joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54a2e0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54a49c
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x54a309
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x54a303
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x54a303
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x54a48e
cmp al, 0x2c
ja 0x54a46b
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x54a33d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x54a337
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x54a337
cmp al, 0x2f
ja 0x54a431
cmp al, 0x26
ja 0x54a409
cmp al, 0x24
jne 0x54a3fe
cmp ecx, 2
jg 0x54a3b4
cmp ecx, 1
je 0x54a3a9
cmp ecx, 2
jne 0x54a3a3
cmp al, 0x2f
jne 0x54a383
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x54a38f
mov eax, 1
jmp 0x54a37e
cmp al, 0x2c
jne 0x54a39b
mov eax, 1
jmp 0x54a37e
cmp al, 0x3f
sete al
jmp 0x54a37e
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x54a3e8
cmp al, 0x40
jne 0x54a3c8
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x54a3d4
mov eax, 1
jmp 0x54a3c3
cmp al, 0x3f
jne 0x54a3e0
mov eax, 1
jmp 0x54a3c3
cmp al, 0x3a
sete al
jmp 0x54a3c3
cmp ecx, 6
je 0x54a3f8
cmp ecx, 7
jne 0x54a3a3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x54a365
jmp 0x54a3a3
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x54a365
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x54a423
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x54a365
jmp 0x54a3a3
cmp al, 0x3d
ja 0x54a450
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x54a365
cmp al, 0x3d
je 0x54a365
jmp 0x54a3a3
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x54a365
cmp al, 0x5f
je 0x54a41d
cmp al, 0x7e
je 0x54a41d
jmp 0x54a3a3
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x54a337
cmp al, 0x5b
je 0x54a337
cmp al, 0x5d
je 0x54a337
jmp 0x54a34a
cmp ecx, 4
je 0x54a326
jmp 0x54a34a
call dbg.runtime.morestack_noctxt
jmp dbg.net/url.shouldEscape
Function at 0x57e080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57e215
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x57e20e
mov ecx, dword [eax]
lea eax, [0x603300]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dbg.runtime.makemap
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044bd04
lea eax, [0x603300]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call dbg.runtime.mapiterinit
jmp 0x57e10f
lea eax, [esp + 0x44]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x44]
test eax, eax
je 0x57e202
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x5d6980]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x5d6980]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call dbg.runtime.typedslicecopy
lea eax, [0x603300]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call dbg.runtime.mapassign_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x752a30]
test ecx, ecx
jne 0x57e1ed
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x57e103
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
jmp 0x57e103
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x57e0a7
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.Header.clone
Function at 0x57ec20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57edb5
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x57edae
mov ecx, dword [eax]
lea eax, [0x603300]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dbg.runtime.makemap
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044bd04
lea eax, [0x603300]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call dbg.runtime.mapiterinit
jmp 0x57ecaf
lea eax, [esp + 0x44]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x44]
test eax, eax
je 0x57eda2
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x5d6980]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x5d6980]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call dbg.runtime.typedslicecopy
lea eax, [0x603300]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call dbg.runtime.mapassign_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x752a30]
test ecx, ecx
jne 0x57ed8d
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x57eca3
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
jmp 0x57eca3
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x57ec47
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.cloneHeader
Function at 0x59b290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x59b47a
sub esp, 0x6c
mov eax, dword [esp + 0x70]
test eax, eax
je 0x59b465
mov ecx, dword [eax]
lea eax, [0x5d6980]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call dbg.runtime.makeslice
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0044bd04
lea eax, [0x5d8660]
mov dword [esp], eax
mov ecx, dword [esp + 0x70]
mov dword [esp + 4], ecx
lea ebp, [esp + 0x3c]
mov dword [esp + 8], ebp
call dbg.runtime.mapiterinit
xor eax, eax
jmp 0x59b323
lea eax, [esp + 0x3c]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x2c]
inc eax
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x59b370
mov ecx, dword [esp + 0x40]
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [esp + 0x20]
cmp eax, ebx
jae 0x59b473
mov dword [esp + 0x2c], eax
mov ebp, dword [esp + 0x34]
lea esi, [ebp + eax*8 + 4]
mov dword [esi], ecx
lea ecx, [ebp + eax*8]
mov esi, dword [0x752a30]
test esi, esi
jne 0x59b362
mov dword [ecx], edx
jmp 0x59b312
mov dword [esp], ecx
mov dword [esp + 4], edx
call dbg.runtime.writebarrierptr
jmp 0x59b312
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
call dbg.sort.StringSlice.Sort
lea eax, [0x5c0540]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call dbg.runtime.makeslice
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x30], edx
xor ebx, ebx
mov ebp, dword [esp + 0x34]
jmp 0x59b3da
mov esi, dword [esp + 0x38]
add esi, 8
lea ebx, [ecx + 1]
mov eax, dword [esp + 0x1c]
mov ecx, edx
mov edx, ebp
mov ebp, esi
mov esi, dword [esp + 0x20]
cmp ebx, esi
jge 0x59b455
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebp
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
lea edx, [0x5d8660]
mov dword [esp], edx
mov ebx, dword [esp + 0x70]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dbg.runtime.mapaccess1_faststr
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
cmp ecx, edx
jae 0x59b46c
mov ebx, dword [0x752a30]
mov ebp, dword [esp + 0x30]
lea esi, [ebp + ecx*4]
test ebx, ebx
jne 0x59b438
mov dword [ebp + ecx*4], eax
jmp 0x59b3c6
mov dword [esp], esi
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x30]
jmp 0x59b3c6
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x6c
ret
xor ecx, ecx
jmp 0x59b2b7
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.flag.sortFlags
Function at 0x5a4960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x5a4bb7
sub esp, 0x88
mov byte [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x180
call dbg.os.OpenFile
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x5a4a4b
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp], ecx
mov dword [esp + 4], edx
call dbg.os.IsNotExist
movzx eax, byte [esp + 8]
test al, al
je 0x5a4a20
mov byte [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
nop
call dbg.runtime.deferreturn
add esp, 0x88
ret
mov byte [esp + 0x9c], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xa4], eax
nop
call dbg.runtime.deferreturn
add esp, 0x88
ret
mov dword [esp + 0x44], eax
mov dword [esp + 8], eax
mov dword [esp], 0xc
lea ecx, [0x624a58]
mov dword [esp + 4], ecx
call dbg.runtime.deferproc
test eax, eax
jne 0x5a4baa
lea edi, [esp + 0x48]
xor eax, eax
call fcn.0044bd00
lea ecx, [0x70fd70]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x4c], ecx
lea ecx, [0x6247fc]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], 0x10000
lea eax, [esp + 0x48]
mov dword [esp], eax
call dbg.bufio.(*Scanner).Scan
movzx eax, byte [esp + 4]
test al, al
je 0x5a4b48
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dbg.runtime.slicebytetostring
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x98]
cmp ecx, edx
jne 0x5a4aa0
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x94]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call dbg.runtime.eqstring
movzx eax, byte [esp + 0x10]
test al, al
jne 0x5a4b1d
mov edx, dword [esp + 0x98]
jmp 0x5a4aa0
mov byte [esp + 0x9c], 1
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
nop
call dbg.runtime.deferreturn
add esp, 0x88
ret
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov edx, dword [0x73fc60]
cmp eax, edx
je 0x5a4b85
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov byte [esp + 0x9c], 0
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
nop
call dbg.runtime.deferreturn
add esp, 0x88
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov eax, dword [0x73fc64]
mov dword [esp + 8], eax
call dbg.runtime.ifaceeq
movzx eax, byte [esp + 0xc]
test al, al
je 0x5a4b5a
xor eax, eax
xor ecx, ecx
jmp 0x5a4b62
nop
call dbg.runtime.deferreturn
add esp, 0x88
ret
call dbg.runtime.morestack_noctxt
jmp dbg.main.checkStringExistsFile
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001aefd
pop dword [ebp - 0x20]
mov eax, 0x7c46046c
add eax, 0x93bbaa91
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x31f1eb53
sub dword [ebp - 0x30], 0xe39fa608
mov dword [ebp - 0x2c], 0x606f199a
add dword [ebp - 0x2c], 0xd1c432ab
mov dword [ebp - 0x28], 0x8437d762
add dword [ebp - 0x28], 0xc8146ccc
mov dword [ebp - 0x24], 0x97ecfddb
sub dword [ebp - 0x24], 0x97ecfddb
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xcd6dd57
sub dword [ebp - 0x30], 0x98647401
mov dword [ebp - 0x2c], 0x94f7d5f4
add dword [ebp - 0x2c], 0xac748b81
mov dword [ebp - 0x28], 0x59d7ffa6
sub dword [ebp - 0x28], 0xf668933a
mov dword [ebp - 0x24], 0x86071b56
add dword [ebp - 0x24], 0x79f8e4aa
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x5a430d1
add eax, 0xa5d8f2f
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x392e2
push 0
call eax
mov ecx, 0x37471c16
sub ecx, 0x3746cd15
mov edx, eax
mov ebx, 0x10026800
add ebx, dword [ebp - 0x20]
mov edi, 0x4c3ba2df
add edi, 0x14e885b4
sub dword [ebp - 4], 0xb7d4d814
mov esi, dword [ebx]
mov dword [ebp - 0xc], 0xf8f129c9
add esi, edi
add dword [ebp - 0x1c], 0x93cc50ec
mov dword [edx], esi
xor dword [ebp - 0x18], edi
add edx, 0xe2c16524
add edx, 0x1d3e9ae0
add ebx, 4
loop 0x1001b014
add eax, 0x4162eed0
sub eax, 0x4161bff9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1711a4a4
add ecx, 0xf8ee5b5c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x204970ea
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x36265ffb
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10051f4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10051f5d
pop dword [ebp - 0x44]
mov eax, 0xdc7741cf
sub eax, 0xcc722272
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x432ec
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xb3be9f38
sub ecx, 0xb3be573e
mov esi, eax
mov edi, 0xa9308fe4
add edi, 0x66e7e21c
add edi, dword [ebp - 0x44]
mov ebx, 0xddd63029
sub ebx, 0xb6080a23
xor dword [ebp - 0x34], edi
mov edx, dword [edi]
xor dword [ebp - 0x10], 0x8e3e772a
add edx, ebx
sub dword [ebp - 8], 0xe7b0143c
mov dword [esi], edx
add dword [ebp - 8], ebx
add esi, 0xd61b5356
sub esi, 0xd61b5352
add edi, 4
loop 0x10051fb7
add eax, 0x112bb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7310150a
sub ecx, 0x6310150a
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10051f4e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4

Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10051f4e
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10051f4e
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10051f4e
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10
Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10051f4e
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8
Function at 0x1003bcf5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x100dcd6c]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.100526c5
push 0x1000d03c
lea ecx, [esp + 0x1c]
call fcn.10052676
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x1003bd77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1003bda1
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x10016b08
call fcn.10052632
mov edi, eax
jmp 0x1003bda1
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.1003bbda
mov ebx, eax
test ebx, ebx
jns 0x1003bda7
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x10016b08
call fcn.1005296f
mov edi, ebx
test esi, esi
je 0x1003bdbb
jmp 0x1003bdb5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push esi
call fcn.1005285d
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100b2d85
mov esp, ebp
pop ebp
ret 8
Function at 0x1004364a
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c30fa
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
mov eax, dword [0x100dcd6c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.1003fb5e
cmp byte [ebp - 0x60], 0
je 0x10043758
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1004edce
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x5c]
call fcn.1004eaf2
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push dword [ebx + 0x3c]
lea eax, [ebp - 0x5c]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x38]
call fcn.10043acd
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.1004f24a
push 0x10051eb0
push 1
push 0x18
lea eax, [ebp - 0x2c]
push eax
call fcn.100b2fd7
cmp byte [ebp - 0x60], 0
je 0x10043754
lea ecx, [ebp - 0x78]
call fcn.10053264
mov eax, esi
jmp 0x10043790
call fcn.10084b3a
mov edi, 0x80070057
mov ecx, dword [eax]
cmp dword [ecx], 2
jbe 0x1004378e
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], esi
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x1000ff70
push eax
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], edi
push edx
push ecx
push ecx
mov edx, 0x10030462
call fcn.100347f6
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b2d85
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x38