joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016a9
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4035fc
call fcn.00401981
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, sub.kernel32.dll_GetModuleHandleA
call edi
cmp word [eax], 0x5a4d
jne 0x4016e8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4016e8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401700
cmp eax, 0x20b
je 0x4016ed
mov dword [ebp - 0x1c], ebx
jmp 0x401714
cmp dword [ecx + 0x84], 0xe
jbe 0x4016e8
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40170e
cmp dword [ecx + 0x74], 0xe
jbe 0x4016e8
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x403478], 0xffffffff
or dword [0x40347c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x403138]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x403134]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403474], eax
call fcn.004018e3
call fcn.0040197e
cmp dword [0x403018], ebx
jne 0x401774
push fcn.0040197e
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040196b
push 0x403010
push 0x403008
call dword [sym.imp.MSVCR71.dll__initterm]
push 0x401927
call fcn.004018d1
mov eax, dword [0x403130]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40312c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x4017ca
push 8
call dword [sym.imp.MSVCR71.dll__amsg_exit]
pop ecx
push 0x403004
push section..data
call dword [sym.imp.MSVCR71.dll__initterm]
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401848
cmp al, bl
je 0x4017f5
cmp dword [ebp - 0x20], ebx
jne 0x401848
mov al, byte [esi]
cmp al, bl
je 0x401805
cmp al, 0x20
ja 0x401805
inc esi
mov dword [ebp - 0x24], esi
jmp 0x4017f5
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call sub.kernel32.dll_GetStartupInfoA
test byte [ebp - 0x58], 1
je 0x401820
movzx eax, word [ebp - 0x54]
jmp 0x401823
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.004013ce
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x401840
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40189e
cmp al, 0x22
jne 0x401857
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x40186a
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x4017e3
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004019bc
ret
Function at 0x100048e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov edx, esi
imul edx, eax
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [edi + 8]
cmp edx, ecx
jbe 0x10004900
mov eax, ecx
xor edx, edx
div esi
mov ecx, dword [edi]
mov edx, dword [esp + 0xc]
push ecx
push eax
push esi
push edx
call fcn.100273cd
mov ecx, eax
imul ecx, esi
sub dword [edi + 8], ecx
add esp, 0x10
pop edi
pop esi
ret

Function at 0x10004920
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x10050294]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x58]
push ebp
mov ebp, dword [esp + 0x58]
push edi
push 1
lea ecx, [esp + 0x4c]
push 8
push ecx
mov dword [esp + 0x14], eax
call fcn.100273cd
add esp, 0x10
cmp eax, 1
je 0x10004965
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10026fe4
add esp, 0x4c
ret
push 8
lea edx, [esp + 0x48]
push str.__arch__n
push edx
call fcn.1003390f
add esp, 0xc
test eax, eax
jne 0x10004952
push ebx
push esi
push edi
push 1
lea eax, [esp + 0x18]
push 0x3c
push eax
mov ebx, 8
call fcn.100273cd
add esp, 0x10
cmp eax, 1
jne 0x10004a62
nop
push 2
lea ecx, [esp + 0x4e]
push 0x1003f234
push ecx
call fcn.1003390f
add esp, 0xc
test eax, eax
jne 0x10004a62
add ebx, 0x3c
cmp byte [esp + 0x10], 0
mov byte [esp + 0x1f], al
lea eax, [esp + 0x10]
je 0x100049e9
mov edi, edi
mov cl, byte [eax]
cmp cl, 0x20
je 0x100049e6
cmp cl, 0x2f
je 0x100049e6
add eax, 1
cmp byte [eax], 0
jne 0x100049d0
jmp 0x100049e9
mov byte [eax], 0
lea edx, [esp + 0x40]
push edx
call fcn.10027805
mov edx, dword [esp + 0x60]
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10004a20
test al, al
je 0x10004a1c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10004a20
add ecx, 2
add edx, 2
test al, al
jne 0x10004a00
xor eax, eax
jmp 0x10004a25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10004a77
add ebx, esi
test bl, 1
je 0x10004a36
add esi, 1
add ebx, 1
push 1
push esi
push edi
call fcn.1002776f
add esp, 0xc
cmp eax, 0xffffffff
je 0x10004a62
push edi
push 1
lea eax, [esp + 0x18]
push 0x3c
push eax
call fcn.100273cd
add esp, 0x10
cmp eax, 1
je 0x100049a0
pop esi
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10026fe4
add esp, 0x4c
ret
push 8
lea ecx, [esp + 0x3c]
push 0
push ecx
mov dword [ebp], esi
mov byte [esp + 0x4b], 0
call fcn.1003390f
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
add esp, 0xc
pop esi
pop ebx
pop ebp
mov dword [edx], eax
xor ecx, esp
xor eax, eax
call fcn.10026fe4
add esp, 0x4c
ret

Function at 0x10005f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
lea edi, [eax + ebp]
cmp ebp, edi
mov edx, ebp
jae 0x10005f63
nop
mov cl, byte [edx]
mov al, byte [esi]
xor al, cl
mov byte [edx], al
rol cl, 1
add edx, 1
cmp edx, edi
mov byte [esi], cl
jb 0x10005f50
pop edi
mov eax, ebp
pop ebp
ret
Function at 0x1000a620
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x10050294]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
mov esi, dword [esp + 0x410]
push edi
mov ecx, esi
xor edi, edi
call fcn.1000a600
cmp eax, 9
jae 0x1000a665
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.10026fe4
add esp, 0x408
ret
push ebx
push 0x1003f244
push esi
lea ebx, [eax - 9]
call fcn.1002798c
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0xc], esi
jne 0x1000a69c
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.10026fe4
add esp, 0x408
ret
push ebp
push 0
push 0
push 0
call fcn.1000aa00
add esp, 0xc
test ebx, ebx
mov ebp, eax
jbe 0x1000a6f6
mov esi, ebx
sub esi, edi
cmp esi, 0x400
jbe 0x1000a6c2
mov esi, 0x400
mov eax, dword [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.100273cd
add esp, 0x10
cmp eax, esi
jb 0x1000a6f2
push eax
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.1000aa00
add edi, esi
add esp, 0xc
cmp edi, ebx
mov ebp, eax
jb 0x1000a6b1
mov esi, dword [esp + 0x10]
push esi
push 9
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.100273cd
push esi
mov edi, eax
call fcn.100270f4
add esp, 0x14
cmp edi, 9
je 0x1000a71a
or eax, 0xffffffff
jmp 0x1000a73a
push 0x10
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x29], 0
call fcn.1003390f
mov edx, eax
mov eax, ebp
sub eax, edx
add esp, 0xc
neg eax
sbb eax, eax
mov ecx, dword [esp + 0x414]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.10026fe4
add esp, 0x408
ret
Function at 0x10010770
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1003dd38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10050294]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
lea esi, [edi + edi + 2]
cmp esi, ebp
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], edi
jge 0x10010877
jmp 0x100107c0
lea eax, [esi*8]
sub eax, esi
cmp dword [ebx + eax*4 - 4], 8
mov edx, dword [ebx + eax*4 - 8]
lea eax, [ebx + eax*4]
mov dword [esp + 0x14], edx
jb 0x100107e0
mov ecx, dword [eax - 0x18]
jmp 0x100107e3
lea ecx, [eax - 0x18]
mov ebp, dword [eax + 0x14]
cmp ebp, edx
mov dword [esp + 0x18], ebp
jae 0x100107f0
mov edx, ebp
cmp dword [eax + 0x18], 8
jb 0x100107fb
mov eax, dword [eax + 4]
jmp 0x100107fe
add eax, 4
test edx, edx
jbe 0x1001082b
mov bp, word [eax]
cmp bp, word [ecx]
jne 0x10010817
add eax, 2
add ecx, 2
sub edx, 1
jne 0x10010802
jmp 0x10010827
mov dx, bp
cmp dx, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
add eax, 1
jne 0x1001083c
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ebp, eax
jb 0x10010840
xor ecx, ecx
cmp ebp, eax
setne cl
mov eax, ecx
test eax, eax
jge 0x10010843
sub esi, 1
push 0xffffffffffffffff
lea edx, [esi*8]
sub edx, esi
lea ecx, [edi*8]
push 0
lea eax, [ebx + edx*4]
sub ecx, edi
push eax
lea ecx, [ebx + ecx*4]
call fcn.10002250
mov ebp, dword [esp + 0x38]
mov edi, esi
lea esi, [esi + esi + 2]
cmp esi, ebp
jl 0x100107c0
jne 0x1001089f
push 0xffffffffffffffff
lea edx, [ebp*8]
sub edx, ebp
lea ecx, [edi*8]
push 0
lea eax, [ebx + edx*4 - 0x1c]
sub ecx, edi
push eax
lea ecx, [ebx + ecx*4]
call fcn.10002250
lea edi, [ebp - 1]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
xor eax, eax
push 0xffffffffffffffff
push eax
lea edx, [esp + 0x60]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], eax
push edx
mov word [ecx + 4], ax
call fcn.10002250
mov eax, dword [esp + 0x38]
push eax
push edi
push ebx
call fcn.100100a0
add esp, 0x28
cmp dword [esp + 0x54], 8
jb 0x100108e8
mov ecx, dword [esp + 0x40]
push ecx
call fcn.1002693b
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10010960
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1003dd68
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10050294]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
lea esi, [edi + edi + 2]
cmp esi, ebp
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], edi
jge 0x10010a12
jmp 0x100109b0
lea eax, [esi*8]
sub eax, esi
lea ecx, [ebx + eax*8]
lea edx, [ecx - 0x38]
push edx
call fcn.1000fc80
test al, al
je 0x100109cc
sub esi, 1
lea ecx, [edi*8]
lea eax, [esi*8]
sub ecx, edi
push 0xffffffffffffffff
sub eax, esi
lea ebp, [ebx + eax*8]
lea edi, [ebx + ecx*8]
push 0
push ebp
mov ecx, edi
call fcn.10002250
push 0xffffffffffffffff
push 0
add ebp, 0x1c
push ebp
lea ecx, [edi + 0x1c]
call fcn.10002250
mov edi, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x34]
jl 0x100109b0
mov ebp, dword [esp + 0x34]
cmp esi, ebp
jne 0x10010a4c
lea eax, [edi*8]
lea edx, [ebp*8]
push 0xffffffffffffffff
sub edx, ebp
sub eax, edi
lea esi, [ebx + edx*8 - 0x38]
lea edi, [ebx + eax*8]
push 0
push esi
mov ecx, edi
call fcn.10002250
push 0xffffffffffffffff
push 0
add esi, 0x1c
push esi
lea ecx, [edi + 0x1c]
call fcn.10002250
lea edi, [ebp - 1]
sub esp, 0x38
lea edx, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
call fcn.1000fe30
mov eax, dword [esp + 0x4c]
push eax
push edi
push ebx
call fcn.100101f0
mov esi, 8
add esp, 0x44
cmp dword [esp + 0x6c], esi
jb 0x10010a86
mov ecx, dword [esp + 0x58]
push ecx
call fcn.1002693b
add esp, 4
xor eax, eax
cmp dword [esp + 0x50], esi
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], eax
mov word [esp + 0x58], ax
jb 0x10010aac
mov edx, dword [esp + 0x3c]
push edx
call fcn.1002693b
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10017c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1003e4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10050294]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10050294]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
sub eax, edi
mov ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov ecx, ebp
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
test ebx, ebx
mov eax, ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], eax
mov esi, ebx
je 0x10017ca1
lea esp, [esp]
cdq
idiv esi
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x14]
test edx, edx
mov esi, edx
jne 0x10017c90
cmp eax, ecx
jge 0x10017dd8
test eax, eax
jle 0x10017dd8
lea ecx, [ebx*8]
sub ecx, ebx
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov dword [esp + 0x1c], ecx
lea ecx, [eax*8]
sub ecx, eax
lea edi, [edi + ecx*8]
mov dword [esp + 0x18], edi
jmp 0x10017cda
mov edi, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x28]
call fcn.1000fe30
mov edx, dword [esp + 0x1c]
lea esi, [edi + edx]
cmp esi, ebp
mov dword [esp + 0x68], 0
jne 0x10017cfb
mov esi, dword [esp + 0x20]
cmp esi, dword [esp + 0x18]
je 0x10017d5a
push 0xffffffffffffffff
push 0
push esi
mov ecx, edi
call fcn.10002250
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.10002250
mov ecx, ebp
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
mov edi, esi
jge 0x10017d40
add esi, dword [esp + 0x1c]
jmp 0x10017d54
mov ecx, ebx
sub ecx, eax
mov eax, dword [esp + 0x20]
lea edx, [ecx*8]
sub edx, ecx
lea esi, [eax + edx*8]
cmp esi, dword [esp + 0x18]
jne 0x10017d01
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.10002250
push 0xffffffffffffffff
xor esi, esi
push esi
lea edx, [esp + 0x48]
push edx
lea ecx, [edi + 0x1c]
call fcn.10002250
mov edi, 8
cmp dword [esp + 0x58], edi
mov dword [esp + 0x68], 0xffffffff
jb 0x10017d9c
mov eax, dword [esp + 0x44]
push eax
call fcn.1002693b
add esp, 4
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], esi
mov word [esp + 0x44], si
jb 0x10017dc0
mov ecx, dword [esp + 0x28]
push ecx
call fcn.1002693b
add esp, 4
mov eax, dword [esp + 0x14]
sub dword [esp + 0x18], 0x38
sub eax, 1
cmp eax, esi
mov dword [esp + 0x14], eax
jg 0x10017cd6
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10026fe4
add esp, 0x58
ret
Function at 0x10018410
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1003e5e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10050294]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [edi + edi + 2]
cmp esi, ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], edi
jge 0x100184c1
lea eax, [esi*8]
sub eax, esi
lea eax, [ebp + eax*8]
lea ecx, [eax - 0x38]
push ecx
push eax
lea ecx, [esp + 0x7c]
call fcn.100173f0
test al, al
je 0x10018479
sub esi, 1
lea eax, [edi*8]
lea edx, [esi*8]
push 0xffffffffffffffff
sub edx, esi
sub eax, edi
lea ebx, [ebp + edx*8]
lea edi, [ebp + eax*8]
push 0
push ebx
mov ecx, edi
call fcn.10002250
push 0xffffffffffffffff
push 0
add ebx, 0x1c
push ebx
lea ecx, [edi + 0x1c]
call fcn.10002250
mov edi, esi
lea esi, [esi + esi + 2]
cmp esi, dword [esp + 0x38]
jl 0x10018457
mov ebx, dword [esp + 0x38]
cmp esi, ebx
jne 0x100184fc
lea edx, [edi*8]
lea ecx, [ebx*8]
sub ecx, ebx
push 0xffffffffffffffff
sub edx, edi
lea esi, [ebp + ecx*8 - 0x38]
lea edi, [ebp + edx*8]
push 0
push esi
mov ecx, edi
call fcn.10002250
push 0xffffffffffffffff
push 0
add esi, 0x1c
push esi
lea ecx, [edi + 0x1c]
call fcn.10002250
lea edi, [ebx - 1]
sub esp, 0x40
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.10017550
sub esp, 0x38
lea edx, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x94], esp
push edx
mov byte [esp + 0xa4], 2
call fcn.1000fe30
mov eax, dword [esp + 0x8c]
push eax
push edi
push ebp
mov byte [esp + 0xac], 1
call fcn.10017a90
mov edi, 8
add esp, 0x84
cmp dword [esp + 0x70], edi
jb 0x10018568
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.1002693b
add esp, 4
xor esi, esi
cmp dword [esp + 0x54], edi
mov ebx, 7
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], esi
mov word [esp + 0x5c], si
jb 0x1001858f
mov edx, dword [esp + 0x40]
push edx
call fcn.1002693b
add esp, 4
cmp dword [esp + 0xac], edi
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], esi
mov word [esp + 0x40], si
jb 0x100185b5
mov eax, dword [esp + 0x98]
push eax
call fcn.1002693b
add esp, 4
cmp dword [esp + 0x90], edi
mov dword [esp + 0xac], ebx
mov dword [esp + 0xa8], esi
mov word [esp + 0x98], si
jb 0x100185e1
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.1002693b
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10018760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003e658
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10050294]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x10050294]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
push str._thes.save_
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10007360
add esp, 0xc
cmp dword [esp + 0x20], 0x10
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x30], 0
jae 0x100187c1
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x38]
push esi
push edx
call fcn.100181c0
add esp, 8
test eax, eax
je 0x100187ee
cmp dword [esp + 0x20], 0x10
jb 0x100187e7
mov eax, dword [esp + 0xc]
push eax
call fcn.1002693b
add esp, 4
mov eax, 1
jmp 0x10018804
cmp dword [esp + 0x20], 0x10
jb 0x10018802
mov ecx, dword [esp + 0xc]
push ecx
call fcn.1002693b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10026fe4
add esp, 0x2c
ret
Function at 0x10018950
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x1003e938
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10050294]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x18], esi
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
xor ebx, ebx
add eax, edx
sub esp, 0x40
cmp eax, 0x28
mov dword [esp + 0x68], ebx
mov ecx, esp
jle 0x10018a66
add eax, 1
cdq
and edx, 7
add eax, edx
mov ebx, eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x5c], esp
push eax
sar ebx, 3
call fcn.10017550
mov ecx, dword [esp + 0x58]
mov eax, ebx
imul eax, eax, 0x70
lea esi, [ebx*8]
sub esi, ebx
add esi, esi
mov dword [esp + 0x5c], eax
add esi, esi
add eax, ecx
add esi, esi
lea edx, [esi + ecx]
push eax
push edx
push ecx
mov dword [esp + 0x64], edx
call fcn.10018330
add esp, 0xc
lea edx, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.10017550
lea eax, [esi + ebp]
push eax
mov ecx, ebp
sub ecx, esi
push ebp
push ecx
call fcn.10018330
add esp, 0xc
lea edx, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.10017550
mov ebx, edi
push edi
sub edi, dword [esp + 0x60]
sub ebx, esi
push ebx
push edi
call fcn.10018330
add esp, 0xc
lea eax, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.10017550
mov ecx, dword [esp + 0x58]
push ebx
push ebp
push ecx
call fcn.10018330
add esp, 0x4c
xor ebx, ebx
jmp 0x10018a7f
lea edx, [esp + 0x7c]
mov dword [esp + 0x54], esp
push edx
call fcn.10017550
push edi
push ebp
push esi
call fcn.10018330
add esp, 0x4c
mov esi, 8
cmp dword [esp + 0x74], esi
jb 0x10018a97
mov eax, dword [esp + 0x60]
push eax
call fcn.1002693b
add esp, 4
cmp dword [esp + 0x58], esi
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], ebx
mov word [esp + 0x60], bx
jb 0x10018abb
mov ecx, dword [esp + 0x44]
push ecx
call fcn.1002693b
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100218c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
xor eax, eax
mov cl, byte [eax + str._LS_]
mov dl, byte [esi + edi]
add edi, 1
add eax, 1
cmp cl, dl
jne 0x10021a33
cmp eax, 4
jl 0x100218d2
xor eax, eax
cmp byte [esi + edi], al
sete al
test eax, eax
je 0x10021a33
push ebx
mov ebx, dword [ebp + 4]
cmp ebx, 1
mov dword [esp + 0x10], 0
jbe 0x10021a32
cmp byte [esi + 2], 0
lea eax, [esi + 2]
je 0x10021928
lea esp, [esp]
add eax, 1
cmp byte [eax], 0
jne 0x10021920
sub eax, esi
add eax, 1
mov ecx, eax
cmp ecx, ebx
sbb eax, eax
and eax, ecx
je 0x10021a32
jmp 0x10021940
mov ebp, eax
xor edi, edi
mov cl, byte [edi + str._LS_]
mov dl, byte [esi + ebp]
add ebp, 1
add edi, 1
cmp cl, dl
jne 0x10021968
cmp edi, 4
jl 0x10021944
xor ecx, ecx
cmp byte [esi + ebp], cl
sete cl
test ecx, ecx
jne 0x100219cd
mov ebp, eax
xor edi, edi
lea esp, [esp]
mov cl, byte [edi + str.Odradek1]
mov dl, byte [esi + ebp]
add ebp, 1
add edi, 1
cmp cl, dl
jne 0x1002199c
cmp edi, 9
jl 0x10021970
xor ecx, ecx
cmp byte [esi + ebp], cl
sete cl
test ecx, ecx
je 0x1002199c
mov dword [esp + 0x10], 1
cmp eax, ebx
jae 0x100219d5
cmp byte [esi + eax + 1], 0
lea eax, [esi + eax + 1]
je 0x100219b8
jmp 0x100219b0
add eax, 1
cmp byte [eax], 0
jne 0x100219b0
sub eax, esi
add eax, 1
mov ecx, eax
cmp ecx, ebx
sbb eax, eax
and eax, ecx
jne 0x10021940
jmp 0x100219f9
test eax, eax
je 0x100219f9
cmp eax, ebx
jb 0x100219d9
xor eax, eax
jmp 0x100219f9
cmp byte [esi + eax + 1], 0
lea eax, [esi + eax + 1]
je 0x100219ec
add eax, 1
cmp byte [eax], 0
jne 0x100219e4
sub eax, esi
add eax, 1
mov ecx, eax
cmp ecx, ebx
sbb eax, eax
and eax, ecx
cmp dword [esp + 0x10], 0
je 0x10021a32
test eax, eax
je 0x10021a32
cmp eax, ebx
mov dl, 0x44
ja 0x10021a32
lea ebx, [ebx]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 8]
lea esi, [ecx + eax]
mov cl, byte [esi]
mov bl, cl
xor bl, dl
rol cl, 1
mov dl, cl
mov ecx, dword [esp + 0x18]
add eax, 1
mov byte [esi], bl
cmp eax, dword [ecx + 4]
jbe 0x10021a10
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x100225b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
mov ebx, eax
jne 0x100225c2
pop ebp
or eax, 0xffffffff
pop ebx
ret
cmp dword [edi + 0xc], 0
je 0x100225ec
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
sub ecx, eax
cmp ecx, ebx
jb 0x100225bc
mov edx, dword [edi + 0x14]
push ebx
add edx, eax
push edx
push ebp
call fcn.1003390f
add dword [edi + 0x1c], ebx
add esp, 0xc
pop ebp
xor eax, eax
pop ebx
ret
test ebx, ebx
push esi
jbe 0x10022630
cmp ebx, 0x4000
mov esi, 0x4000
ja 0x10022600
mov esi, ebx
sub ebx, esi
cmp dword [edi + 8], 0
je 0x10022617
mov eax, dword [edi + 4]
push eax
push esi
push 1
push ebp
call fcn.100048e0
jmp 0x10022623
mov ecx, dword [edi]
push ecx
push esi
push 1
push ebp
call fcn.100273cd
add esp, 0x10
cmp esi, eax
jne 0x10022636
add ebp, esi
test ebx, ebx
ja 0x100225f1
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret