joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x1000a9b8
mov edi, dword [0x100130a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x1000a8c7
test byte [0x1000c0ec], 8
jne 0x1000a960
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x1000c0fc], 8
jne 0x1000a920
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000a869
cmp esi, 3
jbe 0x1000a8d8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000a87a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10010a68]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x1000a869
mov dword [esp], 0x1000c0fc
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000a840
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x1000a840
mov dword [esp], 0x1000c0ec
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000a82b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x1000a833
mov eax, 0xffffffff
jmp 0x1000a8c7
Function at 0x1000ac50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100130c0]
test eax, eax
je 0x1000ad08
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x1000ac90
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000ac7c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000ad3d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100130c0], eax
sub esp, 8
test eax, eax
jne 0x1000ac6d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000ac7e
Function at 0x1000ad50
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x1000aee0
mov eax, dword [esi]
test eax, eax
je 0x1000aec8
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000aeec
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x1000aeb8
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1000ae7c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x1000adb6
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x1000aee2
Function at 0x8c5500
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc5000]
push edi
jmp 0x8c551a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8c5521
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8c5510
mov eax, 1
add ebx, ebx
jne 0x8c5533
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8c5544
jne 0x8c5563
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8c5563
dec eax
add ebx, ebx
jne 0x8c5550
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8c5528
add ebx, ebx
jne 0x8c555f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8c55b5
xor ecx, ecx
sub eax, 3
jb 0x8c557b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8c55ea
sar eax, 1
mov ebp, eax
jmp 0x8c5586
add ebx, ebx
jne 0x8c5586
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8c5554
inc ecx
add ebx, ebx
jne 0x8c5594
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8c5554
add ebx, ebx
jne 0x8c55a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8c5596
jne 0x8c55b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8c5596
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8c55d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8c55c6
jmp 0x8c5516
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8c55d4
add edi, ecx
jmp 0x8c5516
pop esi
mov edi, esi
mov ecx, 0x4d48
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8c55f2
cmp byte [edi], 0x22
jne 0x8c55f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8c55f7
lea edi, [esi + 0x4c2000]
mov eax, dword [edi]
or eax, eax
je 0x8c566f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4c6cec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4c6e18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8c5624
mov ecx, edi
jns 0x8c5653
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4c6e1c]
or eax, eax
je 0x8c5669
mov dword [ebx], eax
add ebx, 4
jmp 0x8c5641
call dword [esi + 0x4c6e2c]
mov ebp, dword [esi + 0x4c6e20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8c56a3
sub esp, 0xffffff80
jmp 0x4a316a
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10007082
pop dword [ebp - 0x4c]
mov eax, 0x81c640bf
sub eax, 0x71c5d03d
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3a009
push 0
mov eax, 0x747a6445
sub eax, 0x647923e1
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x632385d8
add ecx, 0x9cdcc60c
mov edi, eax
mov esi, 0x40f61b31
add esi, 0xcf0b6acf
add esi, dword [ebp - 0x4c]
mov ebx, 0xe0e4ec80
add ebx, 0xa99c8ec8
add dword [ebp - 0x14], 0x82371409
mov edx, dword [esi]
add dword [ebp - 0xc], 0xf9761df7
sub edx, ebx
xor dword [ebp - 0x30], ebx
mov dword [edi], edx
add edi, 4
add esi, 4
loop 0x100070e1
add eax, 0xb26e9df5
add eax, 0x4d92846e
xor ebx, ebx
add ebx, eax
add eax, 0x35165236
add eax, 0xcae9adcf
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x409113
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x409122
pop dword [ebp - 0x38]
mov eax, 0x409122
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x35d7e
push 0
mov eax, 0x66bffd5e
add eax, 0x9980f332
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x2dfaf9b9
sub ecx, 0x2dfabbf7
xor edi, edi
add edi, eax
mov edx, 0x3201e00a
add edx, 0xce3fc9f6
add edx, dword [ebp - 0x38]
mov esi, 0x25461e0
add esi, 0xad38a3fe
mov ebx, dword [edx]
xor dword [ebp - 0x1c], edi
add ebx, esi
add dword [ebp - 0x1c], eax
mov dword [edi], ebx
sub dword [ebp - 0x2c], eax
add edi, 0xa4d54b3c
add edi, 0x5b2ab4c8
add edx, 0x2a013e5b
sub edx, 0x2a013e57
loop 0x40917e
add eax, 0x4af4a51f
add eax, 0xb50c44bc
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6113389c
sub ecx, 0x60d3389c
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402c00
pop dword [ebp - 0x28]
mov eax, 0x402c00
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe2d59530
sub dword [ebp - 0x38], 0x94834fe5
mov dword [ebp - 0x34], 0x365455ff
add dword [ebp - 0x34], 0xfbdef646
mov dword [ebp - 0x30], 0x1194058
add dword [ebp - 0x30], 0x4b3303d6
mov dword [ebp - 0x2c], 0x79452283
sub dword [ebp - 0x2c], 0x79452283
lea eax, [ebp - 0x38]
push eax
mov eax, 0x307d8a30
add eax, 0xcfc2e634
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2d1cba5f
sub dword [ebp - 0x38], 0xb8aa5109
mov dword [ebp - 0x34], 0x77a99fc
sub dword [ebp - 0x34], 0xc60e3887
mov dword [ebp - 0x30], 0x322a9df8
add dword [ebp - 0x30], 0x3144ce74
mov dword [ebp - 0x2c], 0x6901f9de
sub dword [ebp - 0x2c], 0x6901f9de
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x6d377571
sub eax, 0x6cf704c9
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37ed6
push 0
call eax
mov ecx, 0xc800fb62
add ecx, 0x37ff5192
xor edi, edi
add edi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x28]
mov esi, 0x9dc91a9c
add esi, 0x5d338fe2
add dword [ebp - 0x20], ebx
mov ebx, dword [edx]
mov dword [ebp - 8], 0x9073a5cf
add ebx, esi
xor dword [ebp - 0x24], 0xc1270de5
mov dword [edi], ebx
add edi, 4
add edx, 0xed0a25de
add edx, 0x12f5da26
loop 0x402d19
add eax, 0x126a3
xor ebx, ebx
add ebx, eax
add eax, 0xa84b82f9
add eax, 0x57b47d0c
mov ecx, 0x53870687
add ecx, 0xacb8f979
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4138f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section._____1
lea edi, [esi - 0xf000]
push edi
jmp 0x41390a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413911
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413900
mov eax, 1
add ebx, ebx
jne 0x413923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413934
jne 0x413953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413953
dec eax
add ebx, ebx
jne 0x413940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x413918
add ebx, ebx
jne 0x41394f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4139a5
xor ecx, ecx
sub eax, 3
jb 0x41396b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4139da
sar eax, 1
mov ebp, eax
jmp 0x413976
add ebx, ebx
jne 0x413976
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413944
inc ecx
add ebx, ebx
jne 0x413984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413944
add ebx, ebx
jne 0x413991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413986
jne 0x4139a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413986
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4139c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4139b6
jmp 0x413906
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4139c4
add edi, ecx
jmp 0x413906
pop esi
mov edi, esi
mov ecx, 0x4e00
jmp 0x413a16
mov al, byte [edi]
add edi, 1
cmp al, 0x80
jb 0x4139f7
cmp al, 0x8f
ja 0x4139f7
cmp byte [edi - 2], 0xf
je 0x4139fd
sub al, 0xe8
cmp al, 1
ja 0x413a20
cmp byte [edi], 5
jne 0x413a20
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
mov dword [edi], eax
add edi, 4
sub ecx, 4
mov al, byte [edi]
add edi, 1
loop 0x4139f7
sub ecx, 1
jg 0x4139e4
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x413a6d
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x134e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1354c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413a2b
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13550]
or eax, eax
je 0x413a67
mov dword [ebx], eax
add ebx, 4
jmp 0x413a48
call dword [esi + 0x13560]
mov ebp, dword [esi + 0x13554]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x413aa1
sub esp, 0xffffff80
jmp section.____
Function at 0x10001370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x5a4d
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp word [esi], ax
jne 0x100013e8
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x100013e8
movzx ecx, word [eax + 6]
xor edx, edx
add eax, 0xf8
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x100013e8
lea ecx, [eax + 0xc]
push edi
lea esp, [esp]
mov edi, dword [ecx]
lea eax, [edi + esi]
cmp ebx, eax
jb 0x100013c4
mov eax, dword [ecx - 4]
add eax, edi
add eax, esi
cmp ebx, eax
jb 0x100013d6
inc edx
add ecx, 0x28
cmp edx, dword [ebp - 4]
jb 0x100013b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edx + edx*4]
shl eax, 3
pop edi
sub eax, esi
add eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100013f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x214], eax
mov edi, edx
push 0x103
lea eax, [ebp - 0x20c]
xor bl, bl
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100014a4
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001491
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10001486
push 0
lea eax, [ebp - 0x210]
push eax
push 0x28
push dword [ebp - 0x214]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
test esi, esi
je 0x10001491
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026980
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.10026980
mov esp, ebp
pop ebp
ret

Function at 0x100014c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x100014e0
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100014e0
mov al, byte [eax + 0x5e]
shr al, 6
and al, 1
ret
xor al, al
ret

Function at 0x100014f0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x10001553
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x10001553
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x10001553
mov ecx, 0x14c
cmp word [eax + 4], cx
jne 0x10001553
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x10001553
mov edx, 0xa
mov ecx, esi
call fcn.10001560
test eax, eax
je 0x10001553
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10001553
mov eax, dword [eax]
test eax, eax
je 0x10001553
cmp ecx, 0x80
jb 0x10001553
cmp dword [eax + esi + 0x7c], 0
pop esi
setne al
ret
xor al, al
pop esi
ret