joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414262
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x41b3d5
call fcn.0041974f
mov dword [ebp - 0x64], edx
mov ebx, ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0x60], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x48]
jmp 0x414308
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], ecx
xor edi, edi
mov dword [ebp - 0x14], ecx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4142a0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004145bf
xor edx, edx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
test ecx, ecx
je 0x4142e0
mov edi, eax
cmp word [edi], 0x3d
je 0x41432f
add edi, 2
sub ecx, 1
jne 0x4142d2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
add esi, 2
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 7
jbe 0x414308
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
call fcn.00403777
xor ecx, ecx
cmp word [esi], cx
jne 0x41428a
mov edi, ebx
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], 0xf
mov byte [ebx], cl
mov eax, ebx
call fcn.0041970d
ret
test edi, edi
je 0x4142e0
sub edi, eax
sar edi, 1
cmp edi, 0xffffffff
je 0x4142e0
push edi
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00414545
mov byte [ebp - 4], 1
cmp dword [ebp - 0x30], 0
jne 0x41436b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x40]
lea esi, [esi + eax*2]
add esi, 2
call fcn.00414594
jmp 0x4142ed
cmp dword [ebp - 0x2c], 7
lea edx, [ebp - 0x40]
cmova edx, dword [ebp - 0x40]
or ecx, 0xffffffff
movzx eax, word [edx]
mov ebx, eax
mov dword [ebp - 0x60], ebx
mov ebx, dword [ebp - 0x5c]
test ax, ax
je 0x4143a6
movzx eax, ax
xor eax, ecx
lea edx, [edx + 2]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4011b0]
movzx eax, word [edx]
test ax, ax
jne 0x41438c
cmp ecx, dword [ebp - 0x64]
jne 0x414354
push 0xffffffffffffffff
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00414545
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 7
jbe 0x4143cf
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push esi
call fcn.00418ad6
pop ecx
xor ecx, ecx
mov edi, eax
push ecx
push ecx
lea eax, [esi + 1]
push eax
push edi
push 0xffffffffffffffff
push dword [ebp - 0x5c]
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
mov ecx, ebx
call fcn.004035da
lea ecx, [ebp - 0x58]
call fcn.00414594
lea ecx, [ebp - 0x40]
call fcn.00414594
mov edx, dword [ebp - 0x14]
cmp edx, 7
jbe 0x414327
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
call fcn.00403777
jmp 0x414327
Function at 0x414433
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Terminate process

Disassembly:
push 0xc4
mov eax, 0x41b411
call fcn.0041974f
mov edx, 0xab934492
lea ecx, [ebp - 0x48]
xor ebx, ebx
call fcn.00414262
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.00413ef4
push 0x44
pop esi
push esi
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 1
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x402070]
lea edi, [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 0xd0], esi
xor eax, eax
mov dword [ebp - 0x20], 0x2d332d2d
stosd dword es:[edi], eax
mov ecx, ebx
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0x2d797271
mov dword [ebp - 0x18], 0x3c2d733c
stosd dword es:[edi], eax
mov word [ebp - 0x14], 0x2d7e
mov byte [ebp - 0x12], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movsx eax, byte [ebp - 0x30]
and eax, 0x8000000f
jns 0x4144c1
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x1d
jb 0x4144b1
lea eax, [ebp - 0x60]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0x2f]
lea ecx, [ebp - 0x78]
call fcn.00413504
pop ecx
cmp dword [eax + 0x14], 0xf
jbe 0x4144e6
mov eax, dword [eax]
cmp dword [ebp - 0x34], 0xf
lea edx, [ebp - 0x8c]
push edx
lea edx, [ebp - 0xd0]
push edx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x48]
cmova ecx, dword [ebp - 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.0040357e
test esi, esi
je 0x414526
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x4c]
cmp edx, 0xf
jbe 0x414537
mov ecx, dword [ebp - 0x60]
inc edx
call fcn.00403777
lea ecx, [ebp - 0x48]
call fcn.0040357e
call fcn.0041970d
ret
Function at 0x41594f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x41597d
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
movzx eax, word [ebx*8 + 0x401afa]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x401af8]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x401afc]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x401afe]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x4159e0
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x4159eb
cmp ebx, 8
jl 0x4159eb
mov eax, dword [ebp + 8]
or word [eax], cx
push 0x10000
lea eax, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push eax
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x415a56
cmp eax, 0xffffffff
je 0x415a56
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x415a2d
mov ecx, esi
call fcn.00415bd5
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [esi + edi + 0x1af70]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x415a35
jmp 0x415a66
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x415d0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, ebx
push edi
mov dword [ebp - 4], ecx
mov edi, ebx
mov dword [esi + 0x6af80], 2
jmp 0x415f05
cmp eax, 3
jb 0x415d85
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x415dc2
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x415dc2
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x415dac
mov dword [esi + 0x6afa0], eax
mov edx, ecx
mov ecx, esi
call fcn.00415a6b
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x415e91
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.004153dc
pop ecx
mov ecx, dword [esi + 0x6af90]
sub ecx, edi
mov dword [ebp - 8], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x415e60
cmp ecx, 3
jb 0x415e60
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x415e04
jmp 0x415ead
add dword [esi + 0x6af84], edi
mov edi, ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6af7c], eax
jmp 0x415eb9
movzx eax, byte [ecx + esi + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.004153dc
dec dword [esi + 0x6af90]
pop ecx
mov dword [ebp - 8], eax
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
cmp dword [ebp - 8], ebx
je 0x415eef
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x415ed2
lea ecx, [esi + 0x1af70]
add ecx, eax
jmp 0x415ed4
mov ecx, ebx
sub edx, eax
push ebx
push edx
mov edx, ecx
mov ecx, esi
call fcn.00415206
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x415f02
mov ecx, esi
call fcn.00415bd5
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x415d2e
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x415f25
lea ebx, [esi + 0x1af70]
add ebx, ecx
mov eax, dword [esi + 0x6af84]
mov edx, ebx
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00415206
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416b6f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x416b7a
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x416c36
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
sub edi, 1
jne 0x416b8f
pop edi
test esi, esi
je 0x416c52
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
inc edx
sub esi, 1
jne 0x416c3a
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x416c59
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
movsx eax, dl
mov ecx, dword [esi]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4015b8]
movzx eax, cl
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
mov dword [esi], ecx
mov ecx, dword [esi + 8]
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4015b8]
mov dword [esi + 8], ecx
pop esi
ret
Function at 0x419377
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4193b6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4193b6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4193b6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4193b6
cmp dword [ecx + 0x74], 0xe
jbe 0x4193b6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10001d4a
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push ebp
push esi
push edi
xor edi, edi
cmp dword [0x1002ec14], edi
mov ebp, SysReAllocString
jne 0x10001d8e
call ebx
test ebp, eax
je 0x10001d84
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1002ec10], eax
mov dword [0x1002ec14], 1
mov eax, dword [0x1002ec10]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x10001daa
push dword [esp + 0x14]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x10001de5
mov eax, dword [0x1002ec18]
test eax, eax
jne 0x10001ddc
call ebx
test ebp, eax
je 0x10001dc7
push dword [0x10025b4c]
call dword [0x10025b44]
jmp 0x10001dd3
push dword [0x10025b50]
call dword [0x10025b48]
test eax, eax
je 0x10001de5
mov dword [0x1002ec18], eax
push dword [esp + 0x14]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x10002029
Capabilities:
Print debug messages

Disassembly:
push edi
xor edi, edi
cmp dword [0x1002ec34], edi
je 0x1000203f
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x1002ec2c], edi
je 0x1000204c
xor edi, edi
inc edi
jmp 0x100020b0
cmp dword [0x1002ec34], edi
push esi
jne 0x1000205e
call fcn.10001dee
test eax, eax
je 0x10002090
mov eax, dword [0x1002ec28]
cmp eax, edi
mov esi, dword [0x1002c548]
jne 0x10002080
push str.ActivateActCtx
call fcn.10001d4a
cmp eax, edi
mov dword [0x1002ec28], eax
je 0x10002090
push dword [esp + 0xc]
push esi
call eax
cmp eax, edi
je 0x10002090
xor edi, edi
inc edi
jmp 0x100020af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x100020a5
cmp eax, 0x7e
je 0x100020a5
cmp eax, 0x78
jne 0x100020af
xor eax, eax
inc eax
mov dword [0x1002ec2c], eax
mov edi, eax
pop esi
mov eax, edi
pop edi
ret 4
Function at 0x100031de
Capabilities:
Create directory
Get common file path
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x10021a3c
call fcn.1001c560
mov dword [ebp - 0x24], ecx
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push 0x208
call fcn.10009421
pop ecx
mov ebx, eax
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp + 8]
call fcn.1000117a
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
push 0x10025df4
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.100011c7
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
push eax
call fcn.100046ca
mov byte [ebp - 4], 2
mov eax, dword [eax]
push dword [ebp - 0x10]
push eax
call fcn.100094ec
add esp, 0xc
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.1000114e
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.1000114e
test bl, bl
je 0x10003383
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [0x1002ebf8]
mov dword [ebp - 0x18], edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003383
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.EnableLUA
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000337a
cmp dword [ebp - 0x1c], 1
jne 0x1000337a
push 0x10025e10
xor ecx, ecx
call fcn.1000231e
cmp eax, 0xffffffff
jne 0x1000337a
push str.Low_
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.1000220e
mov dword [ebp - 4], 3
mov ecx, esi
call fcn.10001255
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.1000114e
push str.GetTempPathEx:
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.10002262
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0x24]
mov edx, dword [edi]
xor ebx, ebx
push ebx
push eax
mov ecx, edi
call dword [edx + 0x44]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.1000114e
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
jne 0x1000337a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000337a
push str.Fail_to_CreateDir
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.10002262
mov dword [ebp - 4], 5
mov edx, dword [edi]
push ebx
push eax
mov ecx, edi
call dword [edx + 0x44]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24]
call fcn.1000114e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.1001c5ff
ret 4

Function at 0x100034fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
je 0x1000354e
cmp dword [ebp + 8], 0
je 0x1000354e
push 0x10025d3c
push dword [ebp + 8]
call fcn.1000b568
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10003547
push 0
push dword [ebp + 0x14]
push esi
call fcn.1000adba
push esi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1000b277
push esi
call fcn.1000b304
add esp, 0x20
xor eax, eax
jmp 0x10003551
mov eax, 0xfffffc17
jmp 0x10003551
push 0xfffffffffffffffa
pop eax
pop esi
pop ebp
ret 0x10
Function at 0x10003556
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x100035b9
cmp dword [ebp + 8], edi
je 0x100035b9
push esi
xor esi, esi
cmp dword [ebp + 0x14], edi
jne 0x10003575
push 0x10025ee8
jmp 0x1000357c
jle 0x10003588
push 0x10025eec
push dword [ebp + 8]
call fcn.1000b568
pop ecx
mov esi, eax
pop ecx
cmp esi, edi
je 0x100035af
push edi
push dword [ebp + 0x14]
push esi
call fcn.1000adba
push esi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1000a9bd
push esi
call fcn.1000b304
add esp, 0x20
jmp 0x100035b4
mov edi, 0xfffffc17
mov eax, edi
pop esi
jmp 0x100035bc
push 0xfffffffffffffffa
pop eax
pop edi
pop ebp
ret 0x10

Function at 0x100035c1
Capabilities:
Print debug messages

Disassembly:
push 0x18
mov eax, 0x10021715
call fcn.1001c560
mov eax, dword [0x1002c508]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x100036a8
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push 0x10025ef0
push eax
call fcn.10002662
add esp, 0xc
mov esi, 0x10025f10
push esi
push 0x1002ebf4
lea eax, [ebp - 0x24]
push eax
call fcn.1000220e
mov byte [ebp - 4], 2
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10001322
mov byte [ebp - 4], 3
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1000220e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10001322
mov byte [ebp - 4], 5
push 0x10025988
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.1000220e
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10]
call fcn.10001255
mov byte [ebp - 4], 5
lea ecx, [ebp + 0xc]
call fcn.1000114e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
call fcn.1000114e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.1000114e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.1000114e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.1000114e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
jmp 0x1000370a
push 0x10025f10
push 0x1002ebf4
lea eax, [ebp - 0x20]
push eax
call fcn.1000220e
mov byte [ebp - 4], 7
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10001322
mov byte [ebp - 4], 8
push 0x10025988
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.1000220e
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10]
call fcn.10001255
mov byte [ebp - 4], 8
lea ecx, [ebp + 0xc]
call fcn.1000114e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
call fcn.1000114e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.1000114e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1000114e
call fcn.1001c5ff
ret 8
Function at 0x1000372c
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
jne 0x10003739
push 0xfffffffffffffffa
pop eax
jmp 0x10003786
mov eax, dword [edx + 0x3c]
xor ecx, ecx
add eax, edx
je 0x10003734
movzx edx, word [eax + 6]
test edx, edx
push esi
movzx esi, word [eax + 0x14]
lea eax, [esi + eax + 0x18]
pop esi
jbe 0x1000375c
mov ecx, eax
add eax, 0x28
dec edx
jne 0x10003754
mov eax, dword [esp + 8]
sub eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x10]
sub eax, dword [ecx + 0x10]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
and dword [eax], 0
test edx, edx
jbe 0x10003783
mov edx, dword [ecx + 0x14]
add edx, dword [ecx + 0x10]
mov dword [eax], edx
xor eax, eax
jmp 0x10003786
or eax, 0xffffffff
ret 0x10
Function at 0x10004479
Capabilities:
Get system information on windows

Disassembly:
push ebp
sub esp, 0x11c
lea ebp, [esp - 4]
mov eax, dword [0x1002b030]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push 0x34
mov eax, 0x1002169d
call fcn.1001c560
mov eax, dword [ebp + 0x128]
and dword [ebp - 0x14], 0
xor ebx, ebx
inc ebx
test byte [0x1002ec48], bl
mov dword [ebp - 0x18], eax
mov esi, 0x1002ec44
jne 0x100044de
or dword [0x1002ec48], ebx
mov dword [ebp - 4], ebx
push 0x10025fb0
mov edi, esi
call fcn.100011c7
push 0x10021e8b
call fcn.10009e5f
pop ecx
mov byte [ebp - 4], 0
push 0x10025fb0
lea edi, [ebp - 0x1c]
call fcn.100011c7
mov dword [ebp - 4], 2
push dword [ebp - 0x1c]
push dword [0x1002ec44]
call fcn.100094ec
pop ecx
test eax, eax
pop ecx
setne byte [ebp - 0xd]
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.1000114e
cmp byte [ebp - 0xd], 0
je 0x1000452f
mov ecx, esi
mov esi, dword [ebp - 0x18]
call fcn.10001039
and dword [ebp - 4], 0
mov dword [ebp - 0x14], ebx
jmp 0x100046a5
mov edi, str.win98
push edi
mov ebx, esi
call fcn.100021bc
lea eax, [ebp]
push eax
mov dword [ebp], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10004570
mov edi, dword [ebp - 0x18]
push 0x10025fad
call fcn.100011c7
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, edi
jmp 0x100046a7
mov eax, dword [ebp + 0x10]
dec eax
je 0x1000466e
dec eax
jne 0x10004690
mov eax, dword [ebp + 4]
imul eax, eax, 0x64
add eax, dword [ebp + 8]
mov ecx, 0x259
cmp eax, ecx
jb 0x100045cd
jne 0x100045b4
cmp byte [ebp + 0x11a], 1
mov ebx, esi
jne 0x100045aa
push 0x10025fd0
jmp 0x1000468b
push 0x10025fd8
jmp 0x1000468b
push dword [ebp + 8]
push dword [ebp + 4]
push str.Unknown___d._d_
push esi
call fcn.10002662
add esp, 0x10
jmp 0x10004690
cmp eax, 0x258
jb 0x100045f3
cmp byte [ebp + 0x11a], 1
mov ebx, esi
jne 0x100045e9
push 0x10025df4
jmp 0x1000468b
push 0x10026010
jmp 0x1000468b
cmp eax, 0x1f6
jb 0x10004649
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp + 0x118], 0x8000
jne 0x10004616
push 0x10026024
jmp 0x10004689
cmp byte [ebp + 0x11a], 1
jne 0x1000462d
cmp word [ebp - 0x40], 9
jne 0x1000462d
push 0x10026038
jmp 0x10004689
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov ebx, esi
je 0x10004642
push 0x1002605c
jmp 0x1000468b
push 0x10026074
jmp 0x1000468b
cmp eax, 0x1f5
jb 0x10004657
push str.winxp
jmp 0x10004689
cmp eax, 0x1f4
mov ebx, esi
jb 0x10004667
push str.win2000
jmp 0x1000468b
push str.winnt
jmp 0x1000468b
cmp dword [ebp + 8], 0
jne 0x1000467b
push str.win95
jmp 0x10004689
cmp dword [ebp + 8], 0x5a
jne 0x10004688
push str.winme
jmp 0x10004689
push edi
mov ebx, esi
call fcn.100021bc
mov ecx, esi
mov esi, dword [ebp - 0x18]
call fcn.10001039
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.10009e71
add ebp, 0x120
leave
ret