joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test byte [esi + 0x18], 1
mov dword [esi], 0x1007d608
jne 0x1004f434
call fcn.1004f3a0
push ebx
mov bx, word [esi + 0xb0]
push ebp
push edi
mov edi, dword [esi + 0xac]
lea ebp, [edi + 0xc34]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, bx
push ebp
mov dword [edi + eax*4 + 0x834], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
lea ecx, [edi + 0x14]
call fcn.1004e5b0
mov ecx, dword [esi + 0x80]
push ecx
call fcn.1004f950
mov eax, dword [esi + 0x78]
add esp, 4
test eax, eax
je 0x1004f48c
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [esi + 0xa8]
mov edx, dword [edi + 0x20]
add edx, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
call fcn.1004eb50
mov eax, dword [esi + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xa4]
test eax, eax
pop edi
pop ebp
pop ebx
je 0x1004f4cf
mov ecx, dword [esi + 0xb8]
mov ecx, dword [ecx + 0x10]
push eax
add ecx, 0xc
call fcn.1004a7a0
mov ecx, dword [esi + 0x8c]
test ecx, ecx
lea eax, [esi + 0x8c]
je 0x1004f4e6
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, esi
pop esi
jmp fcn.10044aa0

Function at 0x10053760
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [eax + 0x10], eax
mov eax, dword [esp + 0x10]
push esi
xor esi, esi
mov dword [eax + 8], esi
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
mov ecx, dword [eax + 0x10]
push 1
call fcn.1004a370
mov ecx, eax
cmp ecx, esi
je 0x10053863
mov eax, dword [ecx + 0x14]
mov word [eax + 2], si
mov word [eax], si
mov edx, dword [esp + 0x14]
mov dword [edx + 0x18], ecx
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x1c]
add edx, 0xc4
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
lock xadd dword [edx], eax
mov dword [esp + 8], eax
xor eax, eax
mov ax, word [ecx + 0x10]
cmp ax, si
je 0x100537eb
mov edx, dword [ecx + 0x14]
sub ax, word [edx + 2]
sub eax, 5
jmp 0x100537ed
xor eax, eax
mov ecx, dword [ecx + 0x14]
mov dx, word [ecx + 2]
mov esi, dword [esp + 0x14]
push 0x10053660
movzx edx, dx
movzx eax, ax
push esi
add edx, eax
push edx
add ecx, 5
push ecx
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x1005386f
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
add eax, 0xc4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
lock xadd dword [edx], eax
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [edx + 0x18]
push ecx
mov esi, eax
mov ecx, 0x18fe
call fcn.100531c0
add esp, 8
mov eax, 4
pop esi
add esp, 0xc
ret 8
xor eax, eax
pop esi
add esp, 0xc
ret 8
Function at 0x100540c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [ebx + 0x24]
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
lea ecx, [ecx]
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub edx, ecx
sub edx, esi
jne 0x100540ee
test ecx, ecx
jne 0x100540fd
test esi, esi
jne 0x100540fd
mov edx, eax
jmp 0x1005417a
cmp edx, 0xffffffff
jne 0x100540fd
mov edx, 0xfffffffe
jmp 0x1005417a
mov esi, dword [ebx + 0x24]
lea esi, [eax + esi - 0x106]
cmp ecx, esi
jb 0x1005417a
mov edi, dword [ebx + 0x30]
mov ecx, eax
mov ebp, ecx
shr ecx, 2
lea esi, [edi + eax]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x68]
mov esi, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x54]
sub edi, eax
sub esi, eax
sub ecx, eax
mov dword [ebx + 0x68], edi
mov edi, dword [ebx + 0x44]
mov dword [ebx + 0x54], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [ebx + 0x64], esi
lea esi, [ecx + edi*2]
movzx ecx, word [esi - 2]
sub esi, 2
cmp ecx, eax
jb 0x10054151
sub ecx, eax
jmp 0x10054153
xor ecx, ecx
dec edi
mov word [esi], cx
jne 0x10054142
mov ecx, dword [ebx + 0x38]
mov edi, eax
lea esi, [ecx + eax*2]
movzx ecx, word [esi - 2]
sub esi, 2
cmp ecx, eax
jb 0x10054170
sub ecx, eax
jmp 0x10054172
xor ecx, ecx
dec edi
mov word [esi], cx
jne 0x10054161
add edx, eax
mov ebp, dword [ebx]
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x10054241
mov esi, dword [ebx + 0x64]
mov edi, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
add edi, esi
add edi, ecx
mov ecx, dword [ebp + 4]
mov esi, ecx
cmp esi, edx
mov dword [esp + 0xc], esi
jbe 0x100541a7
mov dword [esp + 0xc], edx
mov esi, edx
test esi, esi
jne 0x100541af
xor ecx, ecx
jmp 0x100541fd
mov edx, dword [ebp + 0x1c]
sub ecx, esi
mov dword [ebp + 4], ecx
mov ecx, dword [edx + 0x18]
test ecx, ecx
jne 0x100541d6
mov eax, dword [ebp]
mov ecx, dword [ebp + 0x30]
push esi
push eax
push ecx
call fcn.10055dc0
mov dword [ebp + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, esi
mov esi, dword [ebp]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
mov esi, dword [ebp]
mov edx, dword [ebp + 8]
add esi, ecx
add edx, ecx
mov dword [ebp], esi
mov dword [ebp + 8], edx
mov edx, dword [ebx + 0x6c]
add edx, ecx
mov edi, edx
cmp edi, 3
mov dword [ebx + 0x6c], edx
jb 0x1005422c
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
lea esi, [ecx + edx]
movzx edx, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], edx
shl edx, cl
movzx ecx, byte [esi + 1]
xor edx, ecx
and edx, dword [ebx + 0x4c]
mov dword [ebx + 0x40], edx
cmp edi, 0x106
jae 0x10054241
mov edx, dword [ebx]
mov ecx, dword [edx + 4]
test ecx, ecx
jne 0x100540d0
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x1005e580
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x1008f354]
push edi
xor edi, edi
cmp eax, edi
jne 0x1005e5b8
mov dword [0x1008f354], 1
call fcn.100661e0
push edi
mov dword [0x1008f344], edi
mov dword [0x1008f348], edi
mov dword [0x1008f34c], edi
call fcn.1005e370
add esp, 4
pop edi
ret
push esi
call fcn.10066220
mov esi, eax
cmp esi, edi
jne 0x1005e5cf
push edi
call fcn.1005e370
add esp, 4
mov esi, eax
mov eax, dword [0x1008f348]
cmp eax, esi
jne 0x1005e5e1
mov ecx, dword [0x1008f34c]
inc ecx
jmp 0x1005e5fb
push esi
push 0x1008f344
call fcn.1005e290
mov eax, esi
add esp, 8
mov dword [0x1008f348], eax
mov ecx, 1
mov esi, dword [0x1008f354]
inc esi
dec ecx
mov dword [0x1008f354], esi
pop esi
mov dword [0x1008f34c], ecx
jne 0x1005e627
mov dword [0x1008f348], edi
push 0x1008f344
mov edi, eax
call fcn.1005e300
add esp, 4
pop edi
ret
Function at 0x10060ee0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x1008f990]
test eax, eax
jne 0x10060f90
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr ecx, 0x1f
not ecx
and ecx, 1
movzx edx, al
movzx esi, ah
je 0x10060f10
shr eax, 0x10
and eax, 0xffff7fff
jmp 0x10060f12
xor eax, eax
test ecx, ecx
mov dword [0x1008f984], edx
mov dword [0x1008f988], esi
mov dword [0x1008f98c], eax
mov dword [0x1008f980], ecx
je 0x10060f48
mov dword [0x1008f97c], 6
mov dword [0x1008f990], 1
pop esi
mov eax, 0x1008f97c
ret
cmp edx, 4
jne 0x10060f7b
test esi, esi
jne 0x10060f6c
mov dword [0x1008f97c], 3
mov dword [0x1008f990], 1
pop esi
mov eax, 0x1008f97c
ret
cmp esi, 0xa
mov dword [0x1008f97c], 4
je 0x10060f85
mov dword [0x1008f97c], 5
mov dword [0x1008f990], 1
pop esi
mov eax, 0x1008f97c
ret

Function at 0x10063520
Capabilities:
Get hostname

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xc]
mov byte [esi], 0
push ecx
mov byte [esi + edi - 1], 0
mov dword [esp + 0x24], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x10063561
dec edi
push edi
lea edx, [esp + 0xc]
push edx
push esi
call fcn.10068b10
add esp, 0xc
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x10063da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x114
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x124]
mov ebp, ecx
push ebx
push ebx
push esi
mov dword [ebp], 0x10080668
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], ebx
call fcn.10062eb0
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp + 4], eax
je 0x10063e0f
push eax
call fcn.10062e70
lea edx, [esp + 0x1c]
add esp, 4
mov dword [ebp + 4], 0xffffffff
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10063e00
jmp 0x10063ed3
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.1005ea00
add esp, 0xc
call fcn.10069757
mov dword [eax], ebx
cmp byte [esp + 0x18], bl
jne 0x10063ed3
cmp dword [esp + 0x128], ebx
je 0x10063ec0
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
push str.SoftwareODBCODBC.INIODBC_File_DSN
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10063ec0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.DefaultDSNDir
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10063e96
push edi
lea edi, [esp + 0x1c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10063ea5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x10063ed3
push 0x104
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.1005eea0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.100616c0
add esp, 4
mov dword [ebp + 0x10], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x114
ret 0xc

Function at 0x100661a0
Capabilities:
Allocate thread local storage
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
mov eax, str.Unknown_error
je 0x100661b0
mov eax, esi
push 0
push str.SQLAnywhere_Fatal_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
je 0x100661cd
push esi
call fcn.1006a45e
add esp, 4
push 1
call fcn.1006c11a
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10066250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd0
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov ebx, 0x1008be94
jmp 0x10066270
mov ecx, 0xa
mov esi, str.SoftwareSybaseAdaptive_Server_Anywhere
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10066286
mov ax, word [0x1007c904]
mov word [edi], ax
mov eax, dword [esp + 0xe4]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100662a0
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100662b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push eax
call ebp
test eax, eax
jne 0x1006632a
mov edx, dword [esp + 0xec]
lea ecx, [esp + 0xf0]
push ecx
mov ecx, dword [esp + 0xec]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1006632a
mov ecx, dword [esp + 0xf4]
cmp dword [esp + 0x14], ecx
je 0x10066346
add ebx, 4
cmp ebx, 0x1008be9c
jl 0x10066270
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd0
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd0
ret

Function at 0x10066a30
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor ecx, ecx
cmp edi, ecx
mov byte [esp + 3], cl
jbe 0x10066a6a
push ebx
push ebp
lea ecx, [ecx]
xor edx, edx
mov eax, ecx
mov ebp, 0xe
div ebp
mov bl, byte [ecx + esi]
mov al, byte [edx + 0x10080bc8]
mov dl, byte [esp + 0xb]
xor al, bl
xor al, dl
mov byte [ecx + esi], al
inc ecx
cmp ecx, edi
mov byte [esp + 0xb], bl
jb 0x10066a40
pop ebp
pop ebx
pop ecx
ret
Function at 0x10068869
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10068956
mov eax, 0x94
call fcn.10068480
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100689cb
mov ecx, dword [esi + 0x10]
mov dword [0x1008faf8], ecx
mov eax, dword [esi + 4]
mov dword [0x1008fb04], eax
mov edx, dword [esi + 8]
mov dword [0x1008fb08], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1008fafc], esi
je 0x100688d4
or esi, 0x8000
mov dword [0x1008fafc], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1008fb00], eax
call fcn.1006c437
test eax, eax
pop ecx
je 0x100689cb
call fcn.1006de1a
test eax, eax
jne 0x10068901
call fcn.1006c488
jmp 0x100689cb
call fcn.1006fb2e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10091304], eax
call fcn.1006fa0c
mov dword [0x1008fa94], eax
call fcn.1006f4ed
test eax, eax
jl 0x1006894f
call fcn.1006f96a
test eax, eax
jl 0x1006894a
call fcn.1006f737
test eax, eax
jl 0x1006894a
call fcn.1006bfe2
test eax, eax
jne 0x1006894a
inc dword [0x1008fa90]
jmp 0x100689dc
call fcn.1006f6eb
call fcn.1006dc0d
jmp 0x100688f7
test eax, eax
jne 0x10068986
cmp dword [0x1008fa90], eax
jle 0x100689cb
dec dword [0x1008fa90]
cmp dword [0x1008fb34], eax
jne 0x10068975
call fcn.1006c13c
call fcn.1006f6eb
call fcn.1006dc0d
call fcn.1006c488
jmp 0x100689dc
cmp eax, 2
jne 0x100689cf
push 0x88
push 1
call fcn.1006a196
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x100689cb
push esi
push dword [0x1008c64c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x100689c5
call fcn.1006dc2b
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x100689dc
call fcn.10067c4e
pop ecx
xor eax, eax
jmp 0x100689df
cmp eax, 3
jne 0x100689dc
push 0
call fcn.1006dcaf
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x1006a96a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006a98a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10069769
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x1006a9ad
test byte [esp + 8], 2
je 0x1006a9ad
call fcn.10069757
mov dword [eax], 0xd
call fcn.10069760
mov dword [eax], 5
jmp 0x1006a986
xor eax, eax
ret
Function at 0x1006b2be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x1006b484
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x100901c0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x1006b484
test cl, 0x48
je 0x1006b324
mov al, byte [eax + 5]
cmp al, 0xa
je 0x1006b324
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006b376
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x1006b35e
call fcn.10069757
mov dword [eax], 9
call fcn.10069760
mov dword [eax], esi
jmp 0x1006b36e
cmp eax, 0x6d
je 0x1006b484
push eax
call fcn.10069769
pop ecx
or eax, 0xffffffff
jmp 0x1006b486
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x1006b47f
test edx, edx
je 0x1006b399
cmp byte [ebx], 0xa
jne 0x1006b399
or al, 4
jmp 0x1006b39b
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x1006b479
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x1006b469
cmp al, 0xd
je 0x1006b3cf
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x1006b45b
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x1006b3e9
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x1006b3e4
add dword [ebp + 0x10], 2
jmp 0x1006b43d
mov dword [ebp + 0x10], eax
jmp 0x1006b457
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006b411
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1006b457
cmp dword [ebp - 0xc], 0
je 0x1006b457
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x1006b432
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x1006b43d
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x1006b45a
cmp ebx, dword [ebp + 0xc]
jne 0x1006b442
cmp byte [ebp - 1], 0xa
jne 0x1006b442
mov byte [ebx], 0xa
jmp 0x1006b45a
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10070cb1
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x1006b45b
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x1006b3b3
jmp 0x1006b479
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x1006b479
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x1006b486
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1006b549
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1008c8f0]
xor eax, dword [ebp + 4]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
jne 0x1006b572
xor eax, eax
jmp 0x1006b6e0
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100901c0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x1006b5a5
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.1006aace
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1006b677
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jbe 0x1006b6b2
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], edi
cmp ecx, dword [ebp + 0x10]
jae 0x1006b600
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1006b5f1
inc dword [ebp - 0x18]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0xc]
mov byte [eax], dl
inc eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x400
jl 0x1006b5d4
mov edi, eax
lea eax, [ebp - 0x420]
sub edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006b640
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
cmp eax, edi
jl 0x1006b649
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x1006b5c5
jmp 0x1006b64b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x1006b6db
cmp dword [ebp - 8], edi
je 0x1006b6b2
push 5
pop esi
cmp dword [ebp - 8], esi
jne 0x1006b6a4
call fcn.10069757
mov dword [eax], 9
call fcn.10069760
mov dword [eax], esi
jmp 0x1006b6ad
push edi
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006b699
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x1006b64b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1006b64b
push dword [ebp - 8]
call fcn.10069769
pop ecx
or eax, 0xffffffff
jmp 0x1006b6de
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1006b6c7
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x1006b6c7
xor eax, eax
jmp 0x1006b6de
call fcn.10069757
mov dword [eax], 0x1c
call fcn.10069760
mov dword [eax], edi
jmp 0x1006b6ad
sub eax, dword [ebp - 0x18]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.10070fd2
leave
ret
Function at 0x1006c047
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.1006c3ec
xor esi, esi
inc esi
cmp dword [0x1008fb38], esi
pop ecx
jne 0x1006c06f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x1008fb34], esi
mov byte [0x1008fb30], al
jne 0x1006c0d5
mov ecx, dword [0x100902ec]
test ecx, ecx
je 0x1006c0b6
mov eax, dword [0x100902e8]
sub eax, 4
cmp eax, ecx
jmp 0x1006c0af
mov eax, dword [eax]
test eax, eax
je 0x1006c0a1
call eax
mov eax, dword [0x100902e8]
sub eax, 4
cmp eax, dword [0x100902ec]
mov dword [0x100902e8], eax
jae 0x1006c099
mov eax, 0x1008402c
mov esi, 0x10084034
cmp eax, esi
mov edi, eax
jae 0x1006c0d5
mov eax, dword [edi]
test eax, eax
je 0x1006c0ce
call eax
add edi, 4
cmp edi, esi
jb 0x1006c0c6
mov eax, 0x10084038
mov esi, 0x1008403c
cmp eax, esi
mov edi, eax
jae 0x1006c0f4
mov eax, dword [edi]
test eax, eax
je 0x1006c0ed
call eax
add edi, 4
cmp edi, esi
jb 0x1006c0e5
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x1006c105
push 8
call fcn.1006c358
jmp 0x1006c117
push dword [ebp + 8]
mov dword [0x1008fb38], 1
call fcn.1006bfa0
pop ecx
pop ebp
ret

Function at 0x1006c229
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x1006c245
call fcn.10069757
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x1006c2b7
push esi
push 0x88
push 1
call fcn.1006a196
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1006c29d
push esi
call fcn.1006dc2b
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x1006c189
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x1006c295
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1006c2b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.10067c4e
test ebx, ebx
pop ecx
je 0x1006c2af
push ebx
call fcn.10069769
pop ecx
or eax, 0xffffffff
jmp 0x1006c2b6
mov eax, edi
pop esi
pop edi
pop ebx
ret