joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a0e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x6b68f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x6a0ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.0069d7a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x6a0e61
mov edx, dword [eax]
jmp 0x6a0e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.0069f050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x6a0ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x6a0ebf
cmp esi, edi
je 0x6a0ebf
mov ecx, esi
call fcn.00698a00
push esi
call fcn.006a61c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.0069d990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x6a0ef5
mov eax, dword [eax]
jmp 0x6a0ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.0069c640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x6a0f25
mov eax, dword [eax]
jmp 0x6a0f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x6a0f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x6a0f76
cmp esi, edi
je 0x6a0f76
mov eax, dword [esi]
cmp eax, edi
je 0x6a0f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x6a0f6d
push eax
call fcn.006a61c8
add esp, 4
push esi
call fcn.006a61c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x6a0f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x6a0ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x6a1035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.006a0e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x6a0fc5
mov edi, 0x6bb8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x6a1035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.006a0e00
add edi, 4
add esp, 0xc
cmp edi, 0x6bb8c0
jb 0x6a1000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x6a1070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.006a7082
mov esi, eax
add esp, 8
test esi, esi
je 0x6a1107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x6a1102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.006a6946
add esp, 8
test eax, eax
je 0x6a10e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x6a10e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.006a6946
add esp, 8
test eax, eax
jne 0x6a10c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x6a1102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x6a1f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x6b69fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x6a2002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.006a5dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x6a2002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.0069d6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.006a620b
push 0x10
call fcn.006a61d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x6a1fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.006921c0
jmp 0x6a1fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.006a1b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x6a1ff0
mov ecx, edi
call fcn.006922c0
push edi
call fcn.006a61c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x6a2021
inc ebx
cmp ebx, 0x20
jb 0x6a1f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x6a3250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b7808
push 0x6a7288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x6a3329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6a3329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.006a61d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x6a3329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x6a3329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x6a332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.006a3351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6a3d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6a3d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x6a3d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6a3d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6a3d94
push eax
push esi
call fcn.006a620b
add esp, 8
pop esi
ret 0x10

Function at 0x6a3da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6a3e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x6a3e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x6bc320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006a5dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x6a3dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x6a3e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6a3ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x6a3eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x6bc320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006a5dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x6a3eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x6a3e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x6a4000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x6a4131
push esi
call fcn.006a7145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00696080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x6a4131
push 0
push ebp
call fcn.006963a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00696260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x6a408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006962f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x6a4121
push 0x6bc918
push edi
call fcn.006a53f0
push eax
push ebx
push esi
call fcn.006a3f60
push 0x6bc8f8
push edi
call fcn.006a53f0
push eax
push ebx
push esi
call fcn.006a3f60
push 0x6bc8d8
push edi
call fcn.006a53f0
push eax
push ebx
push esi
call fcn.006a3f60
push 0x6bc8c0
push edi
call fcn.006a53f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.006a3f60
push 0x6bc8a0
push edi
call fcn.006a53f0
push eax
push ebx
push esi
call fcn.006a3f60
push 0x6bc888
push edi
call fcn.006a53f0
push eax
push ebx
push esi
call fcn.006a3f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6a51b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006a5140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006a5140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006a5140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006a5140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6a5bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6a5c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6b787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6a5c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6a5c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x100389c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.100460a1
add byte [eax], al
push edx
popal
inc esi
imul ebp, dword [ebp], 0x74530000
popal
jb 0x10038a4c
push ebx
jb 0x10038a52
imul esp, dword [ebx + 0x65], 0xe3290041
mov ebx, eax
bt bp, 0xd
call fcn.1003a59b
jns 0x10038a8f
aas
and al, 0x62
popal
jae 0x10038abe
arpl word [edi + 0x73], bx
je 0x10038acc
imul ebp, dword [esi + 0x67], 0x3f554440
and al, 0x63
push 0x745f7261
jb 0x10038acb
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
inc eax
inc eax
push esi
aas
and al, 0x61
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x10038ac2
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x10038afd
inc eax
inc eax
inc ecx
inc ecx
inc ebp
pop eax
pop edi
dec esi
inc eax
pop edx
add byte [eax - 0x73], dl
push eax
lea esp, [esp + 0x10]
je 0x10039797
cmp dh, 0x53
push 0xb8a58771
call fcn.10045ce8
dec al
call fcn.10044974
add byte [eax], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
call fcn.100393ef
or byte [ebp + 0x2fb6534], cl
test byte [ebx - 0x17], ch
dec ebx
add al, 0
add byte [eax - 0x10], dl
pop ds
std
std
xchg bh, dh
xchg edx, eax
outsb dx, byte [esi]
cwde
mov ah, 0x40
ret 0x6d
mov dh, byte [edi + 0x4c6ff020]
lodsd eax, dword [esi]
jge 0x10038b82
or ebp, esp
mov cl, 0x78
dec esi
dec esp
shl dword [edi + eax*4], cl
aam 0x52
push ebp
iretd

Function at 0x10047293
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x10045dbc
test bp, 0x2071
test eax, eax
jmp 0x10038f3f
cmp bx, 0x8195
mov ebp, esp
ror eax, 0x17
sub esp, 0x10
movsx ax, cl
stc
push esi
sub ah, ah
movzx ax, dl
push edi
rcl ah, cl
push ebx
shl al, 2
push edx
sar ah, cl
mov eax, dword [ebp + 8]
jmp 0x100458ed
neg ax
add esp, 4
jge 0x1004650a
mov ebp, esp
or ah, 0x7a
xor ah, 0x60
sub esp, 0x10
movsx eax, cl
btc ax, di
Function at 0x1000f03d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
not edx
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x1000f069
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ba548]
inc edi
sub esi, 1
jne 0x1000f051
not edx
pop edi
mov eax, edx
pop esi
ret

Function at 0x1000f070
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov edx, ebx
test edi, edi
je 0x1000f0d6
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x1000f09e
cmp edi, 2
jb 0x1000f09e
cmp byte [esi], al
jne 0x1000f09e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ba548]
test edi, edi
jne 0x1000f087
jmp 0x1000f0dd
cmp al, 0x23
jne 0x1000f0c4
cmp byte [esi], al
jne 0x1000f0c4
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ba548]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000f0b6
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret

Function at 0x1000fa2e
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.10099bc2
add esp, 0x10
xor edx, edx
ret
Function at 0x1001a373
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7f5f
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10110480]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x30], 0
je 0x1001a3a7
push dword [esi + 0x30]
call fcn.10018da8
pop ecx
cmp dword [esi + 0x34], 0
je 0x1001a3b6
push dword [esi + 0x34]
call fcn.10018da8
pop ecx
and dword [ebp - 4], 0
lea eax, [esi + 0x64]
push 0x10019b9f
push 2
push 0xc
push eax
call fcn.10092914
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x10041bd3
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
test byte [edi], 4
jne 0x10041d91
imul eax, dword [edi + 0x46c], 0x1c
lea ecx, [edi + 0x60]
push ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
add eax, dword [edi + 0x50]
xor ebx, ebx
mov dword [esp + 0x18], eax
movzx ebp, word [eax]
movzx ecx, word [eax + 6]
mov esi, ebp
movzx eax, word [eax + 4]
add ecx, ebx
imul ecx, dword [edi + 0x24]
sub esi, ebx
mov edx, dword [edi + 0x1c]
shr esi, 1
sub ebp, esi
sub ebp, ebx
add ecx, eax
test edx, edx
je 0x10041c6c
lea eax, [edx + ecx]
mov dword [esp + 0x10], eax
test esi, esi
je 0x10041c3d
push esi
push 0
push eax
call fcn.100958c0
mov eax, dword [esp + 0x1c]
add esp, 0xc
test ebx, ebx
je 0x10041c52
push ebx
add eax, esi
push 0xff
push eax
call fcn.100958c0
add esp, 0xc
test ebp, ebp
je 0x10041cb7
mov eax, dword [esp + 0x10]
push ebp
add eax, esi
add eax, ebx
push 0
push eax
call fcn.100958c0
add esp, 0xc
jmp 0x10041cb7
mov eax, dword [edi + 0x20]
mov edx, esi
shl edx, 2
lea edi, [eax + ecx*4]
mov dword [esp + 0x10], edi
test esi, esi
je 0x10041c8f
mov ecx, edx
mov eax, 0xffffff
shr ecx, 2
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
test ebx, ebx
je 0x10041c9c
add edi, edx
mov ecx, ebx
or eax, 0xffffffff
rep stosd dword es:[edi], eax
test ebp, ebp
je 0x10041cb3
mov ecx, dword [esp + 0x10]
lea eax, [esi + ebx]
lea edi, [ecx + eax*4]
mov ecx, ebp
mov eax, 0xffffff
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
movzx edx, word [ecx + 4]
movzx ecx, word [ecx + 6]
add ecx, ebx
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100be000]
lea eax, [edx - 1]
add eax, esi
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x100be000]
cvtpd2ps xmm0, xmm0
addss xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, dword [edi + 0x30]
addsd xmm0, qword [eax*8 + 0x100be000]
lea eax, [edx + 1]
add eax, esi
mulss xmm1, dword [0x100ba4c0]
add eax, ebx
lea esi, [esp + 0x1c]
cvtpd2ps xmm0, xmm0
movss dword [esp + 0x20], xmm1
mulss xmm0, dword [edi + 0x2c]
movss dword [esp + 0x28], xmm1
movss dword [esp + 0x1c], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
inc ebx
addsd xmm0, qword [eax*8 + 0x100be000]
mov eax, dword [esp + 0x14]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x2c]
mov edi, eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
movss dword [esp + 0x24], xmm0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x30]
cmp ebx, 0x40
jb 0x10041bfe
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x1c
ret
Function at 0x10050f89
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
dec ebx
cmp ebp, ebx
jg 0x10050ff5
push 0x1f
pop edx
mov ecx, ebx
and ecx, edx
push esi
mov dword [esp + 0x18], ecx
push edi
mov eax, ebp
mov edi, ebp
or eax, edx
sar edi, 5
cmp ebx, eax
push 0x1f
cmovg ecx, edx
xor esi, esi
inc ecx
xor eax, eax
bts esi, ecx
cmp ecx, 0x20
mov ecx, ebp
cmovae eax, esi
and ecx, edx
xor esi, eax
xor edx, edx
bts edx, ecx
xor eax, eax
dec esi
cmp ecx, 0x20
mov ecx, dword [esp + 0x20]
cmovae eax, edx
add ebp, 0x20
xor edx, eax
and ebp, 0xffffffe0
mov eax, dword [esp + 0x18]
neg edx
and esi, edx
pop edx
or dword [eax + edi*4], esi
cmp ebp, ebx
jle 0x10050fa5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10070c79
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x24]
push 9
pop ecx
xor eax, eax
xor ebx, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [esi], ebx
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + 8]
div ecx
push 0x40
sub ecx, edx
add ecx, dword [ebp + 8]
test edx, edx
push 0x3000
cmove ecx, dword [ebp + 8]
push ecx
push ebx
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100711cf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10110480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.d3d9.dll
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.100a7291
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
lea ecx, [edx + esi]
cmp edx, ecx
jae 0x10071248
mov ecx, 0x8689
inc edx
mov eax, 0x6c7
cmp word [edx], ax
jne 0x10071241
cmp word [edx + 6], cx
jne 0x10071241
cmp word [edx + 0xc], cx
je 0x1007125b
lea eax, [esi + edx]
cmp edx, eax
jb 0x1007122a
inc edx
mov ecx, dword [ebp - 4]
mov eax, edx
pop edi
xor ecx, ebp
pop esi
call fcn.1009280f
leave
ret 4
add edx, 2
jmp 0x10071249