joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100098d5
Capabilities:
Query service status
Start service

Disassembly:
push 0x68
mov eax, 0x10229975
call fcn.101e5a91
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x6c], esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x70], 0x14
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
xor eax, eax
and dword [ebp - 0x18], 0
push str.2345SafeSvc
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10005e61
xor eax, eax
or esi, 1
push 1
push eax
mov dword [ebp - 4], eax
push eax
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x74], esi
test esi, esi
je 0x10009982
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 4
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x68], eax
test eax, eax
je 0x10009982
lea ecx, [ebp - 0x5c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push dword [ebp - 0x68]
test eax, eax
je 0x1000997d
mov esi, dword [ebp - 0x58]
call edi
push dword [ebp - 0x74]
call edi
cmp esi, 4
je 0x10009982
mov byte [ebp - 0x61], 1
jmp 0x10009986
call edi
push esi
call edi
mov byte [ebp - 0x61], 0
or esi, 0xffffffff
mov dword [ebp - 4], esi
and dword [ebp - 0x6c], 0xfffffffe
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.10005e33
cmp byte [ebp - 0x61], 0
mov dword [ebp - 4], esi
je 0x10009a4b
xor eax, eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push str.2345SafeSvc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10005e61
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 5
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x10009a1d
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push 0xf01ff
cmovae ecx, dword [ebp - 0x40]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x68], eax
test eax, eax
je 0x10009a1a
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push dword [ebp - 0x68]
call edi
push esi
call edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 6
call fcn.10005e33
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x10009a8e
dec eax
push 0x64
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x6c]
jmp 0x100098f6
cmp dword [ebx + 0x14], 8
jb 0x10009a53
mov ebx, dword [ebx]
push ecx
push 0
push ebx
lea ecx, [ebp - 0x60]
call fcn.100794c0
mov dword [ebp - 4], 0xa
cmp byte [ebp - 0x5c], 0
je 0x10009a83
cmp dword [ebp - 0x60], 0
je 0x10009a7b
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x60]
call fcn.10079780
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], esi
call fcn.10079710
call fcn.101e5a4c
ret 4
Function at 0x10009b6f
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x102299a7
call fcn.101e5a5d
mov edi, ecx
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x14]
cmp eax, 0x131
jne 0x10009bb9
cmp dword [edi + 0xbc], 5
jae 0x10009b9a
call fcn.1000e082
jmp 0x10009c05
mov esi, 0x132
xor edx, edx
mov ecx, esi
call fcn.1000e0e0
push esi
mov ecx, edi
call fcn.1000a08b
mov ecx, edi
call fcn.1000a46e
jmp 0x10009c05
cmp eax, 0x132
jne 0x10009cbb
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x166
call fcn.1000e1a2
push 0x41001
push 0x1027467c
push 0x10274688
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
cmp eax, 2
jne 0x10009c0b
call fcn.1000e22a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.101e5a37
ret
inc ecx
call fcn.1000e22a
cmp dword [edi + 0xbc], 5
jb 0x10009b93
lea ebx, [edi + 0x90]
cmp dword [ebx], 0
jne 0x10009c05
lea eax, [edi + 0xb8]
push eax
push 0x164
lea ecx, [edi + 0x24]
mov byte [eax], 0
call fcn.100b65d0
push 0x133
mov ecx, edi
call fcn.1000a08b
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push 0x7e8
push dword [edi + 4]
mov dword [edi + 0xd0], eax
mov dword [edi + 0x98], eax
mov dword [edi + 0x9c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xc
call fcn.101e4da1
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
push edi
push 0x10009f63
call fcn.10077050
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push eax
call fcn.1000820d
mov ecx, dword [ebx]
call fcn.100772a0
push 0x64
push 0x66
lea ecx, [edi + 0x24]
call fcn.100c1010
jmp 0x10009c05
cmp eax, 0x133
jne 0x10009bfc
lea ecx, [eax + 0x68]
call fcn.1000e28d
mov ecx, edi
call fcn.1000a0c3
push 0x134
mov ecx, edi
call fcn.1000a08b
jmp 0x10009c05
Function at 0x1000bb62
Capabilities:
Read file on windows

Disassembly:
call fcn.1000d072
mov ecx, eax
jmp 0x1000c051
push 0x44c
mov eax, 0x10229dcc
call fcn.101e5a91
mov esi, ecx
lea ecx, [ebp - 0x450]
call fcn.1001bc70
push 7
pop edi
xor ebx, ebx
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], ebx
xor eax, eax
push str.2345PCSafe
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], edi
mov word [ebp - 0x438], ax
call fcn.10005e61
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x450]
call fcn.1001bcc0
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], bl
call fcn.10005e33
test esi, esi
jne 0x1000c0d2
lea ecx, [ebp - 0x450]
call fcn.10020280
jmp 0x1000c1d6
cmp esi, 1
jne 0x1000c0e7
lea ecx, [ebp - 0x450]
call fcn.10020460
jmp 0x1000c1d6
cmp esi, 2
jne 0x1000c1d6
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.101fd690
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x207
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
lea ecx, [ebp - 0x438]
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], edi
push eax
call fcn.10005e61
push 0x10274984
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 2
call fcn.1000b009
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push ebx
cmovae eax, dword [ebp - 0x438]
push 0x80
push 3
push ebx
push 1
push accept
push eax
mov dword [ebp - 0x454], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c1ba
push ebx
lea eax, [ebp - 0x458]
mov dword [ebp - 0x458], ebx
push eax
push 4
lea eax, [ebp - 0x454]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
push esi
sbb eax, eax
and dword [ebp - 0x454], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x454]
lea ecx, [ebp - 0x450]
call fcn.100205f0
lea ecx, [ebp - 0x438]
call fcn.10005e33
lea ecx, [ebp - 0x450]
call fcn.10018090
call fcn.101e5a4c
ret
Function at 0x1000cbc0
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x10229f17
call fcn.101e5a5d
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 4]
test eax, eax
je 0x1000cbf7
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000cbf7
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1000cbf3
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi + 4], 0
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
push eax
sub esp, 0xc
movups xmmword [ebp - 0x28], xmm0
call fcn.1000cc7b
push 0x80
call fcn.101e4da1
mov ebx, eax
mov dword [ebp - 0x18], ebx
and dword [ebp - 4], 0
mov ecx, ebx
mov dword [esp], 0x191
call fcn.100b3b30
mov byte [ebp - 4], 1
sub esp, 0x10
or dword [ebp - 4], 0xffffffff
mov edi, esp
mov dword [ebx + 0x7c], esi
mov dword [ebx], vtable.RC::RCDownloadDlg.1.0
mov dword [ebx + 0x24], vtable.RC::RCDownloadDlg.0
mov dword [esi + 4], ebx
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
push 0x80
push accept
push ecx
movsd dword es:[edi], dword [esi]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100b3e80
mov eax, dword [ebp - 0x14]
push 4
mov eax, dword [eax + 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.101e5a37
ret
Function at 0x1000e733
Capabilities:
Check os version

Disassembly:
push 0x184
mov eax, 0x1022a444
call fcn.101e5a91
mov esi, ecx
and dword [ebp - 0x190], 0
lea eax, [ebp - 0x184]
push 0x110
push 0
push eax
call fcn.101fd690
add esp, 0xc
mov dword [ebp - 0x188], 0x114
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
push 7
inc ebx
pop edi
test eax, eax
je 0x1000e82d
cmp dword [ebp - 0x184], 6
jb 0x1000e82d
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x2c], edi
push str.Progid
mov word [ebp - 0x40], ax
call fcn.10005e61
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x18], 0
xor eax, eax
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
call fcn.10005e61
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push esi
push eax
lea edx, [ebp - 0x28]
mov dword [ebp - 0x190], 3
mov ecx, reloc.WS2_32.dll_accept
call fcn.1000e5e6
pop ecx
pop ecx
test al, al
je 0x1000e802
cmp dword [esi + 0x10], 0
mov byte [ebp - 0x189], bl
jne 0x1000e809
mov byte [ebp - 0x189], 0
lea ecx, [ebp - 0x28]
call fcn.10005e33
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005e33
cmp byte [ebp - 0x189], 0
je 0x1000e82d
mov al, bl
jmp 0x1000e95a
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], edi
push 0x10272ce0
mov word [ebp - 0x28], ax
call fcn.10005e61
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x40]
and dword [ebp - 0x30], 0
xor eax, eax
push str.http_shellopencommand
mov dword [ebp - 0x190], 4
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x40], ax
call fcn.10005e61
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push esi
push eax
lea edx, [ebp - 0x40]
mov dword [ebp - 0x190], 0xc
mov ecx, accept
call fcn.1000e5e6
pop ecx
pop ecx
test al, al
je 0x1000e8a7
cmp dword [esi + 0x10], 0
mov byte [ebp - 0x189], bl
jne 0x1000e8ae
mov byte [ebp - 0x189], 0
lea ecx, [ebp - 0x40]
call fcn.10005e33
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e33
cmp byte [ebp - 0x189], 0
jne 0x1000e826
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0x70]
xor eax, eax
mov dword [ebp - 0x5c], edi
push 0x10272ce0
mov word [ebp - 0x70], ax
call fcn.10005e61
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x58]
and dword [ebp - 0x48], 0
xor eax, eax
push str.SoftwareClasses.html
mov dword [ebp - 0x190], 0x10
mov dword [ebp - 0x44], edi
mov word [ebp - 0x58], ax
call fcn.10005e61
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 5
push esi
push eax
lea edx, [ebp - 0x58]
mov dword [ebp - 0x190], 0x30
mov ecx, reloc.WS2_32.dll_accept
call fcn.1000e5e6
pop ecx
pop ecx
test al, al
je 0x1000e943
cmp dword [esi + 0x10], 0
jne 0x1000e945
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.10005e33
lea ecx, [ebp - 0x70]
call fcn.10005e33
test bl, bl
setne al
call fcn.101e5a4c
ret
Function at 0x1000fb2f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, 0x100
mov dword [ebp - 0x20c], eax
push edi
xor ebx, ebx
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x104]
mov esi, edx
push ebx
push eax
call fcn.101fd690
push edi
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.101fd690
mov eax, ebx
add esp, 0x18
mov cl, al
mov byte [ebp + eax - 0x104], cl
inc cl
inc eax
cmp eax, edi
jb 0x1000fb80
mov ecx, ebx
mov ebx, dword [ebp - 0x210]
xor edx, edx
mov eax, ecx
div esi
mov al, byte [edx + ebx]
mov byte [ebp + ecx - 0x204], al
inc ecx
cmp ecx, edi
jb 0x1000fb96
xor ebx, ebx
mov ah, bl
mov dh, bl
movzx esi, dh
mov dl, byte [ebp + esi - 0x104]
mov al, byte [ebp + esi - 0x204]
add al, dl
add ah, al
inc dh
movzx ecx, ah
mov al, byte [ebp + ecx - 0x104]
mov byte [ebp + esi - 0x104], al
mov byte [ebp + ecx - 0x104], dl
sub edi, 1
jne 0x1000fbb1
mov dh, bl
cmp dword [ebp + 0xc], ebx
jbe 0x1000fc46
mov edi, dword [ebp + 8]
sub edi, dword [ebp - 0x20c]
inc dh
movzx esi, dh
mov dl, byte [ebp + esi - 0x104]
add bl, dl
movzx ecx, bl
mov al, byte [ebp + ecx - 0x104]
mov byte [ebp + esi - 0x104], al
mov byte [ebp + ecx - 0x104], dl
mov al, byte [ebp + esi - 0x104]
mov ecx, dword [ebp - 0x20c]
add al, dl
movzx eax, al
mov al, byte [ebp + eax - 0x104]
xor al, byte [edi + ecx]
mov byte [ecx], al
inc ecx
sub dword [ebp + 0xc], 1
mov dword [ebp - 0x20c], ecx
jne 0x1000fbf5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101e48f0
leave
ret
Function at 0x1000fe36
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push 0x105
push ecx
mov ebx, 0x102d0a60
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
call ebx
mov edi, eax
push edi
call ebx
mov esi, eax
mov ax, word [0x102d0a60]
push 0x5c
pop ecx
test ax, ax
je 0x1000fe7c
cmp word [edi], 0x3a
jne 0x1000fe7c
cmp word [edi + 2], cx
jne 0x1000fe7c
push esi
call ebx
mov esi, eax
jmp 0x1000feb2
cmp ax, cx
jne 0x1000feb0
cmp word [0x102d0a62], cx
jne 0x1000feb0
push 2
pop edi
xor ebx, ebx
mov edx, ecx
dec edi
mov ecx, esi
call fcn.1000fced
mov esi, eax
cmp word [esi], bx
je 0x1000ff89
add esi, 2
push 0x5c
pop ecx
test edi, edi
jne 0x1000fe8f
jmp 0x1000feb2
xor esi, esi
test esi, esi
je 0x1000ff89
mov ecx, esi
call fcn.1000fd19
movzx eax, word [esi]
test ax, ax
je 0x1000ff89
push 0x5c
pop ecx
cmp ax, cx
je 0x1000ff89
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, 0x102d0a60
sub esi, eax
push eax
sar esi, 1
call edi
mov ebx, dword [sym.imp.USER32.dll_CharPrevW]
jmp 0x1000ff4e
push 0x102d0810
push 0x102d0a60
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x1000ff18
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [0x102d0810], 0x10
je 0x1000ff89
push 0x102d0a60
call edi
push 0x5c
mov edx, 0x102d0a60
pop edi
lea eax, [eax*2 + 0x102d0a60]
cmp word [eax], di
je 0x1000ff40
push eax
push edx
call ebx
mov edx, 0x102d0a60
cmp eax, edx
ja 0x1000ff2e
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
push edx
mov word [eax], cx
call edi
cmp eax, esi
jg 0x1000fef3
mov esi, 0x102d0a60
push esi
call edi
lea eax, [eax*2 + 0x102d0a60]
push eax
push esi
call ebx
push 0x5c
pop ecx
cmp word [eax], cx
je 0x1000ff79
push 0x10274d50
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000ff89
mov al, 1
jmp 0x1000ff8b
xor al, al
pop edi
pop esi
pop ebx
ret
Function at 0x10013db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022ae60
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
test eax, eax
je 0x10013eb8
cmp byte [eax + 0x54], 0
je 0x10013eb8
add eax, 0x1c
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call fcn.10012910
mov dword [ebp - 4], 0
mov ecx, dword [esi + 4]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
call fcn.10007f54
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10013e8c
push 0
mov edx, edi
lea ecx, [ebp - 0x38]
call fcn.10089ab0
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x38]
call fcn.10005e30
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10013e6a
mov eax, dword [eax]
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.10008004
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x10013eb1
cmp byte [ebp - 0x18], 0
je 0x10013eb1
mov eax, dword [esi]
test eax, eax
je 0x10013ead
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 4
Function at 0x100257e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022d549
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.10006040
mov ecx, ebx
call fcn.10005e30
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
call fcn.1000610e
add esp, 8
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x100259b5
dec eax
mov dword [ebp + 8], eax
mov al, byte [edi]
inc edi
mov byte [ebp + esi - 0x14], al
inc esi
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x100258f7
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
mov byte [ebp - 0x16], cl
and al, 0x3f
mov ecx, 0x102cfc68
mov byte [ebp - 0x15], al
call fcn.10005e30
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x100258d2
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.10025c70
inc edi
cmp edi, 4
jl 0x100258c8
mov edi, dword [ebp - 0x20]
xor esi, esi
mov dl, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10025863
mov dword [ebp + 8], esi
test esi, esi
je 0x100259b5
mov eax, esi
cmp esi, 3
jge 0x10025931
cmp eax, 3
jae 0x100259c9
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x10025917
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x1002599b
mov ecx, 0x102cfc68
call fcn.10005e30
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x10025981
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.10025c70
inc edi
cmp edi, dword [ebp - 0x20]
jl 0x10025977
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x100259b5
mov edi, 3
sub edi, esi
push 0x3d
mov ecx, ebx
call fcn.10025c70
sub edi, 1
jne 0x100259a7
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.101e524c
int3
Function at 0x10025ed0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022d647
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x18
mov byte [edi], 0
call fcn.101e4da1
add esp, 4
mov dword [edi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
lea esi, [edi + 8]
push 0
mov dword [ebp - 0x18], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10029180
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x18], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10029180
mov dword [esi], eax
mov byte [ebp - 4], 6
lea ecx, [edi + 0x20]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.10007fd4
mov byte [ebp - 4], 7
lea ecx, [edi + 0x38]
call fcn.10017530
mov byte [ebp - 4], 8
lea esi, [edi + 0xb8]
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.10007fd4
mov byte [ebp - 4], 9
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x30], 0
mov byte [ebp - 4], 0xa
lea ecx, [edi + 0xf0]
call fcn.10007fd4
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x108]
call fcn.10006040
lea ecx, [edi + 0x108]
call fcn.10005e30
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
call fcn.1000610e
add esp, 8
mov byte [ebp - 4], 0xc
lea ecx, [edi + 0x120]
call fcn.10006040
lea ecx, [edi + 0x120]
call fcn.10005e30
mov dword [eax + 0x10], 0
lea ecx, [ebp - 0xd]
mov dword [eax + 0x14], 0xf
push ecx
push eax
mov byte [ebp - 0xd], 0
call fcn.1000610e
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002cf00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022e3f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.1020b1ac
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x1002cfda
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.10028b50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.10007f3e
test al, al
jne 0x1002cfcb
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.10007f54
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002cfcb
test esi, esi
je 0x1002cfcb
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10005e05
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 4