joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e4b80
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x178
push ebx
push ebp
mov dword [esp + 0xc], ecx
push esi
mov esi, dword [esp + 0x188]
push edi
xor ecx, ecx
xor eax, eax
mov al, byte [ecx + 0x101fef50]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x101feee0]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x50], al
inc ecx
cmp ecx, 0x38
jl 0x100e4b97
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x190], 1
je 0x100e4bd8
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x101fef88]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x100e4c0a
mov bl, byte [esp + ecx + 0x50]
jmp 0x100e4c0e
mov bl, byte [esp + ecx + 0x34]
mov byte [esp + eax + 0x18], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x100e4bff
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x100e4c2c
mov bl, byte [esp + ecx + 0x50]
jmp 0x100e4c30
mov bl, byte [esp + ecx + 0x34]
mov byte [esp + eax + 0x18], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x100e4c21
xor ecx, ecx
mov eax, 0x101feef0
xor ebx, ebx
mov bl, byte [ecx + 0x101fef98]
cmp byte [esp + ebx + 0x18], 0
je 0x100e4c5b
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x101fefb0]
cmp byte [esp + ebx + 0x18], 0
je 0x100e4c72
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x101fef50
jl 0x100e4c42
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x100e4bcb
lea esi, [esp + 0x88]
lea edi, [esp + 0x108]
mov dword [esp + 0x10], 0x10
mov edx, dword [esi + 4]
mov eax, esi
add esi, 4
mov ecx, edx
mov eax, dword [eax]
mov ebx, edx
shr ecx, 4
and ecx, 0xfc000
and ebx, 0xfc0
or ecx, ebx
mov ebx, eax
and ebx, 0xfc0
mov ebp, eax
shl ebx, 4
and ebp, 0xfc0000
add edi, 4
or ebx, ebp
add edi, 4
shr ecx, 6
shl ebx, 6
or ecx, ebx
add esi, 4
mov dword [edi - 8], ecx
mov ecx, eax
and ecx, 0x3f
and eax, 0x3f000
shl ecx, 4
or ecx, eax
mov eax, edx
shr eax, 4
shl ecx, 0xc
and eax, 0x3f00
and edx, 0x3f
or ecx, eax
mov eax, dword [esp + 0x10]
or ecx, edx
dec eax
mov dword [edi - 4], ecx
mov dword [esp + 0x10], eax
jne 0x100e4ca8
mov eax, dword [esp + 0x14]
lea edi, [eax + 4]
lea ecx, [eax + 0x84]
cmp edi, ecx
jae 0x100e4d47
mov edx, edi
sub ecx, edi
sub edx, eax
add ecx, 3
shr ecx, 2
lea esi, [esp + edx + 0x104]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x178
ret 8
Function at 0x100e5250
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [ecx + 0x400]
push esi
mov esi, dword [ecx + 0x404]
push edi
xor edi, edi
test edx, edx
jle 0x100e52b7
push ebx
push ebp
mov ebp, dword [esp + 0x14]
inc eax
and eax, 0xff
mov edx, dword [ecx + eax*4]
add esi, edx
and esi, 0xff
mov ebx, dword [ecx + esi*4]
mov dword [ecx + eax*4], ebx
add ebx, edx
and ebx, 0xff
mov dword [ecx + esi*4], edx
mov dl, byte [ecx + ebx*4]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x18]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jl 0x100e526e
pop ebp
pop ebx
mov dword [ecx + 0x404], esi
pop edi
mov dword [ecx + 0x400], eax
pop esi
ret 8
mov dword [ecx + 0x404], esi
pop edi
mov dword [ecx + 0x400], eax
pop esi
ret 8
Function at 0x100e6710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa0
mov eax, dword [esp + 0xa8]
xor ecx, ecx
xor edx, edx
push ebx
mov ch, byte [eax]
mov dl, byte [eax + 2]
mov cl, byte [eax + 1]
push ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 3]
push esi
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 6]
mov esi, ecx
xor ecx, ecx
push edi
mov ch, byte [eax + 4]
mov cl, byte [eax + 5]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xa]
mov edi, ecx
xor ecx, ecx
mov ch, byte [eax + 8]
mov cl, byte [eax + 9]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xb]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xe]
mov ebp, ecx
xor ecx, ecx
mov ch, byte [eax + 0xc]
mov cl, byte [eax + 0xd]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 0xf]
shl ecx, 8
or ecx, edx
mov edx, dword [0x101ff8d4]
mov eax, ecx
mov ecx, dword [0x101ff8d0]
xor ecx, esi
mov esi, dword [esp + 0xb4]
xor edx, edi
mov dword [esp + 0x20], ecx
mov ecx, dword [0x101ff8d8]
mov dword [esp + 0x24], edx
mov edx, dword [0x101ff8dc]
xor ecx, ebp
xor edx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
xor ecx, ecx
mov eax, dword [ecx + 0x101ff8e0]
mov edx, dword [esp + ecx + 0x24]
mov ebp, dword [esp + ecx + 0x2c]
mov ebx, dword [esp + ecx + 0x28]
xor eax, edx
add ecx, 4
xor eax, ebp
xor eax, ebx
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
mov edx, eax
shr edx, 8
mov byte [esp + 0x12], dl
and eax, 0xff
mov edi, dword [esp + 0x11]
mov edx, dword [esp + 0x10]
mov al, byte [eax + 0x101ff7d0]
and edi, 0xff
and edx, 0xff
mov byte [esp + 0x1b], al
mov bl, byte [edi + 0x101ff7d0]
mov edi, dword [esp + 0x12]
mov dl, byte [edx + 0x101ff7d0]
and edi, 0xff
mov byte [esp + 0x19], bl
xor eax, eax
mov bl, byte [edi + 0x101ff7d0]
mov ah, dl
mov byte [esp + 0x1a], bl
mov edx, dword [esp + 0x19]
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1a]
shl eax, 8
and edx, 0xff
or eax, edx
mov edx, dword [esp + 0x1b]
shl eax, 8
and edx, 0xff
or edx, eax
mov eax, edx
mov edi, edx
shr eax, 0x13
shl edi, 0xd
or eax, edi
mov edi, edx
mov ebx, edx
shl edi, 0x17
shr ebx, 9
or edi, ebx
mov ebx, dword [esp + ecx + 0x1c]
xor eax, edi
xor eax, ebx
xor eax, edx
cmp ecx, 0x80
mov dword [esp + ecx + 0x2c], eax
mov dword [ecx + esi - 4], eax
jb 0x100e67d1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x100e6b80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
cmp eax, 1
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
jne 0x100e6c19
test eax, eax
jle 0x100e6ca8
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
shr eax, 4
mov dword [esp + 0x2c], eax
mov ebp, esi
sub ecx, edi
mov eax, edi
sub ebp, edi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec edx
mov byte [eax + ebp - 1], bl
jne 0x100e6bc3
mov eax, dword [esp + 0x24]
push esi
add eax, 4
push esi
push eax
call fcn.100e6940
mov ecx, dword [esp + 0x3c]
mov edx, esi
mov eax, ecx
add esp, 0xc
mov ebx, dword [edx]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov ebx, dword [edx + 4]
mov dword [eax + 4], ebx
mov ebx, dword [edx + 8]
mov dword [eax + 8], ebx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x100e6bb6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test eax, eax
jle 0x100e6ca8
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
add eax, 0xf
add ecx, 4
shr eax, 4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
mov edx, edi
push esi
push edi
mov ebx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 8]
push eax
mov dword [esp + 0x24], ecx
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
call fcn.100e6940
mov ecx, dword [esp + 0x3c]
add esp, 0xc
mov eax, esi
sub ecx, esi
mov ebp, 0x10
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x100e6c73
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edi, 0x10
mov dword [eax], ebx
add esi, 0x10
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jne 0x100e6c3e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x100e6cb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
cmp dword [eax], edi
jae 0x100e6cc3
xor eax, eax
pop edi
ret
test edi, edi
jbe 0x100e6cf5
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x20]
push esi
sub ebx, ebp
mov eax, ecx
xor edx, edx
div dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea esi, [ecx + ebp]
mov dl, byte [edx + eax]
mov al, byte [ebx + esi]
xor dl, al
inc ecx
cmp ecx, edi
mov byte [esi], dl
jb 0x100e6cd4
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov eax, 1
pop edi
ret
Function at 0x100e8f60
Capabilities:
Get user security identifier

Disassembly:
mov eax, dword [0x1027dcd4]
sub esp, 0x120
push ebx
xor ebx, ebx
push ebp
cmp eax, ebx
push edi
jne 0x100e8fac
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, 2
jne 0x100e8fa7
mov dword [0x1027dcd8], eax
mov dword [0x1027dcd4], eax
cmp dword [0x1027dcd8], ebx
jne 0x100e8fc0
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x120
ret
mov ebp, dword [esp + 0x130]
mov edi, dword [esp + 0x134]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x14]
push ebx
push eax
push ebx
push ebp
push ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100e900c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x100e900c
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x120
ret
mov ecx, dword [esp + 0xc]
push esi
push ecx
call fcn.101d42d4
mov edx, dword [esp + 0x18]
mov dword [edi], eax
lea eax, [edx + edx]
push eax
call fcn.101d42d4
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x100e9051
test esi, esi
je 0x100e9062
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x100e905e
push esi
call fcn.101d42fd
add esp, 4
test ebx, ebx
jne 0x100e9071
mov edi, dword [edi]
test edi, edi
je 0x100e9071
push edi
call fcn.101d42fd
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x100e9780
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ec4d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
mov eax, dword [0x1027dc7c]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
jne 0x100e996b
push 1
push 0x1027dc88
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push 1
push 0x1027dc88
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x34]
mov dword [0x1027dca0], 0xc
mov dword [0x1027dca8], esi
mov dword [0x1027dca4], 0x1027dc88
call fcn.10062400
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.101d25a2
mov eax, dword [0x1027dcdc]
mov byte [ebp - 4], 1
cmp eax, esi
mov dword [ebp - 0x24], str.S_1_1_0
mov dword [ebp - 0x20], str.S_1_15_2_1
mov dword [ebp - 0x1c], str.S_1_15_2_2
mov ebx, 3
jne 0x100e9881
mov ecx, 0x44
xor eax, eax
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x15c], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x14c]
mov ecx, 2
cmp eax, ecx
jne 0x100e9877
mov eax, dword [ebp - 0x158]
cmp eax, 6
ja 0x100e986d
jne 0x100e9877
cmp dword [ebp - 0x154], ecx
jb 0x100e9877
mov dword [0x1027dce0], 1
mov dword [0x1027dcdc], 1
cmp dword [0x1027dce0], esi
jne 0x100e988e
mov ebx, 1
cmp ebx, esi
jle 0x100e98d5
lea esi, [ebp - 0x24]
mov edi, ebx
mov ecx, dword [esi]
push ecx
lea ecx, [ebp - 0x14]
call fcn.1005ae80
mov edx, dword [ebp - 0x30]
push eax
push edx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10062b60
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1005b6f0
mov eax, dword [ebp - 0x40]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x48]
call fcn.101d27c6
add esi, 4
dec edi
jne 0x100e9897
xor esi, esi
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x34]
push ecx
push edx
push 0x1027dcc0
mov byte [ebp - 4], 3
call fcn.100e9340
add esp, 0xc
cmp eax, esi
jne 0x100e9929
lea eax, [ebp - 0x18]
push 0x1021f3d0
push eax
mov dword [ebp - 0x18], esi
call fcn.10044816
push 1
push 0x1027dcc0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push 0x1027dcc0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, 0x100e9927
ret
mov eax, 1
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], eax
mov dword [0x1027dcb0], 0xc
mov dword [0x1027dcb8], esi
mov dword [0x1027dcb4], 0x1027dcc0
mov dword [0x1027dc7c], eax
mov byte [ebp - 4], 0
call fcn.101d25d5
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10062410
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ea110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ec560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x24], ebx
call fcn.101d3da2
mov ecx, dword [ebp + 0xc]
lea edi, [esi + 0x28]
push ecx
mov ecx, edi
call fcn.101d3da2
mov ecx, edi
call fcn.101d1694
mov ecx, edi
call fcn.101d15a3
mov edx, dword [ebp + 8]
push ebx
push edx
call fcn.10179174
add esp, 8
test eax, eax
je 0x100ea1a4
mov dword [esi + 0x2c], ebx
mov dword [esi + 8], ebx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 4]
push ebx
push ebx
push eax
mov dword [esi + 0x2c], 1
mov dword [ebp - 4], ebx
call fcn.1016fa20
mov ecx, dword [esi + 4]
call fcn.1016fc70
mov ecx, dword [esi + 4]
push ebx
mov dword [esi + 8], eax
call fcn.101703a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100ea230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ec570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esp
xor eax, eax
push 0x10277134
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x24], edi
call fcn.101d3da2
mov eax, dword [ebp + 0xc]
lea ebx, [esi + 0x28]
push eax
mov ecx, ebx
call fcn.101d3da2
mov ecx, ebx
call fcn.101d1694
mov ecx, ebx
call fcn.101d15a3
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x30]
test eax, eax
jne 0x100ea2c2
mov dword [esi + 0x2c], eax
mov dword [esi + 8], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
push 0
push edi
mov dword [esi + 0x2c], 1
mov dword [ebp - 4], 0
call fcn.1016fa80
mov ecx, dword [esi + 4]
call fcn.1016fc70
mov ecx, dword [esi + 4]
push 0
mov dword [esi + 8], eax
call fcn.101703a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100f2cb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, 0x8000
push edi
cmp eax, esi
mov dword [esp + 0x14], esi
jbe 0x100f2cce
mov dword [esp + 0x14], eax
mov esi, eax
push esi
call fcn.101d42d4
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
mov ebp, dword [esp + 0x24]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
mov dword [esp + 0x10], ebx
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jne 0x100f2d0d
xor ebx, ebx
jmp 0x100f2d2a
lea eax, [esp + 0x24]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100f2d26
or ebx, 0xffffffff
jmp 0x100f2d2a
mov ebx, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100f2d7d
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push 0
push ecx
push eax
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100f2d62
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
je 0x100f2d79
mov ecx, dword [esp + 0x10]
push ecx
call fcn.101d42fd
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
cmp ebx, esi
jae 0x100f2da2
test ebx, ebx
je 0x100f2e76
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push 0
push edx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100f2e76
lea ecx, [ebx + edi]
add edi, eax
push esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edi
call fcn.101d42d4
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x24], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x100f2dd6
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
jg 0x100f2e15
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x100f2e15
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push 0
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100f2e0f
or esi, 0xffffffff
jmp 0x100f2e17
mov esi, dword [esp + 0x28]
jmp 0x100f2e17
xor esi, esi
mov edx, dword [esp + 0x2c]
push 0
push 0
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebx, ebx
je 0x100f2e3f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0
push eax
push ebx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
add edx, ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x10], edx
test esi, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov ebx, esi
jg 0x100f2dd2
push eax
call fcn.101d42fd
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call fcn.101d42fd
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100f2e90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
jne 0x100f2eb3
or ebx, eax
jmp 0x100f2eb5
mov ebx, eax
push 2
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
je 0x100f2ecf
mov dword [esp + 0x1c], eax
push 0
push ebx
push esi
call fcn.100f31d0
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
sub eax, ebp
sub ecx, ebp
add esp, 0xc
cmp ecx, eax
mov dword [esp + 0x20], ecx
jl 0x100f2ef7
mov dword [esp + 0x20], eax
push 0x8000
call fcn.101d42d4
mov ebx, eax
add esp, 4
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [eax + ebp]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x24]
push 0
push edx
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100f2f41
or eax, 0xffffffff
jmp 0x100f2f7d
mov edi, dword [esp + 0x24]
mov eax, edi
test edi, edi
mov dword [esp + 0x14], eax
jle 0x100f2f7d
push 0
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x100f2f79
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100f2f88
cmp dword [esp + 0x10], edi
jne 0x100f2f88
mov eax, dword [esp + 0x14]
add ebp, eax
cmp eax, 0x8000
jne 0x100f2f9b
jmp 0x100f2f11
push ebx
call fcn.101d42fd
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
sub eax, ecx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call fcn.101d42fd
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100f4120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101ecf0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x101fe014]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], eax
mov dword [esp + 0x28], 1
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
mov byte [esp + 0x28], 2
cmp eax, edi
jle 0x100f4240
push ebx
push ebp
mov bl, 4
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*8]
mov edx, dword [eax + edi*8 + 4]
lea eax, [eax + edi*8]
cmp ecx, edx
ja 0x100f4232
jne 0x100f41aa
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.101cdf00
add esp, 8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call fcn.1005b8a0
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
jmp 0x100f4206
mov eax, dword [eax + 4]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.101cdf00
mov ebp, eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], bl
mov eax, dword [edx + edi*8]
push eax
push ecx
call fcn.101cdf00
add esp, 0x10
mov edx, dword [ebp]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s__s
push ecx
mov byte [esp + 0x40], 5
call fcn.1005e700
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.1005b6f0
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x20]
call fcn.1005b6f0
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x100f4224
push 0x10258d14
lea ecx, [esp + 0x14]
call fcn.1005c330
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
call fcn.1005c390
mov eax, dword [esi + 8]
inc edi
cmp edi, eax
jl 0x100f416b
pop ebp
pop ebx
mov esi, dword [esp + 0x30]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.1005ac70
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.1005b6f0
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.1005b6f0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4