joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c210
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001c2bb
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001c27b
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001c2a5
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x14]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001c2b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001c2b4
mov ecx, dword [ebp - 0x14]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1001c2c9
mov esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x208]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001c2d2
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, 0x41
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ax, word [edx]
lea ecx, [ebp - 4]
push 1
push ecx
mov word [ebx + 0x29a], ax
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001c316
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [0x100278f8]
push 0
mov dword [ebx + 0x29c], edx
lea edx, [ebp - 0xc]
push edx
push 0x2a0
push ebx
push 0x2a0
push ebx
push 0x2201c0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test esi, esi
je 0x1001c369
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov esi, 1
test edi, edi
je 0x1001c378
mov esi, dword [ebx + 0x28e]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6ec
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x6e8], eax
mov eax, dword [0x100278f8]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x220]
mov dword [esp + 0x10], 0
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001c3d0
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x22c
lea edx, [esp + 0x2c4]
push edx
push 0x2a0
lea eax, [esp + 0x2c]
push eax
push 0x2201ac
push ebx
call edi
test eax, eax
je 0x1001c533
test byte [esp + 0x2c8], 0x14
jne 0x1001c533
cmp dword [esp + 0x2d4], 0
jne 0x1001c533
lea ecx, [esp + 0x10]
push 1
push ecx
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001c458
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6e8]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0
lea eax, [esp + 0x18]
push eax
push 0x2a0
lea ecx, [esp + 0x24]
push ecx
push 0x2a0
mov dword [esp + 0x2c8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x2b6], edx
mov edx, ecx
push edx
push 0x2201a4
push ebx
call edi
mov edi, eax
test esi, esi
je 0x1001c4ae
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
jne 0x1001c4ce
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6e8]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x2a6]
mov esi, eax
test eax, eax
jne 0x1001c538
mov al, 8
test byte [ebp + 0xc], al
jne 0x1001c4eb
test byte [esp + 0x2cc], al
je 0x1001c538
lea eax, [esp + 0x2dc]
push eax
push 0x1001f434
lea ecx, [esp + 0x4f0]
push 0x104
push ecx
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea edx, [esp + 0x4e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6e8]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov esi, 8
mov ecx, dword [esp + 0x6f4]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
Function at 0x1001c550
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001c5fb
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001c5bb
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001c5e5
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x14]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001c5f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001c5f4
mov ecx, dword [ebp - 0x14]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1001c609
mov esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001c619
mov ecx, 0x41
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 4]
push 1
push edx
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001c633
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, dword [0x100278f8]
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2a0
push ebx
push 0x2a0
push ebx
push 0x2201a0
push ecx
mov dword [ebx + 0x29c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebx + 0x28a], edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test esi, esi
je 0x1001c690
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
jne 0x1001c6a9
push ebx
lea esi, [edi + 1]
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x292]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebx + 0x28e]
push ebx
mov dword [eax], edx
call sym.dcapi.dll_secure_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c6d0
Capabilities:
Allocate or change rwx memory
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x40
push 0x3000
push 0x2a0
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x2a0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001c77c
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001c73a
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001c764
mov ecx, dword [0x100278f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 8
lea eax, [ebp - 0x14]
push eax
push 0x2201f0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001c773
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001c773
mov ecx, dword [ebp - 0x14]
push 0x2a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov edx, dword [ebp - 0x14]
mov ebx, edx
test edx, edx
jne 0x1001c789
mov esi, 9
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
add edx, 0x208
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x1001c792
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebx + 0x28a], edx
test esi, esi
je 0x1001c7be
push edi
mov ecx, 0x41
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp + 0x14]
cmp eax, 0xffffffff
jne 0x1001c7f8
lea eax, [ebp - 4]
push 1
push eax
call sym.dcapi.dll_checker_dc_obtain_structure_info
add esp, 8
cmp eax, 1
jne 0x1001c7df
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
call fcn.10016ac0
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebx + 0x29c], edx
jmp 0x1001c80e
test eax, eax
jne 0x1001c808
mov dword [ebx + 0x29c], 0xffffffff
jmp 0x1001c80e
mov dword [ebx + 0x29c], eax
mov eax, dword [0x100278f8]
push 0
lea edx, [ebp - 0xc]
push edx
push 0x2a0
push ebx
push 0x2a0
push ebx
push 0x22019c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x1001c84b
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test esi, esi
mov esi, 1
je 0x1001c85a
mov esi, dword [ebx + 0x28e]
push ebx
call sym.dcapi.dll_secure_free
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c870
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x854
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x850], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x1001c959
lea edi, [esp + 0x10]
lea ecx, [esp + 0x650]
call fcn.1001b390
test eax, eax
je 0x1001c8d4
mov ecx, edi
push ecx
call sym.dcapi.dll_dc_next_volume
add esp, 4
test eax, eax
jne 0x1001c959
mov esi, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [esp + 0x434], 1
je 0x1001c8f9
lea edx, [esp + 0x14]
push 1
push edx
call sym.dcapi.dll_dc_unmount_volume
add esp, 8
mov ecx, dword [esp + 0x10]
push 0x104
lea eax, [esp + 0x654]
push eax
push ecx
call esi
call ebx
cmp eax, 0x12
je 0x1001c94e
lea edi, [esp + 0x10]
lea ecx, [esp + 0x650]
call fcn.1001b390
test eax, eax
je 0x1001c8e0
mov edx, edi
push edx
call sym.dcapi.dll_dc_next_volume
add esp, 4
test eax, eax
je 0x1001c8e0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x850]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1000d340
mov esp, ebp
pop ebp
ret

Function at 0x1001cca0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x800
push eax
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x804]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 0x814]
push ecx
push 0x800
lea edx, [ebp - 0x804]
push edx
push 0xc
lea eax, [ebp - 0x810]
push eax
push 0x2d1400
push edi
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x80c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001cd31
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x7f8]
mov byte [esi], 0
mov eax, esi
test ecx, ecx
je 0x1001cd53
mov eax, ecx
push esi
lea ecx, [ebp - 0x804]
call fcn.1001c970
add esp, 4
add eax, esi
cmp dword [ebp - 0x7f4], 0
je 0x1001cd79
cmp eax, esi
je 0x1001cd64
mov byte [eax], 0x20
inc eax
push eax
mov eax, dword [ebp - 0x7f4]
lea ecx, [ebp - 0x804]
call fcn.1001c970
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
cmp byte [esi], al
sete al
xor ecx, ebp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
Function at 0x1001ceb0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1001cf1f
dec eax
je 0x1001cee3
sub eax, 2
jne 0x1001cf3c
mov eax, dword [0x100278f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1001cf3c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100278f8], eax
cmp eax, 0xffffffff
jne 0x1001cef9
xor eax, eax
pop ebp
ret 0xc
push str.DISKCRYPTOR_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp + 8]
mov dword [0x10027848], eax
mov dword [0x100278f4], ecx
mov eax, 1
pop ebp
ret 0xc
mov eax, dword [0x10027848]
test eax, eax
je 0x1001cf2f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x100278f8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1001cff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
test ecx, ecx
jle 0x1001d0b5
mov edx, dword [0x100278bc]
mov eax, dword [0x100278b8]
push esi
push edi
nop
mov ecx, dword [ebp + 8]
mov cl, byte [ebx + ecx]
mov byte [eax + edx], cl
inc eax
mov dword [0x100278b8], eax
cmp eax, 0x2000
jne 0x1001d0a6
mov edi, edx
mov edx, dword [0x100278f8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001d065
push eax
push eax
push 3
push eax
push eax
push eax
push str..dcrypt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001d08b
mov eax, dword [0x100278f8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x2000
push edi
push 0x2201b0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001d08b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x100278bc]
mov ecx, 0x2000
mov eax, edx
mov byte [eax], 0
inc eax
dec ecx
jne 0x1001d098
xor eax, eax
mov dword [0x100278b8], eax
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x1001d010
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov eax, dword [ebp + 8]
pop ebx
test ecx, ecx
je 0x1001d0c7
lea ecx, [ecx]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1001d0c0
mov esp, ebp
pop ebp
ret
Function at 0x1001d4d0
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Execute shellcode via indirect call
Generate random numbers via winapi
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
push 0x40
push 0x3000
push 0x2000
push 0
mov dword [esp + 0x24], 0x2000
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001d540
push 0
push 0
push 8
lea eax, [esp + 0x1c]
push eax
push 0x2201f0
call sym.dcapi.dll_dc_device_control
add esp, 0x14
test eax, eax
je 0x1001d53c
mov ecx, dword [esp + 0x10]
push 0x2000
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov eax, dword [esp + 0x10]
mov dword [0x100278bc], eax
test eax, eax
jne 0x1001d562
mov eax, 9
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push eax
push 0
push 0x1001d170
push 7
call edi
mov dword [0x100278b4], eax
call esi
push eax
push 0
push 0x1001d0d0
push 2
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push 0
push 0
lea edx, [esp + 0x1c]
push edx
mov dword [0x100278c0], eax
call esi
test eax, eax
jne 0x1001d5be
push 8
push 1
push eax
push eax
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
je 0x1001d5f2
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push 0x200
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
lea eax, [esp + 0x18]
push 0x200
push eax
call fcn.1001cff0
mov ecx, dword [esp + 0x14]
add esp, 8
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call sym.dcapi.dll_rnd_reseed_now
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1000d340
mov esp, ebp
pop ebp
ret
Function at 0x1001d840
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x66c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push str._s
lea eax, [esp + 0x268]
push 0x208
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x1001d900
mov ebx, 0x2c
test byte [esp + 0x10], 0x10
jne 0x1001d8df
lea eax, [esp + 0x3c]
push eax
push esi
push str._s_s
lea ecx, [esp + 0x26c]
push 0x208
push ecx
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x14
lea edx, [esp + 0x260]
push edx
push edi
call fcn.1001d610
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1001d8f3
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001d8a0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1001d90c
push esi
push edi
call fcn.1001d610
add esp, 8
mov ebx, eax
mov ecx, 0x250
lea eax, [esp + 0x10]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1001d915
mov ecx, 0x410
lea eax, [esp + 0x260]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1001d928
mov ecx, dword [esp + 0x674]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1000d340
mov esp, ebp
pop ebp
ret
Function at 0x1001d950
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 0x4c]
push eax
mov eax, esi
call fcn.10015400
lea edx, [esi + 0xd0]
mov eax, edx
mov ecx, 0x20
xor dword [eax], 0x6a6a6a6a
add eax, 4
dec ecx
jne 0x1001d973
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
mov ebx, 0x80
mov dword [ebp - 8], edx
jmp 0x1001da06
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x1001da32
cmp ebx, 0x80
jb 0x1001da32
push esi
call fcn.10014730
add esp, 4
add dword [esi + 0x40], 0x400
adc dword [esi + 0x44], 0
sub dword [ebp - 8], 0xffffff80
add ebx, 0xffffff80
jmp 0x1001da7d
mov edi, 0x80
sub edi, eax
cmp edi, ebx
jbe 0x1001da3f
mov edi, ebx
push edi
push edx
lea edx, [eax + esi + 0x4c]
push edx
call sub.msvcrt.dll_memcpy
add dword [esi + 0x48], edi
add dword [ebp - 8], edi
add esp, 0xc
sub ebx, edi
cmp dword [esi + 0x48], 0x80
jne 0x1001da7d
lea edx, [esi + 0x4c]
push esi
call fcn.10014730
add esp, 4
add dword [esi + 0x40], 0x400
mov eax, 0
mov dword [esi + 0x48], eax
adc dword [esi + 0x44], eax
test ebx, ebx
jne 0x1001da03
push 0x40
lea eax, [ebp - 0x4c]
push eax
call fcn.100154d0
mov ecx, dword [ebp + 8]
push ecx
mov eax, esi
call fcn.10015400
lea edi, [ebp - 0x4c]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001dac0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
push 0x80
lea edi, [esi + 0xd0]
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp ebx, 0x80
jbe 0x1001db05
mov eax, esi
call fcn.100146b0
mov eax, dword [ebp + 8]
push ebx
push eax
call fcn.100154d0
push edi
mov eax, esi
call fcn.10015400
jmp 0x1001db13
mov ecx, dword [ebp + 8]
push ebx
push ecx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, edi
mov ecx, 0x20
lea ebx, [ebx]
xor dword [eax], 0x36363636
add eax, 4
dec ecx
jne 0x1001db20
xor eax, eax
mov edx, edi
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
mov ebx, 0x80
mov dword [ebp + 8], edx
jmp 0x1001dbb5
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x1001dbe1
cmp ebx, 0x80
jb 0x1001dbe1
push esi
call fcn.10014730
add esp, 4
add dword [esi + 0x40], 0x400
adc dword [esi + 0x44], 0
sub dword [ebp + 8], 0xffffff80
add ebx, 0xffffff80
jmp 0x1001dc2c
mov edi, 0x80
sub edi, eax
cmp edi, ebx
jbe 0x1001dbee
mov edi, ebx
push edi
push edx
lea eax, [eax + esi + 0x4c]
push eax
call sub.msvcrt.dll_memcpy
add dword [esi + 0x48], edi
add dword [ebp + 8], edi
add esp, 0xc
sub ebx, edi
cmp dword [esi + 0x48], 0x80
jne 0x1001dc2c
lea edx, [esi + 0x4c]
push esi
call fcn.10014730
add esp, 4
add dword [esi + 0x40], 0x400
mov eax, 0
mov dword [esi + 0x48], eax
adc dword [esi + 0x44], eax
test ebx, ebx
jne 0x1001dbb2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8