joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051f80
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push esi
push edi
mov edi, ecx
xor edx, edx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x1c]
mov eax, dword [esi]
lea esi, [esi + 4]
bswap eax
mov dword [ebp + edx*4 - 0x154], eax
inc edx
cmp edx, 0x10
jb 0x10051f95
lea eax, [ebp - 0x14c]
mov edx, 0x40
mov ecx, dword [eax + 0x2c]
lea eax, [eax + 4]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax - 0xc]
xor ecx, dword [eax - 4]
ror ecx, 0x1f
mov dword [eax + 0x34], ecx
sub edx, 1
jne 0x10051fb4
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi + 8]
mov esi, eax
mov dword [ebp - 0x14], eax
push ebx
mov eax, dword [ecx + 0x14]
mov ebx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x18]
mov edi, dword [edi + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
nop
mov ecx, ebx
mov edx, esi
not ecx
ror esi, 0x1b
and ecx, eax
mov eax, edi
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 0xc]
add esi, ecx
add eax, 0x5a827999
mov ecx, dword [ebp - 8]
add esi, dword [ebp + ecx*4 - 0x154]
inc ecx
add esi, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 4], eax
shr ebx, 2
shl edi, 0x1e
or edi, ebx
mov ebx, edx
cmp ecx, 0x14
jb 0x10051ff0
mov edx, 0x14
lea esp, [esp]
xor eax, edi
mov ecx, esi
xor eax, ebx
ror esi, 0x1b
add esi, eax
mov eax, dword [ebp - 0xc]
add esi, dword [ebp + edx*4 - 0x154]
add eax, 0x6ed9eba1
add esi, eax
inc edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 4], eax
shr ebx, 2
shl edi, 0x1e
or edi, ebx
mov ebx, ecx
cmp edx, 0x28
jb 0x10052040
mov dword [ebp - 8], 0x28
mov ecx, edi
mov edx, esi
xor ecx, ebx
ror esi, 0x1b
add esi, dword [ebp - 0xc]
and ecx, eax
mov eax, edi
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 8]
add ecx, 0x8f1bbcdc
add ecx, dword [ebp + eax*4 - 0x154]
mov eax, dword [ebp - 4]
add esi, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
inc ecx
mov eax, edi
mov dword [ebp - 8], ecx
mov edi, ebx
mov dword [ebp - 4], eax
shr ebx, 2
shl edi, 0x1e
or edi, ebx
mov ebx, edx
cmp ecx, 0x3c
jb 0x10052080
mov edx, dword [ebp - 0xc]
mov ecx, 0x3c
xor eax, edi
mov dword [ebp - 8], esi
xor eax, ebx
ror esi, 0x1b
add eax, 0xca62c1d6
add esi, edx
add eax, dword [ebp + ecx*4 - 0x154]
inc ecx
mov edx, dword [ebp - 4]
add esi, eax
mov eax, edi
mov edi, ebx
shr ebx, 2
shl edi, 0x1e
or edi, ebx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
cmp ecx, 0x50
jb 0x100520d1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, esi
pop ebx
add dword [ecx + 0x10], edi
mov dword [ecx + 8], eax
mov eax, dword [ebp - 8]
add dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
add dword [ecx + 0x14], eax
add dword [ecx + 0x18], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10052460
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
mov esi, ecx
mov dword [ebp - 0x58], 0
mov eax, edx
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, eax
mov dword [ebp - 0x54], 0x67452301
mov dword [ebp - 0x50], 0xefcdab89
mov dword [ebp - 0x4c], 0x98badcfe
mov dword [ebp - 0x48], 0x10325476
mov dword [ebp - 0x44], 0xc3d2e1f0
call fcn.10052130
add esp, 4
lea edx, [ebp - 0x5c]
mov ecx, esi
call fcn.10052350
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10052750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x14], edx
mov edx, ecx
mov ecx, dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 0x10], edx
mov edi, dword [edi + 0x1fbec]
add edi, 0x110
mov eax, dword [ecx]
mov dword [ecx], esi
test al, 0xf
jne 0x10052860
sar eax, 4
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test eax, eax
jle 0x1005280d
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
add eax, 0x1f7ac
mov dword [ebp - 0xc], eax
push eax
lea edx, [ebp - 0x24]
mov ecx, ebx
call fcn.10056ed0
mov eax, dword [edi]
add esp, 4
xor dword [ebp - 0x24], eax
mov eax, dword [edi + 4]
xor dword [ebp - 0x20], eax
mov eax, dword [edi + 8]
xor dword [ebp - 0x1c], eax
mov eax, dword [edi + 0xc]
xor dword [ebp - 0x18], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0xc], eax
add ebx, 0x10
add dword [edx], 0x10
mov ecx, dword [edx]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
sub esi, 1
jne 0x100527a0
mov edx, dword [ebp - 0x10]
xor esi, esi
cmp dword [ebp - 0x14], 0
je 0x10052865
lea eax, [ecx - 1]
add eax, edx
mov bl, byte [eax]
lea ecx, [ebx - 1]
cmp cl, 0xf
ja 0x10052859
movzx edx, bl
mov ecx, 1
sub ecx, edx
add eax, ecx
xor ecx, ecx
test bl, bl
je 0x1005284d
test esi, esi
jne 0x10052865
cmp byte [eax], bl
je 0x10052843
mov esi, 4
jmp 0x10052845
inc eax
inc ecx
cmp ecx, edx
jl 0x10052834
test esi, esi
jne 0x10052865
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
sub eax, edx
mov dword [ecx], eax
jmp 0x10052865
mov esi, 4
jmp 0x10052865
mov esi, 3
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi]
mov edx, dword [eax + 0x1fbec]
mov eax, esi
mov dword [edx + 0x110], ecx
mov ecx, dword [edi + 4]
mov dword [edx + 0x114], ecx
mov ecx, dword [edi + 8]
mov dword [edx + 0x118], ecx
mov ecx, dword [edi + 0xc]
pop edi
pop esi
mov dword [edx + 0x11c], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005ae20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x100c7330], 0
je 0x1005ae7a
push dword [0x100c7600]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1005ae73
push esi
push 0x14d70
call fcn.1008680d
mov esi, eax
add esp, 4
test esi, esi
je 0x1005ae6f
push esi
push dword [0x100c7600]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1005ae66
mov ecx, esi
pop esi
jmp fcn.1005abe0
push esi
call fcn.10086818
add esp, 4
xor eax, eax
pop esi
ret
mov ecx, eax
jmp fcn.1005abe0
xor eax, eax
ret

Function at 0x1005ae80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x100c7330], 0
je 0x1005af1a
push esi
push dword [0x100c7600]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1005af16
push 0x14d70
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1005af0f
mov ecx, esi
call fcn.100655d0
mov eax, dword [esi + 0x146c4]
test eax, eax
je 0x1005aed4
push eax
call fcn.10086818
add esp, 4
mov dword [esi + 0x146c4], 0
mov ecx, esi
call fcn.1005c190
push 0x210
lea eax, [esi + 0x146c8]
push 0
push eax
call fcn.1007cff0
add esp, 0xc
mov ecx, esi
call fcn.1005c070
push 0
push dword [0x100c7600]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call fcn.10086818
add esp, 4
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
xor eax, eax
ret
Function at 0x1005bc60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [0x100c7600]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1005bd49
push ebx
mov ebx, dword [esi + 0x641c]
test ebx, ebx
je 0x1005bd48
mov ecx, dword [ebp + 8]
or ecx, dword [ebp + 0xc]
jne 0x1005bc98
xor eax, eax
jmp 0x1005bcbe
push 0
push 0x64
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1009d620
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push eax
call fcn.1009d8a0
cmp eax, 0x64
jle 0x1005bcbe
mov eax, 0x64
cmp dword [esi + 0xa8], 0
mov ecx, dword [esi + 0x6420]
push ecx
push eax
mov dword [esi + 0x6418], eax
push edi
je 0x1005bce8
call ebx
test eax, eax
je 0x1005bcea
mov dword [esi + 0xa4], 1
jmp 0x1005bcea
call ebx
lea eax, [esi + 0x4418]
mov edx, 0x800
sub edi, eax
jmp 0x1005bd00
lea ecx, [edx + 0x7ffff7fe]
test ecx, ecx
je 0x1005bd38
movzx ecx, word [edi + eax]
test cx, cx
je 0x1005bd31
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1005bd00
sub eax, 2
xor ecx, ecx
pop ebx
pop edi
mov word [eax], cx
mov ecx, esi
pop esi
pop ebp
jmp fcn.1005beb0
test edx, edx
jne 0x1005bd38
sub eax, 2
xor ecx, ecx
pop ebx
mov word [eax], cx
mov ecx, esi
pop edi
pop esi
pop ebp
jmp fcn.1005beb0
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1005bd50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x100c7600]
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x1005be1c
mov ecx, dword [ebx + 0x6428]
test ecx, ecx
je 0x1005be1c
test edi, edi
jne 0x1005bd87
xor eax, eax
jmp 0x1005bdba
cmp edi, 0x186a0
jle 0x1005bda9
mov eax, 0x51eb851f
mul edi
mov eax, dword [ebp + 8]
mov ecx, edx
cdq
shr ecx, 5
idiv ecx
mov ecx, dword [ebx + 0x6428]
jmp 0x1005bdb0
imul eax, dword [ebp + 8], 0x64
cdq
idiv edi
cmp eax, 0x64
jle 0x1005bdba
mov eax, 0x64
push dword [ebx + 0x642c]
mov dword [ebx + 0x6424], eax
push eax
push esi
call ecx
lea ecx, [ebx + 0x5418]
mov edi, eax
mov edx, 0x800
sub esi, ecx
lea esp, [esp]
lea eax, [edx + 0x7ffff7fe]
test eax, eax
je 0x1005be07
movzx eax, word [esi + ecx]
test ax, ax
je 0x1005be00
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1005bde0
jmp 0x1005be04
test edx, edx
jne 0x1005be07
sub ecx, 2
xor eax, eax
mov word [ecx], ax
mov ecx, ebx
call fcn.1005beb0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005c7c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, edx
mov edx, dword [ebp + 0xc]
push esi
push edi
test ecx, ecx
jl 0x1005c882
jg 0x1005c7e4
cmp edx, 0xffffffff
jbe 0x1005c882
xor esi, esi
xor eax, eax
mov dword [ebp - 8], eax
cmp eax, ecx
jg 0x1005c8c6
jl 0x1005c7fd
cmp esi, edx
jae 0x1005c8c6
mov eax, dword [ebp + 0x10]
mov ecx, edx
sub ecx, esi
mov edi, 0x8000
sbb eax, dword [ebp - 8]
test eax, eax
jg 0x1005c81a
jl 0x1005c816
cmp ecx, edi
jae 0x1005c81a
mov edi, edx
sub edi, esi
mov edx, dword [ebp + 8]
mov eax, esi
add edx, eax
test ebx, ebx
je 0x1005c8d2
mov eax, dword [ebx + 4]
test eax, eax
je 0x1005c8d2
cmp eax, 0xffffffff
je 0x1005c8d2
mov ecx, dword [ebx]
test ecx, ecx
je 0x1005c855
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push edi
push edx
push eax
call fcn.100373e0
jmp 0x1005c864
push 0
lea ecx, [ebp - 4]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005c8da
mov eax, dword [ebp - 4]
cmp eax, edi
jne 0x1005c8da
mov edx, dword [ebp + 0xc]
add esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
adc eax, 0
jmp 0x1005c7e8
test ebx, ebx
je 0x1005c8d2
mov eax, dword [ebx + 4]
test eax, eax
je 0x1005c8d2
cmp eax, 0xffffffff
je 0x1005c8d2
mov ecx, dword [ebx]
test ecx, ecx
je 0x1005c8a9
push ecx
lea esi, [ebp - 4]
push esi
push edx
push dword [ebp + 8]
push eax
call fcn.100373e0
jmp 0x1005c8ba
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005c8da
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
jne 0x1005c8da
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10064bf0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
lea eax, [esp + 4]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push eax
push dword [ebp + 0xc]
push esi
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10064cb3
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], edi
test edi, edi
je 0x10064cc3
test esi, esi
jne 0x10064c37
or eax, 0xffffffff
jmp 0x10064c61
mov eax, dword [ebx + 0x126a4]
not eax
nop
movsx edx, byte [esi]
lea esi, [esi + 1]
movzx ecx, al
xor edx, ecx
shr eax, 8
movzx ecx, dl
xor eax, dword [ecx*4 + 0x100b0990]
sub edi, 1
jne 0x10064c40
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0
mov dword [ebx + 0x126a4], eax
mov eax, edi
add eax, dword [ebx + 0x38]
mov dword [ebx + 0x38], eax
adc ecx, dword [ebx + 0x3c]
cmp dword [ebx + 0x126a0], 0
mov dword [ebx + 0x3c], ecx
jne 0x10064c8d
mov edx, dword [ebx + 0x40]
mov esi, dword [ebx + 0x44]
jmp 0x10064c98
xor esi, esi
xor eax, eax
mov edx, 0x64
xor ecx, ecx
push ecx
push eax
push esi
push edx
lea ecx, [ebx + 0x116a0]
call fcn.1005bc60
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10064cc3
mov dword [ebx], 0xb
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10064cd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
cmp dword [eax + 0x10bc], esi
je 0x10064cfd
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10064df0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0x10d0]
add edx, dword [eax + 0x10d8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10064de5
mov edi, dword [ebp + 8]
jmp 0x10064d20
mov ecx, dword [eax + 0x10dc]
cmp ecx, dword [eax + 0x10cc]
jg 0x10064d57
jl 0x10064d3e
mov ecx, dword [eax + 0x10d8]
cmp ecx, dword [eax + 0x10c8]
jae 0x10064d57
mov cl, byte [edx]
inc edx
mov byte [esi + edi], cl
inc esi
add dword [eax + 0x10d8], 1
adc dword [eax + 0x10dc], 0
cmp esi, ebx
jb 0x10064d20
test esi, esi
je 0x10064de5
test edi, edi
jne 0x10064d68
or ebx, 0xffffffff
jmp 0x10064d92
mov ebx, dword [eax + 0x126a4]
mov eax, esi
not ebx
movsx edx, byte [edi]
lea edi, [edi + 1]
movzx ecx, bl
xor edx, ecx
shr ebx, 8
movzx ecx, dl
xor ebx, dword [ecx*4 + 0x100b0990]
sub eax, 1
jne 0x10064d72
mov eax, dword [ebp + 0x10]
mov edi, esi
lea ecx, [eax + 0x116a0]
add edi, dword [eax + 0x38]
mov edx, 0
not ebx
mov dword [eax + 0x38], edi
adc edx, dword [eax + 0x3c]
cmp dword [eax + 0x126a0], 0
mov dword [eax + 0x126a4], ebx
mov dword [eax + 0x3c], edx
jne 0x10064dd5
push edx
push edi
push dword [eax + 0x44]
push dword [eax + 0x40]
call fcn.1005bc60
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x64
call fcn.1005bc60
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10064df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp dword [esi + 0x10e8], 0
je 0x10064e11
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x10f0]
xor ebx, ebx
mov eax, 3
mov ecx, dword [ebp + 8]
mov edi, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x10f4]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
cmp dword [ebp + 0xc], ebx
jbe 0x10064ea2
mov ecx, dword [esp + 0x14]
cmp eax, 3
jne 0x10064e9f
mov eax, dword [ebp + 0xc]
sub eax, ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x1104]
lea eax, [esp + 0x24]
push dword [esi + 0x10fc]
push dword [esi + 0x10f8]
push ecx
push edx
push eax
mov eax, dword [esi + 0x1100]
push edi
push 0
call eax
mov eax, dword [esp + 0x1c]
add ebx, eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add edx, eax
mov dword [esp + 0x10], edx
adc ecx, 0
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
cmp ebx, dword [ebp + 0xc]
jb 0x10064e42
mov ecx, dword [ebp + 8]
cmp eax, 3
ja case.0x10064ea7.1
jmp dword [eax*4 + 0x10064f68]
test ebx, ebx
je 0x10064ec3
add dword [esi + 0x10f0], ebx
mov edi, ebx
adc dword [esi + 0x10f4], 0
jmp 0x10064efc
mov dword [esi + 0x10e8], 1
jmp case.0x10064ea7.1
test ebx, ebx
je 0x10064ee0
add dword [esi + 0x10f0], ebx
adc dword [esi + 0x10f4], 0
mov dword [esi + 0x10e8], 1
mov edi, ebx
jmp 0x10064efc
mov dword [esi + 0xa4], 1
xor ebx, ebx
xor edi, edi
test ecx, ecx
lea ecx, [esi + 0x126a4]
jne 0x10064f1d
or eax, 0xffffffff
add dword [esi + 0x38], ebx
not eax
adc dword [esi + 0x3c], 0
mov dword [ecx], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
mov dword [esp + 0x1c], ecx
not eax
test edi, edi
je 0x10064f54
mov esi, dword [ebp + 8]
lea esp, [esp]
movsx edx, byte [esi]
lea esi, [esi + 1]
movzx ecx, al
xor edx, ecx
shr eax, 8
movzx ecx, dl
xor eax, dword [ecx*4 + 0x100b0990]
sub edi, 1
jne 0x10064f30
mov ecx, dword [esp + 0x1c]
mov esi, dword [ebp + 0x10]
add dword [esi + 0x38], ebx
not eax
pop edi
adc dword [esi + 0x3c], 0
mov dword [ecx], eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065470
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a1e70
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, edx
mov eax, dword [esi]
test al, 0x10
jne 0x10065546
test eax, 0x400
je 0x10065546
cmp dword [esi + 0x1c], 0
jne 0x10065546
cmp dword [esi + 0x20], 0
jne 0x10065546
cmp dword [esi + 0x24], 0xa000000c
jne 0x10065546
push edi
push 0x104
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1004d280
mov edi, dword [ebp - 0x18]
mov eax, edi
test edi, edi
jne 0x100654df
mov eax, dword [ebp - 0x1c]
push ebx
push 0
push 0
push 3
push 0
push 7
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 4], 0
test edi, edi
je 0x1006550c
push edi
call fcn.10086818
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp ebx, 0xffffffff
je 0x10065544
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10065534
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006553d
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1006bf90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov eax, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0xac]
xor edi, edi
cmp ebx, 0xffffffff
je 0x1006c020
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1006bfe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006bfe6
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1006c020
mov ecx, dword [ebp - 0x20]
xor eax, eax
or eax, dword [ebp - 0x1c]
jmp 0x1006bfee
mov ecx, dword [ebp - 4]
xor eax, eax
or eax, dword [ebp - 8]
test ecx, ecx
jl 0x1006c020
jg 0x1006bff8
test eax, eax
jb 0x1006c020
mov edi, dword [ebp - 0xc]
mov esi, dword [edi + 0x9650]
mov edi, dword [edi + 0x9654]
test edi, edi
jg 0x1006c01c
jl 0x1006c015
cmp esi, 0x10000
jae 0x1006c01c
mov esi, 0x10000
xor edi, edi
sub esi, eax
sbb edi, ecx
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006d620
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
mov ebx, ecx
mov dword [ebp - 0x18], edx
push eax
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1006d670
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006d670
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1006d687
mov ecx, dword [ebp - 0x30]
xor eax, eax
or eax, dword [ebp - 0x2c]
jmp 0x1006d677
mov ecx, dword [ebp - 4]
xor eax, eax
or eax, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
test ecx, ecx
jg 0x1006d693
jl 0x1006d687
test eax, eax
jne 0x1006d693
mov eax, 0xa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x40000
call fcn.1008680d
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1006d6b0
lea eax, [ebx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, edi
xor edx, edx
and eax, ecx
xor esi, esi
mov dword [ebp - 4], edx
cmp eax, 0xffffffff
jne 0x1006d6d8
mov eax, dword [ebp + 0x10]
mov ecx, eax
mov dword [eax + 0x6424], edx
call fcn.1005be30
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
and eax, ecx
cmp eax, 0xffffffff
je 0x1006d710
cmp edx, ecx
jg 0x1006d7d6
jl 0x1006d6f3
cmp esi, edi
jae 0x1006d7d6
mov eax, dword [ebp + 0xc]
mov ecx, edi
sub ecx, esi
sbb eax, edx
test eax, eax
jg 0x1006d710
jl 0x1006d70a
cmp ecx, 0x40000
jae 0x1006d710
mov eax, edi
sub eax, esi
jmp 0x1006d715
mov eax, 0x40000
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006d7e8
mov eax, dword [ebp - 8]
test eax, eax
je 0x1006d7d6
push 0
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006d7c1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 8]
jne 0x1006d7c1
mov ecx, dword [ebp - 4]
add esi, eax
mov eax, edi
adc ecx, 0
and eax, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp eax, 0xffffffff
jne 0x1006d78e
push 0
push 0x64
push ecx
push esi
call fcn.1009d620
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push edx
push eax
call fcn.1009d8a0
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0x6424], eax
jmp 0x1006d791
mov ecx, dword [ebp + 0x10]
call fcn.1005be30
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
cmp dword [eax + 0xa4], 0
je 0x1006d6d8
push ebx
call fcn.10086818
mov eax, 9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.10086818
mov eax, 0xa
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.10086818
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.10086818
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006de30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1006de85
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006de85
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1006de7a
mov edx, dword [ebp - 0x18]
xor eax, eax
or eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
xor eax, eax
or eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret