joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100067d0
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
push 0
push 2
push 0x10e48f20
push 0x943796
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.100067ff
call fcn.100076e2
call fcn.10006bf0
jmp fcn.10006512

Function at 0x10006a09
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push 0x20
mov eax, 0x100285d5
call fcn.1000866d
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [0x10e48d0c], eax
mov ecx, 0x1003f4bc
lea eax, [ebp + 0xc]
mov dword [ebp - 4], edi
push eax
call fcn.10005465
lea eax, [ebp - 0x2c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10006aa9
lea eax, [ebp - 0x18]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10006aa9
mov eax, dword [ebp - 0x18]
xor esi, esi
push edi
push edi
mov dword [ebp - 0x24], eax
inc esi
mov eax, dword [ebp - 0x14]
push 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10006aa9
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10006aa9
push edi
push edi
push edi
push 0x10006bb4
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10006aab
mov esi, edi
lea ecx, [ebp + 0xc]
call fcn.1000195f
mov eax, esi
call fcn.10008628
ret
Function at 0x10006bf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push 0x10e48d1c
push str.Conquer.exe
call fcn.1000602f
mov edi, 0x10e48d40
push edi
push str...iniMagictype.dat
call fcn.1000602f
push 0x10e48d64
push str..._servers.dat
call fcn.1000602f
mov ebx, 0x10e48d88
push ebx
push str...iniMagicEffect.ini
call fcn.1000602f
mov esi, 0x10e48dac
push esi
push str...iniStrRes.ini
call fcn.1000602f
push 0x10e48df4
push 0x10029c40
call fcn.1000602f
add esp, 0x30
cmp byte [edi], 0x2d
jne 0x10006d09
cmp byte [edi + 1], 0x31
jne 0x10006d09
movzx eax, byte [edi + 2]
test al, al
jne 0x10006d09
cmp byte [ebx], 0x2d
jne 0x10006d09
cmp byte [ebx + 1], 0x31
jne 0x10006d09
movzx eax, byte [ebx + 2]
test al, al
jne 0x10006d09
cmp byte [esi], 0x2d
jne 0x10006d09
cmp byte [esi + 1], 0x31
jne 0x10006d09
movzx eax, byte [esi + 2]
test al, al
jne 0x10006d09
mov ecx, 0x10e48dd0
cmp byte [ecx], 0x2d
jne 0x10006d09
cmp byte [ecx + 1], 0x31
jne 0x10006d09
movzx eax, byte [ecx + 2]
test al, al
jne 0x10006d09
push 0x10e48d1c
push str.Env_DX8_Conquer.exe
call fcn.1000602f
push edi
push str.ini_Magictype.dat
call fcn.1000602f
push 0x10e48d64
push str.servers.dat
call fcn.1000602f
push ebx
push str.ini_MagicEffect.ini
call fcn.1000602f
push esi
push str.ini_StrRes.ini
call fcn.1000602f
push 0x10e48df4
push str.Env_DX8_CO2Helper.dll
call fcn.1000602f
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push str.Connected_to_the_server..._Sending_the_welcome_hash.
mov dword [0x10e48e50], eax
call fcn.10004977
push 0xcc
call fcn.10012b24
mov edi, eax
mov eax, 0x10e48d1c
pop ecx
mov edx, edi
pop ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax + 0x25], cl
inc eax
test cl, cl
jne 0x10006d35
mov edx, edi
mov ecx, 0x10e48d40
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 4], al
inc ecx
test al, al
jne 0x10006d49
mov ecx, edi
sub ecx, ebx
mov al, byte [ebx]
mov byte [ecx + ebx + 0x46], al
inc ebx
test al, al
jne 0x10006d58
mov edx, edi
mov ecx, 0x10e48d64
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 0x67], al
inc ecx
test al, al
jne 0x10006d6c
mov ecx, edi
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi + 0x88], al
inc esi
test al, al
jne 0x10006d7b
mov edx, edi
mov ecx, 0x10e48df4
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx + 0xa9], al
inc ecx
test al, al
jne 0x10006d92
push 0
push 0xcc
push edi
mov dword [edi], 1
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.100124e4
pop ecx
pop edi
cmp esi, 0xffffffff
pop esi
pop ebx
je 0x10006dcc
ret
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Error_with_welcome_buff_n
call fcn.100068ac
pop ecx
push 2
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_shutdown]
call fcn.10007a50
int3
Function at 0x10006dfd
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1003f51c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10744a24], 0
push edi
mov edi, dword [ebp + 8]
jne 0x10006ec4
push ebx
push esi
push 0x10029cf8
push 0x10029cfc
call fcn.10013317
push 0x10029d0c
push dword [edi]
mov esi, eax
call fcn.10013317
xor ebx, ebx
mov edi, eax
inc ebx
jmp 0x10006e55
push eax
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.10013c1f
push esi
push 0x200
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.10013627
add esp, 0x20
push edi
test eax, eax
jne 0x10006e47
mov dword [0x10744a24], ebx
call fcn.10012e4b
push esi
call fcn.10012e4b
lea eax, [ebp - 0x204]
push eax
call fcn.100083cb
add esp, 0xc
xor esi, esi
push esi
push 2
push 0x1003a160
push dword [0x1003a164]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.10006295
push esi
push esi
push esi
push 0x10005ef4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1000837d
mov esp, ebp
pop ebp
ret

Function at 0x10007027
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
push edi
push edi
push edi
push 0x10005511
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edi
push 0x10007d3e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop edi
ret
Function at 0x10007261
Capabilities:
Write file on windows

Disassembly:
push 0x28
mov eax, 0x1002862a
call fcn.1000866d
mov esi, ecx
mov dword [ebp - 0x30], esi
xor ebx, ebx
cmp dword [esi + 0x38], ebx
je 0x10007369
cmp byte [esi + 0x3d], bl
je 0x10007369
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10007299
xor al, al
jmp 0x1000736b
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.1000765b
lea eax, [esi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov ecx, dword [ecx + 0x38]
add eax, edi
push eax
push esi
push dword [ebp - 0x34]
mov edx, dword [ecx]
call dword [edx + 0x20]
sub eax, ebx
je 0x100072f6
sub eax, 1
jne 0x1000734e
mov esi, dword [ebp - 0x30]
jmp 0x100072fc
mov esi, dword [ebp - 0x30]
mov byte [esi + 0x3d], bl
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov edi, dword [ebp - 0x2c]
cmovae eax, edx
sub edi, eax
je 0x10007334
push dword [esi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, edx
push 1
push eax
call fcn.10013c1f
add esp, 0x10
cmp edi, eax
jne 0x10007359
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [esi + 0x3d], 0
je 0x10007357
test edi, edi
jne 0x100072c0
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.10007600
jmp 0x100072ba
dec eax
sub eax, 1
jne 0x1000735d
inc eax
jmp 0x1000735b
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.1000195f
mov al, bl
jmp 0x1000736b
mov al, 1
call fcn.10008628
ret
Function at 0x100076e2
Capabilities:
Connect socket
Create thread

Disassembly:
mov eax, dword [0x10040748]
inc dword [0x10e48f28]
mov dword [0x1004074c], eax
push esi
test eax, eax
je 0x10007757
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, eax
mov dword [0x1003a15c], ecx
cmp ecx, 0xffffffff
jne 0x1000772d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_failed_with_error:__ld_n
call fcn.10004977
pop ecx
pop ecx
pop esi
jmp dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x1004074c]
push dword [eax + 0x10]
push dword [eax + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1000777b
and dword [0x10e48f28], 0
mov eax, dword [0x10040748]
mov byte [0x10040772], 1
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [0x1003a15c], 0xffffffff
jne 0x10007779
push str.Unable_to_connect_to_server__n
call fcn.10004977
pop ecx
pop esi
jmp dword [sym.imp.WS2_32.dll_WSACleanup]
pop esi
ret
xor esi, esi
push esi
push esi
push esi
push 0x10005f86
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push 0x10029940
push str.Server_is_offline_right_now._nTry_again_later.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
push dword [0x1003a15c]
call dword [sym.imp.WS2_32.dll_shutdown]
or dword [0x1003a15c], 0xffffffff
call fcn.10007a50
int3
Function at 0x10007a74
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x100286a7
call fcn.1000866d
mov esi, ecx
mov dword [ebp - 0x38], esi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp edi, ebx
jne 0x10007a96
xor eax, eax
jmp 0x10007bec
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10007ac0
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x10007ac0
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x10007bec
cmp dword [esi + 0x4c], 0
je 0x10007bea
mov ecx, esi
call fcn.10007551
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x10007aed
push dword [esi + 0x4c]
push edi
call fcn.10004ebc
test al, al
pop ecx
pop ecx
cmovne ebx, edi
jmp 0x10007bea
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x2c], cl
lea ecx, [ebp - 0x2c]
push 8
mov byte [ebp - 0x14], al
mov dword [ebp - 0x18], 0xf
call fcn.1000765b
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x18]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
lea edx, [ebp - 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x13]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x3c]
call dword [edi + 0x1c]
test eax, eax
js 0x10007be2
cmp eax, 1
jg 0x10007bc7
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp edi, 0x10
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x40], edx
je 0x10007b98
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.10013c1f
mov edx, dword [ebp - 0x40]
add esp, 0x10
cmp edx, eax
jne 0x10007be2
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x10007bc2
test edx, edx
jne 0x10007b18
cmp dword [ebp - 0x1c], 0x20
jae 0x10007be2
push edx
push 8
lea ecx, [ebp - 0x2c]
call fcn.10007600
jmp 0x10007b15
mov ebx, dword [ebp + 8]
jmp 0x10007be2
cmp eax, 3
jne 0x10007be2
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
push dword [ebp - 0x14]
call fcn.10004ebc
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.1000195f
mov eax, ebx
call fcn.10008628
ret 4
Function at 0x1000a8c6
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x1002886a
call fcn.1000866d
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x1000a9f9
cmp byte [edi + 0x3e], bl
je 0x1000a9f9
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.100092fa
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x1000a912
xor al, al
jmp 0x1000a9fb
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.1000765b
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x1000a947
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1000a951
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call fcn.100092fa
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x1000a980
sub eax, 1
jne 0x1000a9de
mov edi, dword [ebp - 0x30]
jmp 0x1000a986
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x1000a996
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x1000a9c0
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1000a9a7
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.10013c1f
add esp, 0x10
cmp esi, eax
jne 0x1000a9e9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x1000a9e7
test esi, esi
jne 0x1000a939
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.10007600
jmp 0x1000a933
dec eax
sub eax, 1
jne 0x1000a9ed
inc eax
jmp 0x1000a9eb
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.1000195f
mov al, bl
jmp 0x1000a9fb
mov al, 1
call fcn.10008628
ret
Function at 0x1000aef9
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x1002883d
call fcn.1000866d
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x1000af1e
xor eax, eax
jmp 0x1000b0a2
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000af4a
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x1000af4a
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x1000b0a2
cmp dword [esi + 0x4c], 0
je 0x1000b09f
mov ecx, esi
call fcn.1000ab19
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x1000af7d
push dword [esi + 0x4c]
push edi
call fcn.1000a4a0
pop ecx
pop ecx
test al, al
je 0x1000b09f
movzx ebx, di
jmp 0x1000b09f
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.1000765b
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x34], edi
cmp ecx, 0x10
jb 0x1000afb7
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1000afc1
mov edx, eax
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x34]
mov esi, dword [edi]
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
call fcn.100092fa
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x1000b097
cmp eax, 1
jg 0x1000b072
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x1000b00b
mov edx, eax
mov edi, dword [ebp - 0x3c]
sub edi, edx
je 0x1000b03a
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1000b01c
mov edx, eax
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push edx
call fcn.10013c1f
add esp, 0x10
cmp edi, eax
jne 0x1000b06d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
jmp 0x1000b03d
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x40], edx
jne 0x1000b067
test edi, edi
jne 0x1000afa9
cmp dword [ebp - 0x18], 0x20
jae 0x1000b091
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.10007600
jmp 0x1000afa3
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x1000b091
cmp eax, 3
jne 0x1000b097
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.1000a4a0
pop ecx
pop ecx
test al, al
je 0x1000b091
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
lea ecx, [ebp - 0x28]
call fcn.1000195f
mov ax, bx
call fcn.10008628
ret 4

Function at 0x1000ed16
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1002d170
push 0x1002d168
push str.FlsAlloc
push 0
call fcn.1000ec96
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000ed48
push dword [ebp + 8]
mov ecx, esi
call fcn.100092fa
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1000ed8a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1002d180
push 0x1002d178
push str.FlsGetValue
push 2
call fcn.1000ec96
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x1000edbb
mov ecx, esi
call fcn.100092fa
call esi
jmp 0x1000edc1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x1000edc4
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1002d188
push 0x1002d180
push str.FlsSetValue
push 3
call fcn.1000ec96
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x1000edf8
mov ecx, esi
call fcn.100092fa
call esi
jmp 0x1000edfe
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x1001be03
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001bac6

Function at 0x1001be0e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001bc47
Function at 0x105f6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105f61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105f607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105f606a
add dl, dl
jne 0x105f6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105f60dc
xor eax, eax
add dl, dl
jne 0x105f6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105f617d
add dl, dl
jne 0x105f60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105f60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105f6075
mov eax, 1
add dl, dl
jne 0x105f60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105f60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105f60e1
sub eax, ebx
mov ebx, 1
jne 0x105f6128
mov ecx, 1
add dl, dl
jne 0x105f610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105f6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105f6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105f6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105f613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105f614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105f6136
cmp eax, 0x7d00
jae 0x105f616d
cmp eax, 0x500
jb 0x105f6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105f6075
cmp eax, 0x7f
ja 0x105f6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105f6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105f619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105f6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
nop
mov ecx, 0x1f875f33
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x6b84756
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219