joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000911a
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push ebp
or ebp, 0xffffffff
push esi
mov esi, ecx
cmp ebx, ebp
jne 0x10009134
xor eax, eax
jmp 0x10009200
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10009158
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
add ecx, dword [eax]
cmp dword [eax], ecx
jae 0x10009158
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x10009200
cmp dword [esi + 0x4c], 0
push edi
je 0x100091fd
mov ecx, esi
call fcn.10008dbb
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10009176
movsx eax, bl
jmp 0x100091b7
lea eax, [esp + 0x3c]
mov byte [esp + 0x13], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100091cd
sub eax, 1
je 0x100091cd
dec eax
sub eax, 1
jne 0x100091fd
movsx eax, byte [esp + 0x13]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
pop ecx
pop ecx
cmp eax, ebp
jne 0x100091c9
mov ebx, ebp
mov eax, ebx
jmp 0x100091ff
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub edi, eax
je 0x100091ed
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100091fd
lea eax, [esp + 0x13]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x100091ff
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x10009679
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test ebx, ebx
jg 0x10009699
jl 0x10009690
test edi, edi
jne 0x10009699
xor eax, eax
xor edx, edx
jmp 0x10009767
cmp dword [ebp + 0x38], 0
je 0x100096b0
push ebx
push edi
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10009767
mov eax, dword [ebp + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100096fc
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x100096fc
cmp eax, edi
jb 0x100096d3
mov eax, edi
mov dword [esp + 0x18], edi
mov esi, dword [esp + 0x14]
push eax
push ecx
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x18]
add esi, ecx
mov dword [esp + 0x14], esi
mov esi, edi
sub esi, ecx
sub dword [eax], ecx
mov eax, dword [ebp + 0x1c]
add dword [eax], ecx
jmp 0x10009704
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
je 0x1000975d
mov ecx, ebp
call fcn.10008dbb
mov ecx, dword [esp + 0x14]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10009747
push dword [ebp + 0x4c]
push eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, dword [esp + 0x24]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x14], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x1000975d
jmp 0x10009717
test edx, edx
je 0x1000975d
push dword [ebp + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sub edi, esi
mov eax, edi
sbb ebx, 0
mov edx, ebx
pop esi
pop edi
pop ebp
pop ebx
ret 0xc
Function at 0x1000976d
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10009790
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10009863
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], edi
test ecx, ecx
je 0x100097bd
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x100097c3
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, ecx
cdq
mov dword [esp + 0x2c], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1000982b
jg 0x100097da
test esi, esi
je 0x1000982b
test ecx, ecx
jl 0x10009825
jg 0x100097e4
test eax, eax
je 0x10009825
cmp edi, ecx
jg 0x100097f8
jl 0x100097ee
cmp esi, eax
jae 0x100097f8
mov eax, esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], edi
mov ebp, dword [esp + 0x28]
push eax
push ebp
push dword [esp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x2c]
add ebp, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1000982f
mov ebp, dword [esp + 0x28]
jmp 0x10009839
mov ebp, dword [esp + 0x28]
test edi, edi
jl 0x10009854
jg 0x10009839
test esi, esi
je 0x10009854
cmp dword [ebx + 0x4c], 0
je 0x10009854
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x1000a36a
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x100b3974]
push esi
sub eax, 1
je 0x1000a3fe
sub eax, 1
je 0x1000a3f1
sub eax, 1
je 0x1000a3de
mov ecx, dword [0x100eba30]
mov edx, 0xfa1
push 5
xor esi, esi
call fcn.1006d56b
mov ecx, eax
test ecx, ecx
je 0x1000a3bc
mov eax, dword [0x100d021c]
push esi
push 0x1000a442
push dword [eax]
mov eax, dword [0x100d0220]
push ecx
push dword [eax]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov esi, eax
jmp 0x1000a3cf
push str.Unable_to_find_the_exception_dialog_resource__n
push 0xffffffffffffffff
push esi
push esi
push 3
call fcn.10008864
add esp, 0x14
mov ecx, dword [0x100d01e8]
call fcn.1000a6c3
mov eax, esi
pop esi
ret
mov ecx, dword [0x100d01e8]
call fcn.1000a6c3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x100d01e8]
call fcn.1000a6c3
jmp 0x1000a43b
mov ecx, dword [0x100d01e8]
push edi
call fcn.1000a6c3
mov edi, str.Recursive_exception_detected__n
xor esi, esi
push edi
push 0xffffffffffffffff
push esi
push esi
push 3
call fcn.10008864
add esp, 0x14
push 0x30
push str.Error_
push edi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
mov eax, 0x481
pop esi
ret
Function at 0x1001e3a5
Capabilities:
Accept command line arguments

Disassembly:
call fcn.10033e3c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._NO_EXT
push eax
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
jne 0x1001e548
call fcn.100265c0
call fcn.10027f08
call fcn.10028c34
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._NO_CLASS_EXT
push eax
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
jne 0x1001e4bc
call fcn.100294f2
call fcn.10040bbe
call fcn.100134e3
call fcn.100481d1
call fcn.10023595
call fcn.1000d373
call fcn.1004a5cb
call fcn.1004c995
call fcn.10014ae9
call fcn.1003b076
call fcn.100491de
call fcn.1001024c
call fcn.1002d283
call fcn.1002c10f
call fcn.10026fbf
call fcn.1002ae2c
call fcn.10038c5e
call fcn.1004333c
call fcn.100207f7
call fcn.1003760e
call fcn.10015d5c
call fcn.100454fc
call fcn.1003e727
call fcn.100467d7
call fcn.1000bafc
call fcn.10021b18
call fcn.10011add
call fcn.1001778b
call fcn.1001f39b
call fcn.1003d8e3
call fcn.1003d8d4
call fcn.1001e57c
call fcn.1003e727
call fcn.1001ea5a
call fcn.1000e784
call fcn.10014223
call fcn.10041dcd
call fcn.10039dc2
call fcn.1002bb3a
call fcn.1001e079
call fcn.1004b591
call fcn.1002f0bf
call fcn.1003ccab
call fcn.10036827
call fcn.1001dbf5
call fcn.10038308
call fcn.10046179
call fcn.1001c52a
call fcn.1002a6fe
call fcn.10028b55
call fcn.10036eb9
call fcn.10017737
call fcn.100179cb
call fcn.10028457
call fcn.10049e91
call fcn.10044512
call fcn.10043e2c
call fcn.1001df58
call fcn.1001e168
call fcn.10027feb
call fcn.10028c24
call fcn.10028c04
call fcn.1001724d
call fcn.1002e0f3
call fcn.10016b8d
call fcn.10067683
call fcn.1001e71c
call fcn.10038609
jmp 0x1001e7f1
ret
push esi
mov esi, 0x1001e864
mov ecx, 0x553e02
mov edx, esi
call fcn.1001e767
mov edx, esi
mov ecx, 0x56c0d2
call fcn.1001e767
mov edx, esi
mov ecx, 0x56d987
call fcn.1001e767
mov edx, esi
mov ecx, 0x56db53
call fcn.1001e767
mov edx, esi
mov ecx, 0x5acd14
call fcn.1001e767
mov edx, esi
mov ecx, 0x5fdd14
call fcn.1001e767
mov edx, esi
mov ecx, 0x67cc27
call fcn.1001e767
mov edx, esi
mov ecx, 0x67cc52
call fcn.1001e767
mov edx, esi
mov ecx, 0x686363
pop esi
jmp fcn.1001e767
Function at 0x1004d404
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
push esi
sub eax, 0
je 0x1004d4e0
sub eax, 1
je 0x1004d435
sub eax, 1
je 0x1004d425
sub eax, 1
jne 0x1004d4f6
push str.Vinifera.dll_is_not_allowed_to_be_loaded_within_a_thread__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1004d4f6
cmp dword [esp + 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
je 0x1004d449
push str.Vinifera.dll_is_being_loaded_statically._n
jmp 0x1004d44e
push str.Vinifera.dll_is_being_loaded_dynamicly._n
call esi
push str.Vinifera.dll_attached_to_GAME.EXE._n
call esi
push str.About_to_call_StartHooking__..._n_n
call esi
call sym.Vinifera.dll_bool___fastcall_StartHooking_void_
test al, al
je 0x1004d4f6
push 0x100eba48
push 0x100eba44
push 0x100eba40
push 0x100eba3c
mov edx, 0x100eba38
mov ecx, 0x100eba34
call fcn.10068fb3
push dword [0x100eba48]
push dword [0x100eba44]
push dword [0x100eba40]
push dword [0x100eba3c]
push dword [0x100eba38]
push dword [0x100eba34]
push str._02u__02u__04u__02u__02u__02u
push 0x100
push 0x100eba50
call fcn.100026fa
add esp, 0x24
call fcn.1004d951
push str._n_nSetup_Hooks___done__n_n
call esi
mov eax, dword [esp + 8]
mov dword [0x100eba30], eax
jmp 0x1004d50d
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str._n_nAbout_to_call_StopHooking__..._n_n
call esi
call sym.Vinifera.dll_bool___fastcall_StopHooking_void_
test al, al
jne 0x1004d4fa
xor eax, eax
jmp 0x1004d510
call fcn.1006d1f2
and dword [0x100eba30], 0
push str.Vinifera.dll_detached_from_GAME.EXE._n
call esi
xor eax, eax
inc eax
pop esi
ret 0xc
Function at 0x1004d514
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
sub esp, 0x10
cmp byte [0x100ebb58], 0
je 0x1004d527
mov al, 1
jmp 0x1004d687
push ebx
push ebp
push str.StartHooking__..._n_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 8]
xor bl, bl
call fcn.1004d8c4
mov ebp, str.StartHooking
test al, al
je 0x1004d62c
push esi
inc bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100ebb50
push 0x40
push dword [esp + 0x1c]
mov esi, eax
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1004d5bf
xor bl, bl
cmp byte [0x100d5818], bl
jne 0x1004d5bf
cmp byte [0x100ebb59], bl
jne 0x1004d5bf
push str.Failed_to_change_code_section_permissions_
push 0x100ebb5b
push 0x100ebb5a
push 0x100ebb59
push ebp
push 0x3c
push str.D:_aViniferaVinifera_srchookerhooker.cpp
push str.success__true
push 1
call fcn.10006081
add esp, 0x24
cmp byte [0x100ebb5a], bl
je 0x1004d5b7
int3
xor ecx, ecx
inc ecx
call fcn.100750ee
push 0x100ebb54
push 0x40
push dword [esp + 0x20]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
pop esi
test eax, eax
jne 0x1004d62c
xor bl, bl
cmp byte [0x100d5818], bl
jne 0x1004d67d
cmp byte [0x100ebb5c], bl
jne 0x1004d62c
push str.Failed_to_change_data_section_permissions_
push 0x100ebb5e
push 0x100ebb5d
push 0x100ebb5c
push ebp
push 0x40
push str.D:_aViniferaVinifera_srchookerhooker.cpp
push str.success__true
push 1
call fcn.10006081
add esp, 0x24
cmp byte [0x100ebb5d], bl
je 0x1004d624
int3
xor ecx, ecx
inc ecx
call fcn.100750ee
cmp byte [0x100d5818], 0
jne 0x1004d67d
cmp byte [0x100ebb5f], 0
jne 0x1004d67d
cmp bl, 1
je 0x1004d67d
push 0
push 0x100ebb61
push 0x100ebb60
push 0x100ebb5f
push ebp
push 0x44
push str.D:_aViniferaVinifera_srchookerhooker.cpp
push str.success__true
push 1
call fcn.10006081
add esp, 0x24
cmp byte [0x100ebb60], 0
je 0x1004d675
int3
xor ecx, ecx
inc ecx
call fcn.100750ee
pop ebp
mov byte [0x100ebb58], bl
mov al, bl
pop ebx
add esp, 0x10
ret
Function at 0x1004d68b
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x14
push ebx
push ebp
push str.StopHooking__..._n_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0xc]
xor bl, bl
call fcn.1004d8c4
mov ebp, str.StopHooking
test al, al
je 0x1004d79b
push esi
inc bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [0x100ebb50]
push dword [esp + 0x20]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1004d72a
xor bl, bl
cmp byte [0x100d5818], bl
jne 0x1004d72a
cmp byte [0x100ebb62], bl
jne 0x1004d72a
push str.Failed_to_change_code_section_permissions_
push 0x100ebb64
push 0x100ebb63
push 0x100ebb62
push ebp
push 0x5c
push str.D:_aViniferaVinifera_srchookerhooker.cpp
push str.success__true
push 1
call fcn.10006081
add esp, 0x24
cmp byte [0x100ebb63], bl
je 0x1004d722
int3
xor ecx, ecx
inc ecx
call fcn.100750ee
lea eax, [esp + 0xc]
push eax
push dword [0x100ebb54]
push dword [esp + 0x24]
push dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
pop esi
test eax, eax
jne 0x1004d79b
xor bl, bl
cmp byte [0x100d5818], bl
jne 0x1004d7ec
cmp byte [0x100ebb65], bl
jne 0x1004d79b
push str.Failed_to_change_data_section_permissions_
push 0x100ebb67
push 0x100ebb66
push 0x100ebb65
push ebp
push 0x60
push str.D:_aViniferaVinifera_srchookerhooker.cpp
push str.success__true
push 1
call fcn.10006081
add esp, 0x24
cmp byte [0x100ebb66], bl
je 0x1004d793
int3
xor ecx, ecx
inc ecx
call fcn.100750ee
cmp byte [0x100d5818], 0
jne 0x1004d7ec
cmp byte [0x100ebb68], 0
jne 0x1004d7ec
cmp bl, 1
je 0x1004d7ec
push 0
push 0x100ebb6a
push 0x100ebb69
push 0x100ebb68
push ebp
push 0x64
push str.D:_aViniferaVinifera_srchookerhooker.cpp
push str.success__true
push 1
call fcn.10006081
add esp, 0x24
cmp byte [0x100ebb69], 0
je 0x1004d7e4
int3
xor ecx, ecx
inc ecx
call fcn.100750ee
pop ebp
mov al, bl
mov byte [0x100ebb58], 0
pop ebx
add esp, 0x14
ret

Function at 0x1004d7fb
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 0x80
push 3
or dword [esi], 0xffffffff
push edi
push 1
push closesocket
push dword [esp + 0x24]
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x1004d88d
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
je 0x1004d88d
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [esi + 8], ecx
test ecx, ecx
je 0x1004d88d
mov eax, 0x5a4d
mov dword [esi + 0xc], ecx
cmp word [ecx], ax
jne 0x1004d88d
add ecx, dword [ecx + 0x3c]
mov dword [esi + 0x10], ecx
cmp dword [ecx], 0x4550
jne 0x1004d88d
lea eax, [ecx + 0x18]
mov dword [esi + 0x14], eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x1004d9f8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, edx
mov ebx, ecx
test esi, esi
je 0x1004da81
mov al, byte [esi]
test al, al
je 0x1004da81
push edi
mov edi, esi
mov ecx, esi
cmp al, 0x2f
je 0x1004da1e
cmp al, 0x5c
jne 0x1004da20
mov edi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1004da16
cmp edi, esi
je 0x1004da54
sub edi, esi
lea eax, [ebp - 0x104]
push edi
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [ebp + edi - 0x104], 0
lea edx, [ebp - 0x104]
mov ecx, ebx
call fcn.1004d9f8
lea eax, [ebp - 0x208]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea eax, [ebp - 0x208]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100507aa
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, edx
mov esi, ebx
mov ebp, ecx
imul esi, dword [esp + 0x14]
cmp byte [edi], 0
je 0x100507e2
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ebp
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100507dc
mov byte [edi + 8], 1
mov eax, dword [esp + 0x14]
jmp 0x10050807
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x100507f2
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop edi
pop esi
xor edx, edx
pop ebp
div ebx
pop ebx
ret 8
Function at 0x10053115
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x10053120
xor eax, eax
jmp 0x100531fe
push esi
mov esi, dword [esp + 8]
not ecx
cmp esi, 8
jb 0x100531dd
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
sub edi, 1
jne 0x10053136
pop edi
test esi, esi
je 0x100531f9
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009ad68]
inc edx
sub esi, 1
jne 0x100531e1
not ecx
mov eax, ecx
pop esi
ret 4
Function at 0x10054309
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov esi, ecx
push str.bad_pack_level
push 7
pop ecx
lea eax, [ebx - 1]
cmp ecx, eax
mov ecx, esi
sbb dl, dl
inc dl
call fcn.10052293
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x1005434d
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
movzx eax, word [ebx*8 + 0x1009ad1a]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x1009ad18]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x1009ad1c]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x1009ad1e]
pop ebp
mov dword [esi + 0x6af94], eax
cmp ebx, ebp
jg 0x100543b1
mov eax, dword [esp + 0x14]
or word [eax], 4
jmp 0x100543bd
cmp ebx, 8
jl 0x100543bd
mov eax, dword [esp + 0x14]
or word [eax], bp
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push 0x10000
mov edx, ebx
mov dword [esi + 0x6af74], edi
mov ecx, esi
call dword [esi + 0xc]
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x10054422
cmp eax, 0xffffffff
je 0x10054422
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x100543fe
mov ecx, esi
call fcn.10053bf5
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, ebp
jb 0x10054406
jmp 0x10054432
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x100551d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x58]
test ecx, ecx
je 0x1005521e
mov eax, dword [edi + 0x60]
mov esi, dword [edi + 0x5c]
cmp eax, esi
jae 0x10055249
sub esi, eax
cmp esi, dword [ebp + 0xc]
jbe 0x100551f6
mov esi, dword [ebp + 0xc]
push esi
add eax, ecx
push eax
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi + 0x60], esi
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x4c]
add dword [edi + 0x48], esi
push esi
call fcn.10053115
mov dword [edi + 0x4c], eax
mov eax, esi
jmp 0x1005524b
cmp dword [edi + 0x50], 0
je 0x10055242
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10055249
mov esi, dword [ebp - 4]
jmp 0x10055208
mov dword [edi + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x100556d1
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x18]
test edi, edi
je 0x10055782
mov eax, dword [esi + 0x1c]
mov ebx, dword [esp + 0x1c]
add eax, ebx
mov ecx, dword [esi + 0x20]
cmp eax, ecx
jb 0x10055768
lea ebx, [ecx + ecx]
cmp ebx, eax
ja 0x100556fc
mov ebx, eax
xor edi, edi
push edi
push ebx
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
test ebp, ebp
jne 0x1005571c
mov eax, 0x300
jmp 0x100557b2
push ebx
push edi
push edi
push 0xf001f
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x1005573a
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10055712
push dword [esi + 0x20]
push dword [esi + 0x18]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esi + 0x18], edi
mov dword [esi + 4], ebp
mov ecx, dword [esi + 0x1c]
push ebx
push dword [esp + 0x1c]
add ecx, edi
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
add dword [esi + 0x1c], ebx
jmp 0x100557b2
mov eax, dword [esi]
test eax, eax
je 0x100557a9
xor edi, edi
lea ecx, [esp + 0x10]
push edi
push ecx
push dword [esp + 0x24]
mov dword [esp + 0x1c], edi
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
jmp 0x100557b2
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8