joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022617
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002ddaf
call fcn.1002b0d2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002275c
cmp dword [ebp - 0x18], 1
jne 0x1002275c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100209b6
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x1002275c
push dword [ebp - 0x14]
push ebx
push esi
call fcn.100209b6
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022751
cmp dword [ebp - 0x18], 1
jne 0x10022751
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100209b6
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10022751
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.100209b6
lea eax, [ebp - 0x20]
push eax
push 0x100333c8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10022735
push ebx
call fcn.100209b6
pop ecx
test al, al
je 0x10022735
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10022751
push dword [edi]
call fcn.1002b601
and dword [edi], 0
pop ecx
jmp 0x10022751
test esi, esi
je 0x1002275c
push esi
call fcn.1002b601
pop ecx
call fcn.1002b030
ret

Function at 0x10022f02
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10033124
xor esi, esi
call fcn.100209b6
pop ecx
test eax, eax
jne 0x10022f23
push 0x1003313c
call fcn.100209b6
pop ecx
test eax, eax
je 0x10022f26
xor esi, esi
inc esi
cmp byte [0x1003cdfb], 0
jne 0x10022f38
cmp byte [0x1003cdfa], 0
je 0x10022f6e
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d640
push edi
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10022f5d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10022f6d
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x100252bb
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cdfb], 0
jne 0x100252fd
cmp byte [0x1003cdfa], 0
je 0x10025334
movzx eax, bl
mov esi, 0x1003e1a8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10025324
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10025334
push esi
call fcn.10005eb0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cdfb], 0
jne 0x1002534b
cmp byte [0x1003cdfa], 0
je 0x1002537d
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1a8
push esi
call fcn.100209b6
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x1002536d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002537d
push esi
call fcn.10005eb0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.100209b6
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100209b6
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.100209b6
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.100209b6
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.100209b6
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.100209b6
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403e59
pop dword [ebp - 0x34]
mov eax, 0x403e59
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x936b8754
add dword [ebp - 0x44], 0xbae6bdf7
mov dword [ebp - 0x40], 0xb2095646
add dword [ebp - 0x40], 0x8029f5ff
mov dword [ebp - 0x3c], 0x7a46453b
sub dword [ebp - 0x3c], 0x2dfa010d
mov dword [ebp - 0x38], 0x1dd90366
sub dword [ebp - 0x38], 0x1dd90366
lea eax, [ebp - 0x44]
push eax
mov eax, 0x3a67e6aa
sub eax, 0x3a277646
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x4490018c
add dword [ebp - 0x44], 0x2fe267ca
mov dword [ebp - 0x40], 0x7ce82ea2
sub dword [ebp - 0x40], 0x3b7bcd2d
mov dword [ebp - 0x3c], 0x7edb18eb
add dword [ebp - 0x3c], 0xe4945381
mov dword [ebp - 0x38], 0x6ab56157
add dword [ebp - 0x38], 0x954a9ea9
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x91168d31
sub eax, 0x90d61c89
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3774d
push 0
call eax
mov ecx, 0x4ad6
xor ebx, ebx
add ebx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x34]
mov edx, 0x867feace
add edx, 0x94ca8d2d
add dword [ebp - 0x28], 0x363b4dc2
mov esi, dword [edi]
add dword [ebp - 0x14], edi
sub esi, edx
xor dword [ebp - 0x1c], edi
mov dword [ebx], esi
add ebx, 0x83a68c4b
sub ebx, 0x83a68c47
add edi, 4
loop 0x403f6c
add eax, 0x98b5bd4a
sub eax, 0x98b49f1f
xor ebx, ebx
add ebx, eax
add eax, 0xeff3cbd4
add eax, 0x100c3431
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1002cbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1002cbbf
pop dword [ebp - 0x48]
mov eax, 0xf728d78b
sub eax, 0xe7260bcc
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xeaf47c6d
add dword [ebp - 0x58], 0x635dc8de
mov dword [ebp - 0x54], 0x23e5363e
sub dword [ebp - 0x54], 0xf1b1e9f9
mov dword [ebp - 0x50], 0xfe9c5f01
sub dword [ebp - 0x50], 0xb2501ad3
mov dword [ebp - 0x4c], 0x76720fad
sub dword [ebp - 0x4c], 0x76720fad
lea eax, [ebp - 0x58]
push eax
mov eax, 0x577afe0c
sub eax, 0x47768d44
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb2804db9
add dword [ebp - 0x58], 0xc1f21b9d
mov dword [ebp - 0x54], 0xdc7f5d41
sub dword [ebp - 0x54], 0x9b12fbcc
mov dword [ebp - 0x50], 0xe4bd04ef
add dword [ebp - 0x50], 0x7eb2677d
mov dword [ebp - 0x4c], 0x20377b7c
add dword [ebp - 0x4c], 0xdfc88484
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x41f4f4ac
add eax, 0xce0f7c38
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4177b
push 0
call eax
mov ecx, 0x6ce0c53b
add ecx, 0x931f7f2d
mov edx, eax
mov esi, 0x7085966a
sub esi, 0x607f666a
add esi, dword [ebp - 0x48]
mov ebx, 0x219eb151
sub ebx, 0xc160c6ee
add dword [ebp - 0x14], ebx
mov edi, dword [esi]
sub dword [ebp - 0x30], 0xee804995
sub edi, ebx
mov dword [ebp - 0x24], 0x15352672
mov dword [edx], edi
xor dword [ebp - 0x30], ecx
add edx, 0x331f0ec
sub edx, 0x331f0e8
add esi, 0x9ea69cb9
sub esi, 0x9ea69cb5
loop 0x1002cce1
add eax, 0x10473
mov ebx, eax
add eax, 0xe0ec796f
sub eax, 0xe0ec796a
mov ecx, 0x1af974f5
sub ecx, 0xaf974f5
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10001640
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, ebx
je 0x10001734
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x10001734
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x10001734
mov eax, dword [esi + 0x18]
cmp eax, 2
je 0x10001734
cmp eax, 1
jne 0x10001688
cmp dword [esi + 4], 0x2a
jne 0x10001734
test eax, eax
je 0x100016a1
mov eax, dword [ecx + 0x30]
push ebx
push ebp
push eax
call sym.zlib1.dll_adler32
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [ecx + 0x30], eax
cmp ebx, 3
jb 0x1000172d
mov eax, dword [esi + 0x2c]
add eax, 0xfffffefa
cmp ebx, eax
jbe 0x100016bc
mov edi, eax
sub ebx, edi
add ebp, ebx
mov edx, dword [esi + 0x38]
push edi
push ebp
push edx
call fcn.100093b0
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x5c], edi
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
add esp, 0xc
xor edx, edx
mov dword [esi + 0x48], eax
add edi, 0xfffffffd
nop
mov ebx, dword [esi + 0x48]
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + edx + 2]
mov ebp, dword [esi + 0x40]
shl ebx, cl
mov ecx, dword [esi + 0x44]
xor eax, ebx
and eax, dword [esi + 0x54]
mov ebx, dword [esi + 0x34]
mov dword [esi + 0x48], eax
mov ax, word [ecx + eax*2]
and ebx, edx
mov word [ebp + ebx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], dx
add edx, 1
cmp edx, edi
jbe 0x100016f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x100025f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x1000266e
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.100093b0
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x10002641
sub eax, ebx
jmp 0x10002643
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x10002632
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x10002662
sub eax, ebx
jmp 0x10002664
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x10002653
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x100026c9
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.100022a0
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x100026b5
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x100026c9
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x100025f6
pop esi
pop ebp
pop ebx
ret

Function at 0x100032d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10003329
cmp byte [esi + 0x5c], 0x77
jne 0x10003329
cmp dword [esi + 0x10], 0
jne 0x10003314
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.100098f9
add esp, 0x10
cmp eax, 0x4000
je 0x1000330d
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x10], 0x4000
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push esi
call sym.zlib1.dll_deflateParams
add esp, 0xc
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x10003330
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x10003383
cmp dword [esi + 4], 0
jne 0x1000338c
call fcn.10009c9c
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.10009c46
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x10003387
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.1000997b
add esp, 4
test eax, eax
je 0x10003383
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
add dword [esi + 4], 0xffffffff
mov cl, byte [eax]
add eax, 1
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x100033a0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x10003415
test edi, edi
je 0x100033b9
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call fcn.10009c9c
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call fcn.10009c46
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100033ff
mov ecx, dword [esi + 0x40]
push ecx
call fcn.1000997b
add esp, 4
test eax, eax
je 0x100033ff
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
cmp eax, 2
mov edx, dword [esi + 0x44]
mov dword [esi], edx
jae 0x10003415
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x100034ee
cmp byte [eax + 1], 0x8b
jne 0x100034ee
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.10003330
mov edi, eax
call fcn.10003330
cmp edi, 8
mov ebx, eax
jne 0x100034e3
test bl, 0xe0
jne 0x100034e3
mov edi, 6
lea esp, [esp]
call fcn.10003330
sub edi, 1
jne 0x10003460
test bl, 4
je 0x10003493
call fcn.10003330
mov edi, eax
call fcn.10003330
shl eax, 8
add edi, eax
mov eax, edi
sub edi, 1
test eax, eax
je 0x10003493
call fcn.10003330
cmp eax, 0xffffffff
jne 0x10003480
test bl, 8
je 0x100034a6
call fcn.10003330
test eax, eax
je 0x100034a6
cmp eax, 0xffffffff
jne 0x10003498
test bl, 0x10
je 0x100034be
jmp 0x100034b0
call fcn.10003330
test eax, eax
je 0x100034be
cmp eax, 0xffffffff
jne 0x100034b0
test bl, 2
je 0x100034d2
mov edi, 2
call fcn.10003330
sub edi, 1
jne 0x100034c8
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret

Function at 0x10003600
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100036ab
cmp byte [esi + 0x5c], 0x77
jne 0x100036ab
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
mov dword [esi], ebp
mov dword [esi + 4], edi
je 0x10003691
lea ebx, [ebx]
cmp dword [esi + 0x10], 0
jne 0x1000365a
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.100098f9
add esp, 0x10
cmp eax, 0x4000
jne 0x1000368a
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call sym.zlib1.dll_deflate
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
test eax, eax
mov dword [esi + 0x38], eax
jne 0x10003691
test ecx, ecx
jne 0x10003630
jmp 0x10003691
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x4c]
push edi
push ebp
push eax
call sym.zlib1.dll_crc32
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, edi
sub eax, dword [esi + 4]
pop edi
pop ebp
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x100037c0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x10003876
cmp byte [esi + 0x5c], 0x77
jne 0x10003876
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x1000380e
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call fcn.100098f9
add esp, 0x10
cmp eax, edi
jne 0x1000386c
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x1000385a
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call sym.zlib1.dll_deflate
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
test edi, edi
mov dword [esi + 0x38], eax
jne 0x1000383b
cmp eax, 0xfffffffb
jne 0x1000383b
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x10003849
cmp dword [esi + 0x38], 1
je 0x10003849
xor ebx, ebx
jmp 0x1000384e
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x100037e0
cmp eax, 1
je 0x100037e0
mov esi, dword [esi + 0x38]
mov eax, esi
sub eax, 1
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x10009f28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001c1b0]
jne 0x10009f32
repz ret
jmp fcn.1000e6e7

Function at 0x1000efa2
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1001c6b8]
je 0x1000efbd
inc edi
cmp edi, 0x17
jb 0x1000efae
cmp edi, 0x17
jae 0x1000f13d
push ebp
push 3
call fcn.10012271
cmp eax, 1
pop ecx
je 0x1000f109
push 3
call fcn.10012271
test eax, eax
pop ecx
jne 0x1000eff1
cmp dword [0x1001d170], 1
je 0x1000f109
cmp ebx, 0xfc
je 0x1000f13c
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1001d658
push ebp
call fcn.1000f1b3
add esp, 0xc
test eax, eax
je 0x1000f027
push esi
push esi
push esi
push esi
push esi
call fcn.1000b997
add esp, 0x14
push 0x104
mov esi, 0x1001d671
push esi
push 0
mov byte [0x1001d775], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000f06b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000f1b3
add esp, 0xc
test eax, eax
je 0x1000f06b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000b997
add esp, 0x14
push esi
call fcn.10011a00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1000f0b0
push esi
call fcn.10011a00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001d96c
push 0x1001983c
sub ecx, eax
push ecx
push eax
call fcn.1000f2eb
add esp, 0x14
test eax, eax
je 0x1000f0b0
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000b997
add esp, 0x14
jmp 0x1000f0b2
xor esi, esi
push 0x10019838
push ebx
push ebp
call fcn.10012200
add esp, 0xc
test eax, eax
je 0x1000f0d2
push esi
push esi
push esi
push esi
push esi
call fcn.1000b997
add esp, 0x14
push dword [edi*8 + 0x1001c6bc]
push ebx
push ebp
call fcn.10012200
add esp, 0xc
test eax, eax
je 0x1000f0f4
push esi
push esi
push esi
push esi
push esi
call fcn.1000b997
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10012043
add esp, 0xc
jmp 0x1000f13c
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1000f13c
cmp ebp, 0xffffffff
je 0x1000f13c
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1001c6bc]
push dword [esi]
call fcn.10011a00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret