joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40efd0
Capabilities:
Get file version info

Disassembly:
mov eax, 0x5010
call fcn.0041e1a0
mov eax, dword [0x4538d0]
xor eax, esp
mov dword [esp + 0x500c], eax
push esi
xor eax, eax
push 0x4ffe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0041dfb0
mov eax, dword [esi + 0xc]
add esp, 0xc
lea edx, [esp + 8]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40f07c
cmp eax, 0x4fff
ja 0x40f07c
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40f07c
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0x447508
lea edx, [esp + 0x1c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40f07c
mov eax, dword [esp + 4]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
push str._d._d._d._d
add esi, 0x210
push esi
call fcn.004203dd
add esp, 0x18
mov ecx, dword [esp + 0x5010]
pop esi
xor ecx, esp
call fcn.0041e18f
add esp, 0x5010
ret

Function at 0x4101c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x445d4a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4538d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.W3Client.0
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ebx
mov byte [esi + 0x14], bl
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov dword [esp + 0x18], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x4c], bl
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], ebx
mov byte [esi + 0x68], bl
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 3
call fcn.004100b0
lea ecx, [esi + 0xa4]
mov byte [esp + 0x18], 4
call fcn.0040fd30
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x410e00
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0x448850
push eax
mov esi, ecx
call fcn.00420ee9
mov edi, eax
add esp, 8
test edi, edi
je 0x410eb7
mov ecx, dword [esi + 0x2c0]
push 0
push ecx
push edi
call fcn.00420da0
mov eax, dword [esi + 0x2d4]
add esp, 0xc
test eax, eax
je 0x410e4f
push eax
call fcn.0041db26
add esp, 4
mov dword [esi + 0x2d4], 0
mov eax, dword [esi + 0x2bc]
test eax, eax
ja 0x410e6a
push edi
call fcn.004207b5
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret 4
push eax
call fcn.0041e48e
mov edx, dword [esi + 0x2bc]
push edi
push 1
push edx
push eax
mov dword [esi + 0x2d4], eax
call fcn.00420aee
push edi
call fcn.004207b5
mov eax, dword [esi + 0x2d4]
add esp, 0x18
cmp dword [eax], 0x2014b50
jne 0x410ea4
pop edi
xor eax, eax
pop esi
ret 4
push eax
call fcn.0041db26
mov dword [esi + 0x2d4], 0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret 4
Function at 0x411510
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0x448864
push ebx
mov esi, ecx
call fcn.00420ee9
mov edi, eax
add esp, 8
test edi, edi
jne 0x411536
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 8
lea eax, [esi + 0x2b0]
xor ecx, ecx
mov dword [eax + 4], ecx
push edi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push 1
mov dword [eax + 0x10], ecx
push 0x16
mov word [eax + 0x14], cx
push eax
mov dword [eax], 0x6054b50
call fcn.004210b5
push edi
call fcn.004207b5
mov edi, dword [esp + 0x28]
add esp, 0x14
test edi, edi
jne 0x411578
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
push ebx
lea eax, [esi + 0xc]
push 0x448860
push eax
call fcn.004203dd
push 0x448850
push edi
call fcn.00420ee9
add esp, 0x14
test eax, eax
je 0x41152d
push edi
lea ecx, [esi + 0x138]
push 0x448860
push ecx
call fcn.004203dd
add esp, 0xc
push 0
push edi
mov ecx, esi
call fcn.00410ef0
movzx eax, al
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
dec eax
pop ebx
ret 8

Function at 0x412d50
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445e10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4538d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov eax, dword [ecx + 0xc]
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
cmp eax, edx
jne 0x412da2
push 0x44e74c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], str.connection_failed...
call fcn.0041e4f3
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
push edx
push ecx
push eax
call dword [0x4473ac]
test eax, eax
jne 0x412de8
push 0x44e74c
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], str.response_failed...
call fcn.0041e4f3
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0xc]
push eax
call dword [0x4473b4]
mov dword [esi + 0xc], 0
mov eax, 0x412de8
ret
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x414a60
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446190
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4538d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 0x1c]
push 0
push 0
push 0
push 0
push eax
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0
call dword [0x447398]
mov dword [esi + 4], eax
test eax, eax
je 0x414c3b
cmp eax, 0xffffffff
je 0x414c3b
mov ecx, dword [ebp + 0x18]
sub ecx, 0
je 0x414b2d
sub ecx, 1
je 0x414b02
sub ecx, 1
jne 0x414b5b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x414ae3
mov ecx, 0x1bb
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push 0
push 0
push 3
push ebx
push edi
push ecx
mov ecx, dword [ebp + 8]
push ecx
push eax
call dword [0x4473c0]
mov dword [esi + 8], eax
jmp 0x414b61
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x414b0e
mov ecx, 0x50
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push 0
push 0
push 3
push ebx
push edi
push ecx
push edx
push eax
call dword [0x4473c0]
mov dword [esi + 8], eax
jmp 0x414b61
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x414b39
mov ecx, 0x15
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push 0
push 0x8000000
push 1
push ebx
push edi
push ecx
mov ecx, dword [ebp + 8]
push ecx
push eax
call dword [0x4473c0]
mov dword [esi + 8], eax
jmp 0x414b61
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
test eax, eax
je 0x414c26
cmp eax, 0xffffffff
je 0x414c26
push 0
call dword [0x4473a0]
test eax, eax
je 0x414b96
push 0x44e74c
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], str.connect_failed...
call fcn.0041e4f3
mov eax, dword [ebp + 8]
push eax
lea ecx, [esi + 0x10]
call fcn.00413e00
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x414bdf
mov eax, dword [ebp + 0x18]
sub eax, 0
je 0x414bd3
sub eax, 1
je 0x414bc7
sub eax, 1
jne 0x414be5
mov dword [esi + 0x80], 0x1bb
jmp 0x414be5
mov dword [esi + 0x80], 0x50
jmp 0x414be5
mov dword [esi + 0x80], 0x15
jmp 0x414be5
mov dword [esi + 0x80], eax
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x84], ecx
test edi, edi
je 0x414bfb
push edi
lea ecx, [esi + 0x2c]
call fcn.00413e00
test ebx, ebx
je 0x414c08
push ebx
lea ecx, [esi + 0x48]
call fcn.00413e00
mov ecx, esi
call fcn.00413cc0
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x44e74c
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], str.connect_failed...
call fcn.0041e4f3
push 0x44e74c
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], str.open_internet_failed...
call fcn.0041e4f3
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi + 4]
mov edi, dword [0x4473b4]
push ecx
mov byte [ebp - 0x11], 0
call edi
mov edx, dword [esi + 8]
push edx
call edi
mov eax, 0x414c6f
ret
Function at 0x4185c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4185cb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4186ce
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x448bd0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x448bd0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x448bd0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x448bd0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x448bd0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x448bd0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x448bd0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x448bd0]
xor eax, edx
inc ecx
dec edi
jne 0x4185e6
pop edi
test esi, esi
je 0x4186f0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x448bd0]
xor eax, edx
inc ecx
dec esi
jne 0x4186d2
pop esi
pop ebx
not eax
ret
Function at 0x10001c00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x10001c14
xor eax, eax
jmp 0x10001ce2
cmp dword [ebp + 8], edi
jne 0x10001c25
push dword [ebp + 0xc]
call dword [0xba403c]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], edi
push esi
mov esi, dword [ebp + 0x10]
jle 0x10001cde
push ebx
push 1
pop edi
mov eax, dword [ebp + 0xc]
and byte [ebp - 1], 0
and byte [ebp - 2], 0
cmp edi, dword [ebp + 8]
mov bl, byte [eax + edi - 1]
jge 0x10001c50
mov al, byte [edi + eax]
mov byte [ebp - 1], al
lea eax, [edi + 1]
cmp eax, dword [ebp + 8]
jge 0x10001c62
mov eax, dword [ebp + 0xc]
mov al, byte [edi + eax + 1]
mov byte [ebp - 2], al
mov al, byte [ebp - 2]
and al, 0x3f
mov byte [ebp - 8], al
mov al, bl
shr al, 2
push eax
call fcn.10001ce5
mov byte [esi], al
mov al, byte [ebp - 1]
and bl, 3
inc esi
shl bl, 4
shr al, 4
or bl, al
push ebx
call fcn.10001ce5
mov byte [esi], al
pop ecx
inc esi
cmp edi, dword [ebp + 8]
pop ecx
jge 0x10001cb1
mov al, byte [ebp - 1]
mov cl, byte [ebp - 2]
and al, 0xf
shl al, 2
shr cl, 6
or al, cl
push eax
call fcn.10001ce5
pop ecx
mov byte [esi], al
jmp 0x10001cb4
mov byte [esi], 0x3d
lea eax, [edi + 1]
inc esi
cmp eax, dword [ebp + 8]
jge 0x10001cca
push dword [ebp - 8]
call fcn.10001ce5
pop ecx
mov byte [esi], al
jmp 0x10001ccd
mov byte [esi], 0x3d
add edi, 3
inc esi
lea eax, [edi - 1]
cmp eax, dword [ebp + 8]
jl 0x10001c36
pop ebx
mov eax, dword [ebp + 0x10]
pop esi
pop edi
leave
ret
Function at 0x10003690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
push edi
lea edi, [esi + 8]
mov dword [edi], 0
test eax, eax
je 0x100036b9
push eax
call fcn.100394b3
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x100036ce
push eax
call fcn.100394b3
add esp, 4
mov dword [esi], 0
push 0x20000
call fcn.10038976
mov ebx, dword [ebp + 8]
push ebx
push 0x10000
push 2
push eax
mov dword [esi], eax
call fcn.10039708
add esp, 0x14
cmp eax, 0x10000
je 0x10003732
mov eax, dword [esi + 4]
mov dword [edi], 0
test eax, eax
je 0x10003712
push eax
call fcn.100394b3
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x10003727
push eax
call fcn.100394b3
add esp, 4
mov dword [esi], 0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 1
push 4
push edi
call fcn.10039708
add esp, 0x10
cmp eax, 1
je 0x10003782
mov eax, dword [esi + 4]
mov dword [edi], 0
test eax, eax
je 0x10003762
push eax
call fcn.100394b3
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x10003727
push eax
call fcn.100394b3
add esp, 4
pop edi
mov dword [esi], 0
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.10039708
add esp, 0x10
cmp eax, 1
je 0x100037a8
call fcn.10003800
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp - 1], 0
mov eax, dword [edi]
setne cl
mov byte [esi + 0xc], cl
xor ecx, ecx
mov edx, 0x10
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10038976
mov ecx, dword [ebp + 8]
mov ebx, dword [edi]
push ecx
push ebx
push 0x10
push eax
mov dword [esi + 4], eax
call fcn.10039708
add esp, 0x14
cmp eax, ebx
jne 0x10003798
dec ebx
mov dword [edi], ebx
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
push edi
lea edi, [esi + 8]
mov dword [edi], 0
test eax, eax
je 0x10004c79
push eax
call fcn.100394b3
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x10004c8e
push eax
call fcn.100394b3
add esp, 4
mov dword [esi], 0
push 0x20000
call fcn.10038976
mov ebx, dword [ebp + 8]
push ebx
push 0x10000
push 2
push eax
mov dword [esi], eax
call fcn.10039708
add esp, 0x14
cmp eax, 0x10000
je 0x10004cf2
mov eax, dword [esi + 4]
mov dword [edi], 0
test eax, eax
je 0x10004cd2
push eax
call fcn.100394b3
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x10004ce7
push eax
call fcn.100394b3
add esp, 4
mov dword [esi], 0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 1
push 4
push edi
call fcn.10039708
add esp, 0x10
cmp eax, 1
je 0x10004d42
mov eax, dword [esi + 4]
mov dword [edi], 0
test eax, eax
je 0x10004d22
push eax
call fcn.100394b3
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
test eax, eax
je 0x10004ce7
push eax
call fcn.100394b3
add esp, 4
pop edi
mov dword [esi], 0
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.10039708
add esp, 0x10
cmp eax, 1
je 0x10004d68
call fcn.10003800
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp - 1], 0
mov ebx, dword [edi]
setne cl
mov byte [esi + 0xc], cl
xor ecx, ecx
mov eax, ebx
mov edx, 0x18
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10038976
add esp, 4
test eax, eax
je 0x10004dae
dec ebx
js 0x10004db0
lea ecx, [eax + 0x14]
lea esp, [esp]
mov dword [ecx], 0xffffffff
add ecx, 0x18
dec ebx
jns 0x10004da0
jmp 0x10004db0
xor eax, eax
mov ecx, dword [ebp + 8]
mov ebx, dword [edi]
push ecx
push ebx
push 0x18
push eax
mov dword [esi + 4], eax
call fcn.10039708
add esp, 0x10
cmp eax, ebx
jne 0x10004d58
dec ebx
mov dword [edi], ebx
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10016830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c54a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10128088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0x1004f5c4
mov dword [esi + 8], 0xffffffff
xor edi, edi
mov dword [esi], 0x1004fe10
mov dword [esi + 4], 0x1004fdfc
push 0x30
mov dword [ebp - 4], edi
mov dword [esi + 0x34], edi
call fcn.10039cfe
add esp, 4
cmp eax, edi
je 0x10016942
mov dword [esi + 0x30], eax
mov dword [eax], eax
mov eax, dword [esi + 0x30]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x30]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x30]
mov al, 1
mov byte [ecx + 0x2c], al
mov edx, dword [esi + 0x30]
mov byte [edx + 0x2d], al
lea ecx, [esi + 0x40]
mov byte [ebp - 4], al
mov dword [esi + 0x3c], edi
call fcn.100239c9
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
call fcn.100239c9
lea ecx, [esi + 0x250]
mov byte [ebp - 4], 3
call fcn.100220c0
lea ecx, [esi + 0x288]
mov byte [ebp - 4], 4
call fcn.100231bb
mov dword [esi + 0x2a4], edi
mov dword [esi + 0x2a8], edi
mov dword [esi + 0x2ac], edi
mov dword [esi + 0x2b0], edi
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
or eax, 0xffffffff
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push 0x206
mov dword [esi + 0x28], eax
lea eax, [esi + 0x48]
push edi
push eax
call fcn.1003ac40
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], edi
call fcn.10038cfb
push 0x101242b8
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], 0x1004f464
call fcn.1003acba
int3

Function at 0x1001e750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004cf03
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10128088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], 0x100504fc
push 0
mov dword [esi], 0x1005050c
mov dword [esi + 0xc], 0x10050504
mov dword [esi + 0x10], eax
mov dword [esi + 0x24], ecx
call fcn.10038c25
add esp, 4
mov dword [esi + 4], eax
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0
mov dword [esi], 0x10050538
mov dword [esi + 0xc], 0x10050530
mov dword [esi + 0x28], 0
mov byte [esi + 0x2c], 0
call fcn.100239c9
push 1
push 0
push 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.100238f2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10022574
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
mov esi, ecx
je 0x100225d3
mov eax, dword [esi + 4]
test eax, eax
je 0x100225d3
cmp dword [ebp + 8], 0
je 0x100225d3
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.10039708
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100225b7
push dword [esi + 4]
call fcn.1003ad6b
pop ecx
test eax, eax
jne 0x100225b7
or eax, 0xffffffff
jmp 0x100225d5
push dword [esi + 4]
call fcn.1003ad93
pop ecx
test eax, eax
je 0x100225cf
push dword [esi + 4]
call fcn.1003c47d
pop ecx
jmp 0x100225b2
mov eax, edi
jmp 0x100225d5
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x1002261b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x10022646
mov eax, dword [ecx + 4]
test eax, eax
je 0x10022646
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.10039aa5
sub eax, dword [ebp + 0xc]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x10022648
xor eax, eax
pop ebp
ret 8
Function at 0x10023670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4008
call fcn.1003adc0
mov eax, dword [0x10128088]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x1011f5f0
push esi
call fcn.100274e1
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x100236da
call fcn.1003d019
push 0xed
push str.Zip_rzxgzip.cpp
push dword [eax]
call fcn.1003cf6c
pop ecx
push eax
push esi
push str.cant_gzopen__s:_s_inin__s_files__d_lines_n
call fcn.1003cd8f
add eax, 0x40
push eax
call fcn.1003b452
add esp, 0x18
or eax, 0xffffffff
jmp 0x10023852
push 0x1011f5f4
push edi
call fcn.1003949c
pop ecx
pop ecx
mov dword [ebp - 0x4008], eax
test eax, eax
jne 0x1002372e
push ebx
call fcn.1002728b
pop ecx
call fcn.1003d019
push 0xf6
push str.Zip_rzxgzip.cpp
push dword [eax]
call fcn.1003cf6c
pop ecx
push eax
push edi
push str.cant_gzopen__s:_s_inin__s_files__d_lines_n
call fcn.1003cd8f
add eax, 0x40
push eax
call fcn.1003b452
add esp, 0x18
push 0xfffffffffffffffe
jmp 0x10023851
mov esi, 0x4000
jmp 0x1002375d
push dword [ebp - 0x4008]
test edi, edi
je 0x100237c9
push edi
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.10039aa5
add esp, 0x10
cmp eax, edi
jne 0x10023810
push esi
lea eax, [ebp - 0x4004]
push 0
push eax
call fcn.1003ac40
push esi
lea eax, [ebp - 0x4004]
push eax
push ebx
call fcn.100274f5
mov edi, eax
add esp, 0x18
test edi, edi
jns 0x10023735
call fcn.1003d019
push 0x103
push str.Zip_rzxgzip.cpp
push dword [eax]
call fcn.1003cf6c
pop ecx
push eax
push str.gzread_error_:_s_in__s_files__d_lines_n
call fcn.1003cd8f
add eax, 0x40
push eax
call fcn.1003b452
push dword [ebp - 0x4008]
call fcn.10039c8a
push ebx
call fcn.1002728b
add esp, 0x1c
push 0xfffffffffffffffd
jmp 0x10023851
call fcn.10039c8a
push ebx
call fcn.1002728b
pop ecx
pop ecx
test eax, eax
je 0x1002380c
call fcn.1003d019
push 0x119
push str.Zip_rzxgzip.cpp
push dword [eax]
call fcn.1003cf6c
pop ecx
push eax
push str.gzclose_error_:_s_in__s_files__d_lines_n
call fcn.1003cd8f
add eax, 0x40
push eax
call fcn.1003b452
add esp, 0x14
push 0xfffffffffffffffb
jmp 0x10023851
xor eax, eax
jmp 0x10023852
call fcn.1003d019
push 0x10e
push str.Zip_rzxgzip.cpp
push dword [eax]
call fcn.1003cf6c
pop ecx
push eax
push str.fwrite_error_:_s_in__s_files__d_lines_n
call fcn.1003cd8f
add eax, 0x40
push eax
call fcn.1003b452
push dword [ebp - 0x4008]
call fcn.10039c8a
push ebx
call fcn.1002728b
add esp, 0x1c
push 0xfffffffffffffffc
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038981
leave
ret
Function at 0x10023cc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0x400]
push edi
mov edi, dword [ecx + 0x404]
je 0x10023d17
mov edx, 0xff
push ebx
dec dword [ebp + 0x10]
inc esi
and esi, edx
mov eax, dword [ecx + esi*4]
add edi, eax
and edi, edx
mov ebx, dword [ecx + edi*4]
mov dword [ecx + edi*4], eax
add al, bl
movzx eax, al
mov dword [ecx + esi*4], ebx
mov dword [ebp + 8], ebx
mov bl, byte [ecx + eax*4]
mov eax, dword [ebp + 0xc]
xor byte [eax], bl
inc eax
cmp dword [ebp + 0x10], 0
mov dword [ebp + 0xc], eax
jne 0x10023ce6
pop ebx
mov dword [ecx + 0x404], edi
pop edi
mov dword [ecx + 0x400], esi
pop esi
pop ebp
ret 0xc