joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5acd8c
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd0c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x2f4], edx
mov dword [ebp - 0x2ec], edx
mov dword [ebp - 0x2f0], edx
mov dword [ebp - 0x2e4], edx
mov dword [ebp - 0x2e8], edx
mov dword [ebp - 0x2e0], edx
mov dword [ebp - 0x2d8], edx
mov dword [ebp - 0x2dc], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x5acfac
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2dc]
xor eax, eax
call fcn.004045f4
mov eax, dword [ebp - 0x2dc]
lea edx, [ebp - 0x2d8]
call fcn.00414e68
lea eax, [ebp - 0x2d8]
mov edx, 0x5acfc8
call fcn.00407bdc
mov edx, dword [ebp - 0x2d8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00407a0c
lea eax, [ebp - 0x2e0]
mov edx, dword [ebp - 4]
call fcn.004079e4
mov edx, dword [ebp - 0x2e0]
lea eax, [ebp - 0x2d4]
call fcn.00404a70
lea eax, [ebp - 0x2d4]
call fcn.00404808
call fcn.0040437c
mov edx, 0x5acff0
lea eax, [ebp - 0x2d4]
call fcn.00408178
call fcn.0040527c
call fcn.0040437c
push 0x5ad008
lea edx, [ebp - 0x2e8]
xor eax, eax
call fcn.004045f4
push dword [ebp - 0x2e8]
push 0x5ad020
lea eax, [ebp - 0x2e4]
mov edx, 3
call fcn.00407d80
mov edx, dword [ebp - 0x2e4]
lea eax, [ebp - 0x2d4]
call fcn.00408178
call fcn.0040527c
call fcn.0040437c
push 0x5ad030
lea edx, [ebp - 0x2f0]
xor eax, eax
call fcn.004045f4
push dword [ebp - 0x2f0]
push 0x5ad054
lea eax, [ebp - 0x2ec]
mov edx, 3
call fcn.00407d80
mov edx, dword [ebp - 0x2ec]
lea eax, [ebp - 0x2d4]
call fcn.00408178
call fcn.0040527c
call fcn.0040437c
push 0x5ad078
push dword [ebp - 4]
push 0x5ad08c
lea eax, [ebp - 0x2f4]
mov edx, 3
call fcn.00406ff8
mov edx, dword [ebp - 0x2f4]
lea eax, [ebp - 0x2d4]
call fcn.0040731c
call fcn.0040527c
call fcn.0040437c
lea eax, [ebp - 0x2d4]
call fcn.00404c14
call fcn.0040437c
mov esi, 0x46
mov eax, esi
call fcn.00404214
mov ebx, eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetShortPathNameW
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00406d60
mov eax, ebx
call fcn.00404230
push 0
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_WinExec
call fcn.00406880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5acfb3
lea eax, [ebp - 0x2f4]
call fcn.00406a58
lea eax, [ebp - 0x2f0]
mov edx, 7
call fcn.004077c0
lea eax, [ebp - 4]
call fcn.00406a58
ret
Function at 0x5ad76c
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5ad7a6
cmp dword [esp + 4], 6
jne 0x5ad7a2
cmp dword [esp + 8], 1
jne 0x5ad7a2
cmp dword [esp + 0xc], 0x1db0
jb 0x5ad7a2
mov eax, 1
jmp 0x5ad7a9
xor eax, eax
jmp 0x5ad7a9
or eax, 0xffffffff
add esp, 0x114
ret
Function at 0x549a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x98e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0xb2014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0xb30ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.000680c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0xb2a8c
push eax
call fcn.000680c0
mov esi, dword [0xb30fc]
xor ebx, ebx
mov edi, dword [0xb3100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0xb6390], bl
mov eax, ebx
mov ecx, 0xb30ec
cmovae ecx, dword [0xb30ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0xb64a0], al
inc ebx
cmp ebx, 0x100
jl 0x54a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0xb6390]
movzx eax, byte [esi + 0xb64a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x54a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0xb6390]
mov byte [esi + 0xb6390], al
inc esi
mov byte [edi + 0xb6390], dl
cmp esi, 0x100
jl 0x54a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00054690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x54ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x54abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54b1f
push edx
push ecx
call fcn.0006d663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x54b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x54b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54b1f
push edx
push ecx
call fcn.0006d663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00086c6a
int3
Function at 0x570a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0xb2014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x50e01ad
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x57289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x57289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.000840f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x50e0237
nop
test eax, eax
je 0x57289
push 4
push 0x1000
push 4
push 0
call 0x50d0e94
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x50c0006
nop
test eax, eax
je 0x57289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0xa8df8
push dword [esp + 0x30]
call 0x50c0271
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x571ac
push 0xa8dfc
push 0xa8e14
call 0x50d0c18
nop
push eax
call 0x50c0080
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x50c018d
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x57289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x50e00a5
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x57243
mov dword [esp + 0xc], eax
call fcn.00056ef0
push eax
call 0x50d0afb
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x50e00a5
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x571f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x50e00a5
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x50c0361
nop
push dword [esp + 0x24]
call 0x50d0cd7
nop
push 0x8000
push 0
push esi
call 0x50e0000
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0006cff1
mov esp, ebp
pop ebp
ret
Function at 0x5af20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x99726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0xb2014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.00088b63
push eax
call fcn.00086660
add esp, 8
call fcn.0008663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.0008663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.0008663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.000545b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x5afd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x5afe6
push 0x40
push 0
push 0xb8560
sub esi, ecx
call fcn.000840f0
add esp, 0xc
mov dword [0xb8554], 0
mov edx, esi
mov dword [0xb8550], 0
lea ecx, [ebp - 0x410]
mov dword [0xb8540], 0x67452301
mov dword [0xb8544], 0xefcdab89
mov dword [0xb8548], 0x98badcfe
mov dword [0xb854c], 0x10325476
call fcn.00055530
call fcn.000555f0
mov ecx, 0xb65a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b071
sub ecx, edx
push ecx
push 0xb65a0
lea ecx, [ebp - 0x42c]
call fcn.000680c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x5b0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5b0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5b18c
push edx
push ecx
call fcn.0006d663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0x5b187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.000680c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0x5b169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5b15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5b18c
push edx
push ecx
call fcn.0006d663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0006cff1
mov esp, ebp
pop ebp
ret
call fcn.00068200
call fcn.00086c6a
int3
Function at 0x6dcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x50f0ea7
nop
test eax, eax
je 0x6dd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6dd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6dd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6dd07
cmp dword [ecx + 0x74], 0xe
jbe 0x6dd07
cmp dword [ecx + 0xe8], 0
je 0x6dd07
mov al, 1
ret
xor al, al
ret
Function at 0x4014f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
inc esp
and al, 0x30
Function at 0x402dd0
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x28
or eax, 0xffffffff
mov word [esp + 0x10], ax
push ebp
xor ecx, ecx
mov eax, 0x65
xor ebp, ebp
mov dword [esp + 0x20], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [esp + 0x24], ebp
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
xor ecx, ecx
push 4
mov dword [esp + 0x24], eax
mov word [eax], cx
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42b3f4
mov dword [eax], 1
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x3c]
cmp dword [edx + 8], ebp
jbe 0x402e63
xor edi, edi
mov eax, edx
mov ecx, dword [eax + 4]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x402e5d
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x402f2d
push esi
call fcn.004112ef
mov eax, dword [esp + 0x40]
add esp, 4
inc edi
cmp edi, dword [eax + 8]
jb 0x402e38
mov edx, dword [esp + 0x3c]
mov dword [edx + 8], ebp
cmp word [ebx], bp
je 0x40306f
jmp 0x402e80
cmp ax, 0x30
jl 0x402e50
mov ecx, dword [esi]
test ecx, ecx
je 0x402e50
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x10], ecx
cmp dword [edx], ebp
je 0x42b3fd
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004112ef
add esp, 4
jmp 0x402e50
add bh, bh
pop es
adc cl, byte [ecx + ecx*4]
push ss
jmp 0x4035b9
Function at 0x40f450
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004151b0
add esp, 0x10
cmp eax, 0x18
jl 0x40f531
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x40f4fd
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x40f521
cmp ecx, 0x14
je 0x42937a
inc edx
cmp edx, edi
jl 0x40f4e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.0041557c
add esp, 0xc
jmp 0x40f4b0
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x40f543
inc ecx
jmp 0x40f4ef
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
je 0x40f555
add ecx, 2
jmp 0x40f4ef
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x429372
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x429361
add ecx, 4
jmp 0x40f4ef
invalid

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x10019f80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x9c], 0
jne 0x10019fb9
push 0
push 0
lea eax, [esi + 0x84]
push eax
push 0x10019fd0
push 0
push 0
call fcn.10073493
xor ecx, ecx
mov dword [esi + 0x9c], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
pop esi
ret
push dword [esi + 0x8c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop esi
ret
Function at 0x100269c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x101b36e4
pop ebp
jmp fcn.1002d3e0
Function at 0x10030ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101ae960]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 0x1cb]
push 0x1008fb70
push 0x104
push edi
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 1
call fcn.10073d16
push 0x12
push str.REGISTRYMACHINE_
push esi
call fcn.10074e60
add esp, 0x18
test eax, eax
jne 0x10030f37
add esi, 0x12
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10031000
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 3
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 0x104
push eax
push 0
push str.HardwareInformation.AdapterString
push dword [ebp - 0x210]
call esi
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0
push eax
push 0x104
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.10074e36
add esp, 0x14
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
push 0
push str.DriverVersion
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10072374
mov esp, ebp
pop ebp
ret 8
Function at 0x10031640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100898de
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ae960]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x2dc], 0
mov dword [esi + 0x2e0], 0
mov dword [esi + 0x2e4], 0
mov dword [ebp - 4], 0
lea eax, [esi + 0xd0]
push 0x104
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 8
push eax
mov dword [esi + 0xc], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2d8], 0
mov dword [esi + 0x2f0], 0
mov dword [esi + 0x2f4], 0
mov dword [esi + 0x2e8], 0
mov dword [esi + 0x2ec], 0
call fcn.100739c0
push 0x104
lea eax, [esi + 0x1d4]
push 0
push eax
call fcn.100739c0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, 0x428a2f98
mov edx, 0x71374491
mov esi, 0xb5c0fbcf
test edi, edi
je 0x1003605c
push ebx
mov ebx, dword [ebp + 8]
nop
xor ecx, dword [ebx]
lea ebx, [ebx + 4]
sub ecx, esi
mov eax, esi
shr eax, 0xd
sub ecx, edx
xor ecx, eax
sub edx, esi
sub edx, ecx
mov eax, ecx
shl eax, 8
xor edx, eax
sub esi, edx
mov eax, edx
sub esi, ecx
shr eax, 0xd
xor esi, eax
sub ecx, esi
mov eax, esi
shr eax, 0xc
sub ecx, edx
xor ecx, eax
sub edx, esi
sub edx, ecx
mov eax, ecx
shl eax, 0x10
xor edx, eax
sub esi, edx
mov eax, edx
sub esi, ecx
shr eax, 5
xor esi, eax
sub ecx, esi
mov eax, esi
shr eax, 3
sub ecx, edx
xor ecx, eax
sub edx, esi
mov eax, ecx
sub edx, ecx
shl eax, 0xa
xor edx, eax
sub esi, edx
mov eax, edx
sub esi, ecx
shr eax, 0xf
xor esi, eax
dec edi
jne 0x10035ff0
pop ebx
xor eax, eax
pop edi
or eax, esi
pop esi
pop ebp
ret 8
Function at 0x10053ba0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x101b0c38], 0
mov dword [ebp - 4], 0
je 0x10053bff
push 0x1008f60c
lea eax, [ebp - 4]
push 0x101b0cb0
push eax
call fcn.100748aa
mov ecx, dword [ebp + 0xc]
add esp, 0xc
test ecx, ecx
je 0x10053c5a
mov eax, dword [ebp - 4]
test eax, eax
je 0x10053c02
lea edx, [ebp + 0x10]
push edx
push ecx
push eax
call fcn.10076355
push 0x10090864
push dword [ebp - 4]
call fcn.10074a01
push dword [ebp - 4]
call fcn.1007440a
add esp, 0x18
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10053c5a
mov eax, dword [0x101b0c08]
test dword [ebp + 8], eax
je 0x10053c5a
push esi
push edi
lea eax, [ebp + 0x10]
push eax
push ecx
call fcn.100764cc
lea esi, [eax + 1]
push esi
call fcn.10071b67
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10053c58
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
push edi
call fcn.100764b1
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
push str.INTC_OCLRT:
call esi
push edi
call esi
push edi
call fcn.10073079
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100547b0
Capabilities:
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push str.gdi32.dll
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x40], eax
test eax, eax
je 0x10054918
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.D3DKMTOpenAdapterFromHdc
push eax
call edi
mov dword [esi], eax
test eax, eax
je 0x10054918
mov ecx, esi
call fcn.10054700
cmp eax, 0x60002
jl 0x10054805
push str.D3DKMTOpenAdapterFromLuid
push dword [esi + 0x40]
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x10054918
push str.D3DKMTQueryAdapterInfo
push dword [esi + 0x40]
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x10054918
push str.D3DKMTCloseAdapter
push dword [esi + 0x40]
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x10054918
push str.D3DKMTCreateDevice
push dword [esi + 0x40]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x10054918
push str.D3DKMTDestroyDevice
push dword [esi + 0x40]
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x10054918
push str.D3DKMTCreateContext
push dword [esi + 0x40]
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x10054918
push str.D3DKMTDestroyContext
push dword [esi + 0x40]
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x10054918
push str.D3DKMTCreateAllocation
push dword [esi + 0x40]
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x10054918
push str.D3DKMTDestroyAllocation
push dword [esi + 0x40]
call edi
mov dword [esi + 0x28], eax
test eax, eax
je 0x10054918
push str.D3DKMTLock
push dword [esi + 0x40]
call edi
mov dword [esi + 0x34], eax
test eax, eax
je 0x10054918
push str.D3DKMTUnlock
push dword [esi + 0x40]
call edi
mov dword [esi + 0x38], eax
test eax, eax
je 0x10054918
push str.D3DKMTRender
push dword [esi + 0x40]
call edi
mov dword [esi + 0x3c], eax
test eax, eax
je 0x10054918
push str.D3DKMTEscape
push dword [esi + 0x40]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x10054918
push str.D3DKMTOpenResource
push dword [esi + 0x40]
call edi
mov dword [esi + 0x2c], eax
test eax, eax
je 0x10054918
push str.D3DKMTQueryResourceInfo
push dword [esi + 0x40]
call edi
mov dword [esi + 0x30], eax
test eax, eax
je 0x10054918
pop edi
mov ecx, esi
pop esi
jmp fcn.10056050
pop edi
xor eax, eax
pop esi
ret