joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fd52
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
cld
lodsb al, byte [esi]
inc ecx
or al, al
jne 0x1002fd67
jmp 0x1002fd6f
cmp al, 0x5c
jne 0x1002fd6d
mov edx, ecx
jmp 0x1002fd5f
mov eax, dword [ebp + 8]
lea edi, [eax + edx]
jmp 0x1002fd7d
push 0x1002fd77
push edi
call fcn.1002f616
add edi, eax
push 0
push dword [ebp + 8]
call fcn.10050fba
cmp byte [0x100525df], 0
jne 0x1002fdfe
mov eax, dword [0x1005d7f3]
mov eax, dword [eax]
or eax, eax
je 0x1002fe01
mov eax, dword [eax + 0x418]
or eax, eax
je 0x1002fdfc
movzx ecx, byte [eax - 4]
mov esi, eax
xor edx, edx
jmp 0x1002fdee
dec ecx
lodsb al, byte [esi]
cmp al, 0x5c
je 0x1002fde2
cmp al, 0x2f
je 0x1002fde2
cmp al, 0x3a
je 0x1002fde2
cmp al, 0x2a
je 0x1002fde2
cmp al, 0x3f
je 0x1002fde2
cmp al, 0x22
je 0x1002fde2
cmp al, 0x3c
je 0x1002fde2
cmp al, 0x3e
je 0x1002fde2
cmp al, 0x7c
jne 0x1002fde6
jmp 0x1002fdee
or al, al
jne 0x1002fdec
jmp 0x1002fdf2
inc edx
stosb byte es:[edi], al
or ecx, ecx
jne 0x1002fdbc
or edx, edx
jne 0x1002fdf7
dec edi
mov word [edi], 0x5c
jmp 0x1002fe01
mov byte [edi], 0
pop edi
pop esi
leave
ret 4

Function at 0x10030a47
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
jmp 0x10030a5d
push 0x10030a51
push 0
push 4
call fcn.10051092
or eax, eax
je 0x10030ac5
cmp eax, 0xffffffff
je 0x10030ac5
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push dword [ebp - 4]
call fcn.10051074
or eax, eax
je 0x10030ab9
cmp eax, 0xffffffff
je 0x10030ab9
mov dword [ebp - 8], eax
push 0x26
lea eax, [eax + 0x18c]
push eax
push dword [ebp + 8]
call fcn.1002f4e9
push dword [ebp - 8]
call fcn.100510d4
push dword [ebp - 4]
call fcn.10050fb4
push 1
pop eax
jmp 0x10030ac7
push dword [ebp - 4]
call fcn.10050fb4
xor eax, eax
jmp 0x10030ac7
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x10031f5d
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 8]
pop dword [0x1006b424]
jmp 0x10031f79
push 0x10031f6e
call fcn.1005100e
or eax, eax
je 0x10032119
mov dword [ebp - 0xc], eax
jmp 0x10031fa2
push 0x10031f90
push dword [ebp - 0xc]
call fcn.10051020
mov dword [fcn.10052501], eax
jmp 0x10031fc5
push 0x10031fb6
push dword [ebp - 0xc]
call fcn.10051020
mov dword [0x10052505], eax
jmp 0x10031fed
push 0x10031fd9
push dword [ebp - 0xc]
call fcn.10051020
mov dword [0x10052509], eax
cmp dword [0x10052292], 0
jne 0x10032119
jmp 0x1003201a
push 0x1003200e
push 0
push 4
call fcn.10051092
cmp eax, 0xffffffff
je 0x10032119
or eax, eax
je 0x10032119
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push dword [ebp - 4]
call fcn.10051074
cmp eax, 0xffffffff
je 0x10032111
or eax, eax
je 0x10032111
mov dword [ebp - 8], eax
push dword [eax + 0x1cc]
pop dword [0x10052292]
push dword [eax + 0x184]
pop dword [0x1006b400]
movzx edx, word [eax + 0x1b2]
mov dword [0x10052511], edx
push dword [eax + 0x1b4]
pop dword [0x10052515]
mov dl, byte [eax + 0x1d3]
mov byte [0x1006b696], dl
mov dl, byte [eax + 0x1d2]
mov byte [0x10052296], dl
mov dl, byte [eax + 0x1d0]
mov byte [0x100525de], dl
mov dl, byte [eax + 0x1d1]
mov byte [0x100525df], dl
mov edx, dword [eax + 0x1c4]
xor edx, dword [eax + 0x1c0]
mov dword [0x1005d66f], edx
mov edx, dword [eax + 0x1c0]
xor edx, dword [eax + 0x1bc]
mov dword [0x1005d647], edx
mov edx, dword [eax + 0x1bc]
xor edx, dword [eax + 0x1b8]
mov dword [0x1005d55b], edx
mov edx, dword [eax + 0x1b8]
xor edx, dword [eax + 0x18c]
mov dword [0x1005d773], edx
push dword [ebp - 8]
call fcn.100510d4
push dword [ebp - 4]
call fcn.10050fb4
leave
ret 4

Function at 0x10032922
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
or eax, 0xffffffff
or edx, edx
je 0x10032954
lea esi, [edx]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edi + edx*4]
xor eax, edx
inc ecx
dec esi
jne 0x1003293a
not eax
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x10033420
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1005d7f3]
mov eax, dword [eax]
mov dword [0x10062828], 0
mov eax, dword [eax + 0x30c]
or eax, eax
je 0x10033454
mov eax, dword [eax + 0x80]
or eax, eax
je 0x10033454
mov eax, dword [eax + 4]
or eax, eax
je 0x10033454
mov dword [0x10062828], eax
cmp dword [0x10062828], 0
je 0x10033512
sub esp, 0x44
xor eax, eax
push ebx
push esi
push edi
mov eax, dword [0x1005d7bb]
mov ecx, dword [eax]
movzx ecx, word [ecx + 8]
mov dword [ebp + 0xc], ecx
mov edx, dword [eax]
movzx edx, word [edx + 0xa]
mov dword [ebp + 0x10], edx
mov eax, dword [eax]
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov word [ebp - 0x22], dx
movzx dx, byte [eax + 0xc]
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x24], cx
mov cx, word [ebp + 8]
push 0x10
lea eax, [ebp - 0x24]
push eax
lea ebx, [ebp - 0x42]
mov dword [ebp - 0x18], esi
mov word [ebp - 0x20], cx
mov word [ebp - 0x1c], dx
call fcn.10033382
mov ecx, 0x4a2d14
mov al, byte [ecx]
mov ecx, dword [0x10062828]
lea edx, [ebp - 0x44]
movzx esi, al
mov dword [ebp - 0xc], edx
mov edx, 0
mov byte [ebp - 0x44], 0x23
mov byte [ebp - 0x32], 0x21
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
add esi, 0x18
mov edi, 0x12
mov eax, esi
cdq
mov ecx, 9
idiv ecx
add dl, 0x31
mov byte [ebp - 0x43], dl
push dword [ebp - 0x10]
push 0x13
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.10051140
mov dword [ebp - 0x14], eax
dec esi
dec edi
jne 0x100334e8
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x100339a2
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
lea esi, [0x1006ba61]
lea edi, [0x1005d22d]
mov ecx, 7
mov ebx, dword [esi + 0x1c]
mov eax, dword [esi]
xor eax, ebx
mov dword [edi], eax
dec ecx
add esi, 4
add edi, 4
or ecx, ecx
jne 0x100339b9
pop ebx
pop edi
pop esi
ret
Function at 0x10033bd2
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x10052fc5], 0
je 0x10033c32
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx eax, word [eax + 0x3c]
cmp eax, dword [0x10052fc6]
ja 0x10033bf7
push 0
call fcn.1004068f
jmp 0x10033bfc
call fcn.10040904
cmp dword [0x1006b5ee], 0xffffffff
jne 0x10033c09
xor eax, eax
jmp 0x10033c34
cmp dword [0x1006b5ee], 0
je 0x10033c2d
call fcn.1005103e
sub eax, dword [0x1006b5f2]
cmp eax, 0x3e8
jb 0x10033c28
xor eax, eax
jmp 0x10033c34
or eax, 0xffffffff
jmp 0x10033c34
or eax, 0xffffffff
jmp 0x10033c34
xor eax, eax
or eax, eax
jne 0x10033d6c
cmp dword [0x10052f85], 0
je 0x10033ccf
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx eax, word [eax + 0x3c]
cmp eax, dword [0x10052f85]
ja 0x10033cc5
cmp ax, word [0x10052426]
jae 0x10033cb6
or ax, ax
je 0x10033cb6
push 3
push 0x1001d628
call fcn.1002f9a8
cmp eax, 0xffffffff
jne 0x10033c87
push 3
push 0x1001d60a
call fcn.1002f9a8
cmp eax, 0xffffffff
je 0x10033cb2
push eax
call fcn.1002f8cf
or eax, eax
jne 0x10033cae
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
mov ax, word [eax + 0x3c]
mov word [0x10052426], ax
mov eax, 1
jmp 0x10033cd1
xor eax, eax
jmp 0x10033cd1
xor eax, eax
jmp 0x10033cd1
or ax, ax
je 0x10033cc1
mov word [0x10052426], ax
xor eax, eax
jmp 0x10033cd1
mov word [0x10052426], ax
xor eax, eax
jmp 0x10033cd1
xor eax, eax
or eax, eax
jne 0x10033d22
cmp dword [0x10052f80], 0
je 0x10033d22
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx eax, word [eax + 0x3c]
cmp eax, dword [0x10052f80]
ja 0x10033d1a
cmp ax, word [0x10052424]
jae 0x10033d0b
or ax, ax
je 0x10033d0b
call fcn.1002f9fb
mov eax, 1
jmp 0x10033d22
or ax, ax
je 0x10033d16
mov word [0x10052424], ax
xor eax, eax
jmp 0x10033d22
mov word [0x10052424], ax
xor eax, eax
or eax, eax
jne 0x10033d6c
cmp dword [0x10052f6c], 0
je 0x10033d6c
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx eax, word [eax + 0x3c]
cmp eax, dword [0x10052f6c]
ja 0x10033d66
cmp ax, word [0x10052422]
jae 0x10033d59
or ax, ax
je 0x10033d59
push 0
call fcn.100316dd
jmp 0x10033d6c
or ax, ax
je 0x10033d6c
mov word [0x10052422], ax
jmp 0x10033d6c
mov word [0x10052422], ax
cmp byte [0x10052fae], 0
je 0x10033e37
cmp dword [0x100534e6], 0
je 0x10033dcb
call fcn.1005103e
sub eax, dword [0x1006b688]
cmp eax, dword [0x100534ea]
jb 0x10033dcb
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx eax, word [eax + 0x3c]
cmp eax, dword [0x100534e6]
ja 0x10033dcb
cmp byte [0x1005350e], 0
jne 0x10033dba
push 2
call fcn.10032e32
jmp 0x10033dc1
push 2
call fcn.10032e9c
call fcn.1005103e
mov dword [0x1006b688], eax
cmp dword [0x10052f0c], 0
je 0x10033e01
call fcn.1005103e
sub eax, dword [0x1006b458]
cmp eax, dword [0x10052f20]
jb 0x10033e01
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx eax, word [eax + 0x3c]
cmp eax, dword [0x10052f0c]
ja 0x10033e01
push 0
call fcn.1003185b
cmp dword [0x10052f24], 0
je 0x10033e37
call fcn.1005103e
sub eax, dword [0x1006b45c]
cmp eax, dword [0x10052f38]
jb 0x10033e37
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx eax, word [eax + 0x3c]
cmp eax, dword [0x10052f24]
ja 0x10033e37
push 0
call fcn.1000496b
ret
Function at 0x10034b49
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov byte [0x1006283a], 0
mov byte [0x100626d5], 0
mov dword [0x100626cc], 0
call fcn.10034f1e
cmp eax, 0xffffffff
jne 0x10034bc3
jmp 0x10034b77
jmp 0x10034b84
push 0x10034b79
push 0x10034b70
call fcn.1000b638
cmp eax, 0xffffffff
je 0x10034bc3
or eax, eax
jne 0x10034bc1
cmp dword [ebp + 8], 1
jne 0x10034bc1
jmp 0x10034bb7
push 0x10034ba4
call fcn.10048003
jmp 0x10034c27
call fcn.10048073
cmp eax, 0xffffffff
jne 0x10034c1e
jmp 0x10034bd6
jmp 0x10034bdf
push 0x10034bd8
push 0x10034bcf
call fcn.1000b638
cmp eax, 0xffffffff
je 0x10034c1e
or eax, eax
jne 0x10034c1c
cmp dword [ebp + 8], 1
jne 0x10034c1c
jmp 0x10034c12
push 0x10034bff
call fcn.10048003
jmp 0x10034c27
or al, 0xff
jmp 0x10034c27
cmp al, 0xff
je 0x10034c56
call fcn.10048058
cmp al, 0x2e
jb 0x10034c36
jmp 0x10034c56
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
mov dx, word [eax + 0x52]
sub dx, word [eax + 0x50]
cmp dx, 0
jg 0x10034c4d
jmp 0x10034c56
mov byte [0x1006283b], 1
jmp 0x10034c9b
call fcn.10048073
cmp eax, 0xffffffff
jne 0x10034c70
mov byte [0x1006283b], 0
mov byte [0x10062843], 1
jmp 0x10034c9b
mov byte [0x1006283b], 0
mov byte [0x1006283d], 1
jmp 0x10034c91
push 0x10034c80
call fcn.10048003
call fcn.1005103e
mov dword [0x1006280c], eax
leave
ret 4
Function at 0x10034d5e
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push esi
push ebx
push 0x76d
push dword [ebp + 8]
call fcn.1001517d
mov dword [ebp - 0x14], eax
push 0
push 0
push 0x1004
push dword [ebp - 0x14]
call fcn.10050f6c
cmp eax, 0xffffffff
je 0x10034ece
or eax, eax
je 0x10034ece
mov dword [ebp - 4], eax
imul eax, eax, 0x18
add eax, 0x18
mov dword [ebp - 8], eax
push dword [ebp - 8]
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov esi, dword [ebp - 0x10]
jmp 0x10034e2c
push 0x28
lea eax, [ebp - 0x3c]
push eax
call fcn.1003062f
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 1
lea eax, [esi + 1]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x1005
push dword [ebp - 0x14]
call fcn.10050f6c
lea eax, [esi + 1]
push eax
call fcn.1002f5af
mov byte [esi], al
inc dword [ebp - 0x34]
lea eax, [ebp - 0x154]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x102d
push dword [ebp - 0x14]
call fcn.10050f6c
lea eax, [ebp - 0x154]
push eax
call fcn.10023ca0
mov dword [esi + 0x14], eax
add esi, 0x18
inc ebx
cmp ebx, dword [ebp - 4]
jb 0x10034dbb
lea eax, [ebp - 0x154]
push eax
call fcn.10015a95
or eax, eax
jne 0x10034ebf
lea eax, [ebp - 0x154]
push eax
call fcn.1002fd52
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.10050fba
push dword [ebp + 0xc]
push dword [ebp + 0x10]
lea eax, [ebp - 0x50]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.100510f8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x154]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10034ebf
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.100510ec
push dword [ebp - 0xc]
call fcn.10050fb4
lea eax, [ebp - 0x10]
push eax
call fcn.1003d00f
pop ebx
pop esi
leave
ret 0xc
lea eax, [ebp - 0x154]
push eax
call fcn.10015a95
or eax, eax
jne 0x10034f18
lea eax, [ebp - 0x154]
push eax
call fcn.1002fd52
push dword [ebp + 0xc]
push dword [ebp + 0x10]
lea eax, [ebp - 0x50]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.100510f8
lea eax, [ebp - 0x154]
push eax
call fcn.10050fd2
pop ebx
pop esi
leave
ret 0xc
Function at 0x100360aa
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
or byte [ebp - 0xd], 0xff
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a854]
mov eax, dword [eax + 8]
cmp eax, 2
jb 0x100361ed
mov dword [ebp - 8], eax
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a854]
mov ecx, dword [eax + 8]
cmp dword [ebp - 0xc], ecx
jb 0x100360fd
jmp 0x100361ed
mov edx, dword [ebp - 0xc]
call dword [fcn.1005d229]
mov ecx, eax
mov al, byte [ecx + 0x20]
or al, al
jne 0x100361de
cmp ecx, dword [ebp - 4]
je 0x100361de
mov ax, word [ecx + 0xe]
cmp al, 0x32
je 0x100361de
cmp al, 0x18
je 0x100361de
cmp al, 0xc
je 0x100361de
or al, al
je 0x100361de
cmp ax, 0x472d
je 0x100361de
cmp ax, 0x309
je 0x100361de
cmp ax, 0x2517
je 0x100361de
cmp ax, 0xaa36
je 0x100361de
cmp ax, 0xab37
je 0x100361de
mov eax, dword [ebp - 4]
mov dx, word [eax + 8]
sub dx, word [ecx + 8]
jns 0x1003617a
neg dx
cmp dx, 1
ja 0x100361de
mov dx, word [eax + 0xa]
sub dx, word [ecx + 0xa]
jns 0x1003618d
neg dx
cmp dx, 1
ja 0x100361de
mov eax, dword [0x1005d853]
mov dword [eax], ecx
call fcn.1005103e
sub eax, dword [0x10062849]
cmp eax, 0x2bc
jbe 0x100361d8
mov eax, 0x4f7f30
cmp byte [eax + 0x10], 0x13
je 0x100361bc
cmp byte [eax], 0
jne 0x100361ce
call fcn.10036438
cmp eax, 0xffffffff
je 0x100361ce
push eax
push 1
call fcn.100472bf
call fcn.1005103e
mov dword [0x10062849], eax
mov byte [ebp - 0xd], 0
jmp 0x100361ed
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jb 0x100360e1
mov al, byte [ebp - 0xd]
leave
ret
Function at 0x1003a7ce
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push esi
push edi
call fcn.1005103e
sub eax, dword [0x10062863]
cmp eax, 0x2bc
jbe 0x1003a885
mov eax, dword [0x1005d82f]
mov eax, dword [eax]
or eax, eax
je 0x1003a885
mov eax, dword [eax + 0x28]
or eax, eax
jne 0x1003a808
pop edi
pop esi
leave
ret 4
movzx ecx, byte [eax - 4]
mov esi, eax
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
or dword [ebp - 0x64], 0xffffffff
cld
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
mov eax, dword [0x1005d7ff]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
cmp eax, 0
jg 0x1003a849
cmp dword [ebp + 8], 1
jne 0x1003a849
lea edx, [ebp - 0x5c]
mov eax, dword [0x1005d7cb]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [fcn.1005d25d]
jmp 0x1003a87b
cmp dword [ebp + 8], 1
jne 0x1003a863
lea edx, [ebp - 0x5c]
mov eax, dword [0x1005d7cb]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [fcn.1005d261]
jmp 0x1003a87b
cmp dword [ebp + 8], 2
jne 0x1003a87b
lea edx, [ebp - 0x5c]
mov eax, dword [0x1005d7cb]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [fcn.1005d265]
call fcn.1005103e
mov dword [0x10062863], eax
pop edi
pop esi
leave
ret 4
Function at 0x1003b37e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push esi
push edi
mov eax, 0x4f9194
cmp byte [eax], 0
je 0x1003b394
mov esi, eax
jmp 0x1003b3a4
mov eax, 0x4f91c8
cmp byte [eax], 0
je 0x1003b3a2
mov esi, eax
jmp 0x1003b3a4
xor esi, esi
or esi, esi
je 0x1003b415
movzx ecx, byte [esi]
cmp ecx, 0
jle 0x1003b4f8
cmp ecx, 0x10
jae 0x1003b4f8
push 0
call fcn.10050f42
or eax, eax
je 0x1003b410
push 0x10
push 0x42
call fcn.10051050
or eax, eax
je 0x1003b40b
mov dword [ebp - 0x6c], eax
push dword [ebp - 0x6c]
call fcn.1005105c
or eax, eax
je 0x1003b40b
mov dword [ebp - 0x68], eax
call fcn.10050e6a
movzx ecx, byte [esi]
inc esi
mov edi, dword [ebp - 0x68]
cld
rep movsb byte es:[edi], byte [esi]
mov byte [edi], 0
push dword [ebp - 0x6c]
call fcn.10051068
push dword [ebp - 0x6c]
push 1
call fcn.10050f78
call fcn.10050e40
jmp 0x1003b4f8
mov eax, dword [0x1005d82f]
mov eax, dword [eax]
or eax, eax
je 0x1003b4f1
cmp byte [eax + 0xe], 0
jne 0x1003b4f1
mov eax, dword [eax + 0x28]
or eax, eax
je 0x1003b4e8
movzx ecx, byte [eax - 4]
lea edi, [ebp - 0x5c]
or dword [ebp - 0x64], 0xffffffff
lea edx, [ecx + 2]
mov dword [ebp - 0x60], edx
mov byte [edi], 0x2f
inc edi
mov esi, eax
cld
rep movsb byte es:[edi], byte [esi]
mov word [edi], 0x20
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a850]
cmp byte [eax + 0x47], 0
jne 0x1003b49b
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a850]
mov dl, 1
call dword [0x1005d3ad]
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a850]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a850]
lea edx, [ebp - 0x5c]
call dword [0x1005d3b1]
mov edx, dword [ebp - 0x60]
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a850]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
xor edx, edx
mov eax, dword [0x1005d7f7]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a850]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
jmp 0x1003b4f8
xor byte [0x100522a9], 1
jmp 0x1003b4f8
xor byte [0x100522a9], 1
pop edi
pop esi
leave
ret

Function at 0x1003be43
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.1005103e
sub eax, dword [0x1006b454]
cmp eax, dword [0x10052ef8]
jbe 0x1003be7a
mov eax, 0x4a3fe8
mov eax, dword [eax]
or eax, eax
je 0x1003be7a
mov eax, dword [eax]
call dword [fcn.1005d301]
call fcn.1005103e
mov dword [0x1006b454], eax
mov byte [0x10052538], 1
ret
Function at 0x1003bf3d
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.1005103e
sub eax, dword [0x1006bab3]
cmp eax, dword [0x1005352b]
jbe 0x1003bf95
call fcn.10003e62
or eax, eax
je 0x1003bf8b
cmp byte [0x1005350e], 0
jne 0x1003bf83
push esi
mov esi, eax
mov eax, dword [0x1005d82f]
xchg dword [eax], esi
push 2
call fcn.10030cee
push eax
call fcn.10033b8a
mov eax, dword [0x1005d82f]
xchg dword [eax], esi
pop esi
jmp 0x1003bf8b
push eax
push 2
call fcn.1003310e
call fcn.1005103e
mov dword [0x1006bab3], eax
ret

Function at 0x1003c9c5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
call fcn.1005103e
sub eax, dword [0x10062863]
cmp eax, 0x2bc
jbe 0x1003ca31
push 0
push 0
push 0x147
push 0xe11
push dword [0x100523ce]
call fcn.10015391
cmp eax, 0xd
jae 0x1003ca31
mov dword [ebp - 4], eax
lea ecx, [0x10053433]
mov eax, dword [ecx + eax*4]
or eax, eax
je 0x1003ca31
push eax
call fcn.1002f8a3
cmp eax, 0xffffffff
je 0x1003ca31
push eax
push dword [ebp - 4]
call fcn.100472bf
push dword [ebp - 4]
call fcn.1003c958
call fcn.1005103e
mov dword [0x10062863], eax
leave
ret
Function at 0x1003e209
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push esi
push edi
mov eax, dword [0x1005d817]
mov eax, dword [eax]
or eax, eax
je 0x1003e471
mov eax, dword [eax]
or eax, eax
je 0x1003e471
mov esi, dword [eax + 0x2ae90]
or esi, esi
je 0x1003e471
lea edi, [ebp - 0x104]
movzx ecx, byte [esi - 4]
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
jmp 0x1003e251
push 0x1003e24c
lea eax, [ebp - 0x104]
push eax
call fcn.10051104
or eax, eax
jne 0x1003e280
mov edx, 0xd
mov eax, dword [0x1005d7f3]
mov eax, dword [eax]
call fcn.1003e4a7
mov eax, 1
pop edi
pop esi
leave
ret
lea esi, [0x100573f5]
mov edi, dword [esi]
add esi, 4
jmp 0x1003e469
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.10051104
or eax, eax
jne 0x1003e465
lea eax, [ebp - 0x104]
push eax
call fcn.10015a95
or eax, eax
jne 0x1003e463
lea eax, [ebp - 0x104]
push eax
call fcn.1002fd2a
jmp 0x1003e2d3
push 0x1003e2c7
lea eax, [ebp - 0x104]
push eax
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x1003e463
mov dword [ebp - 0x108], eax
cmp dword [0x100524a1], 0
je 0x1003e325
mov eax, dword [0x100524a1]
call dword [fcn.1005d3a9]
push 0
push dword [ebp - 0x108]
call fcn.10050ff6
cmp eax, 0x10657a
jne 0x1003e463
push 0
push 0
push dword [esi + 0xc]
push dword [ebp - 0x108]
call fcn.100510b6
mov eax, dword [esi + 0x10]
add eax, 0x7d0
call dword [0x1005d3a5]
mov dword [0x100524a1], eax
push 0
lea eax, [ebp - 0x104]
push eax
push dword [esi + 0x10]
push dword [0x100524a1]
push dword [ebp - 0x108]
call fcn.1005109e
push dword [ebp - 0x108]
call fcn.10050fb4
mov edx, 0x1f
mov eax, dword [0x1005d7cb]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x35c]
call dword [fcn.1005d399]
or eax, eax
je 0x1003e463
movzx edx, word [esi + 0xa]
mov cx, word [eax + 0x2c]
shl ecx, 0x10
mov cx, word [eax + 0x28]
mov dword [eax + 0x28], edx
mov dword [0x100524b5], edx
movzx edx, word [esi + 8]
mov dword [0x100524b1], edx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], edx
mov eax, dword [eax + 0x14]
or eax, eax
je 0x1003e463
mov eax, dword [eax + 4]
or eax, eax
je 0x1003e463
mov dword [ebp - 0x10c], 0
push edi
push eax
mov edi, eax
mov eax, ecx
mov ecx, 0x50
cld
repne scasd eax, dword es:[edi]
pop eax
jne 0x1003e40c
sub edi, eax
sub edi, 0xc
mov dword [ebp - 0x10c], edi
pop edi
cmp dword [ebp - 0x10c], 0
jle 0x1003e463
add eax, dword [ebp - 0x10c]
movzx edx, word [esi + 8]
mov dword [eax + 4], edx
mov word [eax + 0xa], dx
mov dx, word [esi + 0xa]
mov word [eax + 8], dx
push dword [0x100524a1]
pop dword [eax]
mov byte [0x10052442], 0
mov edx, 0x20
mov eax, dword [0x1005d7f3]
mov eax, dword [eax]
call dword [fcn.1005d39d]
call fcn.1005103e
mov dword [0x1006280c], eax
mov eax, 1
pop edi
pop esi
leave
ret
jmp 0x1003e471
add esi, 0x14
dec edi
or edi, edi
jne 0x1003e290
call fcn.1005103e
mov dword [0x1006280c], eax
xor eax, eax
pop edi
pop esi
leave
ret