joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042f7
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.00416778
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x40446a
jg 0x404326
test esi, esi
jb 0x40446a
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40446a
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404388
push edi
call fcn.00404879
pop ecx
test eax, eax
je 0x40437f
push ebx
push esi
push edi
push ebp
call fcn.00416778
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40446f
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.00416778
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x40446a
jg 0x4043b1
cmp ebp, ebx
jb 0x40446a
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043c6
jl 0x4043c0
cmp ebp, ecx
jae 0x4043c6
mov esi, ebp
mov ecx, eax
jmp 0x4043ca
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.00416778
add esp, 0x10
cmp edx, ebx
jl 0x40446a
jg 0x4043f0
cmp eax, ebx
jb 0x40446a
push 0x10015
call fcn.00416778
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40446a
push esi
push ebx
push dword [esp + 0x24]
call fcn.00417558
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404463
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40445f
cmp byte [esi], 0x50
jne 0x40445e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40445e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404476
dec esi
cmp esi, ebx
jae 0x40441f
push ebx
call fcn.00416778
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a130
push ebx
call fcn.00416778
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404879
add esp, 0x14
test eax, eax
je 0x4044b6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.00416778
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40446f
Function at 0x416778
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x416787
pop dword [ebp - 0x4c]
mov eax, 0x416787
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x5c5a825
sub dword [ebp - 0x5c], 0xb77362da
mov dword [ebp - 0x58], 0x2573c0f1
add dword [ebp - 0x58], 0xcbf8b54
mov dword [ebp - 0x54], 0x1160a796
sub dword [ebp - 0x54], 0xc5146368
mov dword [ebp - 0x50], 0xfee66a05
sub dword [ebp - 0x50], 0xfee66a05
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x84ec8c98
sub eax, 0x84aa3c44
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xd76bacb3
sub dword [ebp - 0x5c], 0x62f9435d
mov dword [ebp - 0x58], 0xf68e415
add dword [ebp - 0x58], 0x32037d60
mov dword [ebp - 0x54], 0x73fe5c59
sub dword [ebp - 0x54], 0x108eefed
mov dword [ebp - 0x50], 0x3890b599
sub dword [ebp - 0x50], 0x3890b599
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e84f
push 0
call eax
mov ecx, 0x4b16
xor esi, esi
add esi, eax
mov edx, 0x38340d05
sub edx, 0x37f03305
add edx, dword [ebp - 0x4c]
mov edi, 0xdd536daa
mov dword [ebp - 0x40], 0x14218b94
mov ebx, dword [edx]
add dword [ebp - 0x10], edx
add ebx, edi
xor dword [ebp - 0x10], 0x1e4b08f5
mov dword [esi], ebx
mov dword [ebp - 0x48], 0xe5855cfb
add esi, 0xda6ef8e8
add esi, 0x2591071c
add edx, 4
loop 0x416895
add eax, 0x11f2b
mov ebx, eax
add eax, 0x937755e1
add eax, 0x6c88aa24
mov ecx, 0x76688e46
sub ecx, 0x76288e46
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10053170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10053310
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10053234
cmp dword [ebp - 4], 0x50000000
jb 0x100531b1
cmp dword [ebp - 4], 0x80000000
ja 0x100531b1
mov dword [ebp - 4], 0x4fff0000
jmp 0x1005318a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1005d7e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100531d7
jmp 0x10053234
cmp dword [ebp - 0x14], 0x10000
jne 0x1005321a
cmp dword [ebp - 0x18], 0x10000
jb 0x1005321a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1005320d
mov eax, dword [ebp - 8]
jmp 0x10053236
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1005322f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10053310
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1005318a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10053240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10053340
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100532fc
cmp dword [ebp - 4], 0x50000000
jb 0x1005327c
cmp dword [ebp - 4], 0x80000000
ja 0x1005327c
mov dword [ebp - 4], 0x80010000
jmp 0x10053255
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1005d7e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100532a2
jmp 0x100532fc
cmp dword [ebp - 0x14], 0x10000
jne 0x100532e5
cmp dword [ebp - 0x18], 0x10000
jb 0x100532e5
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100532d8
mov eax, dword [ebp - 8]
jmp 0x100532fe
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100532f7
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10053340
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10053255
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10053a70
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10053a85
xor eax, eax
jmp 0x10053afa
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10053ab2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10053af5
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10053af3
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10053aef
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10053af3
xor eax, eax
jmp 0x10053afa
jmp 0x10053aa9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10053cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10197448]
mov dword [ebp - 4], eax
jmp 0x10053cd9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10053cf6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10053cd0
mov esp, ebp
pop ebp
ret
Function at 0x10054140
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10197458], eax
je 0x1005415e
mov eax, 0x10dd
jmp 0x1005423f
mov eax, dword [0x10197468]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100541dc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100541ba
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100541ba
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100537e0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10055762
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10054166
mov dword [0x10197468], 0
call fcn.10053b00
mov ecx, dword [0x10197464]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10054229
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10055762
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100541f4
mov dword [0x10197464], 0
mov dword [0x10197458], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10054730
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1019745c], 0
je 0x10054749
mov eax, dword [0x1019745c]
jmp 0x100547e9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1005475b
xor eax, eax
jmp 0x100547e9
push 8
call fcn.10055713
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100547b1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1005479a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10055762
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1019745c], eax
mov dword [0x10197460], 0
mov eax, dword [ebp - 8]
jmp 0x100547e9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100547cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1005477b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10197464]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10197464], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1006b7be
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10194820]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.100634ce
mov dword [ebp - 0x14], eax
cmp dword [0x101981b8], edi
jne 0x1006b8af
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1006b83c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006b98f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1006b98f
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006b98f
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x101981b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x101981bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x101981c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101981c8], eax
test eax, eax
je 0x1006b8ac
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101981c4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006b8d4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006b8c7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1006b8e9
push 4
pop eax
jmp 0x1006b991
cmp dword [ebp - 0x14], edi
je 0x1006b8e9
push dword [0x101981b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006b8ce
mov eax, dword [0x101981c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1006b947
cmp dword [0x101981c8], esi
je 0x1006b947
push eax
call ebx
push dword [0x101981c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006b947
test eax, eax
je 0x1006b947
call ecx
test eax, eax
je 0x1006b93c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006b93c
test byte [ebp - 8], 1
jne 0x1006b947
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1006b977
mov eax, dword [0x101981bc]
cmp eax, esi
je 0x1006b974
push eax
call ebx
test eax, eax
je 0x1006b974
call eax
mov edi, eax
test edi, edi
je 0x1006b974
mov eax, dword [0x101981c0]
cmp eax, esi
je 0x1006b974
push eax
call ebx
test eax, eax
je 0x1006b974
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x101981b8]
call ebx
test eax, eax
je 0x1006b98f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1006b991
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055090
leave
ret
Function at 0x100709d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0x10162240
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10055178
add esp, 0xc
test eax, eax
je 0x10070a17
xor al, al
jmp 0x10070a98
mov eax, dword [ebp + 0x10]
push eax
call fcn.100551bd
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10070a3c
mov ecx, dword [ebp - 8]
push ecx
call fcn.100552bb
add esp, 4
xor al, al
jmp 0x10070a98
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.100554f5
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10070a71
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.10070aa0
jmp 0x10070a3c
mov edx, dword [ebp - 4]
push edx
call fcn.100555a1
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.100552bb
add esp, 4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
xor edx, 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10070b60
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x4c11db7
mov dword [ebp - 4], 0
jmp 0x10070b82
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xff
jg 0x10070c1c
push 8
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10070b00
shl eax, 0x18
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0xc], 0
jmp 0x10070bbb
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x10070bfa
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
and edx, 0x80000000
je 0x10070bda
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x10070be1
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
shl eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x10070bb2
push 0x20
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
push edx
mov ecx, dword [ebp - 8]
call fcn.10070b00
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
jmp 0x10070b79
mov esp, ebp
pop ebp
ret
Function at 0x10072cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.10068f10
mov eax, dword [0x10194820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1020], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.1005d7e0
add esp, 0xc
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
jmp 0x10072d0f
mov ecx, dword [ebp - 0x1018]
add ecx, 1
mov dword [ebp - 0x1018], ecx
cmp dword [ebp - 0x1018], 0xa
jge 0x10072dc6
mov edx, dword [ebp - 0x1018]
imul edx, edx, 0x16
add edx, dword [ebp - 0x1020]
mov dword [ebp - 0x1010], edx
mov eax, dword [ebp - 0x1010]
add eax, 1
mov dword [ebp - 0x102c], eax
mov ecx, dword [ebp - 0x1010]
mov dl, byte [ecx]
mov byte [ebp - 0x1009], dl
add dword [ebp - 0x1010], 1
cmp byte [ebp - 0x1009], 0
jne 0x10072d40
mov eax, dword [ebp - 0x1010]
sub eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1024], eax
je 0x10072dc1
mov ecx, dword [ebp - 0x1018]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1020]
mov edx, dword [ebp - 0x1014]
lea eax, [ebp + edx - 0x1004]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov cx, word [ecx + 0x14]
mov word [eax + 0x14], cx
mov edx, dword [ebp - 0x1014]
add edx, 0x16
mov dword [ebp - 0x1014], edx
jmp 0x10072d00
mov dword [ebp - 0x1008], 0
jmp 0x10072de1
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1014]
jge 0x10072e5f
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
sub eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x10072dd2
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0xffffffff
jne 0x10072e89
jmp 0x10072ed7
mov dword [ebp - 0x1028], 0
push 0
lea eax, [ebp - 0x1028]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
lea edx, [ebp - 0x1004]
push edx
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10072eca
mov ecx, dword [ebp - 0x101c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10072ed7
mov edx, dword [ebp - 0x101c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10055090
mov esp, ebp
pop ebp
ret 4
Function at 0x10072ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.10068f10
mov eax, dword [0x10194820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1024], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.1005d7e0
add esp, 0xc
push 0x1000
push 0
lea ecx, [ebp - 0x1004]
push ecx
call fcn.1005d7e0
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], 0xffffffff
jne 0x10072f6d
jmp 0x10073163
push 0
mov eax, dword [ebp - 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x102c], 0
push 0
lea ecx, [ebp - 0x102c]
push ecx
mov edx, dword [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1018]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10072fc6
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10073163
mov dword [ebp - 0x1008], 0
jmp 0x10072fe1
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1020]
jge 0x1007305f
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
add eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x10072fd2
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0x1020]
xor edx, edx
mov ecx, 0x16
div ecx
mov dword [ebp - 0x1034], eax
mov dword [ebp - 0x100c], 0
jmp 0x100730a8
mov edx, dword [ebp - 0x100c]
add edx, 1
mov dword [ebp - 0x100c], edx
cmp dword [ebp - 0x100c], 0xa
jge 0x10073163
mov eax, dword [ebp - 0x100c]
imul eax, eax, 0x16
add eax, dword [ebp - 0x101c]
mov dword [ebp - 0x1014], eax
mov ecx, dword [ebp - 0x1014]
add ecx, 1
mov dword [ebp - 0x1028], ecx
mov edx, dword [ebp - 0x1014]
mov al, byte [edx]
mov byte [ebp - 0x100d], al
add dword [ebp - 0x1014], 1
cmp byte [ebp - 0x100d], 0
jne 0x100730d9
mov ecx, dword [ebp - 0x1014]
sub ecx, dword [ebp - 0x1028]
mov dword [ebp - 0x1030], ecx
je 0x10073126
mov edx, dword [ebp - 0x1024]
mov eax, dword [edx + 0xec]
add eax, 1
mov ecx, dword [ebp - 0x1024]
mov dword [ecx + 0xec], eax
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
mov eax, dword [ebp - 0x101c]
lea ecx, [eax + edx + 0xb]
push ecx
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
add edx, dword [ebp - 0x101c]
push edx
mov ecx, dword [ebp - 0x100c]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1024]
call fcn.10001020
jmp 0x10073099
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10055090
mov esp, ebp
pop ebp
ret 4