joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10047085
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10062648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10041dc9
and dword [ebp - 0x14], 0
cmp dword [0x1008afe4], 0
mov dword [ebp - 0x18], eax
jne 0x10047138
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100471e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100471e0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1008afe4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1008afe8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1008afec], eax
call edi
push eax
call esi
mov dword [0x1008aff4], eax
test eax, eax
je 0x10047138
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1008aff0], eax
mov eax, dword [0x1008aff0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10047191
cmp dword [0x1008aff4], ecx
je 0x10047191
push eax
call esi
push dword [0x1008aff4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10047191
test ebx, ebx
je 0x10047191
call edi
test eax, eax
je 0x10047188
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10047188
test byte [ebp - 8], 1
jne 0x10047191
or dword [ebp + 0x10], 0x200000
jmp 0x100471c4
mov eax, dword [0x1008afe8]
cmp eax, dword [ebp - 0x18]
je 0x100471c4
push eax
call esi
test eax, eax
je 0x100471c4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100471c4
mov eax, dword [0x1008afec]
cmp eax, dword [ebp - 0x18]
je 0x100471c4
push eax
call esi
test eax, eax
je 0x100471c4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1008afe4]
call esi
test eax, eax
je 0x100471e0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100471e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003999f
leave
ret
Function at 0x5f4bf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x151000]
push edi
or ebp, 0xffffffff
jmp 0x5f4c12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5f4c19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f4c08
mov eax, 1
add ebx, ebx
jne 0x5f4c2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5f4c3c
jne 0x5f4c5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f4c5b
dec eax
add ebx, ebx
jne 0x5f4c48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5f4c20
add ebx, ebx
jne 0x5f4c57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5f4cad
xor ecx, ecx
sub eax, 3
jb 0x5f4c73
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5f4ce2
sar eax, 1
mov ebp, eax
jmp 0x5f4c7e
add ebx, ebx
jne 0x5f4c7e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f4c4c
inc ecx
add ebx, ebx
jne 0x5f4c8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f4c4c
add ebx, ebx
jne 0x5f4c99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5f4c8e
jne 0x5f4caa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5f4c8e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5f4ccc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5f4cbe
jmp 0x5f4c0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5f4ccc
add edi, ecx
jmp 0x5f4c0e
pop esi
mov edi, esi
mov ecx, 0x73b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5f4cea
cmp byte [edi], 0x21
jne 0x5f4cea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5f4cef
lea edi, [esi + 0x1f1000]
mov eax, dword [edi]
or eax, eax
je 0x5f4d67
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x246474]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2465d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5f4d1c
mov ecx, edi
jns 0x5f4d4b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2465d8]
or eax, eax
je 0x5f4d61
mov dword [ebx], eax
add ebx, 4
jmp 0x5f4d39
call dword [esi + 0x2465d4]
mov ebp, dword [esi + 0x2465dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5f4d9b
sub esp, 0xffffff80
jmp 0x42ffdf
Function at 0x4045f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00403d78
pop ecx
push eax
push dword [ebp + 0x18]
jne 0x404629
push dword [ebp + 0x14]
call fcn.00403d2d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
invalid
movsd dword es:[edi], dword [esi]
cmp al, 0xfc
invalid

Function at 0x40605d
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44a200], 2
jl 0x406082
movaps xmm0, xmmword [0x4347f0]
movaps xmmword [0x441040], xmm0
movaps xmm0, xmmword [0x4347e0]
movaps xmmword [0x441050], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.0040640a
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x4347b8]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x406090
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x406773
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x40679d
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x441060]
inc edi
sub esi, 1
jne 0x406785
pop edi
mov eax, edx
pop esi
ret 0xc

Function at 0x40698a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
xor ebp, ebp
cmp dword [edi], 2
lea esi, [edi + 4]
jne 0x4069e0
mov eax, dword [esi]
push ebx
push ebp
push ebp
push ebp
push ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x20
push dword [esp + 0x5c]
call fcn.00407074
mov edx, ebp
mov ebx, ebp
movzx eax, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor eax, ebx
inc edx
mov ebx, eax
cmp edx, 0x20
jb 0x4069c4
mov dword [esi], eax
pop ebx
cmp dword [edi], 3
jne 0x406a0c
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
push 0x20
push esi
push 0x20
push dword [esp + 0x58]
call fcn.00407074
push 0x20
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00422c30
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x24
ret 8
Function at 0x40c198
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040799b
mov dword [ebp - 0x14], eax
cmp dword [0x435340], esi
jne 0x40c28b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c218
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c36b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c36b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c36b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x435340], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x435344], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x435348], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x435350], eax
test eax, eax
je 0x40c288
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43534c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c2b0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c2a3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c2c5
push 4
pop eax
jmp 0x40c36d
cmp dword [ebp - 0x14], esi
je 0x40c2c5
push dword [0x435340]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c2aa
mov eax, dword [0x43534c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c323
cmp dword [0x435350], edi
je 0x40c323
push eax
call ebx
push dword [0x435350]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c323
test eax, eax
je 0x40c323
call ecx
test eax, eax
je 0x40c318
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c318
test byte [ebp - 8], 1
jne 0x40c323
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c353
mov eax, dword [0x435344]
cmp eax, edi
je 0x40c350
push eax
call ebx
test eax, eax
je 0x40c350
call eax
mov esi, eax
test esi, esi
je 0x40c350
mov eax, dword [0x435348]
cmp eax, edi
je 0x40c350
push eax
call ebx
test eax, eax
je 0x40c350
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x435340]
call ebx
test eax, eax
je 0x40c36b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c36d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b05
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40c828
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407067
mov dword [ebp - 0x14], eax
cmp dword [0x4adc74], esi
jne 0x40c91b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c8a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c9fb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c9fb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c9fb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4adc74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4adc78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4adc7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4adc84], eax
test eax, eax
je 0x40c918
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4adc80], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c940
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c933
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c955
push 4
pop eax
jmp 0x40c9fd
cmp dword [ebp - 0x14], esi
je 0x40c955
push dword [0x4adc74]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c93a
mov eax, dword [0x4adc80]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9b3
cmp dword [0x4adc84], edi
je 0x40c9b3
push eax
call ebx
push dword [0x4adc84]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9b3
test eax, eax
je 0x40c9b3
call ecx
test eax, eax
je 0x40c9a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c9a8
test byte [ebp - 8], 1
jne 0x40c9b3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c9e3
mov eax, dword [0x4adc78]
cmp eax, edi
je 0x40c9e0
push eax
call ebx
test eax, eax
je 0x40c9e0
call eax
mov esi, eax
test esi, esi
je 0x40c9e0
mov eax, dword [0x4adc7c]
cmp eax, edi
je 0x40c9e0
push eax
call ebx
test eax, eax
je 0x40c9e0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4adc74]
call ebx
test eax, eax
je 0x40c9fb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c9fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f7b
mov esp, ebp
pop ebp
ret
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.1001a050
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call fcn.1001a050
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1001a050
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call fcn.1001a050
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call fcn.1001a050
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000de00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005719c
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x820], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebx + 4]
add eax, 4
push eax
call fcn.1001a050
add esp, 0xc
test eax, eax
jne 0x1000e004
push 0x10060560
push dword [ebx + 4]
call fcn.1001a050
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000e009
mov eax, dword [ebx + 4]
push 2
push 0
push 0
mov edi, dword [eax + 0x18]
push edi
mov dword [ebp - 0x824], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x1000ded4
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
push 0
push 0
push 0
push edi
mov esi, eax
mov ebx, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x14
test eax, eax
je 0x1000deef
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
mov eax, 0x34
jmp 0x1000e00b
push dword [ebp - 0x814]
lea ecx, [ebp - 0x81c]
call fcn.1001a050
push 0x10060570
push dword [ebp - 0x818]
mov dword [ebp - 4], 0
call fcn.1001a050
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x814], eax
mov eax, esi
or eax, ebx
je 0x1000df99
mov eax, 0x800
nop
push dword [ebp - 0x824]
cmp esi, 0x800
mov edi, esi
push 1
cmova edi, eax
lea eax, [ebp - 0x810]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x1000dffd
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push 1
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x1000dffd
sub esi, edi
mov eax, esi
sbb ebx, 0
or eax, ebx
mov eax, 0x800
jne 0x1000df40
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::File::close_void_
mov edi, eax
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
add eax, 4
push eax
call fcn.1001a050
push dword [ebp - 0x828]
mov eax, dword [ebp - 0x818]
push dword [ebp - 0x82c]
add eax, 4
push eax
call fcn.10033ac0
add esp, 0x10
mov edi, eax
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_void___thiscall_ScCore::File::destructor_void_
jmp 0x1000e009
mov edi, 0x34
jmp 0x1000dfd9
mov edi, 0x30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret 4
Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call fcn.1001a050
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x1001a050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001a05f
pop dword [ebp - 0x28]
mov eax, 0xd4c05247
add eax, 0x3b414e18
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xad21007a
sub dword [ebp - 0x38], 0x5ecebb2f
mov dword [ebp - 0x34], 0x662e1cdf
sub dword [ebp - 0x34], 0x33fad09a
mov dword [ebp - 0x30], 0xcb4e3ce9
add dword [ebp - 0x30], 0x80fe0745
mov dword [ebp - 0x2c], 0x7bf56659
add dword [ebp - 0x2c], 0x840a99a7
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd56fc091
add dword [ebp - 0x38], 0x9f02a8c5
mov dword [ebp - 0x34], 0xb0af90c8
sub dword [ebp - 0x34], 0x6f432f53
mov dword [ebp - 0x30], 0x8af0864a
sub dword [ebp - 0x30], 0x278119de
mov dword [ebp - 0x2c], 0x2897cefc
add dword [ebp - 0x2c], 0xd7683104
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x948068f1
add eax, 0x7b85572b
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x58c7f
push 0
call eax
mov ecx, 0x9103cc1a
sub ecx, 0x91036e1b
xor edx, edx
add edx, eax
mov edi, 0x3b96e7ca
add edi, 0xd4723436
add edi, dword [ebp - 0x28]
mov esi, 0x2f3d709a
xor dword [ebp - 0x24], ecx
mov ebx, dword [edi]
xor dword [ebp - 0x20], edi
xor ebx, esi
xor dword [ebp - 4], edx
mov dword [edx], ebx
add dword [ebp - 0x20], 0xff8e5843
add edx, 0x634500db
add edx, 0x9cbaff29
add edi, 0xbf3a321f
sub edi, 0xbf3a321b
loop 0x1001a178
add eax, 0x16acf
mov ebx, eax
add eax, 0x760dd2c7
sub eax, 0x760dd2c2
mov ecx, 0xb7b9eb5d
sub ecx, 0xa7b9eb5d
add ecx, dword [ebp - 0x28]
call ebx
leave
ret