joyce8/EMBER2024-capa huggingface dataset:
Function at 0x208d08
Capabilities:
Get disk size

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
cld
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
sub esp, 0x820
mov eax, esp
call fcn.00208e17
xor edx, edx
mov esi, esp
lea edi, [esi + 0x208]
push edx
push edx
push 0x618
push edi
push 0xffffffffffffffff
push esi
push edx
push edx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call 0x208d58
dec ebx
add byte [ebp], al
push edx
add byte [esi], cl
inc ebp
add byte [eax + eax + 0x33], cl
add byte [edx], dh
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
mov edi, section..data
test dword [edi + 0x5dc], 0x80
je 0x208d91
lea ebx, [esp + 0x208]
call 0x208dac
inc edi
je 0x208dc5
imul esi, dword [ebx + 0x6b], 0x65657246
push ebx
jo 0x208dec
arpl word [ebp + 0x45], sp
js 0x208dd1
add byte [ebx + 0x14e8dc], cl
add byte [eax], al
mov ebx, esp
call 0x208dac
inc edi
je 0x208de0
imul esi, dword [ebx + 0x6b], 0x65657246
push ebx
jo 0x208e07
arpl word [ebp + 0x45], sp
js 0x208e02
add byte [esi - 1], dl
adc eax, sym.imp.KERNEL32.DLL_GetProcAddress
mov ecx, eax
test byte [ebx], 0xff
jne 0x208dbc
xor ebx, ebx
jecxz 0x208dcd
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call ecx
jmp 0x208e0b
xor eax, eax
mov ebx, esp
push eax
push eax
push eax
push eax
lea eax, [ebx - 4]
push eax
sub eax, 4
push eax
sub eax, 4
push eax
sub eax, 4
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
fild dword [esp]
fimul dword [esp + 4]
fimul dword [esp + 8]
fistp qword [ebp - 0x6c]
fild dword [esp]
fimul dword [esp + 4]
fimul dword [esp + 0xc]
dec esp
and al, 0xc
fistp qword [ebp - 0x64]
pushfd
add esp, 0x10
add esp, 0x820
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
Function at 0x208d58
Capabilities:
Get disk size

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
cld
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
sub esp, 0x820
mov eax, esp
call fcn.00208e17
xor edx, edx
mov esi, esp
lea edi, [esi + 0x208]
push edx
push edx
push 0x618
push edi
push 0xffffffffffffffff
push esi
push edx
push edx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call 0x208d58
dec ebx
add byte [ebp], al
push edx
add byte [esi], cl
inc ebp
add byte [eax + eax + 0x33], cl
add byte [edx], dh
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
mov edi, section..data
test dword [edi + 0x5dc], 0x80
je 0x208d91
lea ebx, [esp + 0x208]
call 0x208dac
inc edi
je 0x208dc5
imul esi, dword [ebx + 0x6b], 0x65657246
push ebx
jo 0x208dec
arpl word [ebp + 0x45], sp
js 0x208dd1
add byte [ebx + 0x14e8dc], cl
add byte [eax], al
mov ebx, esp
call 0x208dac
inc edi
je 0x208de0
imul esi, dword [ebx + 0x6b], 0x65657246
push ebx
jo 0x208e07
arpl word [ebp + 0x45], sp
js 0x208e02
add byte [esi - 1], dl
adc eax, sym.imp.KERNEL32.DLL_GetProcAddress
mov ecx, eax
test byte [ebx], 0xff
jne 0x208dbc
xor ebx, ebx
jecxz 0x208dcd
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call ecx
jmp 0x208e0b
xor eax, eax
mov ebx, esp
push eax
push eax
push eax
push eax
lea eax, [ebx - 4]
push eax
sub eax, 4
push eax
sub eax, 4
push eax
sub eax, 4
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
fild dword [esp]
fimul dword [esp + 4]
fimul dword [esp + 8]
fistp qword [ebp - 0x6c]
fild dword [esp]
fimul dword [esp + 4]
fimul dword [esp + 0xc]
dec esp
and al, 0xc
fistp qword [ebp - 0x64]
pushfd
add esp, 0x10
add esp, 0x820
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
Function at 0x208dac
Capabilities:
Get disk size

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
cld
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
sub esp, 0x820
mov eax, esp
call fcn.00208e17
xor edx, edx
mov esi, esp
lea edi, [esi + 0x208]
push edx
push edx
push 0x618
push edi
push 0xffffffffffffffff
push esi
push edx
push edx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call 0x208d58
dec ebx
add byte [ebp], al
push edx
add byte [esi], cl
inc ebp
add byte [eax + eax + 0x33], cl
add byte [edx], dh
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
mov edi, section..data
test dword [edi + 0x5dc], 0x80
je 0x208d91
lea ebx, [esp + 0x208]
call 0x208dac
inc edi
je 0x208dc5
imul esi, dword [ebx + 0x6b], 0x65657246
push ebx
jo 0x208dec
arpl word [ebp + 0x45], sp
js 0x208dd1
add byte [ebx + 0x14e8dc], cl
add byte [eax], al
mov ebx, esp
call 0x208dac
inc edi
je 0x208de0
imul esi, dword [ebx + 0x6b], 0x65657246
push ebx
jo 0x208e07
arpl word [ebp + 0x45], sp
js 0x208e02
add byte [esi - 1], dl
adc eax, sym.imp.KERNEL32.DLL_GetProcAddress
mov ecx, eax
test byte [ebx], 0xff
jne 0x208dbc
xor ebx, ebx
jecxz 0x208dcd
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call ecx
jmp 0x208e0b
xor eax, eax
mov ebx, esp
push eax
push eax
push eax
push eax
lea eax, [ebx - 4]
push eax
sub eax, 4
push eax
sub eax, 4
push eax
sub eax, 4
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
fild dword [esp]
fimul dword [esp + 4]
fimul dword [esp + 8]
fistp qword [ebp - 0x6c]
fild dword [esp]
fimul dword [esp + 4]
fimul dword [esp + 0xc]
dec esp
and al, 0xc
fistp qword [ebp - 0x64]
pushfd
add esp, 0x10
add esp, 0x820
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret

Function at 0x208f5c
Capabilities:
Terminate process

Disassembly:
or edx, edx
jns 0x208f16
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.00208620
jb 0x208f50
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0020affe
call fcn.002088f8
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0020affe
jmp 0x208f42
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.00204c75
push eax
call fcn.00208fd0
jb 0x208f48
cmp ecx, edx
ja 0x208f48
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x208f10
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x208f10
mov ecx, ebx
mov edi, ebp
jmp 0x208f72
Function at 0x208ffc
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0020868f
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.0020867c
pop edi
call fcn.0020868f
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x209030
jne 0x209083
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.00208620
jb 0x209068
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0020affe
call fcn.0020affe
call fcn.002088f8
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.0020affe
call fcn.0020affe
call fcn.0020affe
call fcn.0020a3e4
jmp fcn.00204c80
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x209030
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.0020913f
jb 0x2090ac
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x209099
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x209030
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x2090c5
jmp 0x209066
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x2090c3
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.00208620
jb 0x209068
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.0020913f
jb 0x209122
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x2090e2
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x20904a
Function at 0x20961c
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0020868f
je 0x2096ee
mov esi, dword [ebp + esi - 0x6c]
call fcn.0020867c
je 0x2096ee
cmp edx, ecx
jb 0x2096ee
push edx
push edi
call fcn.00209333
pop edi
pop edx
mov ebx, eax
test ebx, ebx
je 0x2096ee
push edx
mov dword [ebp - 0x60], edx
mov eax, ecx
mul ebx
mov ebx, ecx
pop ecx
sub ecx, eax
push edi
push dword [ebp - 0x60]
call fcn.00208620
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop edx
pop edi
jb 0x2096f9
mov dword [ebp - 0x64], edi
mov ecx, ebx
push ebx
push esi
push edi
call fcn.0020935c
pop eax
pop esi
pop ebx
jae 0x20969c
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x60]
sub edx, eax
jmp 0x2096c2
push esi
push edi
mov esi, eax
mov ecx, edi
sub ecx, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
add edi, ebx
sub edx, ebx
cmp edx, ebx
jae 0x209683
mov eax, edi
mov ecx, edx

Function at 0x209714
Capabilities:
Terminate process

Disassembly:
mov esi, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x68]
call fcn.0020affe
call fcn.002088f8
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
jmp 0x2096f3
call fcn.0020affe
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
call fcn.0020affe
call fcn.0020affe
call fcn.0020a3e4
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.00204c75
push eax
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x68]
call fcn.0020867c
je 0x2096ee
mov edi, dword [ebp + edi - 0x6c]
call fcn.0020868f
je 0x2096ee
mov dword [ebp - 0x64], esi
add dword [ebp - 0x64], ecx
cld
push ecx
push esi
call fcn.0020934a
pop esi
pop ecx
test eax, eax
je 0x2096ee
push edi
push edx
push ecx
sub ecx, eax
call fcn.00208620
jb 0x2097a1
jecxz 0x209799
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop ecx
pop edx
pop edi
call fcn.0020946d
jb 0x20978f
push ecx
mov ecx, esi
sub ecx, eax
push esi
mov esi, eax
push edi
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
pop ecx
inc esi
or ecx, ecx
jne 0x209760
jmp 0x2096d5
mov ecx, dword [ebp - 0x64]
sub ecx, eax
jmp 0x2096c4
add esp, 0xc
jmp 0x2096d8
add esp, 0xc
jmp 0x2096f9
Function at 0x209a99
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x209ab9
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.0020867c
call fcn.00208620
jb 0x209ade
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.00204c80

Function at 0x209f9c
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xe
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x209fc9
je 0x209fc5
shr esi, 1
jae 0x209fea
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.00208654
jmp 0x209fa8
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x209ffb
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00204c69
pop ebx
jae 0x209fa8
pop esi
pop edx
pop eax
jmp fcn.00204c80
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x209fa8
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x209fa8
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x209fa8

Function at 0x20a0df
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x20a0ff
and esi, 0xfffffffe
jne 0x20a109
xchg dword [ebx], esi
call fcn.00208654
pop edi
pop esi
ret
call fcn.0020867c
mov edi, dword [ebx]
or edi, edi
je 0x20a119
cmp ecx, dword [edi - 4]
je 0x20a139
call fcn.00208620
jb 0x20a149
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00208654
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00208654
pop edi
pop esi
jmp fcn.00204c80

Function at 0x20a989
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0020868f
mov esi, dword [ebp + esi - 0x6c]
call fcn.0020867c
jecxz 0x20a9c4
test ebx, ebx
jns 0x20a9bd
push edx
push edi
push ebx
call fcn.00209333
pop ebx
add ebx, eax
add ebx, 2
pop edi
pop edx
call fcn.0020aa61
jmp 0x20aa1a
test ebx, ebx
jns 0x20a9d8
push ecx
push edi
push ebx
call fcn.0020a95f
pop eax
add ebx, eax
add ebx, 2
pop edi
pop ecx
call fcn.0020a2d4
jmp 0x20aa1a
call fcn.00208620
jb 0x20aa51
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0020affe
call fcn.002088f8
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0020affe
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00204c75
Function at 0x20af60
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.0020867c
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.0020867c
jecxz 0x20afd6
test ebx, ebx
je 0x20afde
add ebx, ecx
xchg ecx, ebx
call fcn.00208620
jb 0x20afeb
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.00208654
mov esi, dword [ebp + edi - 0x6c]
call fcn.00208654
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00204c80

Function at 0x20b206
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00208884
jecxz 0x20b23f
call fcn.00208850
jb 0x20b244
cld
push edi
push ecx
push edi
cld
shr ecx, 1
rep movsd dword es:[edi], dword [esi]
adc cl, 0
rep movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffW]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00208654
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.00204c75

Function at 0x20b2df
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.00208620
jb 0x20b302
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.0020a3e6
pop edi
pop ecx
ret

Function at 0x20b327
Capabilities:
Terminate process

Disassembly:
pop edi
pop ecx
call fcn.0020a3e4
jmp fcn.00204c80
push ecx
push edi
mov ecx, 1
call fcn.00208620
jb 0x20b302
mov byte [edi], 0
call fcn.0020a3e6
pop edi
pop ecx
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x414176
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x414185
pop dword [ebp - 0x50]
mov eax, 0x414185
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x56d86f07
sub dword [ebp - 0x60], 0x88629bc
mov dword [ebp - 0x5c], 0x480e57ae
sub dword [ebp - 0x5c], 0x15db0b69
mov dword [ebp - 0x58], 0x9bb35b37
add dword [ebp - 0x58], 0xb098e8f7
mov dword [ebp - 0x54], 0x1b8ade76
add dword [ebp - 0x54], 0xe475218a
lea eax, [ebp - 0x60]
push eax
mov eax, 0x3d80e1fc
sub eax, 0x3d3eb188
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x55db325
add dword [ebp - 0x60], 0x6f14b631
mov dword [ebp - 0x5c], 0xa95e6f68
sub dword [ebp - 0x5c], 0x67f20df3
mov dword [ebp - 0x58], 0x596e671d
add dword [ebp - 0x58], 0xa01054f
mov dword [ebp - 0x54], 0xdeaca44a
sub dword [ebp - 0x54], 0xdeaca44a
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c534
push 0
call eax
mov ecx, 0x4132
xor edx, edx
add edx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x50]
mov ebx, 0x4fdebb3b
add ebx, 0x13d3614c
xor dword [ebp - 0x20], 0x7830693f
mov edi, dword [esi]
add dword [ebp - 0x14], ecx
xor edi, ebx
mov dword [edx], edi
add dword [ebp - 0x44], 0xedc2eab6
add edx, 0x5ed3acbf
add edx, 0xa12c5345
add esi, 4
loop 0x414293
add eax, 0x8c8aa97a
sub eax, 0x8c89b1df
mov ebx, eax
add eax, 0xc7187eef
sub eax, 0xc7187eea
mov ecx, 0xb55f00f5
add ecx, 0x4ae0ff0b
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10007fe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.10092e90
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.10092e90
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10008043
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x10008048
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x10008066
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x10008068
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x1000807c
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x101091a8]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10064e61
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10008960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cb106
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.CBeautifyMinePage::CallWebLogin
call fcn.10015f50
add esp, 4
cmp dword [edi + 0x9c], 0
je 0x10008b2c
cmp dword [edi + 0xdc], 0
je 0x10008b2c
call fcn.100093c0
mov ecx, eax
test ecx, ecx
je 0x10008b48
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x118], esi
mov dword [ebp - 4], 0
call fcn.10040b70
mov ebx, eax
test ebx, ebx
je 0x10008aaa
cmp dword [edi + 0xe0], 8
lea ecx, [edi + 0xcc]
jb 0x100089fb
mov ecx, dword [ecx]
push 0xfde9
push ecx
lea ecx, [ebp - 0x94]
call fcn.10007c80
push dword [eax]
call fcn.10040ba0
push eax
push str.open_id
push ebx
call fcn.10040a60
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
add esp, 0x10
cmp eax, ecx
je 0x10008a3b
push eax
call fcn.1009676e
add esp, 4
push ebx
call fcn.10040e10
add esp, 4
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x10008aa1
push 0xfde9
push eax
lea ecx, [ebp - 0x114]
call fcn.10007b00
push dword [eax]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.100082e0
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0
cmp eax, ecx
je 0x10008a8d
push eax
call fcn.1009676e
add esp, 4
push dword [ebp - 0x11c]
call fcn.1009676e
mov esi, dword [ebp - 0x118]
add esp, 4
push ebx
call fcn.10040c20
add esp, 4
movzx eax, byte [ebp - 0x12c]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], 0
mov dword [ecx], vtable.._AV___Func_impl_no_alloc_V___Binder_U_Unforced_std__P8CBeautifyMinePage__AEXKPB_W_ZPAV3_ABU___Ph__00_2_ABU___Ph__01_2__std__XKPB_W_std__.0
mov dword [ecx + 8], 0x10009e70
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
movzx eax, byte [ebp - 0x12b]
mov byte [ecx + 0x11], al
lea eax, [ebp - 0x120]
push eax
push 1
lea eax, [ebp - 0x124]
mov dword [ecx + 0x14], edi
push eax
mov dword [ecx + 0x24], ecx
lea ecx, [edi + 0x88]
push str.login
call fcn.10034b00
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10008b2c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008920
int3
Function at 0x1000b7c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000b819
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000b819
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000b80a
cmp esi, edx
jae 0x1000b819
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000b7f8
cmp esi, edx
jae 0x1000b819
cmp word [esi], 0
je 0x1000b819
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret