joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f1f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5915c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49f2c9
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x49f2ab
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x49f2ab
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.00474d90
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
movzx edx, byte [eax + 6]
sub ecx, dword [esp + 8]
test dl, dl
je 0x49f27d
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004a09f0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.0049efc0
jmp 0x49f2a7
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0049efc0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a09f0
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a09f0
add esp, 0x10
ret
call fcn.0046c370
jmp fcn.0049f1f0
Function at 0x4a7640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5915c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a76be
sub esp, 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
xor eax, eax
jmp 0x4a76ad
mov dword [esp + 4], edx
mov esi, ebx
and esi, 0xff
xor ecx, esi
shr ebx, 8
mov esi, ebp
shl esi, 0x18
mov dword [esp], esi
mov edi, eax
mov eax, ecx
mov esi, 0x1b3
mul esi
shl ecx, 8
mov esi, dword [esp + 4]
imul esi, esi, 0x1b3
add esi, edx
inc edi
mov edx, edi
mov edi, dword [esp]
or ebx, edi
shr ebp, 8
add esi, ecx
mov ecx, eax
mov eax, edx
mov edx, esi
cmp eax, 8
jl 0x4a7667
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
add esp, 8
ret
call fcn.0046c370
jmp fcn.004a7640

Function at 0x4a76d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5915c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a772b
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xor eax, eax
jmp 0x4a771d
mov ebp, ebx
and ebp, 0xff
xor ecx, ebp
mov ebp, eax
mov eax, ecx
mov esi, 0x1b3
mov edi, edx
mul esi
shl ecx, 8
imul edi, edi, 0x1b3
add edi, edx
inc ebp
shr ebx, 8
lea edx, [ecx + edi]
mov ecx, eax
mov eax, ebp
cmp eax, 4
jl 0x4a76f0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
ret
call fcn.0046c370
jmp fcn.004a76d0

Function at 0x4a8c50
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x5915c4]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a8c9c
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call fcn.0046c370
jmp fcn.004a8c50
Function at 0x402bdc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402c1b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402c1b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402c1b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402c1b
cmp dword [ecx + 0x74], 0xe
jbe 0x402c1b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x524760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x811c9dc5
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
sub edi, ecx
xor esi, esi
and edi, 0xfffffffe
lea edx, [edi + ecx]
cmp ecx, edx
cmova edi, ebx
test edi, edi
je 0x524799
movzx edx, byte [ecx]
lea ecx, [ecx + 1]
xor edx, eax
inc esi
imul eax, edx, 0x1000193
cmp esi, edi
jne 0x524786
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x527322
Capabilities:
Terminate process

Disassembly:
call fcn.00726000
jmp 0x527322
push 0x14
push 0x5c10c8
call fcn.00527b90
push 1
call fcn.00401560
pop ecx
test al, al
je 0x52747e
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00405cb8
mov byte [ebp - 0x24], al
mov eax, dword [0x5cda4c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x52747e
test eax, eax
jne 0x5273ac
mov dword [0x5cda4c], ecx
push 0x567814
push 0x5677f0
call fcn.00405cf6
pop ecx
pop ecx
test eax, eax
je 0x52738f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x527478
push 0x5677ec
push 0x5677a8
call fcn.00406730
pop ecx
pop ecx
mov dword [0x5cda4c], 2
jmp 0x5273b1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004069dd
pop ecx
call fcn.004069fa
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x5273e2
push esi
call fcn.00526f2e
pop ecx
test al, al
je 0x5273e2
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call dword [0x5677a4]
call esi
call fcn.00406a00
mov esi, eax
cmp dword [esi], edi
je 0x527400
push esi
call fcn.00526f2e
pop ecx
test al, al
je 0x527400
push dword [esi]
call fcn.0053afa2
pop ecx
call fcn.00406a06
movzx eax, ax
push eax
call fcn.00406a39
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.004154e0
test al, al
je 0x527485
test bl, bl
jne 0x52742e
call fcn.0053af7d
push edi
push 1
call fcn.00526fb8
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x527478
call fcn.00527bd6
ret
push 7
call fcn.00527a20
push esi
call fcn.00415750
push dword [ebp - 0x20]
call fcn.0053af8c
int3

Function at 0x540eab
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00540ce3

Function at 0x54a600
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
mov ebx, dword [eax + 0x3c]
xor esi, esi
add ebx, eax
mov dword [ebp - 4], eax
xor edi, edi
movzx ecx, word [ebx + 6]
cmp esi, ecx
jae 0x54a659
movzx eax, word [ebx + 0x14]
lea edx, [ebx + 0x18]
add eax, edi
add edx, eax
je 0x54a659
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
add ecx, eax
neg eax
sbb eax, eax
and eax, ecx
cmp eax, dword [ebp + 8]
ja 0x54a648
mov ecx, dword [edx + 8]
add ecx, eax
cmp ecx, dword [ebp + 8]
ja 0x54a64e
inc esi
add edi, 0x28
jmp 0x54a616
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4024b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov dword [ebp - 0x56], 0x330056
mov dword [ebp - 0x52], 0x4b0044
mov dword [ebp - 0x4e], 0x790065
mov dword [ebp - 0x4a], 0x650047
mov dword [ebp - 0x46], 0x43006e
mov dword [ebp - 0x42], 0x61006c
mov dword [ebp - 0x3e], 0x730073
mov word [ebp - 0x3a], 0
lea edx, [ebp - 0x88]
mov eax, 0
mov ecx, 0xc
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x88], 0x30
mov dword [ebp - 0x84], 3
mov dword [ebp - 0x80], 0x4017b8
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x74], eax
mov dword [esp + 4], 0x7f89
mov dword [esp], 0
mov eax, dword [0x40e340]
call eax
sub esp, 8
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 6
mov dword [ebp - 0x64], 0
lea eax, [ebp - 0x56]
mov dword [ebp - 0x60], eax
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [0x40e344]
call eax
sub esp, 8
mov dword [ebp - 0x5c], eax
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [0x40e344]
call eax
sub esp, 8
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x88]
mov dword [esp], eax
mov eax, dword [0x40e350]
call eax
sub esp, 4
test ax, ax
jne 0x4025e9
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.Window_Registration_Failed_
mov dword [esp], 0
mov eax, dword [0x40e348]
call eax
sub esp, 0x10
mov eax, 0
jmp 0x402a67
mov dword [esp], 0
mov eax, dword [0x40e330]
call eax
sub esp, 4
mov dword [0x40c9f8], eax
mov dword [esp], 1
mov eax, dword [0x40e330]
call eax
sub esp, 4
mov dword [0x40c9fc], eax
mov dword [0x40ca00], 0x1d6
mov dword [0x40ca04], 0x10e
mov eax, dword [0x40c9f8]
mov edx, dword [0x40ca00]
sub eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [0x40ca08], eax
mov eax, dword [0x40c9fc]
mov edx, dword [0x40ca04]
sub eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [0x40ca0c], eax
jmp fcn.007f41c6
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x4606c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x68c89d
jmp fcn.0068c962

Function at 0x68c962
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebp, 0x775b6366
sub ebp, esi
sub ebp, 0x775b6366
pop esi
xchg dword [esp], ebp
pop esp
mov dword [esp], ebp
jmp 0x68c9c7
push ebp
mov ebp, esp
push ebx
mov ebx, 4
add ebp, ebx
pop ebx
push esi
mov esi, 4
jmp 0x68c904
jmp 0x764691
jmp 0x6c516d
push eax
mov dword [esp], ebx
mov dword [esp], 0x42a28a73
mov dword [esp], ecx
mov dword [esp], eax
jmp 0x6c5165
jmp 0x70ab5b
xor esi, dword [esp]
mov esp, dword [esp]
jmp 0x70ac34
push esi
mov esi, esp
add esi, 4
push ecx
mov ecx, 0x14
add esi, 0x3ebe148f
jmp 0x70ac20
sub esi, ecx
sub esi, 0x3ebe148f
pop ecx
xor esi, dword [esp]
xor dword [esp], esi
jmp 0x70ab50
jmp 0x6c5160
jmp 0x7647a5
push esp
mov ebp, dword [esp]
sub esp, 4
mov dword [esp], ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
jmp 0x7647c9
jmp 0x70aaf8
Function at 0x66e41390
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
test byte [0x66e43018], 8
jne 0x66e41410
test esi, esi
je 0x66e4146a
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x66e41471
mov dword [eax], 1
test byte [0x66e43018], 8
jne 0x66e41440
mov dword [esi], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.handle__p._n
mov dword [esp + 8], str.CreateInteractionContext
mov dword [esp + 4], 0x66e43018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x66e413ae
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Created_context__p._n
mov dword [esp + 8], str.CreateInteractionContext
mov dword [esp + 4], 0x66e43018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x66e413f7
mov eax, 0x80004003
jmp 0x66e413fb
mov eax, 0x8007000e
jmp 0x66e413fb

Function at 0x66e41480
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x66e43018], 8
jne 0x66e414d8
test ebx, ebx
je 0x66e41502
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.context__p._n
mov dword [esp + 8], str.DestroyInteractionContext
mov dword [esp + 4], 0x66e43018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x66e4149d
mov eax, 0x80070006
jmp 0x66e414c7

Function at 0x66e41980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x66e419db
cmp byte [esi + ebx - 1], 0xa
je 0x66e419af
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x66e46084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x66e41f30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x66e46094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x66e420f0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x66e46094]
movzx eax, al
bt eax, esi
jae 0x66e42150
mov ecx, dword [0x66e46084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x66e41ff6
test byte [0x66e43030], 8
jne 0x66e42090
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x66e43040], 8
jne 0x66e42040
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x66e41fc5
cmp esi, 3
jbe 0x66e42000
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x66e45300]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x66e41fc5
mov ecx, dword [0x66e46094]
test ecx, ecx
je 0x66e42130
mov dword [esp], 0x66e43040
call dword [0x66e46094]
test al, 8
je 0x66e41f9c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x66e41f9c
mov ebx, dword [0x66e46094]
test ebx, ebx
je 0x66e42110
mov dword [esp], 0x66e43030
call dword [0x66e46094]
test al, 8
je 0x66e41f89
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x66e41f8f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x66e46094
call sym._load_func.part.0
jmp 0x66e41f50
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x66e46094
call sym._load_func.part.0
jmp 0x66e4209a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x66e46094
call sym._load_func.part.0
jmp 0x66e4204e
mov eax, 0xffffffff
jmp 0x66e41ff6
Function at 0x403017
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406018]
jne 0x403021
repz ret
jmp fcn.00403364

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x1000c2a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 1
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
call fcn.1000b9f0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x18], 0
je 0x1000c2d6
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x14]
jmp 0x1000c337
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 0x20], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1000c3b0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.10056155
add esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000c326
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
call fcn.1000f700
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10010af0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.10010a90
add esp, 4
test eax, eax
je 0x10010b61
push 0
push 0
push 3
push 0
push 1
push connect
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x10010b61
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10014f60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 1
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
call fcn.1000b9f0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x18], 0
je 0x10014f96
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x14]
jmp 0x1001500f
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x24], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x28], ecx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0x20], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 0x1002b920
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.10056155
add esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10014ffe
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
call fcn.1000f700
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1001ce80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 1
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
call fcn.1000b9f0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x18], 0
je 0x1001ceb6
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x14]
jmp 0x1001cf17
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 0x20], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1001dbb0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.10056155
add esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001cf06
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
call fcn.1000f700
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10022e20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 1
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
call fcn.1000b9f0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x18], 0
je 0x10022e56
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x14]
jmp 0x10022eb7
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + 0x20], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x100231a0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.10056155
add esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10022ea6
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
call fcn.1000f700
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc]
call fcn.1000ba40
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10