joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ee3b
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push 0x54
mov eax, 0x1002dc7f
call fcn.1002b09b
mov esi, dword [ebp + 8]
xor eax, eax
cmp word [ebp + 0x20], ax
movzx ebx, word [ebp + 0x1c]
setne al
movzx eax, ax
push eax
push esi
call fcn.1002bcdf
pop ecx
pop ecx
test eax, eax
jne 0x1001ef9b
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001ef98
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x1001ef98
mov eax, dword [esi + 4]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], esi
inc dword [eax + 0x38]
inc dword [esi + 0x14]
and dword [ebp - 4], 0
test bx, bx
mov eax, dword [esi + 4]
mov dword [ebp - 0x54], eax
mov eax, 0x50555348
mov dword [ebp - 0x58], 0x50455354
cmovne eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
xor eax, eax
mov word [ebp - 0x4c], ax
test bx, bx
lea eax, [esi + 0xc]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], eax
mov esi, 0x50454552
mov eax, 0x50444154
mov dword [ebp - 0x44], 4
cmovne eax, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x3c], ax
mov word [ebp - 0x2c], ax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp byte [0x1003cdfb], 0
push 4
pop ecx
mov word [ebp - 0x1c], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], 0x504f4653
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x4c454e20
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jne 0x1001ef21
cmp byte [0x1003cdfa], 0
je 0x1001ef6b
mov esi, dword [ebp - 0x54]
test bx, bx
mov ecx, str.kPDFXPush
mov eax, str.kPDFXPushError
cmove eax, ecx
mov ebx, 0x1003d228
push eax
push esi
push str.__lx__PDFXSendOrSave__s_
push ebx
call fcn.1002bcdf
add esp, 0x10
cmp byte [0x1003cdfa], 0
je 0x1001ef59
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1001ef6e
push ebx
call fcn.10005eb0
pop ecx
jmp 0x1001ef6e
mov esi, dword [ebp - 0x54]
xor eax, eax
cmp word [ebp + 0x20], ax
push 8
pop ecx
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.1001ec31
add esp, 0x10
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.1002bcdf
mov eax, esi
jmp 0x1001ef9b
push 3
pop eax
call fcn.1002b045
ret
Function at 0x1001efa1
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push 0x50
mov eax, 0x1002dcac
call fcn.1002b09b
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
push esi
call fcn.1002bcdf
pop ecx
pop ecx
test eax, eax
jne 0x1001f0c5
mov eax, dword [esi + 4]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], esi
inc dword [eax + 0x38]
inc dword [esi + 0x14]
and dword [ebp - 4], 0
xor eax, eax
mov ebx, dword [esi + 4]
mov word [ebp - 0x4c], ax
lea eax, [esi + 0xc]
mov dword [ebp - 0x48], eax
xor eax, eax
push 4
pop ecx
mov word [ebp - 0x3c], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push 0
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x54]
push 0x7fffffff
push eax
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x52535048
mov dword [ebp - 0x28], eax
call fcn.1002bcdf
mov dword [ebp - 0x24], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x20], 0x55524544
cmp byte [0x1003cdfb], 0
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
jne 0x1001f069
cmp byte [0x1003cdfa], 0
je 0x1001f09d
push ebx
push str.__lx__PDFXSendOrSave_kPDFXPushResponse_
mov esi, 0x1003d228
push esi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x1001f08d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1001f09d
push esi
call fcn.10005eb0
pop ecx
xor eax, eax
cmp word [ebp + 0x1c], ax
push 8
pop ecx
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.1001ec31
add esp, 0x10
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.1002bcdf
mov eax, esi
call fcn.1002b045
ret
Function at 0x100223c5
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x440
mov eax, 0x1002dd87
call fcn.1002b109
mov eax, dword [ebp + 8]
mov esi, 0x208
mov dword [ebp - 0x438], eax
xor edi, edi
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x424]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x434], 0x104
lea eax, [ebp - 0x428]
xorps xmm0, xmm0
movsd qword [ebp - 0x430], xmm0
push eax
push 0x20019
push edi
push 0x100333cc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100225e4
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
mov ebx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
jmp 0x100224d1
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
fstp qword [ebp - 0x44c]
movsd xmm0, qword [ebp - 0x44c]
comisd xmm0, xmmword [0x100336a8]
pop ecx
jbe 0x100224bd
comisd xmm0, xmmword [ebp - 0x430]
jbe 0x100224bd
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x430], xmm0
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
inc ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x10022469
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x100225e4
push str.ClientUserInterface
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov dword [esp], str.SoftwareMicrosoftSoftGrid_
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor ecx, ecx
mov dword [ebp - 0x42c], edi
push 2
pop edx
lea ebx, [eax + 0x105]
mov dword [ebp - 4], edi
add ebx, esi
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002bcdf
mov esi, eax
mov dword [ebp - 0x42c], esi
pop ecx
pop ecx
test esi, esi
je 0x100225e4
push ebx
push edi
push esi
call fcn.1002bcdf
push str.SoftwareMicrosoftSoftGrid_
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push str.ClientUserInterface
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x30
lea eax, [ebp - 0x428]
push eax
push 0x20019
push edi
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100225dd
push dword [ebp - 0x438]
push str.LaunchCommand
push dword [ebp - 0x428]
call fcn.10022617
add esp, 0xc
push dword [ebp - 0x43c]
push str.DDELaunchCommand
push dword [ebp - 0x428]
call fcn.10022617
add esp, 0xc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1002b601
pop ecx
call fcn.1002b056
ret
Function at 0x10022617
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002ddaf
call fcn.1002b0d2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002275c
cmp dword [ebp - 0x18], 1
jne 0x1002275c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002bcdf
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x1002275c
push dword [ebp - 0x14]
push ebx
push esi
call fcn.1002bcdf
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022751
cmp dword [ebp - 0x18], 1
jne 0x10022751
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002bcdf
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10022751
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.1002bcdf
lea eax, [ebp - 0x20]
push eax
push 0x100333c8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10022735
push ebx
call fcn.1002bcdf
pop ecx
test al, al
je 0x10022735
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10022751
push dword [edi]
call fcn.1002b601
and dword [edi], 0
pop ecx
jmp 0x10022751
test esi, esi
je 0x1002275c
push esi
call fcn.1002b601
pop ecx
call fcn.1002b030
ret

Function at 0x10022f02
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10033124
xor esi, esi
call fcn.1002bcdf
pop ecx
test eax, eax
jne 0x10022f23
push 0x1003313c
call fcn.1002bcdf
pop ecx
test eax, eax
je 0x10022f26
xor esi, esi
inc esi
cmp byte [0x1003cdfb], 0
jne 0x10022f38
cmp byte [0x1003cdfa], 0
je 0x10022f6e
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d640
push edi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10022f5d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10022f6d
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x100252bb
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cdfb], 0
jne 0x100252fd
cmp byte [0x1003cdfa], 0
je 0x10025334
movzx eax, bl
mov esi, 0x1003e1a8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10025324
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10025334
push esi
call fcn.10005eb0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cdfb], 0
jne 0x1002534b
cmp byte [0x1003cdfa], 0
je 0x1002537d
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1a8
push esi
call fcn.1002bcdf
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x1002536d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002537d
push esi
call fcn.10005eb0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.1002bcdf
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1002bcdf
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.1002bcdf
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.1002bcdf
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.1002bcdf
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.1002bcdf
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x1002bcdf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1002bcee
pop dword [ebp - 8]
mov eax, 0x9037d37b
sub eax, 0x8035168d
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2973b2a4
add dword [ebp - 0x18], 0x24de92a7
mov dword [ebp - 0x14], 0xd6a2b4ab
add dword [ebp - 0x14], 0x5b90979a
mov dword [ebp - 0x10], 0x24aa6f46
add dword [ebp - 0x10], 0x27a1d4e8
mov dword [ebp - 0xc], 0x559a5bdf
add dword [ebp - 0xc], 0xaa65a421
lea eax, [ebp - 0x18]
push eax
mov eax, 0x5febd2a5
add eax, 0xb0171ee7
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x3541ce8e
add dword [ebp - 0x18], 0x3f309ac8
mov dword [ebp - 0x14], 0xaf5bb6db
add dword [ebp - 0x14], 0x9210aa9a
mov dword [ebp - 0x10], 0xad767abd
add dword [ebp - 0x10], 0xb5f8f1af
mov dword [ebp - 0xc], 0x68b35124
sub dword [ebp - 0xc], 0x68b35124
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x45c6b
push 0
call eax
mov ecx, 0xf8e653fc
sub ecx, 0xf8e606d5
mov esi, eax
mov edi, 0xb1c327c2
sub edi, 0xa1bec3c2
add edi, dword [ebp - 8]
mov edx, 0xa0769ad6
add edx, 0xec0124a9
mov ebx, dword [edi]
xor dword [ebp - 4], 0x9f97824e
xor ebx, edx
mov dword [ebp - 4], 0xee03adef
mov dword [esi], ebx
sub dword [ebp - 4], edx
add esi, 4
add edi, 0x29bcf108
add edi, 0xd6430efc
loop 0x1002be0b
add eax, 0x1276f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4014a3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x228]
sub esp, 0x23c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 8
mov dword [esp + 8], eax
call fcn.00408219
sub esp, 0x10
test eax, eax
jne 0x4015a5
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x222]
mov dword [esp + 0xc], 0x105
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [ebp - 0x22c], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
sub esp, 0x10
test eax, eax
mov edx, dword [ebp - 0x22c]
jne 0x40155b
test byte [ebp + 0x10], 1
mov eax, dword [ebp - 0x228]
je 0x401541
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x4015a5
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.004014a3
sub esp, 0xc
test eax, eax
je 0x4014e8
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.00408f99
test eax, eax
push edx
je 0x401596
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
jmp 0x4015a5
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edx
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x1006137e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1006138d
pop dword [ebp - 0x34]
mov eax, 0x600bdde
sub eax, 0xf5faaa51
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x460df
push 0
mov eax, 0x3f3c628b
add eax, 0xd0ca9e61
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x82249d25
add ecx, 0x7ddbbae8
xor esi, esi
add esi, eax
mov edx, 0x10185c00
add edx, dword [ebp - 0x34]
mov ebx, 0xf73f50a2
add ebx, 0x2fcca5a5
add dword [ebp - 0x2c], ecx
mov edi, dword [edx]
add dword [ebp - 0x1c], 0xb6aa1086
xor edi, ebx
mov dword [esi], edi
add esi, 0x10aac229
sub esi, 0x10aac225
add edx, 0x1b778719
add edx, 0xe48878eb
loop 0x100613e8
add eax, 0x15307
mov ebx, eax
add eax, 0x5b12a056
add eax, 0xa4ed5faf
mov ecx, 0x5e15954a
add ecx, 0xb1ea6ab6
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x100696fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x10069780
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1006974a
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006974a
cmp edi, ebx
jge 0x1006974a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006977a
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006977a
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x10069792
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x10069a28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x1016c088], al
je 0x10069a5f
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10069ac3
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvDX9.x3d_struct_PIXWEIGHT____stdcall_PrepareRescale_int__int__int__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvDX9.x3d_struct_PIXWEIGHT____stdcall_PrepareRescale_int__int__int__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call sym.drvDX9.x3d_struct_PIXWEIGHT____stdcall_PrepareRescale_int__int__int__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e864
leave
ret 0x10

Function at 0x10069ad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10069b00
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10069b31
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10069b2f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvDX9.x3d_struct_PIXWEIGHT____stdcall_PrepareRescale_int__int__int__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10069b31
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006e864
leave
ret 8

Function at 0x10069bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
mov eax, dword [ebp + 8]
je 0x10069bf4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10069c0e
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvDX9.x3d_struct_PIXWEIGHT____stdcall_PrepareRescale_int__int__int__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1006e864
leave
ret 4

Function at 0x1006e864
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b1980]
jne 0x1006e86e
repz ret
jmp fcn.1006ef63