joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10161c60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.100a0380
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x10161db4
cmp ebx, 0x80
jg 0x10161db4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.10162570
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x10161cf7
test ebp, ebp
jle 0x10161d45
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x10161ce4
jmp 0x10161d41
xor esi, esi
test ebp, ebp
jle 0x10161d45
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x10161d27
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x10161d23
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, reloc.OLEAUT32.dll_VariantInit
jns 0x10161d54
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x10161d85
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x10161d9c
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x10161d98
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1016f5f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x1016f651
mov al, byte [edi]
test al, al
je 0x1016f651
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x1016f609
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x101810d0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x101829e0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x10182a40
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x10184180
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x10184220
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x1018a3f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101dffae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.1018d440
mov eax, dword [0x10211074]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx + 0x2c], eax
mov ecx, dword [0x10211074]
lea ebp, [ebx + 0x30]
mov dword [ebp], ecx
mov byte [esp + 0x1c], 2
mov dword [ebx], 0x1021c908
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x10272a5c
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [esp + 0x24]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x40], edi
mov edx, dword [esi + 0x14]
mov dword [ebx + 0x14], edx
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ecx, dword [esi + 0x1c]
mov dword [ebx + 0x1c], ecx
mov edx, dword [esi + 0x20]
mov dword [ebx + 0x20], edx
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov ecx, dword [esi + 0x28]
lea edx, [esi + 0x30]
mov dword [ebx + 0x28], ecx
push edx
mov ecx, ebp
call fcn.100c9d50
mov eax, dword [ebx + 0x38]
mov ebp, dword [esi + 0x34]
mov esi, dword [esi + 0x38]
cmp eax, edi
je 0x1018a4d0
push eax
call fcn.10066289
add esp, 4
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x34], edi
cmp esi, edi
je 0x1018a4fd
cmp ebp, edi
jbe 0x1018a4fd
push ebp
call fcn.1006625a
add esp, 4
cmp eax, edi
mov dword [ebx + 0x38], eax
je 0x1018a4fd
mov ecx, ebp
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x34], ebp
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1018a520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101dffde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x1021c908
mov eax, dword [esi + 0x38]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x14], 2
je 0x1018a564
push eax
call fcn.10066289
add esp, 4
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x30]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esp + 0x14], 1
call fcn.100c9bd0
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], bl
call fcn.100c9bd0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.1018d470
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1018dde0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101e053e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.100e0520
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.101539b0
push 0xa
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 1
call fcn.101c9990
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 2
call fcn.100dccc0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov word [esi + 0x2c], di
mov dword [esi + 0x30], edi
mov dword [esi + 0xa0], edi
mov dword [esi], 0x1021c9c4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1018e350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e05f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, ecx
push 1
lea ecx, [esp + 0x18]
lea eax, [edi + 0x80]
push eax
call fcn.100dd1f0
mov eax, dword [esp + 0x30]
xor ebp, ebp
cmp eax, ebp
mov eax, dword [edi + 0x70]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], ebp
je 0x1018e449
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x1018e3d0
lea esi, [edi + 0x68]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.101c9d50
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
cmp dword [esp + 0x30], ebp
jne 0x1018e3ab
mov eax, dword [edi + 0x70]
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x1018e43f
push ebx
lea ebx, [edi + 0x68]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, ebx
call fcn.101c9d50
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 0x30]
cmp ecx, ebp
je 0x1018e409
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, esi
mov dword [esi + 0x2c], ebp
call fcn.100e07b0
mov ecx, dword [esp + 0x10]
call fcn.100e0870
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
je 0x1018e42a
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
je 0x1018e438
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x34], ebp
jne 0x1018e3e3
pop ebx
lea ecx, [edi + 0x68]
call fcn.101c9a20
jmp 0x1018e4c1
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x1018e4c1
lea esi, [edi + 0x68]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.101c9d50
mov ecx, dword [esp + 0xc]
call fcn.100e08f0
test eax, eax
jne 0x1018e4bb
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x28], ebp
jne 0x1018e4bb
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x1018e4a1
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ecx, ebp
je 0x1018e4b3
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.101c9cc0
cmp dword [esp + 0x30], ebp
jne 0x1018e458
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.100dd250
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x1019ac80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, 0x8000
push edi
cmp eax, esi
mov dword [esp + 0x14], esi
jbe 0x1019ac9e
mov dword [esp + 0x14], eax
mov esi, eax
push esi
call fcn.1006625a
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
mov ebp, dword [esp + 0x24]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
mov dword [esp + 0x10], ebx
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jne 0x1019acdd
xor ebx, ebx
jmp 0x1019acfa
lea eax, [esp + 0x24]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1019acf6
or ebx, 0xffffffff
jmp 0x1019acfa
mov ebx, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1019ad4d
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push 0
push ecx
push eax
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1019ad32
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
je 0x1019ad49
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10066289
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
cmp ebx, esi
jae 0x1019ad72
test ebx, ebx
je 0x1019ae46
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push 0
push edx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1019ae46
lea ecx, [ebx + edi]
add edi, eax
push esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edi
call fcn.1006625a
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x24], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x1019ada6
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
jg 0x1019ade5
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x1019ade5
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push 0
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1019addf
or esi, 0xffffffff
jmp 0x1019ade7
mov esi, dword [esp + 0x28]
jmp 0x1019ade7
xor esi, esi
mov edx, dword [esp + 0x2c]
push 0
push 0
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebx, ebx
je 0x1019ae0f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0
push eax
push ebx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
add edx, ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x10], edx
test esi, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov ebx, esi
jg 0x1019ada2
push eax
call fcn.10066289
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call fcn.10066289
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1019ae60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
jne 0x1019ae83
or ebx, eax
jmp 0x1019ae85
mov ebx, eax
push 2
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
je 0x1019ae9f
mov dword [esp + 0x1c], eax
push 0
push ebx
push esi
call fcn.1019b1a0
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
sub eax, ebp
sub ecx, ebp
add esp, 0xc
cmp ecx, eax
mov dword [esp + 0x20], ecx
jl 0x1019aec7
mov dword [esp + 0x20], eax
push 0x8000
call fcn.1006625a
mov ebx, eax
add esp, 4
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [eax + ebp]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x24]
push 0
push edx
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1019af11
or eax, 0xffffffff
jmp 0x1019af4d
mov edi, dword [esp + 0x24]
mov eax, edi
test edi, edi
mov dword [esp + 0x14], eax
jle 0x1019af4d
push 0
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x1019af49
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1019af58
cmp dword [esp + 0x10], edi
jne 0x1019af58
mov eax, dword [esp + 0x14]
add ebp, eax
cmp eax, 0x8000
jne 0x1019af6b
jmp 0x1019aee1
push ebx
call fcn.10066289
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
sub eax, ecx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call fcn.10066289
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1019b860
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e1420
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
mov dword [ebp - 0x14], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1019b8ba
push 0x10258300
call fcn.101a4f90
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x6400000
jbe 0x1019b8c9
push 0x102582e0
jmp 0x1019b89d
lea eax, [esi + 1]
mov dword [ebp + 8], edi
push eax
mov dword [ebp - 4], edi
call fcn.1006625a
add esp, 4
lea ecx, [ebp + 8]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
push 0
push ecx
push esi
push edi
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, dword [ebp + 8]
je 0x1019b90c
push edi
call fcn.10066289
add esp, 4
push 0x102582cc
jmp 0x1019b89d
mov ecx, dword [ebp - 0x14]
push 1
push edi
call fcn.1019b940
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1019e680
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x101e184f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, ecx
neg esi
sbb esi, esi
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
add esi, 2
call fcn.100dc7c0
mov eax, dword [edi + 0x9c]
lea ecx, [esp + 0x10]
push eax
push ecx
push esi
mov ecx, edi
mov dword [esp + 0x34], 1
call fcn.101a0e60
push 0x102704c8
lea ecx, [esp + 0x38]
call fcn.100ce7b0
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
mov byte [esp + 0x28], 2
mov edi, eax
jle 0x1019e738
test esi, esi
je 0x1019e705
push 0x10258590
lea ecx, [esp + 0x38]
call fcn.100cfba0
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
mov ecx, dword [edx + esi*4]
call fcn.101a3910
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 3
call fcn.100cfc00
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.100cef50
inc esi
cmp esi, edi
jl 0x1019e6f3
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.100ce550
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 1
call fcn.100cef50
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.100dc7d0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x1019f500
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x101e1a48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.100dc7c0
mov eax, dword [esi + 0x9c]
lea ecx, [esp + 0x10]
push eax
push ecx
push 3
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.101a0e60
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
cmp edi, eax
jge 0x1019f5c5
mov edx, dword [esp + 0x34]
push 0
push edx
call fcn.101a65c0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x1019f56b
push 0x102586fc
jmp 0x1019f5bd
mov eax, dword [esp + 0x10]
lea edx, [esp + 8]
push edx
mov ecx, dword [eax + edi*4]
mov dword [esp + 0xc], 0
call fcn.101a4c90
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push edx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1019f5eb
mov eax, dword [esp + 8]
push eax
call fcn.10066289
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x102586e8
call fcn.101a4f90
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.100dc7d0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
mov ecx, dword [esp + 8]
push ecx
call fcn.10066289
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.100dc7d0
mov ecx, dword [esp + 0x20]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x101a20e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e1f2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
call fcn.101a2460
test eax, eax
jne 0x101a220f
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.101a2460
test eax, eax
jne 0x101a220f
lea eax, [esp + 8]
mov ecx, edi
push eax
call fcn.101a28a0
push 0x10258acc
push 0x10258460
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.100d0e90
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.101a28a0
mov esi, eax
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
push 0x10258460
push eax
mov byte [esp + 0x34], 2
call fcn.100cf8a0
push 0x10258ad4
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x34], 3
call fcn.100cf6c0
push esi
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x34], 4
call fcn.100cf4f0
mov esi, dword [esp + 0x30]
push 0x10258ac8
push eax
push esi
mov byte [esp + 0x34], 5
call fcn.100cf6c0
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x28], 4
call fcn.100cef50
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.100cef50
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.100cef50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 1
call fcn.100cef50
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.100cef50
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
mov edi, dword [esp + 0x30]
mov ecx, esi
push edi
call fcn.101a28a0
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4