joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f5f7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x98], eax
je 0x101f726
cmp ebx, esi
je 0x101f726
push edi
xor eax, eax
mov dword [ebp - 0x94], esi
lea edi, [ebp - 0x90]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
push eax
mov dword [ebx], esi
call dword [sym.imp.ole32.dll_CoCreateGuid]
push esi
mov edi, eax
push edi
push 0x264
mov esi, 0x10037b0
push esi
call fcn.0101c3d2
test edi, edi
jl 0x101f711
push 0x40
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x101f696
push 0
mov eax, 0x80004005
push eax
push 0x26a
push esi
mov edi, eax
call fcn.0101c3d2
test edi, edi
jl 0x101f711
push ebx
lea eax, [ebp - 0x84]
push eax
call fcn.0101a143
push 0
mov edi, eax
push edi
push 0x271
push esi
call fcn.0101c3d2
test edi, edi
jl 0x101f711
mov ecx, dword [ebx]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x9c], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101f6c8
sub eax, dword [ebp - 0x9c]
inc eax
push eax
push ecx
push 1
push 0
push 0x10037bc
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x101f70d
jle 0x101f6fd
and eax, 0xffff
or eax, 0x80070000
push 0
mov edi, eax
push edi
push 0x27a
push esi
call fcn.0101c3d2
test edi, edi
jge 0x101f721
mov eax, dword [ebx]
test eax, eax
je 0x101f721
push eax
call fcn.0100dd74
and dword [ebx], 0
pop ecx
mov eax, edi
pop edi
jmp 0x101f72b
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
leave
ret 8
Function at 0x101f9bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call fcn.0100ddf9
or dword [esi], 0xffffffff
push dword [0x1043018]
lea eax, [ebp - 0x108]
push 0x1002f3c
push 0x104
push eax
call fcn.0100a18a
add esp, 0x1c
push ebx
mov esi, eax
push esi
push 0x293
mov edi, 0x10037b0
push edi
call fcn.0101c3d2
cmp esi, ebx
jl 0x101fb2e
push ebx
lea eax, [ebp - 0x10c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x101fa7e
jle 0x101fa6f
and eax, 0xffff
or eax, 0x80070000
push ebx
mov esi, eax
push esi
push 0x2a4
push edi
call fcn.0101c3d2
cmp esi, ebx
jl 0x101fb2e
lea eax, [ebp - 0x114]
push eax
push ebx
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x10037dc
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x101fac6
jle 0x101fab7
and eax, 0xffff
or eax, 0x80070000
push ebx
mov esi, eax
push esi
push 0x2ae
push edi
call fcn.0101c3d2
cmp esi, ebx
jl 0x101fb2e
cmp dword [ebp - 0x110], 4
je 0x101fae5
push ebx
mov esi, 0x80004005
push esi
push 0x2b6
push edi
call fcn.0101c3d2
cmp esi, ebx
jl 0x101fb2e
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x118]
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x10037dc
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x101fb2e
jle 0x101fb1f
and eax, 0xffff
or eax, 0x80070000
push ebx
mov esi, eax
push esi
push 0x2bf
push edi
call fcn.0101c3d2
cmp dword [ebp - 0x10c], ebx
je 0x101fb42
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
leave
ret 4
Function at 0x101fb55
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call fcn.0100ddf9
push dword [0x1043018]
lea eax, [ebp - 0x108]
push 0x1002f3c
push 0x104
push eax
call fcn.0100a18a
add esp, 0x1c
push ebx
mov esi, eax
push esi
push 0x2d6
push 0x10037b0
call fcn.0101c3d2
cmp esi, ebx
jl 0x101fc4c
push edi
push ebx
lea eax, [ebp - 0x10c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
mov edi, 0x80070000
je 0x101fc0d
jle 0x101fbfa
and eax, 0xffff
or eax, edi
push ebx
mov esi, eax
push esi
push 0x2e8
push 0x10037b0
call fcn.0101c3d2
cmp esi, ebx
jl 0x101fc4b
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push 0x10037dc
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x101fc4b
jle 0x101fc38
and eax, 0xffff
or eax, edi
push ebx
mov esi, eax
push esi
push 0x2f2
push 0x10037b0
call fcn.0101c3d2
pop edi
cmp dword [ebp - 0x10c], ebx
je 0x101fc60
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
leave
ret 4

Function at 0x101fc72
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x214], eax
jne 0x101fc9f
mov eax, 0x80070057
jmp 0x101fd87
push ebx
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
mov ebx, 0xffff
mov edi, 0x80070000
jne 0x101fcf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101fcd5
and eax, ebx
or eax, edi
push 0
mov esi, eax
push esi
push 0x337
push 0x10037b0
call fcn.0101c3d2
xor eax, eax
cmp esi, eax
jl 0x101fd83
jmp 0x101fcf7
xor eax, eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x210]
push ecx
push eax
push eax
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x101fd3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101fd2a
and eax, ebx
or eax, edi
push 0
mov esi, eax
push esi
push 0x342
push 0x10037b0
call fcn.0101c3d2
test esi, esi
jl 0x101fd83
mov eax, dword [ebp - 0x210]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x10037e4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0100a18a
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x101fd83
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.0101ab56
mov esi, eax
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100d61a
leave
ret 4
Function at 0x102093a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x102095c
mov eax, 0x80070057
jmp 0x10209c4
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0100ddf9
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x10209a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10209a5
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x10209c4
push 0x1003884
lea eax, [ebp - 0x108]
push eax
push fcn.01002ee8
push dword [ebp + 0xc]
push esi
call fcn.0100a18a
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100d61a
leave
ret 8

Function at 0x1021c11
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24ec
call fcn.01017dcc
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x28]
mov dword [ebp - 0x24e4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x24ec], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x24e8], eax
mov byte [ebx], 0
push 0x104
lea eax, [ebp - 0x414]
mov byte [esi], 0
push eax
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1021c9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call int.01009d20
push 0
push eax
push 0x26
push 0x1008a84
mov dword [ebp - 0x24e0], eax
call fcn.0101c3d2
cmp dword [ebp - 0x24e0], 0
jl 0x1021d95
push 0x1008a6c
lea eax, [ebp - 0x414]
push eax
push 0x1008a60
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0101cf61
add esp, 0x14
test eax, eax
mov dword [ebp - 0x24e0], eax
jl 0x1021d95
lea eax, [ebp - 0x20c]
push eax
call fcn.0101a894
dec eax
neg eax
sbb al, al
inc al
mov byte [edi], al
je 0x1021d95
lea eax, [ebp - 0x20c]
push eax
push 0x1064
lea eax, [ebp - 0x24dc]
push eax
mov edi, 0x1008a48
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
seta al
mov byte [esi], al
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x24e4]
push 0
push 0x1008a34
push edi
call esi
test eax, eax
seta al
test al, al
mov byte [ebx], al
jne 0x1021d5c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x24e4]
push 0
push 0x1008a14
push edi
call esi
test eax, eax
seta al
mov byte [ebx], al
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
mov edi, 0x1008a04
push dword [ebp - 0x24ec]
push 0
push 0x10089e8
push edi
call esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x1c]
push dword [ebp - 0x24e8]
push 0
push 0x10089dc
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24e0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
leave
ret 0x24
Function at 0x1021dd9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 4
pop esi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x20019
push edi
push 0x1008aa0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
je 0x1021e22
push eax
call int.01009d20
mov ebx, eax
cmp ebx, edi
jl 0x1021e5b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x1008a9c
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
je 0x1021e4c
push eax
call int.01009d20
mov ebx, eax
cmp ebx, edi
jl 0x1021e5b
xor eax, eax
inc eax
cmp dword [ebp - 0xc], eax
jne 0x1021e5b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], edi
pop edi
pop esi
pop ebx
je 0x1021e6c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x10236d2
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x414]
test eax, eax
push edi
mov edi, dword [ebp + 0xc]
je 0x1023736
push eax
push dword [edi + 4]
call fcn.010176df
test eax, eax
pop ecx
pop ecx
jne 0x102372c
mov edi, dword [edi]
push edi
mov dword [esi + 0x41c], edi
call fcn.0100d5aa
and dword [esi + 0x420], 0
mov dword [esi + 0x418], eax
pop ecx
mov eax, 0xcabfeed
jmp 0x1023832
mov eax, 0xdeadcab
jmp 0x1023832
mov al, byte [esi]
neg al
push ebx
push dword [edi + 4]
mov ebx, 0x104
push dword [edi + 0x10]
mov ecx, esi
push ebx
sbb eax, eax
and word [ebp - 0x20c], 0
and eax, 0xfffffc00
add eax, 0x400
or eax, 0x8321
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010235c6
cmp word [ebp - 0x20c], 0
jne 0x1023786
or eax, 0xffffffff
jmp 0x1023831
mov edi, 0x180
push edi
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0102304f
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1023831
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.01029a8a
lea eax, [ebp - 0x414]
push 0x5c
xor ebx, ebx
push eax
mov word [ebp - 0x20e], bx
call fcn.01029c33
add esp, 0x14
cmp eax, ebx
je 0x10237e0
mov word [eax], bx
lea eax, [ebp - 0x414]
push eax
call fcn.0101b8a1
push edi
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0102304f
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1023831
cmp byte [esi], bl
je 0x1023831
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0102304f
add esp, 0x10
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100d61a
leave
ret
Function at 0x1023840
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [esi + 4]
lea eax, [ebp - 0x20c]
push dword [esi + 0x10]
xor edi, edi
push 0x104
push eax
mov word [ebp - 0x20c], di
call fcn.010235c6
push dword [esi + 0x14]
call fcn.01023125
cmp word [ebp - 0x20c], di
pop ecx
jne 0x1023895
or eax, 0xffffffff
jmp 0x102391f
push ebx
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1023906
lea eax, [ebp - 0x21c]
push eax
movzx eax, word [esi + 0x1a]
push eax
movzx eax, word [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, 1
jne 0x10238ff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, 1
jne 0x10238ff
lea eax, [ebp - 0x214]
push eax
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [esi + 0x1c]
and eax, 0x27
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100d61a
leave
ret

Function at 0x1023b17
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x1008c58
mov dword [ebp - 8], ecx
call fcn.0101b1ab
mov ebx, eax
test ebx, ebx
jl 0x1023bd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1008c40
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x104a5b8], eax
mov edi, 0x80004005
jne 0x1023b5e
mov ebx, edi
test ebx, ebx
jl 0x1023bd1
push 0x1008c30
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x104a5bc], eax
jne 0x1023b77
mov ebx, edi
test ebx, ebx
jl 0x1023bd1
push 0x1008c1c
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x104a5c0], eax
jne 0x1023b90
mov ebx, edi
test ebx, ebx
jl 0x1023bd1
push 0x1008c04
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x104a5c4], eax
jne 0x1023ba9
mov ebx, edi
test ebx, ebx
jl 0x1023bd1
push 0x1008bfc
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x104a5c8], eax
jne 0x1023bc2
mov ebx, edi
test ebx, ebx
jl 0x1023bd1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
jmp 0x1023be0
cmp dword [ebp - 4], 0
je 0x1023be0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10246a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0100ddf9
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.0100ddf9
add esp, 0x18
inc esi
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x102472d
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1024718
and eax, 0xffff
or eax, 0x80070000
push ebx
mov edi, eax
push edi
push 0x5f
push 0x1008cb0
call fcn.0101c3d2
cmp edi, ebx
pop edi
jl 0x1024760
push 0x1008ce4
lea eax, [ebp - 0x108]
push eax
push fcn.01002ee8
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0100a18a
add esp, 0x14
cmp eax, ebx
jl 0x1024760
lea eax, [ebp - 0x20c]
push eax
call fcn.0102436b
jmp 0x1024762
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
leave
ret

Function at 0x1025a12
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x1025a4f
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1025a2c
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1025a6b
dec esi
je 0x1025a64
dec esi
jne 0x1025a70
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x402190
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4b3ca4]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x4928eb
push str.C:UsersPublic_sJNpFtPWRMh7YarO.bin
call fcn.0040d7b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4021c5
xor eax, eax
jmp 0x4022da
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040d9b0
add esp, 8
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x4021f7
mov edx, dword [ebp - 4]
push edx
call fcn.0040da10
add esp, 4
xor eax, eax
jmp 0x4022da
lea eax, [ebp - 0x138]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040d7f0
add esp, 0xc
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x40222e
mov edx, dword [ebp - 4]
push edx
call fcn.0040da10
add esp, 4
xor eax, eax
jmp 0x4022da
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x144], 0
jmp 0x402255
mov ecx, dword [ebp - 0x144]
add ecx, 1
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x144]
cmp edx, dword [ebp - 0x140]
jge 0x4022be
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040d7f0
add esp, 0xc
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040d970
add esp, 0xc
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x4022bc
mov eax, dword [ebp - 4]
push eax
call fcn.0040da10
add esp, 4
xor eax, eax
jmp 0x4022da
jmp 0x402246
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040da10
add esp, 4
push str.C:UsersPublic_sJNpFtPWRMh7YarO.bin
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043df47
mov esp, ebp
pop ebp
ret
Function at 0x402310
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x40232f
cmp dword [ebp + 0xc], 0
je 0x40232f
cmp dword [ebp + 0x10], 0
jne 0x402336
push 0
call fcn.00440b62
mov eax, dword [ebp + 8]
push eax
call fcn.004022f0
add esp, 4
test eax, eax
jne 0x40234d
push 0
call fcn.00440b62
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00440160
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4928ec
mov edx, dword [ebp + 8]
push edx
call fcn.004408ab
add esp, 8
mov dword [ebp - 0xc], eax
push 0x4928f0
mov eax, dword [ebp + 0xc]
push eax
call fcn.004408ab
add esp, 8
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044077f
add esp, 4
test eax, eax
jne 0x4023f4
mov edx, dword [ebp - 0xc]
push edx
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.00440762
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044077f
add esp, 4
test eax, eax
jne 0x4023f2
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + edx]
mov byte [ebp - 0xd], cl
movsx edx, byte [ebp - 1]
movsx eax, byte [ebp - 0xd]
xor edx, eax
mov byte [ebp - 1], dl
mov ecx, dword [ebp - 0x30]
push ecx
push 1
push 1
lea edx, [ebp - 1]
push edx
call fcn.00440440
add esp, 0x10
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x402384
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00440262
add esp, 4
mov edx, dword [ebp - 0x30]
push edx
call fcn.00440262
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x409380
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x409390
xor eax, eax
jmp 0x40952d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x4094ee
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x494820]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x494820]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x494820]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x494820]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x494820]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x494820]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x494820]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x494820]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x409399
cmp dword [ebp + 0x10], 0
je 0x409527
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x494820]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x4094f4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret