joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d09e171
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0x10]
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov edi, ecx
movzx ecx, word [ebp + 0xc]
push dword [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push dword [0x6d0fb68c]
push eax
call fcn.6d08901e
mov ebx, dword [ebp + 0x14]
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.6d06c694
pop ecx
push eax
push ebx
call fcn.6d06c694
cmp eax, 3
sete al
movzx eax, al
pop ecx
push eax
push dword [0x6d0fb6a8]
call fcn.6d06c5fd
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push eax
call fcn.6d06c35b
pop ecx
push edx
push eax
push 0x1f6
mov ecx, edi
call fcn.6d08901e
push ebx
call fcn.6d06c6c3
pop ecx
test dword [edi + 0x3e4], eax
je 0x6d09e238
push 0
push ebx
call fcn.6d06c694
pop ecx
push eax
push 0
push dword [0x6d0fb6a8]
call fcn.6d06c5fd
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push eax
call fcn.6d06c35b
pop ecx
push edx
push eax
push 0x1f4
mov ecx, edi
call fcn.6d08901e
push ebx
call fcn.6d06c6c3
pop ecx
push 2
not eax
and dword [edi + 0x3e4], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x6d09e35f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
push edi
mov ebx, ecx
call esi
push eax
call fcn.6d06c35b
mov edi, eax
pop ecx
mov dword [ebp - 4], edx
cmp dword [0x6d0fb6e0], edi
jne 0x6d09e38e
cmp dword [0x6d0fb6e4], edx
je 0x6d09e3d8
push dword [ebp + 0x10]
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
push dword [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push dword [0x6d0fb68c]
push eax
call fcn.6d08901e
lea eax, [ebp - 0x24]
add esp, 0x18
push eax
call fcn.6d06c5fd
push eax
call esi
push eax
call fcn.6d06c35b
pop ecx
push edx
push eax
push 0x3e9
mov ecx, ebx
call fcn.6d08901e
mov eax, dword [ebp - 4]
push 2
mov dword [0x6d0fb6e4], eax
pop eax
mov dword [0x6d0fb6e0], edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6d0a4600
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x6d0f8610]
xor eax, esp
mov dword [esp + 0x11c], eax
cmp word [0x6d0fb7c0], 0
push ebx
jne 0x6d0a4822
push esi
push 0x11c
lea eax, [esp + 0xc]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.kernel32.dll_GetVersionExW]
push str._I__OS_Version_
push 0
push 3
mov esi, eax
call fcn.6d08901e
add esp, 0xc
test esi, esi
pop esi
je 0x6d0a4806
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
cmp eax, 2
jne 0x6d0a47f1
cmp ecx, 4
jbe 0x6d0a47f1
mov eax, dword [esp + 0xc]
mov ebx, 1
cmp ecx, 6
jb 0x6d0a4728
test eax, eax
jne 0x6d0a46de
cmp byte [esp + 0x11e], bl
jne 0x6d0a46bc
push str.OS_VISTA_n
push eax
push 3
call fcn.6d08901e
add esp, 0xc
mov word [0x6d0fb7c0], bx
jmp 0x6d0a4822
push str.OS_WINSERV_2008_n
push 0
push 3
call fcn.6d08901e
mov edx, 2
add esp, 0xc
mov word [0x6d0fb7c0], dx
jmp 0x6d0a4822
cmp eax, ebx
jb 0x6d0a4728
cmp byte [esp + 0x11e], bl
jne 0x6d0a4706
push str.OS_WINDOWS7_or_newer_n
push 0
push 3
call fcn.6d08901e
add esp, 0xc
mov eax, 0x20
jmp 0x6d0a481c
push str.OS_WINSERV_2008R2_or_newer_n
push 0
push 3
call fcn.6d08901e
mov ecx, 0x40
add esp, 0xc
mov word [0x6d0fb7c0], cx
jmp 0x6d0a4822
cmp ecx, 5
jne 0x6d0a47d0
cmp eax, 2
jne 0x6d0a477c
cmp byte [esp + 0x11e], bl
jne 0x6d0a4761
push str.OS_WINXP_64_n
push 0
push 3
call fcn.6d08901e
mov edx, 8
add esp, 0xc
mov word [0x6d0fb7c0], dx
jmp 0x6d0a4822
push str.OS_WINSERV_2003_n
push 0
push 3
call fcn.6d08901e
add esp, 0xc
mov eax, 0x10
jmp 0x6d0a481c
cmp eax, ebx
jne 0x6d0a47d0
push str.OS_WINXP
push 0
push 3
call fcn.6d08901e
add esp, 0xc
test dword [esp + 0x11c], 0x200
mov ecx, 4
mov word [0x6d0fb7c0], cx
je 0x6d0a47bd
push str.Home_n
push 0
push 3
call fcn.6d08901e
add esp, 0xc
jmp 0x6d0a4822
push str.Pro_n
push 0
push 3
call fcn.6d08901e
add esp, 0xc
jmp 0x6d0a4822
push eax
push ecx
push str.OS_UNKNOWN:_dwMajorVersion_d_dwMinorVersion_d_n
push 0
push 3
call fcn.6d08901e
mov edx, 0xff80
add esp, 0x14
mov word [0x6d0fb7c0], dx
jmp 0x6d0a4822
push ecx
push eax
push str.OS_UNKNOWN:_dwPlatformId_d_dwMajorVersion_d_n
push 0
push 3
call fcn.6d08901e
add esp, 0x14
jmp 0x6d0a4817
push str.OS_UNKNOWN:_GetVersionEx_failed_n
push 0
push 3
call fcn.6d08901e
add esp, 0xc
mov eax, 0xff80
mov word [0x6d0fb7c0], ax
movzx ecx, word [esp + 0x128]
movzx eax, word [0x6d0fb7c0]
and eax, ecx
mov ecx, dword [esp + 0x120]
pop ebx
xor ecx, esp
call fcn.6d0b0acb
add esp, 0x120
ret
Function at 0x6d0a4990
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push str.J2D_D3D_RASTERIZER
call dword [sym.imp.MSVCR100.dll_getenv]
mov esi, eax
add esp, 4
mov ebx, 1
test esi, esi
je 0x6d0a4a79
push edi
push str._W__D3DPPLM::SelectDeviceType:
push 0
push 2
call fcn.6d08901e
mov edi, dword [sym.imp.MSVCR100.dll_strncmp]
push 3
push 0x6d0d33d4
push esi
call edi
add esp, 0x18
test eax, eax
je 0x6d0a4a51
push 3
push 0x6d0b70a4
push esi
call edi
add esp, 0xc
test eax, eax
je 0x6d0a4a51
push 3
push 0x6d0d33d0
push esi
call edi
add esp, 0xc
test eax, eax
je 0x6d0a4a41
push 3
push 0x6d0d33cc
push esi
call edi
add esp, 0xc
test eax, eax
je 0x6d0a4a41
push 3
push 0x6d0d33c8
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x6d0a4a2d
push str.nullref_rasterizer_selected
push eax
push 2
call fcn.6d08901e
mov ebx, 4
jmp 0x6d0a4a64
push esi
push str.unknown_rasterizer:__s__only__refhalnul__supported__hal_selected_instead
push 0
push 2
call fcn.6d08901e
add esp, 0x10
jmp 0x6d0a4a67
push str.hal_rasterizer_selected
push 0
push 2
call fcn.6d08901e
jmp 0x6d0a4a64
push str.ref_rasterizer_selected
push 0
push 2
call fcn.6d08901e
mov ebx, 2
add esp, 0xc
push 0x6d0b71b8
push 0
push 2
call fcn.6d08901e
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x6d0a5380
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
ja 0x6d0a539c
call esi
cmp al, 5
jne 0x6d0a53aa
call esi
shr eax, 8
cmp al, 1
jb 0x6d0a53aa
push 0x52
call fcn.6d0a4600
add esp, 4
test eax, eax
je 0x6d0a53d5
push str.D3DPPLM::CheckOSVersion:_Windows_2000_or_earlier__or_a_server__OS_detected__failed
push 1
push 1
call fcn.6d08901e
add esp, 0xc
cmp dword [0x6d0fb7bc], 0
je 0x6d0a53d9
push str.__OS_check_overridden_via_J2D_D3D_NO_HWCHECK
push 1
push 2
call fcn.6d08901e
add esp, 0xc
xor eax, eax
pop esi
ret
mov eax, 0x80004005
pop esi
ret
Function at 0x6d0ae316
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x1fd0]
mov eax, 0x2050
call fcn.6d0b0be0
mov eax, dword [0x6d0f8610]
xor eax, ebp
mov dword [ebp + 0x1fcc], eax
mov ecx, dword [ebp + 0x1fe4]
mov eax, dword [ebp + 0x1fd8]
push ebx
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x1fe0]
push ecx
push eax
xor ebx, ebx
call dword [0x6d0fb810]
test eax, eax
je 0x6d0ae472
push esi
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x6d0ae461
push edi
push 0x2c
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [ebp + 0x1fe8]
add esp, 0xc
mov eax, edi
neg eax
mov dword [ebp - 0x58], eax
push 0x20
xor eax, eax
inc eax
mov word [ebp - 0x54], ax
pop eax
push ebx
mov word [ebp - 0x52], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x70]
mov esi, edi
push dword [ebp - 0x64]
imul esi, edi
mov dword [ebp - 0x60], 0x28
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x50], ebx
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ebx, dword [sym.imp.kernel32.dll_GetVersion]
call ebx
cmp al, 5
jb 0x6d0ae3df
call ebx
shr eax, 8
cmp al, 1
jae 0x6d0ae3e5
call ebx
cmp al, 5
jbe 0x6d0ae3fa
xor eax, eax
test esi, esi
jle 0x6d0ae3fa
test dword [ebp + eax*4 - 0x34], 0xff000000
jne 0x6d0ae435
inc eax
cmp eax, esi
jl 0x6d0ae3eb
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0xfcc]
push eax
push edi
push 0
push dword [ebp - 0x74]
push dword [ebp - 0x64]
call dword [sym.imp.GDI32.dll_GetDIBits]
xor ecx, ecx
test esi, esi
jle 0x6d0ae435
cmp dword [ebp + ecx*4 + 0xfcc], 0
jne 0x6d0ae430
lea eax, [ebp + ecx*4 - 0x34]
or dword [eax], 0xff000000
inc ecx
cmp ecx, esi
jl 0x6d0ae41c
push dword [ebp - 0x64]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [ebp - 0x6c]
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0x2cc]
lea ecx, [ebp - 0x34]
push ecx
push esi
mov ebx, eax
mov eax, dword [edi]
push 0
push ebx
push edi
call dword [eax + 0x34c]
pop edi
push dword [ebp - 0x70]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x74]
call esi
pop esi
mov ecx, dword [ebp + 0x1fcc]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.6d0b0acb
add ebp, 0x1fd0
leave
ret 0x14

Function at 0x6d0af4b0
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
jb 0x6d0af4c6
call esi
shr eax, 8
cmp al, 1
jae 0x6d0af4cc
call esi
cmp al, 5
jbe 0x6d0af4e4
push 0
push dword [esp + 0x10]
push 0x6d0af464
push dword [esp + 0x14]
call sub.COMCTL32.dll_SetWindowSubclass
xor eax, eax
jmp 0x6d0af4f4
push dword [esp + 0xc]
push 0xfffffffffffffffc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop esi
ret 8
Function at 0x6d0af4f8
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetVersion]
call esi
cmp al, 5
jb 0x6d0af50e
call esi
shr eax, 8
cmp al, 1
jae 0x6d0af514
call esi
cmp al, 5
jbe 0x6d0af528
push dword [esp + 0xc]
push 0x6d0af464
push dword [esp + 0x10]
call sub.COMCTL32.dll_RemoveWindowSubclass
jmp 0x6d0af538
push dword [esp + 0x10]
push 0xfffffffffffffffc
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop esi
ret 0xc

Function at 0x6d0b0acb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d0f8610]
jne 0x6d0b0ad5
repz ret
jmp fcn.6d0b1354
Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1b0019e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1b0019f0
repz ret
jmp fcn.1b001d0e
Function at 0x402f93
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402fc9
lea esi, [edi + 4]
test esi, esi
je 0x402fc9
call fcn.00402ef5
test al, al
je 0x402fc9
mov ecx, edi
call fcn.00402ef5
test al, al
je 0x402fc9
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402fcb
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x4055c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4055d3
pop dword [ebp - 8]
mov eax, 0x4993e29
sub eax, 0x458e856
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3dce0
push 0
mov eax, 0x65c79d6e
add eax, 0x9a7a44be
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xfeb3b350
add ecx, 0x14c953f
xor edi, edi
add edi, eax
mov edx, 0xce35549f
add edx, 0x320e5d61
add edx, dword [ebp - 8]
mov esi, 0x341faed9
sub esi, 0x98c79c28
xor dword [ebp - 4], edx
mov ebx, dword [edx]
add dword [ebp - 4], esi
xor ebx, esi
add dword [ebp - 4], edi
mov dword [edi], ebx
mov dword [ebp - 4], 0x17a1fc1
add edi, 4
add edx, 0x1fae0c8d
sub edx, 0x1fae0c89
loop 0x405634
add eax, 0x1150f
mov ebx, eax
add eax, 0x5753274d
sub eax, 0x57532748
mov ecx, 0x8ce59b32
sub ecx, 0x8ca59b32
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001cd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
mov eax, dword [ebp + 8]
je 0x1001cd48
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cd62
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022ac0
leave
ret 4

Function at 0x1001cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cf66
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cfc5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022ac0
leave
ret 0x10
Function at 0x1001cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d00c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d03d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d03b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct_ANGLEAXIS_const__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d03d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022ac0
leave
ret 8
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403e59
pop dword [ebp - 0x1c]
mov eax, 0x2b1e1858
add eax, 0xd5222601
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x51226439
add dword [ebp - 0x2c], 0xfd2fe112
mov dword [ebp - 0x28], 0x58e6fa42
add dword [ebp - 0x28], 0xd94c5203
mov dword [ebp - 0x24], 0xd3feba1b
add dword [ebp - 0x24], 0x784d8a13
mov dword [ebp - 0x20], 0xc55ed97a
add dword [ebp - 0x20], 0x3aa12686
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x5d18a602
add eax, 0xa327ca62
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x9b685f02
sub dword [ebp - 0x2c], 0x26f5f5ac
mov dword [ebp - 0x28], 0x523b02fe
sub dword [ebp - 0x28], 0x10cea189
mov dword [ebp - 0x24], 0x10b918f4
add dword [ebp - 0x24], 0x52b65378
mov dword [ebp - 0x20], 0x4fd233f7
sub dword [ebp - 0x20], 0x4fd233f7
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x397fd
push 0
call eax
mov ecx, 0x79b1a328
add ecx, 0x864eafda
mov edi, eax
mov ebx, 0xc1895f75
sub ebx, 0xc1485f75
add ebx, dword [ebp - 0x1c]
mov esi, 0x3ce00e05
add dword [ebp - 0x10], eax
mov edx, dword [ebx]
sub dword [ebp - 0x14], 0x2327e1cd
sub edx, esi
xor dword [ebp - 0x10], edx
mov dword [edi], edx
add dword [ebp - 0x18], 0xfabbbfc4
add edi, 0x71a5493c
sub edi, 0x71a54938
add ebx, 4
loop 0x403f70
add eax, 0x13edb
mov ebx, eax
add eax, 0x44e98276
add eax, 0xbb167d8f
mov ecx, 0x2c46a125
add ecx, 0xd3f95edb
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x1000e5e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000e5f2
pop dword [ebp - 0x30]
mov eax, 0x3c4aa34
add eax, 0xc3c3bbe
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x78dc47a4
sub dword [ebp - 0x40], 0x2a8a0259
mov dword [ebp - 0x3c], 0x6f64524f
sub dword [ebp - 0x3c], 0x3d31060a
mov dword [ebp - 0x38], 0x3b4e3029
sub dword [ebp - 0x38], 0xef01ebfb
mov dword [ebp - 0x34], 0xa0a35687
add dword [ebp - 0x34], 0x5f5ca979
lea eax, [ebp - 0x40]
push eax
mov eax, 0x4d545f9c
sub eax, 0x3d532fbc
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xad9b14d6
add dword [ebp - 0x40], 0xc6d75480
mov dword [ebp - 0x3c], 0x1b06a788
sub dword [ebp - 0x3c], 0xd99a4613
mov dword [ebp - 0x38], 0x6db5f669
sub dword [ebp - 0x38], 0xa4689fd
mov dword [ebp - 0x34], 0x303c4a37
add dword [ebp - 0x34], 0xcfc3b5c9
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xcb61f562
add eax, 0x449f3a86
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x32980
push 0
call eax
mov ecx, 0x381f
xor esi, esi
add esi, eax
mov edi, 0x78bdbdc3
add edi, 0x9743cc3d
add edi, dword [ebp - 0x30]
mov edx, 0x6d30f0f3
sub edx, 0x3c65d2b5
sub dword [ebp - 8], edx
mov ebx, dword [edi]
sub ebx, edx
add dword [ebp - 0x14], ebx
mov dword [esi], ebx
add esi, 0xf26cfd
sub esi, 0xf26cf9
add edi, 0xa6906306
sub edi, 0xa6906302
loop 0x1000e710
add eax, 0x96c23dce
add eax, 0x693e9581
mov ebx, eax
add eax, 5
mov ecx, 0x1d41e384
sub ecx, 0xd41e384
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40507c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40508b
pop dword [ebp - 0x50]
mov eax, 0x40508b
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x40133
push 0
mov eax, 0xd0d89c4c
add eax, 0x2f69b5cc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x58a37339
sub ecx, 0x58a32285
mov edx, eax
mov edi, 0xd81a51b9
add edi, 0x28290247
add edi, dword [ebp - 0x50]
mov esi, 0x2684447e
add esi, 0x6ad90fff
mov ebx, dword [edi]
add dword [ebp - 8], esi
xor ebx, esi
add dword [ebp - 0x44], 0x910e49ae
mov dword [edx], ebx
sub dword [ebp - 0x48], 0x889b04b1
add edx, 4
add edi, 0x7e29099b
sub edi, 0x7e290997
loop 0x4050e5
add eax, 0x758ca59c
sub eax, 0x758b6ff9
xor ebx, ebx
add ebx, eax
add eax, 0x8c755bb9
sub eax, 0x8c755bb4
mov ecx, 0x44d426f6
sub ecx, 0x449426f6
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x10026534
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10026543
pop dword [ebp - 0x20]
mov eax, 0xbb565b1f
add eax, 0x54ac0a24
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3c47f
push 0
mov eax, 0x279de287
add eax, 0xe864ae85
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4e9b
mov ebx, eax
mov esi, 0x10046c00
add esi, dword [ebp - 0x20]
mov edx, 0x2a17daa8
sub edx, 0x866775f4
xor dword [ebp - 0x14], eax
mov edi, dword [esi]
add dword [ebp - 0x10], ebx
add edi, edx
add dword [ebp - 0x1c], ecx
mov dword [ebx], edi
sub dword [ebp - 4], ebx
add ebx, 4
add esi, 0xf69b469b
sub esi, 0xf69b4697
loop 0x10026596
add eax, 0xcc2cb944
sub eax, 0xcc2b8c05
mov ebx, eax
add eax, 0x7c1ee7b0
add eax, 0x83e11855
mov ecx, 0xba063c57
add ecx, 0x55f9c3a9
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10007250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002376d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10031340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1001f187
mov edi, eax
add esp, 4
test edi, edi
je 0x100072ed
push 1
mov dword [ebp - 4], 0
call fcn.1000909d
add esp, 4
mov dword [edi + 4], eax
jmp 0x100072ef
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10002bb0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1000734a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1000734a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10007366
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10007389
cmp byte [ebp + 0xc], 0
je 0x10007375
push esi
call fcn.10009533
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10007395
mov esi, str.ios_base::badbit_set
jmp 0x100073a5
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10007470
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10003be0
push 0x1002e150
lea eax, [ebp - 0x28]
push eax
call sub.msvcrt.dll__CxxThrowException
int3