joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003094
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
mov ecx, dword [0x10020be0]
mov eax, dword [0x10020be4]
add ecx, 0x3c
mov edx, dword [0x10020c2c]
push ebx
mov ebx, dword [0x10020c28]
adc eax, 0
mov dword [ebp - 8], edx
push esi
push edi
cmp edx, eax
jl 0x100031b7
jg 0x100030d3
cmp ebx, ecx
jbe 0x100031b7
xor edi, edi
mov dword [0x10020be0], ebx
mov dword [0x10020be4], edx
cmp dword [0x10020be8], edi
jbe 0x100031b7
xor esi, esi
mov eax, dword [0x10020bec]
cmp dword [esi + eax], 0
je 0x1000319b
mov edx, dword [esi + eax + 0x18]
test edx, edx
je 0x10003113
call fcn.1000be6c
test eax, eax
jne 0x1000319b
mov ecx, dword [0x10020bec]
cmp dword [esi + ecx + 4], 0
je 0x10003127
cmp dword [esi + ecx + 0x1c], 0
je 0x10003145
mov eax, dword [esi + ecx]
test eax, eax
jle 0x1000319b
imul eax, eax, 0x3c
cdq
add eax, dword [esi + ecx + 0x10]
adc edx, dword [esi + ecx + 0x14]
cmp edx, dword [ebp - 8]
jg 0x1000319b
jl 0x10003145
cmp eax, ebx
ja 0x1000319b
cmp dword [esi + ecx + 0xc], 0
je 0x10003166
push 4
lea eax, [ebp - 0x14]
push eax
push 0x5a
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [0x10020bec]
call dword [esi + eax + 0xc]
jmp 0x10003178
push 0
push 0
push 0
push dword [esi + ecx + 8]
call fcn.10002170
add esp, 0x10
mov eax, dword [0x10020bec]
mov ecx, dword [ebp - 8]
mov dword [esi + eax + 0x10], ebx
mov dword [esi + eax + 0x14], ecx
xor ecx, ecx
mov eax, dword [0x10020bec]
inc ecx
mov dword [esi + eax + 0x1c], ecx
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1000319e
mov eax, dword [ebp - 4]
inc edi
add esi, 0x20
cmp edi, dword [0x10020be8]
jb 0x100030ef
test eax, eax
je 0x100031b7
call fcn.100033a9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003544
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, edx
lea edx, [ebp - 0x28]
push esi
mov esi, ecx
push ecx
mov ecx, eax
call fcn.1000d585
pop ecx
mov ecx, esi
call fcn.1000da3a
test eax, eax
je 0x100035de
push 0x28f
call fcn.1000109a
mov dword [esp], 0x104
lea ecx, [ebp - 0x230]
push ecx
mov dword [ebp - 8], eax
push eax
mov eax, dword [0x10020b58]
call dword [eax + 0xec]
test eax, eax
jne 0x1000359d
call fcn.1000351c
mov esi, eax
jmp 0x100035d2
push 0x4a5
call fcn.1000109a
push 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
push ecx
mov ecx, str.__b
push ecx
push eax
push ecx
lea eax, [ebp - 0x230]
push eax
call fcn.1000a0b8
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.100093e4
add esp, 0x20
lea eax, [ebp - 8]
push eax
call fcn.100093e4
pop ecx
jmp 0x10003646
push 0x104
lea edx, [ebp - 0x438]
mov ecx, esi
call fcn.1000345d
pop ecx
test eax, eax
je 0x1000363f
lea edx, [ebp - 0x230]
call fcn.1000d118
push 0x4a5
call fcn.1000109a
push 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 8], eax
push ecx
mov ecx, str.__b
push ecx
push eax
push ecx
lea eax, [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x438]
push eax
call fcn.1000a0b8
mov esi, eax
lea eax, [ebp - 8]
push eax
call fcn.100093e4
add esp, 0x28
jmp 0x10003646
call fcn.1000351c
mov esi, eax
mov ecx, esi
mov dword [ebp - 4], esi
call fcn.1000d36f
test eax, eax
jne 0x1000367b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1000366b
mov ecx, esi
call fcn.1000d36f
test eax, eax
jne 0x1000367b
lea eax, [ebp - 4]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
mov esi, dword [ebp - 4]
pop ecx
pop ecx
mov eax, esi
pop esi
leave
ret
Function at 0x10006369
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
lea edx, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.1000ce7d
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x1000638f
push 0xfffffffffffffffe
pop esi
jmp 0x100064dc
mov edx, esi
mov eax, dword [0x10020b5c]
mov ecx, edx
and ecx, 0x1f
mov al, byte [ecx + eax + 0x1858]
xor byte [edx + ebx], al
inc edx
cmp edx, 0x20
jb 0x10006391
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.1000e685
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x100063cb
or esi, 0xffffffff
jmp 0x100064db
mov ebx, dword [ebp - 4]
mov eax, esi
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x100064b5
mov ecx, dword [edi + eax*4]
lea edx, [ebp - 0x28]
call fcn.1000ccc5
test eax, eax
jne 0x1000647c
push dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
call fcn.1000cc6f
mov dword [0x10020c34], eax
pop ecx
test eax, eax
jne 0x10006420
mov eax, dword [0x10020b58]
push dword [ebp - 0x24]
call dword [eax + 0x30]
mov eax, dword [0x10020b58]
push dword [ebp - 0x28]
call dword [eax + 0x30]
push 0xfffffffffffffffe
jmp 0x1000647b
mov eax, dword [0x10020b5c]
lea edx, [ebp - 0x28]
mov ecx, 0x10006313
push dword [eax + 0x224]
call fcn.1000e8ba
pop ecx
test eax, eax
jne 0x10006457
mov eax, dword [0x10020b58]
push dword [ebp - 0x24]
call dword [eax + 0x30]
mov eax, dword [0x10020b58]
push dword [ebp - 0x28]
call dword [eax + 0x30]
push 0xfffffffffffffffd
jmp 0x1000647b
lea ecx, [ebp - 0x28]
call fcn.1000e9b8
test eax, eax
jne 0x1000648d
mov eax, dword [0x10020b58]
push dword [ebp - 0x24]
call dword [eax + 0x30]
mov eax, dword [0x10020b58]
push dword [ebp - 0x28]
call dword [eax + 0x30]
push 0xfffffffffffffffc
pop esi
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, ebx
jb 0x100063db
jmp 0x1000649d
push dword [ebp - 0x28]
call fcn.10004165
pop ecx
mov dword [ebp - 0x10], 1
mov ebx, dword [ebp - 4]
push 0xfffffffffffffffe
push edi
call fcn.1000ac2f
pop ecx
add edi, 4
pop ecx
sub ebx, 1
jne 0x100064a0
mov ebx, dword [ebp - 4]
shl ebx, 2
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.1000ac2f
cmp dword [ebp - 0x10], 0
pop ecx
pop ecx
jne 0x100064cf
push 0xfffffffffffffffb
pop esi
jmp 0x100064db
mov ecx, dword [0x10020b58]
push dword [ebp - 0x24]
call dword [ecx + 0x30]
pop edi
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
call fcn.1000ac2f
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10006565
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x14
xor edi, edi
call fcn.1000ac19
pop ecx
mov ecx, dword [0x10020b5c]
mov esi, eax
cmp word [ecx + 0x22a], 0x3a
jne 0x100065bb
mov ax, word [ecx + 0x228]
mov word [ebp - 0x20], ax
mov ax, word [ecx + 0x22a]
mov word [ebp - 0x1e], ax
mov ax, word [ecx + 0x22c]
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esi], 2
mov dword [esi + 4], edi
mov eax, dword [0x10020b5c]
mov ecx, dword [eax + 0x224]
mov dword [esi + 8], ecx
call fcn.10002faa
mov dword [esi + 0xc], eax
test eax, eax
je 0x100065ec
push 0x3b
pop edx
mov ecx, eax
call fcn.1000beb7
test eax, eax
jne 0x100065fa
call fcn.10003680
test eax, eax
je 0x100065fa
or edi, 0xffffffff
jmp 0x10006601
mov ecx, esi
call fcn.1000557a
lea ecx, [esi + 0xc]
call fcn.1000bfc5
lea ecx, [esi + 0x10]
call fcn.1000bfc5
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10006674
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov ecx, 0xc63
call fcn.1000abca
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 4]
call fcn.100093d1
call fcn.1000b5fc
test eax, eax
jne 0x100066a4
or eax, 0xffffffff
leave
ret
mov eax, dword [0x10020b5c]
cmp dword [eax + 0xa4], 1
je 0x100066b7
call fcn.1001155a
call fcn.100062cc
call fcn.100067c1
mov dword [0x10020c38], eax
sub eax, 0
je 0x1000671a
sub eax, 1
je 0x10006723
sub eax, 1
je 0x1000673b
sub eax, 1
jne 0x1000673b
mov eax, dword [0x10020b5c]
lea ecx, [ebp - 0x2c]
mov edx, dword [eax + 0xac]
add edx, 4
call fcn.1000c598
lea ecx, [ebp - 0x2c]
call fcn.1000d440
mov ecx, dword [0x10020b5c]
mov edx, 0x1d4c0
mov ecx, dword [ecx + 0xac]
call fcn.10005f2b
mov dword [0x10020b80], eax
call fcn.10006618
jmp 0x10006736
call fcn.10006565
test eax, eax
js 0x1000673b
mov eax, dword [0x10020b5c]
cmp dword [eax + 0xa4], 1
je 0x10006736
call fcn.100112f6
call fcn.1000654b
xor eax, eax
leave
ret
Function at 0x10006b2e
Capabilities:
Check for peb beingdebugged flag
Check if file exists
Encode data using xor
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 1
push esi
jne 0x10006c4e
call fcn.1000ac04
call fcn.10009bef
mov eax, dword [ebp + 8]
push eax
mov dword [0x10020b70], eax
call fcn.100145df
pop ecx
mov eax, dword fs:[0x30]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp byte [eax + 2], 0
je 0x10006b8b
mov eax, esi
mov ecx, 0x80
xor byte [eax + 0x1001f710], 0xb7
inc eax
cmp eax, ecx
jb 0x10006b71
mov eax, esi
xor byte [eax + 0x1001f050], 0xb7
inc eax
cmp eax, ecx
jb 0x10006b7f
push 0xe31
mov edx, 0x13c
mov ecx, 0x1001da78
call fcn.1000ffbd
mov dword [0x10020b58], eax
mov dword [esp], 0x1c2
call fcn.1000abe4
pop ecx
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [ebp + 0xc]
push eax
je 0x10006bce
call fcn.100093e4
pop ecx
xor eax, eax
jmp 0x10006c49
call fcn.100093e4
mov dword [esp], 0x4ce
call fcn.1000109a
pop ecx
mov ecx, eax
call fcn.100104e5
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10006c25
push 0x917
push 0x58
pop edx
mov ecx, 0x1001dbe8
call fcn.1000ffbd
mov dword [0x10020b68], eax
call fcn.100069ad
lea eax, [ebp + 0xc]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
mov eax, dword [0x10020b58]
add esp, 0xc
push 1
call dword [eax + 0xe8]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
mov eax, dword [0x10020b58]
push esi
push esi
push 0x1000684a
push esi
push esi
call dword [eax + 0x74]
mov dword [0x10020b7c], eax
test eax, eax
je 0x10006bca
xor eax, eax
inc eax
pop esi
leave
ret 0xc
cmp dword [ebp + 0xc], 0
jne 0x10006c46
mov eax, dword [0x10020b58]
push 0xaa
call dword [eax + 0xb8]
jmp 0x10006bca
Function at 0x10007787
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa60
push ebx
push edi
xor edi, edi
mov ebx, ecx
and dword [ebp - 0xc], edi
mov eax, edx
and dword [ebp - 8], edi
cmp ebx, 1
je 0x100077b0
cmp ebx, 2
je 0x100077b0
or eax, 0xffffffff
jmp 0x10007957
lea edx, [ebp - 8]
mov ecx, eax
call fcn.1000ce7d
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x100077c9
push 0xfffffffffffffffe
pop eax
jmp 0x10007957
push esi
mov esi, dword [0x10020b5c]
lea eax, [ebp - 0xa60]
push eax
add esi, 0xb0
push 0
push esi
call fcn.1000b431
pop ecx
mov edx, eax
mov ecx, esi
call fcn.1000f226
pop ecx
add eax, ebx
push eax
call fcn.10013e49
lea eax, [ebp - 0xa60]
push eax
push 0xc
lea eax, [ebp - 0x9c]
push 0xa
push eax
call fcn.10009d51
push 0x2e
pop ecx
xor ebx, ebx
mov word [ebp + eax*2 - 0xa4], cx
mov eax, dword [0x10020b5c]
push ebx
add eax, 0x438
push 0x1001ddac
push eax
call fcn.1000a0b8
mov esi, eax
lea eax, [ebp - 0x9c]
push ebx
push eax
push str.__b
push esi
mov dword [ebp - 0x1c], esi
call fcn.1000a0b8
add esp, 0x34
mov dword [ebp - 0x10], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp - 8]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
push eax
call fcn.100105c7
mov ebx, eax
pop ecx
test ebx, ebx
jg 0x10007876
push 0xfffffffffffffffd
pop edi
jmp 0x1000791d
mov eax, dword [0x10020b5c]
mov dl, 2
mov ecx, dword [ebp - 0x10]
add eax, 0xb0
push 2
push eax
call fcn.100095eb
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
pop ecx
test esi, esi
jne 0x1000789c
push 0xfffffffffffffffc
jmp 0x10007870
mov edx, dword [ebp - 0xc]
mov ecx, esi
push ebx
call fcn.10009874
pop ecx
test eax, eax
jns 0x100078b1
push 0xfffffffffffffffb
pop edi
jmp 0x10007911
lea ecx, [ebp - 4]
call fcn.1000993c
push 0
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [0x10020b5c]
add eax, 0x438
push str.__b
push eax
call fcn.1000a0b8
mov ecx, dword [ebp - 0x10]
add esp, 0x10
mov edx, eax
mov dword [ebp - 0x18], eax
call fcn.1000d1e4
test eax, eax
jns 0x100078ee
push 0xfffffffffffffff9
pop edi
lea eax, [ebp - 0x18]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
pop ecx
pop ecx
test edi, edi
jne 0x1000790c
push 0x2deb8b96
call fcn.10005002
pop ecx
jmp 0x1000791d
jns 0x1000791d
mov esi, dword [ebp - 4]
test esi, esi
je 0x1000791d
lea ecx, [ebp - 4]
call fcn.1000993c
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
call fcn.1000ac2f
pop ecx
pop ecx
pop esi
test ebx, ebx
jg 0x10007932
xor ebx, ebx
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.1000ac2f
lea eax, [ebp - 0x1c]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
lea eax, [ebp - 0x10]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
add esp, 0x18
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x1000795b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push ebx
push esi
push edi
push 0x31
xor ebx, ebx
pop ecx
inc ebx
call fcn.1000b9e4
test eax, eax
je 0x10007a74
push 0
call fcn.100107f7
push eax
mov eax, dword [0x10020b5c]
add eax, 0x438
push 0x1001ddb4
push eax
call fcn.1000a0b8
mov esi, eax
add esp, 0x10
mov dword [esp + 0xc], esi
test esi, esi
je 0x10007a74
mov ecx, dword [0x10020b5c]
mov edx, 0x1388
lea ecx, [ecx + 0x1878]
call fcn.1000c085
mov edi, eax
test edi, edi
je 0x10007a66
mov ecx, esi
call fcn.1000d36f
test eax, eax
jne 0x100079df
mov ecx, esi
call fcn.10010b51
mov ebx, eax
mov ecx, edi
call fcn.1000c154
mov ecx, dword [0x10020b58]
push edi
call dword [ecx + 0x30]
test ebx, ebx
jle 0x10007a66
lea ecx, [esp + 0x10]
call fcn.1000b059
push 0x33
pop ecx
call fcn.1000b9e4
test eax, eax
jne 0x10007a4f
push 0x12
pop ecx
call fcn.1000b9e4
test eax, eax
jne 0x10007a1e
call fcn.1000c168
test eax, eax
je 0x10007a4f
xor ecx, ecx
call fcn.1000b059
push eax
push esi
push str._s._u
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.1000ae40
add esp, 0x14
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x100079ab
mov ecx, esi
call fcn.1000202d
test eax, eax
js 0x10007a66
mov ecx, esi
call fcn.1000d2b7
jmp 0x100079ab
lea eax, [esp + 0xc]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009009
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push 0x126
call fcn.1000ac19
mov ebx, eax
xor eax, eax
pop ecx
test ebx, ebx
je 0x1000909c
push esi
push edi
mov esi, str.CreateWindowW
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x20]
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, esi
cmp byte [ebp - 0x10], al
je 0x10009057
inc eax
cmp byte [ebp + eax - 0x10], 0
jne 0x10009044
push 0xe
pop edx
cmp eax, edx
jbe 0x10009057
mov ecx, esi
jmp 0x1000905f
mov edx, eax
mov ecx, esi
test edx, edx
je 0x1000906b
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, edx
jb 0x1000905f
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x100209f0
sub edx, ebx
mov eax, esi
lea ecx, [esi + ebx]
and eax, 0xf
mov al, byte [eax + str._Dej_bu._P3J_b]
xor al, byte [edx + ecx]
inc esi
mov byte [ecx], al
cmp esi, 0x126
jb 0x1000907c
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x10009236
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov dword [ebp - 4], ebx
mov esi, edi
cmp edi, edx
jae 0x10009262
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x7f
mov al, byte [eax + ecx]
cmp al, byte [esi + ebx]
je 0x100092ba
inc esi
cmp esi, edx
jb 0x10009250
mov ebx, 0x10020bd6
mov esi, str.GetCurrentPath
lea edi, [ebp - 0x14]
xor eax, eax
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, ecx
cmp byte [ebp - 0x14], al
je 0x10009297
inc eax
cmp byte [ebp + eax - 0x14], cl
jne 0x10009289
push 0xe
pop edx
cmp eax, edx
ja 0x1000929d
mov edx, eax
test edx, edx
je 0x100092a9
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, edx
jb 0x1000929d
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
sub esi, edi
je 0x10009262
lea eax, [esi + 1]
push eax
call fcn.1000ac19
mov ebx, eax
mov dword [ebp + 0x10], ebx
pop ecx
test ebx, ebx
jne 0x100092d8
mov eax, 0x10020bd6
jmp 0x100092b5
mov edx, dword [ebp + 8]
mov ecx, ebx
mov ebx, dword [ebp - 4]
sub ecx, edi
mov eax, edi
and eax, 0x7f
mov al, byte [eax + edx]
xor al, byte [edi + ebx]
mov byte [ecx + edi], al
inc edi
sub esi, 1
jne 0x100092e2
mov ebx, dword [ebp + 0x10]
jmp 0x10009267
Function at 0x100092fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 8], ecx
mov esi, edi
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x10009339
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x7f
mov al, byte [eax + ecx]
mov ecx, dword [ebp - 8]
cmp al, byte [esi + ecx]
je 0x10009332
inc esi
cmp esi, edx
jb 0x10009318
jmp 0x10009339
mov ecx, esi
sub ecx, edi
mov dword [ebp - 4], ecx
mov esi, str.OpenStorage
lea edi, [ebp - 0x14]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, ebx
cmp byte [ebp - 0x14], al
je 0x10009368
inc eax
cmp byte [ebp + eax - 0x14], bl
jne 0x10009356
push 0xe
pop edx
cmp eax, edx
jbe 0x10009368
mov ecx, ebx
jmp 0x10009370
mov edx, eax
mov ecx, ebx
test edx, edx
je 0x1000937c
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, edx
jb 0x10009370
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 4]
lea eax, [esi*2 + 2]
push eax
call fcn.1000ac19
mov edx, eax
pop ecx
test edx, edx
jne 0x100093a4
mov eax, 0x10020c40
jmp 0x100093cc
test esi, esi
je 0x100093ca
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov eax, ecx
and eax, 0x7f
mov al, byte [eax + esi]
xor al, byte [ecx + edi]
movzx eax, al
mov word [edx + ebx*2], ax
inc ebx
inc ecx
cmp ebx, dword [ebp - 4]
jb 0x100093ae
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b5c7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
inc eax
push eax
call fcn.1000ac19
mov edx, eax
pop ecx
test edx, edx
je 0x1000b5f8
xor ecx, ecx
cmp dword [esi], ecx
jbe 0x1000b5f8
mov eax, ecx
and eax, 3
mov al, byte [eax + esi + 0x108]
xor al, byte [esi + ecx + 4]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi]
jb 0x1000b5e0
mov eax, edx
pop esi
ret
Function at 0x1000cfd8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
push 0
mov ebx, ecx
push 0x1001dea0
push ebx
call fcn.1000a0b8
add esp, 0xc
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000d113
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000d106
lea ecx, [ebp - 0x230]
call fcn.1000cfb0
test eax, eax
jne 0x1000d0e4
mov eax, dword [ebp - 0x25c]
test al, 0x10
jne 0x1000d088
xor esi, esi
push dword [esi + 0x10020c68]
lea eax, [ebp - 0x230]
push eax
mov eax, dword [0x10020b64]
call dword [eax + 0x18]
test eax, eax
je 0x1000d076
push dword [ebp + 0x14]
lea eax, [ebp - 0x25c]
push eax
push ebx
call fcn.100109a5
add esp, 0xc
test eax, eax
je 0x1000d07e
mov eax, dword [0x10020b58]
push 1
call dword [eax + 0xc0]
add esi, 4
cmp esi, 4
jb 0x1000d039
mov eax, dword [ebp - 0x25c]
test al, 0x10
je 0x1000d0e4
push 0
lea eax, [ebp - 0x230]
push eax
push str.__b
push ebx
call fcn.1000a0b8
mov esi, eax
add esp, 0x10
mov dword [ebp - 8], esi
test esi, esi
je 0x1000d0e4
mov ecx, dword [0x10020b58]
push 1
call dword [ecx + 0xc0]
push 1
push 1
push 0
push dword [ebp + 0x14]
mov edx, 0x10020c68
mov ecx, esi
push fcn.100109a5
push 5
push 1
call fcn.1000cfd8
add esp, 0x1c
lea eax, [ebp - 8]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
pop ecx
pop ecx
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000d01a
mov eax, dword [0x10020b58]
push edi
call dword [eax + 0x80]
lea eax, [ebp - 0xc]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000d1e4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov eax, edx
xor edi, edi
push edi
push eax
mov dword [ebp - 4], eax
mov ebx, ecx
mov eax, dword [0x10020b58]
push ebx
call dword [eax + 0x11c]
test eax, eax
jne 0x1000d2a3
push 0x208
lea eax, [ebp - 0x210]
push edi
push eax
call sub.msvcrt.dll_memset
push 0x136
call fcn.1000abe4
mov esi, eax
mov eax, dword [0x10020b5c]
push 0xf4240
add eax, 0x648
mov dword [ebp - 8], esi
push 1
push eax
call fcn.10013f75
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push esi
push 0x103
push eax
call fcn.1000ae40
lea eax, [ebp - 8]
push eax
call fcn.100093e4
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x210]
add esp, 0x34
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1000d290
mov eax, dword [0x10020b58]
push edi
push esi
push ebx
call dword [eax + 0x11c]
test eax, eax
jne 0x1000d295
or edi, 0xffffffff
jmp 0x1000d2b0
mov eax, dword [0x10020b58]
push ebx
call dword [eax + pe_nt_image_headers32]
jmp 0x1000d2b0
mov ecx, dword [0x10020b58]
push ebx
call dword [ecx + pe_nt_image_headers32]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000d2b7
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push esi
push edi
mov esi, ecx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, 0x200
lea eax, [ebp - 0x244]
push edi
push 0
push eax
call fcn.1000adb3
push edi
lea eax, [ebp - 0x244]
push eax
push esi
call fcn.1000c4a8
mov eax, dword [0x10020b58]
add esp, 0x18
push esi
call dword [eax + pe_nt_image_headers32]
test eax, eax
je 0x1000d30a
xor eax, eax
inc eax
jmp 0x1000d36b
mov eax, dword [0x10020b5c]
push 0xffffffffffffffff
add eax, 0x648
push 0xf0000000
push eax
call fcn.10013f75
push eax
push 0x1001dea8
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.1000ae40
push 0
lea eax, [ebp - 0x44]
push eax
push 0x1001de0c
push esi
call fcn.1000a0b8
add esp, 0x2c
mov dword [ebp - 4], eax
test eax, eax
je 0x1000d369
mov edx, eax
mov ecx, esi
call fcn.1000d1e4
mov esi, eax
lea eax, [ebp - 4]
push 0xfffffffffffffffe
push eax
call fcn.1000ac2f
pop ecx
pop ecx
test esi, esi
jns 0x1000d305
xor eax, eax
pop edi
pop esi
leave
ret