joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10150960
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
jne 0x10150983
or ebx, eax
jmp 0x10150985
mov ebx, eax
push 2
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
je 0x1015099f
mov dword [esp + 0x1c], eax
push 0
push ebx
push esi
call fcn.10150ca0
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
sub eax, ebp
sub ecx, ebp
add esp, 0xc
cmp ecx, eax
mov dword [esp + 0x20], ecx
jl 0x101509c7
mov dword [esp + 0x20], eax
push 0x8000
call fcn.1017c342
mov ebx, eax
add esp, 4
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [eax + ebp]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x24]
push 0
push edx
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10150a11
or eax, 0xffffffff
jmp 0x10150a4d
mov edi, dword [esp + 0x24]
mov eax, edi
test edi, edi
mov dword [esp + 0x14], eax
jle 0x10150a4d
push 0
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x10150a49
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10150a58
cmp dword [esp + 0x10], edi
jne 0x10150a58
mov eax, dword [esp + 0x14]
add ebp, eax
cmp eax, 0x8000
jne 0x10150a6b
jmp 0x101509e1
push ebx
call fcn.1017c36b
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
sub eax, ecx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call fcn.1017c36b
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10150aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101974bb
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
mov ebx, dword [esp + 0x134]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
je 0x10150c44
push ebx
call fcn.1005f906
add esp, 4
test eax, eax
je 0x10150c44
push ebx
lea ecx, [esp + 0x18]
call fcn.10076d80
mov esi, dword [esp + 0x144]
mov dword [esp + 0x138], ebp
cmp esi, ebp
je 0x10150b11
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10150c30
neg esi
sbb esi, esi
mov dword [esp + 0x18], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
and esi, 0xc0000000
add esi, 0xc0000000
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x10150be4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10150b47
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x101ea0e4]
cmp eax, 0xffffffff
jne 0x10150b82
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [esp + 0x2c]
xor eax, eax
cmp ecx, 2
sete al
mov dword [0x101ea0e4], eax
test eax, eax
je 0x10150b9b
push 0
push 0x80
push 4
push 0
push 1
push esi
push ebx
call ebp
mov edi, eax
jmp 0x10150bc9
push ebx
lea ecx, [esp + 0x14]
call fcn.10071a40
mov edx, dword [esp + 0x10]
push 0
push 0x80
push 4
push 0
push 1
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.100721a0
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 3
mov dword [esp + 0x18], eax
jl 0x10150b2e
cmp edi, 0xffffffff
je 0x10150c7a
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push edi
call esi
cmp eax, 0xffffffff
jne 0x10150bfc
or ebp, eax
jmp 0x10150bfe
mov ebp, eax
push 2
push 0
push 0
push edi
call esi
cmp eax, 0xffffffff
jne 0x10150c10
or ebx, eax
jmp 0x10150c12
mov ebx, eax
push 0
push 0
push ebp
push edi
call esi
test ebx, ebx
jne 0x10150c7a
mov eax, dword [esp + 0x144]
test eax, eax
je 0x10150c60
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov dword [esp + 0x138], 0xffffffff
call fcn.10077520
or eax, 0xffffffff
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x12c
ret
lea eax, [esp + 0x10]
push 2
push eax
push 0
push edi
mov dword [esp + 0x20], 0xfeff
call fcn.10150780
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x138], 0xffffffff
call fcn.10077520
mov eax, edi
jmp 0x10150c47
Function at 0x101518e0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10197580
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.1007ceb0
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.1007ceb0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x102046f8]
test eax, eax
je 0x10151998
cmp ebp, eax
jne 0x10151998
mov eax, dword [0x102046fc]
test eax, eax
je 0x10151998
cmp ebx, eax
jb 0x10151998
add eax, 0x493e0
cmp eax, ebx
jb 0x10151998
mov ebp, dword [0x10204700]
push 1
inc ebp
push 0x10204618
lea ecx, [esp + 0x18]
mov dword [0x10204700], ebp
call fcn.10084010
push 0x10204648
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.1007d090
push 0x10204638
mov ecx, edi
call fcn.1007d090
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x10151a0e
push edi
push esi
mov dword [0x10204700], 0
call fcn.10151d10
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x10204618
call fcn.10084010
push 0xffffffffffffffff
push 0
mov ecx, 0x10204648
mov dword [esp + 0x38], 1
mov dword [0x102046f8], ebp
mov dword [0x102046fc], ebx
call fcn.1007ceb0
push esi
mov ecx, 0x10204648
call fcn.1007d090
push 0xffffffffffffffff
push 0
mov ecx, 0x10204638
call fcn.1007ceb0
push edi
mov ecx, 0x10204638
call fcn.1007d090
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10084070
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x10151d10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101975e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.1007ceb0
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.1007ceb0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x10151e49
mov edx, dword [0x101cf94c]
mov cx, word [0x101cf950]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.10076d80
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.1007d450
mov edx, dword [0x1019b4e4]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.100777a0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.1007d450
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.10077520
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.10077520
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x10151d6b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x1015dc70
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1015dcc9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1015dcc9
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x1015dcd0
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x1015dcad
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1015dccb
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x101637a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x101637f0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x101637f0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x101637f5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x101637db
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x10163802
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x10174ed0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x10174fb6
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x10174f43
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + 0x101eb6f8]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + 0x101eb6f8]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + 0x101eb6f8]
mov byte [ecx - 1], al
mov dl, byte [edx + 0x101eb6f8]
mov byte [ecx], dl
jmp 0x10174f9a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x10174f56
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + 0x101eb6f8]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + 0x101eb6f8]
mov byte [ecx - 1], al
jne 0x10174f86
mov ebx, 0x3d
jmp 0x10174f94
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + 0x101eb6f8]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x10174eea
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x10175390
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.1005ffe0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x101753bb
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x101753cd
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x10175539
push esi
call fcn.10177540
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x10175403
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.100c7980
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x10175442
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.100c5a30
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.100c5ba0
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.100c5ca0
add esp, 0x24
jmp 0x10175481
test ebp, ebp
jl 0x1017544e
cmp ebp, 0x80
jle 0x10175462
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.100c7980
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x101754a6
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x101754af
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.100c5a30
push esi
call fcn.10177540
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.100c5ba0
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x101754eb
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.100c5a30
push esi
call fcn.10177540
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.100c5ba0
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.100c5d50
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x1017551e
jmp 0x101754ad
Function at 0x10175d50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.1005ffe0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x10175ea4
cmp ebx, 0x80
jg 0x10175ea4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.10176660
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x10175de7
test ebp, ebp
jle 0x10175e35
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x10175dd4
jmp 0x10175e31
xor esi, esi
test ebp, ebp
jle 0x10175e35
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x10175e17
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x10175e13
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, reloc.WS2_32.dll_getsockopt
jns 0x10175e44
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x10175e75
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x10175e8c
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x10175e88
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1017db5a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1017db8a
push edi
call ebx
push eax
call fcn.1017dca8
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x1017dbb4
test byte [ebp - 4], 1
je 0x1017dbb4
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1017dbb4
push edi
call ebx
push eax
call fcn.1017dca8
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x1017dc5a
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.1017daa7
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x1017dbe6
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.1017daa7
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x1017dbfc
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.1017daa7
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1017dc26
push 0
call ebx
push eax
call fcn.1017dca8
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1017dc44
push eax
call ebx
push eax
call fcn.1017dca8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1017dc58
push eax
call ebx
push eax
call fcn.1017dca8
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x1017dc81
test byte [ebp - 4], 1
jne 0x1017dc81
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1017dc81
push edi
call ebx
push eax
call fcn.1017dca8
pop edi
pop ebx
leave
ret 8

Function at 0x101801e5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1018021d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1017d5fc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1017d5d3
jmp 0x10180229
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x36853b26
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x59e76c5d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x14d0fa28
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x14d12300]
test eax, eax
je 0x14d0fb16
cmp dword [ebp - 0xc], 0xc8
jne 0x14d0fb16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x14d12158]
mov esi, eax
cmp esi, 0xffffffff
je 0x14d0fb16
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x14d12150]
test eax, eax
je 0x14d0fabc
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [0x14d122ec]
test eax, eax
jne 0x14d0fac0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x14d0faf0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x14d12190]
test eax, eax
je 0x14d0fae7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x14d0faeb
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x14d0fa91
push esi
call dword [0x14d121a0]
push esi
call dword [0x14d12140]
cmp byte [ebp - 1], bl
je 0x14d0fb0c
push dword [ebp + 0xc]
call fcn.14d0eab6
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x14d0fb18
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x5ab93311
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x46b25309
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219