joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000eab0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f849b
mov eax, dword fs:[0]
push eax
mov eax, 0x1044
call fcn.100721f0
mov eax, dword [0x1013306c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0xc], 0
jl 0x1000ec4e
jg 0x1000eafa
cmp dword [ebp + 8], 0x10
jb 0x1000ec4e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1000eb2d
push 2
push 0
push 0
lea edi, [esi + 0xc]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1000eb2d
mov eax, dword [edi]
cdq
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov edi, dword [esi + 0x10]
mov eax, edi
mov esi, dword [esi + 0x14]
or eax, esi
je 0x1000ec31
mov dword [ebp - 0x1034], 0xffffffff
push 0x1000
lea eax, [ebp - 0x1028]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x102c], 0
call fcn.100cdcc0
add esp, 8
mov dword [ebp - 0x20], edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x1050]
mov dword [ebp - 0x1c], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x28], reloc.WS2_32.dll_accept
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edi
call fcn.1000f650
add esp, 4
lea ecx, [ebp - 0x102c]
cmp dword [ebp - 0x103c], 8
lea eax, [ebp - 0x1050]
cmovae eax, dword [ebp - 0x1050]
push 0xffffffffffffffff
push ecx
push 0x400
lea ecx, [ebp - 0x1028]
push ecx
push 0x18
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
mov ebx, eax
test ebx, ebx
jne 0x1000ebee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._BasicNamedPipe_char_t_::Call__failed__GetLastError_returned__d
call fcn.1000f510
add esp, 8
test ebx, ebx
mov edx, dword [ebp - 0x103c]
setne bl
cmp edx, 8
jb 0x1000ec2d
mov ecx, dword [ebp - 0x1050]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000ec23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ec7e
push edx
push ecx
call fcn.100713c7
add esp, 8
test bl, bl
jne 0x1000ec48
xorps xmm0, xmm0
movlpd qword [ebp - 0x1038], xmm0
mov edi, dword [ebp - 0x1034]
mov esi, dword [ebp - 0x1038]
mov eax, esi
mov edx, edi
jmp 0x1000ec60
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070d87
mov esp, ebp
pop ebp
ret 0x10
call fcn.100d4798
int3
Function at 0x1000f510
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.100721f0
mov eax, dword [0x1013306c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea eax, [ebp + 0xc]
mov edx, 0x1000
push eax
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x100c]
push 0xffd
call fcn.1000f4d0
add esp, 0x10
lea esi, [ebp - 0x100c]
test eax, eax
mov ecx, 0xffd
cmovs eax, ecx
add esi, eax
lea eax, [ebp - 0x100c]
cmp esi, eax
jbe 0x1000f584
movsx eax, byte [esi - 1]
push eax
call fcn.100d4af1
add esp, 4
test eax, eax
je 0x1000f584
dec esi
lea eax, [ebp - 0x100c]
mov byte [esi], 0
cmp esi, eax
ja 0x1000f565
lea eax, [ebp - 0x100c]
mov word [esi], 0xa0d
push eax
mov byte [esi + 2], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.10070d87
mov esp, ebp
pop ebp
ret

Function at 0x1000f750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1013306c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov ebx, edx
lea eax, [ebp - 0xc]
mov edi, ecx
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000f801
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x1000f797
cmp eax, 2
je 0x1000f797
cmp eax, 7
jne 0x1000f801
mov eax, dword [ebp - 0xc]
inc eax
push eax
call fcn.100713d5
mov esi, eax
add esp, 4
test esi, esi
je 0x1000f801
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push edi
mov byte [ecx + esi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test eax, eax
jne 0x1000f7e5
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000f7d2
mov ecx, dword [ebp - 0x10]
sub edx, edi
push edx
push esi
call fcn.10004c40
push esi
call fcn.10070d98
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070d87
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10070d87
mov esp, ebp
pop ebp
ret

Function at 0x1000f820
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013306c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [ebp + 8]
mov edi, ecx
push 0
push 0
push 0
lea esi, [edi + 8]
mov dword [edi + 4], 0
push esi
lea ecx, [ebp - 8]
mov dword [esi], 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov dword [edi], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, eax
mov eax, dword [esi]
inc eax
mov dword [esi], eax
test ecx, ecx
je 0x1000f88a
push dword [edi + 4]
mov dword [edi + 8], 0
call fcn.10070d98
mov dword [edi + 4], 0
jmp 0x1000f893
push eax
call fcn.100713d5
mov dword [edi + 4], eax
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
call fcn.10070d87
mov esp, ebp
pop ebp
ret 4
Function at 0x10012030
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f88f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1013306c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x10137af4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x10137af4
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x1011bac0
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10011040
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x1001225c
cmp byte [esi + 0x2c], bl
jne 0x10012346
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012250
jmp 0x1001232c
mov edi, dword [esi + 0x18]
test edi, edi
je 0x10012272
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x10012263
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.100d680c
push ebx
call fcn.100d62e2
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.100d680c
add esp, 0x1c
test edi, edi
jg 0x100122dd
cmp byte [esi + 0x2c], 0
jne 0x10012346
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100122d4
jmp 0x1001232c
lea eax, [edi + 1]
push eax
call fcn.100713d5
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.100d9f3e
add esp, 0x14
cmp eax, 1
je 0x1001234f
push edi
call fcn.10070d98
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x10012346
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012325
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.10011040
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [edi + ebx], 0
mov eax, edi
mov cl, byte [edi]
mov edx, edi
test cl, cl
je 0x10012383
nop dword [eax]
mov dword [ebp + 8], eax
lea ebx, [edx + 1]
inc eax
cmp cl, 0xd
jne 0x10012379
mov byte [edx], 0xa
cmp byte [eax], 0xa
cmovne eax, dword [ebp + 8]
inc eax
jmp 0x1001237b
mov byte [edx], cl
mov cl, byte [eax]
mov edx, ebx
test cl, cl
jne 0x10012360
push 0
mov byte [edx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push edi
call dword [eax + 8]
push edi
call fcn.10070d98
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10012b70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f8a19
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1013306c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 8], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x20], 0x10137af4
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 5
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x2c]
mov dword [ebx], vtable.TiXmlDeclaration.0
mov dword [ecx], 0x10137af4
mov dword [ebx + 0x30], 0x10137af4
mov dword [ebx + 0x34], 0x10137af4
push 3
push 0x1011c668
mov byte [ebp - 4], 3
call fcn.10011040
push 5
push str.UTF_8
lea ecx, [ebx + 0x30]
call fcn.10011040
push 2
push 0x1011c65c
lea ecx, [ebx + 0x34]
call fcn.10011040
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100172a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
mov eax, dword [0x1013306c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x400
lea eax, [ebp - 0xc08]
mov dword [ebp - 0xc10], 0
push 0
push eax
mov dword [ebp - 0xc14], 0
call fcn.100cdcc0
push 0x400
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.100cdcc0
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.100cdcc0
add esp, 0x24
mov dword [ebp - 0xc0c], 0x200
lea eax, [ebp - 0xc10]
push eax
push 0xf003f
push 0
push 0x1011cd40
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0xc10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10017401
lea ecx, [ebp - 0xc0c]
push ecx
lea ecx, [ebp - 0xc08]
push ecx
push 0
push 0
push str.debug
push eax
call edi
lea eax, [ebp - 0xc0c]
mov dword [ebp - 0xc0c], 0x200
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0x1011cd94
push dword [ebp - 0xc10]
call edi
test eax, eax
jne 0x100173f8
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0xc2c]
push eax
call fcn.100580a0
push eax
mov ecx, 0x10133b70
call fcn.10007d20
mov edx, dword [ebp - 0xc18]
cmp edx, 0x10
jb 0x100173e6
mov ecx, dword [ebp - 0xc2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100173dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017512
push edx
push ecx
call fcn.100713c7
add esp, 8
push dword [ebp - 0xc10]
call esi
xor eax, eax
mov dword [ebp - 0xc10], eax
jmp 0x100173fe
mov eax, dword [ebp - 0xc10]
push eax
call esi
cmp dword [0x10133b68], 0
jne 0x100174c4
lea eax, [ebp - 0xc14]
mov dword [ebp - 0xc0c], 0x200
push eax
push 0xf003f
push 0
push str.CLSID9C9E903E_BBC7_4A0E_8326_ED6AC85B9FCCInstanceE9BBD754_6CF4_492E_BA89_782177A2771BInstanceC7468EC6_2D19_4349_A30F_68A10B329B68
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0xc14]
test eax, eax
je 0x100174c4
lea ecx, [ebp - 0xc0c]
push ecx
lea ecx, [ebp - 0x808]
push ecx
push 0
push 0
push 0x1011cd94
push eax
call edi
test eax, eax
jne 0x100174bc
mov dword [ebp - 0xc14], eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0xc2c]
push eax
call fcn.100580a0
push eax
mov ecx, 0x10133b58
call fcn.10007d20
mov edx, dword [ebp - 0xc18]
cmp edx, 0x10
jb 0x100174bc
mov ecx, dword [ebp - 0xc2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100174b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017517
push edx
push ecx
call fcn.100713c7
add esp, 8
push dword [ebp - 0xc14]
call esi
mov ecx, 0x1011cec4
lea eax, [ebp - 0xc08]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100174f6
test dx, dx
je 0x100174f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100174f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100174d0
xor ecx, ecx
jmp 0x100174fb
sbb ecx, ecx
or ecx, 1
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.10070d87
mov esp, ebp
pop ebp
ret
call fcn.100d4798
call fcn.100d4798
int3
Function at 0x10019ff0
Capabilities:
Encode data using xor

Disassembly:
sub ecx, 0x2be3693c
and edi, dword [0x10136440]
mov esi, eax
xor edx, esi
and eax, ebp
inc esi
or edi, 0x69e83ea7
sub ecx, ebx
ror esi, 0x10
not ecx
or edx, 0x9e55fe80
sub esi, 0x49f08cde
ror esi, 0x16
add eax, 0x95c9f369
xor ebx, 0xb2acfdf
xor edi, 0x6c683499
sub edx, 0xb9e28079
or ebx, edx
sub edx, 0x4fc6ee21
sub eax, dword [0x101343b3]
rol edi, 0x11
inc esi
test dword [0x10134324], edx
jp 0x1001a053
or ebx, ebp
call fcn.1007b2aa
mov ecx, 0x7fc56851
ror edx, 0x1f
add dword [0x10134c00], edi
mov edx, eax
shl esi, 0x18
and ebx, 0x2cd47fc7
sub edx, edi
neg esi
xor edi, ebx
mov ebx, 0xcf16bb2f
shr esi, 7
or edx, edi
ror ebx, 7
call fcn.1007b851
not edi
shl edi, 0x1c
loop 0x1001a05d
call fcn.10028439
test dword [0x101364fd], 0x74b64d5a
js 0x1001a0a6
mov ecx, 0x55500f99
sub edx, 0xb3a6393b
or ebx, 0x53a05788
sub eax, edx
add ebx, ebx
shl eax, 0x17
add edi, eax
inc esi
not ebx
mov edi, edx
call fcn.1004fd0f
add edi, dword [0x10135490]
inc ebx
dec esi
loop 0x1001a0a6
shr esi, 0x1f
Function at 0x1001c220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f9023
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x1013306c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], 0
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.100cdcc0
add esp, 0xc
mov dword [ebp - 0x424], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x430], esi
test esi, esi
jne 0x1001c2d9
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x430], eax
test esi, esi
jne 0x1001c2d9
call fcn.1001b8a0
mov edi, eax
jmp 0x1001c3f5
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1001c2fc
call fcn.1001b8a0
jmp 0x1001c3e8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
test ebx, ebx
jne 0x1001c31a
call fcn.1001b8a0
jmp 0x1001c3e8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x428], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x1001c33b
mov edi, 0x8007000e
jmp 0x1001c3ea
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x1001c430
jb 0x1001c359
cmp eax, 0xffffffff
ja 0x1001c430
cmp eax, 0x400
jbe 0x1001c36e
push eax
lea ecx, [ebp - 0x424]
call fcn.1001f050
jmp 0x1001c394
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x1001c394
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
jne 0x1001c3ab
mov edi, 0x8007000e
jmp 0x1001c3ea
push edi
push dword [ebp - 0x424]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1001c3cb
call fcn.1001b8a0
jmp 0x1001c3e8
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.1001d040
mov edi, eax
test esi, esi
je 0x1001c3f5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x1001c410
lea ecx, [ebp - 0x424]
call fcn.1001f040
nop
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10070d87
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.1001b7e0
int3
Function at 0x1001e320
Capabilities:
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1013306c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
push eax
push 0xf003f
push 0
push 0x1011dc00
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0x491
je 0x1001e39e
cmp eax, 2
je 0x1001e39e
test eax, eax
je 0x1001e379
push str._AuraSyncStatus__setRegKey__Cannot_open_registry_key.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 8], 0
jmp 0x1001e3a9
push str._AuraSyncStatus__setRegKey__AuraSync_Registry_key_exist.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.AuraIsSync
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1001e3a9
push str._AuraSyncStatus__setRegKey__No_AIOFanSDK._Skip.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070d87
mov esp, ebp
pop ebp
ret

Function at 0x1001fd90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001fde9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001fde9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1001fdd8
cmp esi, edx
jae 0x1001fde9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1001fdc6
cmp esi, edx
jae 0x1001fde9
cmp word [esi], 0
je 0x1001fde9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10022a20
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f965b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1013306c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x10]
lea ecx, [esi + 8]
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov dword [ebp + 8], esi
mov eax, dword [edi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 4], eax
lea eax, [edi + 0x18]
push eax
call fcn.10004880
lea eax, [edi + 0x30]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x20]
call fcn.1004bbb0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10022c70
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f96c6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1013306c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x10]
lea ecx, [esi + 8]
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov dword [ebp + 8], esi
mov eax, dword [edi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 4], eax
lea eax, [edi + 0x18]
push eax
call fcn.1004c260
lea eax, [edi + 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x14]
call fcn.1004c0f0
lea eax, [edi + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x20]
call fcn.1004c0f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c8c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1004c8eb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1004d120
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1004c90d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1004c90f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1004c993
jg 0x1004c924
test esi, esi
je 0x1004c993
test ecx, ecx
jl 0x1004c96d
jg 0x1004c92e
test eax, eax
je 0x1004c96d
cmp edi, ecx
jg 0x1004c942
jl 0x1004c938
cmp esi, eax
jae 0x1004c942
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.100cd1c0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1004c970
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1004c993
jg 0x1004c97a
test esi, esi
je 0x1004c993
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1004c993
push eax
push esi
push 1
push edx
call fcn.100de0d3
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc