joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025dd0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10025e71
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025e51
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10025e32
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10025e4f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000bcce
mov dword [eax], 1
jmp 0x10025e27
jmp 0x10025e6f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10025e6f
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10025e8e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0
push 0x6361
push dword [ebp - 0x2c]
push 0x3afc
call fcn.1001e7c4
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10029883
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029902
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100298d4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100298d2
push 0xe1f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x10029900
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10029900
push 0
push 0
push 0x192
push 0x2ce
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x10029923
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x297f
push 1
call fcn.10013646
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10029927
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10029954
push 0x5afe
push 1
push 0x7bd
push 0x3e49
call fcn.100299da
add esp, 0x10
jmp 0x100299d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100299b0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.1000bcce
mov esi, eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.1000bcce
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100299d5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100299d5
push 0xe1f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10029a01
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x10029aeb
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10029a4c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10029a47
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x10029ae6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jg 0x10029a91
mov dword [ebp - 0x14], 1
jmp 0x10029a95
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
ja 0x10029aa4
mov dword [ebp - 0x18], 1
jmp 0x10029aa8
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp - 0x18]
jmp 0x10029abb
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x10029b6d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10029b22
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1c32
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10029b6d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10029b50
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jge 0x10029b6d
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.1000bcce
mov dword [eax], 0x20ea0c8d
jmp 0x10029b45
mov esp, ebp
pop ebp
ret
Function at 0x10029d31
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b8aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10029da3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10029d8a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10029d88
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10029d9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x10029ef1
mov dword [ebp - 0x38], 0x139d
cmp dword [ebp - 0x38], 0x1250
jge 0x10029ecb
lea eax, [ebp - 0x18]
push eax
push 0x10009ae8
call fcn.10050bab
pop ecx
pop ecx
lea ecx, [ebp - 0x54]
call fcn.1002e514
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.1002e514
mov byte [ebp - 4], 1
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x3c], 0
je 0x10029e90
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x10009e24
call fcn.10050bab
add esp, 0x10
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x54]
call fcn.1002e5fd
test eax, eax
jne 0x10029e40
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x4c]
call fcn.1002e5fd
test eax, eax
je 0x10029e6b
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.1002e529
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x54]
call fcn.1002e529
jmp 0x10029e8b
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x54]
call fcn.1002e529
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x4c]
call fcn.1002e529
jmp 0x10029de7
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jge 0x10029ea4
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x100099ec
call fcn.10050dc6
pop ecx
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.1002e8c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.1002e8c6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
push 0x56c1
push dword [ebp - 0x40]
push 0x676a
push 1
push dword [ebp - 0x44]
call fcn.1001391f
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10040416
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006beb5
call fcn.1006aa48
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x18], 0x7f30
cmp dword [ebp - 0x18], 0x7fe1
push edi
mov dword [ebp - 0x10], esp
jle 0x10040474
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov esi, 0x7bfd
mov eax, ebx
mov ecx, 0x1065c1d8
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb3b
dec ebx
dec esi
jne 0x10040447
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xa42
jl 0x10040440
inc edi
cmp edi, 0x3fa7
jl 0x1004043b
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x7dff
jge 0x10040490
mov edx, 0x10009f88
mov ecx, 0x1065c1d8
call fcn.1002f3d6
fldz
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100666a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10070770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10056f68
mov dword [ebp - 0x14], eax
cmp dword [0x1065d300], esi
jne 0x10066798
push 0x800
push esi
push 0x10009880
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10066725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10066878
push esi
push esi
push 0x10009880
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10066878
push 0x10009898
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10066878
push eax
call ebx
push 0x100098a4
push edi
mov dword [0x1065d300], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100098b4
push edi
mov dword [0x1065d304], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100098c8
push edi
mov dword [0x1065d308], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065d310], eax
test eax, eax
je 0x10066795
push 0x100098e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065d30c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100667bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100667b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100667d2
push 4
pop eax
jmp 0x1006687a
cmp dword [ebp - 0x14], esi
je 0x100667d2
push dword [0x1065d300]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100667b7
mov eax, dword [0x1065d30c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10066830
cmp dword [0x1065d310], edi
je 0x10066830
push eax
call ebx
push dword [0x1065d310]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10066830
test eax, eax
je 0x10066830
call ecx
test eax, eax
je 0x10066825
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10066825
test byte [ebp - 8], 1
jne 0x10066830
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10066860
mov eax, dword [0x1065d304]
cmp eax, edi
je 0x1006685d
push eax
call ebx
test eax, eax
je 0x1006685d
call eax
mov esi, eax
test esi, esi
je 0x1006685d
mov eax, dword [0x1065d308]
cmp eax, edi
je 0x1006685d
push eax
call ebx
test eax, eax
je 0x1006685d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065d300]
call ebx
test eax, eax
je 0x10066878
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006687a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005452a
mov esp, ebp
pop ebp
ret
Function at 0x10001780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10005a58
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10009018]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov eax, dword [0x10009018]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov edi, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], esi
cmp dword [edi + 4], esi
je 0x10001883
push 0x48
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, esi
je 0x1000181b
lea esi, [esp + 0x54]
call fcn.10002240
mov ecx, dword [edi + 4]
mov ebx, dword [esp + 0x10]
mov edx, esi
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x20], 1
call fcn.10001160
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x1000181f
mov dword [esp + 0x10], esi
test byte [esp + 0x18], 1
je 0x10001840
mov eax, dword [esp + 0x54]
test eax, eax
je 0x10001840
lea ecx, [esp + 0x60]
cmp eax, ecx
je 0x10001840
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov esi, dword [esp + 0x10]
add esi, 4
cmp dword [esi], 0xffffffff
jne 0x10001864
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x10002940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x44]
push 0x7530
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001887
mov edx, dword [esp + 0x10]
mov byte [edx + 0xc], 1
xor al, al
jmp 0x100018f0
lea eax, [edi + 0x18]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [esp + 0x24]
call fcn.10002240
mov eax, dword [esp + 0x10]
mov dword [esp + 0x50], eax
add edi, 8
mov eax, esi
mov ecx, edi
mov dword [esp + 0x90], 0
call 0x100035c0
push eax
lea ecx, [esp + 0x20]
push ecx
push edi
call fcn.100031d0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100018e3
lea edx, [esp + 0x30]
cmp eax, edx
je 0x100018e3
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10004f80
mov esp, ebp
pop ebp
ret 8
Function at 0x10001fc0
Capabilities:
Inspect section memory permissions

Disassembly:
inc dword [ebx + 0x39660cc4]
pop edi
push es
mov dword [ebp + 0xc], ebx
jbe 0x10002000
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.10001a01
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x10001fcd
call fcn.10001a90
and dword [eax + 0x7e8b2ea5], 0x3c
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1000227f
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x10002035
cmp dword [eax + 0xc], ebx
je 0x100020d8
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.10001a90
add dl, bh
salc
mov edi, 0x750c5d39
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.10001a90
fst dword [eax - 0x16]
push es
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x10002144
add eax, esi
cmp dword [eax], ebx
je 0x10002144
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1000213f
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10002129
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10002131
cmp edx, ebx
jne 0x1000227f
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10002100
add eax, dword [eax + 4]
jmp 0x100020ed
mov dword [ebp + 0xc], ebx
jmp 0x1000214f
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10002167
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10002185
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100021e3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100021ca
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100021d3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100021dd
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100021bf
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10002149
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x100022c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x62fffffc], esi
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10001aa0
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]

Function at 0x10002330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001a55
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10001aa0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001a55
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.10001aa0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001a55
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.10001a90
mov ebp, 0x8032254a
movsd dword es:[edi], dword [esi]
int3
Function at 0x100029c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10001aa0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001a55
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10001a90
insb byte es:[edi], dx
jmp 0x14692431
Function at 0x10004260
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ecx + 8]
push esi
lea eax, [ebp - 4]
push eax
or esi, 0xffffffff
push ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov dword [ebp - 8], eax
and eax, ecx
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x100042af
call esi
test eax, eax
jne 0x100042af
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
test eax, eax
je 0x100042d4
mov dword [eax], 0
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret 4
call esi
test eax, eax
je 0x100042c3
jle 0x100042c8
and eax, 0xffff
or eax, 0x80070000
jmp 0x100042c8
mov eax, 0x8007054f
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
test ecx, ecx
je 0x100042d4
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10004f80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10009018]
jne 0x10004f8a
repz ret
jmp fcn.100054fb