joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53e340
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005330fa
mov dword [ebp - 0x14], eax
cmp dword [0x5bb514], esi
jne 0x53e433
push 0x800
push esi
push 0x587280
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x53e3c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x53e513
push esi
push esi
push 0x587280
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x53e513
push 0x587298
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x53e513
push eax
call ebx
push 0x5872a4
push edi
mov dword [0x5bb514], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5872b4
push edi
mov dword [0x5bb518], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5bb51c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bb524], eax
test eax, eax
je 0x53e430
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bb520], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x53e458
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x53e44b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x53e46d
push 4
pop eax
jmp 0x53e515
cmp dword [ebp - 0x14], esi
je 0x53e46d
push dword [0x5bb514]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x53e452
mov eax, dword [0x5bb520]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x53e4cb
cmp dword [0x5bb524], edi
je 0x53e4cb
push eax
call ebx
push dword [0x5bb524]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x53e4cb
test eax, eax
je 0x53e4cb
call ecx
test eax, eax
je 0x53e4c0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x53e4c0
test byte [ebp - 8], 1
jne 0x53e4cb
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x53e4fb
mov eax, dword [0x5bb518]
cmp eax, edi
je 0x53e4f8
push eax
call ebx
test eax, eax
je 0x53e4f8
call eax
mov esi, eax
test esi, esi
je 0x53e4f8
mov eax, dword [0x5bb51c]
cmp eax, edi
je 0x53e4f8
push eax
call ebx
test eax, eax
je 0x53e4f8
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5bb514]
call ebx
test eax, eax
je 0x53e513
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x53e515
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret
Function at 0x196a000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13ab000]
push edi
or ebp, 0xffffffff
jmp 0x196a022
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x196a029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x196a018
mov eax, 1
add ebx, ebx
jne 0x196a03b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x196a04c
jne 0x196a06b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x196a06b
dec eax
add ebx, ebx
jne 0x196a058
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x196a030
add ebx, ebx
jne 0x196a067
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x196a0bd
xor ecx, ecx
sub eax, 3
jb 0x196a083
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x196a0f2
sar eax, 1
mov ebp, eax
jmp 0x196a08e
add ebx, ebx
jne 0x196a08e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x196a05c
inc ecx
add ebx, ebx
jne 0x196a09c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x196a05c
add ebx, ebx
jne 0x196a0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x196a09e
jne 0x196a0ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x196a09e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x196a0dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x196a0ce
jmp 0x196a01e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x196a0dc
add edi, ecx
jmp 0x196a01e
pop esi
mov edi, esi
mov ecx, 0x207d9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x196a0fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x196a0ff
lea edi, [esi + 0x1566000]
mov eax, dword [edi]
or eax, eax
je 0x196a167
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23e98c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23e9a04]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x196a125
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23e9a0c]
or eax, eax
je 0x196a161
mov dword [ebx], eax
add ebx, 4
jmp 0x196a142
call dword [esi + 0x23e9a08]
mov ebp, dword [esi + 0x23e9a10]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x196a19b
sub esp, 0xffffff80
jmp 0x9b1c38
Function at 0x1004a4f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov eax, dword [ebx + 0x74]
add ecx, dword [ebx + 0xac]
imul eax, dword [ebx + 0x88]
cmp ecx, eax
push edi
jbe 0x1004b47
mov edx, dword [ebx + 0xac]
mov edi, dword [ebx + 0xa8]
mov esi, dword [ebp + 8]
sub eax, edx
mov ecx, eax
add edi, edx
mov dword [ebp - 4], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x74]
xor edi, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
fild qword [ebp - 0xc]
cmp eax, edi
fdiv qword [ebx + 0x90]
fild qword [ebx + 0xc0]
fmul qword [0x10014b8]
faddp st(1)
fsub qword [0x10014a0]
fstp qword [ebx + 0xc8]
jbe 0x1004b1e
push 0
push edi
push dword [ebx + 0xa8]
mov ecx, ebx
call fcn.01004d20
test eax, eax
jl 0x1004b79
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x1004b18
inc dword [ebx + 0xb4]
mov ecx, dword [ebx + 0xb4]
lea esi, [ebx + 0xb4]
inc eax
cmp ecx, eax
jne 0x1004b18
mov ecx, ebx
call fcn.01004b9f
test eax, eax
jl 0x1004b79
inc dword [ebx + 0xb0]
mov dword [esi], 1
inc edi
cmp edi, dword [ebx + 0x74]
jb 0x1004acb
mov eax, dword [ebp - 4]
and dword [ebx + 0xac], 0
sub dword [ebp + 0xc], eax
add dword [ebp + 8], eax
mov eax, dword [ebx + 0x74]
inc dword [ebx + 0xd0]
imul eax, dword [ebx + 0x88]
cmp dword [ebp + 0xc], eax
ja 0x1004a75
mov eax, dword [ebp + 0xc]
mov edi, dword [ebx + 0xa8]
add edi, dword [ebx + 0xac]
mov esi, dword [ebp + 8]
mov ecx, eax
push 1
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 0xac], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
push dword [ebx + 0xa4]
lea esi, [ebx + 0xa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebx + 0xa0]
or dword [esi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or eax, 0xffffffff
jmp 0x1004b72
Function at 0x1004b9f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
xor eax, eax
mov ecx, dword [esi + 0x6c]
mov edi, dword [esi + 0xd8]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov cl, byte [ebp - 0xc]
mov eax, dword [esi + 0x7c]
and cl, 0xf2
or cl, 2
inc eax
shl al, 4
and cl, 0xf
or al, cl
mov ecx, dword [esi + 0x9c]
mov byte [ebp - 0xc], al
mov al, byte [esi + 0xb0]
mov byte [ebp - 0xb], al
lea eax, [ebp - 4]
push eax
call fcn.01006629
test eax, eax
jl 0x1004d18
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push 2
push eax
call fcn.0100bf5d
test eax, eax
jge 0x1004c1a
mov ecx, dword [ebp - 4]
call fcn.0100bf36
jmp 0x1004d18
xor ebx, ebx
lea ecx, [ebp - 0x34]
push ebx
call fcn.010056e4
mov eax, dword [esi + 0x6c]
lea ecx, [ebp - 0x34]
sub eax, 3
push eax
push dword [esi + 0x7c]
call fcn.0100570e
cmp eax, ebx
jne 0x1004d08
xor edi, edi
cmp dword [esi + 0x7c], ebx
jle 0x1004c6e
mov eax, edi
mov ecx, dword [esi + 0xd4]
imul eax, dword [esi + 0x6c]
lea eax, [eax + ecx + 3]
lea ecx, [ebp - 0x34]
push eax
push edi
call fcn.01005781
cmp eax, ebx
jne 0x1004d08
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x1004c46
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call fcn.010057ab
cmp eax, ebx
jne 0x1004cff
cmp dword [ebp - 8], ebx
je 0x1004cff
mov eax, dword [esi + 0x6c]
add eax, 0xfffffffd
cmp dword [ebp - 0x10], eax
jne 0x1004cff
mov ecx, dword [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.0100c013
test eax, eax
jl 0x1004cff
mov ecx, dword [ebp - 4]
push ebx
push dword [esi + 0x6c]
push dword [esi + 0xd8]
call fcn.0100c0db
test eax, eax
jl 0x1004cff
lea eax, [ebp - 0x14]
push ebx
push eax
push dword [esi + 0x6c]
push dword [esi + 0xd8]
push dword [esi + 0xa4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1004cff
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x6c]
jne 0x1004cff
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0100bf36
lea ecx, [ebp - 0x34]
call fcn.01005709
push 1
pop eax
jmp 0x1004d1b
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0100bf36
lea ecx, [ebp - 0x34]
call fcn.01005709
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10050aa
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 4], 1
mov eax, dword [esi + 0xa8]
cmp dword [esi + 0xac], ebx
mov dword [ebp - 0xc], eax
je 0x10051a6
mov eax, dword [esi + 0xac]
mov ecx, dword [esi + 0x88]
cmp eax, ecx
mov dword [ebp - 8], ecx
ja 0x10050e9
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
push dword [ebp - 8]
fild qword [ebp - 0x14]
push 0xffffffffffffffff
mov ecx, esi
push dword [ebp - 0xc]
fdiv qword [esi + 0x90]
fild qword [esi + 0xc0]
fmul qword [0x10014b8]
faddp st(1)
fsub qword [0x10014a0]
fstp qword [esi + 0xc8]
call fcn.01004d20
test eax, eax
jl 0x100517b
mov eax, dword [esi + 0x7c]
cmp eax, ebx
je 0x1005159
inc dword [esi + 0xb4]
mov ecx, dword [esi + 0xb4]
lea edi, [esi + 0xb4]
inc eax
cmp ecx, eax
jne 0x1005159
mov ecx, esi
call fcn.01004b9f
test eax, eax
jl 0x10051a2
inc dword [esi + 0xb0]
mov dword [edi], ebx
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], eax
sub dword [esi + 0xac], eax
mov eax, dword [esi + 0xac]
inc dword [esi + 0xd0]
cmp eax, ebx
jne 0x10050d3
jmp 0x10051a6
push dword [esi + 0xa4]
or dword [ebp - 4], 0xffffffff
lea edi, [esi + 0xa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0xa0]
or dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10051a6
or dword [ebp - 4], 0xffffffff
push dword [esi + 0xa4]
lea edi, [esi + 0xa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0xffffffff
cmp dword [ebp - 4], ebx
jge 0x10051cc
push dword [esi + 0xa0]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 0x9c]
lea edi, [esi + 0x9c]
call fcn.01005dcf
push dword [esi + 0xd4]
mov dword [edi], ebx
lea edi, [esi + 0xd4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov dword [edi], ebx
lea edi, [esi + 0xdc]
pop ecx
push dword [edi]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esi, 0xd8
pop ecx
mov dword [edi], ebx
push dword [esi]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 4]
pop ecx
mov dword [esi], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10057ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edx, edx
xor edi, edi
cmp dword [ebp + 8], edx
mov esi, ecx
je 0x10057c2
cmp dword [ebp + 0xc], edx
jne 0x10057c6
push 0x57
jmp 0x10057f3
mov eax, dword [esi + 0x14]
cmp eax, edx
jle 0x10057dd
mov ecx, dword [esi + 0x18]
cmp dword [ecx], 0
je 0x100584f
inc edx
add ecx, 4
cmp edx, eax
jl 0x10057d0
push dword [esi + 0x1c]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
xor edx, edx
cmp edi, edx
pop ecx
mov dword [ebp - 4], edi
jne 0x10057f6
push 8
pop ebx
jmp 0x1005820
cmp dword [esi + 0x1c], edx
jle 0x100581e
mov eax, dword [esi + 0x14]
xor cl, cl
test eax, eax
jle 0x1005815
mov edi, dword [esi + 0x18]
mov ebx, dword [edi]
add edi, 4
xor cl, byte [edx + ebx]
dec eax
jne 0x1005807
mov edi, dword [ebp - 4]
mov byte [edi + edx], cl
inc edx
cmp edx, dword [esi + 0x1c]
jl 0x10057fb
xor ebx, ebx
test ebx, ebx
je 0x1005831
test edi, edi
je 0x1005831
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor edi, edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x100583a
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1005846
mov ecx, dword [esi + 0x1c]
mov dword [eax], ecx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 8
push 0x15
jmp 0x10057f3
Function at 0x1009b20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor edi, edi
push dword [ebx + 0x10]
mov dword [ebx + 8], edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebx + 0x10], edi
push dword [ebx + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov esi, dword [ebp + 8]
mov dword [ebx + 0x18], edi
pop ecx
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 0xc]
mov word [ebx + 0xc], ax
mov ax, word [esi + 0x14]
mov word [ebx + 0x14], ax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov ax, word [ebx + 6]
cmp ax, di
je 0x1009bab
movzx eax, ax
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebx + 8], eax
movzx ecx, word [ebx + 6]
mov esi, dword [esi + 8]
mov edi, eax
shl ecx, 1
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ax, word [ebx + 0xc]
test ax, ax
je 0x1009bdf
movzx eax, ax
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebx + 0x10], eax
movzx ecx, word [ebx + 0xc]
mov esi, dword [esi + 0x10]
mov edi, eax
shl ecx, 1
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ax, word [ebx + 0x14]
test ax, ax
je 0x1009c0c
movzx eax, ax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebx + 0x18], eax
movzx ecx, word [ebx + 0x14]
mov esi, dword [esi + 0x18]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100d4ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x100d514
call edi
test eax, eax
je 0x100d512
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100d514
xor esi, esi
test esi, esi
jne 0x100d5c4
lea eax, [ebp - 8]
and dword [ebp - 8], esi
push esi
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100d553
call edi
test eax, eax
je 0x100d54f
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100d55e
xor esi, esi
jmp 0x100d55e
cmp dword [ebp - 8], 4
jae 0x100d55e
mov esi, 0x800703ee
test esi, esi
jne 0x100d5c4
cmp dword [ebp - 0xc], 0x46464952
jne 0x100d5ac
mov eax, dword [ebx + 0x2d0]
push dword [ebp + 8]
lea edi, [ebx + 0x2d0]
mov ecx, edi
call dword [eax + 0x10]
mov esi, eax
test esi, esi
jge 0x100d58e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
jmp 0x100d5c4
mov dword [ebx + 0x3d4], 1
mov ebx, dword [ebx + 0x8c]
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov al, byte [edi + 8]
mov byte [ebx + 8], al
jmp 0x100d5c4
mov eax, dword [ebx + 0x8c]
mov ecx, dword [ebx + 0x94]
mov dword [eax + 4], ecx
mov cl, byte [ebx + 0x98]
mov byte [eax + 8], cl
cmp dword [ebp - 4], 0xffffffff
je 0x100d5d3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100e7e5
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
shr eax, 0x10
movzx ecx, ax
mov edx, ecx
push edi
shr edx, 5
mov dword [ebp - 8], edx
mov dword [esi + 4], edx
not al
mov edx, ecx
mov edi, ecx
shr ecx, 1
push 4
and eax, 1
and ecx, 3
pop ebx
mov dword [esi + 0x14], eax
sub ebx, ecx
movzx eax, word [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov ebx, eax
mov ecx, eax
shr ebx, 9
and ebx, 1
push 3
mov dword [esi + 0x20], ebx
mov ebx, eax
shr ebx, 8
and ebx, 1
mov dword [esi + 0x24], ebx
mov ebx, eax
shr ebx, 6
and ebx, 3
mov dword [esi + 0x28], ebx
mov ebx, eax
shr ebx, 4
and ebx, 3
mov dword [esi + 0x2c], ebx
mov ebx, eax
shr ebx, 3
and ebx, 1
mov dword [esi + 0x30], ebx
mov ebx, eax
shr ecx, 0xc
shr ebx, 2
mov dword [ebp + 8], ecx
mov dword [esi + 0x18], ecx
and ebx, 1
mov ecx, eax
mov dword [esi + 0x34], ebx
pop ebx
shr edx, 4
shr edi, 3
shr ecx, 0xa
and edx, 1
and edi, 1
and ecx, 3
and eax, ebx
cmp dword [ebp - 8], 0x7ff
mov dword [esi + 8], edx
mov dword [esi + 0xc], edi
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x38], eax
jne 0x100e8da
cmp dword [ebp + 8], 0xf
je 0x100e8da
cmp dword [ebp + 8], 0
je 0x100e8da
cmp ecx, ebx
je 0x100e8da
cmp dword [ebp - 4], ebx
jg 0x100e8da
test edx, edx
jne 0x100e8ca
cmp dword [ebp - 4], ebx
jne 0x100e8da
test edx, edx
jne 0x100e8ca
cmp edi, 1
jne 0x100e8ca
cmp dword [ebp - 4], ebx
je 0x100e8da
mov ecx, esi
mov dword [esi + 0x3c], 1
call fcn.0100e99d
jmp 0x100e8e5
and dword [esi + 0x3c], 0
mov ecx, esi
call fcn.0100e959
mov eax, dword [esi + 0x3c]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100edf4
Capabilities:
Get file size

Disassembly:
push esi
push 0
mov esi, ecx
push 0
push 3
push 0
push 1
lea eax, [esi + 0x1c]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
je 0x100ee27
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x224], eax
pop esi
ret
Function at 0x100fa65
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x100fb11
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push eax
lea eax, [ebp - 0x1c]
push 0xa
push eax
push dword [esi + 0x18]
call edi
cmp eax, ebx
je 0x100fb01
cmp dword [ebp - 4], 0xa
jne 0x100fb01
lea eax, [ebp - 0x1c]
push eax
call fcn.01010b52
cmp eax, ebx
mov dword [ebp - 0x10], eax
jle 0x100fb01
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
je 0x100fb01
lea ecx, [ebp - 4]
push ebx
push ecx
push dword [ebp - 0x10]
push eax
push dword [esi + 0x18]
call edi
cmp eax, ebx
je 0x100faf8
cmp dword [ebp - 4], 0xa
jne 0x100faf8
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0100f95c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, esi
call fcn.01010b51
mov ecx, esi
call fcn.0101070b
jmp 0x100fb46
push 0x18c
push str.h:_nsbld_v4_1_nstoolscontent_nsid3id3_tag_parse.cpp
push 1
lea ecx, [ebp - 0x22c]
call fcn.0100f38c
push 0x42
mov esi, eax
pop ecx
lea edi, [ebp - 0x124]
lea eax, [ebp - 0x124]
push 0x10152a8
rep movsd dword es:[edi], dword [esi]
push eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1011fa2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0x24]
mov dword [ebp + 8], eax
jmp 0x1011fb7
mov eax, dword [ebp + 8]
mov esi, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x34]
mov edx, dword [ebx + 0x64]
sub ecx, esi
sub ecx, edx
mov dword [ebp - 4], ecx
jne 0x1011fd5
test edx, edx
jne 0x1011fd5
test esi, esi
jne 0x1011fd5
mov ecx, eax
jmp 0x1012050
cmp ecx, 0xffffffff
jne 0x1011fdf
push 0xfffffffffffffffe
pop ecx
jmp 0x1012050
mov esi, dword [ebx + 0x24]
lea esi, [eax + esi - 0x106]
cmp edx, esi
jb 0x1012050
mov edi, dword [ebx + 0x30]
mov ecx, eax
mov edx, ecx
lea esi, [eax + edi]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x3c]
sub dword [ebx + 0x68], eax
sub dword [ebx + 0x64], eax
sub dword [ebx + 0x54], eax
lea ecx, [ecx + edx*2]
dec ecx
dec ecx
movzx esi, word [ecx]
mov edi, esi
sub edi, eax
cmp esi, eax
sbb esi, esi
not esi
and esi, edi
dec edx
mov word [ecx], si
jne 0x1012015
mov ecx, dword [ebx + 0x38]
mov esi, eax
lea ecx, [ecx + eax*2]
dec ecx
dec ecx
movzx edx, word [ecx]
mov edi, edx
sub edi, eax
cmp edx, eax
sbb edx, edx
not edx
and edx, edi
dec esi
mov word [ecx], dx
jne 0x1012034
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x10120a8
push ecx
mov ecx, dword [ebx + 0x30]
add ecx, dword [ebx + 0x64]
add ecx, dword [ebx + 0x6c]
push ecx
push eax
call fcn.010120af
add dword [ebx + 0x6c], eax
mov esi, dword [ebx + 0x6c]
cmp esi, 3
jb 0x1012094
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
lea edx, [eax + ecx]
mov ecx, dword [ebx + 0x50]
movzx eax, byte [edx]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp esi, 0x106
jae 0x10120a8
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x1011fb4
pop edi
pop esi
pop ebx
leave
ret 4