joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418f30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x418f68
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x190]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x78], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x190]
movzx eax, byte [edx + 8]
test eax, eax
je 0x419035
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x78]
cmp eax, dword [edx + 0x60]
jae 0x418ffd
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x418fc3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x78]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x60]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x78
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x194]
mov edx, dword [ecx + 4]
call edx
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
cmp ecx, dword [ebp - 4]
jne 0x418ffb
xor al, al
jmp 0x41904f
jmp 0x418f7d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x190]
mov edx, dword [ecx + 4]
call edx
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x190]
mov eax, dword [edx]
call eax
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], 0
jmp 0x418f68
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x41]
neg eax
sbb eax, eax
neg eax
add eax, 0xcd
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x478b30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x478bd0
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x478b82
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a1058]
xor eax, edx
inc esi
cmp esi, edi
jl 0x478b63
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x478bab
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a1058]
xor eax, edx
inc esi
cmp esi, edi
jl 0x478b8e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x4b2640
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6a000]
push edi
jmp 0x4b265a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b2661
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2650
mov eax, 1
add ebx, ebx
jne 0x4b2673
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b2684
jne 0x4b26a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b26a3
dec eax
add ebx, ebx
jne 0x4b2690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b2668
add ebx, ebx
jne 0x4b269f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b26f5
xor ecx, ecx
sub eax, 3
jb 0x4b26bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b272a
sar eax, 1
mov ebp, eax
jmp 0x4b26c6
add ebx, ebx
jne 0x4b26c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2694
inc ecx
add ebx, ebx
jne 0x4b26d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2694
add ebx, ebx
jne 0x4b26e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b26d6
jne 0x4b26f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b26d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b2714
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b2706
jmp 0x4b2656
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b2714
add edi, ecx
jmp 0x4b2656
pop esi
mov edi, esi
mov ecx, 0x4302
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b2732
cmp byte [edi], 0x11
jne 0x4b2732
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b2737
lea edi, [esi + 0xaf000]
mov eax, dword [edi]
or eax, eax
je 0x4b27af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb6af8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb6c10]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b2764
mov ecx, edi
jns 0x4b2793
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb6c14]
or eax, eax
je 0x4b27a9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b2781
call dword [esi + 0xb6c24]
mov ebp, dword [esi + 0xb6c18]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b27e3
sub esp, 0xffffff80
jmp 0x4568a2
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x15966539
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x53616702
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1e7a7960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a7580
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a7535
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [di - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a7580
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a7535
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a7570
xchg esi, eax
shl esi, 1
pop eax
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
invalid

Function at 0x1e7a7ca0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a7c47
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a7c65
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a7cc3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a7caa
dec ebp
sbb byte [ebx], bh
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a7cb3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a7cbd
add ecx, eax
or byte [ecx], 4
inc eax
invalid
inc ebp

Function at 0x1e7a7cc0
Capabilities:
Inspect section memory permissions

Disassembly:
mov esp, 0x45ffdc76
or al, 0x8b
test dword [eax - 1], edi
invalid

Function at 0x1e7a7da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x62fffffc], esi
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
invalid
invalid
invalid
cld
Function at 0x1e7a7e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a7535
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
invalid
invalid
inc eax

Function at 0x1e7a7f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1e7a7580
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a7535
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.1e7a7570
cmpsb byte [esi], byte es:[edi]
mov bh, 0xc5
and al, byte [eax - 0x5335b]
inc dword [eax]
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
clc

Function at 0x1e7a80e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + edi*8 - 0x17af0001], ebx
xchg ebp, eax
hlt

Function at 0x1e7a8f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x1e7a90eb
and byte [ebp - 0x77c], 0
invalid
movsd dword es:[edi], dword [esi]
invalid

Function at 0x1e7a9c90
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], 0
push ebx
mov ebx, dword [sym.imp.python27.dll_Py_FatalError]
push esi
push edi
mov edi, dword [sym.imp.python27.dll_PyThreadState_Swap]
jne 0x1e7a9ccd
push 0
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1e7a9cbf
push str.pywintypes:_can_not_setup_interpreter_state__as_current_state_is_invalid
call ebx
add esp, 4
mov eax, dword [esi + 4]
push esi
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9ce7
push 0x1e7b10fc
call ebx
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call edi
push eax
mov dword [esi], eax
call edi
add esp, 8
pop edi
mov dword [esi + 4], 0
pop esi
pop ebx
ret
Function at 0x41e29d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41e2dc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e2dc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e2dc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41e2dc
cmp dword [ecx + 0x74], 0xe
jbe 0x41e2dc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42429f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f338
push 0x42f330
push str.FlsAlloc
push 0x1f
call fcn.0042415e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4242d3
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d144]
call esi
jmp 0x4242d9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42431d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f348
push 0x42f340
push str.FlsGetValue
push 0x21
call fcn.0042415e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424354
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42435c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f350
push 0x42f348
push str.FlsSetValue
push 0x22
call fcn.0042415e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424396
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42d144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x425b4f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x425bec
push ebx
push esi
call fcn.00425b18
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00425aac
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x425b99
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425beb
push edi
push eax
call fcn.00424561
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x425bb9
call fcn.004245af
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425bea
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00425aac
add esp, 0x20
test eax, eax
jne 0x425bd8
push edi
call fcn.004245af
jmp 0x425be0
push ebx
call fcn.004245af
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42be30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42be5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42be5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100042a6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x100042f3
cmp byte [esi + 0x3d], bl
je 0x100042f3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10004322
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x100042fa
sub eax, 1
je 0x100042fd
dec eax
sub eax, 1
jne 0x10004322
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000431a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10067807
add esp, 0x10
cmp edi, eax
jne 0x10004322
cmp byte [esi + 0x3d], bl
sete al
jmp 0x100042f5
xor al, al
jmp 0x100042f5

Function at 0x10006485
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x1000649f
xor eax, eax
jmp 0x1000656f
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x100064cd
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x100064cd
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x1000656e
cmp dword [esi + 0x4c], 0
je 0x1000656c
mov ecx, esi
call fcn.1000481d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100064f9
push dword [esi + 0x4c]
push eax
call fcn.10001db6
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x1000656c
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x1000653d
sub eax, 1
je 0x1000653d
dec eax
sub eax, 1
jne 0x1000656c
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x100064eb
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x1000655c
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.10067807
add esp, 0x10
cmp ebp, eax
jne 0x1000656c
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x1000656e
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x10007eb1
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x10007ed1
jl 0x10007ec8
test edi, edi
jne 0x10007ed1
xor eax, eax
xor edx, edx
jmp 0x10007f98
cmp dword [ebp + 0x38], 0
je 0x10007ee7
push esi
push edi
push dword [esp + 0x18]
call fcn.10007fa2
jmp 0x10007f98
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10007f2b
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x10007f2b
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.10062660
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x10007f33
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x10007f8e
mov ecx, ebp
call fcn.1000481d
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x10007f6e
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.10067180
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x10007f9e
mov eax, 0xfff
cmp ebx, eax
ja 0x10007f4a
test ecx, ecx
je 0x10007f8e
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.10067180
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x10007f90

Function at 0x10008076
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10008097
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1000814c
jmp 0x10008146
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x100080ba
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100080bc
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10008137
jg 0x100080cf
test esi, esi
je 0x10008137
test eax, eax
jl 0x10008119
jg 0x100080d9
test ebp, ebp
je 0x10008119
cmp edi, eax
jg 0x100080e9
jl 0x100080e3
cmp esi, ebp
jae 0x100080e9
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.10062660
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x10008137
jg 0x1000811d
test esi, esi
je 0x10008137
jmp 0x1000811d
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x10008137
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.10067807
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x10008d3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xc8
cmp dword [0x101279c0], eax
jae 0x10008d5a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101279c0], eax
ret