joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x102346ac], 0x1d26
mov dword [0x102346a8], 0x60c
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
jmp 0x1000c83b
mov eax, dword [ebp - 0x3c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1023055d]
mov dh, byte [eax + 0x1023052e]
sub dh, dl
mov byte [ebp + eax - 0x2c], dh
cmp ecx, 0xe
mov dword [ebp - 0x3c], ecx
je 0x1000c8a5
jmp 0x1000c80f
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, ecx, 0x1c
mov edi, edx
add edi, esi
add edi, 0x18
imul esi, ecx, 0x1c
add edx, esi
add edx, 0x14
add ecx, 1
mov esi, dword [edi]
movzx edx, word [edx]
xor edx, esi
add edx, eax
cmp ecx, 0x1f3
mov eax, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x1000c83b
xor eax, eax
mov dword [0x102346ac], 0x780
mov dword [0x102346a8], 0x5a0
mov dword [ebp - 0x3c], eax
jmp 0x1000c80f
lea eax, [ebp - 0x2c]
mov dword [0x102346a8], 0xfffe294f
mov dword [0x102346ac], 0xfffe0a60
mov dword [ebp - 0x44], eax
call fcn.1000cd87
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.1000be4f
mov ecx, eax
mov dword [0x102346c4], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [0x102346a8]
add edx, 0xffffe776
mov dword [0x102346a8], edx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0x1c
mov edi, edx
add edi, esi
add edi, 0x14
imul esi, eax, 0x1c
mov ebx, edx
add ebx, esi
add ebx, 0x18
imul esi, eax, 0x1c
add edx, esi
add eax, 1
mov esi, dword [ebp - 0x48]
add esi, ecx
mov ebx, dword [ebx]
mov edx, dword [edx]
movzx edi, word [edi]
xor edi, ebx
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edi
call fcn.1000d0bf
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
cmp edx, 0x1f3
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
jne 0x1000c91a
mov eax, dword [ebp - 0x48]
add eax, 0x5da2c
mov ecx, dword [ebp - 0x48]
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov edx, dword [ebp - 0x40]
mov dword [esp + 8], edx
mov dword [ebp - 0x60], eax
call fcn.1000ccda
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x687de
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x146c00
mov ecx, dword [ebp - 0x60]
mov dword [edx + 8], ecx
mov ecx, dword [0x102346a8]
add ecx, 0x1cd8
mov dword [0x102346ac], ecx
mov dword [edx + 0xc], 0x20a0
mov ecx, dword [0x102346ac]
add ecx, 0xffffe7ff
mov dword [0x102346ac], ecx
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000cebf
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x102346a8], 0x1557
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x102346ac], 0x43b
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000cf76
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop ebp
ret
mov dword [0x102346ac], 0x220f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x1000d006
jmp 0x1000d01d
mov dword [0x102346ac], 0xffffd45e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000cfce
jmp 0x1000d01d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1000cfaf
jmp 0x1000d01d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x1000cf4b
jmp 0x1000d01d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
je 0x1000cf5f
mov dword [0x102346a8], 0x96f
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
jl 0x1000cf76
jmp 0x1000cf5f
mov dword [0x102346a8], 0xffffeee6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1000cf29
jmp 0x1000d01d
mov dword [0x102346ac], 0xfffff81a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1000d01d
mov dword [0x102346a8], 0x2244
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1000cf07
jmp 0x1000d01d
mov eax, 1
mov dword [0x102346a8], 0x720
mov dword [ebp - 0x14], eax
jmp 0x1000ceff
xor eax, eax
mov dword [0x102346ac], 0xe66
mov dword [ebp - 0x14], eax
jmp 0x1000ceff
Function at 0x1000d300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102346b0], 0
mov dword [0x102346b4], 0
mov dword [0x102346c0], 0
mov ebx, dword [0x102346a8]
add ebx, 0xffffe9e9
mov dword [0x102346ac], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1000d490
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
mov ebx, esi
add ebx, 1
add edx, 1
add ecx, 0xffffe742
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x102346b0], edx
mov dword [0x102346a8], 0x1896
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x30]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x102346b4], edx
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x38]
mov cl, byte [ecx + edi]
mov byte [0x102346b8], cl
mov ecx, dword [ebp - 0x34]
mov dword [0x102346a8], ecx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x24]
mov byte [edx + edi], cl
mov cl, byte [0x102346b8]
mov edx, dword [0x102346b4]
mov edi, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov edx, dword [0x102346a8]
add edx, 0xffffee17
mov dword [0x102346ac], edx
mov edx, dword [0x102346b0]
movzx edx, byte [edi + edx]
mov ecx, dword [0x102346b4]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x102346c0], ecx
mov dword [0x102346a8], 0x1309
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x1c]
mov ch, byte [edx + esi]
mov dword [0x102346ac], 0x904
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov dword [0x102346a8], 0x1ce0
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x3c], ebx
je 0x1000d490
mov eax, dword [0x102346ac]
mov ecx, dword [0x102346b0]
mov edx, dword [0x102346b4]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
jmp 0x1000d36e
mov dword [0x102346a8], 0x129a
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d4a2
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x102346a8]
add edx, 0x148
mov dword [0x102346ac], edx
mov dword [0x102346a8], 0x1530
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000c7e0
lea ecx, [0x1000c1b6]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x20], 0x146c00
mov edx, dword [0x10234694]
mov dword [esp + 0x44], edx
mov edx, dword [0x10234698]
mov dword [esp + 0x34], edx
mov edx, dword [0x1023469c]
mov dword [esp + 0x50], edx
mov edx, dword [0x102346a0]
mov dword [esp + 0x78], edx
mov edx, dword [0x102346a4]
mov dword [esp + 0x2c], edx
mov dword [0x102346a8], 0xfe6
mov dword [0x102346ac], 0xf09
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1000d57e
mov dword [0x102346a8], 0x1c76
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1000d57e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1000d58f
jmp 0x1000d54a
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x1000d568
jmp 0x1000d54a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [0x102346a8], 0x15c6
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x5c], edx
mov dword [0x102346ac], 0x10f6
call fcn.1000cebf
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1000d61a
lea eax, [esp + 0x20]
mov ecx, dword [0x102346a8]
add ecx, 0xffffdda3
mov dword [0x102346ac], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000c44c
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x102346a8]
add ecx, 0xffffe64c
mov dword [0x102346a8], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10003850
Capabilities:
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x114], 0
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.100cac20
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jge 0x100038b7
xor eax, eax
jmp 0x1000399c
mov edx, dword [0x10109ab0]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x100038e6
xor eax, eax
jmp 0x1000399c
lea ecx, [ebp - 0x110]
push ecx
call fcn.100cb090
add esp, 4
test eax, eax
jbe 0x10003932
lea edx, [ebp - 0x110]
push edx
call fcn.100cb090
add esp, 4
cmp eax, 0x104
jae 0x10003932
lea eax, [ebp - 0x110]
push eax
push 0x104
mov ecx, dword [ebp - 0x120]
add ecx, 0x1d8
push ecx
call fcn.100cad54
add esp, 0xc
jmp 0x10003936
xor eax, eax
jmp 0x1000399c
mov edx, dword [ebp - 0x120]
add edx, 0x1d8
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
or eax, 2
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x120]
add edx, 0x1d8
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x10109adc
push 0x104
mov eax, dword [ebp - 0x120]
add eax, 0x1d8
push eax
call fcn.100cb017
add esp, 0xc
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret

Function at 0x100039b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 8], 0x101
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x11c]
add ecx, 4
call sym.PfMgrApi.dll_protected:_void___thiscall_CProfileDbControllerBase::GetUniqueIdHelper_char___unsigned_int_
push 0x101
push 0
lea edx, [ebp - 0x118]
push edx
call fcn.100cac20
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x10003a2b
mov edx, dword [0x10109a8c]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.100cad54
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.100cb090
add esp, 4
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10003fc0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 8
Function at 0x10003ce0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x114], 1
cmp dword [ebp + 8], 0
jne 0x10003d20
push 0x297
push 0x10109ae0
push 0x10109b18
call fcn.100cb557
add esp, 0xc
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10093760
add esp, 8
test eax, eax
je 0x10003d3c
mov eax, 1
jmp 0x10003e86
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10003e81
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.100cac20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.100cac20
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.100cad54
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
push 0x10109b48
lea edx, [ebp - 0x110]
push edx
call fcn.10003fe0
add esp, 0xc
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x10003dd0
xor eax, eax
jmp 0x10003e86
mov eax, dword [ebp - 0x118]
push eax
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call fcn.100cad54
add esp, 0xc
mov edx, 1
test edx, edx
je 0x10003e81
lea eax, [ebp - 0x224]
push eax
push 0x10109b4c
push 0
call fcn.10003fe0
add esp, 0xc
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x10003e1f
jmp 0x10003e81
push 0x10109b50
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call fcn.100cb017
add esp, 0xc
mov edx, dword [ebp - 0x118]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.100cb017
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x228]
call sym.PfMgrApi.dll_public:_int___thiscall_CAidGroupDbController::CheckCreateSubFolder_char_const__
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x10003e7c
mov eax, dword [ebp - 0x114]
jmp 0x10003e86
jmp 0x10003deb
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 4

Function at 0x10003ea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x10003ecd
push 0x2c2
push 0x10109b54
push 0x10109b8c
call fcn.100cb557
add esp, 0xc
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10093760
add esp, 8
test eax, eax
jne 0x10003eee
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x10006720
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x214]
push eax
push sym.PfMgrApi.dll_Ordinal_477
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push 0x10
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameA
push 0x2e
mov eax, dword [ebp - 0x218]
push eax
call fcn.10006840
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x10006792
mov ecx, dword [ebp - 0x10c]
mov byte [ecx], 0
mov edx, dword [ebp - 0x218]
push edx
call fcn.10006880
add esp, 4
mov eax, dword [ebp - 0x218]
push eax
push str.MUROC_TRACE__s
lea ecx, [ebp - 0x210]
push ecx
call fcn.100068c0
add esp, 0xc
push 0x100
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100067fe
push 0x10109f34
lea ecx, [ebp - 0x108]
push ecx
call fcn.10006820
add esp, 8
neg eax
sbb eax, eax
neg eax
mov edx, dword [ebp - 0x218]
mov byte [edx + 0x10], al
jmp 0x10006808
mov eax, dword [ebp - 0x218]
mov byte [eax + 0x10], 1
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret
Function at 0x10008850
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x18], 0x1010b2cc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x130], 0
push 0x103
push 0
lea eax, [ebp - 0x12f]
push eax
call fcn.100cac20
add esp, 0xc
mov dword [ebp - 0x20], 0x103
cmp dword [ebp + 8], 0
je 0x100088d1
cmp dword [ebp + 0xc], 8
jae 0x100088db
mov eax, 0x800436bc
jmp 0x10008a52
mov ecx, dword [ebp - 0x18]
push ecx
push 0x104
lea edx, [ebp - 0x130]
push edx
call fcn.100cad54
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x130]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10008a4f
mov edx, dword [ebp - 8]
push edx
call fcn.100aaab5
add esp, 4
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x10008941
mov eax, 0x800436b2
jmp 0x10008a52
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x130]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10008a2d
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x13c]
push eax
push 0x1010b2dc
mov ecx, dword [ebp - 0x134]
push ecx
call sub.VERSION.dll_VerQueryValueA
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 8]
and eax, 0xffff0000
shr eax, 0x10
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx + 8]
and edx, 0xffff
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff0000
shr ecx, 0x10
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
and eax, 0xffff
mov dword [ebp - 0x10], eax
push 0x104
push 0
lea ecx, [ebp - 0x130]
push ecx
call fcn.100cac20
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x1010b2e0
lea eax, [ebp - 0x130]
push eax
call fcn.100cd213
add esp, 0x18
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003fa0
add esp, 0x10
mov dword [ebp - 0xc], 0
jmp 0x10008a34
mov dword [ebp - 0xc], 0x800436b2
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
push eax
call fcn.100aaaba
add esp, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c550
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb574
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x434
mov eax, dword [0x10172eb8]
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
jne 0x1000c5ac
push 0x1bc
push 0x1010cc90
push str.pPlaintext
call fcn.100cb557
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x1000c5c9
push 0x1bd
push 0x1010ccdc
push str.pRetCiphertext
call fcn.100cb557
add esp, 0xc
mov edx, dword [ebp - 0x43c]
cmp dword [edx + 8], 0
jne 0x1000c5f1
lea ecx, [ebp - 0x420]
call fcn.1000e1f0
push 0x101508c8
lea eax, [ebp - 0x420]
push eax
call fcn.100cb4c0
mov ecx, dword [ebp - 0x43c]
cmp dword [ecx + 4], 0
jne 0x1000c619
lea ecx, [ebp - 0x428]
call fcn.1000e170
push 0x101508b8
lea edx, [ebp - 0x428]
push edx
call fcn.100cb4c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.100cac20
add esp, 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x418], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x18]
cmp ecx, 0x3e8
jae 0x1000c66b
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
jmp 0x1000c672
mov dword [ebp - 0x1c], 0x3e8
push 0x3f0
push 0
lea eax, [ebp - 0x410]
push eax
call fcn.100cac20
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x410]
push eax
call fcn.100cd3b0
add esp, 0xc
cmp dword [ebp - 0x1c], 0x3e8
je 0x1000c6b5
mov dword [ebp - 0x418], 1
push 0x3e8
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x410]
push edx
push 0
mov eax, dword [ebp - 0x418]
push eax
push 0
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jne 0x1000c70b
lea ecx, [ebp - 0x430]
call fcn.1000dff0
push 0x10150868
lea eax, [ebp - 0x430]
push eax
call fcn.100cb4c0
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jbe 0x1000c72d
push 0x1f4
push 0x1010cd30
push 0x1010cd64
call fcn.100cb557
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x18]
push edx
call fcn.100cd3b0
add esp, 0xc
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
jb 0x1000c75a
jmp 0x1000c767
cmp dword [ebp - 0x418], 0
je 0x1000c652
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
push 0x3f0
lea ecx, [ebp - 0x410]
push ecx
call fcn.1000e470
add esp, 8
jmp 0x1000c7eb
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.100ca7f5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000d2e0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x1000d30a
push 0x3cc
push 0x1010d43c
push str.pRetBytes
call fcn.100cb557
add esp, 0xc
push 0xf0000000
push 1
mov ecx, dword [0x1010c818]
push ecx
push 0
lea edx, [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000d343
lea ecx, [ebp - 0x10]
call fcn.1000e170
push 0x101508b8
lea eax, [ebp - 0x10]
push eax
call fcn.100cb4c0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.100cac20
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000d398
cmp dword [ebp - 4], 0
je 0x1000d382
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [ebp - 0x18]
call fcn.1000e610
push 0x10150a7c
lea ecx, [ebp - 0x18]
push ecx
call fcn.100cb4c0
cmp dword [ebp - 4], 0
je 0x1000d3aa
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret