joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10060f60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x10061005
cmp dword [esi + 4], 0xffffffff
jne 0x10061005
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10060f92
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x10060fc7
cmp eax, 0x2f
je 0x10060fc7
push 0x100a21f4
push 0x104
push edi
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.1005fd10
add esp, 8
test eax, eax
jne 0x10060fe6
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.100601c0
xor ecx, ecx
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov dword [esi], eax
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100616e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x10061712
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10061712
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x100617d5
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x1006172f
cmp ax, 0x5c
jne 0x10061731
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x10061723
cmp esi, ebx
je 0x1006177a
sub esi, ebx
and esi, 0xfffffffe
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.MSVCR110.dll_memcpy
add esp, 0xc
cmp esi, 0x208
jae 0x100617e5
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.100616e0
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x1006179e
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100617d5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret
call fcn.10094b3c
int3
Function at 0x100638d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x10063ad6
cmp dword [esi + 0x6af90], 3
jb 0x10063948
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
movzx ecx, byte [edx + esi + 0x1af72]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x10063985
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x10063985
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x1006396f
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.100635b0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, esi
cmp edi, 3
jb 0x10063a56
mov edx, dword [esi + 0x6af84]
sub edx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
call fcn.10062da0
sub dword [esi + 0x6af90], edi
add esp, 4
mov dword [ebp - 4], eax
cmp edi, dword [esi + 0x6af98]
ja 0x10063a1d
cmp dword [esi + 0x6af90], 3
jb 0x10063a1d
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
movzx ecx, byte [esi + edx + 0x1af72]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec edi
jne 0x100639c3
mov eax, dword [ebp - 4]
jmp 0x10063a75
add dword [esi + 0x6af84], edi
mov eax, dword [esi + 0x6af84]
xor edi, edi
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x10063a7b
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.10062da0
add esp, 4
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x10063ab6
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x10063a93
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x10063a95
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push 0
push eax
mov ecx, esi
call fcn.10062bf0
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x10063ac9
mov ecx, esi
call fcn.10063770
cmp dword [esi + 0x6af90], 0
jne 0x100638f3
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x10063aea
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x10063aec
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push 1
push eax
mov ecx, esi
call fcn.10062bf0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10064820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1006482b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x100648f5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
add edx, 8
sub esi, 8
dec edi
jne 0x10064840
pop edi
test esi, esi
je 0x1006491a
lea esp, [esp]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100a7b58]
lea edx, [edx + 1]
dec esi
jne 0x10064900
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x10064930
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x100a7b58]
xor eax, esi
movzx ecx, al
add ecx, dword [edi + 4]
mov dword [edi], eax
mov eax, dword [edi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x100a7b58]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x10064e60
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x2d], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ebx
je 0x10064f4f
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x10064ea5
cmp dword [esi + 0x40], ebx
jae 0x10064ea5
push eax
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x10064ebe
lea eax, [ebx + ebx]
push eax
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call sub.MSVCR110.dll_memcpy
xor edx, edx
add esp, 0xc
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x10064f4c
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
movsx eax, bl
xor eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x100a7b58]
xor eax, ecx
mov dword [esi + 0x30], eax
movzx eax, al
add eax, dword [esi + 0x34]
mov edi, edx
imul eax, eax, 0x8088405
and edi, 0xfffd
or edi, 2
inc eax
mov dword [esi + 0x34], eax
mov ecx, edi
xor ecx, 1
shr eax, 0x18
imul ecx, edi
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x100a7b58]
shr ecx, 8
mov dword [esi + 0x38], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x3c]
xor cl, bl
mov ebx, dword [ebp - 8]
mov byte [edx + eax], cl
inc edx
mov dword [ebp - 0xc], edx
cmp edx, ebx
jb 0x10064ed4
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10064f8f
mov edx, dword [esi + 0x24]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x10064f6a
mov dword [esi + 0x14], 0x30000
jmp 0x10064fc2
push ebx
add ecx, edx
push edi
push ecx
call sub.MSVCR110.dll_memcpy
add esp, 0xc
add dword [esi + 0x24], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x10064fbb
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
Function at 0x10065480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x100654f9
mov ecx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp ecx, esi
jae 0x10065548
sub esi, ecx
cmp esi, dword [ebp + 0xc]
lea eax, [ecx + edx]
cmova esi, dword [ebp + 0xc]
push esi
push eax
push ebx
call sub.MSVCR110.dll_memcpy
mov ecx, dword [edi + 0x78]
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
mov edx, ebx
call fcn.10064820
add esp, 0x10
mov dword [edi + 0x78], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x10065541
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10065548
mov esi, dword [ebp - 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
mov edx, ebx
call fcn.10064820
add esp, 4
mov dword [edi + 0x78], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
Function at 0x100664a0
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret

Function at 0x10066520
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.100974c0
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x81e
push eax
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push eax
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x104c], 0x820
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104c]
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x1048]
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
jne 0x100665db
mov eax, dword [ebp - 0x1048]
cmp eax, 1
je 0x100665a8
cmp eax, 2
jne 0x100665db
push 0x100b78bc
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100665db
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x81e
push eax
mov word [ebp - 0x1044], ax
lea eax, [ebp - 0x1042]
push eax
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x104c], 0x820
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104c]
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x1048]
push eax
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
mov ecx, dword [ebp - 4]
test eax, eax
sete al
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x10066650
Capabilities:
Check if file exists
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
lea eax, [ebp - 0x628]
push eax
push 0
push 0x20019
push str.SOFTWAREMozilla
mov dword [ebp - 0x628], 0
call dword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyW]
test eax, eax
je 0x1006669c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call sub.MSVCR110.dll_memset
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
xor esi, esi
mov byte [ebp - 0x629], 0
push 0x10
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push dword [ebp - 0x628]
mov dword [ebp - 0x620], 0x208
call dword [sym.imp.SHLWAPI.dll_SHRegEnumUSKeyW]
inc esi
test eax, eax
jne 0x1006682d
push str.Mozilla_Firefox
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.Mozilla_Firefox
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x100666d2
push 0x206
push eax
mov dword [ebp - 0x624], eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x620], 0x208
call sub.MSVCR110.dll_memset
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0x14
mov edx, 0x82
push str.SOFTWAREMozilla
push ecx
lea ecx, [ebp - 0x20c]
call fcn.1001a460
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x100b7994
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 1
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x624]
push eax
push str.PathToExe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
jne 0x100666d2
mov eax, dword [ebp - 0x624]
cmp eax, 1
je 0x100667f0
cmp eax, 2
jne 0x100666d2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x100666d2
push str.firefox.exe
push eax
call edi
test eax, eax
jne 0x100666d2
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x100666d2
mov byte [ebp - 0x629], 1
push dword [ebp - 0x628]
call dword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x629]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x10067490
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push eax
mov dword [ebp - 0x14], ecx
xor bl, bl
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x1006761e
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100675f4
cmp eax, 0xffffffff
je 0x100675f4
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x100675f4
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100675db
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x100675db
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10067556
xor esi, esi
jmp 0x100675db
cmp dword [edi], 0x54534347
jne 0x100675db
push dword [edi + 0x14]
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100675db
mov eax, dword [ebp - 0xc]
add eax, 0xffffffe4
push eax
lea ecx, [edi + 0x1c]
push ecx
push eax
push ecx
push 0x26
push str.E54635FC_4016_4A34_A7B0_0D4E3E1FC257
mov dword [ebp - 0x14], eax
call sym.iImportLib.dll_int___cdecl_elex::safe::RC4_Encrypt_unsigned_char___int__unsigned_char___int__unsigned_char_const___int_
add esp, 0x18
test eax, eax
jne 0x100675db
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
lea ecx, [edi + 0x1c]
call fcn.10067110
add esp, 8
test eax, eax
je 0x100675db
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100675db
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
push edi
mov edi, dword [sym.imp.MSVCR110.dll_free]
call edi
mov eax, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x100675f4
push eax
call edi
add esp, 4
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10067604
push eax
call edi
test esi, esi
je 0x1006760b
push esi
call edi
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x10067630
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
mov dword [ebp - 0xc], ecx
xor bl, bl
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100676e5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x100676da
cmp eax, 0xffffffff
je 0x100676da
cmp eax, 0x1c
jb 0x100676da
push esi
push 0x1c
call dword [sym.imp.MSVCR110.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x100676d9
push 0
lea eax, [ebp - 8]
push eax
push 0x1c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100676cf
cmp dword [ebp - 8], 0x1c
jne 0x100676cf
cmp dword [esi], 0x54534347
jne 0x100676cf
mov ecx, dword [ebp - 0xc]
push 0xe
lea eax, [esi + 4]
push eax
call fcn.10012ea0
mov bl, 1
push esi
call dword [sym.imp.MSVCR110.dll_free]
add esp, 4
pop esi
test edi, edi
je 0x100676e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret

Function at 0x10067700
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
mov dword [ebp - 0xc], ecx
xor bl, bl
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100677b5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x100677aa
cmp eax, 0xffffffff
je 0x100677aa
cmp eax, 0x52
jb 0x100677aa
push esi
push 0x52
call dword [sym.imp.MSVCR110.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x100677a9
push 0
lea eax, [ebp - 8]
push eax
push 0x52
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006779f
cmp dword [ebp - 8], 0x52
jne 0x1006779f
cmp dword [esi], 0x4c534347
jne 0x1006779f
mov ecx, dword [ebp - 0xc]
push 0xe
lea eax, [esi + 0x1c]
push eax
call fcn.10012ea0
mov bl, 1
push esi
call dword [sym.imp.MSVCR110.dll_free]
add esp, 4
pop esi
test edi, edi
je 0x100677b5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret
Function at 0x100677d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 9], 0
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100678f1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x100678e6
cmp esi, 0xffffffff
je 0x100678e6
push edi
push esi
call dword [sym.imp.MSVCR110.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x100678e5
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100678cc
cmp esi, dword [ebp - 8]
jne 0x100678cc
cmp dword [edi], 0x54534347
jne 0x100678cc
push dword [edi + 0x14]
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100678cc
lea eax, [esi - 0x1c]
push eax
lea ecx, [edi + 0x1c]
push ecx
push eax
push ecx
push 0x26
push str.E54635FC_4016_4A34_A7B0_0D4E3E1FC257
mov dword [ebp - 0x18], eax
call sym.iImportLib.dll_int___cdecl_elex::safe::RC4_Encrypt_unsigned_char___int__unsigned_char___int__unsigned_char_const___int_
add esp, 0x18
test eax, eax
jne 0x100678cc
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea ecx, [edi + 0x1c]
call fcn.10067110
add esp, 8
test eax, eax
je 0x100678cc
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.10012ea0
mov byte [ebp - 9], 1
mov esi, dword [sym.imp.MSVCR110.dll_free]
push edi
call esi
mov eax, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x100678e5
push eax
call esi
add esp, 4
pop edi
test ebx, ebx
je 0x100678f1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 9]
pop esi
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret