joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002f00
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov dword [esp + 0xc], 0
mov dword [eax], 0
je 0x10002fae
mov eax, dword [edi]
mov edx, dword [eax + 0xf4]
mov ecx, dword [esi + 0xf4]
cmp ecx, edx
mov ebx, dword [eax + 0xf0]
jb 0x10002fae
ja 0x10002f44
cmp dword [esi + 0xf0], ebx
jb 0x10002fae
cmp dword [esi + 0xf0], ebx
jne 0x10002f9f
cmp ecx, edx
jne 0x10002f9f
mov ecx, dword [esi + 0xfc]
mov edx, dword [eax + 0xfc]
cmp ecx, edx
mov ebx, dword [esi + 0xf8]
mov ebp, dword [eax + 0xf8]
jb 0x10002fae
ja 0x10002f72
cmp ebx, ebp
jb 0x10002fae
cmp ebx, ebp
jne 0x10002f9f
cmp ecx, edx
jne 0x10002f9f
cmp dword [esp + 0x18], 0
je 0x10002fb9
mov ecx, dword [esi + 0x10c]
cmp ecx, dword [eax + 0x10c]
jb 0x10002fae
ja 0x10002f9f
mov edx, dword [esi + 0x108]
cmp edx, dword [eax + 0x108]
jb 0x10002fae
mov dword [esp + 0xc], edi
mov edi, dword [edi + 8]
test edi, edi
jne 0x10002f22
cmp dword [esp + 0x18], 0
jne 0x10003079
test edi, edi
je 0x10003079
mov eax, dword [edi]
mov ecx, dword [eax + 0xf0]
cmp ecx, dword [esi + 0xf0]
jne 0x10003079
mov edx, dword [eax + 0xf4]
cmp edx, dword [esi + 0xf4]
jne 0x10003079
mov ecx, dword [eax + 0xf8]
cmp ecx, dword [esi + 0xf8]
jne 0x10003079
mov edx, dword [eax + 0xfc]
cmp edx, dword [esi + 0xfc]
jne 0x10003079
mov ecx, dword [eax + 0x13c]
cmp ecx, dword [esi + 0x13c]
jne 0x10003079
mov edx, dword [eax + 0x140]
cmp edx, dword [esi + 0x140]
jne 0x10003079
mov ecx, dword [eax + 0x144]
cmp ecx, dword [esi + 0x144]
jne 0x10003079
mov edx, dword [eax + 0x148]
cmp edx, dword [esi + 0x148]
jne 0x10003079
mov ecx, dword [esi + 0x14c]
cmp dword [eax + 0x14c], ecx
je 0x10003051
test ecx, ecx
jne 0x10003079
cmp dword [eax + 0x150], 0
jne 0x10003066
mov ecx, dword [esi + 0x150]
mov dword [eax + 0x150], ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
pop edi
pop ebp
mov dword [edx], 1
pop ebx
pop ecx
ret
push 0x10
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
jne 0x10003090
push 1
call dword [sym.imp.MSVCR80.dll_exit]
test edi, edi
mov ecx, dword [esp + 0xc]
mov dword [eax], esi
mov dword [eax + 0xc], 0
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
je 0x100030aa
mov dword [edi + 4], eax
test ecx, ecx
je 0x100030b5
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100032e0
Capabilities:
Terminate process

Disassembly:
push esi
push 0x160
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x100032fd
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x160
push 0
push esi
call sub.ntdll.dll_memset
mov eax, dword [esp + 0x14]
push eax
mov eax, esi
call fcn.10003220
add esp, 0x10
pop esi
ret
Function at 0x10003440
Capabilities:
Terminate process

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esi + 0x104]
push edi
xor ebp, ebp
push 0x1a0
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x20
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x28], 0x80
mov dword [esp + 0x2c], 0xf0
mov dword [esp + 0x30], 0xff
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x100034ad
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x1a0
push ebp
push ebx
call sub.ntdll.dll_memset
mov edx, dword [esp + 0x44]
mov ecx, 0x68
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x48]
add esp, 0xc
push ecx
push edx
mov ecx, ebx
call fcn.10003320
add esp, 8
mov edi, eax
mov esi, 8
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
mov ecx, ebx
mov dword [ebx + 0x104], esi
call fcn.10003320
add esp, 8
cmp eax, edi
jb 0x10003504
mov edi, eax
mov dword [esp + 0x10], esi
mov esi, dword [esp + ebp*4 + 0x18]
add ebp, 1
test esi, esi
jne 0x100034e0
push ebx
call dword [sym.imp.MSVCR80.dll_free]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x10003c30
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebx, eax
cmp dword [ebx + 0x134], 0x10003e40
push esi
push edi
je 0x10003ced
mov esi, dword [sym.imp.MSVCR80.dll_malloc]
push 8
call esi
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
jne 0x10003c64
push 1
call dword [sym.imp.MSVCR80.dll_exit]
xor ecx, ecx
mov dword [eax], ecx
push 0x1a0
mov dword [eax + 4], ecx
call esi
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x10003c83
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x1a0
push 0
push ebp
call sub.ntdll.dll_memset
mov eax, dword [esp + 0x1c]
mov ecx, 0x68
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov dword [eax], ebp
add esp, 0xc
xor edi, edi
mov dword [eax + 4], edi
mov dword [ebx + 0x188], edi
mov dword [ebx + 0x148], eax
mov eax, dword [ebp + 0x128]
mov dword [ebx + 0x128], eax
mov ecx, dword [ebp + 0x138]
mov dword [ebx + 0x138], ecx
mov dword [ebx + 0x130], 0x10003f90
mov dword [ebx + 0x134], fcn.10003e40
mov dword [ebx + 0x140], 0x10003fd0
jmp 0x10003cef
xor edi, edi
mov ebx, dword [ebx + 0x148]
mov esi, dword [ebx + 4]
xor ebp, ebp
cmp esi, edi
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x1c]
je 0x10003d25
mov ecx, dword [esi + 0x10]
xor eax, eax
add ecx, dword [esi]
adc eax, dword [esi + 4]
cmp ebx, eax
ja 0x10003d3c
jb 0x10003d1c
cmp dword [esp + 0x18], ecx
jae 0x10003d3c
mov ebp, esi
mov esi, dword [esi + 0x1c]
cmp esi, edi
jne 0x10003d06
push 0x20
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
cmp eax, edi
jne 0x10003d56
push 1
call dword [sym.imp.MSVCR80.dll_exit]
cmp ebx, dword [esi + 4]
jb 0x10003d25
ja 0x10003d4b
mov edx, dword [esp + 0x18]
cmp edx, dword [esi]
jb 0x10003d25
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x20]
xor ecx, ecx
cmp ebp, edi
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 0x10], 0x200
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x14], edx
mov dword [eax + 0x1c], esi
je 0x10003d8a
pop edi
pop esi
mov dword [ebp + 0x1c], eax
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x10004020
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x200
mov edi, eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10004040
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x200
push 0
push esi
call sub.ntdll.dll_memset
mov eax, dword [edi + 0xf0]
mov ecx, dword [edi + 0xf4]
mov edx, dword [ebx + 0x134]
add eax, 0x8000
adc ecx, 0
push ecx
push eax
push 0x200
push esi
push ebx
call edx
add esp, 0x20
cmp eax, 0x200
je 0x1000408e
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
ret
push edi
mov ecx, esi
call fcn.10004110
add esp, 4
test eax, eax
jne 0x1000407c
mov eax, esi
call fcn.100040c0
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
xor eax, eax
pop esi
ret
Function at 0x100041c0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x200
mov edi, eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x100041e0
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x200
push 0
push esi
call sub.ntdll.dll_memset
mov eax, dword [edi + 0xf4]
mov ecx, dword [edi + 0xf0]
mov edx, dword [ebx + 0x134]
push eax
push ecx
push 0x200
push esi
push ebx
call edx
add esp, 0x20
cmp eax, 0x200
je 0x10004226
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
ret
mov ecx, esi
call fcn.10004260
test eax, eax
jne 0x10004214
movzx eax, word [esi + 6]
xor ecx, ecx
mov ch, al
shr eax, 8
add edi, 0xa0
or ecx, eax
push ecx
push str.LUKS__u__Data_size_unknown_
push edi
call dword [sym.imp.ntdll.dll_sprintf]
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 0x10
pop edi
xor eax, eax
pop esi
ret
Function at 0x10005300
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 0x200
mov esi, eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005321
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x200
push 0
push edi
call sub.ntdll.dll_memset
mov eax, dword [esi + 0xf4]
mov ecx, dword [esi + 0xf0]
mov edx, dword [ebx + 0x134]
add esp, 0xc
push eax
push ecx
push 0x200
push edi
push ebx
call edx
add esp, 0x14
cmp eax, 0x200
je 0x1000536b
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ecx
ret
push esi
mov eax, edi
call fcn.100054f0
add esp, 4
test eax, eax
push edi
jne 0x10005359
push ebx
call fcn.100054a0
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x100058c0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
movzx ecx, byte [esi + 0xc]
movzx eax, byte [esi + 0xd]
movzx edx, byte [esi + 0xb]
shl ecx, 8
push edi
mov dword [esp + 0x10], eax
lea ebx, [ecx + edx]
mov ecx, dword [esi + 0x30]
cdq
push edx
push eax
mov eax, dword [esi + 0x34]
push eax
push ecx
call sub.ntdll.dll__allmul
mov ecx, eax
movzx eax, word [esi + 0xe]
mov edi, edx
cdq
push 0
add ecx, eax
push ebx
adc edi, edx
push edi
push ecx
call sub.ntdll.dll__allmul
mov ebp, eax
mov eax, dword [esp + 0x1c]
add ebp, dword [eax + 0xf0]
mov edi, edx
adc edi, dword [eax + 0xf4]
mov eax, dword [esp + 0x18]
cmp edi, dword [eax + 0x154]
jb 0x1000592e
ja 0x100059a5
cmp ebp, dword [eax + 0x150]
ja 0x100059a5
mov cl, byte [esi + 0x40]
test cl, cl
jle 0x1000593f
movsx eax, cl
imul eax, dword [esp + 0x10]
jmp 0x10005948
neg ecx
mov eax, 1
shl eax, cl
imul ebx, eax
add ebx, ebx
add ebx, ebx
mov esi, ebx
je 0x100059a5
test esi, esi
ja 0x1000595f
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10005977
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
push 0
push ebx
call sub.ntdll.dll_memset
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x134]
add esp, 0xc
push edi
push ebp
push esi
push ebx
push eax
call edx
add esp, 0x14
cmp eax, esi
je 0x100059b0
push ebx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
add esi, ebx
lea eax, [ebx + 0x30]
cmp eax, esi
mov edi, ebx
ja 0x100059e5
jmp 0x100059c0
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call fcn.100056f0
mov ebp, eax
add esp, 8
test ebp, ebp
jg 0x100059f7
mov eax, dword [edi + 0x1c]
cmp eax, 0x30
jb 0x100059f7
add edi, eax
lea edx, [edi + 0x30]
cmp edx, esi
jbe 0x100059c0
push ebx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x10007650
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x198]
test esi, esi
ja 0x1000766a
push 1
call dword [sym.imp.MSVCR80.dll_exit]
mov ebp, dword [sym.imp.MSVCR80.dll_malloc]
push esi
call ebp
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10007684
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
push 0
push ebx
call sub.ntdll.dll_memset
mov esi, dword [edi + 0x198]
add esp, 0xc
test esi, esi
ja 0x100076a2
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
call ebp
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x100076b6
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
push 0
push ebp
call sub.ntdll.dll_memset
mov eax, dword [edi + 0x134]
add esp, 0xc
push 0
push 0
push 0x200
push ebp
push edi
call eax
add esp, 0x14
cmp eax, 0x200
je 0x100076ef
push 0x200
push 0
push ebp
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push 0
push ebx
call sub.ntdll.dll_memset
mov al, 0x55
add esp, 0xc
cmp byte [ebp + 0x1fe], al
jne 0x1000772e
mov dl, 0xaa
cmp byte [ebp + 0x1ff], dl
jne 0x1000772e
mov ecx, 0x6f
mov esi, ebp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebx + 0x1fe], al
mov byte [ebx + 0x1ff], dl
jmp 0x10007737
push ebx
call fcn.10007ed0
add esp, 4
cmp byte [ebx], 0x45
jne 0x10007745
cmp byte [ebx + 1], 0x52
jne 0x10007745
mov byte [ebx], 0
cmp byte [ebx + 0x1fc], 0xda
jne 0x1000775e
cmp byte [ebx + 0x1fd], 0xbe
jne 0x1000775e
mov byte [ebx + 0x1fc], 0
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100077af
mov esi, dword [edi]
mov eax, dword [esi + 0x150]
test eax, eax
jle 0x100077a8
cmp eax, 2
jle 0x1000777c
cmp eax, 4
jne 0x100077a8
mov eax, dword [esi + 0x154]
cmp eax, 1
jb 0x100077a8
cmp eax, 4
ja 0x100077a8
mov edx, dword [esp + 0x14]
shl eax, 4
lea ecx, [eax + ebx + 0x1ae]
push ecx
push 0
push 0
push edx
call fcn.10008b10
add esp, 0x10
mov edi, dword [edi + 8]
test edi, edi
jne 0x10007766
cmp dword [esp + 0x1c], 0
jne 0x100077f3
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x200
push ebx
push eax
mov eax, dword [eax + 0x138]
call eax
add esp, 0x14
cmp eax, 0x200
je 0x100077f3
mov esi, dword [sym.imp.MSVCR80.dll_free]
push ebp
call esi
add esp, 4
push ebx
call esi
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [sym.imp.MSVCR80.dll_free]
push ebp
call esi
add esp, 4
push ebx
call esi
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x1000a730
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov edx, dword [esi + 0xfc]
mov eax, dword [esi + 0xf8]
xor ebp, ebp
cmp edx, ebp
push edi
ja 0x1000a752
cmp eax, 1
jbe 0x1000a845
mov ecx, dword [esi + 0xf0]
add ecx, eax
mov eax, dword [esi + 0xf4]
adc eax, edx
add ecx, 0xffffffff
adc eax, 0xffffffff
cmp eax, dword [esp + 0x1c]
ja 0x1000a7df
jb 0x1000a776
cmp ecx, dword [esp + 0x18]
ja 0x1000a7df
push 0x160
mov dword [esp + 0x14], ebp
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x1000a796
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x160
push ebp
push ebx
call sub.ntdll.dll_memset
push ebp
mov eax, ebx
call fcn.10003220
mov ecx, 0x58
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x30]
mov ecx, dword [edi]
lea eax, [esp + 0x20]
push eax
push ebp
push ecx
mov esi, ebx
call fcn.10002f00
add esp, 0x1c
cmp dword [esp + 0x10], ebp
mov dword [edi], eax
jg 0x1000a83b
mov ebp, 1
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x160
mov dword [esp + 0x14], ebp
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x1000a7ff
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x160
push ebp
push ebx
call sub.ntdll.dll_memset
push ebp
mov eax, ebx
call fcn.10003220
mov ecx, 0x58
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
lea edx, [esp + 0x20]
push edx
push ebp
push eax
mov esi, ebx
call fcn.10002f00
add esp, 0x1c
cmp dword [esp + 0x10], ebp
mov dword [edi], eax
jle 0x1000a845
push ebx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000bb30
Capabilities:
Terminate process

Disassembly:
push ebx
push 0x1000
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1000bb4d
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x1000
push 0
push ebx
call sub.ntdll.dll_memset
mov eax, dword [esi + 0xf4]
mov ecx, dword [esi + 0xf0]
mov edx, dword [edi + 0x134]
push eax
push ecx
push 0x1000
push ebx
push edi
call edx
add esp, 0x20
cmp eax, 0x1000
je 0x1000bb92
push ebx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, 1
pop ebx
ret
push esi
call fcn.1000bc20
add esp, 4
test eax, eax
jne 0x1000bb81
mov eax, esi
mov edx, ebx
call fcn.1000bbc0
push ebx
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
xor eax, eax
pop ebx
ret
Function at 0x1000c3d0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
mov eax, dword [esi + 0x174]
push ebx
push ebp
mov ebp, dword [esi + 0x170]
add ebp, dword [esp + 0x1c]
push edi
adc eax, dword [esp + 0x24]
mov edi, dword [esi + 0x198]
xor ebx, ebx
push ebx
push edi
push eax
push ebp
mov dword [esp + 0x20], eax
call sub.ntdll.dll__aullrem
xor ecx, ecx
add eax, dword [esp + 0x1c]
push ebx
adc edx, ecx
add eax, edi
adc edx, ebx
add eax, 0xffffffff
push edi
adc edx, 0xffffffff
push edx
push eax
call sub.ntdll.dll__aulldiv
mov ebx, eax
mov eax, dword [esp + 0x1c]
imul ebx, edi
cmp eax, ebx
jne 0x1000c466
test dword [esi + 0x190], 0x4000
mov ecx, dword [esp + 0x18]
je 0x1000c44e
add edi, 0xffffffff
test ecx, edi
je 0x1000c44e
cmp ecx, dword [esi + 0x178]
jne 0x1000c466
cmp dword [esi + 0x180], ebx
jb 0x1000c466
mov edx, dword [esp + 0x10]
push edx
push ebp
push eax
push ecx
push esi
call fcn.1000cfa0
add esp, 0x14
pop edi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esi + 0x178], 0
jne 0x1000c479
mov dword [esi + 0x180], 0x10000
cmp dword [esi + 0x180], ebx
jae 0x1000c4af
mov edi, dword [sym.imp.MSVCR80.dll_free]
mov eax, dword [esi + 0x178]
push eax
call edi
mov ecx, dword [esi + 0x180]
add ecx, ecx
add esp, 4
cmp ecx, ebx
mov dword [esi + 0x178], 0
mov dword [esi + 0x180], ecx
jb 0x1000c487
cmp dword [esi + 0x178], 0
jne 0x1000c4fc
mov eax, dword [esi + 0x180]
test eax, eax
mov dword [esp + 0x20], eax
ja 0x1000c4ce
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000c4e6
push 1
call dword [sym.imp.MSVCR80.dll_exit]
mov edx, dword [esp + 0x20]
push edx
push 0
push edi
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [esi + 0x178], edi
mov edi, dword [esi + 0x198]
xor eax, eax
push eax
mov eax, dword [esp + 0x14]
push edi
push eax
push ebp
call sub.ntdll.dll__aulldiv
xor ecx, ecx
push ecx
push edi
push edx
push eax
call sub.ntdll.dll__allmul
mov ecx, dword [esi + 0x178]
push edx
push eax
push ebx
push ecx
push esi
call fcn.1000cfa0
mov ebx, dword [esp + 0x30]
mov edx, dword [esi + 0x198]
add esp, 0x14
push ebx
push 0
mov edi, eax
mov eax, dword [esp + 0x18]
push edx
push eax
push ebp
call sub.ntdll.dll__aullrem
add eax, dword [esi + 0x178]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
cmp edi, ebx
mov eax, edi
jl 0x1000c566
mov eax, ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000c570
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esi + 0x198]
push ebx
mov ebx, dword [esi + 0x170]
add ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esi + 0x174]
adc ebp, dword [esp + 0x1c]
push edi
xor ecx, ecx
push ecx
push eax
push ebp
push ebx
call sub.ntdll.dll__aullrem
mov edi, eax
xor eax, eax
add edi, dword [esp + 0x18]
mov ecx, 0
adc edx, eax
mov eax, dword [esi + 0x198]
add edi, eax
adc edx, ecx
push ecx
add edi, 0xffffffff
push eax
adc edx, 0xffffffff
push edx
push edi
call sub.ntdll.dll__aulldiv
mov ecx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esi + 0x198]
imul edi, eax
cmp ecx, edi
jne 0x1000c5ff
test dword [esi + 0x190], 0x4000
je 0x1000c5e9
add eax, 0xffffffff
test dword [esp + 0x14], eax
jne 0x1000c5ff
push ebp
push ebx
push ecx
mov ecx, dword [esp + 0x20]
push ecx
push esi
call fcn.1000d110
add esp, 0x14
pop edi
pop ebp
pop ebx
pop ecx
ret
cmp dword [esi + 0x17c], 0
jne 0x1000c612
mov dword [esi + 0x184], 0x10000
cmp dword [esi + 0x184], edi
jae 0x1000c64c
lea ebx, [ebx]
mov edx, dword [esi + 0x17c]
push edx
call dword [sym.imp.MSVCR80.dll_free]
mov eax, dword [esi + 0x184]
add eax, eax
add esp, 4
cmp eax, edi
mov dword [esi + 0x17c], 0
mov dword [esi + 0x184], eax
jb 0x1000c620
cmp dword [esi + 0x17c], 0
jne 0x1000c69f
mov eax, dword [esi + 0x184]
test eax, eax
mov dword [esp + 0x1c], eax
ja 0x1000c66b
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x1000c685
push 1
call dword [sym.imp.MSVCR80.dll_exit]
mov ecx, dword [esp + 0x1c]
push ecx
push 0
push eax
call sub.ntdll.dll_memset
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi + 0x17c], edx
mov eax, dword [esi + 0x198]
xor ecx, ecx
push ecx
push eax
push ebp
push ebx
call sub.ntdll.dll__aulldiv
xor ecx, ecx
push ecx
mov ecx, dword [esi + 0x198]
push ecx
push edx
push eax
call sub.ntdll.dll__allmul
push edx
push eax
mov eax, dword [esi + 0x17c]
push edi
push eax
push esi
call fcn.1000cfa0
add esp, 0x14
test eax, eax
jge 0x1000c6f0
mov ecx, dword [esi + 0x184]
mov edx, dword [esi + 0x17c]
push ecx
push 0
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x198]
push eax
push ecx
push 0
push edx
push ebp
push ebx
call sub.ntdll.dll__aullrem
add eax, dword [esi + 0x17c]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [esi + 0x198]
add esp, 0xc
xor ecx, ecx
push ecx
push eax
push ebp
push ebx
mov dword [esp + 0x30], ecx
call sub.ntdll.dll__aulldiv
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, dword [esi + 0x198]
push ecx
push edx
push eax
call sub.ntdll.dll__allmul
push edx
mov edx, dword [esi + 0x17c]
push eax
push edi
push edx
push esi
call fcn.1000d110
add esp, 0x14
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000c7f0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x50
mov eax, dword [0x100dd9d4]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [esp + 0x14]
push eax
push 8
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x7405c
push edi
call ebx
test eax, eax
je 0x1000c83b
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10059076
add esp, 0x50
ret
mov ecx, edi
call fcn.1000c970
mov ecx, eax
or ecx, edx
jne 0x1000c8b0
cmp byte [esi], cl
je 0x1000c87d
cmp byte [esi + 1], cl
je 0x1000c87d
cmp byte [esi + 2], cl
je 0x1000c87d
cmp byte [esi + 3], cl
je 0x1000c87d
cmp byte [esi + 4], cl
lea eax, [esi + 4]
je 0x1000c87d
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000c823
push 0
lea eax, [esp + 0x14]
push eax
push 0x28
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x700a0
push edi
call ebx
test eax, eax
je 0x1000c8a9
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov ecx, eax
or ecx, edx
jne 0x1000c8b0
mov ecx, edi
call fcn.1000c9d0
mov ecx, dword [esp + 0x4c]
pop ebx
xor ecx, esp
call fcn.10059076
add esp, 0x50
ret

Function at 0x1000c970
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
push edi
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000c9bc
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x1000c9bc
call edi
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0x400
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
xor edx, edx
pop edi
pop esi
add esp, 8
ret
pop edi
mov eax, esi
xor edx, edx
pop esi
add esp, 8
ret