joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59c051
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x667d00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x324]
push edi
mov edi, dword [ebp + 0xc]
push 0x190
push 0
push eax
call fcn.005a26c0
mov ebx, 0xc8
lea eax, [ebp - 0xcc]
push ebx
push 0
push eax
call fcn.005a26c0
push ebx
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.005a26c0
push edi
push esi
lea eax, [ebp - 0x194]
push 0x5d82f0
push eax
call fcn.00405e00
push esi
lea eax, [ebp - 0x324]
push str.SOFTWARE_sCapabilitiesFileAssociations
push eax
call fcn.00405e00
add esp, 0x40
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.005b023d
lea eax, [ebp - 0xcc]
push 0x5d4964
push eax
call fcn.005b01cc
lea eax, [ebp - 0xcc]
push edi
push eax
call fcn.005b01cc
add esp, 0x18
lea eax, [ebp - 0xcc]
mov esi, reloc.WS2_32.dll_bind
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x194]
push eax
call fcn.005b025f
pop ecx
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push edi
lea eax, [ebp - 0x324]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059d38a
leave
ret 8

Function at 0x59c239
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x667d00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.005a26c0
add esp, 0xc
mov dword [ebp - 0x218], 0x114
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x214], 6
jb 0x59c2fe
lea eax, [ebp - 0x21c]
push eax
push str._n_vSN
push 3
push esi
push 0x5de730
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x59c2fe
lea eax, [ebp - 0x104]
mov dword [ebp - 0x220], esi
push 0x5d4e18
push eax
call fcn.005b023d
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x220]
pop ecx
pop ecx
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push 1
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0x220], esi
jne 0x59c2f2
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x104]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push esi
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059d38a
leave
ret
Function at 0x59eae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.005a02b0
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.005a0260
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.005a0300
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x59eb1c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x59eb70
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x59eb60
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x59eb60
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x59f1c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3ac6
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x667d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x59f21a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x59f237
mov eax, dword [esi + 0x20]
jmp 0x59f23a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x59f254
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x59f26e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x59f288
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.005aaa26
push eax
call fcn.005b0c60
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.005a26c0
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x59f347
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.005a26c0
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x59f338
test eax, eax
je 0x59f338
add eax, eax
cmp eax, 0x412
jae 0x59f333
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x59f33e
call fcn.0059defb
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.0059f4f0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x59f373
cmp dword [esi + 0x34], 8
jb 0x59f359
mov ecx, dword [esi + 0x20]
jmp 0x59f35c
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x59f373
push 1
push 0x649968
lea ecx, [esi + 0x20]
call fcn.005a0590
cmp dword [esi + 0x30], 0
jne 0x59f388
push 3
push 0x64996c
lea ecx, [esi + 0x20]
call fcn.0059ee20
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059d38a
mov esp, ebp
pop ebp
ret
Function at 0x59f3b0
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x59f3cc
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x59f3c5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x59f3e9
push eax
call fcn.0059d3c7
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x59f3ff
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.0059ef20
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x59f415
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x59f430
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.0059ef20
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x59f446
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x59f461
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.0059ef20
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x59f477
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x59f492
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.0059ef20
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x59f4a8
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x59f4c2
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.0059ef20
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x59f4e1
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x5a10c0
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x5a10fe
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x5a10fe
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x5bff2e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005bfdad

Function at 0x5c3ed9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005c3b99

Function at 0x5c4109
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005c400e
Function at 0x401970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x408508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
mov eax, dword [ebp]
push edi
mov edi, ecx
push 0x40b49c
push eax
mov dword [esp + 0x14], edi
call esi
add esp, 8
test eax, eax
je 0x401b8f
push ebx
lea eax, [esp + 0x30]
push 3
push eax
mov ecx, ebp
call sub.MFC42.DLL_CString::Left
mov ecx, dword [esp + 0x30]
push 0x40b084
push ecx
mov dword [esp + 0x2c], 0
mov ebx, 1
call esi
add esp, 8
test eax, eax
jne 0x4019e0
mov edx, dword [esp + 0x30]
push 0x40b080
push edx
call esi
add esp, 8
test eax, eax
jne 0x4019f8
mov ebx, 2
mov eax, dword [esp + 0x30]
push 0x40b07c
push eax
call esi
add esp, 8
test eax, eax
jne 0x401a10
mov ebx, 3
mov ecx, dword [esp + 0x30]
push 0x40b078
push ecx
call esi
add esp, 8
test eax, eax
jne 0x401a28
mov ebx, 4
mov edx, dword [esp + 0x30]
push 0x40b074
push edx
call esi
add esp, 8
test eax, eax
jne 0x401a40
mov ebx, 5
mov eax, dword [esp + 0x30]
push 0x40b070
push eax
call esi
add esp, 8
test eax, eax
jne 0x401a58
mov ebx, 6
mov ecx, dword [esp + 0x30]
push 0x40b06c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x401a70
mov ebx, 7
mov edx, dword [esp + 0x30]
push 0x40b068
push edx
call esi
add esp, 8
test eax, eax
jne 0x401a88
mov ebx, 8
mov eax, dword [esp + 0x30]
push 0x40b064
push eax
call esi
add esp, 8
test eax, eax
jne 0x401aa0
mov ebx, 9
mov ecx, dword [esp + 0x30]
push 0x40b060
push ecx
call esi
add esp, 8
test eax, eax
jne 0x401ab8
mov ebx, 0xa
mov edx, dword [esp + 0x30]
push 0x40b05c
push edx
call esi
add esp, 8
test eax, eax
jne 0x401ad0
mov ebx, 0xb
mov eax, dword [esp + 0x30]
push 0x40b058
push eax
call esi
add esp, 8
test eax, eax
jne 0x401ae8
mov ebx, 0xc
push 4
lea ecx, [esp + 0x18]
push 7
push ecx
mov ecx, ebp
call sub.MFC42.DLL_CString::Mid
mov eax, dword [eax]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push eax
call edi
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
call sub.MFC42.DLL_CString::CString
cmp esi, 0x7b2
jle 0x401b63
push 2
lea edx, [esp + 0x18]
push 4
push edx
mov ecx, ebp
call sub.MFC42.DLL_CString::Mid
mov eax, dword [eax]
push eax
call edi
add esp, 4
lea ecx, [esp + 0x14]
mov edi, eax
call sub.MFC42.DLL_CString::CString
push 0xffffffffffffffff
push 0
push 0
push 0
push edi
push ebx
push esi
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CTime::CTime
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x401b67
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x401d10
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x12b60
call fcn.00408070
mov eax, dword [esp + 0x12b70]
test eax, eax
jbe 0x401e29
xor eax, eax
mov byte [esp + eax + 8], al
inc eax
cmp eax, 0x12b57
jb 0x401d2b
push ebx
push ebp
mov ebp, dword [esp + 0x12b6c]
push esi
push edi
mov edi, dword [esp + 0x12b78]
xor esi, esi
xor ecx, ecx
mov eax, ecx
xor edx, edx
div edi
mov bl, byte [esp + ecx + 0x18]
xor eax, eax
mov al, byte [edx + ebp]
mov edx, eax
mov eax, ebx
and eax, 0xff
add esi, edx
add eax, esi
xor edx, edx
mov esi, 0x12b57
div esi
inc ecx
cmp ecx, 0x12b57
mov esi, edx
mov al, byte [esp + esi + 0x18]
mov byte [esp + ecx + 0x17], al
mov byte [esp + esi + 0x18], bl
jb 0x401d4d
mov eax, dword [esp + 0x12b80]
mov ebp, dword [esp + 0x12b7c]
xor edi, edi
xor esi, esi
dec eax
mov ecx, eax
mov dword [esp + 0x12b80], eax
inc ecx
mov dword [esp + 0x10], ecx
lea eax, [esi + 1]
xor edx, edx
mov ecx, 0x12b57
mov bl, byte [ebp]
div ecx
push 0
push 0
mov esi, edx
xor edx, edx
mov cl, byte [esp + esi + 0x20]
mov eax, ecx
mov byte [esp + 0x1c], cl
and eax, 0xff
add eax, edi
mov edi, 0x12b57
div edi
mov edi, edx
mov dl, byte [esp + edi + 0x20]
mov byte [esp + esi + 0x20], dl
mov byte [esp + edi + 0x20], cl
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov ecx, dword [esp + 0x14]
xor eax, eax
mov al, byte [esp + esi + 0x18]
and ecx, 0xff
add eax, ecx
mov ecx, 0x12b57
cdq
idiv ecx
mov eax, dword [esp + 0x10]
mov dl, byte [esp + edx + 0x18]
xor dl, bl
mov byte [ebp], dl
inc ebp
dec eax
mov dword [esp + 0x10], eax
jne 0x401daa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12b60
ret
xor eax, eax
add esp, 0x12b60
ret
Function at 0x405850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x408d38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x13c]
lea ecx, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x138], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x140]
mov ecx, esi
push edx
mov dword [esp + 0xc], 2
call fcn.00405920
mov ecx, dword [esp + 0x13c]
mov edi, dword [esp + 0x138]
push 0
push 0
mov dword [esp + 0x24], eax
push ecx
lea eax, [esp + 0x30]
push edi
push 1
lea ecx, [esi + 0x16c]
mov dword [esp + 0x28], eax
call sub.MFC42.DLL_CTabCtrl::InsertItem
mov eax, dword [esi + 0x18c]
lea edx, [esp + 8]
push edx
push edi
push 0x1306
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x13c]
mov dword [esp + 0x130], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x128]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x12c
ret 0xc

Function at 0x405e40
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x405e58
cmp eax, 5
jne 0x405e6f
lea eax, [esp + 8]
push 3
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::Left
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, 1
pop esi
ret 4
Function at 0x406240
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x408dfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
mov eax, dword [esp + 0x158]
push ebx
push ebp
push esi
push edi
push eax
lea ecx, [esp + 0x18]
xor esi, esi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
push 1
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x168], esi
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x40b230
push eax
call edi
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x4062bc
push 0x40b230
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator
push 0x40b22c
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406347
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x18], 0x10
je 0x406330
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0x10]
push 0x40b228
push edx
call edi
add esp, 8
test eax, eax
je 0x406327
mov eax, dword [esp + 0x10]
push 0x40b224
push eax
call edi
add esp, 8
test eax, eax
je 0x406327
mov esi, 1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
push ecx
push ebp
call ebx
test eax, eax
je 0x406340
test esi, esi
je 0x4062e7
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov dword [esp + 0x160], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x158]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x154
ret 4
Function at 0x10001d20
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008b690
push 0x1007d075
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x10091040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001db5
xor al, al
jmp 0x10001e3e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001de0
xor al, al
jmp 0x10001e3e
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001e2b
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1007d0a4
mov esp, ebp
pop ebp
ret
Function at 0x10002b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e4c0
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x10091040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xb0], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x98
mov ebx, eax
lea eax, [ebp - 0xa8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea ecx, [ebp - 0xa8]
call fcn.100042b0
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x100899b0]
movups xmmword [ebp - 0xc4], xmm0
mov dword [ebp - 0xb4], 0x87327
nop word [eax + eax]
mov cl, byte [ebp - 0xc4]
xor byte [ebp + eax - 0xc3], cl
inc eax
cmp eax, 0x12
jb 0x10002bd0
lea edx, [ebp - 0xc3]
mov byte [ebp - 0xb1], 0
lea ecx, [ebp - 0xa8]
call fcn.10003930
push 0x10003860
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push 0x10003840
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push 0
mov esi, eax
lea eax, [ebp - 0xd8]
push 8
push eax
call dword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov ecx, eax
add esp, 0xc
mov eax, dword [esi]
push dword [ecx + 0xc]
mov eax, dword [eax + 4]
push dword [ecx + 8]
add eax, esi
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
mov eax, dword [eax + 4]
push ebx
mov byte [eax + esi + 0x40], 0x30
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
mov byte [ebp - 0xaa], 0
mov dl, 0x7b
mov byte [ebp - 0xaa], 0
mov al, 0x26
mov byte [ebp - 0xac], dl
xor al, dl
lea edx, [ebp - 0xab]
mov byte [ebp - 0xab], al
call fcn.10003930
push edi
lea ecx, [ebp - 0xa8]
call fcn.10003750
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xa8], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 4]
lea ecx, [edx - 0x50]
mov dword [ebp + edx - 0xac], ecx
lea ecx, [ebp - 0xa4]
call fcn.10004200
lea ecx, [ebp - 0xa0]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007d0a4
mov esp, ebp
pop ebp
ret