joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b9d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb5000]
push edi
jmp 0x50b9ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50b9f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50b9e0
mov eax, 1
add ebx, ebx
jne 0x50ba03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ba14
jne 0x50ba33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ba33
dec eax
add ebx, ebx
jne 0x50ba20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50b9f8
add ebx, ebx
jne 0x50ba2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50ba85
xor ecx, ecx
sub eax, 3
jb 0x50ba4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50baba
sar eax, 1
mov ebp, eax
jmp 0x50ba56
add ebx, ebx
jne 0x50ba56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ba24
inc ecx
add ebx, ebx
jne 0x50ba64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ba24
add ebx, ebx
jne 0x50ba71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50ba66
jne 0x50ba82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ba66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50baa4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50ba96
jmp 0x50b9e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50baa4
add edi, ecx
jmp 0x50b9e6
pop esi
mov edi, esi
mov ecx, 0x3ed3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50bac2
cmp byte [edi], 0x11
jne 0x50bac2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50bac7
lea edi, [esi + 0x104000]
mov eax, dword [edi]
or eax, eax
je 0x50bb3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13e224]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13e3a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50baf4
mov ecx, edi
jns 0x50bb23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13e3a4]
or eax, eax
je 0x50bb39
mov dword [ebx], eax
add ebx, 4
jmp 0x50bb11
call dword [esi + 0x13e3b4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x50bb70
cmp al, 0xef
ja 0x50bb63
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x50bb45
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x50bb52
mov ebp, dword [esi + 0x13e3a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50bba4
sub esp, 0xffffff80
jmp 0x427dcd
Function at 0x402100
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40214b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402144
test esi, esi
je 0x402144
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402120
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402330
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402380
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402458
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4023be
cmp eax, 4
jne 0x4023e0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4023ce
cmp edx, 4
je 0x4023ce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402330
Function at 0x402810
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
sub esp, 0x4c
cmp dword [esi], 0
mov cl, 0x3c
mov al, 0x97
mov byte [esp], 0x88
mov byte [esp + 1], 0x34
mov byte [esp + 2], cl
mov byte [esp + 3], 0xa0
mov byte [esp + 4], 0x83
mov byte [esp + 5], 0xfd
mov byte [esp + 6], 0x6a
mov byte [esp + 7], 0x8d
mov byte [esp + 8], 0xdb
mov byte [esp + 9], 0xdd
mov byte [esp + 0xa], 0x7d
mov byte [esp + 0xb], 0x61
mov byte [esp + 0xc], 0x9b
mov byte [esp + 0xd], 0xca
mov byte [esp + 0xe], 0xe9
mov byte [esp + 0xf], 4
mov byte [esp + 0x10], 0x90
mov byte [esp + 0x11], 0x8c
mov byte [esp + 0x12], 0xa9
mov byte [esp + 0x13], 0xd2
mov byte [esp + 0x14], 0xf
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x6b
mov byte [esp + 0x18], 0x96
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0x80
mov byte [esp + 0x1c], 0x23
mov byte [esp + 0x1d], 0x11
mov byte [esp + 0x1e], 0xd
mov byte [esp + 0x1f], 0xd7
jne 0x4028d5
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4028d5
mov dword [esi], eax
xor al, al
add esp, 0x4c
ret
push 0x2c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00401100
push 0x20
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x40]
push edx
mov word [esp + 0x38], 0x208
mov word [esp + 0x3c], 0x6610
mov byte [esp + 0x40], 0x20
call fcn.00401140
mov edx, dword [esi]
add esp, 0x18
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x2c
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x40293b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00407a30
add esp, 4
xor al, al
add esp, 0x4c
ret
mov al, 1
add esp, 0x4c
ret
Function at 0x436980
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x456130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004284d0
add esp, 0xc
cmp dword [0x457f1c], 0
jne 0x436a8d
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, word [ebp - 0xc]
movzx ecx, word [ebp - 0xa]
shl eax, 0x10
or eax, ecx
cmp dword [ebp - 0x11c], 4
mov dword [0x457f20], eax
jne 0x4369ff
mov dword [0x457f1c], 1
jmp 0x436a8d
cmp dword [ebp - 0x11c], 5
jne 0x436a4c
cmp dword [ebp - 0x118], 0
jne 0x436a1d
mov dword [0x457f1c], 2
jmp 0x436a8d
cmp dword [ebp - 0x118], 1
jne 0x436a32
mov dword [0x457f1c], 3
jmp 0x436a8d
xor eax, eax
cmp dword [ebp - 0x118], 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
mov dword [0x457f1c], eax
jmp 0x436a8d
cmp dword [ebp - 0x11c], 6
jne 0x436a83
cmp dword [ebp - 0x118], 0
jne 0x436a6c
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x436a45
cmp dword [ebp - 0x118], 1
jne 0x436a83
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x436a45
mov dword [0x457f1c], 9
mov eax, dword [0x457f1c]
mov ecx, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [0x457f20]
pop edi
mov dword [ebx], eax
xor ecx, ebp
pop ebx
call fcn.0042854a
leave
ret 8

Function at 0x436bb7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436bdb
test al, 0x10
je 0x436bdb
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x436bd8
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x436be2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436caa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x436caa
cmp eax, 3
je 0x436c23
push edi
push ebx
call fcn.00436bb7
test eax, eax
jne 0x436caa
movzx eax, word [ebx]
push esi
xor esi, esi
mov ecx, ebx
test ax, ax
je 0x436c47
cmp ax, 0x5c
jne 0x436c38
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x436c30
test esi, esi
jne 0x436c5b
mov edi, 0x80070003
push edi
push 0x7a
push str.dirutil.cpp
call fcn.00432f06
jmp 0x436ca9
push dword [ebp + 0xc]
xor eax, eax
push ebx
mov word [esi], ax
call fcn.00436be2
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x436ca9
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436ca7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x436c95
xor edi, edi
inc edi
jmp 0x436ca9
test eax, eax
jle 0x436ca3
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x436ca9
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x40abf0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xor eax, 8
mov esi, dword [0x5756530c]
mov ebx, dword [eax*4 - 0x3d47601]
jne 0x40ac13
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
wait
adc byte [edx - 0x74030cc2], dl
inc ebp
adc al, 0x83
cmp byte [eax], bh
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0x38
je 0x40ac6d
mov esi, dword [ebp + 8]
xor ecx, ecx
mov cx, word [esi]
add esi, 2
cmp ecx, 0x8bed0eeb
xchg ebx, eax
cmp eax, 0xe3e4c00c
pop esi
out dx, eax
pop ebx
int3

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0xd057b19
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x70696686
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10004920
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100519c0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0
call fcn.1000f7c0
jmp 0x10004969
mov ecx, dword [ebp - 0x24]
mov eax, dword [0x1027f24c]
xor eax, dword [0x1027f250]
or eax, 0xd08a9bc1
mov edx, eax
xor edx, 0xffffffff
and edx, 0xcc91c4a
and eax, 0xf336e3b5
sub eax, edx
add eax, 0x6bbf99b
mov dword [ebp - 0x28], eax
call fcn.10010440
mov eax, dword [ebp - 0x28]
cmp eax, 0xd50452f1
jbe 0x10004969
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10037390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x24], ecx
mov al, byte [ebp + 8]
mov byte [ebp - 0x1d], al
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10051ac0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x102816c4]
mov edx, dword [0x102816c8]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
imul eax, eax, 0xa3bf62df
mov ecx, 0x35ebc366
xor edx, edx
div ecx
imul eax, eax, 0xc7828dc0
cmp eax, 0xa11ea040
jae 0x100374ef
mov edx, dword [ebp - 0x24]
mov bl, byte [ebp - 0x1d]
mov eax, dword [0x102816cc]
mov ecx, dword [0x102816d0]
sub eax, ecx
and eax, 0x519fce21
xor eax, 0xd0e01
add eax, 0x5d0a90db
mov dword [ebp - 0x28], eax
push eax
mov esi, esp
mov dword [ebp - 0x30], esi
push eax
mov ecx, esp
sub esp, 8
mov eax, esp
mov dword [ebp - 0x2c], eax
mov byte [esi], bl
mov dword [ecx], edx
mov ecx, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.1003ed50
mov eax, dword [ebp - 0x28]
cmp eax, 0x419a23ef
jb 0x10037401
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
sub esp, 4
mov eax, esp
mov dword [eax], ecx
call fcn.1003e6d0
add esp, 4
mov dword [ebp - 0x34], eax
jmp 0x10037477
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
movsx edx, byte [eax]
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.1003eec0
mov byte [ebp - 0x35], al
jmp 0x10037494
mov eax, dword [0x102816e4]
xor eax, dword [0x102816e8]
add eax, 0xe58dedcb
sub eax, 0xef2e9b89
sub eax, 0xe58dedcb
or eax, 0x1b776427
sub eax, 0x22805750
sub eax, 0x47f0733a
add eax, 0x22805750
cmp eax, 0xb45ca065
jae 0x10037516
mov ecx, dword [ebp - 0x2c]
call fcn.100284c0
mov al, byte [ebp - 0x35]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
movsx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edx, dword [ebp - 0x24]
mov bl, byte [ebp - 0x1d]
push eax
mov esi, esp
push eax
mov ecx, esp
sub esp, 8
mov eax, esp
mov byte [esi], bl
mov dword [ecx], edx
mov ecx, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.1003ed50
jmp 0x10037401
mov ecx, dword [ebp - 0x2c]
call fcn.100284c0
jmp 0x100374cd
Function at 0x10049810
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x28], ecx
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x21], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10051c40
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
mov bl, byte [ebp - 0x21]
mov eax, dword [0x102824cc]
mov ecx, dword [0x102824d0]
and eax, ecx
xor eax, 0x14480009
or eax, 0xe9b5f5d6
mov dword [ebp - 0x38], eax
push eax
mov edi, esp
mov dword [ebp - 0x3c], edi
push eax
mov eax, esp
push eax
mov ecx, esp
and bl, 1
mov byte [edi], bl
mov dword [eax], esi
mov dword [ecx], edx
mov ecx, dword [ecx]
mov dword [ebp - 0x40], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.1004af50
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov esi, edx
add esi, 4
mov dword [ebp - 0x34], esi
mov edx, dword [edx]
mov dword [ebp - 0x30], edx
mov cl, byte [ecx]
mov byte [ebp - 0x29], cl
cmp eax, 0x368ed2c9
jb 0x1004984e
mov ecx, dword [ebp - 0x30]
mov al, byte [ebp - 0x29]
mov dword [ebp - 0x10], 0
sub esp, 4
movzx edx, al
and edx, 1
mov eax, esp
mov dword [eax], edx
call fcn.1004b260
mov byte [ebp - 0x41], al
jmp 0x100498e5
mov dl, byte [ebp - 0x41]
mov eax, dword [0x102824dc]
mov ebx, dword [0x102824e0]
mov ecx, eax
xor ecx, 0xffffffff
mov edi, ebx
and edi, ecx
mov ecx, ebx
xor ecx, 0xffffffff
mov esi, eax
and esi, ecx
mov ecx, dword [ebp - 0x34]
imul esi, edi
mov edi, eax
and edi, ebx
or eax, ebx
imul eax, edi
add eax, esi
imul eax, eax, 0x7304b352
mov edi, eax
and edi, 0x4d48e6f
mov esi, eax
or esi, 0x4d48e6f
xor esi, 0xffffffff
imul esi, edi
mov edi, eax
and edi, 0xfb2b7190
or eax, 0xfb2b7190
imul eax, edi
add eax, esi
mov esi, eax
add esi, 1
xor eax, 0xffffffff
or eax, 0x8c6b74d5
add eax, esi
and dl, 1
mov byte [ecx], dl
cmp eax, 0x29e63aa7
ja 0x100498e5
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x100884d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x21], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1009a800
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov edi, dword [ebp - 0x20]
mov dl, byte [ebp - 0x21]
push eax
mov ebx, esp
mov dword [ebp - 0x2c], ebx
push eax
mov esi, esp
mov dword [ebp - 0x34], esi
push eax
mov ecx, esp
push eax
mov eax, esp
mov byte [ebx], dl
mov edx, dword [ebp - 0x28]
mov dword [esi], edi
mov dword [ecx], edx
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
sub esp, 4
mov dl, byte [eax]
mov eax, esp
mov byte [eax], dl
call fcn.1002fb50
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov esi, dword [edx]
movsx edx, byte [eax]
mov dword [ebp - 0x10], 0
sub esp, 8
mov eax, esp
mov dword [eax + 4], esi
mov dword [eax], edx
call fcn.1008a3a0
jmp 0x1008856b
mov eax, dword [0x10289334]
xor edx, edx
div dword [0x10289338]
mov ecx, eax
xor ecx, 0x3287141c
and eax, 0xcd78ebe3
shl eax, 1
sub eax, ecx
add eax, 0xa4e71bbf
sub eax, 0x2479a7ca
sub eax, 0xa4e71bbf
sub eax, 0x4299ec3f
cmp eax, 0x782ccac4
je 0x1008856b
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x100b64b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100b6509
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100b6509
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x100b64fa
cmp esi, ecx
jae 0x100b6509
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x100b64e8
cmp esi, ecx
jae 0x100b6509
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x100b650b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100ba2c8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x100ba31b
push esi
push dword [ebp + 8]
call fcn.100ba890
mov edi, eax
test edi, edi
je 0x100ba316
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100ba316
mov eax, dword [ebp - 8]
jmp 0x100ba32d
mov eax, dword [ebp + 0x10]
jmp 0x100ba32d
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x100ba3bc
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1021bf7e
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.100b5b50
mov eax, dword [0x10290680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x100ba4ed
push ebx
push edx
call fcn.100ba890
mov ebx, eax
test ebx, ebx
jne 0x100ba424
push esi
jmp 0x100ba515
lea ecx, [ebp - 0x2014]
call fcn.100b6b55
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x100ba4ac
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.100b69d3
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.100ba1a9
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x100ba4da
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.100b6ad3
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.100b6577
jmp 0x100ba51c
push esi
mov ecx, edi
call fcn.100b6ba4
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x100ba4d3
test esi, esi
jne 0x100ba4f6
mov esi, 0x102675a4
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.100b6ba4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b5a82
leave
ret 0x10