joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a9c10
Capabilities:
Terminate process

Disassembly:
push ecx
test ecx, ecx
jns 0x100a9c5e
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a9c6a
xor eax, eax
pop ecx
ret
xor eax, eax
sar ecx, 7
inc eax
test ecx, ecx
jne 0x100a9c60
pop ecx
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a9c80
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
jns 0x100a9cd2
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a9d01
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov al, cl
lea esi, [edx + 4]
and al, 0x7f
sar ecx, 7
mov byte [esi], al
mov edi, 1
dec esi
test ecx, ecx
je 0x100a9cfb
mov dl, cl
lea esi, [esi - 1]
or dl, 0x80
sar ecx, 7
inc edi
mov byte [esi + 1], dl
test ecx, ecx
jne 0x100a9ce8
mov eax, edi
pop edi
pop esi
pop ecx
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a9db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
test eax, eax
jg 0x100a9e0d
jl 0x100a9dc5
test edx, edx
jae 0x100a9e0d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015be0
mov ecx, eax
call fcn.100a4b60
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a9e24
xor eax, eax
pop esi
pop ecx
pop ebp
ret
xor esi, esi
nop
shrd edx, eax, 7
inc esi
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100a9e10
mov eax, esi
pop esi
pop ecx
pop ebp
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a9e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
test eax, eax
jg 0x100a9e9d
jl 0x100a9e55
test edx, edx
jae 0x100a9e9d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Negative_value
mov ecx, eax
call fcn.10015be0
mov ecx, eax
call fcn.100a4b60
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a9edf
xor eax, eax
pop edi
pop esi
pop ebp
ret
lea esi, [ecx + 8]
mov edi, 1
mov cl, dl
and cl, 0x7f
shrd edx, eax, 7
mov byte [esi], cl
dec esi
sar eax, 7
mov ecx, edx
or ecx, eax
je 0x100a9ed9
lea ebx, [ebx]
mov cl, dl
lea esi, [esi - 1]
or cl, 0x80
inc edi
shrd edx, eax, 7
mov byte [esi + 1], cl
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100a9ec0
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a9f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9171
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10001850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100aa070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jne 0x100aa158
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x100aa158
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
jne 0x100aa158
mov ecx, dword [esi + 4]
call fcn.100aa320
mov ecx, eax
test ecx, ecx
jne 0x100aa0ef
push dword [esi + 4]
mov edx, str.ERROR:
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Error_finding_table_size_for_source_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ecx - 1]
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
push eax
push ecx
lea ecx, [esi + 8]
call fcn.100aa980
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x14]
shr eax, 4
push eax
call fcn.100aa980
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x20]
shr eax, 4
push eax
call fcn.100aa980
cmp byte [ebp + 8], 0
je 0x100aa14d
push dword [esi + 4]
mov ecx, esi
call fcn.100aa620
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Init___called_twice_for_same_BlockHash_object
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100aa0e4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100aa320
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov edx, esi
shr edx, 2
inc edx
cmp edx, eax
jbe 0x100aa33a
add eax, eax
je 0x100aa38b
cmp eax, edx
jb 0x100aa332
lea ecx, [eax - 1]
test eax, ecx
je 0x100aa3ea
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._is_not_a_power_of_2
jmp 0x100aa3cf
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._is_zero_or_negative
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100aa44e
jmp 0x100aa452
test esi, esi
je 0x100aa450
lea ecx, [edx + edx]
cmp eax, ecx
jbe 0x100aa450
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._is_too_large
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
xor eax, eax
pop esi
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100aa470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jne 0x100aa4b6
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.BlockHash::AddBlock___called_before_BlockHash::Init__
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100aa600
jmp 0x100aa607
mov esi, dword [edx + 0x34]
mov eax, dword [edx + 4]
inc esi
shr eax, 4
cmp esi, eax
jl 0x100aa506
dec eax
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.BlockHash::AddBlock___called_with_block_number
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._that_is_past_last_block
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
jmp 0x100aa49b
mov edi, dword [edx + 0x14]
cmp dword [edi + esi*4], 0xffffffff
lea eax, [edi + esi*4]
je 0x100aa557
push dword [eax]
mov edx, str.ERROR:
push ecx
push esi
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_block_number_
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
jmp 0x100aa49b
mov ecx, dword [edx + 0x2c]
and ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
jns 0x100aa57a
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + esi*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edx + 0x20]
mov eax, dword [eax + ebx*4]
cmp dword [edi + eax*4], 0xffffffff
je 0x100aa5f4
push dword [edi + eax*4]
mov edx, str.ERROR:
push ecx
push eax
push ecx
push ebx
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_first_matching_block_
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str.__last_matching_block_
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [edi + eax*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + ebx*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100aa620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp ecx, eax
jle 0x100aa68c
push eax
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100aa716
jmp 0x100aa71d
mov edx, dword [edi + 0x34]
shl edx, 4
cmp ecx, edx
jg 0x100aa6e3
push edx
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, 0x100f959c
mov ecx, eax
call fcn.10015be0
jmp 0x100aa671
cmp eax, 0x10
jb 0x100aa716
add eax, 0xfffffff0
cmp ecx, eax
jle 0x100aa6f2
lea ecx, [eax + 1]
mov eax, dword [edi]
lea esi, [eax + 0x10]
lea ebx, [eax + ecx]
add esi, edx
cmp esi, ebx
jae 0x100aa716
mov ecx, esi
call fcn.100a5170
push eax
mov ecx, edi
call fcn.100aa470
add esi, 0x10
cmp esi, ebx
jb 0x100aa700
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100aa7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x100aa800
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100aa812
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.100aa730
pop ebp
ret 8
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100d3630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100d3700
push 0xffffffffffffffff
push 0x100e96f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001850]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x10002660]
cmp eax, 0xffffffff
jne 0x100d3739
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100d3746
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100d37ad
jmp 0x100d377c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100d37ea
test edi, edi
jne 0x100d37f0
push 0x100d3300
push 0x100ebfac
call fcn.100d2fa0
mov eax, dword [0x10002660]
add esp, 8
cmp eax, 0xffffffff
je 0x100d37ad
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100d37d6
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100d37d6
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100d3828
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100d3819
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100d37f0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100d3770
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100d3887
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100d386c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100d3887
jmp 0x100d3860
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100d3860
jmp 0x100d3887
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100d3885
cmp esi, dword [eax + 8]
jne 0x100d3885
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100d3875
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100d389b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100d389b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100d3330
cmp esi, ebx
jne 0x100d3840
mov ebp, dword [esp + 0x14]
jmp 0x100d3770
Function at 0x100d3700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100d3700
push 0xffffffffffffffff
push 0x100e96f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001850]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x10002660]
cmp eax, 0xffffffff
jne 0x100d3739
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100d3746
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100d37ad
jmp 0x100d377c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100d37ea
test edi, edi
jne 0x100d37f0
push 0x100d3300
push 0x100ebfac
call fcn.100d2fa0
mov eax, dword [0x10002660]
add esp, 8
cmp eax, 0xffffffff
je 0x100d37ad
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100d37d6
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100d37d6
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100d3828
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100d3819
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100d37f0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100d3770
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100d3887
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100d386c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100d3887
jmp 0x100d3860
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100d3860
jmp 0x100d3887
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100d3885
cmp esi, dword [eax + 8]
jne 0x100d3885
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100d3875
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100d389b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100d389b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100d3330
cmp esi, ebx
jne 0x100d3840
mov ebp, dword [esp + 0x14]
jmp 0x100d3770
Function at 0x403043
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417044]
sub esi, dword [0x40afb0]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x423eac], eax
jle 0x4031ad
push dword [0x41f054]
call fcn.004031f1
push ebx
push ebx
push dword [0x40afb0]
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f050], esi
mov dword [0x417040], ebx
mov ebp, 0x40b040
mov eax, dword [0x417048]
mov edi, 0x4000
sub eax, dword [0x41f054]
cmp eax, edi
jg 0x4030b8
mov edi, eax
mov esi, 0x413040
push edi
push esi
call fcn.004031bf
test eax, eax
je 0x40319f
add dword [0x41f054], edi
mov dword [0x40afd0], esi
mov dword [0x40afd4], edi
cmp dword [0x423eb0], ebx
je 0x40310f
cmp dword [0x423f40], ebx
jne 0x40310f
mov eax, dword [0x41f050]
push ebx
sub eax, dword [0x417044]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40afb0]
mov dword [0x417040], eax
call fcn.00402bd3
pop ecx
mov ecx, 0x40afb8
mov dword [0x40afd8], ebp
mov dword [0x40afdc], 0x8000
call fcn.00405f82
test eax, eax
jl 0x4031a8
mov esi, dword [0x40afd8]
sub esi, ebp
je 0x403169
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031a4
cmp esi, dword [esp + 0x10]
jne 0x4031a4
add dword [0x40afb0], esi
cmp dword [0x40afd4], ebx
jne 0x4030de
jmp 0x403175
cmp dword [0x40afd4], ebx
jne 0x4031a8
cmp edi, ebx
je 0x4031a8
mov eax, dword [0x417044]
mov ecx, eax
sub ecx, dword [0x40afb0]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030a2
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4031ad
or eax, 0xffffffff
jmp 0x4031b7
push 0xfffffffffffffffe
jmp 0x4031aa
push 0xfffffffffffffffd
pop eax
jmp 0x4031b7
push 1
call fcn.00402bd3
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x4036af
Capabilities:
Enumerate pe sections

Disassembly:
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4036e4
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4036cb
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4036dc
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4036e6
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4036c1
xor eax, eax
pop edi
pop esi
ret

Function at 0x405684
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
invalid
Function at 0x4058b4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e88
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058d8
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405a11
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422630], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422630
je 0x40591c
push 1
push 0
push esi
call fcn.0040583d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
mov esi, 0x4220a8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405a17
cmp eax, edi
jg 0x405a17
push esi
push ebp
push str._s_s_r_n
push 0x421ca8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423eb0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b88
push 4
push 0xc0000000
push esi
call fcn.0040583d
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405a11
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a0a
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a0a
cmp edi, dword [esp + 0x18]
jne 0x405a0a
push str._Rename__r_n
push esi
call fcn.004057b2
test eax, eax
jne 0x405a1e
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405b66
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421ca8
push eax
call fcn.004057fe
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f30]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409350
push eax
call fcn.004057b2
test eax, eax
je 0x4059d5
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405a45
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405a3a
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4059d7