joyce8/EMBER2024-capa huggingface dataset:
Function at 0x113ec383
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x113ec3b0
call fcn.113eecc7
mov dword [eax], esi
call fcn.113eecb4
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.113ec595
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x113ec38c
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x113ec3df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.113eecda
pop ecx
call fcn.113eecb4
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x113ec406
test al, 1
je 0x113ec406
test byte [esp + 0xc], 2
je 0x113ec406
call fcn.113eecc7
mov dword [eax], 5
call fcn.113eecb4
mov dword [eax], 0xd
jmp 0x113ec3d6
xor eax, eax
pop esi
ret

Function at 0x113f3d54
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x11403760]
je 0x113f3d6f
inc edi
cmp edi, 0x17
jb 0x113f3d60
cmp edi, 0x17
jae 0x113f3eef
push ebp
push 3
call fcn.113f7644
cmp eax, 1
pop ecx
je 0x113f3ebb
push 3
call fcn.113f7644
test eax, eax
pop ecx
jne 0x113f3da3
cmp dword [0x11403030], 1
je 0x113f3ebb
cmp ebx, 0xfc
je 0x113f3eee
push 0x113feaf8
mov ebx, 0x314
push ebx
mov ebp, 0x11404ed8
push ebp
call fcn.113ec5c9
add esp, 0xc
test eax, eax
je 0x113f3dd9
push esi
push esi
push esi
push esi
push esi
call fcn.113ec499
add esp, 0x14
push 0x104
mov esi, 0x11404ef1
push esi
push 0
mov byte [0x11404ff5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x113f3e1d
push 0x113feae0
push 0x2fb
push esi
call fcn.113ec5c9
add esp, 0xc
test eax, eax
je 0x113f3e1d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.113ec499
add esp, 0x14
push esi
call fcn.113efef0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x113f3e62
push esi
call fcn.113efef0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x114051ec
push 0x113feadc
sub ecx, eax
push ecx
push eax
call fcn.113ed327
add esp, 0x14
test eax, eax
je 0x113f3e62
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.113ec499
add esp, 0x14
jmp 0x113f3e64
xor esi, esi
push 0x113fead8
push ebx
push ebp
call fcn.113ec41e
add esp, 0xc
test eax, eax
je 0x113f3e84
push esi
push esi
push esi
push esi
push esi
call fcn.113ec499
add esp, 0x14
push dword [edi*8 + 0x11403764]
push ebx
push ebp
call fcn.113ec41e
add esp, 0xc
test eax, eax
je 0x113f3ea6
push esi
push esi
push esi
push esi
push esi
call fcn.113ec499
add esp, 0x14
push 0x12010
push 0x113feab0
push ebp
call fcn.113f7487
add esp, 0xc
jmp 0x113f3eee
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x113f3eee
cmp ebp, 0xffffffff
je 0x113f3eee
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x11403764]
push dword [esi]
call fcn.113efef0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x113f7487
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.113ef22f
xor ebx, ebx
cmp dword [0x114053b4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x113f755d
push 0x113ff34c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x113f763d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x113ff340
push edi
call esi
cmp eax, ebx
je 0x113f763d
push eax
call fcn.113ef1c1
mov dword [esp], 0x113ff330
push edi
mov dword [0x114053b4], eax
call esi
push eax
call fcn.113ef1c1
mov dword [esp], 0x113ff31c
push edi
mov dword [0x114053b8], eax
call esi
push eax
call fcn.113ef1c1
mov dword [0x114053bc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.113ef980
test eax, eax
pop ecx
pop ecx
je 0x113f752b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.113ec499
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x113f755d
push 0x113ff300
push edi
call esi
push eax
call fcn.113ef1c1
cmp eax, ebx
pop ecx
mov dword [0x114053c4], eax
je 0x113f755d
push 0x113ff2e8
push edi
call esi
push eax
call fcn.113ef1c1
pop ecx
mov dword [0x114053c0], eax
mov eax, dword [0x114053c0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x113f75e2
cmp dword [0x114053c4], ecx
je 0x113f75e2
push eax
call fcn.113ef238
push dword [0x114053c4]
mov esi, eax
call fcn.113ef238
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x113f75e2
cmp edi, ebx
je 0x113f75e2
call esi
cmp eax, ebx
je 0x113f75af
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x113f75af
test byte [ebp - 0x18], 1
jne 0x113f75e2
lea eax, [ebp - 0x10]
push eax
call fcn.113ef9b7
test eax, eax
pop ecx
je 0x113f75ca
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.113ec499
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x113f75d9
or dword [ebp + 0x10], 0x200000
jmp 0x113f761d
or dword [ebp + 0x10], 0x40000
jmp 0x113f761d
mov eax, dword [0x114053b8]
cmp eax, dword [ebp - 8]
je 0x113f761d
push eax
call fcn.113ef238
cmp eax, ebx
pop ecx
je 0x113f761d
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x113f761d
mov eax, dword [0x114053bc]
cmp eax, dword [ebp - 8]
je 0x113f761d
push eax
call fcn.113ef238
cmp eax, ebx
pop ecx
je 0x113f761d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x114053b4]
call fcn.113ef238
cmp eax, ebx
pop ecx
je 0x113f763d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x113f763f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003651b
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x488], eax
mov eax, dword [eax + 0x10]
mov esi, eax
shr esi, 4
lea ebx, [esi + 1]
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x48c], eax
shl ebx, 4
lea eax, [ebx + 1]
push eax
call fcn.1003433c
mov edi, eax
lea eax, [ebx + 1]
push eax
push 0
push edi
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x488]
add esp, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x100029a6
mov eax, dword [eax]
mov edx, edi
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100029b0
mov ecx, dword [ebp - 0x48c]
and ecx, 0xf
mov eax, 0x10
sub eax, ecx
test eax, eax
jle 0x100029e0
shl esi, 4
push eax
add esi, ecx
push eax
add esi, edi
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
xor ecx, ecx
mov byte [ebx + edi], 0
mov word [ebp - 0x488], 0x3416
mov byte [ebp - 0x486], 0x96
test ebx, ebx
jle 0x10002a24
lea ebx, [ebx]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ecx
sub eax, edx
mov dl, byte [ebp + eax - 0x488]
xor byte [ecx + edi], dl
inc ecx
cmp ecx, ebx
jl 0x10002a00
lea esi, [ebx + 1]
push esi
call fcn.1003433c
push esi
xor esi, esi
push esi
push eax
mov dword [ebp - 0x48c], eax
call sub.MSVCR100.dll_memset
add esp, 0x10
mov dword [ebp - method.AES.virtual_0], vtable.AES.0
mov byte [ebp - 0x480], 0
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 4], esi
push str.__is2ssy_uperecure2J__.123__
lea esi, [ebp - 0x484]
call fcn.10001d40
mov esi, dword [ebp - 0x48c]
push ebx
push esi
push edi
lea eax, [ebp - 0x484]
call fcn.10002150
push ebx
mov ebx, dword [ebp - 0x490]
push esi
push ebx
call fcn.10008b00
push edi
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
call edi
push esi
call edi
add esp, 0x14
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x10003e30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003780a
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x1004b034]
xor eax, esp
mov dword [esp + 0xd4], eax
push esi
push edi
mov eax, dword [0x1004b034]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.10006d50
push 1
mov ecx, str..Xor_PlusSplashXor_Ban.bmp
lea esi, [esp + 0x28]
mov dword [esp + 0xf4], 0
call fcn.10007c30
push 0
test eax, eax
jne 0x10003eaf
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 4]
push 2
lea ecx, [esp + ecx + 0x1c]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
jmp 0x10003ec2
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 4]
push 0
lea ecx, [esp + ecx + 0x1c]
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool_]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov ecx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x14]
and cl, 6
movsx edx, cl
neg edx
sbb edx, edx
not edx
test eax, edx
je 0x10003eeb
call fcn.10027760
jmp 0x10003fb5
push 0
push 0
push 0
push 0x10003cc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0xc4]
push 0x10052ccc
push eax
call fcn.10002920
add esp, 8
mov edi, eax
mov esi, 0x10052ccc
mov byte [esp + 0xf0], 1
call fcn.100032d0
mov byte [esp + 0xf0], 0
cmp dword [esp + 0xd8], 0x10
jb 0x10003f4c
mov ecx, dword [esp + 0xc4]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea edx, [esp + 0xc4]
push 0x10052d04
push edx
call fcn.10002920
add esp, 8
mov edi, eax
mov esi, 0x10052d04
mov byte [esp + 0xf0], 2
call fcn.100032d0
cmp dword [esp + 0xd8], 0x10
jb 0x10003f90
mov eax, dword [esp + 0xc4]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0xd8], 0xf
mov dword [esp + 0xd4], eax
mov byte [esp + 0xc4], al
mov dword [0x1015e86c], eax
call fcn.10009910
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x7c]
mov dword [esp + 0x10], ecx
mov dword [esp + eax + 0x14], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
lea ecx, [esp + 0x24]
mov dword [esp + 0xf0], 3
call fcn.10006f70
mov dword [esp + 0xf0], 0xffffffff
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
mov eax, dword [sym.imp.MSVCP100.dll_const_std::basic_istream_char__struct_std::char_traits_char__::vftable]
lea ecx, [esp + 0x7c]
mov dword [esp + edx + 0x14], eax
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x10007d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035a28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x10007e52
cmp byte [edi + 0x49], bl
je 0x10007e52
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10007e46
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10007da4
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x10007dbc
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x10007de3
dec eax
je 0x10007de6
sub eax, 2
lea esi, [ebp - 0x2c]
jne 0x10007e41
jmp 0x10007e4d
mov byte [edi + 0x49], bl
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x10007df6
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x10007e20
cmp edx, 0x10
jae 0x10007e05
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10007e3e
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], bl
je 0x10007e4a
cmp esi, ebx
jne 0x10007db0
push ebx
mov ebx, 8
lea esi, [ebp - 0x2c]
call fcn.100088c0
xor ebx, ebx
jmp 0x10007daa
lea esi, [ebp - 0x2c]
call fcn.10003340
xor al, al
jmp 0x10007e54
lea esi, [ebp - 0x2c]
call fcn.10003340
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x10009110
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10009120
mov eax, pe_nt_image_headers32
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000912c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10009136
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10009140
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000914a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10009154
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000915e
or eax, 2
test cl, 2
je 0x10009166
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10009220
test al, 1
je 0x1000922d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10009220
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10009114
pop edi
pop ebx
ret

Function at 0x10009250
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10040aac
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10009282
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x100092b0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10009313
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100092f9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x100092d8
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x100092d0
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100097f0
Capabilities:
Terminate thread

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esi + 0x100034], ebx
je 0x10009826
mov dword [0x10160bf0], 0xffffffff
mov eax, dword [esi + 0x100034]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x100034]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x100034], ebx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1000983c
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1000984d
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], ebx
mov byte [esi + 0x100038], bl
pop ebx
ret

Function at 0x100099b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0x20
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009a10
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x100099f6
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [esi + 4], 0
mov ecx, dword [esi + 8]
push ecx
call fcn.1003433c
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x10009a17
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
push 0
lea edx, [ebp - 4]
push edx
push ecx
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
je 0x10009a0a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000a170
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
call fcn.100099b0
test al, al
jne 0x1000a17e
pop esi
ret
push edi
mov edi, dword [esi + 8]
cmp edi, 8
jae 0x1000a18c
pop edi
xor al, al
pop esi
ret
mov edx, dword [esi + 4]
mov eax, 0x1003c8c8
mov ecx, 8
sub edx, eax
push ebx
lea esp, [esp]
mov ebx, dword [edx + eax]
cmp ebx, dword [eax]
jne 0x1000a212
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x1000a1a0
add edi, 0xfffffff8
xor ecx, ecx
test edi, edi
jle 0x1000a208
jmp 0x1000a1c0
mov eax, dword [esi + 4]
lea edi, [eax + ecx + 8]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx + edx*2]
mov eax, ecx
sub eax, edx
movsx edx, byte [eax + 0x10040b44]
and edx, 0xf
mov al, byte [edx + 0x1003c8d0]
sub byte [edi], al
mov edx, dword [esi + 4]
lea eax, [edx + ecx + 8]
mov edx, ecx
and edx, 0xf
mov dl, byte [edx + 0x1003c8d0]
xor byte [eax], dl
mov eax, dword [esi + 8]
inc ecx
sub eax, 8
cmp ecx, eax
jl 0x1000a1c0
push esi
call fcn.1000a220
pop ebx
pop edi
pop esi
ret
pop ebx
pop edi
xor al, al
pop esi
ret
Function at 0x1000ae30
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100443c8
push 0x10034af6
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x1004b034]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14c], eax
push ecx
push str..PhysicalDrive_d
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x148], edi
cmp edi, 0xffffffff
je 0x1000afe2
xor eax, eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
push esi
lea ecx, [ebp - 0x150]
push ecx
push 8
lea edx, [ebp - 0x140]
push edx
push 0xc
lea eax, [ebp - 0x138]
push eax
push 0x2d1400
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call ebx
test eax, eax
jne 0x1000af14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000afe2
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.1003433c
mov esi, eax
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x13c]
push edx
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0x10
push 0
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
push esi
push 0xc
lea edx, [ebp - 0x138]
push edx
push 0x2d1400
push edi
call ebx
test eax, eax
jne 0x1000af73
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
jmp 0x1000afe2
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1000af60
mov dword [ebp - 4], 0
add eax, esi
push eax
push 0x100
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1000afe4
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x1000b910
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000b98c
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000b985
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
cmp dword [ebp - 0x128], ebx
je 0x1000b979
lea ecx, [ebp - 0x130]
push ecx
push esi
call edi
test eax, eax
jne 0x1000b961
jmp 0x1000b985
mov edx, dword [ebp - 0x118]
mov dword [0x1015e5ec], edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10034620
mov esp, ebp
pop ebp
ret

Function at 0x1000b9c0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.1000b910
mov eax, dword [0x1015e5ec]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
push 0x1015e5f0
push 0
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push 0x10040acf
push 0x1015e5f0
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x1000baf2
mov eax, 0x1015e5f0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ba24
sub eax, edx
cmp eax, 5
jl 0x1000baf2
lea esi, [ebp - 0x408]
call fcn.10009110
mov ecx, dword [0x1015d420]
mov edx, esi
push edx
lea esi, [ebp - 0x40c]
mov eax, 0x1015e5f0
mov dword [ebp - 0x410], ecx
call fcn.10009250
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test al, al
jne 0x1000baad
push 1
push 0x1015d450
mov byte [0x1015ec39], 1
call esi
push 0
push 0
push 0
push 0x1000b9a0
push 0
push 0
call edi
push 0xfa0
call ebx
mov dword [0x1015e86c], 0
call fcn.10009910
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x40c]
je 0x1000baf2
push 1
push 0x1015d450
mov byte [0x1015ec39], 1
call esi
push 0
push 0
push 0
push 0x1000b9a0
push 0
push 0
call edi
push 0xfa0
call ebx
mov dword [0x1015e86c], 0
call fcn.10009910
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10034620
mov esp, ebp
pop ebp
ret