joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003aee3
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 4], ebx
jmp 0x1003aefb
xor ebx, ebx
test edi, edi
je 0x1003af8e
mov ecx, edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003af11
sub ecx, edx
mov edx, dword [esi + 0x270]
sar ecx, 1
add edx, ecx
lea ecx, [ebp - 0x10]
lea edx, [edx*2 + 4]
call fcn.10064c43
lea edx, [esi + 0x26c]
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x10]
call fcn.10064c03
push 0x5c
pop edx
lea ecx, [ebp - 0x10]
call fcn.10064d57
push 0x1000000
mov edx, edi
lea ecx, [ebp - 0x10]
call fcn.10064cec
lea edi, [esi + 0xc]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
lea ecx, [ebp - 0x10]
mov dword [esi + 8], eax
call fcn.10064c22
cmp dword [esi + 8], 0xffffffff
je 0x1003b006
mov dword [esi + 0x25c], edi
mov edi, ebx
jmp 0x1003afa3
lea eax, [esi + 0xc]
push eax
push dword [esi + 8]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x1003b04a
mov edx, dword [esi + 0x25c]
add edx, 0x2c
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x1003afb1
and dword [esi + 0x260], 0xffffffcf
sub ecx, ebx
push 0x2e
pop eax
sar ecx, 1
cmp word [edx], ax
jne 0x1003aff3
movzx eax, word [edx + 2]
mov ebx, eax
test ax, ax
je 0x1003aef9
push 0x2e
pop eax
cmp bx, ax
jne 0x1003aff3
xor ebx, ebx
cmp word [edx + 4], bx
je 0x1003aefb
push ecx
mov ecx, esi
call fcn.1003a82b
xor eax, eax
inc eax
mov dword [esi + 0x264], eax
jmp 0x1003b05f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1006a813
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov ecx, dword [esi]
mov edx, esi
add ecx, 0x48
push ecx
mov eax, dword [eax]
or ecx, 0xffffffff
dec dword [esi + 0x290]
mov dword [esi + 0x268], eax
call fcn.1003a662
mov ecx, esi
call fcn.1003acac
or dword [esi + 0x264], 0xffffffff
or eax, 0xffffffff
jmp 0x1003b05f
push dword [esi + 8]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
or dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 0x25c], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100449e1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
push edi
mov edi, edx
mov dword [ebp - 4], edi
cmp eax, 5
jae 0x10044a01
xor eax, eax
jmp 0x10044b5e
mov edx, dword [ecx + 0x4d14]
push ebx
mov ebx, dword [ecx + 0x4d10]
mov ecx, dword [ecx + 0x4d18]
mov dword [ebp - 8], ecx
lea ecx, [eax - 4]
push esi
xor esi, esi
add ecx, edi
mov dword [ebp - 0x14], ecx
add edi, esi
mov dword [ebp - 0x10], edi
cmp edi, ecx
jae 0x10044a3b
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x10044a38
inc edi
cmp edi, ecx
jb 0x10044a2b
mov dword [ebp - 0x10], edi
mov esi, edi
sub esi, dword [ebp - 4]
cmp edi, ecx
jae 0x10044b45
mov ecx, esi
sub ecx, ebx
cmp ecx, 3
jbe 0x10044a76
xor edx, edx
mov dword [ebp - 0xc], edx
mov al, byte [edi + 4]
mov ebx, esi
mov dword [ebp - 0x1c], ebx
test al, al
je 0x10044ab6
cmp al, 0xff
je 0x10044ab6
and edx, 3
xor eax, eax
add edx, edx
or edx, 1
inc eax
jmp 0x10044b3e
dec ecx
shl edx, cl
and edx, 7
mov dword [ebp - 0xc], edx
je 0x10044a56
cmp byte [edx + 0x10014d28], 0
je 0x10044aa0
movzx eax, byte [edx + 0x10014cf8]
mov ecx, edi
sub ecx, eax
mov al, byte [ecx + 4]
test al, al
je 0x10044aa0
cmp al, 0xff
jne 0x10044a56
and edx, 3
mov ebx, esi
add edx, edx
or edx, 1
inc esi
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
jmp 0x10044a22
movzx ebx, al
movzx eax, byte [edi + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
shl ebx, 8
or ebx, eax
sub ebx, dword [ebp - 8]
sub ebx, esi
test edx, edx
je 0x10044b19
movzx eax, byte [edx + 0x10014cf8]
shl eax, 3
push 0x18
pop edi
mov dword [ebp - 0x18], eax
sub edi, eax
mov edx, eax
mov eax, ebx
mov ecx, edi
shr eax, cl
test al, al
je 0x10044aff
cmp al, 0xff
jne 0x10044b13
xor eax, eax
push 0x20
pop ecx
sub ecx, edx
inc eax
shl eax, cl
dec eax
xor ebx, eax
sub ebx, dword [ebp - 8]
sub ebx, esi
jmp 0x10044af1
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov eax, ebx
mov byte [edi + 1], bl
shr eax, 0x18
and al, 1
neg al
mov byte [edi + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x1c]
shr eax, 8
push 5
mov byte [edi + 2], al
pop eax
add esi, eax
jmp 0x10044aab
mov ecx, dword [ebp - 0x20]
mov eax, esi
add dword [ecx + 0x4d18], esi
pop esi
mov dword [ecx + 0x4d10], ebx
mov dword [ecx + 0x4d14], edx
pop ebx
pop edi
leave
ret 4

Function at 0x10046a49
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
shr esi, 2
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x10046a70
mov ecx, ebx
call fcn.10029629
xor edi, eax
add ebx, 4
sub esi, 1
jne 0x10046a5f
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1004f69f
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1011a5f0], 0
jne 0x1004f714
xor edx, edx
mov dword [0x1011a5f0], 1
push esi
mov ecx, edx
push edi
push 8
movzx esi, cx
pop edi
mov eax, esi
shr si, 1
and eax, 1
imul eax, eax, 0xa001
xor ax, si
movzx esi, ax
sub edi, 1
jne 0x1004f6be
mov word [ecx*2 + 0x1011b638], si
inc ecx
cmp ecx, 0x100
jb 0x1004f6b8
mov esi, 0x1011b638
movzx ecx, word [esi + edx]
movzx eax, cl
shr cx, 8
xor cx, word [eax*2 + 0x1011b638]
mov word [edx + 0x1011b838], cx
add edx, 2
cmp edx, 0x200
jb 0x1004f6ed
pop edi
pop esi
ret

Function at 0x1004f71b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ebx
test esi, esi
je 0x1004f828
test bl, 1
je 0x1004f754
movzx eax, byte [ebx]
xor eax, ecx
shr cx, 8
movzx eax, al
xor cx, word [eax*2 + 0x1011b638]
inc ebx
movzx ecx, cx
dec esi
mov dword [ebp - 4], ebx
cmp esi, 8
jb 0x1004f807
push edi
mov edi, esi
shr edi, 3
movzx edx, word [ebx]
sub esi, 8
movzx eax, cx
movzx ecx, word [ebx + 2]
xor edx, eax
mov eax, edx
shr eax, 8
movzx ebx, word [eax*2 + 0x1011b638]
movzx eax, dl
movzx eax, word [eax*2 + 0x1011b838]
xor ebx, eax
mov eax, dword [ebp - 4]
xor ebx, ecx
movzx ecx, word [eax + 4]
lea edx, [eax + 6]
mov eax, ebx
shr eax, 8
movzx eax, word [eax*2 + 0x1011b638]
mov dword [ebp - 4], eax
movzx eax, bl
mov ebx, dword [ebp - 4]
movzx eax, word [eax*2 + 0x1011b838]
xor ebx, eax
lea eax, [edx + 2]
xor ebx, ecx
mov dword [ebp - 4], eax
movzx ecx, word [edx]
mov eax, ebx
shr eax, 8
movzx edx, word [eax*2 + 0x1011b638]
movzx eax, bl
mov ebx, dword [ebp - 4]
movzx eax, word [eax*2 + 0x1011b838]
xor edx, eax
xor edx, ecx
mov ecx, edx
movzx eax, dl
shr ecx, 8
mov cx, word [ecx*2 + 0x1011b638]
xor cx, word [eax*2 + 0x1011b838]
movzx ecx, cx
sub edi, 1
jne 0x1004f763
pop edi
test esi, esi
je 0x1004f828
movzx eax, byte [ebx]
xor eax, ecx
shr cx, 8
movzx eax, al
xor cx, word [eax*2 + 0x1011b638]
inc ebx
movzx ecx, cx
sub esi, 1
jne 0x1004f80b
pop esi
mov ax, cx
pop ebx
leave
ret 4
Function at 0x10057bd8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0xc], ebx
inc esi
mov edx, ecx
mov dword [ebp - 4], edx
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov al, bl
movlpd qword [ebp - 0x14], xmm0
mov ecx, esi
cmp edi, esi
jbe 0x10057c11
xor al, byte [ecx + edx]
inc ecx
cmp ecx, edi
jb 0x10057c07
jmp 0x10057c15
test edi, edi
je 0x10057c7a
cmp al, byte [edx]
jne 0x10057c7a
push 0x28
push esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_calloc]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10057c7a
mov edx, dword [ebp - 4]
xor ecx, ecx
push edi
call fcn.1008b8b6
xor ecx, ecx
xor edx, edx
or ecx, edi
or eax, ebx
mov dword [esi + 0x14], ecx
inc edx
lea ecx, [ebp - 0x28]
mov dword [esi + 0x10], eax
call fcn.10057d67
test eax, eax
je 0x10057c9c
lea ecx, [ebp - 0x28]
call fcn.10057d0b
inc eax
push eax
mov dword [esi + 4], eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_malloc]
mov dword [esi], eax
pop ecx
test eax, eax
jne 0x10057c81
mov ecx, esi
call fcn.10057cd4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [esi + 4], ebx
jbe 0x10057c9c
push 8
pop edx
lea ecx, [ebp - 0x28]
call fcn.10057d67
mov ecx, dword [esi]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, dword [esi + 4]
jb 0x10057c86
mov eax, esi
jmp 0x10057c7c

Function at 0x1005bb99
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push esi
mov edx, 0x10017744
push 8
sub edx, ecx
pop esi
mov al, byte [edx + ecx]
xor al, 0xa1
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x1005bba6
pop esi
ret
Function at 0x1005e9f1
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [ecx]
xorps xmm0, xmm0
mov dword [ebp - 0xc], edx
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 8], 1
push ebx
mov bl, al
push esi
push edi
cmp al, 0x2d
jne 0x1005ea1d
or dword [ebp - 8], 0xffffffff
mov bl, byte [ecx + 1]
mov edi, dword [ebp - 0x14]
lea esi, [ecx + 1]
cmp al, 0x2d
cmovne esi, ecx
mov ecx, dword [ebp - 0x10]
xor eax, eax
jmp 0x1005ea81
cmp bl, 0x39
ja 0x1005ea90
lea edx, [ebx - 0x30]
cmp ecx, 0xccccccc
jg 0x1005ea88
jl 0x1005ea49
cmp edi, 0xcccccccc
ja 0x1005ea88
cmp edi, 0xcccccccc
jne 0x1005ea5e
cmp ecx, 0xccccccc
jne 0x1005ea5e
cmp dl, 7
jg 0x1005ea88
push eax
push 0xa
pop eax
push eax
push ecx
push edi
call fcn.10113fc0
mov edi, eax
mov ecx, edx
movzx eax, bl
cdq
add edi, eax
push 0
adc ecx, edx
sub edi, 0x30
pop eax
sbb ecx, eax
inc esi
mov bl, byte [esi]
cmp bl, 0x30
jge 0x1005ea2f
jmp 0x1005ea90
or edi, 0xffffffff
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
push ecx
cdq
push edi
push edx
push eax
call fcn.10113fc0
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov dword [ecx + 4], edx
xor edx, edx
mov dword [ecx], eax
mov dword [edi], edx
cmp bl, 0x2e
jne 0x1005eadf
mov eax, 0x5f5e100
inc esi
mov bl, byte [esi]
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x1005eadf
movsx ecx, bl
sub ecx, 0x30
imul ecx, eax
push 0xa
add edx, ecx
mov dword [ebp - 0xc], edx
mov dword [edi], edx
xor edx, edx
pop ecx
div ecx
mov edx, dword [ebp - 0xc]
test eax, eax
jne 0x1005eab6
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1006a60b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
test ecx, ecx
jns 0x1006a626
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [eax], 9
or eax, 0xffffffff
jmp 0x1006a65a
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x1006a657
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 5
je 0x1006a615
mov ecx, eax
call fcn.1006a813
jmp 0x1006a621
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x1006b82e
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 3
mov esi, ecx
mov edi, edx
pop ecx
cmp ebx, ecx
jb 0x1006b8c0
mov eax, ebx
xor edx, edx
div ecx
mov dword [ebp - 4], eax
movzx edx, byte [edi]
mov ecx, esi
shr edx, 2
mov dl, byte [edx + 0x10020088]
call fcn.10064d2d
movzx edx, byte [edi]
mov ecx, esi
movzx eax, byte [edi + 1]
and edx, 3
shl edx, 4
shr eax, 4
or edx, eax
mov dl, byte [edx + 0x10020088]
call fcn.10064d2d
movzx edx, byte [edi + 1]
mov ecx, esi
movzx eax, byte [edi + 2]
and edx, 0xf
shl edx, 2
shr eax, 6
or edx, eax
mov dl, byte [edx + 0x10020088]
call fcn.10064d2d
movzx edx, byte [edi + 2]
mov ecx, esi
and edx, 0x3f
mov dl, byte [edx + 0x10020088]
call fcn.10064d2d
add edi, 3
sub ebx, 3
sub dword [ebp - 4], 1
jne 0x1006b84e
test ebx, ebx
je 0x1006b928
movzx edx, byte [edi]
mov ecx, esi
shr edx, 2
mov dl, byte [edx + 0x10020088]
call fcn.10064d2d
movzx eax, byte [edi]
mov ecx, esi
and eax, 3
shl eax, 4
cmp ebx, 1
jne 0x1006b8f6
mov dl, byte [eax + 0x10020088]
call fcn.10064d2d
mov dl, 0x3d
jmp 0x1006b918
movzx edx, byte [edi + 1]
shr edx, 4
or edx, eax
mov dl, byte [edx + 0x10020088]
call fcn.10064d2d
movzx edx, byte [edi + 1]
and edx, 0xf
mov dl, byte [edx*4 + 0x10020088]
mov ecx, esi
call fcn.10064d2d
mov dl, 0x3d
mov ecx, esi
call fcn.10064d2d
mov dl, 0xa
mov ecx, esi
call fcn.10064d2d
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1006f3be
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, ecx
mov word [ebp - 2], dx
xor ebx, ebx
mov dword [ebp - 8], eax
push eax
mov edi, ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1006f406
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7b
jne 0x1006f42a
mov ecx, dword [ebp - 8]
call fcn.10069d6e
mov edi, eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006f42a
mov eax, esi
and esi, 0xfffffffe
or eax, 1
test byte [ebp - 2], 0x80
cmove esi, eax
push esi
test edi, edi
je 0x1006f41d
push edi
jmp 0x1006f420
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
jne 0x1006f43a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1006a813
or ebx, 0xffffffff
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1006f622
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_CreateSymbolicLinkW]
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
xor ecx, ecx
mov dword [0x1011bacc], eax
mov dword [ebp - 4], ecx
push esi
push edi
cmp eax, ecx
je 0x1006f666
mov esi, ebx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, cx
jne 0x1006f649
sub esi, edx
sar esi, 1
jne 0x1006f66f
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [eax], 0x16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
lea eax, [esi*2 + 2]
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1006f666
movzx eax, word [ebx]
mov ecx, edi
push 0x5c
pop edx
test ax, ax
je 0x1006f6af
sub ebx, edi
cmp ax, 0x2f
jne 0x1006f69d
mov eax, edx
jmp 0x1006f6a0
movzx eax, ax
mov word [ecx], ax
add ecx, 2
movzx eax, word [ebx + ecx]
test ax, ax
jne 0x1006f693
xor eax, eax
cmp dword [ebp + 8], 1
mov word [ecx], ax
je 0x1006f6f7
cmp dword [ebp + 8], 2
je 0x1006f6ef
movzx eax, word [ecx - 2]
cmp ax, dx
je 0x1006f6ef
push 0x2e
pop ebx
cmp ax, bx
jne 0x1006f6f7
cmp esi, 1
je 0x1006f6ef
movzx eax, word [ecx - 4]
cmp ax, dx
je 0x1006f6ef
cmp ax, bx
jne 0x1006f6f7
cmp esi, 2
je 0x1006f6ef
cmp word [ecx - 6], dx
jne 0x1006f6f7
xor esi, esi
inc esi
mov dword [ebp - 4], esi
jmp 0x1006f6f9
xor esi, esi
mov ebx, dword [ebp - 8]
or esi, 2
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1006f71d
mov ecx, ebx
test al, 0x10
je 0x1006f718
call fcn.100705df
jmp 0x1006f71d
call fcn.1007059a
push esi
mov esi, dword [0x1011bacc]
mov ecx, esi
push edi
push ebx
call dword [0x1011c338]
call esi
movzx esi, al
test al, al
jne 0x1006f74f
push dword [ebp - 4]
mov esi, dword [0x1011bacc]
mov ecx, esi
push edi
push ebx
call dword [0x1011c338]
call esi
movzx esi, al
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
pop ecx
mov eax, esi
jmp 0x1006f668
Function at 0x10071e6d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10071eb9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7b
jne 0x10071ea7
mov ecx, edi
call fcn.10069d6e
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10071eb9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1006a813
push 0xffffffffffffffec
pop eax
jmp 0x10071ed9
mov eax, dword [ebp + 8]
not eax
and eax, esi
or eax, ebx
and eax, 0x31a7
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
neg eax
sbb eax, eax
and eax, 0x14
add eax, 0xffffffec
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1007ee50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ecx + 0xa4]
mov ebx, edx
xor edx, edx
mov dword [ebp - 0x20], edi
mov eax, dword [edi + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x68]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
cmp eax, edx
jg 0x1007ee8f
jl 0x1007ee88
cmp ecx, 0x40
jae 0x1007ee8f
mov eax, ecx
mov dword [ebp - 8], ecx
jmp 0x1007ee95
push 0x40
pop eax
mov dword [ebp - 8], eax
mov ecx, dword [edi + 0x154]
test ecx, ecx
jne 0x1007eea4
cmp dword [ebp + 8], eax
jae 0x1007eee4
cmp ecx, eax
jge 0x1007eede
push 0x40
pop esi
sub esi, ecx
lea eax, [edi + 0x114]
cmp esi, dword [ebp + 8]
cmova esi, dword [ebp + 8]
add eax, ecx
push esi
push ebx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add dword [edi + 0x154], esi
add esp, 0xc
mov eax, dword [ebp - 8]
cmp dword [edi + 0x154], eax
jl 0x1007f02c
xor edx, edx
lea ebx, [edi + 0x114]
and dword [edi + 0x110], 0xfffffffe
mov ecx, 0x10022640
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x1007f02c
mov eax, dword [ebx + 4]
cmp eax, dword [ecx + 4]
jne 0x1007f02c
movzx edi, byte [ebx + 0xb]
movzx eax, byte [ebx + 0xa]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 9]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 8]
shl edi, 8
or edi, eax
cmp edi, 0x18
jb 0x1007f02c
cmp byte [ebx + 0xc], 4
jne 0x1007f02c
mov cl, byte [ebx + 0xd]
mov byte [ebp - 1], cl
lea eax, [ecx - 7]
cmp al, 0x17
ja 0x1007f02c
movzx esi, cl
xor eax, eax
push 0
lea ecx, [edx + esi]
xor edx, edx
bts eax, ecx
cmp ecx, 0x20
cmovae edx, eax
xor eax, edx
cmp ecx, 0x40
pop ecx
cmovae edx, eax
add eax, edi
adc edx, ecx
sub eax, 1
sbb edx, ecx
mov ecx, esi
call fcn.10114370
cmp dword [ebp - 0x10], 0
mov edx, eax
mov dword [ebp - 0x18], edx
lea ecx, [edx*4 + 0x14]
mov dword [ebp - 0xc], ecx
jl 0x1007f02c
jg 0x1007ef9b
cmp dword [ebp - 0x14], ecx
jb 0x1007f02c
add dword [ebp - 8], ebx
lea esi, [ebx + 0x10]
test edx, edx
je 0x1007f012
mov ebx, dword [ebp - 0x18]
lea eax, [esi + 8]
cmp eax, dword [ebp - 8]
ja 0x1007f012
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi]
shl edx, 8
or edx, eax
cmp edx, ecx
jne 0x1007f02c
movzx ecx, byte [esi + 7]
add esi, 4
shl ecx, 8
movzx eax, byte [esi + 2]
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
cmp ecx, edx
jb 0x1007f02c
xor eax, eax
cmp eax, dword [ebp - 0x10]
jg 0x1007f02c
jl 0x1007f005
cmp ecx, dword [ebp - 0x14]
ja 0x1007f02c
sub ecx, edx
add dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
sub ebx, 1
jne 0x1007efa8
mov eax, dword [ebp - 0x1c]
mov cl, byte [ebp - 1]
mov dword [eax + 0x78], edi
mov byte [eax + 0x74], 4
mov byte [eax + 0x75], cl
mov eax, dword [ebp - 0x20]
and dword [eax + 0x110], 0xfffffffd
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100816d1
Capabilities:
Encode data using xor
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
test byte [esi + 0x90], 1
je 0x1008172c
test edi, edi
je 0x1008171f
mov edx, dword [esi + 0x94]
movzx eax, byte [ebx]
mov ecx, edx
shr ecx, 0x18
xor ecx, eax
shl edx, 8
xor edx, dword [ecx*4 + 0x100229a8]
inc ebx
mov dword [esi + 0x94], edx
sub edi, 1
jne 0x100816f9
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
add dword [esi + 0x98], edi
adc dword [esi + 0x9c], 0
test dword [esi + 0x90], 0x100
je 0x10081751
cmp dword [esi + 0xa0], 0
je 0x10081751
push 0
push edi
push ebx
push dword [esi + 0xa8]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test dword [esi + 0x90], 0x4000
je 0x10081776
cmp dword [esi + 0xac], 0
je 0x10081776
push 0
push edi
push ebx
push dword [esi + 0xb4]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test dword [esi + 0x90], 0x800000
je 0x1008179b
cmp dword [esi + 0xb8], 0
je 0x1008179b
push 0
push edi
push ebx
push dword [esi + 0xc0]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test dword [esi + 0x90], 0x1000000
je 0x100817c0
cmp dword [esi + 0xc4], 0
je 0x100817c0
push 0
push edi
push ebx
push dword [esi + 0xcc]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test dword [esi + 0x90], 0x2000000
je 0x100817e5
cmp dword [esi + 0xd0], 0
je 0x100817e5
push 0
push edi
push ebx
push dword [esi + 0xd8]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100817f2
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [esp + 0x14], ebx
lea esi, [edi + 0x90]
test byte [esi], 1
je 0x1008186f
mov eax, dword [edi + 0x98]
lea edx, [edi + 0x94]
or eax, dword [edi + 0x9c]
je 0x10081868
mov esi, dword [edx]
mov ebx, dword [edi + 0x9c]
mov edx, dword [edi + 0x98]
mov ecx, esi
movzx eax, dl
shr ecx, 0x18
xor ecx, eax
shl esi, 8
shrd edx, ebx, 8
shr ebx, 8
mov eax, edx
xor esi, dword [ecx*4 + 0x100229a8]
or eax, ebx
jne 0x10081835
mov ebx, dword [esp + 0x14]
lea edx, [edi + 0x94]
mov dword [edx], esi
lea esi, [edi + 0x90]
mov eax, dword [edx]
not eax
mov dword [ebx + 4], eax
test dword [esi], 0x100
je 0x10081889
lea eax, [edi + 0xa0]
push eax
push 0x10
lea ecx, [ebx + 8]
pop edx
call fcn.1002c5f8
test dword [esi], 0x4000
mov dword [esp + 0x10], esi
je 0x100818b1
lea eax, [edi + 0xac]
push eax
push 0x14
lea ecx, [ebx + 0x2c]
pop edx
call fcn.1002c5f8
lea eax, [edi + 0x90]
mov dword [esp + 0x10], eax
test dword [esi], 0x800000
mov dword [esp + 0x14], esi
je 0x100818d7
lea eax, [edi + 0xb8]
push eax
push 0x20
lea ecx, [ebx + 0x40]
pop edx
call fcn.1002c5f8
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
test dword [esi], 0x1000000
je 0x100818f1
lea eax, [edi + 0xc4]
push eax
push 0x30
lea ecx, [ebx + 0x60]
pop edx
call fcn.1002c5f8
mov esi, dword [esp + 0x14]
test dword [esi], 0x2000000
je 0x10081912
lea eax, [edi + 0xd0]
push eax
push 0x40
lea ecx, [ebx + 0x90]
pop edx
call fcn.1002c5f8
mov eax, dword [esi]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
mov esp, ebp
pop ebp
ret