joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101fd20
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 4
pop ebx
xor edi, edi
push ebx
push edi
push 0x10017f8
push 0x80000002
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x101fd74
mov esi, eax
jle 0x101fd68
and esi, 0xffff
or esi, 0x80070000
push 0x10017c8
push 0x10017ac
jmp 0x101fde4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
lea ecx, [ebp - 8]
push ecx
push edi
push ebx
push edi
push edi
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x101fdad
mov esi, eax
jle 0x101fda1
and esi, 0xffff
or esi, 0x80070000
push 0x1001770
push 0x1001754
jmp 0x101fde4
push edi
lea eax, [ebp - 4]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x1001734
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x101fdf2
mov esi, eax
jle 0x101fdda
and esi, 0xffff
or esi, 0x80070000
push 0x10016f0
push 0x10016d0
push eax
call fcn.010264b0
add esp, 0xc
jmp 0x101ff3d
push ebx
lea eax, [ebp + 0xc]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10016b0
push dword [ebp - 4]
call edi
test eax, eax
je 0x101fe2c
mov esi, eax
jle 0x101fe1d
and esi, 0xffff
or esi, 0x80070000
push 0x1001660
push 0x1001640
jmp 0x101ff32
push ebx
lea eax, [ebp + 0x10]
push eax
push ebx
push 0
push 0x1001624
push dword [ebp - 4]
call edi
test eax, eax
je 0x101fe61
mov esi, eax
jle 0x101fe52
and esi, 0xffff
or esi, 0x80070000
push 0x10015d8
push 0x10015bc
jmp 0x101ff32
push ebx
lea eax, [ebp + 0x14]
push eax
push ebx
push 0
push 0x10015a0
push dword [ebp - 4]
call edi
test eax, eax
je 0x101fe96
mov esi, eax
jle 0x101fe87
and esi, 0xffff
or esi, 0x80070000
push 0x1001564
push 0x1001548
jmp 0x101ff32
push ebx
lea eax, [ebp + 0x18]
push eax
push ebx
push 0
push 0x1001528
push dword [ebp - 4]
call edi
test eax, eax
je 0x101fec8
mov esi, eax
jle 0x101febc
and esi, 0xffff
or esi, 0x80070000
push 0x10014d8
push 0x10014b8
jmp 0x101ff32
cmp dword [ebp + 0x1c], esi
je 0x101fed4
mov dword [ebp - 0x10], 1
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x100149c
push dword [ebp - 4]
call edi
test eax, eax
je 0x101ff06
mov esi, eax
jle 0x101fefa
and esi, 0xffff
or esi, 0x80070000
push 0x1001450
push 0x1001434
jmp 0x101ff32
push 0x1001428
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x101ff3b
mov esi, eax
jle 0x101ff28
and esi, 0xffff
or esi, 0x80070000
push 0x10013ec
push 0x10013d0
push eax
call fcn.010264b0
add esp, 0xc
xor edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], edi
je 0x101ff50
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], edi
cmp dword [ebp - 8], edi
je 0x101ff5d
push dword [ebp - 8]
call ebx
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x101ff67
push dword [ebp - 0xc]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1020162
Capabilities:
Delete file

Disassembly:
push 0x2c
mov eax, 0x103a5dc
call fcn.0102af14
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
lea ebx, [esi + 2]
push ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0101fb6a
movzx eax, al
test eax, eax
jne 0x10201cd
push 0x1001934
push 0x1001928
push 0x8007000e
call fcn.010262cc
add esp, 0xc
push dword [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.0102afc8
ret 4
mov eax, dword [edi]
push esi
push eax
push ebx
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0101ff8c
test eax, eax
jge 0x10201f5
push 0x10018e0
push 0x10018d4
push eax
call fcn.010262cc
add esp, 0xc
push ebx
jmp 0x10201bb
lea eax, [ebx + esi*2]
xor ecx, ecx
mov word [eax + 2], cx
mov word [eax], cx
mov eax, 0x414
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, dword [edi]
push eax
push edi
push 0x10013c8
push 0x10018b0
push 0x4000000
call fcn.010265a2
add esp, 0x14
jmp 0x10201f2
Function at 0x1020528
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x10
mov eax, 0x103a604
call fcn.0102af14
xor edi, edi
push 0x103e7d8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call fcn.01022033
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, dword [ecx - 0xc]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.010203d2
cmp esi, 8
jb 0x1020588
push 8
push 0x1001a20
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1020588
push edi
lea ecx, [ebp - 0x14]
call fcn.01020284
add eax, 0x10
jmp 0x10205bb
cmp esi, 4
jb 0x10205b2
push 4
push 0x1001a14
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10205b2
push edi
lea ecx, [ebp - 0x14]
call fcn.01020284
add eax, 8
jmp 0x10205bb
push edi
lea ecx, [ebp - 0x14]
call fcn.01020284
mov ebx, dword [sym.imp.msvcrt.dll_wcschr]
push 0x5c
push eax
call ebx
pop ecx
pop ecx
cmp eax, edi
jne 0x10205fe
mov esi, dword [ebp - 0x14]
push esi
push 0x10019e8
mov eax, 0x800700a1
push 0x10019d8
push eax
mov dword [ebp - 0x18], eax
call fcn.010262cc
lea ecx, [esi - 0x10]
add esp, 0x10
call fcn.0101fb10
mov eax, dword [ebp - 0x18]
call fcn.0102afc8
ret 8
push dword [ebp - 0x14]
lea esi, [eax + 2]
movzx edi, word [esi]
xor eax, eax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1020630
test al, 0x10
jne 0x1020682
mov esi, dword [ebp - 0x14]
push esi
push 0x100199c
mov eax, 0x800700b7
push 0x100198c
jmp 0x10205df
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1020682
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x1020656
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x18], eax
test eax, eax
jl 0x1020664
mov dword [ebp - 0x18], 0x80004005
mov edi, dword [ebp - 0x14]
push edi
push 0x100199c
push 0x100197c
call esi
push eax
call fcn.010263be
lea ecx, [edi - 0x10]
jmp 0x10205eb
push 0x5c
push esi
mov word [esi], di
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x10205fe
mov eax, dword [ebp + 8]
push dword [eax]
push 0x10013c8
push 0x1001968
push 0x4000000
call fcn.010265a2
mov ecx, dword [ebp - 0x14]
add esp, 0x10
add ecx, 0xfffffff0
jmp 0x10205ee
Function at 0x1020ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x103a6b7
call fcn.0102af14
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 1
call fcn.0102006e
test byte [ebp + 0x18], 1
je 0x1020cdc
mov esi, 0x100
cmp dword [ebp + 0xc], ebx
je 0x1020d3a
lea eax, [ebp - 0x18]
push eax
or esi, 0x20019
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1020d40
jg 0x1020d04
mov dword [ebp - 0x14], eax
jmp 0x1020d15
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0xc]
push 0x1001ec0
push 0x1001ea0
push eax
call fcn.010264b0
add esp, 0x10
push ebx
mov byte [ebp - 4], bl
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x1020e5a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
cmp eax, ebx
je 0x1020d83
jg 0x1020d63
mov dword [ebp - 0x14], eax
jmp 0x1020d74
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x10]
push 0x1001e58
push 0x1001e3c
jmp 0x1020d22
cmp dword [ebp - 0x20], 1
je 0x1020da6
push 0x1001df8
mov eax, 0x8007000d
push 0x1001ddc
push eax
mov dword [ebp - 0x14], eax
call fcn.010262cc
add esp, 0xc
jmp 0x1020d2b
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
lea ecx, [ebp - 0x24]
call fcn.0101f935
mov esi, dword [ebp - 0x24]
cmp esi, ebx
jne 0x1020dcd
push 0x1001d60
mov eax, 0x8007000e
push 0x1001dc0
jmp 0x1020d98
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax], bl
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax - 1], bl
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call edi
cmp eax, ebx
je 0x1020e24
jg 0x1020df7
mov dword [ebp - 0x14], eax
jmp 0x1020e08
mov ecx, eax
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x14], ecx
push dword [ebp + 0x10]
push 0x1001e58
push 0x1001da4
push eax
call fcn.010264b0
add esp, 0x10
push esi
jmp 0x1020d2c
mov ecx, dword [ebp + 0x14]
push esi
call fcn.010206ee
jmp 0x1020e1e
cmp dword [ebp + 0xc], ebx
je 0x1020e6d
cmp dword [ebp - 0x18], ebx
je 0x1020e6d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
call fcn.0102afc8
ret 0x14
Function at 0x1021408
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x103a6f7
call fcn.0102af14
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1021471
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1021477
mov esi, eax
jle 0x1021456
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x1001ec0
push 0x10024d4
push eax
call fcn.010264b0
add esp, 0x10
jmp 0x1021510
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 4
pop edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10214b9
mov esi, eax
jle 0x10214aa
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x1001e58
push 0x10024b8
jmp 0x1021463
cmp dword [ebp - 0x1c], edi
je 0x1021508
push 0x1002470
mov esi, 0x8007000d
push 0x1002454
push esi
call fcn.010262cc
add esp, 0xc
jmp 0x1021510
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
cmp dword [ebp + 0xc], ebx
je 0x1021523
cmp dword [ebp - 0x14], ebx
je 0x1021523
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0102afc8
ret 0x10

Function at 0x1021532
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x103a717
call fcn.0102af14
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
je 0x1021592
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 2
push dword [ebp + 0x18]
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x1021598
mov esi, eax
jle 0x102157a
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x100257c
push 0x1002564
push eax
call fcn.010264b0
add esp, 0x10
jmp 0x10215fe
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x10215fe
mov esi, eax
jle 0x10215c1
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x1002520
push 0x1002508
jmp 0x1021587
cmp dword [ebp + 0xc], edi
je 0x1021611
cmp dword [ebp - 0x14], edi
je 0x1021611
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0102afc8
ret 0x14
Function at 0x1021620
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x103a737
call fcn.0102af14
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
je 0x102167e
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 2
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x1021684
mov esi, eax
jle 0x1021666
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x100257c
push 0x10025e8
push eax
call fcn.010264b0
add esp, 0x10
jmp 0x10216f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x10216f5
mov esi, eax
jle 0x10216b8
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x1002520
push 0x10025cc
jmp 0x1021673
cmp dword [ebp + 0xc], edi
je 0x1021708
cmp dword [ebp - 0x14], edi
je 0x1021708
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0102afc8
ret 0x10

Function at 0x1021717
Capabilities:
Delete registry value

Disassembly:
push 0xc
mov eax, 0x103a757
call fcn.0102af14
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
je 0x102176f
lea eax, [ebp - 0x14]
push eax
push 2
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1021775
mov esi, eax
jle 0x1021757
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0xc]
push 0x1002698
push 0x1002680
push eax
call fcn.010264b0
add esp, 0x10
jmp 0x10217d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x10217d0
mov esi, eax
jle 0x1021795
and esi, 0xffff
or esi, 0x80070000
push dword [ebp + 0x10]
push 0x1002638
push 0x100261c
jmp 0x1021764
cmp dword [ebp + 0xc], 0
je 0x10217e5
cmp dword [ebp - 0x14], 0
je 0x10217e5
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0102afc8
ret 0xc
Function at 0x1021e52
Capabilities:
Get file version info

Disassembly:
push 0x1c
mov eax, 0x103a7bf
call fcn.0102af14
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov byte [ebp - 4], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x1021ecc
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x1021ea1
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x1021eaf
mov dword [ebp - 0x14], 0x80004005
push dword [esi]
push 0x1002860
push 0x100284c
call edi
push eax
call fcn.010263be
add esp, 0x10
push ebx
jmp 0x1021fe4
push edi
lea ecx, [ebp - 0x18]
call fcn.0101f935
cmp dword [ebp - 0x18], ebx
jne 0x1021ef7
push 0x1001d60
mov eax, 0x8007000e
push 0x100283c
push eax
mov dword [ebp - 0x14], eax
call fcn.010262cc
add esp, 0xc
jmp 0x1021ec6
push dword [ebp - 0x18]
mov eax, dword [esi]
push edi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, ebx
jne 0x1021f48
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x1021f1e
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x1021f2c
mov dword [ebp - 0x14], 0x80004005
push dword [esi]
push 0x10027e0
push 0x10027d0
call edi
push eax
call fcn.010263be
add esp, 0x10
jmp 0x1021fe1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1001390
push dword [ebp - 0x18]
call sub.VERSION.dll_VerQueryValueW
cmp eax, ebx
jne 0x1021fc0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x1021f77
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x1021f85
mov dword [ebp - 0x14], 0x80004005
push dword [esi]
push 0x10027e0
push 0x10027c0
jmp 0x1021f38
mov eax, dword [ebp - 0x1c]
movzx edx, word [eax + 0xa]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
movzx edx, word [eax + 8]
mov dword [ecx + 4], edx
movzx edx, word [eax + 0xe]
mov dword [ecx + 8], edx
movzx eax, word [eax + 0xc]
mov dword [ecx + 0xc], eax
push dword [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp - 0x14]
call fcn.0102afc8
ret 8
Function at 0x10262cc
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x103ade2
call fcn.0102af14
and dword [ebp - 4], 0
push 0x10013c8
lea ecx, [ebp - 0x14]
call fcn.01026286
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0102070a
push dword [eax]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.01022e9f
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0101fb10
cmp dword [ebp + 0xc], 0
je 0x102632f
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push 0x1005224
push eax
call fcn.01026233
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.01025f61
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x1005218
push eax
call fcn.01026233
add esp, 0xc
push dword [ebp - 0x14]
push 0x2000000
call fcn.0102bbbc
pop ecx
pop ecx
push 0xa
lea ecx, [ebp - 0x14]
call fcn.01026169
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0101fb10
call fcn.0102afc8
ret

Function at 0x10263be
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x103ae1a
call fcn.0102af14
and dword [ebp - 4], 0
push 0x10013c8
lea ecx, [ebp - 0x14]
call fcn.01026286
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0102070a
push dword [eax]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.01022e9f
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0101fb10
cmp dword [ebp + 0xc], 0
je 0x1026421
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push 0x1005224
push eax
call fcn.01026233
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.01025f61
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x100523c
push eax
call fcn.01026233
add esp, 0xc
push dword [ebp - 0x14]
push 0x2000000
call fcn.0102bbbc
pop ecx
pop ecx
push 0xa
lea ecx, [ebp - 0x14]
call fcn.01026169
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0101fb10
call fcn.0102afc8
ret
Function at 0x10264b0
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x103ae52
call fcn.0102af14
and dword [ebp - 4], 0
push 0x10013c8
lea ecx, [ebp - 0x14]
call fcn.01026286
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0102070a
push dword [eax]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.01022e9f
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0101fb10
cmp dword [ebp + 0xc], 0
je 0x1026513
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push 0x1005224
push eax
call fcn.01026233
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.01025f61
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x1005258
push eax
call fcn.01026233
add esp, 0xc
push dword [ebp - 0x14]
push 0x2000000
call fcn.0102bbbc
pop ecx
pop ecx
push 0xa
lea ecx, [ebp - 0x14]
call fcn.01026169
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0101fb10
call fcn.0102afc8
ret

Function at 0x10265a2
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x103ae82
call fcn.0102af14
and dword [ebp - 4], 0
push 0x103e7d8
lea ecx, [ebp - 0x14]
call fcn.01022033
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.01026286
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.01025f61
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.0102bbbc
pop ecx
pop ecx
push 0xa
lea ecx, [ebp - 0x14]
call fcn.01026169
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0101fb10
lea ecx, [esi - 0x10]
call fcn.0101fb10
call fcn.0102afc8
ret

Function at 0x1026649
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x103aeba
call fcn.0102af14
and dword [ebp - 4], 0
push 0x103e7d8
lea ecx, [ebp - 0x14]
call fcn.01022033
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0102070a
push dword [eax]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.01022e9f
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0101fb10
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.01025f61
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.0102bbbc
pop ecx
pop ecx
push 0xa
lea ecx, [ebp - 0x14]
call fcn.01026169
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0101fb10
lea ecx, [esi - 0x10]
call fcn.0101fb10
call fcn.0102afc8
ret
Function at 0x1026b5b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
je 0x1026b91
mov ecx, dword [ebp + 0xc]
push esi
movzx esi, byte [ecx]
dec dword [ebp + 0x10]
mov edx, eax
and edx, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x103e020]
inc ecx
cmp dword [ebp + 0x10], 0
jne 0x1026b6f
pop esi
not eax
pop ebp
ret 0xc