joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x10001cc3
push 0x10021ae4
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000b494
push esi
push str._s___CW__n
push dword [ebp - 4]
call fcn.10001290
push dword [ebp - 4]
call fcn.10006e0e
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001cd0
Capabilities:
Create process on windows
Set registry value
Terminate process

Disassembly:
mov ecx, str.PROCEXPL
call fcn.10001c20
mov ecx, str.TreeListWindowClass
call fcn.10001c20
mov ecx, str.ProcessHacker
call fcn.10001c20
mov ecx, str.RegEdit_RegEdit
call fcn.10001c20
mov ecx, str.ProcessThreadsView
call fcn.10001c20
mov ecx, str.TreeListWindowClass
call fcn.10001c20
mov ecx, str.PhTreeNew
call fcn.10001c20
mov ecx, 0x100221a4
call fcn.10001c20
mov ecx, str.TformSettings
call fcn.10001c20
mov ecx, str.TWildProxyMain
call fcn.10001c20
mov ecx, str.TUserdefinedform
call fcn.10001c20
mov ecx, str.TformAddressChange
call fcn.10001c20
mov ecx, str.TMemoryBrowser
call fcn.10001c20
mov ecx, str.TFoundCodeDialog
call fcn.10001c20
mov ecx, str.TL2PacketHackMain
call fcn.10001c20
mov ecx, str.vxwindowclassnr
call fcn.10001c20
mov ecx, str.l2packet
call fcn.10001c20
mov ecx, str.hlapex
call fcn.10001c20
mov ecx, str.wp_v5
call fcn.10001c20
mov ecx, 0x10022254
call fcn.10001c20
mov ecx, str.TfProcessRawLog
call fcn.10001c20
mov ecx, str.TfScriptEditor
call fcn.10001c20
mov ecx, str.TfScript
call fcn.10001c20
mov ecx, str.TTabSheet
call fcn.10001c20
mov ecx, str.TJvSpinEdit
call fcn.10001c20
mov ecx, str.PhTreeNew
call fcn.10001c20
mov ecx, str.TPaintPanel
call fcn.10001c20
mov ecx, str.ThtmlLiteEx
call fcn.10001c20
mov ecx, str.TfmMain
call fcn.10001c20
mov ecx, str.TvkProgressBar
call fcn.10001c20
mov ecx, str.TTabSheet
call fcn.10001c20
mov ecx, str.SandboxieControlWnsClass
call fcn.10001c20
mov ecx, str.0x150114__1376532_
call fcn.10001c20
mov ecx, str.0x507B6__329654_
jmp fcn.10001c20
Function at 0x100020a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp byte [ebx], 0xe9
jne 0x100020c6
mov ecx, dword [ebx + 1]
add ecx, 5
add ecx, ebx
call fcn.100020a0
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10025d78]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1002a90c]
cmp eax, dword [ecx + 4]
jle 0x1000211e
push 0x1002a90c
call fcn.10003b1c
add esp, 4
cmp dword [0x1002a90c], 0xffffffff
jne 0x1000211e
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x1002a90c
mov dword [0x1002a908], eax
call fcn.10003acb
add esp, 4
push esi
mov esi, dword [0x1002a908]
push edi
lea edx, [esi + 0x1000]
cmp esi, edx
je 0x10002143
lea ecx, [esi + 0x1c]
call fcn.10002090
test eax, eax
je 0x10002145
add esi, 0x20
cmp esi, edx
jne 0x10002130
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.10001e50
add edi, eax
cmp edi, 5
jl 0x10002147
mov ecx, esi
sub ebx, esi
mov edx, edi
nop dword [eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10002160
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [ebx - 5]
add eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call edi
mov eax, dword [ebp - 0x10]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x10021ae4
lea eax, [ebp - 4]
mov esi, ecx
push str.Protection.log
push eax
call fcn.1000b494
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x1000226b
push esi
push 0x10021af8
push eax
call fcn.10001290
push dword [ebp - 4]
call fcn.10006e0e
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10002290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x108c
call fcn.1001aad0
mov eax, dword [0x10025040]
xor eax, esp
mov dword [esp + 0x1088], eax
mov eax, ecx
mov dword [esp], 0xf21160b
push ebx
push esi
push edi
movups xmm0, xmmword [eax]
push ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], 0x171811fb
mov dword [esp + 0x18], 0x15012d12
mov dword [esp + 0x1c], 0xcfb107a
movups xmmword [esp + 0x1080], xmm0
call fcn.10001160
lea esi, [esp + 0x1080]
mov dword [esp + 0x28], 3
add esp, 4
mov dword [esp + 0x20], esi
mov ecx, dword [esi + 4]
lea edi, [esp + 0x74]
mov eax, dword [esi]
mov esi, 0x10
mov dword [esp + 0x1c], ecx
xor eax, dword [edi]
lea edi, [edi - 4]
mov edx, eax
mov dword [esp + 0x28], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esp + eax*4 + 0x78]
add eax, dword [esp + ecx*4 + 0x478]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esp + ecx*4 + 0x878]
movzx ecx, bl
add eax, dword [esp + ecx*4 + 0xc78]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], edx
sub esi, 1
jne 0x10002317
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
xor ecx, edx
mov dword [esi], ecx
mov ecx, dword [esp + 0x34]
xor ecx, eax
mov dword [esi + 4], ecx
add esi, 8
sub dword [esp + 0x24], 1
mov dword [esp + 0x20], esi
jne 0x10002305
mov eax, dword [esp + 0x2c]
movups xmm0, xmmword [esp + 0x107c]
mov ecx, dword [esp + 0x1094]
pop edi
pop esi
pop ebx
xor ecx, esp
movups xmmword [eax], xmm0
call fcn.10003742
mov esp, ebp
pop ebp
ret

Function at 0x10002640
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c88
call fcn.1001aad0
mov eax, dword [0x10025040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2c88]
mov dword [ebp - 0x2c88], 0x2880
push eax
lea eax, [ebp - 0x2c84]
mov esi, ecx
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x1000268d
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003742
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x2af0], 0
lea eax, [ebp - 0x2c84]
jne 0x100026d8
nop dword [eax]
cmp byte [eax + 0x195], 0
jne 0x100026d8
cmp byte [eax + 0x196], 0
jne 0x100026d8
cmp byte [eax + 0x197], 0
jne 0x100026d8
cmp byte [eax + 0x198], 0
jne 0x100026d8
cmp byte [eax + 0x199], 0
jne 0x100026d8
mov eax, dword [eax]
cmp byte [eax + 0x194], 0
je 0x100026a0
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x404]
push 0x3e8
push eax
call fcn.100021f0
push 0x3e8
lea eax, [ebp - 0x404]
push eax
push 0x3e8
push esi
push 0
call fcn.1000c2b5
mov ecx, dword [ebp - 4]
add esp, 0x38
xor ecx, ebp
mov al, 1
pop esi
call fcn.10003742
mov esp, ebp
pop ebp
ret
Function at 0x100028c0
Capabilities:
Get common file path
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d24
call fcn.1001aad0
mov eax, dword [0x10025040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
lea eax, [ebp - 0x204]
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100029d3
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.10004f50
push str.._
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000bfb8
lea eax, [ebp - 0x204]
mov byte [ebp - 0x202], 0
push eax
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000c2f2
add esp, 0x24
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100029d3
push 0x2710
lea eax, [ebp - 0x2d14]
mov dword [ebp - 0x2d24], 0
push 0
push eax
mov dword [ebp - 0x2d18], 0
mov dword [ebp - 0x2d20], 0
mov dword [ebp - 0x2d1c], 0
call fcn.10004f50
add esp, 0xc
lea eax, [ebp - 0x2d24]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2d14]
push eax
push 0xc
lea eax, [ebp - 0x2d20]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100029e5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003742
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x2cfc]
lea eax, [ebp - 0x604]
push eax
push ecx
lea ecx, [ebp - 0x2d14]
call fcn.10002750
push eax
push str._02X_02X
lea eax, [ebp - 0x604]
push 0x3e8
push eax
call fcn.100021f0
push 0x3e8
lea eax, [ebp - 0x604]
push eax
push 0x3e8
push edi
push 0
call fcn.1000c2b5
mov ecx, dword [ebp - 4]
add esp, 0x2c
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.10003742
mov esp, ebp
pop ebp
ret
Function at 0x10002fb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.engine.dll
call ebx
mov esi, eax
push str.ntdll.dll
mov dword [ebp - 4], esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
push eax
call esi
mov eax, dword [ebp - 4]
mov dword [0x100268e0], eax
lea eax, [ebp - 0x10]
push 0xc
push eax
push ebx
call edi
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.KiUserExceptionDispatcher
push str.ntdll.dll
mov dword [0x100268e8], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [0x100268f4], eax
test eax, eax
je 0x10003168
cmp byte [eax], 0xfc
jne 0x10003039
inc eax
mov dword [0x100268f4], eax
push str.connect
push str.ws2_32.dll
call edi
push eax
call esi
test eax, eax
je 0x10003168
mov edx, 0x10002280
mov ecx, eax
call fcn.100020a0
push str._AddNetworkQueue_UNetworkHandler__UAEHPAUNetworkPacket___Z
push dword [ebp - 4]
mov dword [0x100268f8], eax
call esi
test eax, eax
je 0x10003168
mov edx, 0x100023b0
mov ecx, eax
call fcn.100020a0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001c00
push 0
push 0
mov dword [0x100268f0], eax
call esi
call fcn.10001b10
call fcn.10001b10
push 0
push 0
push 0
push 0x10001e30
push 0
push 0
call esi
call fcn.10001cd0
call fcn.10001cd0
push 0
push 0
push 0
push 0x100019c0
push 0
push 0
call esi
mov ecx, str.L2Tower.exe
call fcn.10001860
mov ecx, str.L2NET.exe
call fcn.10001860
mov ecx, str.HxD.exe
call fcn.10001860
mov ecx, str.boot.exe
call fcn.10001860
mov ecx, str.alquimista.exe
call fcn.10001860
mov ecx, str.L2Divine.exe
call fcn.10001860
mov ecx, str.SandMan.exe
call fcn.10001860
mov ecx, str.SbieSvc.exe
call fcn.10001860
mov ecx, str.SbieSvc32.exe
call fcn.10001860
mov ecx, str.SbieSvc32.exe
call fcn.10001860
mov ecx, str.SbieCtrl.exe
call fcn.10001860
mov ecx, str.Start.exe
call fcn.10001860
call fcn.100017a0
push 0
push 0
push 0
push 0x10001830
push 0
push 0
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c770
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000c7af
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000c7af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000c7af
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000c7af
cmp dword [ecx + 0x74], 0xe
jbe 0x1000c7af
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000dddb
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c7ec
push 0x1001c7e4
push str.FlsAlloc
push 0x1f
call fcn.1000dcb7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000de0f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b19c]
call esi
jmp 0x1000de15
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000de59
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c7fc
push 0x1001c7f4
push str.FlsGetValue
push 0x21
call fcn.1000dcb7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000de90
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b19c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000de98
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c804
push 0x1001c7fc
push str.FlsSetValue
push 0x22
call fcn.1000dcb7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000ded2
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001b19c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001022d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10026090]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001026d
cmp byte [ebx], 0xa
jne 0x1001026d
or byte [edi + eax + 0x28], 4
jmp 0x10010272
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10010371
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10010354
inc eax
cmp dl, 0xd
je 0x1001029e
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100102c4
cmp eax, ecx
jae 0x100102d2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10010286
jmp 0x10010371
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001034f
cmp dword [ebp - 0x10], 0
je 0x1001034f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10026090]
test byte [eax + edi + 0x28], 0x48
je 0x10010329
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10010314
mov byte [esi], dl
jmp 0x10010325
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10026090]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10010371
cmp byte [ebp - 1], 0xa
jne 0x10010338
cmp esi, ebx
jne 0x10010338
mov byte [esi], 0xa
jmp 0x10010370
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001707f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10010371
mov byte [esi], 0xd
jmp 0x10010370
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10026090]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001036e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10010371
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001037a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10026090]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100103c0
cmp word [ebx], dx
jne 0x100103c0
or byte [eax + edi + 0x28], 4
jmp 0x100103c5
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10010528
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10010508
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10010406
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001043c
cmp eax, edx
jae 0x1001044a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100103e1
jmp 0x10010528
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10010503
cmp dword [ebp - 0x18], 0
je 0x10010503
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10026090]
test byte [eax + edi + 0x28], 0x48
je 0x100104d9
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1001049d
mov word [esi], cx
jmp 0x100104d4
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10026090]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10026090]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10026090]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10010528
pop eax
cmp word [ebp - 4], ax
jne 0x100104e9
cmp esi, ebx
jne 0x100104e9
mov word [esi], ax
jmp 0x10010525
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001707f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10010528
push 0xd
pop eax
jmp 0x100104e4
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10026090]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10010522
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10010528
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100125fc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10012699
push ebx
push esi
call fcn.100125c5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10012559
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012646
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012698
push edi
push eax
call fcn.1000e934
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10012666
call fcn.1000d50f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012697
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10012559
add esp, 0x20
test eax, eax
jne 0x10012685
push edi
call fcn.1000d50f
jmp 0x1001268d
push ebx
call fcn.1000d50f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10018571
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100184ed
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100186e0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100186e0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10018695
jg 0x100185cd
test eax, eax
je 0x1001868b
push 1
push 0x1000
call fcn.1000d4b2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100185f0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10018682
push 0x8000
push ebx
call fcn.1001841e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10018619
jg 0x10018614
cmp ecx, 0x1000
jb 0x10018619
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10013e2d
add esp, 0x10
cmp eax, 0xffffffff
je 0x1001865e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10018614
jl 0x10018645
test ecx, ecx
jne 0x10018606
push dword [ebp - 0xc]
push ebx
call fcn.1001841e
push esi
call fcn.1000d50f
add esp, 0xc
xor ebx, ebx
jmp 0x100186ee
cmp byte [edi + 0x24], 0
je 0x10018675
cmp dword [edi + 0x20], 5
jne 0x10018675
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10018680
mov ebx, dword [edi + 0x18]
jmp 0x10018682
xor ebx, ebx
push esi
call fcn.1000d50f
pop ecx
jmp 0x100186ee
test ecx, ecx
jg 0x10018657
jl 0x10018695
test eax, eax
jae 0x10018657
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001707f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100186b5
cmp byte [edi + 0x1c], 0
je 0x10018657
jmp 0x100186e6
push ebx
call fcn.100133ba
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10018657
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100186ee
cmp byte [edi + 0x1c], 0
je 0x100186eb
mov ebx, dword [edi + 0x18]
jmp 0x100186ee
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001707f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001a710
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a73d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a73d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x38dc2c17
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4d7e693c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219