joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022e90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e631
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1004f0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x30]
add ecx, 1
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x30], ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10022f11
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xf4]
call eax
cmp eax, 2
jne 0x10022f11
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 0x44]
mov edx, dword [edx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [edx + 0x4c]
call eax
add eax, 1
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 0x44]
mov edx, dword [edx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [edx + 0x48]
call eax
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx + 0x1c]
call dword [sym.imp.KwDataDef.dll_public:_class_std::vector_class_CSongInfoBase___class_std::allocator_class_CSongInfoBase_______thiscall_CSongListBase::GetSongInfoVector_void_]
mov ecx, eax
call fcn.10021ca0
mov edx, dword [ebp - 0x44]
cmp dword [edx + 0x30], eax
jne 0x1002302f
push 4
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x44]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x1c]
mov edx, dword [eax + 0x50]
call edx
lea ecx, [ebp - 0x70]
call fcn.10014570
mov dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x54]
call fcn.10014740
mov byte [ebp - 0x45], 1
lea ecx, [ebp - 0x45]
push ecx
lea ecx, [ebp - 0x54]
call fcn.1000c010
push str.modwifimgrobserver
lea ecx, [ebp - 0x40]
call fcn.10001d10
mov byte [ebp - 4], 1
call dword [sym.imp.KwMusicCore.dll_AfxGetMessageManager]
mov dword [ebp - 0x4c], eax
lea edx, [ebp - 0x70]
push edx
push 0
push 0xd
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x18]
call eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.100033c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10014f50
lea ecx, [ebp - 0x64]
call fcn.10014570
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x58]
call fcn.10014740
lea ecx, [ebp - 0x58]
call fcn.100167b0
push str.modwifimgrobserver
lea ecx, [ebp - 0x28]
call fcn.10001d10
mov byte [ebp - 4], 3
call dword [sym.imp.KwMusicCore.dll_AfxGetMessageManager]
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0x64]
push edx
push 0
push 6
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.100033c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.10014f50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b334
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100244d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1004f0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
add esi, 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x1c]
call dword [sym.imp.KwDataDef.dll_public:_class_std::vector_class_CSongInfoBase___class_std::allocator_class_CSongInfoBase_______thiscall_CSongListBase::GetSongInfoVector_void_]
mov ecx, eax
call fcn.10021ca0
cmp esi, eax
jae 0x10024586
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x1c]
call dword [sym.imp.KwDataDef.dll_public:_class_std::vector_class_CSongInfoBase___class_std::allocator_class_CSongInfoBase_______thiscall_CSongListBase::GetSongInfoVector_void_]
mov ecx, eax
call fcn.1001c3f0
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
je 0x10024581
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0xa0]
call eax
lea ecx, [ebp - 0x1c]
call fcn.1001d220
movzx ecx, al
test ecx, ecx
je 0x10024566
lea ecx, [ebp - 0x1c]
call fcn.1001c660
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10024579
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x1c]
call fcn.100033c0
mov eax, dword [ebp - 0x28]
jmp 0x10024589
lea ecx, [ebp - 0x1c]
call fcn.100033c0
jmp 0x100244e4
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b334
mov esp, ebp
pop ebp
ret 4

Function at 0x100252f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ea28
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1004f0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
call fcn.10026490
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.100254b0
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
call fcn.100256b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10025630
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x1002538d
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
jmp 0x100253bb
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100253ab
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b334
mov esp, ebp
pop ebp
ret
Function at 0x100267f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003eb66
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x1004f0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x150], 0x104
mov byte [ebp - 0x114], 0
push 0x103
push 0
lea eax, [ebp - 0x113]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x150]
push edx
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.1001c660
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x10026913
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x154], eax
push str.CUsbDiskMethod::GetDeviceDriverName
lea ecx, [ebp - 0x12c]
call fcn.10001d10
mov dword [ebp - 4], 0
push str.MusicUsbDeviceMgr.txt
lea ecx, [ebp - 0x144]
call fcn.10001d10
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x154]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.1001c660
push eax
push str.GetDeviceDriver__s_failed_with_error_code__d_n
lea edx, [ebp - 0x12c]
push edx
push 0
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KwLog.dll_void___cdecl_YL_Log_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___int__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x144]
call fcn.100033c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.100033c0
lea ecx, [ebp - 0x114]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10001d10
mov edx, dword [ebp - 0x148]
or edx, 1
mov dword [ebp - 0x148], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b334
mov esp, ebp
pop ebp
ret
Function at 0x10026950
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ebae
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x1004f0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x71], 0
call fcn.10026490
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.10027b30
add esp, 0xc
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x8c]
call fcn.100256b0
push eax
lea ecx, [ebp - 0x28]
call fcn.10027c00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.10025630
lea ecx, [ebp - 0x28]
call fcn.10027e80
movzx eax, al
test eax, eax
jne 0x10026b1f
lea ecx, [ebp - 0x28]
call fcn.100263e0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0x80], 2
je 0x10026b1b
cmp dword [ebp - 0x80], 3
je 0x10026a14
jmp 0x10026b1f
push 2
push 0
lea edx, [ebp - 0x70]
push edx
lea ecx, [ebp - 0x28]
call fcn.10028280
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xa0]
push ecx
push str.._
lea edx, [ebp - 0x40]
push edx
call fcn.10027ad0
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.10014c20
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x40]
call fcn.100263e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffff
je 0x10026b0d
push 0x227
call fcn.1003ab3c
add esp, 4
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ecx + 4], 0x227
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x7c]
push eax
call fcn.10026b80
add esp, 8
test eax, eax
je 0x10026aeb
mov ecx, dword [ebp - 0x78]
cmp dword [ecx + 0x1c], 7
jne 0x10026ad8
mov dword [ebp - 0x84], 1
jmp 0x10026ae2
mov dword [ebp - 0x84], 0
mov dl, byte [ebp - 0x84]
mov byte [ebp - 0x71], dl
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
push ecx
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.10014c20
jmp 0x10026b1f
mov byte [ebp - 0x71], 1
mov al, byte [ebp - 0x71]
mov byte [ebp - 0x72], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10014c20
mov al, byte [ebp - 0x72]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b334
mov esp, ebp
pop ebp
ret
Function at 0x10027160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1004f0d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x818], 0
cmp dword [ebp + 0xc], 0
je 0x10027198
cmp dword [ebp + 0x10], 0
je 0x10027198
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx], 0
cmp dword [ebp + 8], 0
je 0x10027323
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
je 0x10027323
cmp dword [ebp + 0xc], 0
je 0x10027323
cmp dword [ebp + 0x10], 0
je 0x10027323
mov byte [ebp - 0x804], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x803]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
push str.SYSTEMCurrentControlSetEnum_
lea edx, [ebp - 0x804]
push edx
call sub.MSVCR120.dll_strcpy
add esp, 8
push 0x3ff
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.MSVCR120.dll_strncat]
add esp, 0xc
lea edx, [ebp - 0x80c]
push edx
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jne 0x10027323
mov byte [ebp - 0x404], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x403]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x814], 0x400
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 0
push str.FriendlyName
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x100272d5
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x810]
push edx
push 0
push str.DeviceDesc
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x808], eax
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x808], 0
jne 0x10027323
cmp dword [ebp - 0x810], 1
jne 0x10027323
mov edx, dword [ebp + 0x10]
sub edx, 1
push edx
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR120.dll_strncpy]
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov byte [edx - 1], 0
mov dword [ebp - 0x818], 1
mov eax, dword [ebp - 0x818]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b334
mov esp, ebp
pop ebp
ret
Function at 0x10031dd0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret
Function at 0x10001016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0x10003010
push 0x65
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x10001065
xor eax, eax
jmp 0x100010a7
push ebx
mov ebx, dword [esi]
push 0
push 4
push 2
push 0
push 2
push 0x40000000
push 0x10003038
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010a3
lea eax, [esp + 0xc]
push 0
push eax
add esi, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x100010ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push 0x10003038
push edx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x10001110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
pop esi
xor eax, eax
leave
ret

Function at 0x10015e90
Capabilities:
Encode data using xor

Disassembly:
push esi
sti
rol eax, 1
je 0x10015e9c
push eax
push 0xab040040
inc eax
add byte [ebx + ebp*4], al
mov eax, edx
clc
push dword [ebp - 4]
test eax, eax
lsl edx, word [esi - 0x15]
add dword [ebx + 0x57], edx
mov edx, dword [ecx + eax + 0x76e8006a]
mov cl, 0xf3
stosd dword es:[edi], eax
mov byte [eax + 0xd], bl
sti
inc ebp
cld
mov eax, dword [ebp + 8]
xor eax, dword [ebp + 0x65ccfecc]
push es
clc
add dword [ebp + 8], 0x33
jp 0x10015e98
dec ah
ret
Function at 0x10005963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10005972
pop dword [ebp - 0x34]
mov eax, 0x773d4734
sub eax, 0x673cedc2
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3efbe9bb
sub dword [ebp - 0x44], 0xf0a9a470
mov dword [ebp - 0x40], 0xbf599ffa
add dword [ebp - 0x40], 0x72d9ac4b
mov dword [ebp - 0x3c], 0x44f6bed3
add dword [ebp - 0x3c], 0x755855b
mov dword [ebp - 0x38], 0xf28369ab
add dword [ebp - 0x38], 0xd7c9655
lea eax, [ebp - 0x44]
push eax
mov eax, 0xdcfb8604
sub eax, 0xccf315d0
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1203b5a0
add dword [ebp - 0x44], 0x626eb3b6
mov dword [ebp - 0x40], 0xafe0b12a
add dword [ebp - 0x40], 0x918bb04b
mov dword [ebp - 0x3c], 0x3cee5f43
sub dword [ebp - 0x3c], 0xd97ef2d7
mov dword [ebp - 0x38], 0x9ba0b747
sub dword [ebp - 0x38], 0x9ba0b747
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xf456bbdb
sub eax, 0xe44e4bb7
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3da2b
push 0
call eax
mov ecx, 0x429567b2
add ecx, 0xbd6adf82
xor edx, edx
add edx, eax
mov ebx, 0x100b9000
add ebx, dword [ebp - 0x34]
mov edi, 0xd0243450
add edi, 0x2a14a913
mov esi, dword [ebx]
add dword [ebp - 0x1c], esi
xor esi, edi
mov dword [edx], esi
xor dword [ebp - 0x20], ebx
add edx, 0xd7227d3c
add edx, 0x28dd82c8
add ebx, 0xb69ed432
sub ebx, 0xb69ed42e
loop 0x10005a90
add eax, 0x10fa3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbcc8f71
sub ecx, 0xfbcc8f71
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1003b014
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1003b023
pop dword [ebp - 0x44]
mov eax, 0xd2c254da
sub eax, 0xc2bea4b7
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xaf75abf1
add dword [ebp - 0x54], 0x9edc995a
mov dword [ebp - 0x50], 0x148459b1
add dword [ebp - 0x50], 0x1daef294
mov dword [ebp - 0x4c], 0x14efe3e2
add dword [ebp - 0x4c], 0x375c604c
mov dword [ebp - 0x48], 0xcf54163d
add dword [ebp - 0x48], 0x30abe9c3
lea eax, [ebp - 0x54]
push eax
mov eax, 0x350a3f3d
sub eax, 0x25065ec1
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x8a8d2445
sub dword [ebp - 0x54], 0x161abaef
mov dword [ebp - 0x50], 0xade7bacd
sub dword [ebp - 0x50], 0x6c7b5958
mov dword [ebp - 0x4c], 0x77889b00
sub dword [ebp - 0x4c], 0x14192e94
mov dword [ebp - 0x48], 0x59461f9c
add dword [ebp - 0x48], 0xa6b9e064
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x95f70494
add eax, 0x7a0cdbf0
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3b9c8
push 0
call eax
mov ecx, 0xa5d108d
sub ecx, 0xa5cd0ca
mov edi, eax
mov ebx, 0x6a1bfe23
add ebx, 0xa5eb13dd
add ebx, dword [ebp - 0x44]
mov edx, 0x1229689f
add edx, 0x7ccea646
xor dword [ebp - 0x24], ebx
mov esi, dword [ebx]
sub dword [ebp - 0x20], 0x9b3715e6
add esi, edx
mov dword [ebp - 0xc], 0x3b8a2f5a
mov dword [edi], esi
add edi, 4
add ebx, 0xc708c0f4
sub ebx, 0xc708c0f0
loop 0x1003b145
add eax, 0xd3429489
add eax, 0x2cbe5d56
xor ebx, ebx
add ebx, eax
add eax, 0xba1dd0bd
sub eax, 0xba1dd0b8
mov ecx, 0xaa0a5483
sub ecx, 0x9a0a5483
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10009761
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1001f5e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.1000a23f
test eax, eax
je 0x10009876
xor ebx, ebx
mov dword [ebp - 0x214], 0x104
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.shlwapi.dll_PathCreateFromUrlW]
test eax, eax
js 0x10009876
push ebx
push 0x80
push 3
push ebx
inc ebx
lea eax, [ebp - 0x20c]
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009876
push 0
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x10009876
cmp dword [ebp - 0x218], 4
jne 0x10009876
push 3
lea eax, [ebp - 0x210]
push 0x10017620
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10009840
push 3
lea eax, [ebp - 0x210]
push 0x10017624
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10009840
mov al, bl
jmp 0x10009878
xor eax, eax
push eax
push eax
push eax
movsx ax, byte [ebp - 0x20d]
movzx eax, ax
push eax
call fcn.10009989
mov ecx, dword [0x10020678]
add esp, 0x10
mov edi, eax
mov esi, edx
call fcn.10009989
cmp edx, esi
jb 0x10009872
ja 0x1000983c
cmp eax, edi
jae 0x1000983c
xor bl, bl
jmp 0x1000983c
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013bb0
leave
ret 4

Function at 0x10009989
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10009998
pop dword [ebp - 0x24]
mov eax, 0xc290196a
sub eax, 0xb28f7fd2
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x37bce
push 0
mov eax, 0xbfd9bedd
add eax, 0x5027a263
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xc0444219
add ecx, 0x3fbbfbde
xor ebx, ebx
add ebx, eax
mov esi, 0x9d5c073f
add esi, 0x72a63cc1
add esi, dword [ebp - 0x24]
mov edi, 0x6c74b168
sub edi, 0xa8c46493
xor dword [ebp - 0x10], esi
mov edx, dword [esi]
add dword [ebp - 0x20], 0x821ef0cf
add edx, edi
sub dword [ebp - 0xc], ebx
mov dword [ebx], edx
sub dword [ebp - 8], 0x3a63fce2
add ebx, 0x9cd582d9
add ebx, 0x632a7d2b
add esi, 0x2e12d6e5
add esi, 0xd1ed291f
loop 0x100099f9
add eax, 0x912b18de
sub eax, 0x912a2e2f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe1198774
sub ecx, 0xd1198774
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x416360
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004161d1

Function at 0x41675a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00406650
mov eax, dword [0x42d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004136e4
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41679c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4168f8
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00421160
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x44a3f0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00417751
mov ecx, dword [esi*4 + 0x44a3f0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4168f1
cmp eax, dword [edi + ecx + 0x24]
jne 0x4168f1
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4168f1
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00417751
add esp, 0x14
test edx, edx
jl 0x4168f1
jg 0x416867
test eax, eax
jb 0x4168f1
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4168f1
jl 0x416881
cmp dword [ebp - 0x1008], eax
ja 0x4168f1
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41689f
test ebx, ebx
je 0x4168d8
cmp ecx, edi
jae 0x4168d8
mov al, byte [ecx]
cmp al, 0xd
jne 0x4168b9
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4168c5
cmp byte [ecx + 1], 0xa
jne 0x4168c5
inc ecx
jmp 0x4168c5
movzx eax, al
movsx eax, byte [eax + 0x42d300]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41689f
cmp edx, ebx
jne 0x41689f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4168f6
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405899
leave
ret