joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a060
Capabilities:
Copy file
Delete file
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x1ebc6b
xor ebp, ebp
push 0x40
mov esi, eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebp
push ebp
push 3
push ebp
push 3
push 0xc0000000
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
add edi, 1
je 0x1000a1cb
push ebp
dec edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 8
jb 0x1000a1b2
mov eax, dword [esp + 0x20]
push ebp
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1000a1b6
push ebp
push ebp
push 0x44
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea ecx, [esp + 0x18]
push ecx
push 0x1ebc6b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], ebp
je 0x1000a195
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov cl, byte [eax]
mov ebp, 0x10
mov edx, 0x101e0640
mov esi, 0x101e0660
mov al, byte [edx]
xor al, cl
inc edx
mov byte [esi], al
rol cl, 1
inc esi
sub ebp, 1
jne 0x1000a103
mov eax, dword [esp + 0x14]
shr eax, 3
mov ebp, eax
test eax, eax
je 0x1000a130
mov esi, ebx
push esi
push esi
call fcn.10009f70
add esi, 8
sub ebp, 1
jne 0x1000a121
mov ebp, dword [esp + 0x20]
push 0
push 0x80
push 3
push 0
push 1
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000a16d
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push 0
push 0
push 0x44
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov dword [esp + 0x10], ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x1000a2d0
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push esi
push edi
mov esi, eax
push esi
xor edi, edi
call ebx
test eax, eax
je 0x1000a32b
push str..HELLO
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000a32b
push eax
push 0x80
push 3
push eax
push 3
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000a32b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 8
jb 0x1000a324
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x1000a340
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
push str..Israbye.Israbye.Israbye.Israbye.Israbye.Israbye.Israbye
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000a3bf
mov ecx, dword [esp + 0x14]
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000a3bf
lea edx, [esp + 8]
push edx
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], 0
jl 0x1000a3bf
jg 0x1000a3b6
cmp dword [esp + 8], 0
jbe 0x1000a3bf
mov al, 1
pop esi
add esp, 0xc
ret 4
xor al, al
pop esi
add esp, 0xc
ret 4

Function at 0x1000a3d0
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x40c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x410]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
mov esi, ecx
xor bl, bl
call edi
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1000a4f7
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push esi
call edi
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, 0xffffffff
je 0x1000a4f0
push 0x3ff
xor esi, esi
lea eax, [esp + 0x1d]
push esi
push eax
mov byte [esp + 0x24], bl
call fcn.100d4cc0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push esi
lea ecx, [esp + 0x14]
push ecx
push 0x400
lea edx, [esp + 0x24]
push edx
push ebp
mov dword [esp + 0x24], esi
call ebx
test eax, eax
je 0x1000a4e7
mov edi, dword [esp + 0x10]
test edi, edi
jbe 0x1000a4e3
xor ecx, ecx
test edi, edi
jbe 0x1000a4ab
mov al, byte [esi + str.AaBbCcDdEeFfGg1234567890_MF1234567890_]
xor byte [esp + ecx + 0x18], al
inc esi
mov eax, 0x9435e50d
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x26
inc ecx
add esi, eax
cmp ecx, edi
jb 0x1000a485
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x400
lea edx, [esp + 0x24]
push edx
push ebp
mov dword [esp + 0x24], 0
call ebx
test eax, eax
jne 0x1000a477
mov edi, dword [esp + 0x14]
push edi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x418]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x40c
ret 4
Function at 0x1000a520
Capabilities:
Get file size

Disassembly:
sub esp, 0x18
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1000a5da
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push esi
call edi
test eax, eax
je 0x1000a5da
push str..keypass
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
call ebx
test eax, eax
je 0x1000a570
push str..DATAWAIT
push esi
call edi
push eax
call ebx
test eax, eax
jne 0x1000a5da
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000a5b3
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], 0
jl 0x1000a5da
jg 0x1000a5c3
cmp dword [esp + 0x10], 0
jbe 0x1000a5da
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100d0738
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100d0738
add esp, 0x18
ret
Function at 0x1000a900
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
sub esp, 0x90
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
xor edi, edi
push str.C:_WinTMPFiles
mov dword [ebp + 0x30], edi
call esi
test eax, eax
je 0x1000aae3
push str.C:_WinTMPLogs.Win
call esi
test eax, eax
je 0x1000aae3
xor eax, eax
push 0x2f
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov word [esp + 0x4d], ax
mov byte [esp + 0x4f], al
mov byte [esp + 0x50], al
lea eax, [esp + 0x51]
push edi
push eax
mov byte [esp + 0x38], 0
call fcn.100d4cc0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0xc
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push str.C:_WinTMPLogs.Win
mov byte [esp + 0x40], 1
mov byte [esp + 0x41], 2
mov byte [esp + 0x42], 3
mov byte [esp + 0x43], 4
mov byte [esp + 0x44], 5
mov byte [esp + 0x45], 6
mov byte [esp + 0x46], 7
mov byte [esp + 0x47], 8
call ebx
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x1000aae3
push edi
lea ecx, [esp + 0x14]
push ecx
push 0x19
lea edx, [esp + 0x38]
push edx
push esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000aadc
cmp dword [esp + 0x10], 0x19
jne 0x1000aadc
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x30]
push 0x19
push ecx
call fcn.10071c40
lea edx, [esp + 0x58]
push edx
push 0x30
push 0x3e8
push 8
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call fcn.10071fe0
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
add esp, 0x28
mov ecx, 8
lea esi, [esp + 0x4c]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x74]
xor edi, edi
push edi
push 0x80
push 3
push edi
mov dword [ebp + 0x20], edx
mov edx, dword [esp + 0x88]
push 1
mov dword [ebp + 0x24], eax
push SysReAllocString
mov dword [ebp + 0x28], ecx
push str.C:_WinTMPFiles
mov dword [ebp + 0x2c], edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1000aad8
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [esp + 0x18]
add ecx, 2
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 0x30], eax
cmp eax, edi
je 0x1000aad1
mov ecx, dword [esp + 0x18]
push edi
lea edx, [esp + 0x14]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [ebp + 0x34], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x90
ret 4
Function at 0x1000ab00
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
cmp byte [eax + 0x34], 0
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
je 0x1000abe3
test ebp, ebp
je 0x1000abe3
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebp
push 0
push 0xfde9
call ebx
mov esi, eax
test esi, esi
je 0x1000abe3
lea ecx, [esi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x1000abe3
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebp
push 0
push 0xfde9
call ebx
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x30]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000abdc
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000abbb
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], ebx
jl 0x1000abdc
jg 0x1000abc9
cmp dword [esp + 0x10], ebx
jbe 0x1000abdc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
Function at 0x1000b140
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
push edi
test esi, esi
je 0x1000b1bc
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push esi
call edi
test eax, eax
je 0x1000b1bc
push str..Lime
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000b1bc
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000b1a4
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], 0
jl 0x1000b1bc
jg 0x1000b1b4
cmp dword [esp + 8], 0
jbe 0x1000b1bc
mov al, 1
pop edi
pop esi
add esp, 0xc
ret
pop edi
xor al, al
pop esi
add esp, 0xc
ret
Function at 0x1000b460
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, eax
push edi
test esi, esi
je 0x1000b569
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jle 0x1000b569
push esi
mov ebp, 0xa
mov edi, str.Lock.
call ebx
jmp 0x1000b4a0
mov ecx, dword [eax]
cmp ecx, dword [edi]
jne 0x1000b569
sub ebp, 4
add edi, 4
add eax, 4
cmp ebp, 4
jae 0x1000b4a0
mov dl, byte [edi]
cmp dl, byte [eax]
jne 0x1000b569
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x1000b569
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.Lock.
call ebp
mov edi, eax
push esi
add edi, edi
call ebx
add eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x1000b569
push str.Lock.
call ebp
mov edi, eax
push esi
add edi, edi
call ebx
add eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [eax], 0x2e
jne 0x1000b569
push str.Lock.
call ebp
push esi
call ebx
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000b551
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], edi
jl 0x1000b569
jg 0x1000b55f
cmp dword [esp + 0x10], edi
jbe 0x1000b569
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x1000b830
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x188
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov eax, dword [esp + 0x190]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ebx, ecx
push ebx
push 0
push 0
mov dword [esp + 0x38], eax
mov byte [esp + 0x37], 0
call ebp
mov edi, eax
test edi, edi
jne 0x1000b87e
xor al, al
jmp 0x1000b9d4
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1000b877
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
call ebp
mov eax, esi
call fcn.10047160
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
je 0x1000b9c5
mov edx, dword [edi + 0x40]
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x38]
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0x44]
mov dword [esp + 0x2c], edx
test eax, eax
ja 0x1000b8d7
test ecx, ecx
jbe 0x1000b9b7
push 0x200
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x38]
push 0
push ecx
mov eax, edi
call fcn.10047630
add esp, 0x10
test eax, eax
jne 0x1000b9b7
mov ebx, edi
call fcn.10047d50
test eax, eax
jne 0x1000b9b7
mov edx, dword [esp + 0x18]
push eax
push 0x80
push 2
push eax
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000b9b2
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1000b9ab
push 0x1000
push 0
push esi
call fcn.100d4cc0
add esp, 0xc
push esi
push edi
call fcn.10048020
add esp, 8
mov dword [esp + 0x1c], eax
test eax, eax
jl 0x1000b9a4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x1000b99f
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push esi
push ebx
call ebp
push 0x1000
push 0
push esi
call fcn.100d4cc0
add esp, 0xc
push esi
push edi
call fcn.10048020
add esp, 8
mov dword [esp + 0x1c], eax
test eax, eax
jge 0x1000b96d
jmp 0x1000b9a4
mov byte [esp + 0x17], 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10048340
mov eax, edi
call fcn.10047580
cmp byte [esp + 0x17], 0
jne 0x1000b9d0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x188
ret 4
Function at 0x1000bd50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push 0x40
push 0
push esi
call fcn.100d4cc0
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esi + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x2c], ecx
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x30], edx
mov edx, dword [edi]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 4]
add esp, 0xc
mov dword [esi], 0x61707865
mov dword [esi + 0x14], 0x3320646e
mov dword [esi + 0x28], 0x79622d32
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], 0x6b206574
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
ret
Function at 0x1000c1a0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push esi
push edi
push 0xf0000000
push 1
xor esi, esi
push esi
mov edi, eax
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1000c1f0
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push esi
push esi
push 0x8003
push edx
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
test eax, eax
jne 0x1000c1fa
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push 0x25
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
mov eax, dword [esp + 8]
jne 0x1000c231
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 0xc]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
add esp, 0xc
ret 4
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push esi
lea edx, [esp + 0x18]
push edx
push esi
push 2
push eax
mov dword [esp + 0x28], esi
call ebp
test eax, eax
jne 0x1000c26e
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebp
pop edi
xor al, al
pop esi
add esp, 0xc
ret 4
mov eax, dword [esp + 0x14]
push ebx
push eax
call fcn.100d279b
mov edx, dword [esp + 0x14]
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x1000c323
push esi
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 2
push edx
call ebp
test eax, eax
je 0x1000c300
push 0x33
push esi
push edi
call fcn.100d4cc0
add esp, 0xc
cmp dword [esp + 0x18], esi
jbe 0x1000c2d4
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
movzx eax, byte [esi + ebx]
push eax
push str._.2X
push edi
call ebp
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add edi, eax
cmp esi, dword [esp + 0x18]
jb 0x1000c2b2
xor esi, esi
push ebx
call fcn.100d1800
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [esp + 0x14]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebx
pop ebp
pop edi
mov al, 1
pop esi
add esp, 0xc
ret 4
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 0x14]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebx
pop ebp
pop edi
xor al, al
pop esi
add esp, 0xc
ret 4
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebx
pop ebp
pop edi
xor al, al
pop esi
add esp, 0xc
ret 4
Function at 0x1000c730
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1000c761
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
xor ecx, ecx
add eax, 0xa
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100cf8cb
add esp, 4
push esi
mov ebx, eax
call edi
lea eax, [eax + eax + 0x14]
push eax
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
mov byte [esp + 0x13], 0
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
cmp eax, 2
jle 0x1000c8d3
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
cmp eax, 2
jle 0x1000c8d3
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c8d3
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1000c8cc
mov ecx, dword [esp + 0x14]
cmp ecx, edi
jl 0x1000c8cc
mov eax, dword [esp + 0x10]
jg 0x1000c830
cmp eax, 0x4e
jbe 0x1000c8cc
push edi
add eax, 0xffffffda
push edi
adc ecx, 0xffffffff
push ecx
push eax
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
push edi
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov byte [esp + 0x49], al
push 0x26
lea eax, [esp + 0x28]
push eax
push esi
mov byte [esp + 0x30], 0
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x18], 0x26
jne 0x1000c8cc
mov edx, 0x26
mov eax, str.36A698B9_D67C_4E07_BE82_0EC5B14B4DF5
lea ecx, [esp + 0x1c]
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x1000c8cc
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x1000c8a5
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000c8cc
mov al, byte [eax + 1]
cmp al, byte [ecx + 1]
jne 0x1000c8cc
mov byte [esp + 0xf], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.100d072d
mov ecx, dword [esp + 0x48]
mov al, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret