joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2350
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x53e008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4d23b5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d2390
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4d23b5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004ec151
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004ec151
add esp, 8
ret 4
Function at 0x4e7f70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4e7f7b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004e7f90
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7fa540cd
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x74e6cc8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x39840866
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x33420e26
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x9d12e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9d132c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9d12f2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9d1390
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9d13e2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9d13e8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9e98d5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009e9595

Function at 0x9ee6cf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009ee54e

Function at 0x9f3c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9f3cad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9f3cad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403a69
nop
nop
sub eax, 0x403a0f
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x10002690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100946d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100c29e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100659e6
mov esi, eax
add esp, 4
test esi, esi
je 0x100026e9
push 1
mov dword [ebp - 4], 0
call fcn.1004f977
add esp, 4
mov dword [esi + 4], eax
jmp 0x100026eb
xor esi, esi
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x2c], edx
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [0x100c7df4]
mov ecx, dword [0x100c7df8]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100c29e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c7d54], 0
jne 0x10004d47
push esi
push edi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x39]
call fcn.100044c0
mov esi, eax
mov edi, 4
lea edx, [esi + 4]
movsx cx, byte [esi]
lea edx, [edx + 0xc]
xor word [edx - 0xe], cx
movsx eax, byte [esi]
xor word [edx - 0xc], ax
movsx eax, byte [esi]
xor word [edx - 0xa], ax
movsx eax, byte [esi]
xor word [edx - 8], ax
movsx eax, byte [esi]
xor word [edx - 6], ax
movsx eax, byte [esi]
xor word [edx - 4], ax
sub edi, 1
jne 0x10004c95
xor eax, eax
mov word [esi + 0x32], ax
lea eax, [esi + 2]
push eax
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
lea ecx, [ebp - 0x39]
test eax, eax
jne 0x10004d55
lea eax, [ebp - 0x38]
push eax
call fcn.10004530
mov esi, eax
mov edi, 4
lea edx, [esi + 4]
nop dword [eax + eax]
movsx cx, byte [esi]
lea edx, [edx + 0xc]
xor word [edx - 0xe], cx
movsx eax, byte [esi]
xor word [edx - 0xc], ax
movsx eax, byte [esi]
xor word [edx - 0xa], ax
movsx eax, byte [esi]
xor word [edx - 8], ax
movsx eax, byte [esi]
xor word [edx - 6], ax
movsx eax, byte [esi]
xor word [edx - 4], ax
sub edi, 1
jne 0x10004d00
xor eax, eax
mov word [esi + 0x32], ax
lea eax, [esi + 2]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065d4c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call fcn.10004470
mov esi, eax
mov edi, 3
lea ecx, [esi + 4]
nop dword [eax + eax]
movsx dx, byte [esi]
lea ecx, [ecx + 0xa]
xor word [ecx - 0xc], dx
movsx eax, byte [esi]
xor word [ecx - 0xa], ax
movsx eax, byte [esi]
xor word [ecx - 8], ax
movsx eax, byte [esi]
xor word [ecx - 6], ax
movsx eax, byte [esi]
xor word [ecx - 4], ax
sub edi, 1
jne 0x10004d70
xor eax, eax
mov word [esi + 0x20], ax
lea eax, [esi + 2]
push eax
call fcn.1000bdd0
add esp, 4
push edi
call fcn.1007752b
int3
Function at 0x10006cd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094d65
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100c29e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
xor eax, eax
mov dword [ebp - 0x5c], 0
push 0x1009d6e0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
call fcn.10007f80
mov byte [ebp - 4], 1
mov al, 0x10
mov dword [ebp - 0x2c], 0x4c0010
xor ecx, ecx
mov dword [ebp - 0x28], 0x750054
mov dword [ebp - 0x24], 0x710076
mov dword [ebp - 0x20], 0x7c0065
mov dword [ebp - 0x1c], 0x590064
mov dword [ebp - 0x18], 0x7f0073
mov dword [ebp - 0x14], 0x7e
cbw
xor word [ebp + ecx*2 - 0x2a], ax
inc ecx
cmp ecx, 0xc
jae 0x10006d74
mov al, byte [ebp - 0x2c]
jmp 0x10006d62
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10001a00
mov ecx, dword [ebp - 0x48]
add esp, 0xc
cmp ecx, 8
jb 0x10006dc8
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006dbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006ee0
push ecx
push edx
call fcn.10065a16
add esp, 8
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0x103
push 0
push 0
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push 0
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10006e47
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, eax
push eax
push ecx
push 1
push 0
lea eax, [ebp - 0x5e]
mov dword [ebp - 0x60], 0xc
push eax
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x10006e7d
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006e73
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006ee5
push ecx
push edx
call fcn.10065a16
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp ecx, 8
jb 0x10006ec7
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006ebd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006ee5
push ecx
push edx
call fcn.10065a16
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10065d4c
mov esp, ebp
pop ebp
ret
call fcn.10071200
call fcn.10071200
int3
Function at 0x100070e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x1000710b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100070f4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x1000bfe0
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095062
mov eax, dword fs:[0]
push eax
sub esp, 0xc2c
mov eax, dword [0x100c29e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc34], esi
mov dword [ebp - 0xc2c], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x200
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0xc2c], 1
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov edi, eax
nop dword [eax]
lea eax, [ebp - 0xc38]
push eax
push 0x400
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x1000c1b5
push 0
push 0
lea eax, [ebp - 0xc30]
push eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1000c1b5
test dword [ebp - 0xc30], 0x80000
jne 0x1000c1b5
lea eax, [ebp - 0xc10]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000c0d0
sub eax, edx
mov dword [ebp - 0xc28], 0
sar eax, 1
xor edx, edx
mov word [ebp - 0xc28], dx
lea edx, [ebp - 0xc10]
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0xc14], 7
lea ecx, [eax + eax]
lea eax, [ebp - 0xc10]
add eax, ecx
cmp edx, eax
je 0x1000c12c
sar ecx, 1
mov eax, edx
push ecx
push eax
lea ecx, [ebp - 0xc28]
call fcn.10007f80
mov eax, dword [esi + 4]
mov dword [ebp - 4], 1
cmp eax, dword [esi + 8]
je 0x1000c166
movups xmm0, xmmword [ebp - 0xc28]
mov ecx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0xc18]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [esi + 4], 0x18
mov word [ebp - 0xc28], ax
jmp 0x1000c17b
lea ecx, [ebp - 0xc28]
push ecx
push eax
mov ecx, esi
call fcn.1000be00
mov ecx, dword [ebp - 0xc14]
mov byte [ebp - 4], 0
cmp ecx, 8
jb 0x1000c1b5
mov edx, dword [ebp - 0xc28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000c1ab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000c1f4
push ecx
push edx
call fcn.10065a16
add esp, 8
push 0x200
lea eax, [ebp - 0x410]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x1000c060
push edi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10065d4c
mov esp, ebp
pop ebp
ret
call fcn.10071200
int3
Function at 0x1000e0a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095395
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100c29e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
push 0x40
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], esi
call fcn.100077f0
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov edi, eax
mov dword [ebp - 0x18], 0x37
mov eax, 0x3f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x1009eb08]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [0x1009eb18]
movups xmmword [edi + 0x20], xmm0
mov eax, dword [0x1009eb28]
mov dword [edi + 0x30], eax
mov ax, word [0x1009eb2c]
mov word [edi + 0x34], ax
mov al, byte [0x1009eb2e]
mov byte [edi + 0x36], al
mov byte [edi + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
push 0x40
mov byte [ebp - 4], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.100077f0
mov dword [esi + 0x10], eax
mov ecx, 0x3f
movups xmm0, xmmword [edi]
inc ecx
push ecx
movups xmmword [eax], xmm0
push edi
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [edi + 0x30]
movq qword [eax + 0x30], xmm0
mov dword [esi + 0x20], 0x37
mov dword [esi + 0x24], 0x3f
mov esi, dword [ebp - 0x2c]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
call fcn.10065a16
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10065d4c
mov esp, ebp
pop ebp
ret
Function at 0x1000e270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095395
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100c29e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
push 0x40
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], esi
call fcn.100077f0
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov edi, eax
mov dword [ebp - 0x18], 0x37
mov eax, 0x3f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], eax
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x1009eb08]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [0x1009eb18]
movups xmmword [edi + 0x20], xmm0
mov eax, dword [0x1009eb28]
mov dword [edi + 0x30], eax
mov ax, word [0x1009eb2c]
mov word [edi + 0x34], ax
mov al, byte [0x1009eb2e]
mov byte [edi + 0x36], al
mov byte [edi + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
push 0x40
mov byte [ebp - 4], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.100077f0
mov dword [esi + 0x10], eax
mov ecx, 0x3f
movups xmm0, xmmword [edi]
inc ecx
push ecx
movups xmmword [eax], xmm0
push edi
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [edi + 0x30]
movq qword [eax + 0x30], xmm0
mov dword [esi + 0x20], 0x37
mov dword [esi + 0x24], 0x3f
mov esi, dword [ebp - 0x2c]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
call fcn.10065a16
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::Filter_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10065d4c
mov esp, ebp
pop ebp
ret
Function at 0x100131f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095cfd
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x100c29e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x14]
push esi
mov dword [ebp - 4], 0
call fcn.10065a24
mov edi, eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
add esp, 4
mov dword [ebp - 0x1c], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
movlpd qword [ebp - 0x24], xmm0
push eax
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x24]
push esi
push edi
add ecx, 4
push edi
call fcn.10039570
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push dword [ebp + 8]
call esi
push edi
call fcn.10065a2d
mov ecx, dword [ebp + 0xc]
add esp, 4
add dword [ebp + 0x14], ecx
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
adc eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x18], eax
add ecx, 0x124
mov eax, dword [ebp + 0x20]
adc eax, 0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], 0
push eax
push 8
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], ecx
push eax
push dword [ebp + 8]
mov dword [ebp + 0x10], 0
call esi
mov eax, dword [ebp + 0x24]
mov ecx, eax
mov dword [eax], 0x1009e940
mov dword [eax + 4], 0x1009e988
mov dword [eax + 8], 0x1009e9cc
mov dword [eax + 0x20], 0x1009ea00
call fcn.1000efa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x20

Function at 0x10014e30
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x100152e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
ret
Function at 0x10019f30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
cmp eax, 4
jb 0x10019f64
mov esi, eax
shr esi, 2
nop dword [eax]
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x10019f50
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
test eax, eax
je 0x1001a044
mov ebx, edi
sub ebx, edx
cmp eax, 8
jb 0x1001a02a
mov ecx, eax
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
mov dword [esp + 0x1c], ecx
lea ecx, [edx + 4]
nop dword [eax]
movd xmm2, dword [edi + ebp]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 0xc]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add ebp, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ecx - 8]
por xmm4, xmm2
movd xmm2, dword [ebx + ecx - 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ebp, dword [esp + 0x1c]
jb 0x10019fb0
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x1001a044
lea edi, [edx + ebp]
sub eax, ebp
nop
movzx edx, byte [ebx + edi]
lea edi, [edi + 1]
movzx ecx, byte [edi - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x1001a030
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
ret