn.10064295
mov eax, dword [0x10428ffc]
test eax, eax
jne 0x1010e5cc
push 0x1c
lea eax, [ebp - 0x24]
push eax
push fcn.1010e4d9
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1010e68c
mov esi, dword [ebp - 0x20]
push 0x102bb21c
push 0x539
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1010e68c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1010e68c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [eax]
add eax, 4
mov dword [0x10429000], ecx
mov dword [0x10428ffc], eax
je 0x1010e659
jmp 0x1010e5d2
mov ecx, dword [0x10429000]
push edi
push ecx
push eax
call sym.extension.dll_PyString_FromStringAndSize
push str.zlib
mov edi, eax
call sym.extension.dll_PyString_FromString
push eax
call sym.extension.dll_PyImport_Import
push str.decompress
push eax
call sym.extension.dll_PyObject_GetAttrString
push edi
push 1
mov esi, eax
call sym.extension.dll_PyTuple_Pack
push eax
push esi
call sym.extension.dll_PyObject_CallObject
lea ecx, [ebp - 4]
mov dword [ebp - 8], ebx
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], ebx
push ecx
push eax
call sym.extension.dll_PyString_AsStringAndSize
push dword [ebp - 4]
push dword [ebp - 8]
call sym.extension.dll_PyMarshal_ReadObjectFromString
push str.__main__
mov edi, eax
call sym.extension.dll_PyImport_AddModule
add esp, 0x40
mov esi, eax
push esi
call sym.extension.dll_PyModule_GetDict
push edi
push str.met_lib_data
push esi
call sym.extension.dll_PyModule_AddObject
push ebx
push str.eval_met_lib_data_0___met_init_False_
call sym.extension.dll_PyRun_SimpleStringFlags
add esp, 0x18
pop edi
call sym.extension.dll_PyErr_Clear
mov esi, 0x104197b0
cmp dword [0x104197b0], ebx
je 0x1010e682
call dword [esi]
call sym.extension.dll_PyErr_Occurred
test eax, eax
je 0x1010e67b
call sym.extension.dll_PyErr_Clear
add esi, 4
cmp dword [esi], ebx
jne 0x1010e66b
call fcn.1010e9c5
call fcn.1010f1af
pop esi
pop ebx
mov esp, ebp
pop ebp
ret