joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov al, byte [edi + 0x100]
mov dl, byte [edi + 0x101]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
cmp dword [esp + 0x14], esi
jle 0x1001f1bb
push ebx
jmp 0x1001f168
mov dl, byte [esp + 0xf]
mov al, byte [esp + 0xe]
inc al
movzx ecx, al
mov bl, byte [ecx + edi]
add ecx, edi
mov byte [esp + 0xe], al
mov al, bl
add al, dl
movzx edx, al
add edx, edi
mov byte [esp + 0xf], al
movzx eax, byte [edx]
mov byte [ecx], al
mov byte [edx], bl
movzx ecx, byte [ecx]
movzx edx, bl
add ecx, edx
and ecx, 0xff
movzx eax, byte [ecx + edi]
xor byte [esi + ebp], al
inc esi
cmp esi, dword [esp + 0x18]
jl 0x1001f160
mov cl, byte [esp + 0xe]
mov al, byte [esp + 0xf]
mov byte [edi + 0x100], cl
mov byte [edi + 0x101], al
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x1001f1c0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xffffffffffffffff
push 0x100f1738
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x10139d00]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
push ebx
push 0x101224c4
push 1
push 0
push 0x10122594
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1001f301
lea eax, [esp + 0x10]
push eax
mov edi, str.ROOTCIMV2
call fcn.1001efe0
mov dword [esp + 0x1c], 0
mov eax, dword [eax]
test eax, eax
je 0x1001f226
mov ecx, dword [eax]
jmp 0x1001f228
xor ecx, ecx
mov eax, dword [ebx]
mov edx, dword [eax]
push ebp
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
mov edi, eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001f294
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1001f28c
test esi, esi
je 0x1001f28c
mov eax, dword [esi]
test eax, eax
je 0x1001f273
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x1001f283
push eax
call fcn.100d1ecb
add esp, 4
push esi
call fcn.100d072d
add esp, 4
mov dword [esp + 0x10], 0
test edi, edi
jge 0x1001f2b7
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
mov eax, dword [ebp]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jge 0x1001f2ff
mov eax, dword [ebp]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x1001f6b0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x498
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x494], eax
mov eax, dword [esp + 0x49c]
push ebx
push ebp
push esi
push edi
push 0x7f
mov esi, ecx
lea ecx, [esp + 0x25]
push 0
push ecx
mov dword [esp + 0x24], eax
mov byte [esp + 0x2c], 0
call fcn.100d4cc0
add esp, 0xc
lea edi, [esp + 0x20]
mov byte [esp + 0x13], 0
call fcn.1001f5d0
test eax, eax
jne 0x1001f704
xor al, al
jmp 0x1001f7fb
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x1001f7f7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push ebp
call fcn.100cf8cb
add esp, 4
push ebp
mov ebx, eax
push 0
push ebx
call fcn.100d4cc0
add esp, 0xc
push 0
lea edx, [esp + 0x18]
push edx
push ebp
push ebx
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x3ff
lea eax, [esp + 0xa5]
push 0
push eax
mov byte [esp + 0xac], 0
call fcn.100d4cc0
lea ecx, [esp + 0x2c]
add esp, 0xc
push ecx
lea esi, [esp + 0xa4]
call fcn.1001f0d0
add esp, 4
push ebp
push ebx
mov edi, esi
call fcn.1001f140
mov edx, dword [esp + 0x20]
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001f7e7
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
mov byte [esp + 0x13], 1
mov ecx, dword [esp + 0x1c]
push ecx
call edi
push ebx
call fcn.100d072d
add esp, 4
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x4a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x498
ret 4

Function at 0x1001f850
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
push esi
call edi
test eax, eax
je 0x1001f8c6
push esi
call edi
mov ebx, eax
call fcn.1001f820
cmp eax, 0xffffffff
je 0x1001f8c6
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001f8c6
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], edi
jl 0x1001f8c6
jg 0x1001f8bd
cmp dword [esp + 0x10], edi
jbe 0x1001f8c6
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x1001f8d0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
xor bl, bl
push eax
mov byte [esp + 0x2f], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001f9fc
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, dword [esp + 0x20]
push ebp
push ebp
push 4
push esi
add edi, 0xfffffff8
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
add ecx, 0x400
push ecx
push 0x40
call ebx
mov ebp, eax
test ebp, ebp
je 0x1001f9e7
lea edx, [edi + 0x400]
push edx
push 0x40
call ebx
mov ebx, eax
test ebx, ebx
je 0x1001f9e0
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
push edi
push ebx
lea edx, [esp + 0x24]
push edx
push ebp
mov dword [esp + 0x2c], ecx
call fcn.100ccc60
add esp, 0x10
test eax, eax
jne 0x1001f9d9
push eax
push 0x80
push 2
push eax
mov eax, dword [esp + 0x3c]
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001f9d9
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x13], 1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret 4
Function at 0x1001fa10
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x14
push esi
push edi
mov esi, eax
push 0x1012b170
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001fa49
push 0x1012b178
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001facf
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001facf
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [esp + 0x14], edi
jl 0x1001fac8
jg 0x1001fa8c
cmp dword [esp + 0x10], 8
jbe 0x1001fac8
push edi
lea ecx, [esp + 0xc]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 8], 4
jne 0x1001facf
cmp dword [esp + 0xc], 0x33e0f0d
jne 0x1001facf
mov al, 1
pop edi
pop esi
add esp, 0x14
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x14
ret

Function at 0x1001fb40
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001fbe5
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push str.China_Yun_Long
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 4
cmp edi, eax
pop edi
jb 0x1001fbde
xor eax, eax
push ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0xc]
push eax
push 0xe
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 8], 0xe
jne 0x1001fbde
push str.China_Yun_Long
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1001fbde
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x18
ret 4
Function at 0x1001fea0
Capabilities:
Check if file exists
Encode data using xor
Read .ini file

Disassembly:
sub esp, 0x424
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x29]
push ebx
push eax
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], 1
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1c], 1
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 1
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
call fcn.100d4cc0
add esp, 0xc
push 0x1012b1d8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001ffca
push 0x1012b1d8
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1001ffca
push str.C:windowsyl.ini
push 0x3ff
lea ecx, [esp + 0x2c]
push ecx
push 0x10128b0a
push 0x1012b210
push 0x1012b214
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov cl, byte [esp + 0x24]
xor eax, eax
cmp cl, bl
je 0x1001ffb7
mov edx, eax
and edx, 7
xor byte [esp + edx + 4], cl
mov cl, byte [esp + eax + 0x25]
lea edx, [esp + edx + 4]
inc eax
cmp cl, bl
jne 0x1001ffa1
push 0x101affd8
push 1
lea eax, [esp + 0xc]
push eax
call fcn.1006a671
jmp 0x1001ffdf
push esi
push edi
mov ecx, 0x20
mov esi, str.86_8
mov edi, 0x101affd8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov ecx, dword [esp + 0x424]
pop ebx
xor ecx, esp
mov eax, 0x101e3051
call fcn.100d0738
add esp, 0x424
ret
Function at 0x10024a10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebp
mov ebp, dword [esp + 0xcc]
push esi
mov esi, ecx
cmp esi, 0x40
jbe 0x10024a57
push ebp
call fcn.100743e0
push esi
push edi
push ebp
call fcn.100759d0
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.10075ad0
add esp, 0x18
mov esi, 0x14
jmp 0x10024a71
lea ecx, [esp + 8]
cmp ecx, edi
je 0x10024a6c
push esi
mov edx, ecx
push edi
push edx
call fcn.100d4950
add esp, 0xc
cmp esi, 0x40
jae 0x10024a88
mov eax, 0x40
sub eax, esi
push eax
lea ecx, [esp + esi + 0xc]
push 0
push ecx
call fcn.100d4cc0
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 8]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [esp + eax + 0x48], dl
mov byte [esp + eax + 0x88], cl
inc eax
cmp eax, 0x40
jb 0x10024a90
push ebp
call fcn.100743e0
push 0x40
lea eax, [esp + 0x50]
push eax
push ebp
call fcn.100759d0
lea esi, [ebp + 0x60]
push esi
call fcn.100743e0
push 0x40
lea ecx, [esp + 0xa0]
push ecx
push esi
call fcn.100759d0
mov ecx, dword [esp + 0xe8]
add esp, 0x20
pop esi
pop ebp
xor ecx, esp
call fcn.100d0738
add esp, 0xc4
ret
Function at 0x10024b00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x178
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov edx, eax
mov dword [esp + 8], ecx
shr edx, 0x18
push ebp
mov ebp, dword [esp + 0x184]
push esi
mov byte [esp + 8], dl
mov ecx, eax
mov edx, eax
shr ecx, 0x10
mov byte [esp + 0xb], al
xor eax, eax
push edi
mov byte [esp + 0xd], cl
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov byte [esp + 0x174], al
mov byte [esp + 0x175], al
mov eax, dword [esp + 0x190]
push eax
mov ecx, 0x30
mov esi, ebx
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
shr edx, 8
push ebp
push ecx
mov byte [esp + 0x1a], dl
mov byte [esp + 0x158], 0x80
mov byte [esp + 0x182], 2
mov byte [esp + 0x183], 0xa0
call fcn.100759d0
push 4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.100759d0
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x154]
push edx
call fcn.10075ad0
push 0x14
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0xa0]
push ecx
call fcn.100759d0
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x168]
push eax
call fcn.10075ad0
mov eax, dword [esp + 0x1c8]
add esp, 0x34
mov ecx, 0x18
lea esi, [esp + 0x78]
lea edi, [esp + 0xd8]
rep movsd dword es:[edi], dword [esi]
cmp eax, 1
jbe 0x10024d4d
mov ebp, dword [esp + 0xe0]
mov edi, dword [esp + 0xdc]
mov esi, dword [esp + 0xd8]
dec eax
mov dword [esp + 0x10], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x138]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], edx
mov edx, dword [ebx + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x30], edx
call fcn.10075ab0
lea eax, [esp + 0x140]
lea ecx, [esp + 0x20]
call fcn.10024970
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x64]
mov dword [esp + 0x80], edx
mov edx, dword [ebx + 0x6c]
mov dword [esp + 0x88], ecx
lea ecx, [esp + 0x140]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x84], eax
mov eax, dword [ebx + 0x70]
push ecx
lea edx, [esp + 0x84]
push edx
mov dword [esp + 0x98], eax
call fcn.10075ab0
add esp, 0x10
lea eax, [esp + 0x138]
lea ecx, [esp + 0x78]
call fcn.10024970
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
xor esi, dword [esp + 0x78]
xor edi, dword [esp + 0x7c]
xor ebp, dword [esp + 0x80]
xor dword [esp + 0xe4], eax
xor dword [esp + 0xe8], ecx
sub dword [esp + 0x10], 1
jne 0x10024c64
mov dword [esp + 0xe0], ebp
mov dword [esp + 0xdc], edi
mov dword [esp + 0xd8], esi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xd8]
call fcn.10024970
mov ecx, dword [esp + 0x17c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100d0738
add esp, 0x178
ret
Function at 0x100264c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push edi
mov edi, eax
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov eax, 0x100
push eax
push ecx
inc edi
push edi
call fcn.100d53f0
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov dword [esp + 0xc], eax
mov eax, 0x100
push eax
push ecx
inc edi
push edi
mov byte [esi + 0x38], dl
call fcn.100d53f0
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov dword [esp + 0xc], eax
mov eax, 0x100
push eax
push ecx
inc edi
push edi
mov byte [esi + 0x39], dl
call fcn.100d53f0
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov dword [esp + 0xc], eax
mov eax, 0x100
push eax
push ecx
inc edi
push edi
mov byte [esi + 0x3a], dl
call fcn.100d53f0
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov dword [esp + 0xc], eax
mov eax, 0x100
push eax
push ecx
inc edi
push edi
mov byte [esi + 0x3b], dl
call fcn.100d53f0
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov dword [esp + 0xc], eax
mov eax, 0x100
push eax
push ecx
inc edi
push edi
mov byte [esi + 0x3c], dl
call fcn.100d53f0
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov dword [esp + 0xc], eax
mov eax, 0x100
push eax
push ecx
inc edi
push edi
mov byte [esi + 0x3d], dl
call fcn.100d53f0
imul edi, edi, 0x8088405
mov dword [esp + 8], eax
mov byte [esi + 0x3e], dl
xor ecx, ecx
push ecx
mov eax, 0x100
push eax
push ecx
inc edi
push edi
call fcn.100d53f0
mov dword [esp + 8], eax
mov byte [esi + 0x3f], dl
xor ebx, ebx
nop
imul edi, edi, 0x8088405
xor ecx, ecx
push ecx
mov eax, 0x100
push eax
push ecx
inc edi
push edi
call fcn.100d53f0
mov byte [ebx + esi], dl
inc ebx
mov dword [esp + 8], eax
cmp ebx, 0x38
jb 0x100265c0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100266e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x326c
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x3268], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x100268ad
test esi, esi
je 0x100268ad
cmp byte [0x101e2fc8], 0
je 0x100268ad
call fcn.10025f70
test eax, eax
je 0x100268ad
push edi
lea ecx, [esp + 0x106c]
call fcn.100268d0
test eax, eax
je 0x100268ad
push 0x1012266c
push edi
call fcn.100d080d
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x100268ad
lea eax, [esp + 0x1068]
push 0x101226b0
push eax
call fcn.100d080d
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
test esi, esi
je 0x100268a4
push 0x101e2fc9
lea ecx, [esp + 0x1c]
push 0x38
push ecx
call fcn.10076db0
mov edx, dword [0x101e3001]
mov eax, dword [0x101e3005]
add esp, 0xc
mov edi, 0x10000
push ebx
mov dword [esp + 0x1064], edx
mov dword [esp + 0x1068], eax
mov dword [esp + 0x10], edi
call fcn.100d1e39
add esp, 4
test eax, eax
je 0x100267f4
push esi
call fcn.100d11ec
add esp, 4
push ebx
call fcn.100d11ec
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3268]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0xc]
test edi, edi
je 0x10026853
mov eax, 0x1000
cmp edi, 0x1000
ja 0x10026807
mov eax, edi
push ebx
push eax
lea ecx, [esp + 0x2278]
push 1
push ecx
call fcn.100d0bd3
lea edx, [esp + 0x28]
push edx
mov edi, eax
lea eax, [esp + 0x1284]
push 0x1000
push eax
lea esi, [esp + 0x107c]
lea eax, [esp + 0x228c]
call fcn.10025ec0
mov esi, dword [esp + 0x2c]
add esp, 0x1c
sub dword [esp + 0xc], edi
lea eax, [esp + 0x1270]
jmp 0x10026874
push ebx
push 0x1000
lea ecx, [esp + 0x2278]
push 1
push ecx
call fcn.100d0bd3
mov edi, eax
add esp, 0x10
lea eax, [esp + 0x2270]
push esi
push edi
push 1
push eax
call fcn.100d0d86
add esp, 0x10
cmp edi, eax
jne 0x1002689b
push ebx
call fcn.100d1e39
add esp, 4
test eax, eax
je 0x100267f0
jmp 0x100267c2
push esi
call fcn.100d11ec
add esp, 4
push ebx
call fcn.100d11ec
add esp, 4
mov ecx, dword [esp + 0x3274]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100d0738
mov esp, ebp
pop ebp
ret
Function at 0x10026970
Capabilities:
Copy file
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, 1
xor ebp, ebp
push 0x3c
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push ebp
push eax
mov dword [esp + 0x38], ebp
call fcn.100d4cc0
add esp, 0xc
push 0xfa00
xor ebx, ebx
push 0x40
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, dword [esp + 0x74]
mov esi, eax
cmp esi, ebp
je 0x10026b2d
mov ecx, dword [esp + 0x70]
push ebp
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10026b22
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
push ebp
push 3
push ebp
push 2
push SysReAllocString
push edi
call ebx
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x10026b20
push ebp
push ebp
push 3
push ebp
push 1
push 0x40000100
push edi
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10026b0f
push 0xf0000000
push 0x18
push ebp
push ebp
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push ebp
push 0x101e2da8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x18]
push eax
push 0x101e2da8
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
push 0x6610
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebp
lea eax, [esp + 0x28]
push eax
push 4
push ecx
call edi
mov eax, dword [esp + 0x10]
push ebp
lea edx, [esp + 0x2c]
push edx
push 3
push eax
call edi
mov edx, dword [esp + 0x10]
push ebp
lea ecx, [esp + 0x30]
push ecx
push 1
push edx
call edi
mov ecx, dword [esp + 0x20]
push ebp
lea eax, [esp + 0x74]
push eax
push 0xfa00
push esi
push ecx
mov dword [esp + 0x84], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test byte [esp + 0x70], 0xf
jne 0x10026b04
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push edx
push esi
push ebp
push 1
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov edx, dword [esp + 0x70]
push ebp
lea ecx, [esp + 0x74]
push ecx
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x1c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x1c]
jmp 0x10026b22
mov ebx, ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp ebx, ebp
jne 0x10026b34
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x5c
ret 8