joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495706
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x495726
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0049824e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x495749
test byte [esp + 8], 2
je 0x495749
call fcn.004982c1
mov dword [eax], 0xd
call fcn.004982ca
mov dword [eax], 5
jmp 0x495722
xor eax, eax
ret
Function at 0x4b2351
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b2393
call fcn.004c21b7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b2393
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b238a
xor eax, eax
jmp 0x4b239b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b23a1
pop edi
pop esi
pop ebx
ret 4
Function at 0x4010a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x4010a8
mov eax, esi
pop esi
ret

Function at 0x401258
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x1f
jmp 0x401272
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x401429
mov dword [ebp - 0x18], 0x9a9
cmp dword [ebp - 0x18], 0x26fe
jle 0x40132b
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x40133e
mov byte [ebp - 1], 1
jmp 0x401342
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
mov dword [ebp - 0x1c], 0xbb9
cmp dword [ebp - 0x1c], 0x1846
jle 0x4013d0
cmp al, 0xc6
cdq
dec ebp
invalid
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x4013e3
mov byte [ebp - 2], 1
jmp 0x4013e7
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x4013ff
and dword [ebp - 0x14], 0
jmp 0x40140c
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x40126b
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x401290
Capabilities:
Parse pe header

Disassembly:
jmp 0x47b60b
push eax
push 0x14bdd
pop eax
xor eax, 0x637f5
pop eax
call fcn.00481b0c
jmp 0x47b610
push 0x14
push 0xa95570
call fcn.0047f2d0
call fcn.0047c7eb
movzx esi, ax
push 2
call fcn.00481abf
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x47b4c2
xor ebx, ebx
jmp 0x47b4f5
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x47b4be
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x47b4be
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x47b4f5
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00480082
test eax, eax
jne 0x47b509
push 0x1c
call fcn.0047b5e4
pop ecx
call fcn.004804da
test eax, eax
jne 0x47b51a
push 0x10
call fcn.0047b5e4
pop ecx
call fcn.00481ba8
and dword [ebp - 4], 0
call fcn.004812d2
test eax, eax
jns 0x47b534
push 0x1b
call fcn.0047b5e4
pop ecx
call dword [0xa9c2e8]
mov dword [0xa9b2c8], eax
call fcn.00481be8
mov dword [0xa98f98], eax
call fcn.00481586
test eax, eax
jns 0x47b55a
push 8
call fcn.0047efe8
pop ecx
call fcn.004817c3
test eax, eax
jns 0x47b56b
push 9
call fcn.0047efe8
pop ecx
push 1
call fcn.0047f022
pop ecx
test eax, eax
je 0x47b57e
push eax
call fcn.0047efe8
pop ecx
call fcn.00481c45
push esi
push eax
push 0
push 0x400000
call fcn.00478cc6
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x47b5a0
push esi
call fcn.0047f28b
call fcn.0047f013
jmp 0x47b5d5
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.0047f315
ret
jmp 0x401385
jmp 0x47b494
Function at 0x10001910
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10018f28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1001e2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10001957
and al, 0x10
xor cl, cl
cmp cl, al
sbb edx, edx
neg edx
jne 0x10001a2d
mov edi, ebx
lea eax, [ebp - 0x18]
call fcn.100012d0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001970
sub eax, edx
sar eax, 1
cmp eax, 1
jle 0x10001993
cmp word [esi + eax*2 - 2], 0x5c
jne 0x10001993
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
push 0x5c
push esi
call fcn.1000b081
add esp, 8
push esi
test eax, eax
jne 0x100019c9
mov dword [ebp - 4], 0xffffffff
call fcn.1000a8ba
add esp, 4
mov eax, 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
mov word [eax], dx
call fcn.10001910
mov edi, eax
add esp, 4
test edi, edi
je 0x10001a00
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.1000a8ba
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001a1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
jne 0x100019dc
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.1000a8ba
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001b70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
mov dword [edi], 0
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001baf
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x10001be2
mov eax, dword [ebp - 4]
xor edx, edx
xor ecx, ecx
add edx, dword [ebp - 8]
adc eax, ecx
mov dword [edi], edx
mov dword [edi + 4], eax
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019157
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001e2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [edi + 8]
lea esi, [eax + 4]
mov dword [edi], vtable.Cabinet::CExtract.0
xor ebx, ebx
push 0x12c
mov dword [ebp - 0x10], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001400
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x10]
add esi, 0xc
push 0x12c
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001400
mov edx, dword [esi]
xor eax, eax
mov word [edx], ax
xor ecx, ecx
mov eax, 4
mov edx, eax
mul edx
seto cl
mov dword [ebp - 4], 1
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
neg ecx
or ecx, eax
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], 0xc8
push ecx
mov dword [edi + 0x48], 4
call fcn.1000a965
mov dword [edi + 0x50], eax
mov eax, dword [edi + 0x48]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000a965
add esp, 8
mov dword [edi + 0x54], eax
cmp dword [edi + 0x50], ebx
je 0x1000542d
cmp eax, ebx
je 0x1000542d
mov dword [edi + 0x4c], ebx
lea esi, [edi + 0x58]
mov byte [ebp - 4], 2
push 0x12c
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001400
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea esi, [edi + 0x60]
mov byte [ebp - 4], 3
push 0x12c
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001400
mov edx, dword [esi]
xor eax, eax
mov word [edx], ax
mov dword [edi + 0x74], ebx
mov dword [edi + 0x70], 0xffffffff
mov dword [edi + 0x10c0], ebx
mov dword [edi + 0x10c4], ebx
mov dword [edi + 0x10c8], ebx
lea esi, [edi + 0x10dc]
mov byte [ebp - 4], 5
push 0x12c
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001400
mov ecx, dword [esi]
xor edx, edx
mov word [ecx], dx
mov dword [edi + 0x10d8], 1
mov dword [edi + 0x10e4], ebx
mov dword [edi + 0x10e8], ebx
mov dword [edi + 0x10ec], ebx
xor eax, eax
mov dword [edi + 0x10cc], eax
mov dword [edi + 0x10d0], eax
mov dword [edi + 0x10d4], eax
mov dword [edi + 0x10f0], ebx
mov dword [edi + 0x110c], ebx
mov dword [edi + 0x10fc], ebx
mov dword [edi + 0x1100], 0x4e4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 0x1108], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x1001ca50
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], str.Fatal_error:_Out_of_memory_
call fcn.1000cf14
int3
Function at 0x10005450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10018ed4
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1001e2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.Cabinet::CExtract.0
mov dword [ebp - 4], 5
call fcn.10005780
test eax, eax
je 0x100054af
mov eax, dword [0x1002003c]
cmp eax, 0xffffffff
je 0x100054af
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x100054af
mov eax, dword [0x1002003c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [esi + 0x110c]
test eax, eax
je 0x100054c0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0x10fc]
test eax, eax
je 0x100054d3
push eax
call fcn.1000a8ba
add esp, 4
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x10dc]
push eax
call fcn.1000a8ba
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x10c0]
add esp, 4
test eax, eax
je 0x100054fd
push eax
call fcn.1000a8ba
add esp, 4
mov dword [esi + 0x10c0], 0
mov dword [esi + 0x10c4], 0
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x60]
push eax
call fcn.1000a8ba
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x58]
push eax
call fcn.1000a8ba
mov byte [ebp - 4], 0
mov eax, dword [esi + 0x50]
push eax
call fcn.1000a8ba
mov eax, dword [esi + 0x54]
push eax
call fcn.1000a8ba
add esi, 8
mov dword [ebp + 8], esi
mov dword [ebp - 4], 6
mov eax, dword [esi + 0xc]
push eax
call fcn.1000a8ba
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 4]
push ecx
call fcn.1000a8ba
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100055c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x1108], eax
je 0x100055e7
xor eax, eax
mov dword [esi + 0x10e4], 0x3f3
mov dword [esi + 0x10e8], eax
mov dword [esi + 0x10ec], eax
ret
mov eax, dword [0x1002003c]
push ebx
push edi
cmp eax, 0xffffffff
je 0x10005717
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
xor ebx, ebx
cmp eax, ebx
je 0x10005621
pop edi
mov dword [esi + 0x10e8], ebx
mov dword [esi + 0x10ec], ebx
mov dword [esi + 0x10e4], 0x3f4
xor eax, eax
pop ebx
ret
mov eax, dword [0x1002003c]
cmp eax, 0xffffffff
je 0x10005719
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10005719
mov eax, dword [0x1002003c]
push eax
call edi
cmp eax, ebx
je 0x10005719
lea edi, [esi + 0x10cc]
xor eax, eax
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
cmp dword [esi + 0x10f0], ebx
jne 0x10005712
cmp dword [esi + 0x110c], ebx
jne 0x10005736
push 0x1001c228
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
mov dword [esi + 0x110c], eax
call ebx
mov ecx, dword [esi + 0x110c]
push str.FDICopy
push ecx
mov dword [esi + 0x1110], eax
call ebx
mov edx, dword [esi + 0x110c]
push str.FDIIsCabinet
push edx
mov dword [esi + 0x1114], eax
call ebx
mov dword [esi + 0x1118], eax
mov eax, dword [esi + 0x110c]
push str.FDIDestroy
push eax
call ebx
xor ecx, ecx
mov dword [esi + 0x111c], eax
cmp dword [esi + 0x1110], ecx
je 0x100056ff
cmp dword [esi + 0x1114], ecx
je 0x100056ff
cmp dword [esi + 0x1118], ecx
je 0x100056ff
cmp eax, ecx
jne 0x10005734
mov dword [esi + 0x110c], ecx
mov dword [edi + 0x18], 0x3e8
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
pop edi
xor eax, eax
pop ebx
ret
xor ebx, ebx
pop edi
mov dword [esi + 0x10e4], ebx
mov dword [esi + 0x10ec], ebx
mov dword [esi + 0x10e8], 0xe
xor eax, eax
pop ebx
ret
xor ebx, ebx
mov ecx, dword [esi + 0x1110]
push edi
push 1
push 0x10005e30
push 0x10005e00
push 0x10005dc0
push 0x10005d90
push 0x10005d50
push 0x10005d40
push 0x10005d30
call ecx
add esp, 0x24
xor edx, edx
cmp eax, ebx
setne dl
pop edi
mov dword [esi + 0x10f0], eax
pop ebx
mov eax, edx
ret
Function at 0x10006980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.1000b726
add esp, 0xc
pop ebp
ret 0xc

Function at 0x10006a00
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, 0x100
je 0x10006a1f
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 0x10]
push eax
push esi
push edi
call fcn.1000c296
add esp, 0xc
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10006a40
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10006ac4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x10006ab2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, 0x100
ja 0x10006aa2
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and edi, 0x27
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10006db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 0x140c], eax
je 0x10006de6
xor eax, eax
mov dword [edi + 0x10b4], 0x3ed
mov dword [edi + 0x10b8], eax
mov dword [edi + 0x10bc], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
cmp word [eax], 0
lea esi, [edi + 0x10c0]
je 0x10006dff
mov edx, ebx
mov eax, esi
call fcn.10001500
jmp 0x10006e17
push 0x104
call fcn.10001400
mov ecx, dword [esi]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, dword [esi]
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006e20
sub eax, edx
sar eax, 1
cmp eax, dword [esi + 4]
jb 0x10006e49
push 0x1001ca50
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], str.The_string_has_no_terminating_null_character_
call fcn.1000cf14
cmp eax, 1
jle 0x10006e62
cmp word [ebx + eax*2 - 2], 0x5c
je 0x10006e62
mov ebx, 0x1001c21c
mov eax, esi
call fcn.10001560
mov esi, dword [esi]
push esi
call fcn.10001910
add esp, 4
test eax, eax
je 0x10006e93
mov dword [edi + 0x10b8], eax
mov dword [edi + 0x10b4], 0x3ea
mov dword [edi + 0x10bc], 0
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
push edi
push eax
push ecx
call fcn.1000b726
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x1000848d
call fcn.1000c3e9
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, esi
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x10008840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10018f60
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x1001e2c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
push 0x12c
lea esi, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.10001400
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov word [ecx], ax
mov dword [esp + 0x30], ebx
mov eax, dword [edi + 0x1414]
mov ecx, dword [edi + 0x10c0]
push eax
lea edx, [eax + 1]
mov eax, dword [edi + 0x1410]
push eax
push ecx
push 0x1001c2e8
lea esi, [esp + 0x2c]
mov dword [edi + 0x1414], edx
call fcn.10001720
mov ebx, dword [esp + 0x2c]
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10008890
xor eax, eax
push 0x12c
lea esi, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call section..text
mov byte [esp + 0x30], 1
mov ecx, dword [esp + 0x14]
mov eax, ebx
mov byte [ecx], 0
lea edx, [eax + 2]
jmp 0x10008900
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008900
sub eax, edx
sar eax, 1
lea edx, [eax*4]
push edx
lea esi, [esp + 0x18]
call section..text
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
push 0
push 0
push eax
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [eax + esi], 0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008947
sub eax, edx
cmp eax, dword [esp + 0x18]
jb 0x1000896d
push 0x1001ca50
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], str.The_string_has_no_terminating_null_character_
call fcn.1000cf14
inc eax
cmp dword [ebp + 0xc], eax
jb 0x100089be
mov edx, dword [ebp + 8]
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10008980
push esi
mov byte [esp + 0x34], cl
call fcn.1000a8ba
push ebx
mov dword [esp + 0x38], 0xffffffff
call fcn.1000a8ba
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push esi
mov dword [edi + 0x10b4], 0x3eb
mov dword [edi + 0x10b8], eax
mov dword [edi + 0x10bc], eax
mov byte [esp + 0x34], al
call fcn.1000a8ba
push ebx
mov dword [esp + 0x38], 0xffffffff
call fcn.1000a8ba
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10009640
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push edi
call esi
test eax, eax
jne 0x1000967a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
jae 0x10009670
jb 0x10009670
pop ss
invalid
push 0x10
call edi
call esi
test eax, eax
je 0x10009660
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
jnp 0x100096a4
jp 0x100096a4
invalid
das
push es
int1
dec esi
mov dl, dl
xor edx, ebx
inc eax
faddp st(2)
dec esi
mov ah, 0x8b
sbb eax, sym.imp.KERNEL32.dll_FreeConsole
mov ebx, dword [sym.imp.KERNEL32.dll_FreeConsole]
call ebx
jne 0x100096cb
je 0x100096cb
xor eax, 0x37a62ec2
add al, 0xcf
ret 0xe01e
push 0x20
mov ecx, 0x1001efb0
call fcn.10009890
add esp, 4
call fcn.10009360
test eax, eax
je 0x10009758
je 0x100096ff
jne 0x100096ff
push esp
test byte [ecx + 0x31], ah
jnp 0x10009697
mov ah, byte [esi + 0xc]
mov al, byte [0xbff678c0]
or esp, edx
push 0x1001c30e
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.10008bd0
add esp, 4
test eax, eax
je 0x1000987b
call esi
test eax, eax
je 0x1000987b
jmp 0x10009746
push 1
push eax
call edi
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
jb 0x1000976e
jae 0x1000976e
movsb byte es:[edi], byte [esi]
imul eax
int3
push 0x20
mov ecx, 0x1001efd0
call fcn.10009890
add esp, 4
call fcn.100092c0
test eax, eax
je 0x100097ad
mov edx, 0x1001c30e
xor ecx, ecx
call fcn.10008d20
test eax, eax
je 0x1000987b
push 0
push 0
call edi
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
jmp 0x100097c0
push 0x20
mov ecx, 0x1001eff0
call fcn.10009890
add esp, 4
cmp dword [0x10020048], 0
je 0x1000984e
push 0x1001efb0
call fcn.1000a6d0
push 0x1001efd0
mov esi, eax
call fcn.1000a6d0
push 0x1001eff0
mov edi, eax
call fcn.1000a6d0
add esp, 0xc
test esi, esi
je 0x10009839
jnp 0x1000981a
jp 0x1000981a
cmp dword [eax - 0x69], 0x71
mov al, 0x3d
movsb byte es:[edi], byte [esi]
ja 0x1000986e
pop eax
popal
pop ebx
mov al, byte [0x500d8b]
add dl, byte [eax]
mov ecx, dword [0x10020050]
push eax
mov eax, dword [0x1002004c]
push edi
push eax
push ecx
call esi
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
call sym.hha.dll_Ordinal_8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
jae 0x10009869
jb 0x10009869
int1
dec eax
invalid
push 0x1001eff0
push 0x1001efd0
call sym.hha.dll_Ordinal_31
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10009890
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1001e2c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
shr eax, 3
mov dword [ebp - 8], eax
test eax, eax
je 0x10009972
js 0x100098cc
jns 0x100098cc
sal dword [ecx - 0x73115957], 1
mov edi, 0x3d784aab
scasd eax, dword es:[edi]
or dword [edi], edx
or al, 0x53
push ebx
lea edx, [ecx + eax*8 - 8]
push esi
mov dword [ebp - 0xc], edx
push edi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov esi, 0x20
jmp 0x100098f3
mov edx, 0xc6ef3720
jmp 0x10009900
mov edi, ecx
shr edi, 5
add edi, 0xde3de20
mov ebx, ecx
shl ebx, 4
add ebx, 0x53961374
xor edi, ebx
lea ebx, [edx + ecx]
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
add edi, 0x37396813
add ebx, 0x5842012
xor edi, ebx
lea ebx, [edx + eax]
xor edi, ebx
sub ecx, edi
add edx, 0x61c88647
dec esi
jne 0x10009900
mov edx, dword [ebp - 0xc]
xor eax, 0x37396813
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor ecx, 0x37396813
dec eax
mov dword [edx], ecx
sub edx, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
test eax, eax
jne 0x100098d6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1000a8ab
mov esp, ebp
pop ebp
ret

Function at 0x10009ad0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, 0x1001c30e
mov ecx, edi
xor esi, esi
call fcn.10008d20
mov dword [ebp + 8], eax
test edi, edi
je 0x10009b10
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call edi
mov esi, eax
test esi, esi
jne 0x10009b10
push ebx
mov ebx, dword [ebp + 0xc]
nop
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov esi, eax
test esi, esi
je 0x10009b00
pop ebx
cmp dword [ebp + 8], 0
je 0x10009b2b
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret