joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401550
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x401703
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
nop dword [eax]
push 0
call esi
add byte [edi + ebp], 0x1b
push 0
call esi
add byte [edi + ebp], 0xbb
push 0
call esi
xor byte [edi + ebp], 0xed
push 0
call esi
add byte [edi + ebp], 0x15
push 0
call esi
add byte [edi + ebp], 0x1f
push 0
call esi
add byte [edi + ebp], 0x21
push 0
call esi
add byte [edi + ebp], 0xd4
push 0
call esi
xor byte [edi + ebp], 0x7b
push 0
call esi
add byte [edi + ebp], 0xbd
push 0
call esi
add byte [edi + ebp], 0xf2
push 0
call esi
xor byte [edi + ebp], 0x99
push 0
call esi
add byte [edi + ebp], 0xb
push 0
call esi
add byte [edi + ebp], 0xc5
push 0
call esi
add byte [edi + ebp], 0x20
push 0
call esi
add byte [edi + ebp], 0xea
push 0
call esi
add byte [edi + ebp], 0x32
push 0
call esi
xor byte [edi + ebp], 0x63
push 0
call esi
add byte [edi + ebp], 0x84
push 0
call esi
add byte [edi + ebp], 0xf9
push 0
call esi
add byte [edi + ebp], 0xf4
push 0
call esi
add byte [edi + ebp], 0x27
push 0
call esi
add byte [edi + ebp], 0xb6
push 0
call esi
add byte [edi + ebp], 0x44
push 0
call esi
add byte [edi + ebp], 0x9a
push 0
call esi
add byte [edi + ebp], 0xd7
push 0
call esi
xor byte [edi + ebp], 0xd7
push 0
call esi
add byte [edi + ebp], 0xdf
push 0
call esi
add byte [edi + ebp], 0xd1
push 0
call esi
add byte [edi + ebp], 0x23
push 0
call esi
add byte [edi + ebp], 0xbc
push 0
call esi
add byte [edi + ebp], 0xc9
push 0
call esi
xor byte [edi + ebp], 0x9a
push 0
call esi
xor byte [edi + ebp], 0xe2
push 0
call esi
xor byte [edi + ebp], 0x30
push 0
call esi
add byte [edi + ebp], 0xc3
push 0
call esi
add byte [edi + ebp], 0x6a
push 0
call esi
xor byte [edi + ebp], 0x12
push 0
call esi
add byte [edi + ebp], 0xf6
push 0
call esi
add byte [edi + ebp], 0x1c
push 0
call esi
xor byte [edi + ebp], 6
push 0
call esi
add byte [edi + ebp], 0x93
push 0
call esi
xor byte [edi + ebp], 0xb1
push 0
call esi
add byte [edi + ebp], 0xb1
push 0
call esi
xor byte [edi + ebp], 0xb3
push 0
call esi
add byte [edi + ebp], 0xd8
push 0
call esi
xor byte [edi + ebp], 0xbe
push 0
call esi
add byte [edi + ebp], 3
push 0
call esi
add byte [edi + ebp], 0x59
push 0
call esi
add byte [edi + ebp], 0x37
inc edi
cmp edi, ebx
jb 0x401570
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x401940
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
push edi
mov eax, 0x1a1
cmp eax, 0x24
ja 0x40194e
call 0x8561871
inc eax
inc ecx
add byte [ebx + ecx*4 + 0x3d], ah
xor byte [eax], al
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x455400], eax
sub eax, eax
je 0x401973
jmp 0x74408196
push 0x37400
push section..pal
call fcn.00401550
add esp, 8
call fcn.004011b0
pop edi
xor eax, eax
pop esi
ret

Function at 0x402494
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4024d3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4024d3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4024d3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4024d3
cmp dword [ecx + 0x74], 0xe
jbe 0x4024d3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408a64
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416860
push 0x416858
push str.FlsAlloc
push 0x1e
call fcn.00408925
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408a98
push dword [ebp + 8]
mov ecx, esi
call dword [0x414120]
call esi
jmp 0x408a9e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408ae2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416870
push 0x416868
push str.FlsGetValue
push 0x20
call fcn.00408925
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408b19
push dword [ebp + 8]
mov ecx, esi
call dword [0x414120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x56d5e3
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0056d662
jae 0x56d5ef
xor ecx, ecx
call fcn.0056d662
jae 0x56d619
xor eax, eax
call fcn.0056d662
jae 0x56d62a
mov al, 0x10
call fcn.0056d662
adc al, al
jae 0x56d60b
jne 0x56d657
stosb byte es:[edi], al
jmp 0x56d5f0
call fcn.0056d66e
dec ecx
loop 0x56d636
mov eax, ebp
call fcn.0056d66c
jmp 0x56d658
lodsb al, byte [esi]
shr eax, 1
je 0x56d67e
adc ecx, 2
mov ebp, eax
jmp 0x56d658
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0056d66c
cmp eax, 0x7d00
jae 0x56d656
cmp eax, 0x500
jae 0x56d657
cmp eax, 0x7f
ja 0x56d658
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x56d5f0
pop ebp
ret 8
Function at 0x100015d0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push str._cdll_
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x100171b4], eax
je 0x100015f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100015f8
xor al, al
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x10016db8
push 0
push 0
push 0x10001540
push 0
push 0
call esi
push 0x10016db4
push 0
push 0
push 0x10001390
push 0
push 0
call esi
mov ecx, dword [0x10018004]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret

Function at 0x10001f10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x118
xor ecx, ecx
mov al, byte [0x100171bc]
mov dword [esp + 1], ecx
push ebx
mov dword [esp + 9], ecx
push esi
mov dword [esp + 0x11], ecx
push edi
mov dword [esp + 0x19], ecx
mov byte [esp + 0xc], al
mov word [esp + 0x1d], cx
mov byte [esp + 0x20], al
mov byte [esp + 0x1f], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x20]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._system.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_time]
push eax
lea eax, [esp + 0x14]
push 0x1001613c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x20]
lea edx, [esp + 0xc]
push ecx
push edx
push 0x10016138
push 0x10016134
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x118
ret
Function at 0x10004db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x488
push ebx
push esi
mov dword [ebp - 0x2c], ecx
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x93]
mov byte [ebp - 0x94], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, 0x44
mov al, 0x4c
xor esi, esi
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], 0x4b
mov byte [ebp - 0x12], 0x55
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], cl
mov word [ebp - 0x28], 3
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
xor eax, eax
mov cl, byte [ebp + eax - 0x18]
xor cl, 0x3c
mov byte [ebp + eax - 0x94], cl
inc eax
cmp eax, 9
jl 0x10004e21
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push esi
lea edx, [ebp - 0x94]
push 0xffffffffffffffff
push edx
push esi
push esi
mov byte [ebp + eax - 0x94], 0
call ebx
mov edi, eax
dec edi
push edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x10004e74
push edi
push esi
lea eax, [ebp - 0x94]
push 0xffffffffffffffff
push eax
push 0
push 0
call ebx
mov dword [ebp - 0x30], esi
mov ebx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
push edx
push esi
mov eax, dword [ebx + 0x364]
mov byte [ebp - 4], 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 8
lea eax, [ebp - 0x28]
push 0
lea ecx, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dl, byte [0x100171bc]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x493]
mov byte [ebp - 0x494], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x494]
mov ecx, ebx
push eax
call fcn.10005120
mov eax, dword [ebp - 0x20]
test eax, eax
mov ebx, eax
je 0x10004f5e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10012250
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
je 0x10004f5e
mov eax, str.true
mov dl, byte [esi]
mov bl, byte [eax]
mov cl, dl
cmp dl, bl
jne 0x10004f44
test cl, cl
je 0x10004f40
mov dl, byte [esi + 1]
mov bl, byte [eax + 1]
mov cl, dl
cmp dl, bl
jne 0x10004f44
add esi, 2
add eax, 2
test cl, cl
jne 0x10004f1c
xor eax, eax
jmp 0x10004f49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10004f5e
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 1
jmp 0x10004f6a
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x4a0]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov al, byte [0x100171bc]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0x13]
cmp al, 0x5c
je 0x100061c3
cmp al, 0x2f
je 0x100061c3
mov edi, 0x1001636c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x124]
mov ebx, dword [esp + 0x120]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, dword [sym.imp.MSVCRT.dll_rand]
mov dword [esp + 0x10], 1
push ebx
call edi
push eax
call edi
push eax
lea eax, [esp + 0x20]
push eax
push str._s_04X_04X._s
push esi
call ebp
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000622a
mov eax, dword [esp + 0x10]
mov ecx, eax
inc eax
cmp ecx, 0x3e8
mov dword [esp + 0x10], eax
jle 0x100061e5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret 0x10
mov eax, dword [esp + 0x128]
test eax, eax
je 0x1000625a
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1000625a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret 0x10
Function at 0x10008580
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebx - 1]
cmp al, 0x5c
je 0x100085b4
cmp al, 0x2f
je 0x100085b4
mov byte [ecx + ebx], 0x5c
mov byte [ecx + ebx + 1], 0
mov edi, str.luocpcs.axz
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 4

Function at 0x100087b0
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.ClickSymbole
push 0
mov esi, ecx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ecx, dword [esp + 8]
mov dword [esi + 0x2f0], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret 4

Function at 0x100089a0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Get geographical location

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebx - 1]
cmp al, 0x5c
je 0x100089d4
cmp al, 0x2f
je 0x100089d4
mov byte [ecx + ebx], 0x5c
mov byte [ecx + ebx + 1], 0
mov edi, str.temp
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10008a13
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, 0x1001636c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.CityMx.dat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 4
Function at 0x10008a70
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebx - 1]
cmp al, 0x5c
je 0x10008aa4
cmp al, 0x2f
je 0x10008aa4
mov byte [ecx + ebx], 0x5c
mov byte [ecx + ebx + 1], 0
mov edi, str.W3xia.SRG
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 4

Function at 0x10008d20
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2050c
call fcn.10012250
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x3fff
xor eax, eax
lea edi, [esp + 0x10519]
mov byte [esp + 0x10518], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3fff
xor eax, eax
lea edi, [esp + 0x519]
mov byte [esp + 0x518], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], esi
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp ebx, dword [esi + 8]
je 0x10008e20
push ebp
lea ebp, [ebx + 0x315]
mov al, byte [0x100171bc]
mov ecx, 0xff
mov byte [esp + 0x11c], al
xor eax, eax
lea edi, [esp + 0x11d]
lea edx, [ebp - 0x100]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x10b]
stosb byte es:[edi], al
push ecx
push ebp
lea eax, [ebp - 0x20b]
push edx
push eax
lea ecx, [ebp - 0x215]
push ebx
push ecx
lea edx, [esp + 0x134]
push str._s_t_s_t_s_t_s_t_s_t_s_n
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x13c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x20
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1051c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
mov ecx, edx
and ecx, 3
add ebx, 0x31d
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 8]
add ebp, 0x31d
cmp ebx, ecx
jne 0x10008d7c
mov esi, eax
pop ebp
lea ecx, [esp + 0x10518]
push 0
lea edx, [esp + 0x51c]
push ecx
push edx
call fcn.1000fb20
mov al, byte [0x100171bc]
mov ecx, 0x40
mov byte [esp + 0x20], al
xor eax, eax
lea edi, [esp + 0x21]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
stosb byte es:[edi], al
call fcn.100089a0
push 0
push 0x80
push 2
push 0
push 0
lea edx, [esp + 0x28]
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10008eba
lea eax, [esp + 0x10]
push 0
push eax
lea edi, [esp + 0x520]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
push ecx
lea ecx, [esp + 0x524]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x2050c
ret
Function at 0x10009370
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x508
push ebx
push ebp
mov ebp, ecx
push esi
push edi
push 0xffffffffffffffff
mov eax, dword [ebp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov cl, byte [0x100171bc]
xor eax, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
lea edi, [esp + 0x15]
mov byte [esp + 0x118], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x119]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
mov ecx, ebp
stosb byte es:[edi], al
call fcn.10008580
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
lea eax, [esp + 0x28]
push SysReAllocStringLen
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x10009451
lea ebx, [ebp + 0x2f8]
mov ecx, ebp
push ebx
call fcn.10009720
push 0
push 0x8000080
push 2
push 0
push 0
lea ecx, [esp + 0x28]
push 0x40000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x100094a5
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push edx
push ecx
push ebx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100094a5
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x120]
push 0x400
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp + 0x2f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x508
ret
Function at 0x100094c0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x110c
call fcn.10012250
push ebx
push ebp
mov ebp, dword [esp + 0x1118]
push esi
mov ebx, ecx
push edi
mov ecx, 0xb8
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov al, byte [0x100171bc]
mov ecx, 0x40
mov byte [esp + 0x18], al
xor eax, eax
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
stosb byte es:[edi], al
call fcn.10008a70
push 0
push 0x80
push 3
push 0
push 0
lea edx, [esp + 0x2c]
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000954b
mov ecx, 0xb8
xor eax, eax
mov edi, ebp
push ebp
rep stosd dword es:[edi], eax
mov ecx, ebx
call fcn.10009790
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110c
ret 4
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x124]
push 0x1000
push ecx
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x11c]
push edx
push eax
call fcn.1000fd20
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ebx
mov dword [esp + 0x14], ecx
mov eax, ebx
mov byte [esp + ecx + 0x11c], 0x7c
js 0x100096ea
mov edi, dword [sym.imp.MSVCRT.dll_strncpy]
cmp byte [esp + eax + 0x11c], 0x7c
jne 0x100095da
inc eax
cmp byte [esp + esi + 0x11c], 0x7c
jne 0x100096e1
cmp esi, eax
jle case.default.0x100095f9
cmp ebx, 9
ja case.default.0x100095f9
jmp dword [ebx*4 + 0x100096f8]
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
push ecx
push edx
push ebp
jmp 0x100096d5
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x200]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x220]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x230]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x250]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x260]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x280]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x290]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x2a0]
push ecx
push edx
jmp 0x100096d4
mov ecx, esi
lea edx, [esp + eax + 0x11c]
sub ecx, eax
lea eax, [ebp + 0x2c0]
push ecx
push edx
push eax
call edi
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov eax, esi
inc ebx
inc esi
cmp esi, ecx
jle 0x100095cf
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110c
ret 4