joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25cffe4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xb949ef8d
push ebx
mov dword [esp + 4], eax
mov byte [esp], dl
push dword [esp + 4]
ret 8
lea eax, [0x25c84ff]
push 0x5bbe7f96
mov dword [esp], 0x25c89d2
jmp 0x25c6ee5
mov byte [edi - 1], 0
movzx ax, dl
jb 0x285b43e
bswap ax
movzx eax, al
push ebx
mov ax, 0xcb0b
mov al, cl
lahf
jmp 0x25c8f98
lea esp, [esp + 0x24]
ja 0x285a98e
bt edi, 0x1f
inc al
clc
sub ebx, edi
adc di, di
add ebx, esp
bsr di, si
inc al
shld edi, ecx, 0xe
mov edi, ebx
or al, 0x94
add al, 0x7b
sal al, cl
mov al, 0x2e
stc
pushfd
cmp si, bx
repne scasb al, byte es:[edi]
push 0x984cb43a
push edi
pushal
pushfd
lea esp, [esp + 0x30]
jne 0x25c738d
jmp 0x25cc8f9
not eax
setne ah
movsx eax, bl
mov ax, sp
push ebx
pushal
lahf
lea eax, [0x25c84ff]
pushal
mov dword [esp + 0x3c], 0x156dfe6
pushfd
call fcn.0285ebef
and al, 0x3c
out 0xdf, al
push esi
add dword [eax + ebp*8 + 0x378e], ebx
mov edx, 0x1d9739ab
cmc
dec edi
push esp
mov esp, 0x6e35e3e
jle 0x285b455
rol dword [ecx - 0x16], cl
cmp al, 0xe5
dec ebx
test eax, 0xeb42d027
inc ecx
imul esp, dword [edi - 0x23], 0xffffffed
cmpsd dword [esi], dword es:[edi]
fist dword [ecx + 0x63]
jp 0x285b466
mov edx, 0x34bec29c
mov dh, 0x1f
sbb esp, dword [ebp - 0x47ade14b]
sti
xchg esi, eax
jg 0x285b4bb
leave
mov ebp, 0x14226023
xor dh, byte [edx + 0x3f]
popal
push ebp
mov ebx, 0x6dcaed3b
popal
lcall 0x3526, 0x8669d43d
sub dword [edi + 0x755c4f7d], ecx
mov ah, 0xe7
hlt
mov byte [0x1ebc5e00], al
neg byte [esp + esi - 0x3e]
or byte [edx], 0xf
sbb esp, dword [ebp + 0xf2bc1b5]
push 0xffffffffffffffaa
lahf
xor dword [ecx - 0x35], 0x4d
dec ecx
xor dword [ebp - 0x4ec4b2f2], ebp
ret

Function at 0x285f0d6
Capabilities:
Encode data using base64

Disassembly:
push 0xc91b3fc6
call fcn.02859038
push edi
push eax
retf 0xa628
clc
sub ecx, dword [edx + 0x10]
test bh, cl
cmp ecx, dword [edx + 0x14]
jmp 0x285bd12
push 0x12a1956
lea esp, [esp + 4]
jl 0x1572f49
pushfd
lea esp, [esp + 4]
jae fcn.025c960d
pushal
push esi
lea esp, [esp + 0x24]
jmp 0x25cf86e
pushfd
lea esp, [esp + 0x38]
jbe 0x25ca61e
shr di, 6
mov edi, dword [edx + 0x24]
shl cl, 2
btr cx, 0xf
dec bh
add edi, eax
pushfd
clc
mov ebx, dword [edx + 0x20]
pop ecx
add ch, cl
movsx ecx, cl
test sp, di
add ebx, eax
jle 0x25c618d
push 0x55546a23
bswap ecx
shld cx, si, 4
mov dword [ebp - 8], 0
stc
movsx cx, cl
rcr ch, 6
mov ecx, dword [edx + 0x18]
lea esp, [esp + 4]
Function at 0x1b01f769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1b023190
cmp edx, dword [eax]
je 0x1b01f78b
add eax, 8
inc ecx
cmp eax, 0x1b023220
jl 0x1b01f77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1b023190]
jne 0x1b01f8b9
mov eax, dword [0x1b023bb0]
cmp eax, 1
je 0x1b01f893
test eax, eax
jne 0x1b01f7bc
cmp dword [0x1b0230e4], 1
je 0x1b01f893
cmp edx, 0xfc
je 0x1b01f8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1b01f7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1b020670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1b020490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1b01f836
lea eax, [ebp - 0x1a4]
push eax
call fcn.1b020490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1b02245c
push edi
call fcn.1b020f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1b020670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1b020680
lea eax, [ebp - 0xa0]
push 0x1b02243c
push eax
call fcn.1b020680
push dword [esi + 0x1b023194]
lea eax, [ebp - 0xa0]
push eax
call fcn.1b020680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1b020e75
add esp, 0x2c
pop edi
jmp 0x1b01f8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x1b023194]
push 0
push eax
push dword [esi]
call fcn.1b020490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x10105e78
Capabilities:
Authenticate hmac

Disassembly:
clc
stc
imul edx, edx, 0xa
lea esp, [esp + 0xc]
ja 0x101c5761
bt ax, 3
jmp 0x100f59bf
add esp, 0x2c
ja 0x10109b69
test edi, edi
call fcn.100f41ce
mov byte [esp], 0x73
lea esp, [esp + 0x24]
je 0x1010c71f
bt cx, 4
call fcn.1010812f
lea esp, [esp + 0x20]
je 0x1010c71f
jmp 0x1010b948
pushal
test edi, edi
mov word [esp], 0x1c86
jmp 0x10107bc2
bt edx, 0x10
stc
jmp 0x10108121
call fcn.1010b1d6
cmp al, 9
jmp 0x10104e64
Function at 0x10001950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 5
jne 0x100019f9
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea eax, [ebp - 0x21f]
push eax
call fcn.100542e0
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call fcn.100542e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x100019ed
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x114], eax
mov edx, dword [ebp + 8]
mov dword [0x1008a1e4], edx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070938
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x10007580
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x1000758c
mov al, 1
jmp 0x1000772f
mov dword [ebp - 0x10], 8
call fcn.10006070
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10006070
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10006050
add esp, 8
movzx eax, al
test eax, eax
je 0x100075cf
xor al, al
jmp 0x1000772f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10006af0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.10006b30
mov ecx, eax
call fcn.10007830
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.10003a40
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.10006b30
mov ecx, eax
call fcn.10007830
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.10007cf0
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x1000764a
cmp dword [ebp - 0x6c], 1
je 0x10007651
cmp dword [ebp - 0x6c], 3
je 0x100076eb
jmp 0x10007703
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10006b30
mov ecx, eax
call fcn.10007830
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x100076b4
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.10006b30
mov ecx, eax
call fcn.10007830
push eax
call fcn.1005731b
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x100076b4
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10001a80
mov al, byte [ebp - 0x61]
jmp 0x1000772f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x100076d7
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10001a80
mov al, byte [ebp - 0x62]
jmp 0x1000772f
cmp dword [ebp - 0x38], 0
jne 0x100076e9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.100028c0
jmp 0x1000771b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10001a80
mov al, byte [ebp - 0x63]
jmp 0x1000772f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10001a80
mov al, byte [ebp - 0x64]
jmp 0x1000772f
jmp 0x100075e2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret
Function at 0x1000e690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007113b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1d0], ecx
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x1a4], 0
push 0x18f
push 0
lea eax, [ebp - 0x1a3]
push eax
call fcn.100542e0
add esp, 0xc
lea ecx, [ebp - 0x1a4]
push ecx
push 0x10072d10
push str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.1000e390
add esp, 0xc
movzx edx, al
test edx, edx
je 0x1000e717
lea eax, [ebp - 0x1a4]
push eax
mov ecx, dword [ebp - 0x1d0]
call fcn.1000e430
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x1a4]
push ecx
push str.ProductId
push 0x10072d54
call fcn.1000e390
add esp, 0xc
movzx edx, al
test edx, edx
je 0x1000e74c
lea eax, [ebp - 0x1a4]
push eax
mov ecx, dword [ebp - 0x1d0]
call fcn.1000e430
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x1a4]
push ecx
push str.BIOSVendor
push str.HARDWAREDESCRIPTIONSystemBIOS
call fcn.1000e390
add esp, 0xc
movzx edx, al
test edx, edx
je 0x1000e833
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.100039a0
mov dword [ebp - 4], 0
mov byte [ebp - 0x1b0], 0
xor ecx, ecx
mov dword [ebp - 0x1af], ecx
mov dword [ebp - 0x1ab], ecx
mov word [ebp - 0x1a7], cx
mov byte [ebp - 0x1ab], 0x6c
mov byte [ebp - 0x1af], 0x61
mov byte [ebp - 0x1ac], 0x6c
mov byte [ebp - 0x1ae], 0x72
mov byte [ebp - 0x1a7], 0x20
mov byte [ebp - 0x1ad], 0x61
mov byte [ebp - 0x1a8], 0x73
mov byte [ebp - 0x1a9], 0x6c
mov byte [ebp - 0x1aa], 0x65
mov byte [ebp - 0x1b0], 0x50
push 0
lea edx, [ebp - 0x1b0]
push edx
lea ecx, [ebp - 0x1cc]
call fcn.10004810
test eax, eax
jne 0x1000e807
mov byte [ebp - 0xd], 1
push 0
push 0x10072db4
lea ecx, [ebp - 0x1cc]
call fcn.10004810
test eax, eax
jne 0x1000e821
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1cc]
call fcn.10001a80
movzx eax, byte [ebp - 0xd]
cmp eax, 1
jne 0x1000e852
mov ecx, dword [ebp - 0x1d0]
mov edx, dword [ecx]
add edx, 0x80
mov eax, dword [ebp - 0x1d0]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret
Function at 0x1000e870
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007117b
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x168], ecx
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x144], 0
lea ecx, [ebp - 0x160]
call fcn.10001a50
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffff
jne 0x1000e8f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.10001a80
jmp 0x1000ea4c
mov dword [ebp - 0x13c], 0x128
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000e935
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.10001a80
jmp 0x1000ea4c
mov dword [ebp - 0x164], 0
jmp 0x1000e950
mov eax, dword [ebp - 0x164]
add eax, 1
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x104
jge 0x1000e982
mov ecx, dword [ebp - 0x164]
movsx edx, byte [ebp + ecx - 0x118]
push edx
call fcn.10058951
add esp, 4
mov ecx, dword [ebp - 0x164]
mov byte [ebp + ecx - 0x118], al
jmp 0x1000e941
lea edx, [ebp - 0x118]
push edx
lea ecx, [ebp - 0x160]
call fcn.10003a20
push 0
push 0x10072db8
lea ecx, [ebp - 0x160]
call fcn.10004810
test eax, eax
jbe 0x1000e9f4
push 0
push str.vboxservice.
lea ecx, [ebp - 0x160]
call fcn.10004810
test eax, eax
jne 0x1000e9cf
mov eax, dword [ebp - 0x144]
add eax, 1
mov dword [ebp - 0x144], eax
push 0
push str.vboxtray.
lea ecx, [ebp - 0x160]
call fcn.10004810
test eax, eax
jne 0x1000e9f4
mov ecx, dword [ebp - 0x144]
add ecx, 1
mov dword [ebp - 0x144], ecx
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000e935
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x144], 1
jle 0x1000ea3a
mov edx, dword [ebp - 0x168]
mov eax, dword [edx]
add eax, 0x100
mov ecx, dword [ebp - 0x168]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.10001a80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret
Function at 0x1000ebe0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100711f6
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c8], ecx
mov byte [ebp - 0xd], 0
push 0x104
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x27c]
push ecx
lea ecx, [ebp - 0x174]
call fcn.100039a0
mov dword [ebp - 4], 0
push str.drivers.
lea ecx, [ebp - 0x174]
call fcn.10002690
mov dword [ebp - 0x158], 0
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x174]
call fcn.10001aa0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0xffffffff
jne 0x1000ecab
mov byte [ebp - 0x29d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10001a80
mov al, byte [ebp - 0x29d]
jmp 0x1000ee42
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1000edec
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x29c]
call fcn.100039a0
mov byte [ebp - 4], 1
push fcn.10058951
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x29c]
call fcn.10006b30
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x29c]
call fcn.1000ee60
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x29c]
call fcn.10006b30
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.1000ee90
add esp, 0x20
push 0
push str.prleth.sys
lea ecx, [ebp - 0x29c]
call fcn.10004810
test eax, eax
jne 0x1000ed56
mov byte [ebp - 0xd], 1
push 0
push str.prlfs.sys
lea ecx, [ebp - 0x29c]
call fcn.10004810
test eax, eax
jne 0x1000ed70
mov byte [ebp - 0xd], 1
push 0
push str.prlmouse.sys
lea ecx, [ebp - 0x29c]
call fcn.10004810
test eax, eax
jne 0x1000ed8a
mov byte [ebp - 0xd], 1
push 0
push str.prlvideo.sys
lea ecx, [ebp - 0x29c]
call fcn.10004810
test eax, eax
jne 0x1000eda4
mov byte [ebp - 0xd], 1
push 0
push str.prl_pv32.sys
lea ecx, [ebp - 0x29c]
call fcn.10004810
test eax, eax
jne 0x1000edbe
mov byte [ebp - 0xd], 1
push 0
push str.vpc_s3.sys
lea ecx, [ebp - 0x29c]
call fcn.10004810
test eax, eax
jne 0x1000edd8
mov byte [ebp - 0xd], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x29c]
call fcn.10001a80
jmp 0x1000ecab
mov ecx, dword [ebp - 0x280]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
movzx edx, byte [ebp - 0xd]
cmp edx, 1
jne 0x1000ee23
mov byte [ebp - 0x2c1], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10001a80
mov al, byte [ebp - 0x2c1]
jmp 0x1000ee42
mov byte [ebp - 0x2c2], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10001a80
mov al, byte [ebp - 0x2c2]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret
Function at 0x1000f220
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x10010290
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071258
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8c], ecx
push 0
push 0x20
push 3
push 0
push 0
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x100103cc
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
add edx, 0xa
push edx
call fcn.10053562
add esp, 4
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xa
push ecx
call fcn.10053562
add esp, 4
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x14]
add eax, 0xa
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.100542e0
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 0xa
push edx
push 0
mov eax, dword [ebp - 0x80]
push eax
call fcn.100542e0
add esp, 0xc
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x7c]
call fcn.10001c50
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x80]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x7c]
call fcn.10002580
lea ecx, [ebp - 0x7c]
call fcn.10003a40
cmp eax, 0x64
jbe 0x100103bd
lea eax, [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x8c]
call fcn.100047c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.10001dd0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret 4
Function at 0x10010500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100712d8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp - 0x5c]
call fcn.10010960
movzx eax, al
cmp eax, 1
jne 0x10010547
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x5c]
call fcn.10010290
mov ecx, dword [ebp - 0x5c]
call fcn.10010960
movzx edx, al
cmp edx, 1
je 0x10010635
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.100039a0
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x54], esp
mov edx, dword [ebp + 0xc]
push edx
call fcn.100039a0
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x5c]
call fcn.10010660
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], 1
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x1001061d
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.10001e30
add esp, 8
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.100027f0
push eax
push 0
lea ecx, [ebp - 0x4c]
call fcn.10010fe0
push eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.10010f60
mov byte [ebp - 0x55], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10001a80
mov al, byte [ebp - 0x55]
jmp 0x10010637
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10011a10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp dword [0x1008be80], 0
jne 0x10011a24
jmp 0x10011b07
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
push 0xf
call dword [0x1008be7c]
push eax
push 0
push 0x443
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x1008be80]
push accept
push 0
push 0x435
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1008be80]
push 0
push 0
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x10011af5
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
call fcn.10053562
add esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x10011990
lea ecx, [ebp - 0x28]
push ecx
push 2
push 0x449
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1008be80]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.10057090
add esp, 4
mov esp, ebp
pop ebp
ret