joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015efb4
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1015f14b
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1015f123
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1015f123
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1015f0d8
jg 0x1015f010
test eax, eax
je 0x1015f0ce
push 1
push 0x1000
call fcn.101555d9
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1015f033
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1015f0c5
push 0x8000
push ebx
call fcn.1015eeae
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1015f05c
jg 0x1015f057
cmp ecx, 0x1000
jb 0x1015f05c
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10159112
add esp, 0x10
cmp eax, 0xffffffff
je 0x1015f0a1
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1015f057
jl 0x1015f088
test ecx, ecx
jne 0x1015f049
push dword [ebp - 0xc]
push ebx
call fcn.1015eeae
push esi
call fcn.10154dc4
add esp, 0xc
xor ebx, ebx
jmp 0x1015f131
cmp byte [edi + 0x24], 0
je 0x1015f0b8
cmp dword [edi + 0x20], 5
jne 0x1015f0b8
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1015f0c3
mov ebx, dword [edi + 0x18]
jmp 0x1015f0c5
xor ebx, ebx
push esi
call fcn.10154dc4
pop ecx
jmp 0x1015f131
test ecx, ecx
jg 0x1015f09a
jl 0x1015f0d8
test eax, eax
jae 0x1015f09a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1015d698
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1015f0f8
cmp byte [edi + 0x1c], 0
je 0x1015f09a
jmp 0x1015f129
push ebx
call fcn.10158820
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1015f09a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1015f131
cmp byte [edi + 0x1c], 0
je 0x1015f12e
mov ebx, dword [edi + 0x18]
jmp 0x1015f131
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1015d698
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx