joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20004430
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x2001a013
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.2000e860
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x2001b94c
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.200199e6
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x20004497
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.20005600
jmp 0x20004499
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x20008aa0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.2000b790
push 1
push ebx
push ebx
push esi
push 0x2000d0b0
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.2000b790
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x200051a0
Capabilities:
Delete file

Disassembly:
sub esp, 0x410
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x418]
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 3
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x200051e6
xor al, al
pop edi
add esp, 0x410
ret
push ebx
push ebp
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x42c]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x400
mov byte [esp + 0x2b], 0
call dword [0x2001b0c8]
test eax, eax
jne 0x20005308
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x42c]
test eax, eax
lea esi, [esp + 0x20]
jbe 0x20005266
mov ebx, dword [0x2001b32c]
push ebp
push esi
call ebx
add esp, 8
test eax, eax
je 0x2000529e
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x14]
dec ecx
lea esi, [esi + ecx + 1]
mov ecx, esi
sub ecx, edx
cmp ecx, eax
jb 0x2000523b
cmp dword [esp + 0x430], 1
jne 0x20005370
lea esi, [esp + eax + 0x1f]
push ebp
push esi
call dword [0x2001b290]
mov edi, dword [0x2001b28c]
push esi
call edi
push esi
mov byte [eax + esi + 1], 0
call edi
mov edx, dword [esp + 0x14]
lea ecx, [edx + eax + 1]
jmp 0x20005348
mov eax, dword [esp + 0x430]
test eax, eax
jne 0x20005370
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
or edx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
mov edi, esi
not ecx
dec ecx
sub edx, ecx
or ecx, 0xffffffff
add eax, edx
mov dword [esp + 0x14], eax
sub eax, esi
lea eax, [esp + eax + 0x21]
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi + 1]
push ecx
push esi
call dword [0x2001b39c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp ecx, 3
jae 0x2000534c
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_CloseWindowStation]
jmp 0x20005369
cmp dword [esp + 0x430], 1
jne 0x20005370
mov edi, dword [esp + 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
inc ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x42c]
push eax
push 7
push 0
push ecx
push edx
call dword [0x2001b0cc]
test eax, eax
sete byte [esp + 0x13]
mov eax, dword [esp + 0x18]
push eax
call dword [0x2001b0d0]
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x410
ret
Function at 0x20005400
Capabilities:
Enumerate devices by category

Disassembly:
push 0xffffffffffffffff
push 0x20019ebb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x828
lea eax, [esp + 0x14]
push ebp
push eax
xor ebp, ebp
push 0x2001eed0
push 1
push ebp
push 0x2001ef60
mov byte [esp + 0x1b], 0
call dword [0x2001b604]
cmp eax, ebp
je 0x20005457
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ebp
push edx
mov ecx, dword [eax]
push 0x2001ef50
push eax
mov dword [esp + 0x844], ebp
call dword [ecx + 0xc]
cmp eax, ebp
je 0x200054ac
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebp
je 0x20005494
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebp
jne 0x200055bf
push ebx
mov ebx, dword [0x2001b1b4]
push esi
mov esi, dword [esp + 0x844]
push edi
mov edi, dword [0x2001b28c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0x2001ee80
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x20005594
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push 0
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push 0x20023b14
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x2000558a
mov eax, dword [esp + 0x30]
push eax
call dword [0x2001b348]
add esp, 4
test eax, eax
jbe 0x2000558a
test esi, esi
je 0x20005586
mov edx, dword [esp + 0x30]
push 0
push 0
lea ecx, [esp + 0x40]
push 0x800
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call ebx
lea eax, [esp + 0x38]
push 0x64
push eax
push esi
call dword [0x2001b384]
add esp, 0xc
push esi
call edi
push esi
lea ebp, [eax + ebp + 1]
call edi
mov ecx, dword [esp + 0x30]
lea esi, [esi + eax + 1]
push ecx
call dword [0x2001b3dc]
inc byte [esp + 0x13]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
je 0x200054ea
pop edi
pop esi
pop ebx
mov eax, dword [esp + 0x840]
test eax, eax
je 0x200055cc
mov dword [eax], ebp
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
test eax, eax
je 0x200055e5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x82c]
mov al, byte [esp + 7]
pop ebp
mov dword fs:[0], ecx
add esp, 0x834
ret
Function at 0x20005ef0
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.20001da0
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x20005f25
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x200252f0]
xor eax, edx
inc ecx
dec esi
jne 0x20005f06
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x20005f41
push esi
push 0x200229c4
push eax
call dword [0x2001b48c]
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x200064d0
Capabilities:
Copy file
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x10], 0x20023cf8
mov dword [esp + 0x14], 0x20023cec
mov dword [esp + 0x18], 0x20023ce4
jbe 0x200064fc
lea ebx, [eax - 1]
jmp 0x200064fe
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea edi, [esp + ebx*4 + 0x10]
test eax, eax
jbe 0x2000650f
dec eax
jmp 0x20006514
mov eax, 2
cmp ebx, eax
ja 0x2000653f
mov eax, dword [edi]
push eax
push 0
call ebp
mov esi, eax
test esi, esi
je 0x20006535
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x20]
inc ebx
add edi, 4
jmp 0x20006508
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x20007370
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001b8f8
push 0x20019a30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
push ebx
push esi
push edi
mov byte [ebp - 0x53c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x53b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
push 0xf003f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, eax
mov dword [ebp - 0x13c], edi
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
push edi
call dword [0x2001b0ac]
mov esi, eax
mov dword [ebp - 0x540], esi
test edi, edi
jne 0x200073f5
test esi, esi
je 0x20007460
lea eax, [ebp - 0x138]
push eax
push esi
call dword [0x2001b064]
test eax, eax
je 0x20007460
cmp dword [ebp - 0x134], 1
je 0x2000742f
lea ecx, [ebp - 0x138]
push ecx
push 1
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x20007460
push 0x320
call dword [0x2001b2b8]
push ebx
mov edx, dword [0x200220a0]
push edx
lea eax, [ebp - 0x53c]
push eax
call dword [0x2001b48c]
add esp, 0xc
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea ecx, [ebp - 0x53c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x2001b404]
mov dword [ebp - 4], 0xffffffff
call fcn.20007489
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x200084f0
Capabilities:
Get file size

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], ecx
push 0x2000
mov dword [esp + 0x18], 0xff
call fcn.200199e6
add esp, 4
mov esi, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], 0x2000
push 0x400
push 0x40
call dword [0x2001b244]
mov edi, dword [esp + 0x12c]
mov ebp, eax
push edi
lea eax, [ebp + 2]
mov byte [ebp], 0x8f
push eax
mov byte [ebp + 1], 0xb
call dword [0x2001b290]
push edi
call dword [0x2001b28c]
mov ebx, eax
lea ecx, [esp + 0x10]
add ebx, 3
push ecx
push esi
lea eax, [esp + 0x1c]
lea edx, [ebx + ebp]
lea ecx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x134]
push 0
push eax
push ecx
push 0
push edx
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x103
je 0x20008667
test eax, eax
jne 0x2000861e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebp
lea ecx, [ebx + eax]
lea edi, [ecx + edx]
call dword [0x2001b304]
lea ecx, [edi + 8]
cmp ecx, eax
jbe 0x200085c5
add edi, 0x400
push 0x42
push edi
push ebp
call dword [0x2001b248]
mov ebp, eax
mov edx, dword [esp + 0x10]
add ebx, 4
mov dword [ebx + ebp], edx
mov ecx, dword [esp + 0x14]
add ebx, 4
test ecx, ecx
jbe 0x200085f7
mov eax, ecx
lea esi, [esp + 0x24]
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
lea ebx, [ebx + ecx + 1]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jbe 0x2000861e
mov edx, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
add ebx, eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [ebx + ebp]
push esi
push edx
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x34]
inc eax
push ecx
push edx
mov dword [esp + 0x34], eax
push eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0x2c], 0x2000
push eax
mov dword [esp + 0x34], 0xff
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x103
jne 0x2000858f
push esi
call fcn.200199d6
mov ecx, dword [esp + 0x24]
add esp, 4
push ebx
push ebp
call fcn.20014e80
push ebp
call dword [0x2001b254]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8
Function at 0x2000c140
Capabilities:
Clear file content

Disassembly:
push 0xffffffffffffffff
push 0x2001a168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.2000e860
push 0xf003f
push 0
push 0
mov dword [esp + 0x1c], 0
mov dword [esi], 0x2001b97c
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x30
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.2000fdf0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x2000c1b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [0x2001b2cc]
test eax, eax
je 0x2000c226
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [0x2001b2ec]
test eax, eax
je 0x2000c226
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x2000c226
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x2000c214
mov edx, esi
cmp edi, ebx
jb 0x2000c21e
add edx, ebx
cmp edi, edx
jbe 0x2000c230
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x2000c206
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x2000c4f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [0x20022a80]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [0x2001b290]
lea edx, [esp + 0x10]
push 0x20023c60
push edx
call fcn.2000baa0
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
push eax
call dword [0x2001b2dc]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x2000c5ad
push edi
push esi
push ebx
call dword [0x2001b238]
mov edi, eax
push edi
call dword [0x2001b37c]
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x2001b234]
xor eax, eax
test edi, edi
jbe 0x2000c584
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x2000c576
push edi
push esi
mov ecx, ebp
call fcn.20011330
push esi
mov edi, eax
call dword [0x2001b380]
add esp, 4
push ebx
call dword [0x2001b2e4]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x2000db40
Capabilities:
Move file

Disassembly:
sub esp, 0x30
push esi
lea eax, [esp + 0x14]
mov esi, ecx
push edi
mov dword [esp + 8], eax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x20]
push ecx
push 4
push edx
push eax
call sub.KERNEL32.dll_CreateEventA
test eax, eax
je 0x2000db7c
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.2000f1f0
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
mov word [edx], 0x500
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
mov word [eax + 2], 0x500
mov eax, dword [esp + 0x10]
push edx
push eax
call sub.KERNEL32.dll_VirtualFree
mov ecx, dword [esp + 0x14]
push ecx
call fcn.200199d6
mov edx, dword [esp + 0x10]
add esp, 4
push edx
call sub.KERNEL32.dll_MoveFileA
mov ecx, dword [esp + 8]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x30
ret 4
Function at 0x2000dd10
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x20019f00
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x2000dd49
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x2001eed0
push 1
push ebx
push 0x2001ef60
call dword [0x2001b604]
cmp eax, ebx
je 0x2000dd98
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x2000dde2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x2001ef50
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x2000ddf7
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x2000ddcc
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x2000dde2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x2000deb6
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x2001ee80
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x2000de8c
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push 0x20023b14
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x2000de82
cmp esi, edi
jne 0x2000de77
mov eax, dword [esp + 0x14]
push ebp
push 0x2001eec0
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [0x2001b3dc]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x2000de27
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x2000dec9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x2000dedf
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x2000e9e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x2000e9f0
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x2000ea0c
cmp al, 0x2b
jne 0x2000ea0c
mov al, 1
ret
xor al, al
ret

Function at 0x2000fdf0
Capabilities:
Clear file content
Get common file path
Get startup folder

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, eax
cmp ebx, esi
je 0x2000ff56
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x2001b37c]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.200199e6
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x2000ff26
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x2000ff12
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x2001b384]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.2000f260
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x2000fec6
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call fcn.20014e80
mov eax, dword [esp + 0x28]
push eax
call dword [0x2001b380]
push ebp
call fcn.200199d6
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x20010110
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push esi
push edi
push 0x104
push eax
call dword [0x2001b128]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x200229c8
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [0x2001b2f0]
lea edx, [esp + 0x14]
push edx
call dword [0x2001b28c]
lea ebx, [esp + eax + 0x14]
mov eax, dword [0x20022a80]
or ecx, 0xffffffff
push ebx
lea edi, [eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sym.davclnt.dll_DllCanUnloadNow
mov edi, 0x20023344
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x28]
push 2
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x2001b2dc]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x200102b1
mov esi, dword [0x20022a80]
mov ecx, 0x17e
lea edi, [esp + 0x21c]
push 0
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [0x2001b358]
push eax
call dword [0x2001b35c]
mov edi, dword [0x2001b364]
add esp, 8
call edi
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fmul qword [0x2001b8f0]
call fcn.200199e0
test al, al
je 0x20010221
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x2001023f
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x224]
push 0x5f8
push edx
push ebx
call dword [0x2001b2c4]
push ebx
call dword [0x2001b2e4]
mov edi, 0x20023334
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.20007ad0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x808
ret