joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f09c
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x17ac]
mov eax, 0x182c
call fcn.10036910
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp + 0x17a8], eax
push esi
push edi
push 4
pop esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
mov edi, ecx
push edi
push str.Softwareprojonepodlp_smpcache_
push 0x80000002
mov dword [ebp - 0x64], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1001f0f0
cmp dword [ebp - 0x60], esi
jne 0x1001f0f0
mov eax, dword [ebp - 0x5c]
jmp 0x1001f0f2
xor eax, eax
test eax, eax
je 0x1001f1bc
push ebx
push 0x7fe
lea eax, [ebp + 0xfaa]
push 0
push eax
call fcn.1002d190
mov ebx, dword [sym.imp.SHLWAPI.dll_StrNCatW]
add esp, 0xc
push 0x5b
pop eax
push 0x400
mov word [ebp + 0xfa8], ax
push edi
lea eax, [ebp + 0xfa8]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10049750
lea eax, [ebp + 0xfa8]
push eax
call edi
lea eax, [ebp - 0x80]
push eax
call fcn.1000dac8
cmp dword [eax + 0x18], 8
pop ecx
jb 0x1001f159
mov eax, dword [eax + 4]
jmp 0x1001f15c
add eax, 4
push eax
lea eax, [ebp + 0xfa8]
push eax
call edi
push 0
push 1
lea esi, [ebp - 0x80]
call fcn.100027cd
push 0x10049758
lea eax, [ebp + 0xfa8]
push eax
call edi
push 0x400
push dword [ebp + 0x17b4]
lea eax, [ebp + 0xfa8]
push eax
call ebx
lea eax, [ebp + 0x17b8]
push eax
lea eax, [ebp + 0xfa8]
push eax
push 0x800
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebx
mov ecx, dword [ebp + 0x17a8]
pop edi
xor ecx, ebp
pop esi
call fcn.1002ada2
add ebp, 0x17ac
leave
ret

Function at 0x1001f34e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x1001f35f
mov eax, dword [eax + 4]
jmp 0x1001f362
add eax, 4
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push str.Softwareprojonepodlpkeyrule_secClass_
push 0x80000002
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1001f398
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.1000e57c
leave
ret
xor eax, eax
leave
ret
Function at 0x1001ff39
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
xor ebx, ebx
inc ebx
push ebx
mov edi, ecx
push edi
push eax
mov dword [ebp - 0x24], eax
call esi
test eax, eax
jne 0x10020003
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1001ff95
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001ff8c
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push edi
push dword [ebp - 0x24]
call esi
jmp 0x10020005
call fcn.1000d6b3
push eax
push edi
push str._s._08x
lea ecx, [ebp - 0x20]
call fcn.1000e4c4
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x1001ffb8
lea eax, [ebp - 0x1c]
push ebx
push eax
push edi
call esi
test eax, eax
je 0x1001ffff
push ebx
push edi
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x1001ffee
cmp dword [ebp - 8], 8
mov esi, dword [ebp - 0x1c]
jae 0x1001ffd8
lea esi, [ebp - 0x1c]
call fcn.1000d44a
mov edi, ebx
push 0
push ebx
lea esi, [ebp - 0x20]
call fcn.100027cd
mov eax, edi
jmp 0x10020005
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x1001fffa
lea eax, [ebp - 0x1c]
push ebx
push edi
push eax
call esi
xor edi, edi
jmp 0x1001ffdf
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ada2
leave
ret

Function at 0x10020034
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
test ebx, ebx
je 0x1002010c
push ebx
call fcn.100208a9
pop ecx
test eax, eax
je 0x1002010c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.1002d190
add esp, 0xc
call fcn.1000d6b3
push eax
push ebx
push str._s._08x
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.10020014
and dword [ebp - 0x228], 0
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
push ebx
lea esi, [ebp - 0x228]
stosd dword es:[edi], eax
call fcn.1001fadd
pop ecx
mov edi, eax
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.1001fd7e
pop ecx
pop ecx
test eax, eax
je 0x100200ff
xor esi, esi
lea eax, [ebp - 0x210]
push eax
mov ecx, ebx
call fcn.1001ff39
pop ecx
test eax, eax
jne 0x1002011c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x100200de
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002ada2
leave
ret
test edi, edi
je 0x1002012d
push ebx
lea esi, [ebp - 0x228]
call fcn.1001fb76
pop ecx
xor eax, eax
inc eax
jmp 0x1002010e
Function at 0x10020247
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x478
mov eax, 0x10044627
call fcn.1002bcea
mov esi, ecx
push esi
mov dword [ebp - 0x42c], esi
call fcn.10020132
pop ecx
test eax, eax
je 0x100204c0
push esi
call fcn.10020178
pop ecx
test eax, eax
je 0x100204c0
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x428], ebx
call fcn.1002d190
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.1000d6b3
push eax
push str.___08x
lea ecx, [ebp - 0x468]
call fcn.1000e4c4
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x100202d7
mov eax, dword [eax + 4]
jmp 0x100202da
add eax, 4
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp - 0x21c]
push eax
call edi
push ebx
push 1
lea esi, [ebp - 0x468]
call fcn.100027cd
lea esi, [ebp - 0x21c]
call fcn.1000d00a
test eax, eax
je 0x100204ac
mov ecx, dword [ebp - 0x42c]
mov edx, esi
call fcn.1001df53
test eax, eax
jne 0x100204ac
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
push ebx
lea eax, [ebp - 0x428]
push ebx
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x434]
push eax
push 0x100204c8
push 1
mov eax, esi
push eax
call fcn.1000cca3
cmp dword [ebp - 0x428], ebx
je 0x100204ac
xor eax, eax
push 0x206
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.1002d190
add esp, 0xc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x42c]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
cmp esi, ebx
je 0x100203b1
push str..rar
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100203b1
mov esi, str..zip
push esi
call fcn.1000d6b3
push eax
push str..._08x._s
lea ecx, [ebp - 0x468]
call fcn.1000e4c4
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x100203d6
mov eax, dword [eax + 4]
jmp 0x100203d9
add eax, 4
push eax
lea eax, [ebp - 0x424]
push eax
call edi
push ebx
push 1
lea esi, [ebp - 0x468]
call fcn.100027cd
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.1000cebd
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
call fcn.10022382
add esp, 0xc
mov ecx, eax
lea ebx, [ebp - 0x424]
mov byte [ebp - 4], 1
call fcn.1001daa9
mov ebx, eax
neg ebx
sbb bl, bl
lea edi, [ebp - 0x484]
inc bl
mov byte [ebp - 4], 0
call fcn.100028c2
push dword [ebp - 0x484]
call fcn.1002b251
pop ecx
test bl, bl
je 0x1002048a
xor esi, esi
mov ecx, dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
push eax
call fcn.1001ff39
pop ecx
test eax, eax
jne 0x10020491
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x10020456
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10020491
and dword [ebp - 0x428], 0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x44c]
call fcn.10002931
push dword [ebp - 0x44c]
call fcn.1002b251
pop ecx
lea eax, [ebp - 0x21c]
push eax
call fcn.1000d478
mov eax, dword [ebp - 0x428]
jmp 0x100204c2
xor eax, eax
call fcn.1002bd6d
ret
Function at 0x100204e9
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x10053060]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], eax
cmp ebx, esi
je 0x10020627
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10020627
xor eax, eax
push 0x206
mov word [esp + 0x34], ax
lea eax, [esp + 0x36]
push esi
push eax
mov dword [esp + 0x18], esi
call fcn.1002d190
add esp, 0xc
call fcn.1000d6b3
push eax
push ebx
push str._s._08x
lea eax, [esp + 0x3c]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.10020014
mov dword [esp + 0x1c], esi
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
push ebx
lea esi, [esp + 0x1c]
stosd dword es:[edi], eax
call fcn.1001fadd
pop ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.1001fe2d
xor esi, esi
pop ecx
inc esi
pop ecx
test eax, eax
je 0x100205e4
xor edi, edi
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
call fcn.1001ff39
pop ecx
test eax, eax
jne 0x100205c2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jl 0x100205a1
jmp 0x100205e4
cmp dword [ebp + 0xc], 2
mov dword [esp + 0xc], esi
jne 0x100205e4
push 2
mov ecx, ebx
call fcn.10020247
pop ecx
test eax, eax
je 0x100205e4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100205e4
mov dword [eax], esi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], esi
jne 0x1002060f
push esi
mov ecx, ebx
call fcn.10020247
pop ecx
test eax, eax
je 0x1002060f
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], esi
test eax, eax
je 0x1002060f
mov dword [eax], esi
cmp dword [esp + 0x14], 0
je 0x10020621
push ebx
lea esi, [esp + 0x1c]
call fcn.1001fb76
pop ecx
mov eax, dword [esp + 0xc]
jmp 0x10020629
xor eax, eax
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002ada2
mov esp, ebp
pop ebp
ret
Function at 0x1002300b
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x10040763
call fcn.1002bcea
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002302a
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10002d35
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x1002312f
jmp 0x1002305b
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x10048af8]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x1002306f
cmp al, 0xff
je 0x1002305b
cmp al, 0xff
je 0x1002312f
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x10048af8]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x1002308f
cmp cl, 0xff
je 0x10023077
cmp cl, 0xff
je 0x1002312f
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1000eee9
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002312f
movsx eax, al
mov al, byte [eax + 0x10048af8]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x100230cf
cmp al, 0xff
je 0x100230af
cmp al, 0xff
je 0x1002312f
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1000eee9
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002312f
movsx eax, al
mov cl, byte [eax + 0x10048af8]
cmp esi, dword [ebp - 0x30]
jae 0x1002310d
cmp cl, 0xff
je 0x100230ef
cmp cl, 0xff
je 0x1002312f
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.1000eee9
cmp esi, dword [ebp - 0x30]
jb 0x10023058
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.100021ee
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.100026d5
mov eax, dword [ebp - 0x38]
call fcn.1002bd6d
ret
Function at 0x1002407e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push edi
xor eax, eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x5c
lea edi, [ebp - 0x11]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
pop edi
cmp eax, 2
je 0x100240bc
cmp eax, 3
jne 0x100240d4
push ebx
call fcn.1000d7de
pop ecx
cmp eax, 0xffffffff
je 0x100240e1
cmp eax, 7
jne 0x100240d4
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
setne al
mov byte [esi], al
mov al, 1
jmp 0x100240e3
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ada2
leave
ret

Function at 0x100242ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x10024309
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10024305
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10024424
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.100245ea
mov bl, al
mov al, dl
call fcn.100245ea
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.100245ea
mov bl, al
mov al, byte [esi - 4]
call fcn.100245ea
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.100245ea
mov bl, al
mov al, byte [esi]
call fcn.100245ea
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.100245ea
mov bl, al
mov al, byte [esi - 0xc]
call fcn.100245ea
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1002444c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ada2
leave
ret 4
Function at 0x100244d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10024666
push ebx
mov dl, al
call fcn.1002463f
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.100245fa
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.10024618
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.100245fa
push ebx
mov byte [ebp - 0x15], al
call fcn.10024618
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.1002463f
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10024666
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.1002463f
mov bl, al
mov al, byte [edi + 4]
call fcn.10024666
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.10024618
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.100245fa
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.10024618
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.100245fa
xor bl, al
mov al, dl
call fcn.10024666
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1002463f
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10024505
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ada2
leave
ret 4

Function at 0x10024b58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test edx, edx
je 0x10024b7c
push esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x10054648]
dec edx
inc ecx
test edx, edx
jne 0x10024b60
pop esi
not eax
ret
Function at 0x10024cea
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x130
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x74]
and dword [ebp - 0xc4], 0
push esi
push edi
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x78]
push 0x3f
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x3f]
push 0
push eax
mov byte [ebp - 0x40], 0
call fcn.1002d190
mov esi, 0x10049694
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x40]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x9c], dl
mov byte [ebp + ecx], al
inc ecx
cmp ecx, 0x40
jb 0x10024d3a
lea eax, [ebp - 0x5c]
call fcn.1002a069
lea eax, [ebp - 0x9c]
push eax
push 0x40
pop eax
lea esi, [ebp - 0x5c]
call fcn.1002a094
push dword [ebp - 0xc0]
mov eax, dword [ebp + 0x7c]
call fcn.1002a094
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.1002a12c
lea eax, [ebp - 0xb8]
call fcn.1002a069
lea eax, [ebp]
push eax
push 0x40
pop eax
lea esi, [ebp - 0xb8]
call fcn.1002a094
lea eax, [ebp + 0x54]
push eax
push 0x14
pop eax
call fcn.1002a094
lea eax, [ebp + 0x40]
push eax
mov ecx, esi
call fcn.1002a12c
mov esi, dword [ebp - 0xbc]
add esp, 0x18
push 0x14
lea eax, [ebp + 0x40]
push eax
call fcn.1000ea8b
mov ecx, dword [ebp + 0x68]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002ada2
add ebp, 0x6c
leave
ret
Function at 0x10024de4
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push esi
push edi
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0xc]
push 0x3f
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0xa7]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0xa8], 0
call fcn.1002d190
add esp, 0xc
cmp dword [ebp + 0x14], 0x40
ja 0x10024e49
push dword [ebp + 0x14]
lea eax, [ebp - 0xa8]
push esi
push eax
call fcn.1002d6c0
add esp, 0xc
jmp 0x10024e82
lea eax, [ebp - 0x138]
call fcn.1002a1ed
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 0x138]
call fcn.1002a22d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x138]
call fcn.1002a2b9
pop ecx
pop ecx
push 0x10
pop ecx
lea esi, [ebp - 0x28]
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov al, byte [ebp + ecx - 0xa8]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x48], dl
mov byte [ebp + ecx - 0x110], al
inc ecx
cmp ecx, 0x40
jb 0x10024e84
lea eax, [ebp - 0xd0]
call fcn.1002a1ed
lea eax, [ebp - 0x48]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1002a22d
push dword [ebp - 0x13c]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xd0]
call fcn.1002a22d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
call fcn.1002a2b9
lea eax, [ebp - 0xd0]
call fcn.1002a1ed
lea eax, [ebp - 0x110]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1002a22d
lea eax, [ebp - 0x28]
push eax
push 0x20
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1002a22d
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xd0]
call fcn.1002a2b9
mov esi, dword [ebp - 0x140]
add esp, 0x18
push 0x20
lea eax, [ebp - 0x68]
push eax
call fcn.1000ea8b
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002ada2
leave
ret
Function at 0x10025244
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x10040365
call fcn.1002bcea
mov eax, dword [ebp + 8]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
push ebx
push 0x8000000
push 3
push ebx
push dword [ebp + edi*4 - 0x38]
push 0x80000000
push dword [ebp - 0x28]
call dword [0x10057340]
push eax
lea esi, [ebp - 0x20]
call fcn.10025208
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x100252ad
cmp ecx, 0xffffffff
jne 0x100252b3
inc edi
cmp edi, 4
jb 0x1002527d
cmp ecx, ebx
je 0x100252be
or eax, 0xffffffff
cmp ecx, eax
jne 0x100252ce
lea eax, [ebp - 0x20]
call fcn.10004037
xor eax, eax
call fcn.1002bd6d
ret
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
push ecx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x1c], 0x70bfbbef
jne 0x100252fb
cmp dword [ebp - 0x18], 0x706c646f
je 0x10025307
lea eax, [ebp - 0x20]
call fcn.10004037
mov eax, ebx
jmp 0x100252c8
mov eax, dword [ebp - 0x14]
dec eax
dec eax
je 0x10025316
dec eax
jne 0x100252fb
push 3
pop ebx
jmp 0x100252fb
push 2
jmp 0x10025313

Function at 0x1002535f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x190
mov eax, dword [esp + 8]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
add eax, ecx
shr edx, 0x10
xor byte [eax], dl
inc ecx
cmp ecx, 0x1000
jl 0x10025364
ret