joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x46f03c]
add eax, 8
mov byte [0x46f03c], al
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
movsx edx, byte [0x46f03c]
add edx, 8
mov byte [0x46f03c], dl
cmp dword [ebp - 4], 0xffffffff
je 0x402530
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x402534
xor eax, eax
jmp 0x402539
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402715
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x407170
call fcn.00402aa0
mov edi, 0x94
mov eax, edi
call fcn.004037b0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x46f3c0], ecx
mov eax, dword [esi + 4]
mov dword [0x46f3cc], eax
mov edx, dword [esi + 8]
mov dword [0x46f3d0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x46f3c4], esi
cmp ecx, 2
je 0x402775
or esi, 0x8000
mov dword [0x46f3c4], esi
shl eax, 8
add eax, edx
mov dword [0x46f3c8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4027b0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4027b0
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4027c8
cmp eax, 0x20b
je 0x4027b5
mov dword [ebp - 0x1c], esi
jmp 0x4027dc
cmp dword [ecx + 0x84], 0xe
jbe 0x4027b0
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4027d6
cmp dword [ecx + 0x74], 0xe
jbe 0x4027b0
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00403752
pop ecx
test eax, eax
jne 0x402808
cmp dword [0x46f3ac], 1
jne 0x4027f5
call fcn.00402f07
push 0x1c
call fcn.00402d90
push 0xff
call fcn.00402bf5
pop ecx
pop ecx
call fcn.004036b0
mov dword [ebp - 4], esi
call fcn.00403505
test eax, eax
jge 0x402821
push 0x1b
call fcn.004026f0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x46f934], eax
call fcn.004033e3
mov dword [0x46f3a4], eax
call fcn.00403341
test eax, eax
jge 0x402847
push 8
call fcn.004026f0
pop ecx
call fcn.0040310e
test eax, eax
jge 0x402858
push 9
call fcn.004026f0
pop ecx
push 1
call fcn.00402c25
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40286e
push eax
call fcn.004026f0
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004030b1
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40288f
movzx eax, word [ebp - 0x40]
jmp 0x402892
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004014a0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4028b0
push edi
call fcn.00402d50
call fcn.00402d72
jmp 0x4028e2
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00402adb
ret
Function at 0x8bc160
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x8bc19f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x8bc19f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x8bc19f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x8bc19f
cmp dword [ecx + 0x74], 0xe
jbe 0x8bc19f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x8c1cf3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x8c1d90
push ebx
push esi
call fcn.008c1cbc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.008c1c50
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x8c1d3d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x8c1d8f
push edi
push eax
call fcn.008c2910
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x8c1d5d
call fcn.008c07b1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x8c1d8e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.008c1c50
add esp, 0x20
test eax, eax
jne 0x8c1d7c
push edi
call fcn.008c07b1
jmp 0x8c1d84
push ebx
call fcn.008c07b1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x8c308d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x8cb030
push 0x8cb028
push str.FlsAlloc
push 0x1f
call fcn.008c2f4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x8c30c1
push dword [ebp + 8]
mov ecx, esi
call dword [0x8c912c]
call esi
jmp 0x8c30c7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x8c310b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x8cb040
push 0x8cb038
push str.FlsGetValue
push 0x21
call fcn.008c2f4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x8c3142
push dword [ebp + 8]
mov ecx, esi
call dword [0x8c912c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x8c314a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x8cb048
push 0x8cb040
push str.FlsSetValue
push 0x22
call fcn.008c2f4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x8c3184
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x8c912c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x8c85e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x8c860d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x8c860d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001c0e
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x10001c25
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10001c85
mov edi, dword [ebp + 0x1c]
xor edx, edx
cmp dword [edi], edx
jne 0x10001c37
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
cmp dword [eax], edx
je 0x10001c3a
xor edx, edx
inc edx
mov ecx, dword [edi]
mov eax, dword [ebp + 0x28]
mov esi, dword [ebp + 0x34]
imul ecx, dword [eax]
mov eax, dword [esi]
imul ecx, edx
mov edx, dword [edi]
sub edx, 0x2536
sub ecx, eax
mov eax, dword [ebp + 0x48]
add edx, ecx
neg edx
mov eax, dword [eax]
sbb edx, edx
inc edx
sub edx, eax
mov eax, dword [ebx]
mov ecx, dword [esi]
imul eax, edx
xor edx, edx
imul ecx, eax
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esi]
setle dl
sub edx, eax
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
sub edx, eax
mov eax, dword [ebp + 0x2c]
mov dword [eax], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x100028b9
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10061bf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
cmp byte [ebp + 0x14], 0
push esi
mov byte [esp + 4], dl
je 0x10002923
cmp byte [ebp + 0xc], 0
je 0x100028fa
push 0
push 0x1453
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100029eb
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100029eb
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 3
jl 0x1000290f
jmp 0x100029eb
test dl, dl
je 0x10002933
mov eax, dword [ebp + 0x18]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100029eb
push 3
lea ecx, [esp + 0x20]
call fcn.1000b34a
xor edx, edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0xfffffffb
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 8], 0xffffffff
mov dword [esp + 8], 6
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edx
jmp 0x10002986
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x1c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 8]
cmp dword [esp + 8], 3
jl 0x10002976
lea eax, [esp + 0xc]
push eax
push edx
push 1
push 0xcb2
push 0x5e92
push 0x4fd8
push ecx
lea eax, [esp + 0x38]
mov ecx, 0x319d
push eax
push 0x6672
push 0x464d
push edx
push 0x8d8
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x48]
push eax
push 0x89e
lea edx, [esp + 0x54]
call fcn.10003ad8
add esp, 0x3c
cmp dword [esp + 0x1c], 0
je 0x100029eb
push dword [esp + 0x1c]
call fcn.1004aef9
pop ecx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006088
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061cf7
call fcn.100616f8
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], ecx
test dl, dl
je 0x1000620d
mov dword [ebp - 0x20], 0x4ff0
cmp dword [ebp - 0x20], 0x52d2
jle 0x1000610f
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov ecx, esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov eax, esi
shl eax, cl
mov ecx, 0x1007da98
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.1000b132
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x7262
jl 0x100060ca
inc esi
push 0
mov dword [ebp - 0x1c], esi
cmp esi, 0x6551
pop esi
jl 0x100060c2
inc ebx
cmp ebx, 0x5a43
jl 0x100060bf
inc edi
cmp edi, 0x1509
jl 0x100060bd
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x4e8e
jge 0x1000612a
mov edx, str.ingevjmap_psc_gukfv_ygsiauem_xlfansm_ogwmaccio_vodwwh_foapvawdg_wjzfydroo_hakjkrqdo_pnakfgk
mov ecx, 0x1007da98
call fcn.1000d503
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x5c93
cmp dword [ebp - 0x20], 0x5ee3
jle 0x10006165
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007da98
or eax, edi
cdq
push edx
push eax
call fcn.1000b132
inc ebx
cmp ebx, 0x156b
jl 0x10006142
inc edi
cmp edi, 0x66a4
jl 0x10006140
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000619e
push 0x1406
push 0x7562
push 0xe62
push 0x64d6
push 0x13c0
push 1
push 0x65c5
push 1
mov edx, 0x7beb
xor cl, cl
call fcn.10005124
add esp, 0x20
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x5b33
jge 0x100061bd
mov edx, str.ggolfdvu_dkydks_fxspviseg_dkvb
mov ecx, 0x1007da98
call fcn.1000d503
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x49f6
cmp dword [ebp - 0x20], 0x4bd2
jle 0x10006246
mov edi, esi
mov ebx, esi
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x1007da98
cdq
push edx
push eax
call fcn.1000b132
inc ebx
cmp ebx, 0x321f
jl 0x10006221
inc edi
cmp edi, 0x7487
jl 0x1000621f
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov edi, dword [ebp + 0x18]
mov eax, dword [ebx]
test eax, eax
setne cl
imul eax, ecx, 0xb6a6
test eax, eax
je 0x10006266
cmp dword [edi], esi
je 0x10006266
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
xor edx, edx
mov ecx, 0xffff
mov dword [eax], ecx
or eax, 0xffffffff
sub eax, esi
cmp eax, ecx
setge dl
sub edx, dword [ebx]
mov eax, dword [ebx]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
mov eax, dword [edi]
setg cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp + 0x1c]
sete bl
xor edx, edx
mov eax, dword [eax]
cmp eax, ebx
mov eax, dword [edi]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setge cl
mov dword [eax], ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x20], 0x47d1
jge 0x100061bd
mov edx, str.yqdsu_wicfh_pghrz_anfxvnu_spevpyr_agjn_awlifxwup
mov ecx, 0x1007da98
call fcn.1000d503
jmp 0x100061bd
Function at 0x10014857
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062354
call fcn.100616f8
sub esp, 0x20
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
je 0x10014885
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
add dword [eax], ecx
jmp 0x1001498a
mov dword [ebp - 0x18], 0x3f6e
xor esi, esi
cmp dword [ebp - 0x18], 0x40bd
jle 0x100148f0
push 0x75b
push 0x1258
push esi
call dword [sym.imp.USER32.dll_OffsetRect]
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov eax, ebx
mov dword [ebp - 0x1c], esi
and eax, edi
mov dword [ebp - 0x20], eax
mov edi, eax
mov eax, edi
mov ecx, 0x1007da98
xor eax, esi
cdq
push edx
push eax
call fcn.1000b132
inc esi
cmp esi, 0x68c0
jl 0x100148bb
mov edi, dword [ebp - 0x14]
inc ebx
push 0
pop esi
cmp ebx, 0x627
jl 0x100148af
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x67e3
jl 0x100148ad
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x3cb1
jge 0x10014929
mov edx, str.eakmvopod_mmhn_quwz_ppfg
mov ecx, 0x1007da98
call fcn.1000d503
jmp 0x10014929
mov edx, dword [ebp - 0x24]
cmp dword [edx], esi
jne 0x10014939
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
cmp dword [eax], esi
je 0x1001493c
xor esi, esi
inc esi
mov ecx, dword [edx]
mov eax, dword [ebp + 0x2c]
mov edi, dword [ebp + 0x1c]
imul ecx, dword [eax]
mov eax, dword [edi]
imul ecx, esi
mov esi, dword [edx]
sub esi, 0x2536
sub ecx, eax
mov eax, dword [ebp + 0x14]
add esi, ecx
neg esi
mov eax, dword [eax]
sbb esi, esi
mov edx, dword [edi]
inc esi
sub esi, eax
mov eax, dword [ebp + 0xc]
imul edx, esi
mov ecx, dword [eax]
mov eax, dword [edi]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [edi]
setle dl
sub edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub edx, eax
mov eax, dword [ebp + 0x28]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014bfe
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0xc], cl
push ebx
push esi
push edi
test dl, dl
je 0x10014ce3
test cl, cl
je 0x10014c5a
mov dword [ebp - 0x14], 0x4e064826
mov dword [ebp - 0x18], 0x412df3d3
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x10014c3d
push 0x2e2b
push ecx
mov cl, 1
call fcn.10014256
pop ecx
pop ecx
push 0x2cb3
push ecx
lea eax, [ebp - 0x14]
mov dl, 1
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10014df4
add esp, 0x10
jmp 0x10014d09
mov dword [ebp - 0x10], 0x56a
cmp dword [ebp - 0x10], 0x906
jle 0x10014caa
xor esi, esi
mov edi, esi
mov ebx, 0x7096
mov eax, edi
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10014c8a
mov eax, dword [eax]
push eax
call fcn.1004ad2c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1000b74b
dec edi
dec ebx
jne 0x10014c73
inc esi
cmp esi, 0xf55
jl 0x10014c6c
cmp dword [ebp - 0x10], 0x2f2
jge 0x10014cbe
push str.megadpflu_cihx_jinhrpuu_erzawppa_qvvouzh_xtbcnqzzo_qfwr_smfcrzyr_ihn_egkw_fhpc
call fcn.1004ad2c
pop ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10014d09
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x53b1dab5
inc dword [edx]
cmp dword [edx], 2
jl 0x10014ccf
jmp 0x10014d09
cmp byte [ebp + 0x14], 0
je 0x10014cfb
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
and dword [ebp - 0x1c], 0
push eax
call fcn.1001346e
jmp 0x10014d09
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10014d09
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024f25
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100627fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10025091
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10024f9c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1002508f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], 0x5be3
mov dword [ebp - 0x48], str.mnfgn_ndggbqd_qvylhmeo_yqzhhxryx_xtqgpyok_plzg_ktvyq_mooj_veld_hfkhbd_xvoqd
cmp dword [ebp - 0x1c], 0x5cd4
jle 0x1002503d
and dword [ebp - 0x14], 0
jmp 0x10024fca
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1448
jge 0x1002502c
and dword [ebp - 0x18], 0
jmp 0x10024fe0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x635f
jge 0x1002502a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
lea ecx, [ebp - 0x88]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.1000b112
push eax
call fcn.1004ad2c
pop ecx
lea ecx, [ebp - 0x88]
call fcn.1000b108
jmp 0x10024fd9
jmp 0x10024fc3
push 0
push 0xf56
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5a82
jge 0x10025059
push dword [ebp - 0x48]
call fcn.1004ad2c
pop ecx
jmp 0x10025075
or dword [ebp - 4], 0xffffffff
jmp 0x1002507f
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x1002508f
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x100250fd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x60], eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 0x2e5e
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push 0x221d
push 0x4092
push dword [ebp - 0x64]
push 0x3e1c
push 0x4d62
push 0
push 0x3ff9
push dword [ebp - 0x68]
push 0x5fd2
call fcn.1001cd6c
add esp, 0x3c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e10c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], ecx
je 0x1002e184
cmp byte [ebp + 0x1c], 0
je 0x1002e177
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1002e208
push 0x2af1
push 0x30e5
push 0x55e1
push 0x7ad
push 0x34a3
push 0x26e3
push 0x7a3f
push 0x15d1
push 0x4ca4
push 1
push 1
push 0x3a51
xor dl, dl
mov ecx, 0x25d9
call fcn.1002df31
add esp, 0x30
jmp 0x1002e208
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1002e208
cmp byte [ebp + 0x30], 0
push esi
je 0x1002e1e2
mov esi, dword [ebp + 0x24]
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ecx, dword [edx]
xor edx, edx
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x2c]
setg dl
mov dword [esi], edx
xor ebx, ebx
mov eax, dword [eax]
test eax, eax
mov eax, dword [ecx]
sets bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ecx]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [edi]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [esi]
cmp eax, ecx
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
mov eax, dword [eax]
cmp eax, edx
setne cl
mov dword [edi], ecx
pop edi
pop ebx
jmp 0x1002e207
mov esi, dword [ebp + 0x28]
xor ecx, ecx
mov eax, dword [esi]
mov eax, dword [esi]
test eax, eax
mov eax, dword [esi]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esi]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0x18]
setg cl
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100327ac
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062c34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100327e9
push 1
push 0x447b
call fcn.1003294d
pop ecx
pop ecx
jmp 0x1003293c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10032812
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1003293c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xaeb
mov dword [ebp - 0x40], str.lmpn_pedzfy_guowu_bhfxs_djse_jszc_azsa_zchhugb_wxo_ofbmc_qajxcz_oszwfrwoh_aghgkfes
cmp dword [ebp - 0x28], 0xdf4
jle 0x100328c3
and dword [ebp - 0x24], 0
jmp 0x1003284c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x6955
jge 0x100328c3
and dword [ebp - 0x18], 0
jmp 0x10032862
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4cba
jge 0x100328c1
and dword [ebp - 0x1c], 0
jmp 0x10032878
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x369
jge 0x100328bf
and dword [ebp - 0x20], 0
jmp 0x1003288e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2cf2
jge 0x100328bd
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x1007da98
call fcn.1000b132
jmp 0x10032887
jmp 0x10032871
jmp 0x1003285b
jmp 0x10032845
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x983
jge 0x100328e3
mov edx, dword [ebp - 0x40]
mov ecx, 0x1007da98
call fcn.1000d503
jmp 0x100328ff
or dword [ebp - 4], 0xffffffff
jmp 0x10032909
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1003291f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x1003293c
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1000b3b1
mov dword [eax], 0x9351f200
jmp 0x10032914
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret