joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d5d0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10136545
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x103b0040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
jne 0x1009d6f3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x18], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x1c], ecx
cmp ecx, edx
je 0x1009d679
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1009d679
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x42e4cd8a
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x1009d672
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x1009d655
cmp esi, 0x7874200a
je 0x1009d67d
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x1009d640
mov eax, dword [eax]
jmp 0x1009d617
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
push esi
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
push 8
call fcn.101240b3
mov dword [ebp - 0x14], eax
mov dword [eax], esi
mov dword [eax + 4], 0x1009cfc0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x1009eca0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1009d71e
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1009d716
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x1009d716
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10123fc5
mov esp, ebp
pop ebp
ret 0xc
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x20], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1009df20
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ecx]
push ebx
push esi
push edi
mov eax, dword [ecx + 0x3c]
mov dword [ebp - 0xc], ecx
cmp dword [eax + ecx + 0x7c], 0
jbe 0x1009dfcd
mov eax, dword [eax + ecx + 0x78]
mov edx, dword [eax + ecx + 0x1c]
mov esi, dword [eax + ecx + 0x20]
mov eax, dword [eax + ecx + 0x24]
add esi, ecx
add eax, ecx
mov dword [ebp - 0x14], esi
lea ebx, [edx + ecx]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ebx
test edx, edx
je 0x1009dfcd
nop dword [eax + eax]
mov edi, dword [esi + ebx*4]
add edi, ecx
mov dword [ebp - 4], 0x811c9dc5
mov ecx, edi
xor edx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009df83
sub ecx, esi
je 0x1009dfb6
mov ebx, dword [ebp - 4]
movsx eax, byte [edi + edx]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009dfa3
sub eax, esi
cmp edx, eax
jb 0x1009df91
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
je 0x1009dfd8
mov ecx, dword [ebp - 0xc]
inc ebx
mov esi, dword [ebp - 0x14]
mov dword [ebp - 8], ebx
cmp ebx, dword [ebp - 0x10]
jb 0x1009df70
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
pop edi
pop esi
movzx eax, word [eax + ebx*2]
pop ebx
mov eax, dword [ecx + eax*4]
add eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1009e2d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10136695
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x103b0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1009e690
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1009e402
cmp dword [0x103c64f8], 0xccccccc
jne 0x1009e35a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x103c64f4
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x18], 0
call fcn.101240b3
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
add esp, 4
lea ebx, [eax + 8]
mov eax, dword [esi]
mov dword [ebx], eax
movq qword [ebx + 4], xmm0
mov dword [ebx + 8], 0
mov dword [ebp - 4], 1
mov eax, dword [0x103c64f8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x103a3d90]
mov eax, dword [0x103c650c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x103a3d90]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x103c64f0]
jbe 0x1009e3f5
call fcn.1009e420
push edi
push ebx
lea eax, [ebp - 0x24]
push eax
call fcn.1009e690
mov ecx, dword [eax]
jmp 0x1009e3f8
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push edi
call fcn.1009e4b0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1009e520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1009e54c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x103c64f4]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x103c64fc
lea eax, [edi + edi]
push eax
call fcn.100410b0
mov eax, dword [0x103c64f4]
lea ebx, [edi - 1]
mov dword [0x103c6508], ebx
mov dword [0x103c650c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1009e686
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x103c64fc]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1009e5e4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1009e651
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1009e61e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1009e616
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1009e651
cmp ebx, edx
je 0x1009e62e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1009e662
cmp ebx, edx
jne 0x1009e622
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1009e686
mov ebx, dword [0x103c6508]
jmp 0x1009e592
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1009e651
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100abb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
movzx ebp, ax
xor eax, eax
mov esi, ebp
push edi
shr esi, 8
xor edi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x20], eax
jbe 0x100abbc1
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x100abbc1
jne 0x100abbb8
cmp eax, edx
jge 0x100abbb8
mov ecx, dword [esp + 0x18]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x100abbe9
inc eax
cmp eax, edx
jl 0x100abba6
mov esi, dword [esp + 0x10]
inc edi
mov eax, edx
cmp edi, dword [esp + 0x20]
jb 0x100abb83
mov edi, dword [esp + 0x2c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x100abbff
mov esi, dword [esp + 0x28]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x100abbf1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x100abbf3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edx, ecx
sub ebp, edx
js 0x100abbff
inc eax
xor bl, 1
cmp eax, edi
jb 0x100abbd1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret
Function at 0x100b2760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x100b2785
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x100b27eb
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x100b27e4
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x100b27b7
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x100b27a6
jmp 0x100b27e4
test edx, edx
jne 0x100b27c0
mov dword [ebx + 0x54], ecx
jmp 0x100b27c3
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100b27d0
push esi
call eax
add esp, 4
push esi
call fcn.100b2c80
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x100b2790
lea eax, [edi + 0x6c]
test eax, eax
je 0x100b286e
test ebp, ebp
je 0x100b286e
mov ebx, dword [eax]
test ebx, ebx
je 0x100b2861
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x100b2817
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x100b282b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100b283c
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x100b2800
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x100b2882
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.100b26e0
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x100b289d
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x100b28cf
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x100b28bb
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x100b28cf
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x100b28f6
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x100fadb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0x58]
mov dword [eax], 0
cmp byte [esi + 0x35c], 0
mov dword [esp + 0x10], edi
jne 0x100fade7
push dword [esi + 0x68]
push esi
call fcn.101020b0
add esp, 8
test eax, eax
jne 0x100fafa1
mov edx, dword [esi + 0x348]
push ebx
mov ebx, dword [esi + 0x358]
add edx, 8
mov esi, 6
mov dword [esp + 0xc], esi
push ebp
lea ebp, [edx + ebx*4]
test edi, edi
je 0x100fae6f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100fae6f
mov ecx, eax
lea eax, [ecx + 1]
mov dword [esp + 0x14], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100fae20
sub ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
je 0x100fae6f
test ebx, ebx
je 0x100fae6f
movzx esi, byte [edx + 2]
lea edi, [edx + 4]
movzx eax, byte [edi - 1]
movzx ecx, byte [edx]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [edx + 1]
mov edx, dword [esp + 0x18]
or ecx, eax
movzx eax, word [edx + 0xe]
cmp ecx, eax
je 0x100fae79
lea eax, [esi + esi*4]
mov edx, edi
lea ebp, [ebp + eax*2]
sub ebx, 1
jne 0x100fae35
mov esi, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
test esi, esi
je 0x100fae6b
lea edi, [ebp + 1]
movzx ebx, byte [edi + 4]
test bl, 0x10
je case.default.0x100faf03
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
movzx ebp, byte [edi + 5]
mov edx, dword [esp + 0x20]
shl ecx, 8
or ecx, eax
shl ebp, 8
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 6]
or ebp, eax
movzx eax, byte [edi + 7]
shl ebp, 8
or ebp, eax
movzx eax, byte [edi + 8]
shl ebp, 8
or ebp, eax
mov eax, dword [edx + 0x354]
cmp ecx, eax
jae case.default.0x100faf03
sub eax, ecx
cmp dword [esp + 0x14], eax
jae case.default.0x100faf03
push eax
mov eax, dword [edx + 0x350]
add eax, ecx
push eax
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne case.default.0x100faf03
and ebx, 0xf
cmp ebx, 3
ja case.default.0x100faf03
jmp dword [ebx*4 + 0x100fafac]
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x354]
cmp ebp, eax
jae case.default.0x100faf03
push eax
mov eax, dword [edx + 0x350]
add eax, ebp
push 0
push eax
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
jne 0x100faf4a
add edi, 0xa
sub esi, 1
jne 0x100fae80
mov esi, dword [esp + 0x10]
mov eax, esi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [ecx], 1
mov eax, dword [esi + 0x350]
add eax, ebp
xor esi, esi
pop ebp
pop ebx
mov dword [ecx + 4], eax
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [eax + 4], ebp
pop ebp
pop ebx
mov dword [eax], 2
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [eax + 4], ebp
pop ebp
pop ebx
mov dword [eax], 3
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov esi, eax
pop edi
pop esi
add esp, 0xc
ret
Function at 0x1010c5a0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x1010c5b4
lea eax, [esi + 0x28]
pop esi
add esp, 0xc
ret
push ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [esp + 0x34]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1010c5e3
pop ebx
mov eax, 1
pop esi
add esp, 0xc
ret
push ebp
push edi
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1010c6f5
mov ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x1010c6f5
mov eax, dword [esp + 0x14]
jl 0x1010c61c
cmp eax, 0x7fffffff
ja 0x1010c6f5
or eax, ecx
je 0x1010c6f5
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x1010c6f5
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
push 4
push edi
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
push edi
mov dword [esi], eax
call ebp
cmp dword [esi], 0
je 0x1010c66d
mov eax, 0x1010c750
jmp 0x1010c6bd
push dword [esi + 4]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x1010c6f5
mov ebp, dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
xor edi, edi
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 4]
sub eax, edi
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call ebp
test eax, eax
je 0x1010c6e0
add edi, dword [esp + 0x10]
cmp edi, dword [esi + 4]
jne 0x1010c690
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1010c720
push ebx
mov dword [esi + 0x18], eax
call ebp
mov eax, dword [esi]
pop edi
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
pop ebp
mov dword [esi + 0x10], eax
xor eax, eax
pop ebx
mov dword [esi + 0x14], 0
pop esi
add esp, 0xc
ret
push dword [esi]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call ebp
pop edi
pop ebp
pop ebx
mov dword [esi], 0
mov eax, 0x51
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
add esp, 0xc
ret
Function at 0x101253a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x101253c7
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x101253ca
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1012537c
pop esi
leave
ret 8
Function at 0x101287a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, 1
push esi
push edi
mov ecx, 0x3020100
mov edx, dword [ebp + 0x10c]
mov dword [ebp + 0x114], 0x3020100
add ecx, 0x4040404
mov dword [ebp + eax*4 + 0x114], ecx
inc eax
cmp eax, edx
jbe 0x101287c2
mov ebx, dword [esp + 0x18]
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x1012881a
mov edx, dword [esp + 0x14]
movzx eax, byte [edx + esi]
or edi, eax
mov cl, byte [eax + ebp + 0x114]
mov byte [edx + esi], cl
mov byte [ebp + 0x113], cl
nop word [eax + eax]
mov cl, byte [eax + ebp + 0x113]
mov edx, eax
sub eax, 1
mov byte [edx + ebp + 0x114], cl
jns 0x10128800
inc esi
cmp esi, ebx
jb 0x101287e0
shr edi, 2
mov dword [ebp + 0x10c], edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1012ca20
Capabilities:
Terminate process

Disassembly:
call fcn.1012ca70
push eax
push dword [esp + 8]
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to:_bzip2_devel_sourceware.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks._n_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10045ba0
add esp, 0x10
cmp dword [esp + 4], 0x3ef
jne 0x1012ca66
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10045ba0
add esp, 8
push 3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3901462b
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x59bb2771
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219