joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036cbc
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 1
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x58], ebx
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, dword [ecx]
mov dword [ebx + 8], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0xc], eax
jb 0x10036e0f
push 0x38
pop eax
cmp dword [ebp + 0xc], eax
cmovbe eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push edx
push eax
call fcn.100e1b00
push 0x12
pop ecx
push 0x1000
lea edi, [ebx + 0x10]
mov esi, 0x101e9348
lea eax, [ebx + 0x58]
mov dword [ebp - 0x4c], edi
push 0x101e8348
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x54], eax
call fcn.100e1b00
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
add esp, 0x18
mov dword [ebp - 0x48], 0x12
xor esi, esi
push 4
xor edx, edx
pop ebx
movzx eax, byte [ecx]
shl edx, 8
or edx, eax
inc ecx
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 0x40]
lea ecx, [esi + 1]
cmp ecx, edi
cmovne eax, dword [ebp - 0x44]
xor esi, esi
cmp ecx, edi
mov dword [ebp - 0x44], eax
cmovne esi, ecx
mov ecx, eax
sub ebx, 1
jne 0x10036d4e
mov eax, dword [ebp - 0x4c]
xor dword [eax], edx
add eax, 4
sub dword [ebp - 0x48], 1
mov dword [ebp - 0x4c], eax
jne 0x10036d49
mov ebx, dword [ebp - 0x58]
and dword [ebp - 0x50], 0
and dword [ebp - 0x4c], 0
xor edi, edi
lea esi, [ebx + 0x14]
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
call fcn.10036e30
mov eax, dword [ebp - 0x50]
add edi, 2
mov dword [esi - 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [esi], eax
lea esi, [esi + 8]
cmp edi, 0x12
jb 0x10036d98
mov dword [ebp - 0x48], 4
lea eax, [ebx + 0x58]
xor edi, edi
mov esi, eax
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
call fcn.10036e30
mov eax, dword [ebp - 0x50]
add edi, 2
mov dword [esi], eax
lea esi, [esi + 8]
mov eax, dword [ebp - 0x4c]
mov dword [esi - 4], eax
cmp edi, 0x100
jl 0x10036dc7
mov eax, dword [ebp - 0x54]
add eax, 0x400
sub dword [ebp - 0x48], 1
mov dword [ebp - 0x54], eax
jne 0x10036dc3
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret 0xc
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], str.Incorrect_key_length
push eax
lea ecx, [ebp - 0x5c]
call fcn.10035a13
push 0x1026b484
mov eax, ecx
push eax
call fcn.100e172b
int3
Function at 0x10037625
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x101a1226
call fcn.1017516e
mov ebx, ecx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], edx
mov eax, 0xcce8
mov dword [ebp - 0x30], 0xcc8b
mov word [ebp - 0x2c], ax
add eax, 0xffffffc9
mov word [ebp - 0x2a], ax
mov eax, 0xccd7
mov word [ebp - 0x28], ax
add eax, 0x1b
mov word [ebp - 0x26], ax
mov eax, 0xccf9
mov word [ebp - 0x24], ax
add eax, 0xfffffff6
mov word [ebp - 0x22], ax
mov eax, 0xccfc
mov word [ebp - 0x20], ax
add eax, 0xffffffc1
mov word [ebp - 0x1e], ax
mov eax, 0xcca5
mov word [ebp - 0x1c], ax
add eax, 0x4e
mov word [ebp - 0x1a], ax
mov eax, 0xccee
mov word [ebp - 0x18], ax
add eax, 0xfffffff8
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
mov ax, word [ebp - 0x2c]
mov ax, word [ebp + edx*2 - 0x2c]
movzx ecx, ax
movzx eax, word [ebp - 0x30]
xor ecx, eax
mov word [ebp + edx*2 - 0x2c], cx
inc edx
cmp edx, 0xc
jb 0x100376ac
xor eax, eax
lea edx, [ebp - 0x38]
mov word [ebp - 0x14], ax
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
call fcn.10037c18
mov esi, dword [ebp - 0x34]
mov edi, eax
pop ecx
test edi, edi
js 0x100376f9
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], esi
push eax
lea ecx, [ebx + 8]
lea edx, [ebp - 0x3c]
call fcn.10037ce8
pop ecx
mov edi, eax
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10037708
push esi
call fcn.10174e26
pop ecx
mov eax, edi
call fcn.10175118
ret

Function at 0x10037774
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
lea edx, [ebp - 0x24]
call fcn.10037b28
test eax, eax
js 0x1003781e
push 0x6b
pop eax
mov word [ebp - 0x20], ax
push 0x42
pop eax
mov word [ebp - 0x1e], ax
push 0x64
pop eax
mov word [ebp - 0x1c], ax
add eax, 0x1d
mov word [ebp - 0x1a], ax
push 0x7a
pop eax
mov word [ebp - 0x18], ax
push 0x6c
pop eax
mov word [ebp - 0x16], ax
push 0x7f
pop eax
mov word [ebp - 0x14], ax
push 0x3e
pop eax
mov word [ebp - 0x12], ax
push 0x36
pop eax
mov word [ebp - 0x10], ax
add eax, 0x4a
mov word [ebp - 0xe], ax
push 0x6d
pop eax
mov word [ebp - 0xc], ax
push 0x75
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
xor ecx, ecx
mov ax, word [ebp - 0x20]
mov ax, word [ebp + ecx*2 - 0x20]
movzx eax, ax
add eax, 0xfffffff8
mov word [ebp + ecx*2 - 0x20], ax
inc ecx
cmp ecx, 0xc
jb 0x100377f4
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003781e
xor eax, eax
inc eax
jmp 0x10037820
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
leave
ret
Function at 0x10037c18
Capabilities:
Read file on windows

Disassembly:
push 0x18
mov eax, 0x101a1322
call fcn.1017513a
mov edi, edx
mov esi, ecx
push 0x10205d24
push dword [ebp + 8]
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
call fcn.100e9956
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10037c52
mov eax, 0xe0010001
jmp 0x10037ce2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0x18]
push eax
call fcn.10037e08
mov dword [ebp - 4], ebx
push 2
push ebx
push dword [ebp - 0x10]
call fcn.100eb59a
push dword [ebp - 0x10]
call fcn.100eb2ba
mov ebx, eax
lea ecx, [ebp - 0x14]
mov edx, ebx
call fcn.100175d2
mov byte [ebp - 4], 1
push 0
push 0
push dword [ebp - 0x10]
call fcn.100eb59a
push dword [ebp - 0x10]
push ebx
push 1
push dword [ebp - 0x14]
call fcn.100eb781
add esp, 0x30
test esi, esi
je 0x10037cb5
mov ecx, dword [esi]
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [ebp - 0x14], ecx
test edi, edi
je 0x10037cbb
mov dword [edi], ebx
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x10037cce
push dword [ebp - 0x14]
call fcn.10174e26
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x24], 0
jne 0x10037ce0
lea ecx, [ebp - 0x20]
call fcn.10037e38
xor eax, eax
call fcn.10175103
ret
Function at 0x10039d1a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0x40
mov eax, 0x101a19bb
call fcn.1017513a
mov eax, ecx
mov dword [ebp - 0x18], eax
xor ebx, ebx
cmp dword [eax + 0x24], ebx
je 0x10039e39
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x18]
mov eax, dword [ecx]
call dword [eax + 0x18]
add eax, 0x1000
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.10039511
mov ecx, esi
call fcn.10039511
mov edi, dword [eax + 0x80]
cmp dword [eax + 0x84], ebx
je 0x10039e39
mov ecx, esi
call fcn.10039511
mov edx, dword [eax + 0xd8]
mov dword [ebp - 0x30], edx
mov ecx, dword [eax + 0xdc]
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x10039e39
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x1c], eax
lea edx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x14]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.1003afa0
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
lea ebx, [edi + eax]
jmp 0x10039e1e
mov ecx, dword [ebx]
mov esi, dword [ebx + 0x10]
add esi, eax
lea edi, [ecx + eax]
test ecx, ecx
jne 0x10039de0
mov edi, esi
cmp dword [edi], 0
je 0x10039e1b
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
lea edx, [ebp - 0x24]
push edx
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
test eax, eax
js 0x10039e0a
cmp esi, dword [ebp - 0x1c]
jb 0x10039e0a
cmp esi, dword [ebp - 0x20]
jae 0x10039e0a
mov eax, dword [ebp - 0x24]
mov dword [esi], eax
add edi, 4
add esi, 4
cmp dword [edi], 0
jne 0x10039de8
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
add ebx, 0x14
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0x10], ebx
jne 0x10039dd0
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x4c], 0
jne 0x10039e39
lea ecx, [ebp - 0x48]
call fcn.1003b147
call fcn.10175103
ret 4
Function at 0x1003c855
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x1c
mov eax, 0x101a1ece
call fcn.1017513a
mov ebx, ecx
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1003c88f
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
jmp 0x1003c953
push dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
and dword [ebp - 0x18], 0
push esi
call fcn.10006db0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x10], 0
mov edi, eax
je 0x1003c8c4
mov esi, 0xe0010001
jmp 0x1003c941
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
push edi
mov ecx, eax
call fcn.100067b0
lea eax, [ebp - 0x28]
push eax
push edi
mov ecx, eax
call fcn.100067b0
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
sub eax, dword [ebp - 0x28]
push 0
push ecx
push eax
push dword [ebp - 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1003c916
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
or esi, 0xe0ff0000
jmp 0x1003c935
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], eax
je 0x1003c928
mov esi, 0xe0010001
jmp 0x1003c935
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.1003dc77
xor esi, esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10006400
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1003c951
call fcn.10001860
mov eax, esi
call fcn.10175103
ret

Function at 0x1003dd49
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ecx + 0x14]
xor edx, edx
push ebx
add eax, 0x18
push esi
add eax, ecx
xor esi, esi
movzx ecx, word [ecx + 6]
cmp si, cx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
jae 0x1003dd9a
mov ebx, dword [ebp - 4]
mov edi, dword [eax + 0xc]
test esi, esi
jb 0x1003dd91
ja 0x1003dd7f
cmp ecx, edi
jb 0x1003dd91
mov ebx, dword [eax + 8]
add ebx, edi
test esi, esi
jb 0x1003dda3
ja 0x1003dd8e
cmp ecx, ebx
jb 0x1003dda3
mov ebx, dword [ebp - 4]
add eax, 0x28
inc edx
cmp dx, bx
jb 0x1003dd72
mov eax, ecx
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [eax + 0x14]
xor edx, edx
sub eax, edi
sbb edx, edx
add eax, ecx
adc edx, esi
jmp 0x1003dd9e
Function at 0x10046109
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0xb
jb 0x10046110
pop edi
mov byte [esi + 0xf], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10048472
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100484f4
cmp byte [esi + 0x3d], 0
je 0x100484f4
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100484c6
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100484ca
sub eax, 1
je 0x100484ce
dec eax
sub eax, 1
je 0x100484f4
xor al, al
jmp 0x100484f6
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100484eb
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100ebefd
add esp, 0x10
cmp edi, eax
jne 0x100484c6
cmp byte [esi + 0x3d], 0
sete al
jmp 0x100484f6
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100e04a9
leave
ret
Function at 0x10049c05
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x26
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10049c10
xor eax, eax
mov word [esi + 0x50], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1004a0cc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
or dword [ecx + 0x1384], 0xffffffff
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1004a0ea
pop edi
pop esi
mov dword [ecx], ebx
mov eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x1004a294
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x1004a2dc
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1004a2a4
jmp 0x1004a2e9
cmp dword [esi], 0x4e0
jb 0x1004a2e9
call fcn.1004a323
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x1004a323
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x1004a335
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x1004a37a
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret
Function at 0x1004a3ee
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp - 0x20c]
mov ebx, 0x104
mov eax, esi
mov edi, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, ebx
jge 0x1004a4e1
test eax, eax
je 0x1004a4e1
cmp word [ebp - 0x20c], 0
je 0x1004a4dd
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x610]
push eax
push 0x200
lea eax, [ebp - 0x60c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1004a4c5
mov eax, dword [ebp - 0x610]
lea ecx, [ebp - 0x61c]
mov dword [ebp - 0x61c], eax
mov eax, dword [edi + 4]
push ecx
mov dword [ebp - 0x618], esi
mov ebx, dword [eax]
mov eax, dword [ebx + 4]
push eax
push ebx
mov dword [ebp - 0x614], eax
call fcn.1004bd58
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [edi + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1004a4fb
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x614]
mov dword [edi + 8], ecx
mov ecx, edi
mov dword [ebx + 4], edx
mov dword [eax], edx
mov eax, dword [edi + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x624]
push eax
call fcn.1004bb26
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
xor eax, eax
add esi, 2
cmp word [esi], ax
jne 0x1004a43b
xor eax, eax
jmp 0x1004a4ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret
push str.list_T__too_long
call fcn.100e0469
int3

Function at 0x1004cc75
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x101a3d47
call fcn.1017513a
mov dword [ebp - 0x10], ecx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push bind
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1004ccb4
push 0xe0010006
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1004cd57
push dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push esi
mov dword [ebp - 0x1c], ebx
call fcn.10006db0
mov dword [ebp - 4], ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.1001428d
mov edi, eax
test edi, edi
jne 0x1004ccf1
push 0xe0010003
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1004cd45
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], 0
push fcn.100142b4
push edi
call fcn.1004d336
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004cd22
xor esi, esi
jmp 0x1004cd35
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
push ebx
mov eax, dword [eax + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1004cd45
call fcn.10001860
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1004cd55
call fcn.10001860
mov eax, esi
call fcn.10175103
ret 8
Function at 0x1004d5a0
Capabilities:
Set file attributes

Disassembly:
push 0x48
mov eax, 0x101a3eff
call fcn.1017513a
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 0x10], 0
je 0x1004d626
lea ecx, [ebp - 0x54]
call fcn.1004d403
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [eax], esi
push esi
push 0x80
mov ebx, dword [ebp + 8]
push 2
push 0x1c
pop ecx
push 0x3c
pop edx
cmove ecx, edx
add ecx, eax
push ecx
push 3
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x54], esi
je 0x1004d60b
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x3c], esi
je 0x1004d619
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebx + 4], 0xffffffff
jne 0x1004d675
mov eax, 0xe0010006
jmp 0x1004d677
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
push esi
push 0x2000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp + 0xc]
call ebx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x1004d675
push esi
push 0x2000000
push 3
push esi
push 3
push bind
push dword [ebp + 0xc]
call ebx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x1004d675
mov eax, 0xe0010005
jmp 0x1004d677
xor eax, eax
call fcn.10175103
ret 0xc

Function at 0x1004d67f
Capabilities:
Set file attributes

Disassembly:
push 0x48
mov eax, 0x101a3eff
call fcn.1017513a
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp + 0x10], 0
je 0x1004d705
lea ecx, [ebp - 0x54]
call fcn.1004d403
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [eax], esi
push esi
push 0x80
mov ebx, dword [ebp + 8]
push 2
push 0x1c
pop ecx
push 0x3c
pop edx
cmove ecx, edx
add ecx, eax
push ecx
push 3
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 4], eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x54], esi
je 0x1004d6ea
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x3c], esi
je 0x1004d6f8
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebx + 4], 0xffffffff
jne 0x1004d754
mov eax, 0xe0010006
jmp 0x1004d756
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
push esi
push 0x2000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp + 0xc]
call ebx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x1004d754
push esi
push 0x2000000
push 3
push esi
push 3
push bind
push dword [ebp + 0xc]
call ebx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x1004d754
mov eax, 0xe0010005
jmp 0x1004d756
xor eax, eax
call fcn.10175103
ret 0xc
Function at 0x1004f3b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1f58]
push dword [esi + 0x1f60]
push 0
mov edx, dword [eax]
push eax
call dword [edx + 0x1c]
mov ecx, dword [esi + 0x1f58]
lea edx, [ebp - 4]
push edx
push 0xa10
lea ebx, [esi + 8]
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x1004f4e9
mov ecx, dword [esi + 0x1f58]
lea edi, [ebp - 4]
push edi
push 0x210
lea edx, [esi + 0xa18]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x1004f4e9
mov ecx, dword [esi + 0x1f58]
lea edx, [ebp - 4]
push edx
push 0x330
lea edi, [esi + 0xc28]
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x1004f4e9
mov ecx, ebx
mov eax, 0x7473754d
mov edx, 0x284
xor dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x1004f446
lea ecx, [esi + 0xa18]
mov edx, 0x84
xor dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x1004f45c
mov ecx, 0xcc
xor dword [edi], eax
inc eax
lea edi, [edi + 4]
sub ecx, 1
jne 0x1004f46c
cmp dword [ebx], 0x7473754d
jne 0x1004f4e2
push 0xa10
push ebx
call fcn.100167df
test eax, eax
jne 0x1004f4e2
mov eax, 0x78747241
cmp dword [esi + 0xc24], eax
je 0x1004f4d0
and dword [esi + 0xc18], 0
and dword [esi + 0xc1c], 0
mov dword [esi + 0xc24], eax
lea eax, [esi + 0xa18]
push 0x210
push eax
mov dword [esi + 0xc20], 1
call fcn.100167df
mov dword [esi + 0xc1c], eax
mov ecx, esi
call fcn.1004f342
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
jmp 0x1004f4ee
mov eax, 0xe0010001
jmp 0x1004f4ee
mov eax, 0xe0010005
pop edi
pop esi
pop ebx
leave
ret