joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100190f0
Capabilities:
Create thread
Read .ini file

Disassembly:
sub esp, 0x10
mov eax, dword [0x1012c310]
xor eax, esp
mov dword [esp + 0xc], eax
mov edx, dword [0x10227b98]
mov eax, dword [0x10227cd8]
mov ecx, dword [0x10227b64]
push esi
push str..config.ini
push 0xa
mov dword [0x1022747c], edx
lea edx, [esp + 0xc]
push edx
push 0x101119eb
mov dword [0x1016b918], eax
mov eax, dword [0x10227a50]
mov dword [0x1017cedc], ecx
mov ecx, dword [0x10227c58]
push 0x10113f70
push str.CONFIG
mov dword [0x102127b4], eax
mov dword [0x102107e8], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 4]
push eax
call fcn.10097f92
add esp, 4
mov dword [0x10210d3c], eax
cmp eax, 0x3c
jne 0x10019179
mov dword [0x10227988], eax
jmp 0x1001926d
cmp eax, 0xc8
jne 0x100191f5
call fcn.10015720
push str.NtDelayExecution
push str.ntdll.dll
mov dword [0x10133c84], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10015540
push eax
call fcn.100c34d0
cmp dword [0x10227994], 0
mov dword [0x10162e34], eax
jne 0x100191df
push 0x20
call sub.d3d9.dll_Direct3DCreate9
test eax, eax
je 0x100191df
mov eax, dword [eax]
mov ecx, dword [eax + 0x40]
push 0x10015640
push ecx
mov dword [0x10212c0c], eax
call fcn.100c34d0
mov dword [0x10162df4], eax
mov dword [0x10227988], 0xc8
mov dword [0x1022798c], 0x1388
jmp 0x1001926d
mov esi, 0x3e8
cmp eax, esi
je 0x10019202
test eax, eax
jne 0x1001926d
call fcn.10015720
push str.NtDelayExecution
push str.ntdll.dll
mov dword [0x10133c84], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10015540
push eax
call fcn.100c34d0
cmp dword [0x10227994], 0
mov dword [0x10162e34], eax
jne 0x10019261
push 0x20
call sub.d3d9.dll_Direct3DCreate9
test eax, eax
je 0x10019261
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
push 0x10015640
push edx
mov dword [0x10212c0c], eax
call fcn.100c34d0
mov dword [0x10162df4], eax
mov dword [0x10227988], esi
mov dword [0x1022798c], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e910
push 0
push 0
call esi
call fcn.10013970
mov eax, dword [0x10227ca0]
push 0
push 4
push 0x102277b8
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.100147a0
call fcn.10014e10
cmp byte [0x1022770a], 0
jne 0x100192ca
push 0
push 0
push 0
push 0x100148b0
push 0
push 0
call esi
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.10096904
add esp, 0x10
ret
Function at 0x100192e0
Capabilities:
Allocate or change rwx memory
Delete file
Execute shellcode via indirect call

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x10019435
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
xor bl, bl
push 0x1f4
call ebp
mov ecx, dword [0x10227a60]
lea eax, [esp + 0x1c]
push eax
push 0x40
push 4
push ecx
call esi
test eax, eax
je 0x1001931f
mov bl, 1
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x10227a60]
lea edx, [esp + 0x1c]
push edx
push eax
push 4
push ecx
call esi
test bl, bl
je 0x10019300
mov eax, dword [esp + 0x18]
call fcn.10008670
mov edi, dword [0x10227b30]
lea edx, [esp + 0x18]
push edx
push 0x40
push 1
push edi
mov ebx, edi
call esi
mov edx, dword [esp + 0x18]
movzx eax, byte [0x10130e12]
lea ecx, [esp + 0x10]
push ecx
push edx
push 1
push edi
mov byte [ebx], al
call esi
mov edi, dword [0x10227a98]
lea eax, [esp + 0x18]
push eax
push 0x40
push 1
push edi
mov ebx, edi
call esi
mov eax, dword [esp + 0x18]
movzx ecx, byte [0x10130e12]
lea edx, [esp + 0x10]
push edx
push eax
push 1
push edi
mov byte [ebx], cl
call esi
mov edi, dword [0x10227a14]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push 1
push edi
mov ebx, edi
call esi
mov ecx, dword [esp + 0x18]
mov dl, byte [0x10130e12]
lea eax, [esp + 0x10]
push eax
push ecx
push 1
push edi
mov byte [ebx], dl
call esi
mov edi, dword [0x10227c8c]
lea edx, [esp + 0x18]
push edx
push 0x40
push 1
push edi
mov ebx, edi
call esi
mov edx, dword [esp + 0x18]
movzx eax, byte [0x10130e12]
lea ecx, [esp + 0x10]
push ecx
push edx
push 1
push edi
mov byte [ebx], al
call esi
mov edi, dword [0x10227c5c]
lea eax, [esp + 0x18]
push eax
push 0x40
push 1
push edi
mov ebx, edi
call esi
movzx ecx, byte [0x10130e12]
mov byte [ebx], cl
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x18]
push edx
push eax
push 1
push edi
call esi
call fcn.100190f0
push 0x7d0
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov eax, 1
pop ecx
ret 0xc
test eax, eax
jne 0x10019466
mov ecx, dword [0x10138a44]
test ecx, ecx
jle 0x10019456
mov eax, dword [0x10227984]
test eax, eax
jle 0x10019456
push eax
push ecx
call fcn.10004370
add esp, 8
call fcn.10009020
push str..XNova_bake.dll
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
pop ecx
ret 0xc
Function at 0x1001c410
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100cdd2b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1012c310]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100c2ab5
push 4
mov dword [esp + 0x24], 0
call fcn.1009a24f
mov edi, eax
add esp, 4
test edi, edi
je 0x1001c492
call fcn.100c24fa
mov dword [edi], eax
call fcn.100c22f3
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.100c274d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1001c487
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.100c2775
jmp 0x1001c494
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x1001fca0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
cmp esi, dword [ecx + eax + 0x2c]
push edi
lea edi, [ecx + eax + 0x18]
jae 0x1001fcb8
mov eax, esi
pop edi
ret
push ebx
movzx ebx, word [eax + 6]
xor eax, eax
xor edx, edx
cmp ax, bx
jae 0x1001fce5
movzx eax, dx
lea ecx, [eax + eax*4]
lea eax, [edi + ecx*8]
mov ecx, dword [eax + 0xc]
cmp esi, ecx
jb 0x1001fcdf
mov eax, dword [eax + 0x10]
add eax, ecx
cmp esi, eax
jb 0x1001fcea
inc edx
cmp dx, bx
jb 0x1001fcc6
pop ebx
xor eax, eax
pop edi
ret
movzx eax, dx
lea ecx, [eax + eax*4]
mov eax, dword [edi + ecx*8 + 0x14]
sub eax, dword [edi + ecx*8 + 0xc]
lea ecx, [edi + ecx*8]
pop ebx
add eax, esi
pop edi
ret
Function at 0x1001fd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 0x18]
add eax, edi
mov edx, 0x10b
sub esp, 8
cmp cx, dx
je 0x1001fd22
mov eax, 0x20b
xor eax, eax
add esp, 8
ret
push ebx
push ebp
push esi
mov esi, dword [eax + 0x78]
mov ecx, edi
call fcn.1001fca0
mov ebp, eax
mov esi, dword [ebp + edi + 0x20]
add ebp, edi
mov ecx, edi
mov dword [esp + 0x10], ebp
call fcn.1001fca0
mov esi, dword [ebp + 0x24]
mov ebx, eax
mov ecx, edi
add ebx, edi
call fcn.1001fca0
mov ebp, dword [ebp + 0x18]
add eax, edi
mov dword [esp + 0xc], eax
test ebp, ebp
je 0x1001fd8a
lea ecx, [ecx]
mov esi, dword [ebx]
mov ecx, edi
dec ebp
call fcn.1001fca0
add eax, edi
push str.ReflectiveLoader
push eax
call fcn.10097a20
add esp, 8
test eax, eax
jne 0x1001fd93
add dword [esp + 0xc], 2
add ebx, 4
test ebp, ebp
jne 0x1001fd60
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
mov esi, dword [edx + 0x1c]
mov ecx, edi
call fcn.1001fca0
mov ecx, dword [esp + 0xc]
movzx edx, word [ecx]
add eax, edi
mov esi, dword [eax + edx*4]
mov ecx, edi
call fcn.1001fca0
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1003dc20
Capabilities:
Parse credit card information

Disassembly:
mov al, byte [esp + 4]
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x1003dc31
mov al, 1
ret
mov dl, al
sub dl, 0x61
cmp dl, 0x19
jbe 0x1003dc2e
mov cl, al
sub cl, 0x30
cmp cl, 9
jbe 0x1003dc2e
cmp al, 0x2f
je 0x1003dc2e
cmp al, 0x2e
je 0x1003dc2e
cmp al, 0x40
je 0x1003dc2e
cmp al, 0x2d
je 0x1003dc2e
cmp al, 0x25
je 0x1003dc2e
cmp al, 0x3a
je 0x1003dc2e
cmp al, 0x3f
je 0x1003dc2e
cmp al, 0x21
je 0x1003dc2e
cmp al, 0x5f
je 0x1003dc2e
cmp al, 0x26
je 0x1003dc2e
cmp al, 0x3b
je 0x1003dc2e
cmp al, 0xc0
jae 0x1003dc78
xor al, al
ret
cmp al, 0xf7
je 0x1003dc75
cmp al, 0xd7
setne al
ret
Function at 0x1004a140
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100c986b
mov eax, dword fs:[0]
push eax
mov eax, 0x18a4
call fcn.1009c040
mov eax, dword [0x1012c310]
xor eax, esp
mov dword [esp + 0x18a0], eax
push esi
mov eax, dword [0x1012c310]
xor eax, esp
push eax
lea eax, [esp + 0x18ac]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18bc]
lea ecx, [esp + 8]
call fcn.10069ce0
lea ecx, [esp + 8]
mov dword [esp + 0x18b4], 0
call fcn.10069d10
test al, al
jne 0x1004a1bb
lea edx, [esp + 0x8a4]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1004a1df
lea eax, [esp + 0xa0]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xa0]
push ecx
mov ecx, esi
call fcn.10036880
jmp 0x1004a1ee
lea edx, [esp + 0x8a4]
push edx
mov ecx, esi
call fcn.10039c00
lea ecx, [esp + 8]
mov dword [esp + 0x18b4], 0xffffffff
call fcn.10069d00
mov ecx, dword [esp + 0x18ac]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18a0]
xor ecx, esp
call fcn.10096904
add esp, 0x18b0
ret
Function at 0x1004a6f0
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x100c99dc
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x1012c310]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1012c310]
xor eax, esp
push eax
lea eax, [esp + 0x458]
mov dword fs:[0], eax
mov edi, dword [esp + 0x468]
mov esi, dword [esp + 0x46c]
lea ecx, [esp + 0x14]
call fcn.100364f0
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x464], 0
call fcn.1003a5b0
push 0x5c
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.10038540
lea ecx, [esp + 0x14c]
call fcn.10069ce0
lea ecx, [esp + 0x14c]
mov byte [esp + 0x460], 1
call fcn.10069d10
test al, al
lea ecx, [esp + 0x14]
je 0x1004a79f
call fcn.100372a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jmp 0x1004a8bc
call fcn.10038b20
cmp eax, 0x104
jle 0x1004a86e
lea ecx, [esp + 0x31c]
call fcn.100364f0
lea eax, [esp + 0x31c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x468], 2
call fcn.1004a010
add esp, 8
lea ecx, [esp + 0x1e4]
call fcn.100364f0
push 0x10106210
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x464], 3
call fcn.1003a2e0
lea ecx, [esp + 0x31c]
call fcn.10037710
push eax
lea ecx, [esp + 0x1e8]
call fcn.1003a2e0
lea ecx, [esp + 0x1e4]
call fcn.10039db0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x1004a841
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1004a83f
mov esi, 1
test esi, esi
lea ecx, [esp + 0x1e4]
setne bl
mov byte [esp + 0x460], 2
call fcn.100365b0
lea ecx, [esp + 0x31c]
mov byte [esp + 0x460], 1
call fcn.100365b0
jmp 0x1004a8bf
lea ecx, [esp + 0x14]
call fcn.10039db0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
jne 0x1004a8bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov edi, eax
je 0x1004a8b0
push edi
mov ecx, esi
call fcn.100523f0
mov ebx, dword [esi]
lea ecx, [esp + 0x14]
call fcn.10037710
mov edx, dword [ebx + 0x2c]
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call edx
cmp edi, 2
jne 0x1004a8ba
mov ebp, 1
test ebp, ebp
setne bl
lea ecx, [esp + 0x14c]
mov byte [esp + 0x460], 0
call fcn.10069d00
lea ecx, [esp + 0x14]
mov dword [esp + 0x460], 0xffffffff
call fcn.100365b0
mov al, bl
mov ecx, dword [esp + 0x458]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.10096904
add esp, 0x450
ret
Function at 0x1004c830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100c9e71
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x1012c310]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1012c310]
xor eax, esp
push eax
lea eax, [esp + 0x320]
mov dword fs:[0], eax
mov edi, dword [esp + 0x330]
mov ebx, dword [esp + 0x338]
mov esi, dword [esp + 0x334]
mov ebp, dword [esp + 0x33c]
mov dword [ebx], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.10038b20
test eax, eax
jne 0x1004c8b8
test ebp, ebp
je 0x1004c8b1
mov eax, dword [ebp]
mov edx, dword [eax + 0x14]
push str.GetAttributes:_filename_is_empty
mov ecx, ebp
call edx
xor al, al
jmp 0x1004c9e5
lea ecx, [esp + 0x14]
call fcn.100364f0
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x32c], 0
call fcn.1003a5b0
push 0x5c
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.10038540
lea ecx, [esp + 0x14]
call fcn.10038b20
lea ecx, [esp + 0x14c]
mov edi, eax
call fcn.10069ce0
cmp edi, 0x104
mov byte [esp + 0x328], 1
jge 0x1004c93e
lea ecx, [esp + 0x14]
call fcn.10037010
test al, al
jne 0x1004c927
lea ecx, [esp + 0x14c]
call fcn.10069d10
test al, al
je 0x1004c93e
lea ecx, [esp + 0x14]
call fcn.100372a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi], eax
cmp eax, 0xffffffff
jmp 0x1004c9ab
test edi, edi
jle 0x1004c996
lea ecx, [esp + 0x1e4]
call fcn.100364f0
lea eax, [esp + 0x1e4]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x330], 2
call fcn.1004a5e0
add esp, 8
lea ecx, [esp + 0x1e4]
call fcn.10036e20
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x1e4]
mov dword [esi], eax
mov byte [esp + 0x328], 1
call fcn.100365b0
jmp 0x1004c9a8
lea ecx, [esp + 0x14]
call fcn.10036e20
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x1004c9b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
cmp dword [esi], 0xffffffff
lea ecx, [esp + 0x14c]
setne bl
mov byte [esp + 0x328], 0
call fcn.10069d00
lea ecx, [esp + 0x14]
mov dword [esp + 0x328], 0xffffffff
call fcn.100365b0
mov al, bl
mov ecx, dword [esp + 0x320]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.10096904
add esp, 0x318
ret
Function at 0x1004cbf0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100c9f21
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x1012c310]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push esi
mov eax, dword [0x1012c310]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
mov esi, dword [esp + 0x328]
lea ecx, [esp + 0xc]
call fcn.100364f0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x324], 0
call fcn.1003a5b0
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
call fcn.10038540
push 0
mov ebx, 1
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.1004a920
add esp, 0xc
lea ecx, [esp + 0x144]
call fcn.10069ce0
lea ecx, [esp + 0x144]
mov byte [esp + 0x320], bl
call fcn.10069d10
test al, al
lea ecx, [esp + 0xc]
je 0x1004ccb5
call fcn.100372a0
mov ecx, dword [esp + 0x32c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x1004cd33
call fcn.10038b20
test eax, eax
jle 0x1004cd19
lea ecx, [esp + 0x1dc]
call fcn.100364f0
lea edx, [esp + 0x1dc]
push edx
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x328], 2
call fcn.1004a5e0
mov ecx, dword [esp + 0x334]
add esp, 8
push ecx
lea ecx, [esp + 0x1e0]
call fcn.10039db0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x1dc]
mov esi, eax
mov byte [esp + 0x320], bl
call fcn.100365b0
jmp 0x1004cd33
mov edx, dword [esp + 0x32c]
push edx
lea ecx, [esp + 0x10]
call fcn.10039db0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x144]
setne bl
mov byte [esp + 0x320], 0
call fcn.10069d00
lea ecx, [esp + 0xc]
mov dword [esp + 0x320], 0xffffffff
call fcn.100365b0
mov al, bl
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.10096904
add esp, 0x318
ret
Function at 0x10052cd0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov edi, dword [esp + 0x1c]
mov byte [ebp], 0
mov ebx, ecx
mov dword [edi], 0
je 0x10052dad
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10052dad
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x10052d50
push 0
push edi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10052d3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x10052d43
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10052dc1
push eax
call fcn.100523f0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
cmp dword [edi], 0
jne 0x10052d47
mov byte [ebp], 1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x14
mov eax, dword [ebx + 8]
test eax, eax
je 0x10052d90
push eax
push esi
push 1
push ecx
call fcn.1009914e
add esp, 0x10
cmp eax, esi
mov dword [edi], eax
je 0x10052d47
mov eax, dword [ebx + 8]
push eax
call fcn.1009c247
add esp, 4
test eax, eax
je 0x10052d43
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10052dc1
call fcn.10052300
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10052dc1
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.No_file_is_open.
call eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10052dc1
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.NULL_buf_or_bufSize
call eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
Function at 0x10052dd0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp dword [ecx + 4], 0xffffffff
mov dword [esp], ecx
jne 0x10052dfa
cmp dword [ecx + 8], 0
jne 0x10052dfa
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10052df4
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Failed_to_write_because_file_is_not_open.
call edx
xor al, al
pop ecx
ret 0x14
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x10052e15
mov dword [edi], 0
mov dword [edi + 4], 0
push ebp
mov ebp, dword [esp + 0x18]
mov eax, ebp
or eax, dword [esp + 0x1c]
push esi
je 0x10052eed
mov edx, dword [esp + 0x18]
jmp 0x10052e30
cmp dword [esp + 0x20], 0
jl 0x10052e48
jg 0x10052e41
cmp ebp, 0x989680
jbe 0x10052e48
mov esi, 0x989680
jmp 0x10052e4a
mov esi, ebp
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x10052ea8
push 0
lea ecx, [esp + 0x1c]
push ecx
push esi
push ebx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10052e76
mov edx, dword [esp + 0x18]
cmp edx, esi
je 0x10052ec7
mov esi, dword [esp + 0x28]
test esi, esi
je 0x10052e9e
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push 1
push str.WriteFileError
mov ecx, esi
call eax
mov ecx, esi
call fcn.10052300
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
pop esi
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret 0x14
mov eax, dword [ecx + 8]
test eax, eax
je 0x10052ecb
push eax
push 1
push esi
push ebx
call fcn.10099826
add esp, 0x10
cmp eax, 1
jne 0x10052ef7
mov edx, esi
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x10]
add ebx, esi
sub ebp, esi
mov eax, 0
sbb dword [esp + 0x20], eax
cmp edi, eax
je 0x10052ee1
add dword [edi], edx
adc dword [edi + 4], eax
mov eax, ebp
or eax, dword [esp + 0x20]
jne 0x10052e30
pop esi
pop ebp
pop edi
mov al, 1
pop ebx
pop ecx
ret 0x14
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x10052f0b
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.fwrite_failed.
call eax
pop esi
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret 0x14
Function at 0x10055700
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1012c310]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
mov ebp, dword [esp + 0x130]
push esi
mov esi, dword [esp + 0x130]
test esi, esi
push edi
mov edi, dword [esp + 0x13c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], edi
je 0x100558e0
test ebx, ebx
je 0x100558e0
lea ecx, [esi + esi*4 + 0xa]
mov eax, 0xaaaaaaab
mul ecx
mov ecx, edx
shr ecx, 1
lea eax, [ecx + ecx]
xor edx, edx
div esi
lea ecx, [ecx + eax + 3]
push ecx
mov ecx, edi
call fcn.1003c250
mov eax, 0xaaaaaaab
mul dword [esp + 0x134]
xor esi, esi
xor ecx, ecx
shr edx, 1
mov dword [esp + 0x10], edx
je 0x10055840
mov dword [esp + 0x18], edx
jmp 0x10055794
mov ebx, dword [esp + 0x14]
movzx eax, byte [ebx + esi]
movzx edi, byte [ebx + esi + 1]
add esi, 1
movzx edx, byte [ebx + esi + 1]
mov ebx, eax
add esi, 1
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ebp]
mov byte [esp + ecx + 0x20], bl
and eax, 3
mov ebx, edi
shl eax, 4
sar ebx, 4
and ebx, 0xf
or ebx, eax
movzx eax, byte [ebx + ebp]
mov byte [esp + ecx + 0x21], al
add ecx, 1
and edi, 0xf
mov eax, edx
sar eax, 6
add edi, edi
and eax, 3
add edi, edi
or eax, edi
movzx eax, byte [eax + ebp]
mov edi, dword [esp + 0x1c]
add ecx, 1
mov byte [esp + ecx + 0x20], al
and edx, 0x3f
mov dl, byte [edx + ebp]
add ecx, 1
mov byte [esp + ecx + 0x20], dl
add ecx, 1
add esi, 1
cmp ecx, 0x100
jl 0x1005581c
push ecx
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.1003c720
xor ecx, ecx
sub dword [esp + 0x18], 1
jne 0x10055790
test ecx, ecx
je 0x10055838
push ecx
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.1003c720
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x134]
lea edx, [edx + edx*2]
sub eax, edx
sub eax, 1
je 0x100558a4
sub eax, 1
jne 0x100558e0
movzx eax, byte [ebx + esi]
movzx esi, byte [ebx + esi + 1]
mov dword [esp + 0x10], eax
sar eax, 2
and eax, 0x3f
movzx eax, byte [eax + ebp]
push eax
mov ecx, edi
call fcn.10040f10
mov eax, dword [esp + 0x10]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
movzx edx, byte [ecx + ebp]
push edx
mov ecx, edi
call fcn.10040f10
and esi, 0xf
movzx eax, byte [ebp + esi*4]
push eax
jmp 0x100558d0
movzx esi, byte [ebx + esi]
mov ecx, esi
sar ecx, 2
and ecx, 0x3f
movzx edx, byte [ecx + ebp]
push edx
mov ecx, edi
call fcn.10040f10
and esi, 3
shl esi, 4
movzx eax, byte [esi + ebp]
push eax
mov ecx, edi
call fcn.10040f10
push 0x3d
mov ecx, edi
call fcn.10040f10
push 0x3d
mov ecx, edi
call fcn.10040f10
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10096904
add esp, 0x11c
ret