joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016040
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x10126a94]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
mov ebx, dword [esp + 0x1a4]
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
mov esi, dword [esp + 0x1b8]
push edi
mov edi, dword [esp + 0x1b4]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebp
mov ecx, dword [edi]
mov eax, ecx
not eax
test al, 1
je 0x100160e0
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100160b3
push eax
push esi
push ebp
lea eax, [edi + 0x80a4]
push str._s:_s_failed_to_setup_winsock2__wsa:__d_
push eax
call fcn.10019150
add esp, 0x14
jmp 0x10016205
test byte [esp + 0x18], 1
je 0x100160db
push esi
push ebp
lea eax, [edi + 0x80a4]
push str._s:_s_bad_winsock_version__2_is_required_
push eax
call fcn.10019150
add esp, 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x10016205
or dword [edi], 1
mov ecx, dword [edi]
cmp dword [esp + 0x1c0], 0
je 0x10016137
lea eax, [edi + 0x84a4]
lea ecx, [edi + 0x1808954]
cmp eax, ecx
jae 0x1001610f
nop word [eax + eax]
cmp dword [eax + 8], 0xffffffff
je 0x10016119
add eax, 0x200064
cmp eax, ecx
jb 0x10016100
mov eax, str._s:_s_server_limit_reached
jmp 0x100161f3
push 1
push esi
push ebp
push eax
push ebx
call fcn.10016220
add esp, 0x14
test eax, eax
je 0x10016207
or dword [eax], 0x20
jmp 0x10016207
not ecx
test cl, 0x20
je 0x100161ee
or dword [ebx + 0x154], 0x20
lea eax, [edi + 0x84a4]
lea ebp, [edi + 0x1808954]
mov esi, eax
cmp esi, ebp
jae 0x10016182
nop dword [eax + eax]
cmp dword [esi + 8], 0xffffffff
je 0x10016172
push 1
push esi
push ebx
call fcn.10017040
add esp, 0xc
add esi, 0x200064
cmp esi, ebp
jb 0x10016160
lea eax, [edi + 0x84a4]
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
push eax
push ebx
call fcn.10016220
mov ebp, eax
add esp, 0x14
test ebp, ebp
je 0x100161ea
lea esi, [ebp + 0x10]
push esi
push dword [ebx + 4]
call fcn.10038b10
push 1
push str.ServerConnecting
push 0
push dword [ebx + 4]
push dword [ebx + 0x14]
call fcn.1002cc80
push 0xfffffffffffffffe
push dword [ebx + 4]
call fcn.10038fc0
test byte [ebp], 4
mov ecx, str._s_connected_to_server_immediately
mov eax, str._s_connecting_to_server
cmovne eax, ecx
push esi
push eax
mov eax, dword [ebx + 0x18]
push 0
push eax
call fcn.10019a50
add esp, 0x34
or dword [edi], 0x20
mov eax, ebp
jmp 0x10016207
mov eax, str._s:_s_already_connected_to_another_server
push esi
push ebp
push eax
lea eax, [edi + 0x80a4]
push eax
call fcn.10019150
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100af7bb
add esp, 0x19c
ret
Function at 0x1001ddd0
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 1
push esi
call fcn.10039330
add esp, 8
cmp eax, 3
jne 0x1001ddfe
push 1
push esi
call fcn.10039100
add esp, 8
fstp dword [esp + 4]
cvttss2si eax, dword [esp + 4]
pop esi
pop ecx
ret
cmp eax, 4
je 0x1001de13
push str.number_or_string
push 1
push esi
call fcn.10048570
add esp, 0xc
push 1
push esi
call fcn.10039220
mov esi, eax
push esi
call fcn.1001dd50
add esp, 0xc
test eax, eax
jne 0x1001de45
push esi
call fcn.1001de50
add esp, 4
test eax, eax
je 0x1001de43
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x1001f1d0
Capabilities:
Log keystrokes
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x104
mov eax, dword [0x10126a94]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, dword [esp + 0x10c]
push edi
push 1
push dword [esp + 0x118]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edi, eax
test edi, edi
je 0x1001f3a3
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1001f3a3
cmp edi, 0xd
jne 0x1001f23b
pop edi
mov dword [esi], 2
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100af7bb
add esp, 0x104
ret
cmp edi, 0x1b
jne 0x1001f25d
pop edi
mov dword [esi], 1
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100af7bb
add esp, 0x104
ret
cmp edi, 8
jne 0x1001f288
mov eax, dword [esi + 4]
test eax, eax
je 0x1001f3a3
dec eax
pop edi
mov dword [esi + 4], eax
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100af7bb
add esp, 0x104
ret
cmp edi, 0x56
jne 0x1001f35e
test byte [esp + 0x19], 0x80
je 0x1001f35e
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001f3a3
push esi
call fcn.1001d8c0
add esp, 4
test eax, eax
je 0x1001f341
push ebx
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
xor edi, edi
movsx ecx, byte [ebx]
push ecx
call fcn.100b9760
add esp, 4
test eax, eax
je 0x1001f2f3
nop word [eax + eax]
movsx eax, byte [edi + ebx + 1]
inc edi
push eax
call fcn.100b9760
add esp, 4
test eax, eax
jne 0x1001f2e0
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub edx, dword [esi + 4]
add ecx, dword [esi + 4]
cmp edi, edx
jae 0x1001f32f
push edi
push ebx
push ecx
call fcn.100b0ad0
add dword [esi + 4], edi
add esp, 0xc
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100af7bb
add esp, 0x104
ret
push edx
push ebx
push ecx
call fcn.100b0ad0
mov eax, dword [esi + 8]
add esp, 0xc
mov dword [esi + 4], eax
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100af7bb
add esp, 0x104
ret
push 0
lea eax, [esp + 0xc]
push eax
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x1001f3a3
movsx eax, byte [esp + 8]
push eax
call fcn.100b9760
add esp, 4
test eax, eax
je 0x1001f3a3
push esi
call fcn.1001d8c0
add esp, 4
test eax, eax
je 0x1001f3a3
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov al, byte [esp + 8]
mov byte [edx + ecx], al
inc dword [esi + 4]
mov ecx, dword [esp + 0x108]
pop edi
pop esi
xor ecx, esp
call fcn.100af7bb
add esp, 0x104
ret
Function at 0x10026500
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10126a94]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
push 0x40
push fcn.100b11aa
push ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
call fcn.10053520
push 0
push eax
call fcn.100b11c0
add esp, 0x14
test eax, eax
jne 0x1002658e
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push esi
push 1
push 8
push eax
call fcn.100baf7d
add esp, 0x10
test eax, eax
je 0x1002658e
push 8
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.10051c60
add esp, 0xc
test eax, eax
jne 0x1002658e
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.10051a60
push 8
push esi
call fcn.10051c30
add esp, 0x10
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100af7bb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100af7bb
mov esp, ebp
pop ebp
ret
Function at 0x1002a4f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push 0x18
call fcn.100b8d28
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1002a515
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1002a510
mov dword [eax], 2
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
test eax, eax
je 0x1002a59e
lea ecx, [esp + 0x10]
push ecx
push 0x100f3f0c
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call fcn.10033850
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1002a684
mov ecx, dword [esp + 0x10]
inc ecx
push ecx
call fcn.100b8d28
mov esi, eax
add esp, 4
test esi, esi
jne 0x1002a564
push edi
call fcn.10032b40
jmp 0x1002a681
push dword [esp + 0x10]
push esi
push edi
call fcn.10033bf0
add esp, 0xc
push edi
cmp eax, dword [esp + 0x14]
je 0x1002a58c
call fcn.10032b40
push esi
call fcn.100b8d0d
add esp, 8
jmp 0x1002a684
call fcn.10032b40
mov eax, dword [esp + 0x14]
mov byte [esi + eax], 0
jmp 0x1002a634
push 0x100f3f0c
push dword [esp + 0x24]
call fcn.100b45f7
mov edi, eax
add esp, 8
test edi, edi
je 0x1002a684
push 2
push 0
push edi
call fcn.100bb83b
add esp, 0xc
test eax, eax
jne 0x1002a67b
push edi
call fcn.100bbe8e
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x1002a67b
push 0
push 0
push edi
call fcn.100bb83b
add esp, 0xc
test eax, eax
jne 0x1002a67b
lea eax, [ebp + 1]
push eax
call fcn.100b8d28
add esp, 4
mov esi, eax
push edi
test esi, esi
je 0x1002a67c
push 1
push ebp
push esi
call fcn.100baf7d
add esp, 0x10
push edi
test eax, eax
jne 0x1002a62b
call fcn.100b4510
push esi
call fcn.100b8d0d
add esp, 8
jmp 0x1002a684
call fcn.100b4510
mov byte [esi + ebp], 0
add esp, 4
lea eax, [ebx + 8]
push dword [esp + 0x24]
push eax
lea eax, [ebx + 4]
push eax
push esi
call fcn.1002a050
add esp, 0x10
mov dword [ebx], eax
test eax, eax
jne 0x1002a669
push esi
call fcn.100b8d0d
push ebx
call fcn.100b8d0d
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebx + 0xc], esi
mov eax, ebx
pop esi
pop ebp
mov dword [ebx + 0x10], 0
pop ebx
pop ecx
ret
push edi
call fcn.100b4510
add esp, 4
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1002a692
mov dword [eax], 1
push ebx
call fcn.100b8d0d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1002c050
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push dword [edi + 0x164]
mov esi, dword [edi + 4]
push 0xffffd8f0
push esi
call fcn.10038ce0
push 0xffffffffffffffff
push esi
call fcn.10039330
add esp, 0x14
cmp eax, 5
je 0x1002c09b
push str.extra_save_data_was_corrupted
push 1
push dword [edi + 0x18]
call fcn.10019ad0
push 0xfffffffffffffffe
push esi
call fcn.10038fc0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ecx
ret
push esi
call fcn.10038ad0
push 0xfffffffffffffffe
push esi
call fcn.100388e0
add esp, 0xc
test eax, eax
jne 0x1002c0c4
push 0xfffffffffffffffe
push esi
call fcn.10038fc0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push ebx
push 0xfffffffffffffffd
push esi
call fcn.10038fc0
push 0
lea eax, [esp + 0x20]
push eax
push esi
call fcn.10036c60
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1002c123
push str.failed_to_save_extra_save_data:
push esi
call fcn.10038b10
push 0xfffffffffffffffe
push esi
call fcn.100385b0
push 2
push esi
call fcn.10038330
push 0xffffffffffffffff
push esi
call fcn.10039220
push eax
push 1
push dword [edi + 0x18]
call fcn.10019ad0
push 0xfffffffffffffffe
push esi
call fcn.10038fc0
add esp, 0x34
xor eax, eax
pop ebx
pop edi
pop esi
pop ecx
ret
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002c15a
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x14]
jne 0x1002c15a
push ebx
call fcn.100b8d0d
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.100b8d0d
push str.failed_to_write_extra_save_data
push 1
push dword [edi + 0x18]
call fcn.10019ad0
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x10033bf0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax], 0
mov ecx, dword [eax + 4]
je 0x10033c16
push dword [esp + 0xc]
push dword [esp + 0xc]
push ecx
call fcn.1005e370
xor ecx, ecx
add esp, 0xc
cmp eax, 0xffffffff
cmove eax, ecx
ret
push ecx
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.100baf7d
add esp, 0x10
ret
Function at 0x100374a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x10126a94]
xor eax, esp
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x10c]
mov edx, ecx
push ebx
push esi
push edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100374c3
sub edx, esi
cmp edx, 0x104
jae 0x10037587
lea edx, [esp + 0xc]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100374e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esp + 0xc], al
je 0x1003754a
lea esi, [esp + 0xc]
cmp byte [esp + 0xd], al
je 0x1003753d
nop dword [eax]
mov al, byte [esi]
cmp al, 0x2f
je 0x1003751a
cmp al, 0x5c
jne 0x10037536
push 0
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call ebx
test eax, eax
jne 0x10037533
call edi
cmp eax, 0xb7
jne 0x10037587
mov byte [esi], 0x5c
inc esi
cmp byte [esi + 1], 0
jne 0x10037510
mov al, byte [esi]
cmp al, 0x2f
je 0x10037547
cmp al, 0x5c
jne 0x1003754a
mov byte [esi], 0
cmp dword [esp + 0x11c], 0
jne 0x1003756a
push 0
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x1003756a
call edi
cmp eax, 0xb7
jne 0x10037587
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100af7bb
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100af7bb
add esp, 0x108
ret
Function at 0x100409f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x10126a94]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x7c]
push edi
test byte [esi + 0x30], 2
je 0x10040aeb
mov edi, dword [esp + 0x88]
sub edi, dword [esi + 0x1c]
push 0xffffffffffffffff
push 1
push esi
mov dword [esp + 0x20], edi
call fcn.10040840
mov eax, dword [esi + 0x14]
add esp, 0xc
test byte [eax + 8], 1
jne 0x10040ae4
cmp dword [eax + 0x14], 0
je 0x10040ae1
dec dword [eax + 0x14]
mov edi, dword [esi + 0x3c]
test edi, edi
je 0x10040ad0
cmp byte [esi + 0x31], 0
je 0x10040ad0
mov eax, dword [esi + 0x14]
mov ebp, dword [esi + 8]
sub ebp, dword [esi + 0x1c]
mov eax, dword [eax + 4]
sub eax, dword [esi + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 8]
mov dword [esp + 0x18], 4
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x74], 0
cmp eax, 0xa0
jg 0x10040a99
push 0x14
push esi
call fcn.10040920
add esp, 8
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 8]
add ecx, 0xa0
mov dword [eax + 4], ecx
lea eax, [esp + 0x18]
push eax
push esi
mov byte [esi + 0x31], 0
call edi
mov eax, dword [esi + 0x14]
add esp, 8
mov ecx, dword [esi + 0x1c]
add ecx, dword [esp + 0x10]
mov byte [esi + 0x31], 1
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x1c]
add eax, ebp
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
cmp dword [eax + 0x14], 0
jne 0x10040a42
mov edi, dword [esp + 0x14]
dec dword [eax + 0x14]
mov ebp, dword [esi + 0x1c]
add ebp, edi
jmp 0x10040af2
mov ebp, dword [esp + 0x88]
add dword [esi + 0x14], 0xffffffe8
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0xc]
mov ebx, dword [esp + 0x84]
sub edi, 8
mov eax, dword [eax]
mov dword [esi + 0xc], eax
test ebx, ebx
je 0x10040b40
nop
cmp ebp, dword [esi + 8]
jae 0x10040b2e
mov ecx, ebp
mov edx, edi
add edi, 8
add ebp, 8
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
sub ebx, 1
jne 0x10040b10
test ebx, ebx
jle 0x10040b40
dec ebx
mov dword [edi], 0
add edi, 8
test ebx, ebx
jg 0x10040b32
mov ecx, dword [esp + 0x78]
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100af7bb
add esp, 0x6c
ret
Function at 0x10041cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, ebp
push esi
mov esi, ebp
mov edx, ebp
shr esi, 5
inc esi
push edi
cmp ebp, esi
jb 0x10041cff
mov ebp, dword [esp + 0x20]
nop dword [eax]
movzx ecx, byte [edx + ebp - 1]
mov eax, ebx
shl eax, 5
sub edx, esi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp edx, esi
jae 0x10041ce0
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x10041d85
cmp dword [edi + 0xc], ebp
jne 0x10041d7f
mov edx, dword [esp + 0x20]
lea eax, [edi + 0x10]
mov esi, ebp
sub esi, 4
jb 0x10041d39
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10041d42
add edx, 4
add eax, 4
sub esi, 4
jae 0x10041d28
cmp esi, 0xfffffffc
je 0x10041ea8
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x10041d7f
cmp esi, 0xfffffffd
je 0x10041ea8
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10041d7f
cmp esi, 0xfffffffe
je 0x10041ea8
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x10041d7f
cmp esi, 0xffffffff
je 0x10041ea8
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x10041ea8
mov edi, dword [edi]
test edi, edi
jne 0x10041d15
mov edi, dword [esp + 0x1c]
lea eax, [ebp + 0x11]
push eax
push 0
push 0
push edi
call fcn.1003b880
mov esi, eax
push ebp
push dword [esp + 0x34]
mov dword [esp + 0x2c], esi
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], ebp
push ecx
mov dword [esi + 8], ebx
mov word [esi + 4], 4
mov byte [esi + 6], 0
call fcn.100b0ad0
mov byte [esi + ebp + 0x10], 0
add esp, 0x1c
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
dec eax
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [esi], eax
mov eax, dword [edx]
mov dword [ecx + eax], esi
inc dword [edx + 4]
mov eax, dword [edx + 8]
cmp dword [edx + 4], eax
jle 0x10041e9e
cmp eax, 0x3ffffffe
jg 0x10041e9e
add eax, eax
mov dword [esp + 0x24], eax
lea esi, [eax*4]
push esi
push 0
push 0
push edi
call fcn.1003b880
mov ecx, dword [esp + 0x34]
add esp, 0x10
mov ebx, dword [edi + 0x10]
mov ebp, eax
mov dword [esp + 0x10], ebx
test ecx, ecx
jle 0x10041e34
shr esi, 2
mov edi, ebp
mov ecx, esi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx + 8]
xor edi, edi
test eax, eax
jle 0x10041e7c
nop dword [eax]
mov eax, dword [ebx]
mov esi, dword [eax + edi*4]
test esi, esi
je 0x10041e70
lea ebx, [ecx - 1]
nop dword [eax]
mov eax, dword [esi + 8]
mov edx, dword [esi]
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [ecx + ebp]
mov dword [esi], eax
mov dword [ecx + ebp], esi
mov esi, edx
test edx, edx
jne 0x10041e50
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 8]
inc edi
mov ecx, dword [esp + 0x24]
cmp edi, eax
jl 0x10041e40
push 0
shl eax, 2
push eax
push dword [ebx]
mov eax, dword [esp + 0x28]
push eax
call fcn.1003b880
mov eax, dword [esp + 0x34]
add esp, 0x10
mov esi, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov dword [ebx], ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1004bc70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x10126a94]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push eax
push ebx
call fcn.10047720
mov edi, dword [esp + 0x234]
add esp, 8
mov esi, 0x200
lea eax, [esp + 0x10]
push eax
call fcn.10048130
cmp esi, edi
mov ecx, edi
push ebp
cmovbe ecx, esi
mov esi, ecx
push esi
push 1
push eax
call fcn.100baf7d
add dword [esp + 0x24], eax
add esp, 0x14
sub edi, eax
je 0x1004bcdc
cmp eax, esi
je 0x1004bcb0
lea eax, [esp + 0x10]
push eax
call fcn.10048160
add esp, 4
test edi, edi
je 0x1004bcfc
push 0xffffffffffffffff
push ebx
call fcn.10039060
add esp, 8
test eax, eax
je 0x1004bd01
mov eax, 1
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100af7bb
add esp, 0x210
ret

Function at 0x10053490
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x100534b0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x100534b0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x100534b0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10060df0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x1505
cmp dword [ebp + 8], 0
jne 0x10060e05
xor eax, eax
jmp 0x10060e39
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x10060e36
imul edx, dword [ebp - 4], 0x21
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
add edx, ecx
xor eax, eax
push 1
push 0
push eax
push edx
call fcn.100b0260
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x10060e05
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1006d290
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1006d2d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1006d170
add esp, 4
push eax
push 5
mov edx, dword [ebp + 8]
push edx
call fcn.10060350
add esp, 0xc
xor al, al
jmp 0x1006d36a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1006d100
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x1006d300
push 0x22
push 5
mov ecx, dword [ebp + 8]
push ecx
call fcn.10060350
add esp, 0xc
xor al, al
jmp 0x1006d36a
mov edx, dword [ebp + 0xc]
mov byte [edx + 0x10], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x1006d368
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 0x11], 1
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1006d360
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1006d170
add esp, 4
push eax
push 5
mov ecx, dword [ebp + 8]
push ecx
call fcn.10060350
add esp, 0xc
xor al, al
jmp 0x1006d36a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1006d370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
jmp 0x1006d388
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x14]
jae 0x1006d3ee
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
cmp dword [ebp + 0xc], 0
je 0x1006d3db
mov ecx, dword [ebp + 8]
push ecx
call fcn.1006d570
add esp, 4
mov byte [ebp - 2], al
movzx edx, byte [ebp - 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1006d4b0
add esp, 8
movzx ecx, byte [ebp - 2]
movzx edx, byte [ebp - 1]
xor edx, ecx
mov byte [ebp - 1], dl
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [eax], cl
jmp 0x1006d3ec
movzx edx, byte [ebp - 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1006d4b0
add esp, 8
jmp 0x1006d37f
mov esp, ebp
pop ebp
ret
Function at 0x1006d5d0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1006d5f1
xor al, al
jmp 0x1006d622
mov ecx, dword [ebp + 8]
push ecx
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1006d60c
xor al, al
jmp 0x1006d622
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x1006d620
xor al, al
jmp 0x1006d622
mov al, 1
mov esp, ebp
pop ebp
ret