joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031fb0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdbcd
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x9c], ecx
push 8
lea eax, [ebp - 0x98]
mov dword [ebp - 0xac], ecx
push eax
mov dword [ebp - 0xa8], 0
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
mov esi, dword [ebp - 0x98]
xor ecx, ecx
and esi, 0xf
mov dword [ebp - 0xa0], 0
add esi, 5
mov edx, 2
mov dword [ebp - 0x9c], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1008855c
mov ebx, eax
add esp, 4
mov dword [ebp - 0xa0], ebx
lea eax, [esi*2 + 2]
mov dword [ebp - 4], 1
push eax
push 0
push ebx
call fcn.1008ac40
mov ecx, 0x1f
lea edi, [ebp - 0x90]
mov esi, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
cmp dword [ebp - 0x9c], edi
jbe 0x100320d8
lea esi, [ebp - 0x90]
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10032090
sub esi, ecx
sar esi, 1
nop
push 8
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
push 0
push esi
push dword [ebp - 0x94]
push dword [ebp - 0x98]
call fcn.10088b40
mov ax, word [ebp + eax*2 - 0x90]
mov word [ebx + edi*2], ax
inc edi
cmp edi, dword [ebp - 0x9c]
jl 0x100320a0
mov esi, dword [ebp - 0xa4]
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100320f6
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
push ebx
call fcn.100049a0
mov dword [ebp - 0xa8], 1
mov byte [ebp - 4], 0
test ebx, ebx
je 0x10032129
push ebx
call fcn.100881b6
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret
Function at 0x10034630
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdf00
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x34]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0
call fcn.1000ad50
push 0x80
push 4
push 1
push 0x80000000
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.10018bc0
test al, al
je 0x100347e2
mov esi, dword [ebp - 0x34]
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
test esi, esi
je 0x100346d1
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x100346d1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100346cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100346d1
xor edi, edi
mov edi, ebx
jmp 0x100346d4
mov edi, dword [ebp - 0x40]
lea eax, [edi + 1]
push eax
call fcn.1008855c
push edi
mov ebx, eax
push 0
push ebx
call fcn.1008ac40
add esp, 0x10
mov dword [ebp - 0x30], 0
test esi, esi
je 0x100347bd
test ebx, ebx
je 0x100347bd
cmp dword [esi], 0xffffffff
je 0x100347bd
push 0
lea eax, [ebp - 0x30]
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100347bd
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1003473b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1003473b
mov dword [esi], 0xffffffff
push dword [ebp - 0x30]
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.1001a2c0
push ebx
mov byte [ebp - 4], 1
call fcn.100881b6
mov eax, dword [ebp - 0x38]
add eax, 0x48
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000e5e0
add esp, 0x10
test eax, eax
sete bl
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100347a4
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003479a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10034813
push edx
push ecx
call fcn.1008854e
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], al
jmp 0x100347e4
push ebx
call fcn.100881b6
add esp, 4
test esi, esi
je 0x100347e2
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x100347e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100347e2
mov dword [esi], 0xffffffff
xor bl, bl
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10018b50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 8
call fcn.1008db97
int3
Function at 0x10036cb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be2bd
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.10088ad0
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1010]
mov ebx, dword [ebp + 0xc]
push 0x1000
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x1030], esi
push eax
mov dword [ebp - 0x1014], 0
call fcn.1008ac40
mov edx, dword [edi + 8]
add esp, 0xc
cmp dword [edx + 0x14], 8
jb 0x10036d22
mov edx, dword [edx]
mov eax, dword [edi + 4]
cmp dword [eax + 0x14], 8
jb 0x10036d2d
mov eax, dword [eax]
mov ecx, dword [edi]
cmp dword [ecx + 0x14], 8
jb 0x10036d37
mov ecx, dword [ecx]
push edx
push 0x7fe
lea edx, [ebp - 0x1010]
push edx
push 0x100de1d0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x1010]
lea edi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10036d60
sub edx, edi
lea eax, [ebp - 0x1010]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.100049a0
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1010]
xor eax, eax
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 7
mov word [ebp - 0x102c], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10036df0
sub ecx, edx
lea eax, [ebp - 0x1010]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x102c]
call fcn.100049a0
push esi
lea eax, [ebp - 0x102c]
mov dword [ebp - 4], 1
push 0x7c
push eax
call fcn.10015780
add esp, 0xc
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x1018]
cmp edx, 8
jb 0x10036e6e
mov ecx, dword [ebp - 0x102c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10036e64
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10036eae
push edx
push ecx
call fcn.1008854e
add esp, 8
xor eax, eax
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 7
mov word [ebp - 0x102c], ax
mov byte [ebp - 4], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 8
call fcn.1008db97
int3
Function at 0x10037630
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.1000b380
mov ecx, dword [esi + 0x14]
add esp, 4
test al, al
jne 0x10037684
cmp ecx, 8
jb 0x10037662
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x1003766a
mov edi, dword [edi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 8
mov eax, esi
cmp ecx, 8
jb 0x1003768d
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebx
test eax, eax
je 0x100376c6
cmp dword [esi + 0x14], 8
jb 0x100376a3
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x100376ab
mov edi, dword [edi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 8
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.1008ac40
lea eax, [ebp - 0x804]
push eax
call fcn.10099f85
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
call ebx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100376fb
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x804]
push ecx
push eax
call ebx
mov ecx, dword [esi + 0x14]
test eax, eax
je 0x10037738
cmp ecx, 8
jb 0x10037719
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x10037721
mov edi, dword [edi]
push esi
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 8
cmp ecx, 8
jb 0x1003773f
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x10037747
mov edi, dword [edi]
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.100881a5
mov esp, ebp
pop ebp
ret 8
Function at 0x10037770
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdf00
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x34]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0
call fcn.1000ad50
push 0x80
push 4
push 1
push 0x80000000
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.10018bc0
test al, al
je 0x10037939
mov esi, dword [ebp - 0x34]
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
test esi, esi
je 0x10037811
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10037811
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1003780b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10037811
xor edi, edi
mov edi, ebx
jmp 0x10037814
mov edi, dword [ebp - 0x40]
lea eax, [edi + 1]
push 0x100fc860
push eax
call fcn.10088bb5
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1003791d
push edi
push 0
push ebx
call fcn.1008ac40
add esp, 0xc
mov dword [ebp - 0x30], 0
test esi, esi
je 0x10037914
cmp dword [esi], 0xffffffff
je 0x10037914
push 0
lea eax, [ebp - 0x30]
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10037914
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10037883
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10037883
mov dword [esi], 0xffffffff
push dword [ebp - 0x30]
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.1001a2c0
push ebx
mov byte [ebp - 4], 1
call fcn.100881b6
mov ecx, dword [ebp - 0x38]
mov edx, 0x84
mov eax, 0x34
cmp byte [ecx], 0
cmove eax, edx
add eax, ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000e5e0
add esp, 0x10
test eax, eax
sete bl
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100378fb
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100378f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003796a
push edx
push ecx
call fcn.1008854e
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], al
jmp 0x1003793b
push ebx
call fcn.100881b6
add esp, 4
test esi, esi
je 0x10037939
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10037939
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10037939
mov dword [esi], 0xffffffff
xor bl, bl
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10018b50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 8
call fcn.1008db97
int3
Function at 0x10037a10
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
push esi
call fcn.1000b380
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 4
test al, al
je 0x10037a40
cmp dword [esi + 0x14], 8
jb 0x10037a39
mov esi, dword [esi]
push 4
push 0
push esi
call ebx
mov esi, dword [ebp + 8]
push esi
call fcn.1000b380
add esp, 4
test al, al
je 0x10037a5f
cmp dword [esi + 0x14], 8
jb 0x10037a58
mov esi, dword [esi]
push 4
push 0
push esi
call ebx
push edi
call fcn.1000b1f0
add esp, 4
test al, al
je 0x10037a7b
cmp dword [edi + 0x14], 8
jb 0x10037a74
mov edi, dword [edi]
push 4
push 0
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a5a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ef0f0
push 0x10089c00
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x100fb03c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x438], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10004990
mov dword [ebp - 0x43c], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x1003a609
mov eax, dword [eax]
lea ecx, [ebp - 0x43c]
push ecx
push eax
call fcn.10004bb0
add esp, 8
mov edx, esi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.1003a720
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x1003a657
test bl, bl
jne 0x1003a6f4
cmp edi, 0x1a
jne 0x1003a6f4
mov ecx, esi
call fcn.10004990
mov dword [ebp - 0x438], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x1003a688
mov eax, dword [eax]
lea ecx, [ebp - 0x438]
push ecx
push eax
call fcn.10004bb0
push 0x410
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.1008ac40
add esp, 0x14
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x430]
push eax
call fcn.10004b70
add esp, 4
push eax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.100049a0
mov ecx, esi
call fcn.100051f0
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret

Function at 0x1003b530
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bea74
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100fb03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10004970
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10004970
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10004970
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10004970
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.10004970
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003f020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf538
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push ecx
push 0xffffffffffffffff
push 0xffff8000
mov ecx, edi
movlpd qword [ebp - 0x3c], xmm0
call fcn.10018da0
test al, al
jne 0x1003f07f
mov eax, 1
jmp 0x1003f1f3
push 0x10000
call fcn.1008855c
add esp, 4
lea ecx, [ebp - 0x30]
mov esi, eax
push 4
call fcn.10020920
push esi
lea ecx, [ebp - 0x30]
call fcn.10032e70
mov dword [ebp - 4], 0
push 0x10000
push 0
push esi
call fcn.1008ac40
mov eax, dword [edi]
add esp, 0xc
mov dword [ebp - 0x18], 0
test eax, eax
je 0x1003f1d1
test esi, esi
je 0x1003f1d1
cmp dword [eax], 0xffffffff
je 0x1003f1d1
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x8000
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003f1d1
xor ecx, ecx
mov dword [ebp - 0x24], 0
mov edx, 0x8000
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], edx
lea edi, [esi + 0x8000]
cmp byte [ebx + 0x9c], 0
jne 0x1003f1ca
lea eax, [edi + ecx]
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], 0
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x34]
push edx
push eax
call fcn.1005d680
test al, al
je 0x1003f1c0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x1003f1a0
mov eax, dword [ebx + 0xc0]
test eax, eax
je 0x1003f161
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx + 0x9c], 0
jne 0x1003f1ca
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], 0xf
ja 0x1003f1b9
mov edx, dword [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x28], edx
jne 0x1003f110
mov ecx, 0x7ffc
mov eax, dword [esi]
cmp eax, dword [edi]
jne 0x1003f1b2
add esi, 4
add edi, 4
sub ecx, 4
jae 0x1003f188
mov esi, 4
jmp 0x1003f1e2
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x8000
je 0x1003f183
jmp 0x1003f173
mov esi, 5
jmp 0x1003f1e2
mov esi, 3
jmp 0x1003f1e2
mov eax, dword [ebp - 0x2c]
mov esi, 3
jmp 0x1003f1dc
mov esi, 2
jmp 0x1003f1e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [ebx + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100099c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100413b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bfa58
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.100051f0
test eax, eax
je 0x1004140b
cmp byte [ebp + 8], 0
jne 0x10041412
mov eax, dword [ebx]
test eax, eax
je 0x10041572
cmp byte [eax + 0xa5], 0
je 0x10041572
xor al, al
jmp 0x10041588
mov ecx, esi
call fcn.100051f0
test eax, eax
je 0x10041572
push esi
call fcn.1000b380
add esp, 4
test al, al
je 0x1004143a
push esi
push edi
call fcn.10040fe0
jmp 0x1004156e
push 0xb
mov ecx, esi
call fcn.10004780
push eax
mov ecx, edi
call fcn.10004780
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x1004145f
mov al, 1
jmp 0x1004156e
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.10004970
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.100196a0
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.10004970
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.100196a0
test al, al
jne 0x100414ac
cmp byte [ebp - 0x60], al
je 0x100414e8
push 0xb
lea ecx, [ebp - 0x40]
call fcn.10004780
push eax
lea ecx, [ebp - 0x58]
call fcn.10004780
push eax
call ebx
test eax, eax
je 0x100414e8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10004840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10004840
mov al, 1
jmp 0x1004156e
mov ecx, esi
call fcn.10018f30
cmp eax, 0xffffffff
je 0x10041551
push esi
lea ecx, [ebp - 0x28]
call fcn.10008cd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.100193f0
test al, al
je 0x10041545
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.10018fd0
test al, al
je 0x10041545
mov edx, esi
mov ecx, edi
call fcn.10018fd0
lea ecx, [ebp - 0x28]
test al, al
je 0x1004153e
call fcn.100191e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10004840
jmp 0x100414c6
mov edx, esi
call fcn.10018fd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10004840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10004840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10004840
xor al, al
test al, al
jne 0x10041586
push edi
call fcn.1000b380
add esp, 4
test al, al
je 0x10041586
mov ecx, edi
call fcn.100191e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006a840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100baf78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.10008cd0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000e9c0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.100051f0
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x1006a96d
call fcn.10004990
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x1006a8b0
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x1006a8ca
mov ecx, esi
cmp eax, 8
jb 0x1006a8bf
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x1006a9e8
mov ecx, esi
cmp eax, 8
jb 0x1006a8d3
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x1006a8e9
mov ecx, esi
cmp eax, 8
jb 0x1006a8e2
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x1006a93e
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.1000e840
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x1006a907
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x1006a93e
mov ecx, esi
cmp eax, 8
jb 0x1006a917
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x1006a93e
mov ecx, esi
cmp eax, 8
jb 0x1006a927
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x1006a93e
cmp eax, 8
jb 0x1006a934
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x1006a9c9
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004840
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret
call fcn.100051f0
cmp eax, 2
jne 0x1006a93e
lea ecx, [ebp - 0x28]
call fcn.10004990
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x1006a98b
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x1006a93e
mov edx, eax
cmp ecx, 8
jb 0x1006a99b
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x1006a93e
cmp ecx, 8
jb 0x1006a9a8
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x1006a93e
push 0x100de148
call fcn.10004b70
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x100de148
call fcn.10004ae0
lea ecx, [ebp - 0x28]
call fcn.10004780
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1006a93e
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x1006a940
Function at 0x100721f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100721fb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.10072210