joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012352c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push ebx
push esi
mov esi, dword [0x101f9aac]
push edi
push dword [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1012359f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, 0xffffffff
je 0x1012359f
test eax, eax
je 0x1012359f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1012359f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x1012359f
push esi
call fcn.10144fc2
test eax, eax
pop ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
je 0x1012359f
push esi
push ebx
push eax
call fcn.10147010
mov eax, dword [esp + 0x24]
mov dword [eax], esi
xor eax, eax
add esp, 0xc
inc eax
jmp 0x101235a1
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x10123649
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push esi
mov esi, dword [0x101f9aa8]
push edi
push str.BASIC_RC
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x101236f0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, 0xffffffff
je 0x101236f0
test eax, eax
je 0x101236f0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x101236f0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x101236f0
and dword [ebp + 0xc], 0
push 0x101b1480
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.10147b95
add esp, 0xc
test eax, eax
jne 0x101236f0
push dword [ebp + 0xc]
push esi
push 1
push ebx
call fcn.10148a8b
add esp, 0x10
cmp eax, esi
push dword [ebp + 0xc]
jne 0x101236e1
call fcn.101475da
pop ecx
lea ecx, [ebp + 8]
call fcn.10003b75
xor eax, eax
inc eax
jmp 0x101236fa
call fcn.101475da
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
call fcn.10003b75
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x101246e5
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.26112016_98AA_40f6_8A05_A8438858979B
push 0
mov ecx, 0x101f8c68
call fcn.10016a0b
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x10124711
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10124728
push 1
call fcn.101243e8
test eax, eax
pop ecx
jne 0x10124728
push 0x101b80bc
call fcn.10095f16
pop ecx
test esi, esi
je 0x10124733
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x101248a4
Capabilities:
Delete registry value

Disassembly:
push 4
mov eax, 0x101960f3
call fcn.10145d80
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
xor esi, esi
cmp dword [eax - 8], esi
je 0x10124934
lea eax, [ebp + 8]
push eax
push 0x1019fce4
lea eax, [ebp - 0x10]
push eax
call fcn.1000ed2f
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10007845
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.10003b75
lea eax, [ebp + 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings
lea eax, [ebp - 0x10]
push eax
call fcn.1000ed2f
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10007845
lea ecx, [ebp - 0x10]
call fcn.10003b75
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.Flags
push dword [ebp + 8]
mov edi, SysReAllocString
push edi
call esi
push 0x101b155c
push dword [ebp + 8]
push edi
call esi
xor esi, esi
inc esi
lea ecx, [ebp + 8]
call fcn.10003b75
mov eax, esi
call fcn.10145e58
ret
Function at 0x10124f47
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.10146c80
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push 0x10000000
push dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
neg eax
sbb eax, eax
neg eax
leave
ret

Function at 0x1012969a
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
mov esi, ecx
mov dword [esi + 4], 0x1019f514
push edi
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
lea eax, [esi + 0x4c]
push eax
mov dword [esi], fcn.10128cef
mov dword [esi + 4], 0x101b8f28
mov dword [esi + 8], 0x101b8f18
call ebx
lea eax, [esi + 0x64]
push eax
call ebx
mov dword [esi + 0x7c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], 0x7530
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
cmp dword [0x101f99e4], edi
jne 0x10129734
push 0x101f99e4
push 4
push esi
push 0x1012962f
push edi
push edi
call fcn.10147cdf
mov ebx, eax
add esp, 0x18
cmp ebx, edi
je 0x10129734
push 0x4000
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x101f9a0c
call fcn.1009b8e4
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x1012991b
Capabilities:
Terminate thread

Disassembly:
mov dword [ecx], 0x101b8ffc
mov dword [ecx + 4], 0x101b8ff4
mov dword [ecx + 8], 0x101b8fe4
jmp fcn.10128c2e
Function at 0x1012cb5f
Capabilities:
Check mutex on windows
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x10197b78
call fcn.10145d80
mov edi, ecx
mov eax, dword [ebp + 0x14]
and dword [eax], 0
push str.4389F869_D241_4d55_B61B_846DC2319405
push 0
mov ecx, 0x101f8c68
call fcn.10016a0b
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [0x101f3028]
mov dword [ebp + 0x14], eax
and dword [ebp - 4], 0
push 0xe4
lea ecx, [ebp + 0x14]
call fcn.100045b9
test esi, esi
je 0x1012cbd0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
push esi
jne 0x1012cbc3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1012cc34
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0x2e
jne 0x1012cc1a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
je 0x1012cc34
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1012cc34
and dword [ebp - 0x18], 0
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x18]
push ecx
mov eax, 0x161
push eax
push 0x4e
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xfffffffe
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1012cc34
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1012cc34
cmp dword [ebp + 0xc], 0x41
jne 0x1012cc34
mov ecx, edi
call fcn.1012c483
lea ecx, [ebp + 0x14]
call fcn.10003b75
xor eax, eax
call fcn.10145e58
ret 0x10

Function at 0x1012d43e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
mov esi, ecx
jl 0x1012d538
lea edi, [esi + 0x44]
mov ecx, edi
call fcn.10064a33
cmp ebx, eax
jge 0x1012d538
mov ecx, dword [esi + 0x54]
call fcn.10004cde
cmp ebx, eax
jge 0x1012d538
mov ecx, dword [esi + 0x54]
push ebx
call fcn.10004cf1
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1012d538
and dword [ebp + 8], 0
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x54]
push eax
push dword [eax + 4]
lea ecx, [ebp - 8]
call fcn.10010e61
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
call fcn.100244f4
push dword [eax + 4]
mov ecx, dword [esi + 0x54]
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.1012cf90
push edi
push dword [edi + 4]
lea ecx, [ebp - 8]
call fcn.1006575b
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
call fcn.100656c4
push dword [eax + 4]
mov ecx, edi
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.1012cc4b
cmp dword [ebp + 0xc], 0
je 0x1012d533
push 1
mov ecx, esi
call fcn.1012c374
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0xc]
jmp 0x1012d53a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1012d541
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [edi + 0x44]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.10064a33
mov esi, eax
dec esi
js 0x1012d6a1
push esi
lea ecx, [edi + 0x44]
call fcn.1012bff8
cmp dword [eax + 8], ebx
je 0x1012d64f
mov ebx, dword [edi + 0x54]
mov ecx, ebx
mov dword [ebp - 0xc], 1
call fcn.10004cde
cmp esi, eax
jge 0x1012d64d
push esi
mov ecx, ebx
call fcn.10004cf1
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1012d64d
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0x54]
mov ecx, ebx
call fcn.10004cde
cmp esi, eax
jge 0x1012d613
push ebx
push dword [ebx + 4]
lea ecx, [ebp - 0x18]
call fcn.10010e61
push esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x18]
call fcn.100244f4
push dword [eax + 4]
mov ecx, dword [edi + 0x54]
push dword [eax]
lea eax, [ebp - 0x30]
push eax
call fcn.1012cf90
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.10064a33
cmp esi, eax
jge 0x1012d64a
push ebx
push dword [ebx + 4]
lea ecx, [ebp - 0x20]
call fcn.1006575b
push esi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.100656c4
push dword [eax + 4]
mov ecx, ebx
push dword [eax]
lea eax, [ebp - 0x40]
push eax
call fcn.1012cc4b
mov dword [ebp - 4], esi
xor ebx, ebx
dec esi
jns 0x1012d569
cmp dword [ebp - 4], 0xffffffff
je 0x1012d688
lea esi, [edi + 0x44]
mov ecx, esi
call fcn.10064a33
cmp eax, dword [ebp - 4]
jge 0x1012d675
mov ecx, esi
call fcn.10064a33
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, ebx
mov ecx, edi
jne 0x1012d681
push ebx
jmp 0x1012d683
dec eax
push eax
call fcn.1012c432
cmp dword [ebp - 0xc], ebx
je 0x1012d6a1
push ebx
mov ecx, edi
call fcn.1012c374
push 1
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1012eca7
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x10197e6e
call fcn.10145d80
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1012ecc1
xor eax, eax
jmp 0x1012ed7d
mov dword [ebp + 8], esi
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.1011de11
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [esp], str.AdFilter
call fcn.1001107f
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], esi
jle 0x1012ed04
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1012ed04
push esi
push 1
push dword [ebp - 0x10]
call fcn.1011cedc
add esp, 0xc
push esi
lea eax, [ebp + 8]
push eax
push 0x101a0984
push esi
call fcn.10119348
add esp, 0x10
cmp eax, esi
jl 0x1012ed61
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1012ed61
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.1000d960
mov eax, dword [ebp + 8]
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 2
call dword [ecx + 0xc]
push dword [ebp + 8]
mov ecx, 0x101f84b0
call fcn.100e6001
mov eax, dword [ebp - 0x14]
cmp eax, esi
mov byte [ebp - 4], 1
je 0x1012ed61
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.10003b75
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp eax, esi
je 0x1012ed7a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
call fcn.10145e58
ret 4
Function at 0x1013b5b2
Capabilities:
Get disk information

Disassembly:
push 0x34
mov eax, 0x10199bd0
call fcn.10145de9
mov eax, dword [ebp + 8]
push 0x101f9b4c
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], eax
call fcn.10038cfb
movsx ebx, byte [ebp + 0xc]
push ebx
lea eax, [ebp - 0x34]
push str.._c:
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.1013b402
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add esp, 0xc
push 0x20
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push edi
push edi
push dword [ebp - 0x34]
call esi
cmp eax, 1
jne 0x1013b630
push dword [ebp - 0x38]
push str._08X
push dword [ebp - 0x3c]
call fcn.1013b402
mov ecx, dword [ebp - 0x34]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.100011dd
xor eax, eax
inc eax
jmp 0x1013b67e
push ebx
lea eax, [ebp - 0x34]
push str._c:_
push eax
call fcn.1013b402
mov ebx, dword [ebp - 0x34]
add esp, 0xc
push 0x20
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push edi
push edi
push ebx
call esi
cmp eax, 1
jne 0x1013b674
push dword [ebp - 0x38]
push str._08X
push dword [ebp - 0x3c]
call fcn.1013b402
xor edi, edi
add esp, 0xc
inc edi
lea ecx, [ebx - 0x10]
call fcn.100011dd
mov eax, edi
call fcn.10145e6c
ret
Function at 0x1013bef6
Capabilities:
Get storage device properties

Disassembly:
push 0x44
mov eax, 0x10199dca
call fcn.10145e1f
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, esi
mov byte [ebp - 0x21], bl
call fcn.1013b415
push edi
mov ecx, esi
call fcn.1000425b
mov eax, dword [esi]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x2c], eax
jne 0x1013bf3c
xor al, al
jmp 0x1013c0ab
xor eax, eax
mov dword [ebp - 0x50], ebx
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0x18
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp - 0x2c]
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
je 0x1013c09f
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x14], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa000
push edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
call fcn.10144fc2
or dword [ebp - 4], 0xffffffff
pop ecx
push edi
push ebx
push eax
mov dword [ebp - 0x28], eax
call fcn.10146c80
add esp, 0xc
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x9fff
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x2c]
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1013c04c
mov eax, dword [ebp - 0x28]
mov byte [eax + 0x9fff], bl
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x10]
cmp eax, ebx
mov dword [ebp - 0x30], ecx
je 0x1013bff4
cmp eax, edi
jae 0x1013bff4
add eax, ecx
push eax
lea ecx, [esi + 8]
call fcn.1001e27f
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x18]
cmp eax, ebx
je 0x1013c010
cmp eax, edi
jae 0x1013c010
mov ecx, dword [ebp - 0x28]
add eax, ecx
push eax
lea ecx, [esi + 4]
call fcn.1001e27f
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x1013c02c
cmp eax, edi
jae 0x1013c02c
mov ecx, dword [ebp - 0x28]
add eax, ecx
push eax
lea ecx, [esi + 0xc]
call fcn.1001e27f
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x14]
cmp eax, ebx
je 0x1013c048
cmp eax, edi
jae 0x1013c048
mov ecx, dword [ebp - 0x28]
add eax, ecx
push eax
lea ecx, [esi + 0x10]
call fcn.1001e27f
mov byte [ebp - 0x21], 1
push edi
push ebx
push dword [ebp - 0x28]
call fcn.10146c80
add esp, 0xc
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x9fff
push dword [ebp - 0x28]
mov dword [ebp - 0x34], ebx
push ebx
push ebx
push 0x2d0c10
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1013c096
mov eax, dword [ebp - 0x28]
mov byte [eax + 0x9fff], bl
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 4]
call fcn.1001e27f
mov byte [ebp - 0x21], 1
push dword [ebp - 0x28]
call fcn.10145563
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x21]
call fcn.10145e7b
ret
Function at 0x1013c884
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 1
mov edi, dword [esi + 4]
pop ebx
cmp edi, 2
jae 0x1013c8f0
test edi, edi
je 0x1013c8a3
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call fcn.1014d0bf
and dword [eax], 0
push dword [esi + 0x40]
mov eax, 0x4000
mov ecx, edi
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call fcn.10147aa1
add esp, 0x10
test eax, eax
jne 0x1013c8d8
mov ecx, dword [esi + 0x40]
test byte [ecx + 0xc], 0x20
je 0x1013c8d8
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x44]
cmp eax, 2
mov dword [esi], ecx
jae 0x1013c8f0
mov dword [esi + 0x58], eax
jmp 0x1013c9ce
mov eax, dword [esi]
movzx ecx, byte [eax]
cmp ecx, dword [0x101ba9e4]
jne 0x1013c9cb
movzx ecx, byte [eax + 1]
cmp ecx, dword [0x101ba9e8]
jne 0x1013c9cb
add dword [esi + 4], 0xfffffffe
add eax, 2
push esi
mov dword [esi], eax
call fcn.1013c9d2
push esi
mov edi, eax
call fcn.1013c9d2
pop ecx
cmp edi, 8
pop ecx
mov ebx, eax
jne 0x1013c9c2
test bl, 0xe0
jne 0x1013c9c2
push 6
pop edi
push esi
call fcn.1013c9d2
dec edi
pop ecx
jne 0x1013c941
test bl, 4
je 0x1013c978
push esi
call fcn.1013c9d2
push esi
mov edi, eax
call fcn.1013c9d2
pop ecx
shl eax, 8
pop ecx
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x1013c978
push esi
call fcn.1013c9d2
cmp eax, 0xffffffff
pop ecx
jne 0x1013c965
test bl, 8
je 0x1013c98d
push esi
call fcn.1013c9d2
test eax, eax
pop ecx
je 0x1013c98d
cmp eax, 0xffffffff
jmp 0x1013c97b
test bl, 0x10
je 0x1013c9a2
push esi
call fcn.1013c9d2
test eax, eax
pop ecx
je 0x1013c9a2
cmp eax, 0xffffffff
jmp 0x1013c990
test bl, 2
je 0x1013c9b4
push 2
pop edi
push esi
call fcn.1013c9d2
dec edi
pop ecx
jne 0x1013c9aa
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and al, 0xfd
mov dword [esi + 0x38], eax
jmp 0x1013c9ce
mov dword [esi + 0x38], 0xfffffffd
jmp 0x1013c9ce
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x1013c9d2
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x3c], 0
je 0x1013c9e2
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 4], 0
jne 0x1013ca29
call fcn.1014d0bf
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call fcn.10147aa1
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x1013ca24
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
or eax, 0xffffffff
test byte [ecx + 0xc], 0x20
je 0x1013ca34
mov dword [esi + 0x38], eax
pop esi
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
pop esi
ret
Function at 0x1013cd9c
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1013ce3c
cmp byte [esi + 0x5c], 0x77
jne 0x1013ce3c
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push edi
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
je 0x1013ce20
mov edi, 0x4000
cmp dword [esi + 0x10], 0
jne 0x1013cded
push dword [esi + 0x40]
mov eax, dword [esi + 0x48]
mov dword [esi + 0xc], eax
push edi
push 1
push eax
call fcn.10148a8b
add esp, 0x10
cmp eax, edi
jne 0x1013ce1c
mov dword [esi + 0x10], edi
mov eax, dword [esi + 4]
push 0
add dword [esi + 0x64], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push esi
call fcn.1013d893
mov edx, dword [esi + 0x10]
pop ecx
sub dword [esi + 0x68], edx
pop ecx
mov ecx, dword [esi + 4]
mov dword [esi + 0x38], eax
sub dword [esi + 0x64], ecx
test eax, eax
jne 0x1013ce20
test ecx, ecx
jne 0x1013cdcb
jmp 0x1013ce20
or dword [esi + 0x38], 0xffffffff
push ebx
push dword [esp + 0x18]
push dword [esi + 0x4c]
call fcn.1014065c
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, ebx
sub eax, dword [esi + 4]
pop edi
pop ebx
pop esi
ret
push 0xfffffffffffffffe
pop eax
pop esi
ret

Function at 0x1013cf08
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x1013cfb2
cmp byte [esi + 0x5c], 0x77
jne 0x1013cfb2
mov dword [esi + 4], ebx
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x1013cf52
push dword [esi + 0x40]
push edi
push 1
push dword [esi + 0x48]
call fcn.10148a8b
add esp, 0x10
cmp eax, edi
jne 0x1013cf9c
mov eax, dword [esi + 0x48]
mov dword [esi + 0x10], 0x4000
mov dword [esi + 0xc], eax
test ebx, ebx
jne 0x1013cfa4
push dword [esp + 0x14]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push esi
call fcn.1013d893
pop ecx
mov dword [esi + 0x38], eax
pop ecx
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
test edi, edi
jne 0x1013cf7d
cmp eax, 0xfffffffb
jne 0x1013cf7d
and dword [esi + 0x38], edi
test ecx, ecx
jne 0x1013cf8b
cmp dword [esi + 0x38], 1
je 0x1013cf8b
xor ebx, ebx
jmp 0x1013cf8e
push 1
pop ebx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1013cf26
cmp eax, 1
jne 0x1013cfa4
jmp 0x1013cf26
or eax, 0xffffffff
mov dword [esi + 0x38], eax
jmp 0x1013cfb5
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
jmp 0x1013cfb5
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
ret
Function at 0x1013e48d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x2c]
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x2c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x1013e515
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.10147010
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x1013e4d8
mov eax, dword [esi + 0x40]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x1013e4fa
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x1013e570
mov ecx, dword [esi + 0x74]
push ebx
add ecx, dword [esi + 0x6c]
add ecx, dword [esi + 0x38]
push ecx
push eax
call fcn.1013e575
add dword [esi + 0x74], eax
mov ebx, dword [esi + 0x74]
add esp, 0xc
cmp ebx, 3
jb 0x1013e55c
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x1013e570
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x1013e499
pop edi
pop esi
pop ebx
pop ebp
ret