joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1588058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.015881a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x158807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x158806a
add dl, dl
jne 0x1588089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15880dc
xor eax, eax
add dl, dl
jne 0x1588096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x158817d
add dl, dl
jne 0x15880a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15880b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15880bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15880c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15880d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1588075
mov eax, 1
add dl, dl
jne 0x15880ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15880f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15880e1
sub eax, ebx
mov ebx, 1
jne 0x1588128
mov ecx, 1
add dl, dl
jne 0x158810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1588119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1588105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1588075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x158813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x158814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1588136
cmp eax, 0x7d00
jae 0x158816d
cmp eax, 0x500
jb 0x1588168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1588075
cmp eax, 0x7f
ja 0x1588170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1588075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x158819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1588075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10002e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
mov edi, ebp
xor ecx, ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10075064
call fcn.10015360
nop
call fcn.100140c0
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10015330
push eax
call fcn.10014590
nop
push 0x100033c0
push 0x1007322c
call fcn.10013b50
nop
call fcn.10014120
test eax, eax
je 0x10002edf
mov esi, esp
push 0x30
push 0x1005a454
push str.Error_in_Attack_Connect
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10015330
nop
push 0
call fcn.1001dd40
nop
jmp 0x10002f4e
call fcn.100140c0
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10015330
push eax
call fcn.10014590
nop
push 0x100032a0
push 0x10073230
call fcn.10013b50
nop
call fcn.10014120
nop
call fcn.100140c0
nop
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10015330
push eax
call fcn.10014590
nop
push 0x100034b0
push 0x10073220
call fcn.10013b50
nop
call fcn.10014120
test eax, eax
je 0x10002f4e
push 0
call fcn.1001dd40
nop
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret
Function at 0x10004b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
lea edi, [ebp - 0x38]
mov ecx, 0xe
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10072200]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10075161
call fcn.10015360
nop
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10004ce0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
call fcn.10015400
add esp, 4
mov dword [ebp - 0xf4], eax
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0x28], edx
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
add edx, 5
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015330
nop
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.10017840
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov byte [edx + ecx], 0xe9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
add eax, dword [edx + 4]
push eax
call fcn.10004c90
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + edx + 1], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], 0xe9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10004c90
add esp, 8
mov edx, 1
shl edx, 0
mov dword [ebp + edx - 0x10], eax
push 5
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10017840
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10004c54]
call fcn.100152d0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100153a0
add esp, 0xf8
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret
Function at 0x10004ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10075161
call fcn.10015360
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015330
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10072178
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015330
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x10072180
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015330
nop
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10072178
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018720
add esp, 0xc
test eax, eax
jne 0x10004d84
mov eax, 0xb
jmp 0x10004daf
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x10072180
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10018720
add esp, 0xc
test eax, eax
jne 0x10004dac
mov eax, 5
jmp 0x10004daf
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10004dd4]
call fcn.100152d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret

Function at 0x10007330
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075176
call fcn.10015360
nop
push 0x6c078965
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.100072c0
nop
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret 4
Function at 0x10009500
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075176
call fcn.10015360
nop
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x10009541
mov ecx, dword [ebp - 8]
call fcn.1000bef0
nop
jmp 0x10009555
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4e0
jb 0x10009555
mov ecx, dword [ebp - 8]
call fcn.1000bd00
nop
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x12
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret

Function at 0x1000a150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10075177
call fcn.10015360
nop
mov dword [ebp - 8], 0
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015330
nop
mov esi, esp
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.10015330
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.10015330
nop
mov esi, esp
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10015330
nop
push edx
mov ecx, ebp
push eax
lea edx, [0x1000a210]
call fcn.100152d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret
Function at 0x1000bd00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x70]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075176
call fcn.10015360
nop
mov dword [ebp - 0x14], 0x26f
mov dword [ebp - 0x20], 0xe3
mov dword [ebp - 0x2c], 0
jmp 0x1000bd4b
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe3
jae 0x1000bdc0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
and eax, 1
je 0x1000bd92
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000bd9c
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x38]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 + 0xff8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bd42
mov dword [ebp - 0x44], 0xe3
jmp 0x1000bdd2
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x26f
jae 0x1000be47
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 + 0x9c8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
and eax, 1
je 0x1000be19
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000be23
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x50]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bdc9
mov dword [ebp - 0x5c], 0x26f
mov eax, 4
imul ecx, eax, 0x4df
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 4]
and eax, 0x80000000
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 4]
and edx, 0x7fffffff
or eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
and eax, 1
je 0x1000be93
mov dword [ebp - 0x130], 0x9908b0df
jmp 0x1000be9d
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x68]
shr ecx, 1
xor ecx, dword [ebp - 0x130]
mov edx, 4
imul eax, edx, 0x18c
mov edx, dword [ebp - 8]
xor ecx, dword [edx + eax + 4]
mov eax, 4
imul edx, eax, 0x26f
mov eax, dword [ebp - 8]
mov dword [eax + edx + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
add esp, 0x130
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret
Function at 0x1000bef0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x10075176
call fcn.10015360
nop
mov dword [ebp - 0x14], 0x270
jmp 0x1000bf2d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4e0
jae 0x1000bfa2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 - 0x9bc]
and edx, 0x80000000
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4 - 0x9b8]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
and eax, 1
je 0x1000bf74
mov dword [ebp - 0xe8], 0x9908b0df
jmp 0x1000bf7e
mov dword [ebp - 0xe8], 0
mov ecx, dword [ebp - 0x20]
shr ecx, 1
xor ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor ecx, dword [eax + edx*4 - 0x388]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4 + 4], ecx
jmp 0x1000bf24
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret
Function at 0x10010670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1007516b
call fcn.10015360
nop
cmp dword [ebp + 0x10], 0
jg 0x100106b2
jl 0x100106a9
cmp dword [ebp + 0xc], 0
ja 0x100106b2
xor eax, eax
xor edx, edx
jmp 0x100107eb
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x100106d4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.10010850
jmp 0x100107eb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
call fcn.1000ae90
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jbe 0x10010744
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100021e0
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000e240
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10004580
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x3c]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000dca0
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x100107dc
mov ecx, dword [ebp - 8]
call fcn.1000bfc0
nop
mov dword [ebp - 0x48], 0xfff
cmp dword [ebp - 0x14], 0xfff
jbe 0x100107b5
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
push 0xfff
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1002ca60
add esp, 0x10
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x54]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x54], 0xfff
je 0x100107b3
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
jmp 0x100107eb
jmp 0x10010761
cmp dword [ebp - 0x14], 0
jbe 0x100107dc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1002ca60
add esp, 0x10
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
sbb edx, eax
mov eax, ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10010814]
call fcn.100152d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x118
cmp ebp, esp
call fcn.10015330
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012a00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10012bb0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10012acd
mov edx, dword [ebp - 4]
cmp edx, dword [0x100721f4]
jb 0x10012a4a
mov eax, dword [ebp - 4]
cmp eax, dword [0x100721f8]
ja 0x10012a4a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10012a1a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100190e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10012a70
jmp 0x10012acd
cmp dword [ebp - 0x14], 0x10000
jne 0x10012ab3
cmp dword [ebp - 0x18], 0x10000
jb 0x10012ab3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012aa6
mov eax, dword [ebp - 8]
jmp 0x10012acf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10012ac8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10012bb0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10012a1a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10012ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10012be0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10012ba5
mov edx, dword [ebp - 4]
cmp edx, dword [0x100721f4]
jb 0x10012b25
mov eax, dword [ebp - 4]
cmp eax, dword [0x100721f8]
ja 0x10012b25
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10012af5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100190e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10012b4b
jmp 0x10012ba5
cmp dword [ebp - 0x14], 0x10000
jne 0x10012b8e
cmp dword [ebp - 0x18], 0x10000
jb 0x10012b8e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012b81
mov eax, dword [ebp - 8]
jmp 0x10012ba7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10012ba0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10012be0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10012af5
xor eax, eax
mov esp, ebp
pop ebp
ret