joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403354
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x2420900], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x4033a0
push 0x402df8
push 0x402e04
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x402e18
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4284a8]
mov dword [ebp - 0x28], eax
mov eax, dword [str.e1_]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.0040334d
mov eax, dword [0x4284b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4284b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x4033df
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x2420900], 0xc
mov dword [ebp - 4], eax
jne 0x403441
push ebx
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc4c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2420900]
cmp eax, 0xfa9
jne 0x40345d
mov dword [0x241fe9c], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40346a
mov dword [0x241f84c], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x241fe98], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x2420900], 0x213
mov dword [ebp - 0x18], edx
jne 0x4034aa
push 0x402e30
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00403347
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x4033dc
cmp dword [0x2420900], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x403514
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4
Function at 0x402f83
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0x5cf120], 0x594
mov dword [ebp - 0xc], eax
jne 0x402fcb
push 0x402d48
push 0x402d58
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
mov eax, dword [str..9_7]
push ebx
mov ebx, dword [0x45b4cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x30], 0x9e3779b9
call fcn.00402f7c
mov eax, dword [0x45b4d0]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x45b4d4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x5cf120], 0xc
mov dword [ebp - 4], ecx
jne 0x403075
push esi
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x84c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
add dword [ebp - 4], ecx
mov ecx, dword [0x5cf120]
cmp ecx, 0xfa9
jne 0x403093
mov dword [0x5ce6bc], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x4030a1
mov dword [0x5ce070], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0x5ce6b8], 0xf4ea3dee
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x5cf120], 0x213
mov dword [ebp - 0x18], ecx
jne 0x4030dc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x40300a
cmp dword [0x5cf120], 0xa6d
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
pop ebx
jne 0x40313d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret 4
Function at 0x403416
Capabilities:
Extract resource via kernel32 functions
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
xor esi, esi
cmp dword [0x5cf120], 0x400
push edi
jne 0x403483
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__hwrite]
push esi
push esi
call fcn.00403780
push esi
push esi
call fcn.00403780
push esi
call fcn.0040394a
push esi
push esi
push esi
call fcn.00404221
add esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00402ee0
fstp st(0)
push esi
call fcn.004042a6
push esi
call fcn.00404038
push esi
push esi
call fcn.00403674
add esp, 0x10
mov eax, dword [0x45bb54]
mov dword [0x5cf120], eax
mov eax, dword [0x45bb2c]
mov dword [0x5cf124], eax
call fcn.00403217
mov dword [ebp - 4], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 4], ebx
jle 0x4034e5
cmp dword [ebp - 8], 0x785074d5
jne 0x4034f1
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1c1b
jl 0x4034a4
xor edi, edi
push esi
lea eax, [ebp - 0x820]
push eax
push esi
push 0x402dc8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x402dec
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp edi, ebx
jle 0x403521
cmp dword [ebp - 8], 0x785074d5
jne 0x40352a
inc edi
cmp edi, 0x11915
jl 0x4034f3
mov eax, dword [0x5ce074]
mov dword [0x5ce6b4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x404c10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45a0e8]
jne 0x404c1a
repz ret
jmp fcn.0040a7b2
Function at 0x40a4d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407192
and dword [ebp - 4], 0
cmp dword [0x45c420], 0
mov ebx, eax
jne 0x40a586
push 0x401bc4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a637
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401bb8
push edi
call esi
test eax, eax
je 0x40a637
push eax
call fcn.00407120
mov dword [esp], 0x401ba8
push edi
mov dword [0x45c420], eax
call esi
push eax
call fcn.00407120
mov dword [esp], 0x401b94
push edi
mov dword [0x45c424], eax
call esi
push eax
call fcn.00407120
mov dword [esp], 0x401b78
push edi
mov dword [0x45c428], eax
call esi
push eax
call fcn.00407120
pop ecx
mov dword [0x45c430], eax
test eax, eax
je 0x40a586
push 0x401b60
push edi
call esi
push eax
call fcn.00407120
pop ecx
mov dword [0x45c42c], eax
mov eax, dword [0x45c42c]
cmp eax, ebx
je 0x40a5de
cmp dword [0x45c430], ebx
je 0x40a5de
push eax
call fcn.0040719b
push dword [0x45c430]
mov esi, eax
call fcn.0040719b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a5de
test edi, edi
je 0x40a5de
call esi
test eax, eax
je 0x40a5d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a5d5
test byte [ebp - 0xc], 1
jne 0x40a5de
or dword [ebp + 0x10], 0x200000
jmp 0x40a617
mov eax, dword [0x45c424]
cmp eax, ebx
je 0x40a617
push eax
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a617
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a617
mov eax, dword [0x45c428]
cmp eax, ebx
je 0x40a617
push eax
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a617
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45c420]
call fcn.0040719b
pop ecx
test eax, eax
je 0x40a637
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a639
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2a3e1951
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3211cc9
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e85
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
sub byte [esi + edi], 0x64
call ebx
add byte [esi + edi], 4
call ebx
xor byte [esi + edi], 0xfd
call ebx
add byte [esi + edi], 0xbe
call ebx
add byte [esi + edi], 0x6d
call ebx
add byte [esi + edi], 0x45
call ebx
add byte [esi + edi], 0x30
call ebx
xor byte [esi + edi], 0x11
call ebx
add byte [esi + edi], 0xa1
call ebx
add byte [esi + edi], 0x16
call ebx
xor byte [esi + edi], 0x9c
call ebx
add byte [esi + edi], 0x33
call ebx
add byte [esi + edi], 0x33
call ebx
add byte [esi + edi], 0x99
call ebx
add byte [esi + edi], 0x57
call ebx
add byte [esi + edi], 0x86
call ebx
xor byte [esi + edi], 0xf8
call ebx
add byte [esi + edi], 0xe
call ebx
add byte [esi + edi], 0xb0
call ebx
add byte [esi + edi], 0x3f
call ebx
add byte [esi + edi], 0x1e
call ebx
add byte [esi + edi], 0x8a
call ebx
add byte [esi + edi], 0xe3
call ebx
add byte [esi + edi], 0xcf
call ebx
add byte [esi + edi], 8
call ebx
xor byte [esi + edi], 0xc5
call ebx
add byte [esi + edi], 0x10
call ebx
add byte [esi + edi], 0x19
call ebx
add byte [esi + edi], 0x5b
call ebx
add byte [esi + edi], 0x1f
call ebx
add byte [esi + edi], 0x1b
call ebx
xor byte [esi + edi], 0x78
call ebx
xor byte [esi + edi], 0x6d
call ebx
xor byte [esi + edi], 0xa
call ebx
add byte [esi + edi], 0x6e
call ebx
add byte [esi + edi], 0xf0
call ebx
xor byte [esi + edi], 0x31
call ebx
add byte [esi + edi], 0xf2
call ebx
add byte [esi + edi], 0xc1
call ebx
xor byte [esi + edi], 0xa4
call ebx
add byte [esi + edi], 0x5f
call ebx
xor byte [esi + edi], 0x15
call ebx
add byte [esi + edi], 0xf4
call ebx
xor byte [esi + edi], 0x12
call ebx
add byte [esi + edi], 0x5f
call ebx
xor byte [esi + edi], 0x23
call ebx
add byte [esi + edi], 4
call ebx
add byte [esi + edi], 0x16
call ebx
add byte [esi + edi], 0xa2
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x45a8ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f78
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e6
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f90
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f40
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f4c
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f7a
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40c75f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c76e
pop dword [ebp - 0x30]
mov eax, 0x3aa43e72
add eax, 0xc59c88fc
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x37e0a
push 0
mov eax, 0xbe234867
sub eax, 0xbde26747
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x79926b47
add ecx, 0x866dd6d4
mov edx, eax
mov edi, 0x678d5791
add edi, 0x98b4206f
add edi, dword [ebp - 0x30]
mov esi, 0x1be97101
add esi, 0xbd3f2674
add dword [ebp - 0x28], ecx
mov ebx, dword [edi]
sub dword [ebp - 0x20], edx
xor ebx, esi
add dword [ebp - 0x2c], 0x8ee944a0
mov dword [edx], ebx
mov dword [ebp - 0x1c], 0xc90b54bb
add edx, 0x75a6b36b
sub edx, 0x75a6b367
add edi, 4
loop 0x40c7cd
add eax, 0xfb3f
xor ebx, ebx
add ebx, eax
add eax, 0x1835c47d
add eax, 0xe7ca3b88
mov ecx, 0xb3ba95ae
add ecx, 0x4c856a52
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x1001200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.01003600
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
je 0x10012b4
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100122c
sub eax, ecx
mov dword [ebp - 4], eax
lea eax, [eax + eax + 2]
push eax
push ebx
call esi
push eax
call edi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10012b4
mov eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
jl 0x10012a7
push dword [ebp - 4]
lea eax, [ebp - 4]
push dword [ebp - 8]
push eax
push 0x1fff
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeToOemN]
test eax, eax
jl 0x10012a7
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x200c], bl
lea eax, [ebp - 0x200c]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
pop ecx
pop ecx
push dword [ebp - 8]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x10012c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0x400
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 4], eax
lea eax, [eax + eax + 2]
push eax
push ebx
call esi
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x100134d
mov eax, dword [ebp - 4]
push eax
push dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
jl 0x100134d
push dword [ebp - 4]
lea eax, [ebp - 4]
push esi
push eax
push 0x1fff
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeToOemN]
test eax, eax
jl 0x100134d
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x200c], bl
lea eax, [ebp - 0x200c]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x10013d7
Capabilities:
Terminate process

Disassembly:
push esi
push 0x1ce8
call fcn.01001356
mov esi, dword [sym.imp.msvcrt.dll_fprintf]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x1001130
push eax
call esi
add esp, 0xc
push 0x1cf7
call fcn.01001356
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x100112c
push eax
call esi
add esp, 0xc
push 0
call dword [sym.imp.msvcrt.dll_exit]
pop esi

Function at 0x1001447
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
call fcn.01001356
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 0x100112c
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 0xc
push 1
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x10016a2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1006608]
push ebx
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
je 0x10016eb
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x1006614], eax
jne 0x10016f4
push ebx
push dword [0x1006608]
call fcn.01001200
jmp 0x10016f4
push 0xfffffffffffffff6
call edi
mov dword [0x1006614], eax
push dword [0x1006614]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileType]
call esi
cmp eax, 1
mov dword [0x10061b8], eax
jne 0x1001745
lea eax, [ebp - 4]
push eax
push dword [0x1006614]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 1
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.01003640
xor ecx, ecx
add eax, dword [ebp - 8]
mov dword [0x1006128], ebx
adc edx, ecx
mov dword [0x1004008], eax
mov dword [0x100400c], edx
jmp 0x100175d
or dword [0x1004008], 0xffffffff
or dword [0x100400c], 0xffffffff
mov dword [0x1006128], 0x1000
cmp dword [0x10061d8], ebx
jne 0x100178f
push 0xfffffffffffffff5
call edi
push eax
mov dword [0x1006114], eax
call esi
cmp eax, 2
mov dword [0x10061d0], eax
jne 0x1001799
lea eax, [ebp - 0xc]
push eax
push dword [0x1006114]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x1001799
mov dword [0x10061d0], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor esi, esi
push ebx
push ebx
push 1
push ebx
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x1006638], eax
call edi
mov dword [esi + 0x1006098], eax
add esi, 0x1c
cmp esi, 0x38
jl 0x10017a1
pop edi
pop esi
pop ebx
leave
ret