joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001de10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x63
lea eax, [ebp - 0x7f]
mov edi, edx
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], 0x67452301
mov dword [ebp - 0xcc], 0xefcdab89
mov dword [ebp - 0xc8], 0x98badcfe
mov dword [ebp - 0xc4], 0x10325476
mov byte [ebp - 0x80], bl
call fcn.1006b580
lea edx, [ebp - 0x80]
add esp, 0xc
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1001de80
lea eax, [ebp - 0x80]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001de90
lea ecx, [ebp - 0x80]
sub eax, edx
push ecx
lea ebx, [ebp - 0xd8]
call fcn.1001d460
lea edx, [ebp - 0x14]
push edx
mov ecx, ebx
call fcn.1001d510
add esp, 8
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
lea ebx, [eax + 4]
jmp 0x1001ded6
mov edi, dword [ebp - 0xdc]
movzx eax, byte [ebp + ebx - 0x14]
push eax
push str._02x
lea ecx, [ebp - 0xe0]
push 4
push ecx
call fcn.10067938
lea eax, [ebp - 0xe0]
add esp, 0x10
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001df00
sub eax, ecx
mov esi, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001df10
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp ebx, 0xc
jl 0x1001ded0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x1001f4d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.10066b1b
mov esp, ebp
pop ebp
ret

Function at 0x1001f5f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001f5ff
xor eax, eax
ret
shr eax, 4
not eax
and eax, 1
ret

Function at 0x1001f610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x1001f618
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001f627
xor eax, eax
ret
shr eax, 4
not eax
and eax, 1
ret

Function at 0x1001f630
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [0x100a5c90]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push edi
cmp esi, 0xffffffff
jne 0x1001f65e
xor al, al
pop edi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
push 1
lea edx, [esp + 0x14]
push edx
xor ecx, ecx
push ecx
xor eax, eax
push eax
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1001f64b
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001f6f5
cmp dword [esp + 0xc], 0x40
jne 0x1001f6f5
mov edx, 0x5a4d
cmp word [esp + 0x18], dx
jne 0x1001f6f5
mov eax, dword [esp + 0x54]
mov edi, eax
cmp eax, 0x2000
jae 0x1001f6f5
cmp eax, 0x40
jb 0x1001f6f5
push 1
push 0
add eax, 0xffffffc0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0x1001f6f5
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001f6f5
cmp dword [esp + 0xc], 4
jne 0x1001f6f5
cmp dword [esp + 0x18], 0x4550
jne 0x1001f6f5
mov bl, 1
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push 0
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esp + 0x5c]
pop edi
mov al, bl
pop ebx
xor ecx, esp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x1001fe80
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084286
mov eax, dword fs:[0]
push eax
mov eax, 0x104c
call fcn.100790e0
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffe
mov ebx, ecx
xor edi, edi
lea ecx, [ebp - 0x100e]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x1010], ax
call fcn.1006b580
add esp, 0xc
push edi
push 0x23
lea edx, [ebp - 0x1010]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x1010]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1001fef0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x1010]
mov esi, ebx
call fcn.10003a30
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001ff24
and eax, 0x10
jne 0x1001ff32
push edi
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
push 9
mov eax, str.piclesoft
lea esi, [ebp - 0x102c]
mov dword [ebp - 0x1018], 7
mov dword [ebp - 0x101c], edi
mov word [ebp - 0x102c], dx
call fcn.10003a30
push ebx
mov edx, esi
lea ecx, [ebp - 0x1048]
mov dword [ebp - 4], edi
call fcn.1001fca0
add esp, 4
mov edi, eax
mov esi, ebx
mov byte [ebp - 4], 1
call fcn.100037e0
mov esi, 8
cmp dword [ebp - 0x1034], esi
jb 0x1001ff9a
mov eax, dword [ebp - 0x1048]
push eax
call fcn.10066b10
add esp, 4
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x1034], 7
mov dword [ebp - 0x1038], edi
mov word [ebp - 0x1048], cx
cmp dword [ebp - 0x1018], esi
jb 0x1001ffcc
mov edx, dword [ebp - 0x102c]
push edx
call fcn.10066b10
add esp, 4
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1058], 0xc
mov dword [ebp - 0x1050], edi
test eax, eax
je 0x1001fffb
push edi
lea ecx, [ebp - 0x1054]
push ecx
push 1
push str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GRGWGX___AU__A_OICI_GA___BA_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
cmp dword [ebx + 0x14], esi
jb 0x10020004
mov eax, dword [ebx]
jmp 0x10020006
mov eax, ebx
lea edx, [ebp - 0x1058]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebx + 0x14], esi
jb 0x1002001b
mov ebx, dword [ebx]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10020033
and eax, 0x10
je 0x10020033
mov eax, 1
jmp 0x10020035
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x100206a0
Capabilities:
Get disk information
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2420
call fcn.100790e0
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x2410], edi
cmp edi, ebx
jne 0x100206dd
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100206ca
lea eax, [ebp - 0x2418]
push eax
push esi
mov dword [ebp - 0x2418], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x10020702
cmp dword [ebp - 0x2418], ebx
je 0x100206ca
push 0
push 1
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x241c], eax
test eax, eax
je 0x100208bd
push 1
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x2420], esi
test esi, esi
je 0x100208b0
push 0x800
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
je 0x100208a4
lea edx, [ebp - 0x40c]
push edx
xor ecx, ecx
push 0x1ff
mov word [ebp - 0x40c], cx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x100208a4
mov eax, dword [0x10094004]
mov cx, word [0x10094008]
lea ebx, [ebp - 0x40c]
mov dword [ebp - 0xc], eax
mov word [ebp - 8], cx
xor edi, edi
mov dword [ebp - 0x2414], ebx
mov dx, word [ebx]
push 0x800
lea eax, [ebp - 0x240c]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10020880
lea eax, [ebp - 0x240c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100207d0
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x800
jae 0x10020880
mov eax, dword [ebp - 0x2410]
push esi
lea edx, [ebp - 0x240c]
push edx
push eax
call fcn.10069f1f
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
inc edi
je 0x10020880
mov ecx, dword [ebp - 0x2410]
lea edx, [ecx + esi*2]
push edx
lea eax, [ebp - 0xc]
push eax
push str._s_s
mov ecx, 0x800
lea ebx, [ebp - 0x140c]
call fcn.1001f530
mov eax, ebx
add esp, 0xc
lea edx, [eax + 2]
jmp 0x10020840
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10020840
sub eax, edx
sar eax, 1
cmp eax, 0x7ffffffe
jbe 0x10020863
mov edx, dword [ebp - 0x2410]
xor ecx, ecx
mov word [edx], cx
jmp 0x10020876
mov ecx, dword [ebp - 0x2410]
push eax
lea eax, [ebp - 0x140c]
push eax
call fcn.1001f590
mov ebx, dword [ebp - 0x2414]
lea esp, [esp]
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x10020880
mov dword [ebp - 0x2414], ebx
test edi, edi
jne 0x1002089e
cmp word [ebx], di
jne 0x100207a0
mov esi, dword [ebp - 0x2420]
push esi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x241c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x100210f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.100790e0
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0xffe
push eax
lea ecx, [ebp - 0x1002]
push ecx
mov word [ebp - 0x1004], ax
call fcn.1006b580
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
push 0x7ff
lea ecx, [ebp - 0x1004]
push 0x800
push ecx
call fcn.10068323
add esp, 0x20
lea edx, [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret

Function at 0x10021b90
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [edi + 4]
push ebx
mov ebx, dword [eax + 4]
cmp byte [ebx + 0x15], 0
push esi
mov esi, ebx
jne 0x10021bce
mov ecx, dword [esi + 8]
push ecx
mov ecx, edi
call fcn.100523e0
mov esi, dword [esi]
push ebx
call fcn.10066b10
add esp, 4
cmp byte [esi + 0x15], 0
mov ebx, esi
je 0x10021bb0
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x10021c57
lea edx, [ebp - 0x20]
push edx
push esi
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10021c4b
cmp dword [ebp - 0x14], ebx
jne 0x10021c3c
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.1004ed90
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10021c28
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x10021c70
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0xc], 0
push ebx
push edi
lea edi, [esi + 8]
lea ebx, [esi + 4]
mov dword [edi], 0
mov dword [esi], 0
mov dword [ebx], 0
jne 0x10021d38
push str.ntdll.dll
mov dword [ebp - 0x124], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10021ce2
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10021ce2
push edi
push ebx
push esi
call eax
xor eax, eax
mov word [edi + 2], ax
mov eax, 1
jmp 0x10021ce8
mov eax, dword [ebp - 0x124]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x10021d38
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x114]
mov dword [esi + 0xc], eax
cmp dword [esi + 0xc], 0
mov eax, dword [ebp - 0x11c]
mov dword [esi], eax
mov dword [ebx], ecx
mov dword [edi], edx
je case.default.0x10021de8
mov eax, dword [esi]
add eax, 0xfffffffc
cmp eax, 6
ja case.default.0x10021de8
jmp dword [eax*4 + 0x10021e68]
mov ebx, dword [ebx]
cmp ebx, 0xa
je 0x10021d74
cmp ebx, 0x5a
jne case.default.0x10021de8
pop edi
mov dword [esi + 0x10], 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x10], 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx]
sub ebx, 0
je 0x10021dca
dec ebx
je 0x10021db3
dec ebx
jne case.default.0x10021de8
pop edi
mov dword [esi + 0x10], 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x10], 6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x10], 5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx]
cmp ebx, 4
ja case.default.0x10021de8
jmp dword [ebx*4 + 0x10021e84]
pop edi
mov dword [esi + 0x10], 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x10], 0xd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x10], 0xe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x10], 0xf
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
cmp dword [ebx], 0
jne case.default.0x10021de8
mov dword [esi + 0x10], 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x100251d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087a10
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100a5c90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
call fcn.10021f60
fstp qword [ebp - 0x28]
mov ecx, dword [ebp + 8]
add ecx, 0x38
mov dword [ebp - 0x20], ecx
call fcn.10023290
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, edi
jle 0x10025297
and eax, 0x80000007
jns 0x1002522e
dec eax
or eax, 0xfffffff8
inc eax
mov esi, 8
sub esi, eax
cmp esi, 8
jne 0x1002523c
xor esi, esi
add ebx, esi
push ebx
mov dword [ebp - 0x14], ebx
call fcn.1005f071
mov ecx, dword [ebp - 0x20]
mov edi, eax
add esp, 4
push edi
mov dword [ebp - 0x1c], edi
call fcn.10023430
test esi, esi
jle 0x1002526e
mov ecx, ebx
push esi
sub ecx, esi
add ecx, edi
push 0x20
push ecx
call fcn.1006b580
add esp, 0xc
mov eax, ebx
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
je 0x10025297
push 0
push 8
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
mov edx, edi
call fcn.10026ce0
add esp, 0xc
test al, al
je 0x100253b9
push 0x1e
call fcn.1005f071
mov ecx, dword [ebp - 0x24]
mov esi, eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov edx, 8
mov dword [esi + 0xe], eax
mov eax, dword [ebp + 0xc]
add esp, 4
mov dword [esi], 0x23535023
mov dword [esi + 8], ecx
mov word [esi + 0xc], dx
mov dword [esi + 0x12], ecx
mov dword [esi + 0x16], 1
mov dword [esi + 0x1a], ebx
cmp dword [eax + 0x14], edx
jb 0x100252d8
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10025324
test edi, edi
je 0x10025305
push edi
call fcn.10067956
add esp, 4
push esi
call fcn.10067956
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 0x18]
push eax
push 0x1e
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100253a1
cmp dword [ebp - 0x18], 0x1e
jne 0x100253a1
mov edx, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x18]
push ecx
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100253a1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jne 0x100253a1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10067956
add esp, 4
test edi, edi
je 0x10025379
push edi
call fcn.10067956
add esp, 4
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.10024a80
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10067956
add esp, 4
test edi, edi
je 0x1002530e
push edi
jmp 0x10025306
Function at 0x10026650
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, eax
mov esi, ecx
xor eax, eax
jmp 0x10026660
mov edx, eax
sar edx, 3
mov dl, byte [edx + esi]
mov cl, al
and cl, 7
sar dl, cl
inc eax
and dl, 1
mov byte [eax + 0x100ac9b7], dl
cmp eax, 0x40
jl 0x10026660
xor eax, eax
movsx ecx, byte [eax + 0x100918e0]
movzx edx, byte [ecx + 0x100ac9b7]
movsx ecx, byte [eax + 0x100918e1]
mov byte [eax + 0x100a8c88], dl
movzx edx, byte [ecx + 0x100ac9b7]
movsx ecx, byte [eax + 0x100918e2]
mov byte [eax + 0x100a8c89], dl
movzx edx, byte [ecx + 0x100ac9b7]
movsx ecx, byte [eax + 0x100918e3]
mov byte [eax + 0x100a8c8a], dl
movzx edx, byte [ecx + 0x100ac9b7]
mov byte [eax + 0x100a8c8b], dl
add eax, 4
cmp eax, 0x40
jl 0x10026680
push ebx
push 0x40
push 0x100a8c88
push 0x100ac9b8
call fcn.10073cd0
add esp, 0xc
cmp byte [ebp + 0xc], 0
jne 0x1002677a
mov ebx, edi
mov dword [ebp + 0xc], 0x10
mov ecx, 8
mov esi, 0x100ac9d8
mov edi, 0x100aca38
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov esi, 0x100ac9d8
call fcn.10026a70
xor eax, eax
nop
movzx ecx, byte [eax + 0x100ac9b8]
movzx edx, byte [eax + 0x100ac9b9]
xor byte [eax + 0x100ac9d8], cl
xor byte [eax + 0x100ac9d9], dl
movzx ecx, byte [eax + 0x100ac9ba]
movzx edx, byte [eax + 0x100ac9bb]
xor byte [eax + 0x100ac9da], cl
xor byte [eax + 0x100ac9db], dl
add eax, 4
cmp eax, 0x20
jl 0x10026720
mov ecx, 8
mov esi, 0x100aca38
mov edi, 0x100ac9b8
add ebx, 0x30
dec dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
jne 0x10026700
jmp 0x1002680b
mov dword [ebp + 0xc], 0xf
lea ebx, [edi + 0x2d0]
jmp 0x10026790
mov ecx, 8
mov esi, 0x100ac9b8
mov edi, 0x100aca38
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov esi, 0x100ac9b8
call fcn.10026a70
xor eax, eax
nop
movzx ecx, byte [eax + 0x100ac9d8]
movzx edx, byte [eax + 0x100ac9d9]
xor byte [eax + 0x100ac9b8], cl
xor byte [eax + 0x100ac9b9], dl
movzx ecx, byte [eax + 0x100ac9da]
movzx edx, byte [eax + 0x100ac9db]
xor byte [eax + 0x100ac9ba], cl
xor byte [eax + 0x100ac9bb], dl
add eax, 4
cmp eax, 0x20
jl 0x100267b0
mov eax, dword [ebp + 0xc]
dec eax
mov ecx, 8
mov esi, 0x100aca38
mov edi, 0x100ac9d8
sub ebx, 0x30
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0xc], eax
test eax, eax
jns 0x10026790
xor eax, eax
pop ebx
mov edi, edi
movsx ecx, byte [eax + 0x10091920]
movzx edx, byte [ecx + 0x100ac9b7]
movsx ecx, byte [eax + 0x10091921]
mov byte [eax + 0x100a8c88], dl
movzx edx, byte [ecx + 0x100ac9b7]
movsx ecx, byte [eax + 0x10091922]
mov byte [eax + 0x100a8c89], dl
movzx edx, byte [ecx + 0x100ac9b7]
movsx ecx, byte [eax + 0x10091923]
mov byte [eax + 0x100a8c8a], dl
movzx edx, byte [ecx + 0x100ac9b7]
mov byte [eax + 0x100a8c8b], dl
add eax, 4
cmp eax, 0x40
jl 0x10026810
push 0x40
push 0x100a8c88
push 0x100ac9b8
call fcn.10073cd0
mov esi, dword [ebp + 8]
add esp, 0xc
mov edi, 0x100ac9b8
call fcn.10026c70
pop edi
pop esi
pop ebp
ret
Function at 0x10026890
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
push edi
xor eax, eax
lea ebx, [ebx]
mov edx, eax
sar edx, 3
mov dl, byte [edx + esi]
mov cl, al
and cl, 7
sar dl, cl
inc eax
and dl, 1
mov byte [eax + 0x100ac977], dl
cmp eax, 0x40
jl 0x100268a0
xor eax, eax
movsx ecx, byte [eax + str.91__]
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x10091981]
mov byte [eax + 0x100a8c88], dl
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x10091982]
mov byte [eax + 0x100a8c89], dl
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x10091983]
mov byte [eax + 0x100a8c8a], dl
movzx edx, byte [ecx + 0x100ac977]
mov byte [eax + 0x100a8c8b], dl
add eax, 4
cmp eax, 0x38
jl 0x100268c0
push 0x38
push 0x100a8c88
push 0x100ac978
call fcn.10073cd0
mov ebx, dword [ebp + 8]
add esp, 0xc
xor edi, edi
movsx esi, byte [edi + 0x100919e8]
push esi
push 0x100ac978
push 0x100a8c88
call fcn.10073cd0
mov eax, 0x1c
sub eax, esi
push eax
lea ecx, [esi + 0x100ac978]
push ecx
push 0x100ac978
call fcn.10073cd0
push esi
mov edx, 0x100ac994
sub edx, esi
push 0x100a8c88
push edx
call fcn.10073cd0
movsx esi, byte [edi + 0x100919e8]
push esi
push 0x100ac994
push 0x100a8c88
call fcn.10073cd0
mov eax, 0x1c
sub eax, esi
push eax
lea ecx, [esi + 0x100ac994]
push ecx
push 0x100ac994
call fcn.10073cd0
push esi
mov edx, 0x100ac9b0
sub edx, esi
push 0x100a8c88
push edx
call fcn.10073cd0
add esp, 0x48
xor eax, eax
lea esp, [esp]
movsx ecx, byte [eax + 0x100919b8]
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x100919b9]
mov byte [eax + 0x100a8c88], dl
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x100919ba]
mov byte [eax + 0x100a8c89], dl
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x100919bb]
mov byte [eax + 0x100a8c8a], dl
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x100919bc]
mov byte [eax + 0x100a8c8b], dl
movzx edx, byte [ecx + 0x100ac977]
movsx ecx, byte [eax + 0x100919bd]
mov byte [eax + 0x100a8c8c], dl
movzx edx, byte [ecx + 0x100ac977]
mov byte [eax + 0x100a8c8d], dl
add eax, 6
cmp eax, 0x30
jl 0x100269c0
push 0x30
push 0x100a8c88
push ebx
call fcn.10073cd0
inc edi
add esp, 0xc
add ebx, 0x30
cmp edi, 0x10
jl 0x10026931
pop edi
pop esi
pop ebx
pop ebp
ret