joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035ea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.10018850
mov edi, eax
mov ecx, dword [edi + 0x90]
cmp dword [ecx + 0x34], 0
jle 0x10035ed1
cmp dword [ecx + 0x14], 0
jne 0x10035ee8
cmp dword [ecx + 0x18], 0
jne 0x10035ee8
push 0xd9
push str.E:Visual_Studio_ProjectsMGRCheatMenumgrCheat_srcimguiimgui_impl_win32.cpp
push str.io.Fonts__IsBuilt_____Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__._
call fcn.10065cee
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [0x100c4368]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
movd xmm1, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x14]
cvtdq2ps xmm0, xmm0
push eax
movss dword [edi + 8], xmm1
movss dword [edi + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [0x100c4370]
mov edx, dword [ebp - 0x10]
sbb edx, dword [0x100c4374]
call fcn.1004e4a0
mov edx, dword [0x100c437c]
mov ecx, dword [0x100c4378]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.1004e4a0
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [0x100c4370], eax
mov dword [0x100c4374], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf8], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf9], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xfb], 0
mov byte [edi + 0xfa], al
call fcn.10018850
cmp byte [eax + 0x353], 0
lea esi, [eax + 0xe0]
je 0x10035ff6
cvttss2si eax, dword [eax + 0xe4]
cvttss2si ecx, dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [0x100c4368]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1003605e
mov ecx, dword [0x100c4368]
cmp eax, ecx
je 0x10036023
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1003605e
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1003605e
lea eax, [ebp - 0x1c]
push eax
push dword [0x100c4368]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1003605e
movd xmm0, dword [ebp - 0x1c]
movd xmm1, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x1003606e
or eax, 0xffffffff
jmp 0x10036073
call fcn.10018950
cmp dword [0x100be870], eax
je 0x10036085
mov dword [0x100be870], eax
call fcn.10036340
call fcn.100360a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x1004b060
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x100c50dc]
test eax, eax
je 0x1004b07c
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x1004b0d2
mov eax, dword [eax]
test eax, eax
jne 0x1004b070
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1004b0cf
push esi
push edi
xor edi, edi
mov dword [eax + 8], 0
lea edx, [eax + 0x20]
lea esi, [edi + 0x20]
mov dword [edx], edi
mov ecx, edx
mov dword [eax + 4], edx
add esi, 0x20
add edx, 0x20
mov edi, ecx
cmp esi, 0xfe0
jbe 0x1004b0a5
mov ecx, dword [0x100c50dc]
mov dword [eax], ecx
mov dword [0x100c50dc], eax
pop edi
pop esi
test eax, eax
jne 0x1004b0d2
xor eax, eax
ret
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
Function at 0x1004ba80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
imul esi, eax, 0x2c
push edi
add esi, dword [0x100c50d0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1004bae0
pop edi
mov eax, 0xa
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1004bb05
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1004bb26
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1004bb26
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1004bb20
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1004bb26
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, byte [esi + 0x14]
and bl, 1
and cl, 0xfd
mov al, bl
add al, al
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
mov byte [esi + 0x14], cl
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1004e12b
mov esp, ebp
pop ebp
ret
Function at 0x1004bc10
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1004bd08
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1004bd01
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x1004bce8
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1004bce8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1004bce8
mov edx, dword [esi]
test edx, edx
jne 0x1004bcb1
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x100c4388]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1004bd01
jmp 0x1004bcdc
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1004bcdc
shl eax, 3
push eax
push edx
push 0
push dword [0x100c4388]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1004bd01
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1004bc70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1004bd4c
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x1004bd4c
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1004bd46
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1004bfe0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x1004bd14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e12b
mov esp, ebp
pop ebp
ret

Function at 0x1004c150
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x1004c1a0
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x1004c18f
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1004c188
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x1004c165
pop ebx
push dword [edi]
push 0
push dword [0x100c4388]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
ret
Function at 0x10066210
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1004e160
mov eax, dword [0x100beb60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1006ffbd
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10066252
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100663ae
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1004e520
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100c4d70]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10071f21
mov ecx, dword [esi*4 + 0x100c4d70]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100663a7
cmp eax, dword [edi + ecx + 0x24]
jne 0x100663a7
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100663a7
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10071f21
add esp, 0x14
test edx, edx
jl 0x100663a7
jg 0x1006631d
test eax, eax
jb 0x100663a7
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100663a7
jl 0x10066337
cmp dword [ebp - 0x1008], eax
ja 0x100663a7
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10066355
test ebx, ebx
je 0x1006638e
cmp ecx, edi
jae 0x1006638e
mov al, byte [ecx]
cmp al, 0xd
jne 0x1006636f
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1006637b
cmp byte [ecx + 1], 0xa
jne 0x1006637b
inc ecx
jmp 0x1006637b
movzx eax, al
movsx eax, byte [eax + 0x100bede0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10066355
cmp edx, ebx
jne 0x10066355
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100663ac
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1004e12b
leave
ret

Function at 0x1006efff
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100957c0
push 0x100957b8
push str.FlsAlloc
push 0x1e
call fcn.1006edec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006f033
push dword [ebp + 8]
mov ecx, esi
call dword [0x10082234]
call esi
jmp 0x1006f039
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1006f07d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100957d0
push 0x100957c8
push str.FlsGetValue
push 0x20
call fcn.1006edec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006f0b4
push dword [ebp + 8]
mov ecx, esi
call dword [0x10082234]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10070f83
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10070df4

Function at 0x100713bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100c4d70]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100713ff
cmp byte [ebx], 0xa
jne 0x100713ff
or byte [eax + edi + 0x28], 4
jmp 0x10071404
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10071502
mov al, byte [edx]
cmp al, 0x1a
je 0x100714e4
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10071433
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x10071458
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x10071462
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x10071415
jmp 0x10071502
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100714df
cmp dword [ebp - 0xc], 0
je 0x100714df
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x100c4d70]
test byte [eax + edi + 0x28], 0x48
je 0x100714b9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100714a4
mov byte [esi], dl
jmp 0x100714b5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100c4d70]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10071502
cmp byte [ebp - 1], 0xa
jne 0x100714c8
cmp esi, ebx
jne 0x100714c8
mov byte [esi], 0xa
jmp 0x10071501
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10071f3f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10071502
mov byte [esi], 0xd
jmp 0x10071501
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x100c4d70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100714fe
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10071502
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1007150b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x100c4d70]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1007154e
cmp word [esi], dx
jne 0x1007154e
or byte [edi + eax + 0x28], 4
jmp 0x10071553
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x100716a6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10071686
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10071595
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100715cb
cmp eax, edx
jae 0x100715d7
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1007156d
jmp 0x100716a6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10071682
cmp dword [ebp - 0x14], 0
je 0x10071682
mov eax, dword [ebx*4 + 0x100c4d70]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1007165a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x10071623
mov word [esi], cx
jmp 0x10071656
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x100c4d70]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x100c4d70]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x100c4d70]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x100716a6
pop ebx
cmp word [ebp - 4], bx
jne 0x1007166b
cmp esi, dword [ebp + 0xc]
jne 0x1007166b
mov word [esi], bx
jmp 0x100716a3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10071f3f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x100716a6
push 0xd
jmp 0x1007169f
mov ecx, dword [ebx*4 + 0x100c4d70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1007169d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100716a6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10074c84
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10074c06
Function at 0x10078546
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100785e3
push ebx
push esi
call fcn.1007850f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1007731b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10078590
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100785e2
push edi
push eax
call fcn.1007211e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100785b0
call fcn.1006ea0a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100785e1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1007731b
add esp, 0x20
test eax, eax
jne 0x100785cf
push edi
call fcn.1006ea0a
jmp 0x100785d7
push ebx
call fcn.1006ea0a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100785e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100785f7
pop esi
ret
push ebx
push edi
push esi
call fcn.1007850f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1007211e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1007861f
push ebx
push esi
push edi
call fcn.1004f980
add esp, 0xc
push 0
call fcn.1006ea0a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10078d6b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10078892
Function at 0x1007f741
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1007f6bd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1007f8b9
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1007f8b9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1007f868
jg 0x1007f79a
test eax, eax
je 0x1007f85e
push 1
push 0x1000
call fcn.1006eaba
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1007f7c0
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1007f855
push 0x8000
push ebx
call fcn.1007f5ee
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1007f7ec
jg 0x1007f7e7
cmp ecx, 0x1000
jb 0x1007f7ec
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10070bf4
add esp, 0x10
cmp eax, 0xffffffff
je 0x1007f831
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1007f7e7
jl 0x1007f818
test ecx, ecx
jne 0x1007f7d9
push dword [ebp - 0xc]
push ebx
call fcn.1007f5ee
push esi
call fcn.1006ea0a
add esp, 0xc
xor edi, edi
jmp 0x1007f8ca
cmp byte [edi + 0x24], 0
je 0x1007f848
cmp dword [edi + 0x20], 5
jne 0x1007f848
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1007f853
mov edi, dword [edi + 0x18]
jmp 0x1007f855
xor edi, edi
push esi
call fcn.1006ea0a
pop ecx
jmp 0x1007f8ca
test ecx, ecx
jg 0x1007f82a
jl 0x1007f868
test eax, eax
jae 0x1007f82a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10071f3f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1007f88b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1007f82a
jmp 0x1007f8c2
push ebx
call fcn.1007bc22
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1007f82a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1007f8ca
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1007f8c7
mov edi, dword [edi + 0x18]
jmp 0x1007f8ca
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10071f3f
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10080770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1008079d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1008079d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x445b2e1d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x57357163
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219