joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10147363
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10194144
push 0x1019413c
push str.FlsAlloc
push 0x1f
call fcn.1014714e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10147397
push dword [ebp + 8]
mov ecx, esi
call dword [0x101712d0]
call esi
jmp 0x1014739d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x101473e1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10194154
push 0x1019414c
push str.FlsGetValue
push 0x21
call fcn.1014714e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10147418
push dword [ebp + 8]
mov ecx, esi
call dword [0x101712d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10147420
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1019415c
push 0x10194154
push str.FlsSetValue
push 0x22
call fcn.1014714e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1014745a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x101712d0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x101479fd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10213678]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10147a3d
cmp byte [ebx], 0xa
jne 0x10147a3d
or byte [edi + eax + 0x28], 4
jmp 0x10147a42
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10147b41
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10147b24
inc eax
cmp dl, 0xd
je 0x10147a6e
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10147a94
cmp eax, ecx
jae 0x10147aa2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10147a56
jmp 0x10147b41
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10147b1f
cmp dword [ebp - 0x10], 0
je 0x10147b1f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10213678]
test byte [eax + edi + 0x28], 0x48
je 0x10147af9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10147ae4
mov byte [esi], dl
jmp 0x10147af5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10213678]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10147b41
cmp byte [ebp - 1], 0xa
jne 0x10147b08
cmp esi, ebx
jne 0x10147b08
mov byte [esi], 0xa
jmp 0x10147b40
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10148583
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10147b41
mov byte [esi], 0xd
jmp 0x10147b40
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10213678]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10147b3e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10147b41
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10147b4a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10213678]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10147b90
cmp word [ebx], dx
jne 0x10147b90
or byte [eax + edi + 0x28], 4
jmp 0x10147b95
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10147cf8
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10147cd8
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10147bd6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10147c0c
cmp eax, edx
jae 0x10147c1a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10147bb1
jmp 0x10147cf8
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10147cd3
cmp dword [ebp - 0x18], 0
je 0x10147cd3
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10213678]
test byte [eax + edi + 0x28], 0x48
je 0x10147ca9
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10147c6d
mov word [esi], cx
jmp 0x10147ca4
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10213678]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10213678]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10213678]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10147cf8
pop eax
cmp word [ebp - 4], ax
jne 0x10147cb9
cmp esi, ebx
jne 0x10147cb9
mov word [esi], ax
jmp 0x10147cf5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10148583
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10147cf8
push 0xd
pop eax
jmp 0x10147cb4
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10213678]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10147cf2
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10147cf8
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1014afad
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1014b04a
push ebx
push esi
call fcn.1014af76
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.101443f4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1014aff7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1014b049
push edi
push eax
call fcn.10142ea9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1014b017
call fcn.10142e6f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1014b048
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.101443f4
add esp, 0x20
test eax, eax
jne 0x1014b036
push edi
call fcn.10142e6f
jmp 0x1014b03e
push ebx
call fcn.10142e6f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1014b04d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1014b05e
pop esi
ret
push ebx
push edi
push esi
call fcn.1014af76
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10142ea9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1014b086
push ebx
push esi
push edi
call fcn.1012b860
add esp, 0xc
push 0
call fcn.10142e6f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1014b456
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014b09b

Function at 0x1014d579
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.101412d8
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1014d5e8
cmp esi, dword [ebp - 4]
je 0x1014d5e3
cmp dword [ebp + 0xc], 0
je 0x1014d5e3
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1014d5c0
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1014d0cb
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1014d5ea
xor eax, eax
inc eax
jmp 0x1014d5ea
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1014d64f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020f140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.101412d8
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.101412d8
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1014d6c6
cmp word [ecx], dx
je 0x1014d6c6
mov eax, dword [0x101945fc]
push edi
dec eax
push eax
push 0x101944e8
call fcn.1014d5ee
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1014d739
cmp word [eax], dx
je 0x1014d739
mov eax, dword [edi]
test eax, eax
je 0x1014d6ea
cmp word [eax], dx
je 0x1014d6ea
lea eax, [ebp - 0x10]
push eax
call fcn.1014cfd1
jmp 0x1014d6f3
lea eax, [ebp - 0x10]
push eax
call fcn.1014d06c
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1014d763
mov eax, dword [0x101944e4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x101941d8
call fcn.1014d5ee
add esp, 0xc
test al, al
je 0x1014d763
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1014d72e
cmp word [eax], di
je 0x1014d72e
lea eax, [ebp - 0x10]
push eax
call fcn.1014cfd1
pop ecx
jmp 0x1014d765
lea eax, [ebp - 0x10]
push eax
call fcn.1014d06c
jmp 0x1014d72b
mov eax, dword [edi]
test eax, eax
je 0x1014d750
cmp word [eax], dx
je 0x1014d750
lea eax, [ebp - 0x10]
push eax
call fcn.1014cf86
pop ecx
jmp 0x1014d763
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1014d82e
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1014d473
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1014d82e
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1014d82e
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1014d82e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1014d7bb
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.101475fc
test ebx, ebx
je 0x1014d829
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.101475fc
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1014d82e
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1014d82e
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10145070
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1014d830
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10129a67
leave
ret
Function at 0x10151471
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.101513ed
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x101515e0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x101515e0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10151595
jg 0x101514cd
test eax, eax
je 0x1015158b
push 1
push 0x1000
call fcn.10142c88
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x101514f0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10151582
push 0x8000
push ebx
call fcn.1015131e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10151519
jg 0x10151514
cmp ecx, 0x1000
jb 0x10151519
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10146715
add esp, 0x10
cmp eax, 0xffffffff
je 0x1015155e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10151514
jl 0x10151545
test ecx, ecx
jne 0x10151506
push dword [ebp - 0xc]
push ebx
call fcn.1015131e
push esi
call fcn.10142e6f
add esp, 0xc
xor ebx, ebx
jmp 0x101515ee
cmp byte [edi + 0x24], 0
je 0x10151575
cmp dword [edi + 0x20], 5
jne 0x10151575
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10151580
mov ebx, dword [edi + 0x18]
jmp 0x10151582
xor ebx, ebx
push esi
call fcn.10142e6f
pop ecx
jmp 0x101515ee
test ecx, ecx
jg 0x10151557
jl 0x10151595
test eax, eax
jae 0x10151557
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10148583
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x101515b5
cmp byte [edi + 0x1c], 0
je 0x10151557
jmp 0x101515e6
push ebx
call fcn.1014fbac
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10151557
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x101515ee
cmp byte [edi + 0x1c], 0
je 0x101515eb
mov ebx, dword [edi + 0x18]
jmp 0x101515ee
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10148583
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10152bd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10152bfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10152bfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10006ae2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10006af1
pop dword [ebp - 0xc]
mov eax, 0xec2988d6
add eax, 0x23d6e21b
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x513e3d0a
sub dword [ebp - 0x1c], 0x2ebf7bf
mov dword [ebp - 0x18], 0xc504aa2
add dword [ebp - 0x18], 0x25e301a3
mov dword [ebp - 0x14], 0xbfe82650
sub dword [ebp - 0x14], 0x739be222
mov dword [ebp - 0x10], 0xbf499665
sub dword [ebp - 0x10], 0xbf499665
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x4bf135ac
sub eax, 0x3bf0850c
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xf7a0add3
add dword [ebp - 0x1c], 0x7cd1bb83
mov dword [ebp - 0x18], 0xb2219d6a
add dword [ebp - 0x18], 0x8f4ac40b
mov dword [ebp - 0x14], 0xe55e1823
sub dword [ebp - 0x14], 0x81eeabb7
mov dword [ebp - 0x10], 0x1ae48b1e
sub dword [ebp - 0x10], 0x1ae48b1e
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x36220
push 0
call eax
mov ecx, 0x69eeed6e
add ecx, 0x96115540
xor edx, edx
add edx, eax
mov ebx, 0xc4580109
add ebx, 0x4bac76f7
add ebx, dword [ebp - 0xc]
mov esi, 0xad370332
add esi, 0x5556167
xor dword [ebp - 4], 0xdc8a5bef
mov edi, dword [ebx]
sub dword [ebp - 4], 0x9274d25a
sub edi, esi
add dword [ebp - 4], ebx
mov dword [edx], edi
add dword [ebp - 4], 0x8dd13b61
add edx, 4
add ebx, 0x5a98c54d
add ebx, 0xa5673ab7
loop 0x10006c10
add eax, 0xfd8b
xor ebx, ebx
add ebx, eax
add eax, 0x612a1767
sub eax, 0x612a1762
mov ecx, 0x99fcc554
add ecx, 0x76033aac
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10002e21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10002e30
pop dword [ebp - 0x28]
mov eax, 0x10002e30
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xa346e539
add dword [ebp - 0x38], 0xab0b6012
mov dword [ebp - 0x34], 0xcc1077ca
add dword [ebp - 0x34], 0x6622d47b
mov dword [ebp - 0x30], 0xc92b356c
sub dword [ebp - 0x30], 0x7cdef13e
mov dword [ebp - 0x2c], 0xd8e104da
add dword [ebp - 0x2c], 0x271efb26
lea eax, [ebp - 0x38]
push eax
mov eax, 0x99ec5582
sub eax, 0x89ebfbce
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2afa062c
add dword [ebp - 0x38], 0x4978632a
mov dword [ebp - 0x34], 0x63766b62
add dword [ebp - 0x34], 0xddf5f613
mov dword [ebp - 0x30], 0xa1c5e516
add dword [ebp - 0x30], 0xc1a98756
mov dword [ebp - 0x2c], 0xc30f60c8
sub dword [ebp - 0x2c], 0xc30f60c8
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x364fa
push 0
call eax
mov ecx, 0x4701
mov esi, eax
mov edx, 0xf59207ab
sub edx, 0xe5915fab
add edx, dword [ebp - 0x28]
mov ebx, 0x4ddb61db
sub ebx, 0x186831a4
add dword [ebp - 0x18], 0x821ecd7
mov edi, dword [edx]
sub dword [ebp - 0x10], 0x612ed6a
sub edi, ebx
xor dword [ebp - 0x14], edx
mov dword [esi], edi
add dword [ebp - 0x24], esi
add esi, 0x395169a1
sub esi, 0x3951699d
add edx, 0xf89bf964
sub edx, 0xf89bf960
loop 0x10002f42
add eax, 0x86e2f08f
sub eax, 0x86e1e1b8
mov ebx, eax
add eax, 5
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x416b88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x30]
mov ebp, ecx
push esi
mov dword [esp + 0xc], 0
call fcn.00401470
test al, al
je 0x401794
mov al, byte [esp + 0x30]
push ebx
push edi
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call fcn.00401d10
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x18]
push ebx
call fcn.00402510
test al, al
je 0x401707
mov edi, dword [esp + 0x18]
mov ecx, ebx
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.004024f0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x34], 0
call fcn.00402260
mov esi, dword [esp + 0x38]
push 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00401d10
mov eax, dword [ebp + 4]
pop edi
cmp esi, eax
pop ebx
je 0x401794
mov eax, dword [esi + 0x20]
test eax, eax
je 0x401794
mov edx, dword [esi + 0x24]
mov ecx, dword [esp + 0x34]
sub edx, eax
sar edx, 4
cmp edx, ecx
jbe 0x401794
mov esi, dword [esp + 0x2c]
shl ecx, 4
add eax, ecx
mov cl, byte [eax]
mov byte [esi], cl
xor ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov edx, dword [0x418218]
push edx
push ecx
push eax
mov ecx, esi
call fcn.00401b10
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea eax, [esp + 0x34]
push 0x418a88
push eax
mov dword [esp + 0x3c], 0
call fcn.0040f11b
nop
nop
nop
nop
nop

Function at 0x403c30
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403c62
xor eax, eax
pop esi
add esp, 0x110
ret
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Identifier
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
je 0x403cbb
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0x110
ret
lea eax, [esp + 0x10]
push str.ia64
push eax
call fcn.0040f551
add esp, 8
test eax, eax
jne 0x403d13
lea ecx, [esp + 0x10]
push str.IA64
push ecx
call fcn.0040f551
add esp, 8
test eax, eax
jne 0x403d13
lea edx, [esp + 0x10]
push str.amd64
push edx
call fcn.0040f551
add esp, 8
test eax, eax
jne 0x403d13
lea eax, [esp + 0x10]
push str.AMD64
push eax
call fcn.0040f551
add esp, 8
test eax, eax
je 0x403d18
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x110
ret
Function at 0x405060
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x416c60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
lea eax, [esp + 4]
xor ebx, ebx
push eax
push str.SOFTWAREIntelBasedriversDebug
push 0x80000002
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x405184
mov cl, byte [esp + 0x28]
push ebp
push edi
mov byte [esp + 0x10], cl
mov edi, str.SetupBD:
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ebx
push ecx
push str.SetupBD:
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00402330
mov eax, dword [0x418218]
mov ecx, dword [esp + 0x38]
mov edi, eax
mov byte [esp + 0x28], 1
cmp ecx, edi
jae 0x4050e4
mov edi, ecx
sub eax, dword [esp + 0x18]
cmp eax, edi
ja 0x4050f1
call fcn.0040e999
cmp edi, ebx
jbe 0x40513f
mov edx, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x14]
lea ebp, [edx + edi]
push ebp
call fcn.00402510
test al, al
je 0x40513f
push esi
mov esi, dword [esp + 0x38]
cmp esi, ebx
jne 0x405119
mov esi, 0x41821c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, edi
push ebp
lea edi, [edx + eax]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.004024f0
pop esi
mov eax, dword [esp + 0x14]
pop edi
cmp eax, ebx
pop ebp
jne 0x40514e
mov eax, 0x41821c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x405184
mov al, byte [ecx - 1]
cmp al, bl
je 0x40517a
cmp al, 0xff
je 0x40517a
dec al
mov byte [ecx - 1], al
jmp 0x405184
dec ecx
push ecx
call fcn.0040e98e
add esp, 4
mov ecx, dword [esp + 0x2c]
cmp ecx, ebx
je 0x4051b6
mov al, byte [ecx - 1]
cmp al, bl
je 0x4051ac
cmp al, 0xff
je 0x4051ac
dec al
pop ebx
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.0040e98e
add esp, 4
mov ecx, dword [esp + 0x18]
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret