joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a31f8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0x54]
mov ebx, dword [esi + 0xf8]
xor eax, eax
cmp word [esi + 0xec], ax
push edi
mov edi, dword [sym.imp.msvcrt.dll_fseek]
jne 0x10a326e
push eax
push eax
push ebx
call edi
push ebx
push 1
lea eax, [ebp - 8]
push 8
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x1c
cmp eax, 1
jne 0x10a327a
mov ax, word [esi + 0x16]
add word [ebp - 4], ax
push 0
push 0
push ebx
call edi
push ebx
push 1
lea eax, [ebp - 8]
push 8
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
xor ecx, ecx
inc ecx
add esp, 0x1c
cmp eax, ecx
je 0x10a3265
push ecx
push ecx
jmp 0x10a327e
mov word [esi + 0xec], cx
xor eax, eax
push eax
push eax
push ebx
call edi
add esp, 0xc
test eax, eax
je 0x10a3295
push 1
push 1
push esi
call fcn.010a2357
mov word [esi + 0xd6], 1
xor ax, ax
jmp 0x10a3330
push dword [ebx + 0x10]
call dword [sym.imp.msvcrt.dll__filelength]
pop ecx
mov ecx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
lea eax, [ecx + 0x16]
xor edx, edx
div dword [edi + 0xa4]
mov edi, dword [ebp + 8]
push ecx
push 0
add dword [esi + 0x3c8], eax
lea eax, [ebp + 0xa]
push eax
push 0
push ecx
push 0x504d5354
push ebx
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push edi
call fcn.010a2ad0
mov ebx, eax
test bx, bx
je 0x10a32fc
push 1
push 1
push esi
call fcn.010a2357
cmp bx, 0xfde7
mov word [esi + 0xd6], 1
jne 0x10a332d
xor ebx, ebx
jmp 0x10a332d
mov eax, dword [edi + 4]
test byte [eax + 0x528], 4
jne 0x10a3324
mov ebx, dword [ebp + 0xc]
push edi
call fcn.010a264a
mov ebx, eax
test bx, bx
jne 0x10a32de
mov eax, dword [edi + 4]
test byte [eax + 0x528], 4
je 0x10a332d
mov word [esi + 0xdc], 1
mov ax, bx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10a3522
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x54]
mov eax, dword [eax + 0x88]
xor edx, edx
mov dword [ebp - 8], eax
mov word [ebp - 4], dx
mov byte [ebp - 1], dl
mov byte [ebp - 2], dl
push dword [ecx + 0xf8]
lea eax, [ebp - 8]
push 1
push 8
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
and ax, 0xfde7
leave
ret 4
Function at 0x10a3845
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x54]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [eax + 0xf0]
push esi
mov dword [ebp + 8], eax
push edi
mov ecx, ebx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3a], 0x42444244
call fcn.010a3566
mov eax, dword [ebx + 0x34]
mov cx, word [ebx + 0x3d]
push dword [ebp + 8]
lea esi, [ebx + 0x38]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
movzx esi, word [ebx + 0x3f]
mov edi, dword [sym.imp.msvcrt.dll_fwrite]
add esi, ebx
mov dword [ebp - 0x13], eax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0xf], cx
inc ebx
mov word [ebp - 0xd], 0x35
mov ecx, dword [ebp - 0xf]
push ebx
mov word [ebp - 0xb], ax
mov word [ebp - 9], ax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
add ecx, 0x35
push 0x24
push eax
mov word [ebp - 0x3c], cx
call edi
add esp, 0x10
cmp eax, ebx
jne 0x10a391e
test byte [ebp - 0x34], bl
jne 0x10a38ed
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_ftell]
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x150], eax
mov word [ecx + 0x154], 5
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push ebx
push 0x11
push eax
call edi
add esp, 0x10
cmp eax, ebx
jne 0x10a391e
cmp word [ebp - 0xf], 0
je 0x10a3931
push dword [ebp + 8]
movzx eax, word [ebp - 0xf]
push eax
push ebx
push esi
call edi
movzx ecx, word [ebp - 0xf]
add esp, 0x10
cmp eax, ecx
je 0x10a3931
mov esi, dword [ebp - 4]
push ebx
push 0
push esi
call fcn.010a2357
mov word [esi + 0xd4], bx
pop edi
pop esi
xor ax, ax
pop ebx
leave
ret 0xc
Function at 0x10a393b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xf0]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
push edi
mov ecx, ebx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x46], 0x454c4946
call fcn.010a3566
mov eax, dword [ebx + 0x34]
lea esi, [ebx + 0x38]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x47]
lea edi, [ebp - 0x15]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push dword [ebp - 4]
lea esi, [ebx + 0x3d]
lea edi, [ebp - 0x1f]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x42]
lea edi, [ebp - 0x1a]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x3a0]
and word [ebp - 8], 0
and word [ebp - 6], 0
movzx edi, word [ebx + 0x56]
mov dword [ebp - 0x10], eax
mov ax, word [ebx + 0x54]
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], 0x44
mov eax, dword [ebp - 0xc]
add eax, 0x44
mov word [ebp - 0x48], ax
movzx eax, word [esi + 0x3a4]
mov eax, dword [ecx + eax*4]
push 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push 0x24
add edi, ebx
mov ebx, dword [sym.imp.msvcrt.dll_fwrite]
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x10a3a38
test byte [ebp - 0x40], al
jne 0x10a3a04
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_ftell]
pop ecx
mov dword [esi + 0x150], eax
mov word [esi + 0x154], 3
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push 1
push 0x20
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x10a3a38
cmp word [ebp - 0xc], 0
je 0x10a3a4b
push dword [ebp - 4]
movzx eax, word [ebp - 0xc]
push eax
push 1
push edi
call ebx
movzx ecx, word [ebp - 0xc]
add esp, 0x10
cmp eax, ecx
je 0x10a3a4b
push 1
push 0
push esi
call fcn.010a2357
mov word [esi + 0xd4], 1
pop edi
pop esi
xor ax, ax
pop ebx
leave
ret 0xc
Function at 0x10a3ca2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xf8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x158]
mov dword [ebp + 8], eax
xor eax, eax
mov ax, word [esi + 0x16]
test ax, ax
push edi
mov dword [ebp - 8], eax
je 0x10a3de8
mov ebx, dword [sym.imp.msvcrt.dll_fseek]
xor edi, edi
inc edi
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call ebx
add esp, 0xc
test eax, eax
jne 0x10a3dd1
push dword [ebp - 4]
lea eax, [ebp - 0x64]
push edi
push 0x5b
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, edi
jne 0x10a3dd1
xor eax, eax
cmp word [esi + 0xd2], 2
jne 0x10a3d39
cmp word [esi + 0xd4], ax
jne 0x10a3d39
mov ecx, dword [esi + 0xe0]
mov dword [ebp - 0x50], ecx
mov cx, word [esi + 0xe4]
mov word [ebp - 0x48], cx
jmp 0x10a3d40
mov dword [ebp - 0x50], eax
mov word [ebp - 0x48], ax
mov ecx, dword [esi + 0x160]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [esi + 0x164]
push dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov ecx, dword [esi + 0x30]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], ecx
call ebx
add esp, 0xc
test eax, eax
jne 0x10a3dd1
push dword [ebp - 4]
lea eax, [ebp - 0x64]
push edi
push 0x5b
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x10a3dd1
add dword [ebp - 8], 0xffff
cmp word [ebp - 8], 0
je 0x10a3de8
movzx eax, word [ebp - 0x64]
add dword [ebp + 8], eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call ebx
add esp, 0xc
test eax, eax
jne 0x10a3dd1
push dword [ebp - 4]
lea eax, [ebp - 0x88]
push edi
push 0x24
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, edi
jne 0x10a3dd1
movzx eax, word [ebp - 0x88]
add dword [ebp + 8], eax
jmp 0x10a3cde
push edi
push 2
push esi
call fcn.010a2357
mov word [esi + 0xd6], di
mov word [esi + 0xd4], di
pop edi
pop esi
xor ax, ax
pop ebx
leave
ret 4
Function at 0x10a3df2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi + 0x154]
mov ebx, dword [esi + 0xf0]
dec eax
dec eax
mov dword [ebp - 4], ebx
je 0x10a3e39
dec eax
je 0x10a3e39
dec eax
dec eax
je 0x10a3e30
xor ebx, ebx
inc ebx
push ebx
push 0
push esi
call fcn.010a2357
mov word [esi + 0xd4], bx
jmp 0x10a3ee2
mov dword [ebp + 8], 0x11
jmp 0x10a3e40
mov dword [ebp + 8], 0x20
push edi
mov edi, dword [sym.imp.msvcrt.dll_fseek]
push 0
push dword [esi + 0x150]
push ebx
call edi
add esp, 0xc
test eax, eax
je 0x10a3e5e
xor ebx, ebx
inc ebx
jmp 0x10a3ed1
push ebx
push dword [ebp + 8]
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x24]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, dword [ebp + 8]
jne 0x10a3ed1
movzx eax, word [esi + 0x154]
dec eax
dec eax
je 0x10a3e90
dec eax
je 0x10a3e90
dec eax
dec eax
jne 0x10a3e94
or byte [ebp - 0x1d], 4
jmp 0x10a3e94
or byte [ebp - 0xe], 4
push 0
push dword [esi + 0x150]
push dword [ebp - 4]
call edi
add esp, 0xc
test eax, eax
jne 0x10a3ed1
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp + 8]
jne 0x10a3ed1
push 2
push 0
push dword [ebp - 4]
call edi
add esp, 0xc
test eax, eax
je 0x10a3ee1
push ebx
push 0
push esi
call fcn.010a2357
mov word [esi + 0xd4], bx
pop edi
pop esi
xor ax, ax
pop ebx
leave
ret 4

Function at 0x10a3eeb
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [sym.imp.msvcrt.dll_fseek]
push 0
push dword [ebp + 8]
push edi
call esi
add esp, 0xc
test eax, eax
je 0x10a3f0e
mov eax, 0xfffffde7
jmp 0x10a3f5e
push edi
push 1
lea eax, [ebp - 0x24]
push 0x24
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x10a3f07
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
push 0
push dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
call esi
add esp, 0xc
test eax, eax
jne 0x10a3f07
push edi
push 1
lea eax, [ebp - 0x24]
push 0x24
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffde7
pop esi
leave
ret 0xc
Function at 0x10a40b5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [eax + 0x54]
mov eax, dword [ebx + 0xf0]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push edi
mov ecx, esi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x46], 0x42524944
call fcn.010a3566
mov eax, dword [ebp + 0xc]
add esi, 0x38
mov ecx, dword [eax + 0x34]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 0x3d]
lea edi, [ebp - 0x1f]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 0x42]
lea edi, [ebp - 0x1a]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 0x47]
lea edi, [ebp - 0x15]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
and word [ebp - 8], 0
and word [ebp - 6], 0
test ecx, 0x20000
mov dword [ebp - 0x10], ecx
je 0x10a419e
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
push dword [esi + 0x74]
and byte [ebp - 0xe], 0xfd
mov ecx, dword [eax + 0x1c]
push eax
call dword [ecx + 0xf0]
mov word [ebp - 0xc], ax
xor eax, eax
mov ax, word [ebx + 0x38c]
cmp ax, word [ebp - 0xc]
jae 0x10a4185
mov ecx, dword [ebp - 0xc]
sub ecx, eax
dec cx
shr cx, 9
shl ecx, 9
lea edi, [eax + ecx + 0x200]
movzx eax, di
push eax
push dword [ebx + 0x388]
call dword [sym.imp.msvcrt.dll_realloc]
test eax, eax
pop ecx
pop ecx
je 0x10a423b
mov dword [ebx + 0x388], eax
mov word [ebx + 0x38c], di
mov edi, dword [ebx + 0x388]
mov eax, dword [esi + 0x60]
mov ecx, dword [eax + 0x1c]
push edi
push dword [esi + 0x74]
push eax
call dword [ecx + 0xb8]
jmp 0x10a41ac
movzx edi, word [eax + 0x52]
add edi, eax
mov ax, word [eax + 0x50]
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], 0x44
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x44]
mov word [ebp - 0x48], cx
lea ecx, [ebp - 0x48]
push ecx
mov ecx, edi
mov esi, ebx
call fcn.010a3f63
test ax, ax
jne 0x10a423b
push dword [ebp - 4]
mov esi, dword [sym.imp.msvcrt.dll_fwrite]
push 1
lea eax, [ebp - 0x48]
push 0x24
push eax
call esi
add esp, 0x10
cmp eax, 1
jne 0x10a423b
test byte [ebp - 0x40], al
jne 0x10a4207
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_ftell]
pop ecx
mov dword [ebx + 0x150], eax
mov word [ebx + 0x154], 2
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push 1
push 0x20
push eax
call esi
add esp, 0x10
cmp eax, 1
jne 0x10a423b
cmp word [ebp - 0xc], 0
je 0x10a424e
push dword [ebp - 4]
movzx eax, word [ebp - 0xc]
push eax
push 1
push edi
call esi
movzx ecx, word [ebp - 0xc]
add esp, 0x10
cmp eax, ecx
je 0x10a424e
push 1
push 0
push ebx
call fcn.010a2357
mov word [ebx + 0xd4], 1
pop edi
pop esi
xor ax, ax
pop ebx
leave
ret 0xc
Function at 0x10a4a36
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [edx + 0x54]
push esi
mov esi, dword [ebx + 0xf0]
push edi
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x22], 0x444e4546
mov edi, dword [eax + 0xa4]
push esi
call dword [sym.imp.msvcrt.dll_ftell]
add eax, 0x16
xor edx, edx
div edi
mov eax, edi
pop ecx
sub eax, edx
cmp eax, 0x24
jae 0x10a4a7f
add eax, edi
cmp eax, 0x10000
mov word [ebp - 0x24], ax
jb 0x10a4a90
mov word [ebp - 0x24], 0x24
push esi
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x24]
push 0x24
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x10a4abd
push esi
call dword [sym.imp.msvcrt.dll_fflush]
test eax, eax
pop ecx
jne 0x10a4abd
call fcn.010a4258
test eax, eax
je 0x10a4acd
push edi
push 0
push ebx
call fcn.010a2357
mov word [ebx + 0xd4], di
pop edi
pop esi
xor ax, ax
pop ebx
leave
ret 4
Function at 0x10a7e89
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [eax + 0x10]
mov esi, dword [edi + 0x270]
mov eax, dword [esi]
test eax, eax
mov word [esi + 0x14], 1
je 0x10a7ec5
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10a7ebd
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
push esi
call dword [sym.imp.msvcrt.dll_free]
and dword [edi + 0x270], 0
pop ecx
pop edi
pop esi
ret
Function at 0x10aaf27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor esi, esi
jmp 0x10aaf65
cmp dword [ebp + 0x10], esi
je 0x10aaf6e
mov ecx, dword [0x10ddd90]
shl ecx, 3
mov ebx, ecx
push 0x20
pop ecx
sub ecx, ebx
mov ebx, dword [edx]
and ebx, 0xff
shl ebx, cl
xor eax, ebx
dec word [0x10ddd90]
dec dword [ebp + 0x10]
inc edx
cmp word [0x10ddd90], si
jne 0x10aaf39
mov esi, dword [ebp + 0x10]
mov ecx, esi
shr ecx, 2
je 0x10aaf80
xor eax, dword [edx]
add edx, 4
dec ecx
jne 0x10aaf78
and esi, 3
je 0x10aafb0
mov word [0x10ddd90], 4
mov ecx, dword [0x10ddd90]
shl ecx, 3
mov ebx, ecx
push 0x20
pop ecx
sub ecx, ebx
movzx ebx, byte [edx]
shl ebx, cl
xor eax, ebx
dec word [0x10ddd90]
inc edx
dec esi
jne 0x10aaf8e
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10ab332
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
jne 0x10ab34f
or ax, 0xffff
jmp 0x10ab45c
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
push 0x5c
push dword [ebp + 0xc]
call edi
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x10ab456
push dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push eax
mov word [esi], bx
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x41c]
mov word [esi], 0x5c
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push eax
call esi
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x41c]
push eax
call esi
add esp, 0x10
lea eax, [ebp + eax*2 - 0x41c]
jmp 0x10ab3f4
push ebx
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10ab3fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10ab3fe
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10ab3fe
lea eax, [ebp - 0x41c]
push 0x5c
push eax
call edi
cmp eax, ebx
pop ecx
pop ecx
jne 0x10ab3f1
lea eax, [ebp - 0x41c]
mov word [eax], bx
lea ecx, [ebp - 0x414]
cmp eax, ecx
ja 0x10ab3a9
lea eax, [ebp - 0x41c]
push eax
call esi
cmp ax, word [ebp + 0xc]
pop ecx
jae 0x10ab450
lea eax, [ebp - 0x41c]
push eax
call esi
pop ecx
mov word [ebp + eax*2 - 0x41c], 0x5c
push ebx
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10ab44a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10ab44a
push eax
call fcn.0109a2fe
mov dword [ebp - 4], eax
cmp word [ebp - 4], bx
je 0x10ab3fe
mov ax, word [ebp - 4]
jmp 0x10ab45a
mov ax, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10add1c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x34]
mov ebx, dword [edi + 0x14]
add ebx, 0xb4
test eax, eax
mov dword [ebp - 8], eax
je 0x10ade26
test ebx, ebx
je 0x10ade26
cmp dword [eax + 0x34], 0
jne 0x10ade26
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push ebx
call esi
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
mov eax, dword [edi + 4]
push 0x5c
push dword [eax + 0x34]
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10add97
push edi
call esi
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x34]
test eax, eax
mov dword [ebp - 4], eax
je 0x10ade30
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
push ebx
call esi
mov ecx, dword [ebp - 4]
add esp, 0xc
lea esi, [ecx + eax*2]
xor eax, eax
jmp 0x10adde3
push eax
push 0x100da60
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x10addd9
mov word [esi], 0x5f
jmp 0x10adddf
mov ax, word [edi]
mov word [esi], ax
inc edi
inc edi
inc esi
inc esi
mov ax, word [edi]
test ax, ax
jne 0x10addc0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x34]
lea ecx, [eax + 4]
movzx eax, word [eax]
push ecx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax + 0x54]
lea eax, [ebp - 0x418]
push 0x1012144
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ax, ax
pop edi
pop esi
pop ebx
leave
ret 4
or ax, 0xffff
jmp 0x10ade29
Function at 0x10af3e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [eax + 0x230]
test edi, edi
je 0x10af450
and dword [ebp + 8], 0
push ebx
push 4
pop esi
sub esi, edi
cmp dword [ebp + 0x10], 0
jle 0x10af43a
mov ecx, edi
shl ecx, 3
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
jge 0x10af43a
movzx ebx, byte [edx]
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 8
shl ebx, cl
xor dword [eax + 0x22c], ebx
inc edx
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0x10]
jl 0x10af417
cmp dword [ebp + 0x10], esi
pop ebx
jge 0x10af44d
mov ecx, dword [ebp + 0x10]
add edi, ecx
mov dword [eax + 0x230], edi
jmp 0x10af493
sub dword [ebp + 0x10], esi
mov esi, dword [ebp + 0x10]
shr esi, 2
test esi, esi
mov ecx, edx
jle 0x10af46d
lea edx, [edx + esi*4]
mov edi, dword [ecx]
xor dword [eax + 0x22c], edi
add ecx, 4
dec esi
jne 0x10af45f
mov esi, dword [ebp + 0x10]
and esi, 3
mov dword [eax + 0x230], esi
je 0x10af493
test esi, esi
jle 0x10af493
xor ecx, ecx
movzx edi, byte [edx]
shl edi, cl
add ecx, 8
xor dword [eax + 0x22c], edi
inc edx
dec esi
jne 0x10af481
pop edi
pop esi
leave
ret 0xc

Function at 0x10afd1b
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x10afd36
xor ax, ax
jmp 0x10afdd5
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x204]
push 0x1004cd0
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, eax
jmp 0x10afdc6
lea eax, [ebp - 0x428]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010ae93d
mov edi, eax
lea eax, [ebp - 0x454]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10afda8
push esi
call ebx
or esi, 0xffffffff
test edi, edi
je 0x10afdd9
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10afdbe
mov dword [ebp - 4], 0xfffffe05
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp esi, 0xffffffff
jne 0x10afd7c
push esi
call ebx
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
or ax, 0xffff
jmp 0x10afdd2
Function at 0x10b07ce
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
push esi
lea eax, [ebp + 0x10]
push eax
xor esi, esi
push 1
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10b07ff
cmp dword [ebp + 0xc], esi
jne 0x10b0808
xor eax, eax
xor edx, edx
jmp 0x10b090b
push ebx
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x40c]
push 0x1004284
push eax
call edi
push dword [ebp + 0x18]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
mov ebx, eax
lea eax, [ebp - 0x40c]
push eax
call esi
add ebx, eax
shl ebx, 1
mov eax, 0x1fc
sub eax, ebx
mov dword [ebp + 8], eax
add esp, 0x18
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x40c]
push eax
call esi
pop ecx
lea eax, [ebp + eax*2 - 0x40c]
push eax
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10b0885
xor esi, esi
xor edi, edi
jmp 0x10b08fc
lea eax, [ebp - 0x40c]
push 0x3a
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x10b089f
mov word [eax], 0x24
push dword [ebp + 0x18]
lea eax, [ebp - 0x40c]
push eax
call edi
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
test esi, esi
lea eax, [ebp - 0x65c]
push eax
jne 0x10b08cf
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jmp 0x10b08d8
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x10b08f6
mov edx, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x640]
xor eax, eax
xor edi, edi
or eax, edx
or ecx, edi
add dword [ebp - 8], eax
adc dword [ebp - 4], ecx
jmp 0x10b08b0
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret 0x14