joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426d2a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00426dd5
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x426d72
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00409ec0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00403da0
jmp 0x426d7d
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004201f3
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4c93f9
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x5a783d
call fcn.0052d215
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403660
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5ea708
call fcn.004056a0
cmp eax, 0xffffffff
jne 0x4c94ad
push 0
push 0x5bc7e0
lea ecx, [ebp - 0x4d0]
call fcn.004056a0
cmp eax, 0xffffffff
jne 0x4c94ad
push 0
push 0x5b76fc
lea ecx, [ebp - 0x4d0]
call fcn.004056a0
cmp eax, 0xffffffff
jne 0x4c94ad
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403660
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4c9489
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00402760
jmp 0x4c94dc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00403560
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00402760
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4c94d3
mov ebx, dword [ebp - 0x4cc]
jmp 0x4c94dc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00402760
mov eax, ebx
call fcn.0052d1c4
ret
Function at 0x4017e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x4017f2
repz ret
jmp fcn.004025fa

Function at 0x40773b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040615d
and dword [ebp - 0x14], 0
cmp dword [0x411b1c], 0
mov dword [ebp - 0x18], eax
jne 0x4077ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407896
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407896
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411b1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411b20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411b24], eax
call edi
push eax
call esi
mov dword [0x411b2c], eax
test eax, eax
je 0x4077ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411b28], eax
mov eax, dword [0x411b28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407847
cmp dword [0x411b2c], ecx
je 0x407847
push eax
call esi
push dword [0x411b2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407847
test ebx, ebx
je 0x407847
call edi
test eax, eax
je 0x40783e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40783e
test byte [ebp - 8], 1
jne 0x407847
or dword [ebp + 0x10], 0x200000
jmp 0x40787a
mov eax, dword [0x411b20]
cmp eax, dword [ebp - 0x18]
je 0x40787a
push eax
call esi
test eax, eax
je 0x40787a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40787a
mov eax, dword [0x411b24]
cmp eax, dword [ebp - 0x18]
je 0x40787a
push eax
call esi
test eax, eax
je 0x40787a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411b1c]
call esi
test eax, eax
je 0x407896
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407898
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004017e8
leave
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x432005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6db26c77
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7cff19a8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10008ccf
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x10008d0d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10008d0d
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_GetFileSizeEx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x10008d17
mov eax, 0
mov edx, 0
leave
ret

Function at 0x10008d9b
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x10008dd4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10008dd4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_SetEndOfFile
mov eax, 0xffffffff
jmp 0x10008dd9
mov eax, 0
leave
ret
Function at 0x10008ddb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x10008dff
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x10008e09
mov eax, 0
jmp 0x10008f89
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x10008e24
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_wcslen
add esp, 4
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x10008e3a
mov eax, 0
jmp 0x10008f89
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, 0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0
jl 0x10008e6d
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b0
jne 0x10008e7b
mov eax, dword [ebp + 0x10]
shl eax, 1
mov dword [ebp + 0x10], eax
jmp 0x10008f30
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b1
jne 0x10008ead
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sym.xPack.dll_xBot_UCS2_BE2LE
add esp, 8
mov eax, dword [ebp + 0x10]
shl eax, 1
mov dword [ebp + 0x10], eax
jmp 0x10008f30
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfded
je 0x10008ed5
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfdee
jne 0x10008f05
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sym.xPack.dll_xBot_UCS2_To_UCS4
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10008f30
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call sym.xPack.dll_xCore_W2M
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, 0
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_WriteFile
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, 0
je 0x10008f6b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
cmp eax, 0
je 0x10008f7f
mov eax, dword [ebp - 0xc]
jmp 0x10008f89
mov eax, 0
jmp 0x10008f89
leave
ret
Function at 0x10008f8b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x10008faf
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x10008fb9
mov eax, 0
jmp 0x100091ae
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x10008fd4
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x10008fea
mov eax, 0
jmp 0x100091ae
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, 0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0
jl 0x1000903f
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4e9f
je 0x1000903f
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 1
je 0x1000903f
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0
jne 0x10009044
jmp 0x10009155
mov eax, dword [ebp + 0x10]
push eax
mov eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
call sym.xPack.dll_xCore_M2W
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b1
jne 0x10009095
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sym.xPack.dll_xBot_UCS2_BE2LE
add esp, 8
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10009155
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b0
jne 0x100090b4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10009155
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfded
je 0x100090dc
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfdee
jne 0x1000911b
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sym.xPack.dll_xBot_UCS2_To_UCS4
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10009155
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp - 8]
push eax
call sym.xPack.dll_xCore_W2M
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, 0
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_WriteFile
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, 0
je 0x10009190
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
cmp eax, 0
je 0x100091a4
mov eax, dword [ebp - 0xc]
jmp 0x100091ae
mov eax, 0
jmp 0x100091ae
leave
ret
Function at 0x100091b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x100091d4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x100091de
mov eax, 0
jmp 0x100093b1
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x100091f9
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x1000920f
mov eax, 0
jmp 0x100093b1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, 0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0
jl 0x10009242
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfde9
jne 0x10009247
jmp 0x10009358
mov eax, dword [ebp + 0x10]
push eax
mov eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
call sym.xPack.dll_xCore_M2W
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b1
jne 0x10009298
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sym.xPack.dll_xBot_UCS2_BE2LE
add esp, 8
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10009358
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b0
jne 0x100092b7
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10009358
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfded
je 0x100092df
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfdee
jne 0x1000931e
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sym.xPack.dll_xBot_UCS2_To_UCS4
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10009358
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp - 8]
push eax
call sym.xPack.dll_xCore_W2M
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, 0
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_WriteFile
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cmp eax, 0
je 0x10009393
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
cmp eax, 0
je 0x100093a7
mov eax, dword [ebp - 0xc]
jmp 0x100093b1
mov eax, 0
jmp 0x100093b1
leave
ret
Function at 0x100093b3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x100093d7
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x100093ed
mov eax, 0
mov dword [0x10029090], eax
mov eax, dword [0x10029084]
jmp 0x100095f0
mov eax, dword [ebp + 0xc]
cmp eax, 0
jne 0x1000940f
mov eax, 0
mov dword [0x10029090], eax
mov eax, dword [0x10029084]
jmp 0x100095f0
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
mov eax, dword [0x100290b0]
call eax
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0
jne 0x10009446
mov eax, 0
mov dword [0x10029090], eax
mov eax, dword [0x10029084]
jmp 0x100095f0
mov eax, dword [ebp + 8]
mov ecx, 0
push ecx
mov ecx, 0x10029090
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_ReadFile
cmp eax, 0
je 0x100095d0
mov eax, dword [0x10029090]
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, 0
mov byte [ecx], al
mov eax, dword [0x10029090]
inc eax
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, 0
mov byte [ecx], al
mov eax, dword [0x10029090]
add eax, 2
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, 0
mov byte [ecx], al
mov eax, dword [0x10029090]
add eax, 3
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, 0
mov byte [ecx], al
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0
jl 0x100095bf
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b0
je 0x100095bf
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfded
je 0x1000950a
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0xfdee
jne 0x1000952e
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
push ecx
mov eax, dword [0x10029090]
push eax
mov eax, dword [ebp - 4]
push eax
call sym.xPack.dll_xBot_UCS4_To_UCS2
add esp, 0xc
mov dword [ebp + 0xc], eax
jmp 0x100095bf
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b1
jne 0x1000955a
mov eax, dword [0x10029090]
push eax
mov eax, dword [ebp - 4]
push eax
call sym.xPack.dll_xBot_UCS2_BE2LE
add esp, 8
jmp 0x100095bf
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b0
je 0x100095bf
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [eax]
cmp ecx, 0x4b1
je 0x100095bf
mov eax, dword [ebp + 8]
add eax, 4
mov ecx, dword [0x10029090]
push ecx
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp - 4]
push eax
call sym.xPack.dll_xCore_M2W
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [0x10029090]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [0x10029090], eax
mov eax, dword [ebp - 4]
jmp 0x100095f0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x100290bc]
call eax
add esp, 4
mov eax, 0
mov dword [0x10029090], eax
mov eax, dword [0x10029084]
leave
ret
Function at 0x10009b06
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x10009b5d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10009b5d
mov eax, dword [ebp + 8]
mov ecx, 0
push ecx
mov ecx, 0x10029090
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_WriteFile
cmp eax, 0
je 0x10009b5d
mov eax, dword [0x10029090]
jmp 0x10009b6d
mov eax, 0
mov dword [0x10029090], eax
mov eax, 0
leave
ret

Function at 0x10009b6f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x10009bc6
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10009bc6
mov eax, dword [ebp + 8]
mov ecx, 0
push ecx
mov ecx, 0x10029090
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [eax]
push ecx
call sub.kernel32.dll_ReadFile
cmp eax, 0
je 0x10009bc6
mov eax, dword [0x10029090]
jmp 0x10009bd6
mov eax, 0
mov dword [0x10029090], eax
mov eax, 0
leave
ret

Function at 0x10009dda
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, 0
push eax
mov eax, pe_nt_image_headers32
push eax
mov eax, 3
push eax
mov eax, 0
push eax
mov eax, 1
push eax
mov eax, 0x80000000
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0
je 0x10009e44
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x10009e44
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSizeEx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x10009e4e
mov eax, 0
mov edx, 0
leave
ret

Function at 0x10009e50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, 0
push eax
mov eax, pe_nt_image_headers32
push eax
mov eax, 3
push eax
mov eax, 0
push eax
mov eax, 1
push eax
mov eax, 0x80000000
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0
je 0x10009eba
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x10009eba
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSizeEx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
jmp 0x10009ec4
mov eax, 0
mov edx, 0
leave
ret
Function at 0x10009ec6
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, 0
push eax
mov eax, pe_nt_image_headers32
push eax
mov eax, 4
push eax
mov eax, 0
push eax
mov eax, 1
push eax
mov eax, 0x40000000
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0
je 0x10009f70
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x10009f70
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov eax, 0
push eax
mov eax, 0
push eax
sub esp, 8
mov eax, esp
mov ecx, 8
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointerEx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetEndOfFile
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0xffffffff
jmp 0x10009f75
mov eax, 0
leave
ret

Function at 0x10009f77
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, 0
push eax
mov eax, pe_nt_image_headers32
push eax
mov eax, 4
push eax
mov eax, 0
push eax
mov eax, 1
push eax
mov eax, 0x40000000
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0
je 0x1000a021
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x1000a021
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov eax, 0
push eax
mov eax, 0
push eax
sub esp, 8
mov eax, esp
mov ecx, 8
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointerEx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetEndOfFile
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0xffffffff
jmp 0x1000a026
mov eax, 0
leave
ret

Function at 0x1000a46a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
nop
mov eax, 0
push eax
mov eax, pe_nt_image_headers32
push eax
mov eax, 4
push eax
mov eax, 0
push eax
mov eax, 1
push eax
mov eax, 0xc0000000
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x1000a4ba
mov eax, 0
jmp 0x1000a515
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFilePointer
mov eax, 0
mov dword [0x10029090], eax
mov eax, 0
push eax
mov eax, 0x10029090
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetEndOfFile
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x10029090]
leave
ret