joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024dc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ea85
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x10088014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x1008a2c0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1008ac00]
cmp eax, dword [edx + 4]
jle 0x10024e3c
push 0x1008ac00
call fcn.10045866
add esp, 4
cmp dword [0x1008ac00], 0xffffffff
jne 0x10024e3c
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
push 0x1008ac00
mov dword [0x1008ac08], eax
mov dword [0x1008ac0c], ecx
call fcn.1004581c
add esp, 4
mov ecx, dword [0x1008ac0c]
test ecx, ecx
jl 0x10024f7b
mov esi, dword [0x1008ac08]
jg 0x10024e5b
cmp esi, 2
jb 0x10024f7b
mov eax, dword [edi + 0x28]
cdq
sub eax, esi
sbb edx, ecx
sub eax, 1
sbb edx, 0
mov dword [ebp - 0x2c], edx
js 0x10024f7b
jg 0x10024e7c
test eax, eax
jb 0x10024f7b
push eax
lea eax, [ebp - 0x60]
push eax
lea ecx, [edi + 0x30]
call fcn.100263c0
mov esi, eax
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x30]
call fcn.10026d40
push esi
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10025bc0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x10024ee9
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10024edf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10024f96
push edx
push ecx
call fcn.10045702
add esp, 8
mov edx, dword [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
cmp edx, 8
jb 0x10024f33
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10024f29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10024f96
push edx
push ecx
call fcn.10045702
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10024f7b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10024f71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10024f9b
push edx
push ecx
call fcn.10045702
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100456c4
mov esp, ebp
pop ebp
ret
call fcn.100503fe
call fcn.100503fe
int3
Function at 0x10025310
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10088014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov dword [ebp - 8], ecx
push ebx
push esi
mov ebx, dword [eax]
mov dword [ebp - 0xc], ebx
push edi
mov edi, dword [ebp + 8]
cmp edx, 8
jne 0x10025341
cmp dword [ecx + 8], 2
je 0x10025341
or ebx, 2
mov dword [ebp - 0xc], ebx
mov esi, dword [ecx + 4]
test esi, esi
je 0x100253d4
cmp dword [esi], 0
je 0x100253d4
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008a2c0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1008abc8]
cmp eax, dword [ecx + 4]
jle 0x100253a4
push 0x1008abc8
call fcn.10045866
add esp, 4
cmp dword [0x1008abc8], 0xffffffff
jne 0x100253a4
mov al, byte [esi + 1]
sub al, byte [esi + 3]
sub al, byte [esi + 2]
add al, byte [esi]
push 0x1008abc8
mov byte [0x1008abcc], al
call fcn.1004581c
add esp, 4
movzx ecx, word [edi]
mov esi, edi
mov edx, edi
test cx, cx
je 0x100253ce
mov bl, byte [0x1008abcc]
add esi, 2
lea edx, [edx + 1]
xor cl, bl
mov byte [edx - 1], cl
movzx eax, word [esi]
mov cl, al
test ax, ax
jne 0x100253b6
mov ebx, dword [ebp - 0xc]
sub esi, edi
sar esi, 1
jmp 0x100253d6
xor esi, esi
test bl, 1
je 0x100253e2
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, 2
je 0x10025401
test esi, esi
je 0x100253f7
mov ecx, dword [ebp - 8]
push esi
push edi
call fcn.10024b00
jmp 0x10025401
push ecx
mov ecx, dword [ebp - 8]
push edi
call fcn.10024fb0
test bl, 4
je 0x1002548f
mov esi, dword [0x1008ab44]
mov edx, dword [esi]
cmp edx, 0xffffffff
jne 0x10025460
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [esi + 4]
add ecx, 0x2710
cmp eax, ecx
jbe 0x1002548f
mov edx, dword [esi]
cmp edx, 0xffffffff
jne 0x10025460
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
push str..GlobalProcmonDebugLogger
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edx, dword [esi]
mov dword [esi + 4], eax
cmp edx, 0xffffffff
je 0x1002548f
mov ecx, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10025465
push 0
sub ecx, esi
lea eax, [ebp - 8]
push eax
push 0
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
push edi
push 0x95358204
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test bl, 8
je 0x1002549a
push edi
call fcn.10025170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100456c4
mov esp, ebp
pop ebp
ret
Function at 0x10026a50
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10026ae8
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x10026a6d
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x10026a81
push 0x5c
mov ecx, esi
call fcn.10026920
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10026a86
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.10026790
mov ecx, dword [esi + 0x14]
mov edx, esi
cmp ecx, 8
jb 0x10026aaa
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
cmp word [edx + eax*2 - 2], 0x5c
je 0x10026ac1
push 0x5c
mov ecx, esi
call fcn.10026920
mov ecx, dword [esi + 0x14]
mov eax, esi
cmp ecx, 8
jb 0x10026aca
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x10026adb
mov esi, dword [esi]
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
pop edi
pop ebp
ret 8
Function at 0x10027b10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [edx + 4]
push edi
mov edi, ecx
test esi, esi
je 0x10027b90
cmp dword [esi], 0
je 0x10027b90
mov eax, dword fs:[0x2c]
mov edx, dword [0x1008a2c0]
mov ecx, dword [eax + edx*4]
mov eax, dword [0x1008ac6c]
cmp eax, dword [ecx + 4]
jle 0x10027b6f
push 0x1008ac6c
call fcn.10045866
add esp, 4
cmp dword [0x1008ac6c], 0xffffffff
jne 0x10027b6f
mov al, byte [esi + 1]
sub al, byte [esi + 3]
sub al, byte [esi + 2]
add al, byte [esi]
push 0x1008ac6c
mov byte [0x1008ac70], al
call fcn.1004581c
add esp, 4
mov cl, byte [edi]
mov eax, edi
test cl, cl
je 0x10027b8b
mov dl, byte [0x1008ac70]
nop dword [eax]
xor cl, dl
mov byte [eax], cl
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x10027b80
sub eax, edi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x1004627f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push esi
mov byte [ebp - 0x44], 0x4d
mov byte [ebp - 0x43], 0x59
mov byte [ebp - 0x42], 0x47
mov byte [ebp - 0x41], 0x21
mov byte [ebp - 0x40], 0x39
mov byte [ebp - 0x3f], 0x43
mov byte [ebp - 0x3e], 0x4b
mov byte [ebp - 0x3d], 0x79
mov byte [ebp - 0x3c], 0x2b
invalid

Function at 0x1004692f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
cmp dword [edx + ecx + 0x78], 0
jne 0x10046960
xor eax, eax
jmp 0x100469f4
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], 0
jmp 0x10046990

Function at 0x10046caf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
or byte [ebx], al
push ecx
and byte [ecx + 0x458bec55], cl
clc

Function at 0x1005c192
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10076f90
push 0x10076f88
push str.FlsAlloc
push 0x1e
call fcn.1005bfff
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005c1c6
push dword [ebp + 8]
mov ecx, esi
call dword [0x10072204]
call esi
jmp 0x1005c1cc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1005c210
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10076fa0
push 0x10076f98
push str.FlsGetValue
push 0x20
call fcn.1005bfff
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005c247
push dword [ebp + 8]
mov ecx, esi
call dword [0x10072204]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1006372c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100637c9
push ebx
push esi
call fcn.100636f5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10061e2b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10063776
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100637c8
push edi
push eax
call fcn.1005c72c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10063796
call fcn.1005bd24
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100637c7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10061e2b
add esp, 0x20
test eax, eax
jne 0x100637b5
push edi
call fcn.1005bd24
jmp 0x100637bd
push ebx
call fcn.1005bd24
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100637cc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100637dd
pop esi
ret
push ebx
push edi
push esi
call fcn.100636f5
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1005c72c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10063805
push ebx
push esi
push edi
call fcn.100473e0
add esp, 0xc
push 0
call fcn.1005bd24
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10063bc9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006381a
Function at 0x10068340
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1008a640]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10068380
cmp byte [ebx], 0xa
jne 0x10068380
or byte [eax + edi + 0x28], 4
jmp 0x10068385
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10068483
mov al, byte [edx]
cmp al, 0x1a
je 0x10068465
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x100683b4
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x100683d9
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x100683e3
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x10068396
jmp 0x10068483
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10068460
cmp dword [ebp - 0xc], 0
je 0x10068460
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1008a640]
test byte [eax + edi + 0x28], 0x48
je 0x1006843a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10068425
mov byte [esi], dl
jmp 0x10068436
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1008a640]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10068483
cmp byte [ebp - 1], 0xa
jne 0x10068449
cmp esi, ebx
jne 0x10068449
mov byte [esi], 0xa
jmp 0x10068482
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10063f37
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10068483
mov byte [esi], 0xd
jmp 0x10068482
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1008a640]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1006847f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10068483
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1006848c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1008a640]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100684cf
cmp word [esi], dx
jne 0x100684cf
or byte [edi + eax + 0x28], 4
jmp 0x100684d4
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x10068627
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10068607
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10068516
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1006854c
cmp eax, edx
jae 0x10068558
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x100684ee
jmp 0x10068627
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10068603
cmp dword [ebp - 0x14], 0
je 0x10068603
mov eax, dword [ebx*4 + 0x1008a640]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x100685db
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x100685a4
mov word [esi], cx
jmp 0x100685d7
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1008a640]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1008a640]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1008a640]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x10068627
pop ebx
cmp word [ebp - 4], bx
jne 0x100685ec
cmp esi, dword [ebp + 0xc]
jne 0x100685ec
mov word [esi], bx
jmp 0x10068624
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10063f37
add esp, 0x10
cmp word [ebp - 4], bx
je 0x10068627
push 0xd
jmp 0x10068620
mov ecx, dword [ebx*4 + 0x1008a640]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1006861e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10068627
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100698e1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10069752

Function at 0x1006ae7b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1006adf7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1006aff3
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1006aff3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1006afa2
jg 0x1006aed4
test eax, eax
je 0x1006af98
push 1
push 0x1000
call fcn.1005bcc1
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1006aefa
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1006af8f
push 0x8000
push ebx
call fcn.1006ad28
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1006af26
jg 0x1006af21
cmp ecx, 0x1000
jb 0x1006af26
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1005e1b0
add esp, 0x10
cmp eax, 0xffffffff
je 0x1006af6b
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1006af21
jl 0x1006af52
test ecx, ecx
jne 0x1006af13
push dword [ebp - 0xc]
push ebx
call fcn.1006ad28
push esi
call fcn.1005bd24
add esp, 0xc
xor edi, edi
jmp 0x1006b004
cmp byte [edi + 0x24], 0
je 0x1006af82
cmp dword [edi + 0x20], 5
jne 0x1006af82
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1006af8d
mov edi, dword [edi + 0x18]
jmp 0x1006af8f
xor edi, edi
push esi
call fcn.1005bd24
pop ecx
jmp 0x1006b004
test ecx, ecx
jg 0x1006af64
jl 0x1006afa2
test eax, eax
jae 0x1006af64
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10063f37
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1006afc5
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1006af64
jmp 0x1006affc
push ebx
call fcn.1004a51c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1006af64
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1006b004
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1006b001
mov edi, dword [edi + 0x18]
jmp 0x1006b004
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10063f37
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405f04
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422254], 0
push esi
jne 0x405f3b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f15
mov dword [ecx*4 + 0x422250], eax
inc ecx
cmp ecx, 0x100
jl 0x405f10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f6c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422250]
xor eax, esi
inc ecx
dec edx
jne 0x405f4e
pop edi
not eax
pop esi
ret 0xc

Function at 0xef6000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xef600a
jmp 0xef800f
jmp fcn.00a98058
Function at 0x4012b0
Capabilities:
Get common file path

Disassembly:
push esi
push edi
push 2
push 0x104
xor edi, edi
call fcn.00405988
mov esi, eax
add esp, 8
test esi, esi
je 0x4012f6
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
mov edi, eax
call fcn.004058b6
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x401300
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x410a98]
push esi
xor esi, esi
push eax
push esi
push 0x40d03c
call fcn.004012b0
mov eax, dword [0x410a98]
add esp, 0xc
cmp word [eax], si
je 0x40134f
push eax
call fcn.00405a39
mov ecx, dword [0x410a98]
add esp, 4
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40134f
mov edx, dword [0x410a98]
push edx
call fcn.00401000
add esp, 4
mov eax, esi
pop esi
ret
mov eax, 4
pop esi
ret

Function at 0x401360
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push esi
push edi
push 1
push 0x250
call fcn.00405988
push 2
push 0x104
mov edi, eax
call fcn.00405988
add esp, 0x10
mov esi, eax
test edi, edi
je 0x40144a
test esi, esi
je 0x40144a
mov eax, dword [esp + 0x10]
push ebp
push eax
push esi
call fcn.0040577a
push esi
call fcn.00401000
push esi
call fcn.0040579f
lea ecx, [esi + eax*2]
push 0x40d050
push esi
mov dword [esp + 0x24], ecx
call fcn.00405750
add esp, 0x18
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40142e
push ebx
lea ebx, [edi + 0x2c]
push 0x40d04c
push ebx
call fcn.00405a63
add esp, 8
test eax, eax
je 0x40141a
push 0x40d044
push ebx
call fcn.00405a63
add esp, 8
test eax, eax
je 0x40141a
mov edx, dword [esp + 0x10]
push ebx
push edx
call fcn.0040577a
mov al, byte [edi]
add esp, 8
test al, 0x10
push esi
je 0x401412
call fcn.00401360
jmp 0x401417
call fcn.00405a39
add esp, 4
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4013d2
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0040577a
push esi
call fcn.00401030
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop ebp
push esi
call fcn.004058b6
push edi
call fcn.004058b6
add esp, 8
pop edi
pop esi
pop ecx
ret
Function at 0x401dd0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401e07
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x26
pop esi
neg eax
sbb eax, eax
add eax, 0x40000002
ret 0xc
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x401e19
mov eax, 0x40000001
pop esi
ret 0xc
sub eax, esi
pop esi
neg eax
sbb eax, eax
and eax, 0x40000002
ret 0xc

Function at 0x401e70
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401ea7
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x70
pop esi
neg eax
sbb eax, eax
add eax, 0x40000004
ret 0xc
mov eax, dword [esp + 0x10]
sub eax, esi
pop esi
neg eax
sbb eax, eax
and eax, 0x40000004
ret 0xc