joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42524b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x48a908]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42528b
cmp byte [ebx], 0xa
jne 0x42528b
or byte [eax + edi + 0x28], 4
jmp 0x425290
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x42538e
mov al, byte [edx]
cmp al, 0x1a
je 0x425370
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4252bf
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4252e4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4252ee
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4252a1
jmp 0x42538e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42536b
cmp dword [ebp - 0xc], 0
je 0x42536b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x48a908]
test byte [eax + edi + 0x28], 0x48
je 0x425345
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x425330
mov byte [esi], dl
jmp 0x425341
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x48a908]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x42538e
cmp byte [ebp - 1], 0xa
jne 0x425354
cmp esi, ebx
jne 0x425354
mov byte [esi], 0xa
jmp 0x42538d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00425dcb
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42538e
mov byte [esi], 0xd
jmp 0x42538d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x48a908]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42538a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42538e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x425397
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x48a908]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4253da
cmp word [esi], dx
jne 0x4253da
or byte [edi + eax + 0x28], 4
jmp 0x4253df
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x425532
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x425512
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x425421
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x425457
cmp eax, edx
jae 0x425463
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4253f9
jmp 0x425532
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42550e
cmp dword [ebp - 0x14], 0
je 0x42550e
mov eax, dword [ebx*4 + 0x48a908]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4254e6
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4254af
mov word [esi], cx
jmp 0x4254e2
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x48a908]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x48a908]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x48a908]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x425532
pop ebx
cmp word [ebp - 4], bx
jne 0x4254f7
cmp esi, dword [ebp + 0xc]
jne 0x4254f7
mov word [esi], bx
jmp 0x42552f
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00425dcb
add esp, 0x10
cmp word [ebp - 4], bx
je 0x425532
push 0xd
jmp 0x42552b
mov ecx, dword [ebx*4 + 0x48a908]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x425529
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x425532
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x32414186
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x133c1fad
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x54a110
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x103000]
push edi
or ebp, 0xffffffff
jmp 0x54a132
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54a139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54a128
mov eax, 1
add ebx, ebx
jne 0x54a14b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54a15c
jne 0x54a17b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54a17b
dec eax
add ebx, ebx
jne 0x54a168
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54a140
add ebx, ebx
jne 0x54a177
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54a1cd
xor ecx, ecx
sub eax, 3
jb 0x54a193
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54a202
sar eax, 1
mov ebp, eax
jmp 0x54a19e
add ebx, ebx
jne 0x54a19e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54a16c
inc ecx
add ebx, ebx
jne 0x54a1ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54a16c
add ebx, ebx
jne 0x54a1b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54a1ae
jne 0x54a1ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54a1ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54a1ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54a1de
jmp 0x54a12e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54a1ec
add edi, ecx
jmp 0x54a12e
pop esi
mov edi, esi
mov ecx, 0x42b4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54a20a
cmp byte [edi], 0x1f
jne 0x54a20a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54a20f
lea edi, [esi + 0x146000]
mov eax, dword [edi]
or eax, eax
je 0x54a287
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d940c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d9568]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54a23c
mov ecx, edi
jns 0x54a26b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d9570]
or eax, eax
je 0x54a281
mov dword [ebx], eax
add ebx, 4
jmp 0x54a259
call dword [esi + 0x1d956c]
mov ebp, dword [esi + 0x1d9574]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54a2bb
sub esp, 0xffffff80
jmp 0x49ba34
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x100010d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x100010db
jmp dword [eax*4 + 0x1000113c]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
push 0x10
push str.Error
push str.Already_injected_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push str.Info
push str.Process_Deatached
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10006742
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x41c
mov eax, 0x1002aee5
call fcn.1002acfb
mov eax, dword [ebp + 8]
xor edx, edx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x420], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x41c], edx
push 2
pop ecx
push ecx
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10006799
call fcn.100052d9
mov esi, eax
jmp 0x10006897
push 0
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x100067b4
call fcn.100052d9
jmp 0x1000688e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x100067aa
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x10006804
lea eax, [ebp - 0x418]
cmp dword [ebp - 0x41c], eax
je 0x100067ec
lea ecx, [ebp - 0x41c]
call fcn.1000529b
lea ecx, [ebp - 0x420]
call fcn.10005711
mov eax, 0x8007000e
call fcn.1002acaa
ret 0x10
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
test edx, edx
jne 0x100068c2
cmp eax, 0xffffffff
ja 0x100068c2
cmp eax, 0x400
jbe 0x10006838
push eax
lea ecx, [ebp - 0x41c]
call fcn.100052b1
mov eax, dword [ebp - 0x41c]
jmp 0x10006844
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 4], 1
test eax, eax
jne 0x10006856
mov esi, 0x8007000e
jmp 0x10006890
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100067aa
mov eax, dword [ebp - 0x41c]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x428]
push dword [ebp - 0x41c]
call fcn.100065ef
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x418]
cmp dword [ebp - 0x41c], eax
je 0x100068b0
lea ecx, [ebp - 0x41c]
call fcn.1000529b
lea ecx, [ebp - 0x420]
call fcn.10005711
mov eax, esi
jmp 0x100067fc
mov ecx, 0x80070057
call fcn.10005aee
int3

Function at 0x1000d1a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000d201
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000d1f3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000d1ef
cmp esi, ecx
jae 0x1000d1f3
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1000d1dd
cmp esi, ecx
jb 0x1000d1f7
xor eax, eax
jmp 0x1000d200
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10001185
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x1000118e
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x100011b1
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x100011b1
mov eax, ebx
jmp 0x100011c6
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x1000119d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret

Function at 0x100087dd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10008890
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x1000d7cc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.100087dd
test eax, eax
je 0x1000d80f
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x1000d80f
cmp word [eax], 0x5a4d
jne 0x1000d80f
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x1000d80f
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.1000d82e
mov eax, dword [ebp + 8]
jmp 0x1000d828
mov esp, ebp
pop ebp
ret 4

Function at 0x1000d9ca
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x1000d9ec
mov eax, 0xfffffffd
jmp 0x1000dacc
mov ebx, dword [0x100bd3a4]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x1000da9a
mov ebx, dword [0x100bd3a4]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x1000da3b
mov ebx, dword [0x100bd3a4]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x1000da3b
mov eax, 1
jmp 0x1000da40
mov eax, 0
test eax, eax
je 0x1000da6c
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x1000da55
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x100bd3a4]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x1000dac2
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x1000dacc
mov esp, ebp
pop ebp
ret 4
Function at 0x10014fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008fad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.10084fe5
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10016840
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10015024
jmp dword [ecx*4 + 0x1001518c]
mov al, byte [esi]
test al, al
je 0x10015052
cmp al, 0x20
je 0x1001503e
cmp al, 0xa1
jne 0x10015052
cmp byte [esi + 1], al
jne 0x10015052
test al, 0x80
je 0x1001504a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10015052
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10015031
test ecx, ecx
je case.default.0x10015024
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10015024
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10015098
cmp dl, 0xa1
jne 0x1001508c
cmp byte [eax + 1], 0xa1
jne 0x1001508c
test ecx, ecx
jne 0x10015084
mov edi, eax
mov ecx, 1
inc eax
jmp 0x100150ac
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x100150c6
jmp 0x100150ac
cmp dl, 0x20
jne 0x100150aa
test ecx, ecx
jne 0x100150a3
mov edi, eax
mov ecx, 1
jmp 0x100150ac
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1001506c
cmp ecx, 1
jne case.default.0x10015024
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10015024
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10015024
mov al, byte [esi]
test al, al
je 0x1001511e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10015104
mov cl, byte [esi + 1]
test cl, cl
je 0x1001511e
cmp al, 0xa1
jne 0x100150f4
cmp cl, al
je 0x10015101
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10016b10
inc esi
jmp 0x10015116
cmp al, 0x20
je 0x10015116
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10016b50
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x100150dd
push 0
lea ecx, [esp + 0x14]
call fcn.10016b50
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10020ad0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10015151
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x10096ad8
call fcn.10016a40
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10084f77
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10015f30
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, 0x100aa238
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
push ecx
call fcn.10015ef0
add esp, 8
mov byte [esp + 8], al
or esi, 0xffffffff
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015fda
lea edx, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
push ecx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
push ecx
call eax
test eax, eax
je 0x1001603b
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x10015fbc
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
jmp 0x10015fc4
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, 0xa
call fcn.10075dd0
mov edx, dword [esp + 0x28]
pop edi
pop esi
mov dword [edx], eax
add esp, 0x1c
ret
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x1001602f
mov eax, dword [esp + 0x34]
test eax, eax
mov eax, dword [esp + 0x30]
je 0x1001600d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push 0x400
imul edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], eax
add esp, 0x1c
ret
mov edx, dword [esp + 0x28]
pop edi
mov dword [edx], esi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
pop esi
add esp, 0x1c
ret