joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059150
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064c8d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1008200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10058ff0
cmp byte [ebp - 0x84], 0
jne 0x100592a1
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x100591e5
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100826f8
call fcn.10058ff0
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10058ff0
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10059254
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.100590a0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x100592e3
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100592d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100592d9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10059c06
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100593b9
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3ddb3311
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6a362ccd
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1002a737
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1007ccf2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100ab0b4
push 0x100ab0ac
push str.FlsAlloc
push 0x1e
call fcn.1007c9c2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1007cd26
push dword [ebp + 8]
mov ecx, esi
call dword [0x1009b1f4]
call esi
jmp 0x1007cd2c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1007cd70
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100ab0c4
push 0x100ab0bc
push str.FlsGetValue
push 0x20
call fcn.1007c9c2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1007cda7
push dword [ebp + 8]
mov ecx, esi
call dword [0x1009b1f4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10080242
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x100b9b90]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x1008028d
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.10080658
test al, al
jne 0x10080287
sub edx, 2
cmp edx, edi
jne 0x1008026d
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x100802af
lea eax, [edi + 2]
cmp edx, eax
je 0x100802af
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.1007ff09
add esp, 0x10
jmp 0x100803a9
push esi
lea ecx, [ebp - 0x255]
call fcn.10080658
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100802f2
push dword [ebp - 0x25c]
jmp 0x1008029f
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x1008032f
cmp word [ebp - 0x226], 0
je 0x10080350
cmp word [ebp - 0x226], ax
jne 0x1008032f
cmp word [ebp - 0x224], 0
je 0x10080350
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.1007ff09
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x1008039c
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x10080309
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x10080384
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100803a9
push 0x1007f959
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.10089fc0
add esp, 0x10
jmp 0x10080379
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002853b
leave
ret
Function at 0x10081d38
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10081dd5
push ebx
push esi
call fcn.10081cf4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10081be6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10081d82
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10081dd4
push edi
push eax
call fcn.1007f637
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10081da2
call fcn.1007bcc4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10081dd3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10081be6
add esp, 0x20
test eax, eax
jne 0x10081dc1
push edi
call fcn.1007bcc4
jmp 0x10081dc9
push ebx
call fcn.1007bcc4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10081dd8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10081de9
pop esi
ret
push ebx
push edi
push esi
call fcn.10081cf4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1007f637
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10081e11
push ebx
push esi
push edi
call fcn.10049e70
add esp, 0xc
push 0
call fcn.1007bcc4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100826f2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10082084
Function at 0x1008ee77
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100bcac8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1008eeb7
cmp byte [ebx], 0xa
jne 0x1008eeb7
or byte [eax + edi + 0x28], 4
jmp 0x1008eebc
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1008efba
mov al, byte [edx]
cmp al, 0x1a
je 0x1008ef9c
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1008eeeb
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1008ef10
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1008ef1a
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1008eecd
jmp 0x1008efba
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1008ef97
cmp dword [ebp - 0xc], 0
je 0x1008ef97
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x100bcac8]
test byte [eax + edi + 0x28], 0x48
je 0x1008ef71
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1008ef5c
mov byte [esi], dl
jmp 0x1008ef6d
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100bcac8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1008efba
cmp byte [ebp - 1], 0xa
jne 0x1008ef80
cmp esi, ebx
jne 0x1008ef80
mov byte [esi], 0xa
jmp 0x1008efb9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10089dec
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1008efba
mov byte [esi], 0xd
jmp 0x1008efb9
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x100bcac8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1008efb6
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1008efba
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1008efc3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x100bcac8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1008f006
cmp word [esi], dx
jne 0x1008f006
or byte [edi + eax + 0x28], 4
jmp 0x1008f00b
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1008f144
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1008f124
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1008f04d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1008f083
cmp eax, edx
jae 0x1008f08f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1008f025
jmp 0x1008f144
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1008f120
cmp dword [ebp - 0x14], 0
je 0x1008f120
mov eax, dword [ebx*4 + 0x100bcac8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1008f0f8
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x1008f13e
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x100bcac8]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x100bcac8]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x100bcac8]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x1008f141
pop ebx
cmp word [ebp - 4], bx
jne 0x1008f109
cmp esi, dword [ebp + 0xc]
jne 0x1008f109
mov word [esi], bx
jmp 0x1008f141
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10089dec
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1008f144
push 0xd
jmp 0x1008f13d
mov ecx, dword [ebx*4 + 0x100bcac8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1008f13b
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1008f144
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10092bb2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10092a86
Function at 0x10018090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001809f
pop dword [ebp - 0x2c]
mov eax, 0x1001809f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xb8aa54ef
add dword [ebp - 0x3c], 0x95a7f05c
mov dword [ebp - 0x38], 0xd279a8ac
sub dword [ebp - 0x38], 0xa0465c67
mov dword [ebp - 0x34], 0x7cf5ef5b
add dword [ebp - 0x34], 0xcf5654d3
mov dword [ebp - 0x30], 0x3d2c363f
sub dword [ebp - 0x30], 0x3d2c363f
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xa5b4653c
sub eax, 0x95b0d448
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x138313f5
add dword [ebp - 0x3c], 0x60ef5561
mov dword [ebp - 0x38], 0xc4d97ac4
sub dword [ebp - 0x38], 0x836d194f
mov dword [ebp - 0x34], 0xdad5e1f8
sub dword [ebp - 0x34], 0x7766758c
mov dword [ebp - 0x30], 0xc85145e8
add dword [ebp - 0x30], 0x37aeba18
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x2c2dc8d4
add eax, 0xe3d5c824
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e33a
push 0
call eax
mov ecx, 0x3b03
mov esi, eax
mov edi, 0x1d45e55a
add edi, 0xf2bf2ca6
add edi, dword [ebp - 0x2c]
mov edx, 0x78df5f0d
add edx, 0xbd1548f9
add dword [ebp - 4], 0xbe3c7447
mov ebx, dword [edi]
xor dword [ebp - 0x24], edx
add ebx, edx
xor dword [ebp - 0x24], ebx
mov dword [esi], ebx
xor dword [ebp - 0x24], 0xaabba634
add esi, 4
add edi, 0x93793bf8
sub edi, 0x93793bf4
loop 0x100181b6
add eax, 0xdedf
mov ebx, eax
add eax, 0x8a50daea
sub eax, 0x8a50dae5
mov ecx, 0xe04985c2
sub ecx, 0xd04985c2
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x10030836
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047018]
jne 0x10030840
repz ret
jmp fcn.10030e15
Function at 0x900058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009001a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90006a
add dl, dl
jne 0x900089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9000dc
xor eax, eax
add dl, dl
jne 0x900096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90017d
add dl, dl
jne 0x9000a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9000b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9000bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9000c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9000d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x900075
mov eax, 1
add dl, dl
jne 0x9000ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9000f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9000e1
sub eax, ebx
mov ebx, 1
jne 0x900128
mov ecx, 1
add dl, dl
jne 0x90010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x900119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x900105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x900075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x900136
cmp eax, 0x7d00
jae 0x90016d
cmp eax, 0x500
jb 0x900168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x900075
cmp eax, 0x7f
ja 0x900170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x900075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x900075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1005fd1f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x1005fd62
call fcn.10042578
mov dword [eax], 0xf
call fcn.1004258b
mov dword [eax], 0xd
call fcn.1004b9c3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015fd5
leave
ret
test eax, eax
jne 0x1005fd69
inc eax
jmp 0x1005fd56
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x1005fd54
xor eax, eax
cmp ecx, 1
setne al
jmp 0x1005fd56

Function at 0x438cb3
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ecx
and ebx, ebx
call fcn.00438ce9
dec edx
inc edx
dec ebx
xor dword [edi], ecx
inc ebx
inc ebx
push edx
mov ebx, dword [esp]
add esp, 4
inc edi
sub edx, 0xe00c4b42
add ebx, 0x82049e9c
or ebx, edx
cmp edi, eax
jne fcn.00438cb3
mov edx, 0x75476757
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401c66
pop dword [ebp - 0x48]
mov eax, 0x55db5234
sub eax, 0x559b35ce
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x195fdc92
sub dword [ebp - 0x58], 0xcb0d9747
mov dword [ebp - 0x54], 0x923c4cb8
sub dword [ebp - 0x54], 0x60090073
mov dword [ebp - 0x50], 0x4de784b5
sub dword [ebp - 0x50], 0x19b4087
mov dword [ebp - 0x4c], 0x461d9644
add dword [ebp - 0x4c], 0xb9e269bc
lea eax, [ebp - 0x58]
push eax
mov eax, 0x6bd7c789
sub eax, 0x6b979735
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x13f57b4a
add dword [ebp - 0x58], 0x607cee0c
mov dword [ebp - 0x54], 0x98517774
add dword [ebp - 0x54], 0xa91aea01
mov dword [ebp - 0x50], 0x71b2b863
add dword [ebp - 0x50], 0xf1bcb409
mov dword [ebp - 0x4c], 0xc023db6e
add dword [ebp - 0x4c], 0x3fdc2492
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x320ddcbf
sub eax, 0x31cdac93
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39c3a
push 0
call eax
mov ecx, 0x5e63b356
add ecx, 0xa19ca1cc
xor edi, edi
add edi, eax
mov ebx, 0xafe8b51a
add ebx, 0x5057bae6
add ebx, dword [ebp - 0x48]
mov edx, 0x18edf1e6
add edx, 0xd165d27
xor dword [ebp - 0x24], 0x7007f41c
mov esi, dword [ebx]
sub dword [ebp - 0x28], esi
add esi, edx
add dword [ebp - 0xc], edi
mov dword [edi], esi
mov dword [ebp - 0x1c], 0x52e97b3
add edi, 0x4d875bb0
add edi, 0xb278a454
add ebx, 0xf56e09e7
add ebx, 0xa91f61d
loop 0x401d8a
add eax, 0x71e7eea
add eax, 0xf8e2c871
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1001c877
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x100bb864]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
push edi
mov dword [ebp - 4], eax
mov edi, ecx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], esi
jne 0x1001c8ae
mov eax, 0x8876086c
jmp 0x1001c9d2
cmp dword [ebp + 0xc], esi
je 0x1001c955
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x1001c937
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push esi
push 0xfde9
call ebx
push eax
mov dword [ebp - 0xa4], eax
call fcn.1001cc0f
cmp eax, esi
pop ecx
mov dword [ebp - 0x9c], eax
jne 0x1001c90d
mov eax, 0x8007000e
jmp 0x1001c9d2
push esi
push esi
push dword [ebp - 0xa4]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa0]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov dword [ebp + 0xc], esi
mov ebx, eax
cmp dword [ebp + 0xc], esi
je 0x1001c955
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
jmp 0x1001c96c
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.kernel32.dll_CreateFileA]
push dword [ebp - 0x9c]
mov dword [edi], eax
call fcn.100762c9
mov eax, dword [edi]
cmp eax, 0xffffffff
pop ecx
je 0x1001c9c0
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x1001c9c0
push esi
push dword [edi]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x1001c9c0
cmp eax, esi
je 0x1001c9cd
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x1001c9d0
call dword [sym.imp.kernel32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x1001c9d2
mov dword [edi + 8], esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.100762d0
leave
ret 8

Function at 0x1001cc0f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1001cc1e
pop dword [ebp - 4]
mov eax, 0x67abc043
sub eax, 0x57a9f425
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x410e1
push 0
mov eax, 0xe614e87d
add eax, 0x29f2989f
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0xbb11c5d5
sub ecx, 0xbb1185f2
xor esi, esi
add esi, eax
mov edx, 0x10187200
add edx, dword [ebp - 4]
mov edi, 0xe6edb2a6
add edi, 0x447aabca
mov ebx, dword [edx]
xor ebx, edi
mov dword [esi], ebx
add esi, 0xaae7e63b
add esi, 0x551819c9
add edx, 0xec49039e
add edx, 0x13b6fc66
loop 0x1001cc79
add eax, 0xf25f
mov ebx, eax
add eax, 5
mov ecx, 0x4e8626e8
add ecx, 0xc179d918
add ecx, dword [ebp - 4]
call ebx
leave
ret