joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100edf7
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
mov word [ebp - 0x10], ax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
push 0
push 0x7d8
stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0x7d4
push esi
call edi
push eax
call ebx
push 0xfffffffffffffff1
push 0x7d0
mov ecx, esi
call fcn.0100ecfd
push 0xfffffffffffffff1
push 0x7d1
mov ecx, esi
call fcn.0100ecfd
push 0xfffffffffffffff1
push 0x7d7
mov ecx, esi
call fcn.0100ecfd
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x1026614]
mov eax, dword [eax + 4]
mov eax, dword [eax]
movzx eax, word [eax + 8]
push 5
push eax
call fcn.010091b4
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.0100b821
mov eax, dword [0x1026614]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 0x14], ecx
mov ecx, esi
call fcn.0100e8be
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret

Function at 0x100efbd
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0x7d0
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x100f028
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100f026
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jne 0x100f042
lea eax, [ebp - 0xcc]
push eax
push edi
call fcn.010140b3
test eax, eax
jne 0x100f042
mov ecx, dword [0x1026614]
mov dword [ecx + 0x14], edi
mov edx, 0xc8
lea ecx, [ebp - 0xcc]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x100f04d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01010238
leave
ret

Function at 0x100f9d1
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x70
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x39
lea eax, [ebp - 0x78]
push eax
push 0xbb8
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x100fa2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100fa2b
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jne 0x100fa3e
lea eax, [ebp - 0x78]
push eax
mov eax, dword [0x1026614]
push dword [eax + 0x14]
call fcn.01014364
push 0x72
pop edx
lea ecx, [ebp - 0x78]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x100fa44
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01010238
leave
ret
Function at 0x1010229
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x101fbb0
call fcn.01010c04
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x10269f4
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100ffe0
cmp eax, esi
jne 0x100ffd3
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100ffe3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100ffba
xor esi, esi
inc esi
mov eax, dword [0x10269f0]
cmp eax, esi
jne 0x100fff6
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1010025
mov eax, dword [0x10269f0]
test eax, eax
jne 0x101001f
mov dword [0x10269f0], esi
push 0x10013cc
push 0x10013c0
call fcn.0100ff1f
pop ecx
pop ecx
test eax, eax
je 0x1010025
jmp 0x101014d
mov dword [0x102669c], esi
mov eax, dword [0x10269f0]
cmp eax, esi
jne 0x1010049
push 0x10013bc
push 0x10013b4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10269f0], 2
test ebx, ebx
jne 0x1010055
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1026a04], 0
je 0x1010079
push 0x1026a04
call fcn.01010b79
pop ecx
test eax, eax
je 0x1010079
push 0
push 2
push 0
call dword [0x1026a04]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10100d5
test al, al
je 0x1010093
cmp dword [ebp - 0x1c], 0
jne 0x10100d5
mov al, byte [esi]
test al, al
je 0x10100a3
cmp al, 0x20
ja 0x10100a3
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1010093
test byte [ebp - 0x3c], 1
je 0x10100af
movzx eax, word [ebp - 0x38]
jmp 0x10100b2
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1026698], eax
cmp dword [0x102668c], 0
jne 0x1010129
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10100e4
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10100f7
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1010080
cmp dword [0x102669c], 0
jne 0x1010138
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1026698]
jmp 0x1010159
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01010c49
ret
call fcn.01010d51
jmp 0x100ff80
Function at 0x1012075
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x10269cc], edi
jne 0x1012191
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x10120dc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x10269cc], edi
pop esi
je 0x1012164
dec eax
jne 0x1012191
cmp dword [ebp - 0x11c], 5
jne 0x1012151
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x1012145
dec eax
je 0x1012132
dec eax
je 0x1012118
mov dword [0x10269cc], 0x14
jmp 0x1012191
cmp word [ebp - 0xc], 1
jb 0x1012129
mov dword [0x10269cc], 0x10
or dword [0x10269cc], 4
jmp 0x1012191
cmp word [ebp - 0xc], 2
jb 0x1012129
mov dword [0x10269cc], 8
jmp 0x1012129
mov dword [0x10269cc], 4
jmp 0x1012191
cmp dword [ebp - 0x11c], 4
ja 0x10121a3
mov dword [0x10269cc], 2
cmp dword [ebp - 0x11c], 4
jne 0x1012191
cmp dword [ebp - 0x118], edi
je 0x1012187
cmp dword [ebp - 0x118], 0xa
je 0x1012187
cmp dword [ebp - 0x118], 0x5a
jne 0x1012191
mov dword [0x10269cc], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x10269cc]
xor ecx, ebp
pop edi
call fcn.01010238
leave
ret
mov dword [0x10269cc], 0x20
jmp 0x1012191

Function at 0x101233b
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
test esi, esi
je 0x1012390
cmp dword [ebp + 8], 0
je 0x1012390
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push dword [ebp + 8]
movzx ebx, ax
push esi
call fcn.010128a9
push edi
push dword [ebp + 8]
call fcn.010122c5
pop edi
test eax, eax
je 0x1012390
push ebx
push dword [ebp + 8]
call fcn.010122c5
test eax, eax
je 0x1012390
push dword [ebp + 8]
push esi
call fcn.0101293e
jmp 0x1012392
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10138ed
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov dword [ebp - 0x28], eax
xor eax, eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x2c], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
cmp esi, edx
je 0x1013a18
cmp ecx, edx
je 0x1013a18
cmp ebx, edx
je 0x1013a18
cmp dword [ebp - 0x28], edx
je 0x1013a18
mov edi, dword [esi + 0x20c]
mov eax, dword [ebp + 0x10]
mov edx, dword [esi + 0x208]
mov ecx, dword [ebp + 0xc]
cmp eax, edi
ja 0x101396a
jb 0x1013a18
cmp ecx, edx
jb 0x1013a18
cmp eax, dword [esi + 0x23c]
jb 0x1013984
ja 0x1013a18
cmp ecx, dword [esi + 0x238]
jae 0x1013a18
sub ecx, edx
sbb eax, edi
xor edi, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
cmp dword [esi + 0x21c], edi
jne 0x101399f
mov eax, 0xc0a20005
jmp 0x1013a1d
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
cmp dword [esi + 0x218], edi
jbe 0x1013a18
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x21c]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1013a2e
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0100abb0
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x1013a1d
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], eax
ja 0x1013a03
jb 0x10139f2
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x24]
ja 0x1013a03
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp eax, edx
jb 0x1013a44
ja 0x1013a03
cmp dword [ebp - 0x24], ecx
jb 0x1013a44
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
adc dword [ebp - 0x18], eax
inc edi
cmp edi, dword [esi + 0x218]
jb 0x10139ad
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1013a1d
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013a1d
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x20]
mov dword [eax], edi
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
sbb esi, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x24]
mov dword [ebx], eax
mov eax, dword [ebp - 0x28]
sbb edx, dword [ebp - 0x20]
mov dword [ebx + 4], esi
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x30]
jmp 0x1013a1d
Function at 0x1013d90
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
cmp edi, esi
je 0x1013e84
cmp ecx, esi
je 0x1013e84
cmp dword [ebp + 0x14], esi
jbe 0x1013e89
jmp 0x1013de5
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.010138ed
cmp eax, esi
jne 0x1013e89
mov ebx, dword [ebp - 0x1c]
cmp esi, dword [ebp - 0x18]
ja 0x1013e17
jb 0x1013e14
cmp dword [ebp + 0x14], ebx
ja 0x1013e17
mov ebx, dword [ebp + 0x14]
mov eax, dword [edi + 0x21c]
mov ecx, dword [ebp - 0xc]
mov edi, dword [eax + ecx*4]
push esi
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1013e6e
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1013e6e
cmp dword [ebp - 8], ebx
jne 0x1013e6e
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x14]
call fcn.01013794
cmp eax, esi
jne 0x1013e89
add dword [ebp - 0x20], ebx
cmp dword [ebp + 0x14], esi
ja 0x1013de2
jmp 0x1013e89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1013e89
and eax, 0xffff
or eax, 0x80070000
jmp 0x1013e89
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret 0x14
Function at 0x10152f5
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2ac], eax
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.msvcrt.dll_memset
or dword [ebp - 0x2a8], 0xffffffff
mov ebx, 0x90
push ebx
lea eax, [ebp - 0x2a4]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
cmp edi, esi
je 0x101546e
cmp dword [ebp - 0x2ac], esi
je 0x101546e
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x10153a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jg 0x101539b
mov edi, eax
jmp 0x1015488
and eax, 0xffff
or eax, 0x80070000
jmp 0x1015394
lea eax, [ebp - 0x214]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01014746
mov edi, eax
cmp edi, esi
jne 0x1015488
mov eax, dword [ebp - 0x214]
cmp eax, esi
jne 0x10153dd
mov edi, 0x80070057
jmp 0x1015488
lea eax, [ebp + eax*2 - 0x20e]
cmp word [eax], 0x5c
jne 0x10153ef
xor ecx, ecx
mov word [eax], cx
push esi
push esi
push 3
push esi
push 3
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2a8], eax
cmp eax, 0xffffffff
je 0x101538a
push esi
lea ecx, [ebp - 0x210]
push ecx
push ebx
lea ecx, [ebp - 0x2a4]
push ecx
push esi
push esi
push 0x70048
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1015458
cmp dword [ebp - 0x210], ebx
jne 0x1015458
push dword [ebp - 0x2ac]
push dword [ebp - 0x290]
push dword [ebp - 0x294]
call fcn.0100ab45
mov edi, eax
jmp 0x1015473
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1015454
and eax, 0xffff
or eax, 0x80070000
jmp 0x1015454
mov edi, 0x80070057
cmp dword [ebp - 0x2a8], 0xffffffff
je 0x1015488
push dword [ebp - 0x2a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret 8
Function at 0x1015540
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
test edi, edi
je 0x10155de
test ebx, ebx
je 0x10155de
test esi, esi
je 0x10155de
push 0
push ebx
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010150a6
mov edi, eax
test edi, edi
jne 0x10155e3
and dword [esi], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10155d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10155e3
test eax, eax
jle 0x10155d2
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10155e3
mov dword [esi], 1
jmp 0x10155e3
mov edi, 0x80070057
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret 0xc

Function at 0x10155fb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x218], 0xffffffff
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x210], esi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp edi, esi
je 0x10156f5
cmp ebx, esi
je 0x10156f5
push esi
push 0x1004944
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010150a6
mov dword [ebp - 0x214], eax
cmp eax, esi
jne 0x1015711
push esi
push esi
push 3
push esi
push 1
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10156ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jg 0x10156ae
mov dword [ebp - 0x214], eax
jmp 0x1015711
and eax, 0xffff
or eax, 0x80070000
jmp 0x10156a6
push esi
lea eax, [ebp - 0x210]
push eax
push 0x30
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10156d9
cmp dword [ebp - 0x210], 0x30
je 0x1015705
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10156ed
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x214], eax
jmp 0x1015705
mov edi, dword [ebp - 0x218]
mov dword [ebp - 0x214], 0x80070057
cmp edi, 0xffffffff
je 0x1015711
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret 8
Function at 0x101d161
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x40
pop ebx
push ebx
push 0
push esi
call sub.msvcrt.dll_memset
push dword [ebp + 0x10]
push edi
push esi
call sub.msvcrt.dll_memmove
add esp, 0x18
lea edi, [esi + 0x40]
push edi
call fcn.01022010
lea eax, [ebp - 0x44]
xor ecx, ecx
sub esi, eax
lea eax, [ebp + ecx - 0x44]
mov dl, byte [esi + eax]
xor dl, 0x36
inc ecx
cmp ecx, ebx
mov byte [eax], dl
jl 0x101d1a5
push ebx
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.01022b40
lea eax, [ebp - 0x44]
mov byte [eax], 0
inc eax
dec ebx
jne 0x101d1c4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret 0xc

Function at 0x101d1e1
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10260d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x24]
push eax
lea esi, [ebx + 0x40]
push esi
call fcn.01022c50
push esi
call fcn.01022010
mov edi, ebx
lea eax, [ebp - 0x64]
xor ecx, ecx
sub edi, eax
lea eax, [ebp + ecx - 0x64]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
cmp ecx, 0x40
mov byte [eax], dl
jl 0x101d21b
push 0x40
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.01022b40
push 0x20
pop edi
push edi
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.01022b40
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.01022c50
mov eax, dword [ebp + 0x10]
cmp eax, edi
jb 0x101d25a
mov eax, edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x68]
call sub.msvcrt.dll_memmove
add esp, 0xc
push 0x40
pop ecx
lea eax, [ebp - 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0x101d270
mov ecx, edi
lea eax, [ebp - 0x24]
mov byte [eax], 0
inc eax
dec ecx
jne 0x101d27c
mov eax, 0xa8
mov byte [ebx], 0
inc ebx
dec eax
jne 0x101d288
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010238
leave
ret 0xc
Function at 0x101d457
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 - 0x14]
push ebx
push esi
mov esi, dword [ecx + eax*4 - 0x10]
mov dword [ebp - 4], esi
mov esi, dword [ecx + eax*4 - 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ecx + eax*4 - 8]
lea eax, [ecx + eax*4]
push edi
mov edi, dword [eax - 4]
add eax, 0xffffffc0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 5
mov ebx, dword [ebp - 0x14]
cmp ecx, ebx
ja 0x101d576
sub ebx, ecx
shr ebx, 6
inc ebx
lea eax, [ecx + 8]
mov dword [ebp - 0xc], ebx
mov ebx, edx
mov edx, dword [ebp - 8]
rol ebx, 9
xor ebx, esi
add ebx, dword [eax - 8]
mov ecx, edi
xor ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ebx
add ecx, dword [eax - 4]
rol edx, 0xd
xor edx, ebx
add edx, dword [eax]
xor esi, ecx
add esi, dword [eax + 4]
mov dword [eax - 8], ebx
rol edi, 9
xor edi, edx
add edi, dword [eax + 8]
mov ebx, esi
xor ebx, dword [ebp - 0x18]
mov dword [eax], edx
add ebx, dword [eax + 0xc]
mov dword [eax - 4], ecx
xor edx, ebx
add edx, dword [eax + 0x14]
rol ecx, 0xd
xor ecx, edi
add ecx, dword [eax + 0x10]
mov dword [eax + 8], edi
xor edi, edx
add edi, dword [eax + 0x1c]
mov dword [eax + 4], esi
rol esi, 9
xor esi, ecx
add esi, dword [eax + 0x18]
mov dword [ebp - 4], ecx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov ecx, edi
xor ecx, dword [ebp - 4]
rol ebx, 0xd
add ecx, dword [eax + 0x24]
xor ebx, esi
add ebx, dword [eax + 0x20]
mov dword [eax + 0x14], edx
rol edx, 9
xor edx, ebx
add edx, dword [eax + 0x28]
mov dword [eax + 0x18], esi
xor esi, ecx
add esi, dword [eax + 0x2c]
mov dword [eax + 0x1c], edi
mov dword [ebp - 8], edx
rol edi, 0xd
xor edi, edx
add edi, dword [eax + 0x30]
mov edx, esi
xor edx, ebx
add edx, dword [eax + 0x34]
mov dword [eax + 0x20], ebx
mov ebx, dword [ebp - 8]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], edi
mov dword [eax + 0x34], edx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], esi
add eax, 0x40
dec dword [ebp - 0xc]
mov esi, edi
mov edi, dword [ebp - 0x18]
mov edx, ecx
mov dword [ebp - 4], ebx
jne 0x101d4a5
mov ecx, dword [ebp + 8]
dec dword [ebp - 0x10]
jne 0x101d48e
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101d6dc
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx + 8]
lea eax, [ecx + eax*4 - 0x40]
push edi
mov edi, dword [ecx + 0xc]
mov dword [ebp + 8], eax
mov dword [ebp - 8], 3
mov eax, ecx
cmp ecx, dword [ebp + 8]
ja 0x101d77c
mov edx, ebx
xor edx, esi
add dword [eax], edx
mov esi, dword [eax + 0x18]
mov edx, esi
rol edx, 0xa
xor edx, edi
add dword [eax + 4], edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebp - 4]
xor edi, edx
add dword [eax + 8], edi
lea edx, [eax + 0x20]
mov dword [ebp - 0xc], edx
mov edx, dword [edx]
mov edi, edx
rol edi, 0x19
xor edi, ebx
add dword [eax + 0xc], edi
mov edi, dword [eax + 0x24]
xor edi, esi
add dword [eax + 0x10], edi
mov esi, dword [eax + 0x28]
mov ebx, dword [eax + 0x34]
mov edi, esi
rol edi, 0xa
xor edi, dword [eax + 0x1c]
add dword [eax + 0x14], edi
mov edi, dword [eax + 0x2c]
xor edx, edi
add edx, dword [eax + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [eax + 0x30]
mov dword [ebp - 4], edx
rol edx, 0x19
xor edx, dword [eax + 0x24]
add edx, dword [eax + 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jbe 0x101d70e
mov edx, ebx
xor edx, esi
add dword [eax], edx
mov esi, dword [eax + 0x18]
mov edx, esi
rol edx, 0xa
xor edx, edi
add dword [eax + 4], edx
mov edx, dword [eax + 0x1c]
mov edi, dword [ebp - 4]
xor edi, edx
add dword [eax + 8], edi
mov edx, dword [ecx]
mov edi, edx
rol edi, 0x19
xor edi, ebx
add dword [eax + 0xc], edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0xc], edi
xor edi, esi
add dword [eax + 0x10], edi
mov esi, dword [ecx + 8]
mov edi, esi
rol edi, 0xa
xor edi, dword [eax + 0x1c]
add dword [eax + 0x14], edi
mov edi, dword [ecx + 0xc]
xor edx, edi
add edx, dword [eax + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0x10]
mov dword [ebp - 4], edx
rol edx, 0x19
xor edx, dword [ebp - 0xc]
add edx, dword [eax + 0x1c]
dec dword [ebp - 8]
mov dword [eax + 0x1c], edx
mov ebx, dword [ecx + 0x14]
jne 0x101d707
pop edi
pop esi
pop ebx
leave
ret 4