joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052d90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b106d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x10]
cmp edx, 0x7ffffffe
ja 0x10052dfd
cmp dword [eax + 0x14], 8
lea edx, [edx*2 + 2]
jb 0x10052dd3
mov eax, dword [eax]
push edx
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x10052e18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push str.Failed_to_set_registry_string_value___size_too_big
lea ecx, [ebp - 0x18]
call fcn.100083f0
push 0x100d6b98
lea eax, [ebp - 0x18]
push eax
call fcn.10083bba
push str.Failed_to_set_registry_string_value
lea ecx, [ebp - 0x24]
call fcn.10005d60
lea edx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000a4f0
int3
Function at 0x10052e40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b10a5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp + 8]
mov ebx, 7
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x28], dx
mov dword [ebp - 4], edx
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp esi, edi
je 0x10052ed5
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10052eaa
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.10018080
push 0
lea ecx, [ebp - 0x28]
call fcn.10017f20
add esi, 0x18
cmp esi, edi
jne 0x10052ea0
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edi, dword [esi + 4]
mov esi, dword [esi]
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x7ffffffe
ja 0x10052f73
lea ecx, [ecx*2 + 2]
cmp ebx, 8
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x34]
push 7
push 0
push dword [ebp - 0x30]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x10052f8e
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10052f55
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10052f4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10052fa9
push edx
push ecx
call fcn.1006d8b6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 8
push str.Failed_to_set_registry_multi_string_value___size_too_big
lea ecx, [ebp - 0x40]
call fcn.100083f0
push 0x100d6b98
lea eax, [ebp - 0x40]
push eax
call fcn.10083bba
push str.Failed_to_set_registry_multi_string_value
lea ecx, [ebp - 0x4c]
call fcn.10005d60
lea edx, [ebp - 0x4c]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.1000a4f0
call fcn.100869bf
int3

Function at 0x100530b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af74d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
je 0x100530ed
cmp esi, 2
jne 0x100530ff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_delete_key
lea ecx, [ebp - 0x28]
call fcn.10005d60
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000a4f0
int3
Function at 0x10053120
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afa5d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov esi, eax
test esi, esi
je 0x1005315d
cmp esi, 2
jne 0x1005316f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_delete_subtree
lea ecx, [ebp - 0x24]
call fcn.10005d60
lea edx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000a4f0
int3

Function at 0x10053190
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af74d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov ecx, esi
sub ecx, 0
je 0x100531e4
sub ecx, 2
jne 0x100531f8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_delete_value
lea ecx, [ebp - 0x28]
call fcn.10005d60
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000a4f0
int3

Function at 0x10053220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b10dd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1c]
push edx
push 0
lea edx, [ebp - 0x18]
push edx
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1005329d
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x1005327a
cmp eax, 2
je 0x1005327a
cmp eax, 7
jne 0x100532bb
mov eax, dword [ebp - 0x1c]
test al, 1
jne 0x100532d6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_get_registry_value_length
lea ecx, [ebp - 0x34]
call fcn.10005d60
lea edx, [ebp - 0x34]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000a4f0
push str.Registry_value_is_not_string
lea ecx, [ebp - 0x28]
call fcn.100083f0
push 0x100d6b98
lea eax, [ebp - 0x28]
push eax
call fcn.10083bba
push str.Invalid_registry_value_length_for_a_Unicode_string
lea ecx, [ebp - 0x40]
call fcn.100083f0
push 0x100d6b98
lea eax, [ebp - 0x40]
push eax
call fcn.10083bba
int3
Function at 0x10053300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1125
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10053351
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x10053445
xor ecx, ecx
shr eax, 1
push ecx
mov word [ebp - 0x3e], cx
xorps xmm0, xmm0
lea ecx, [ebp - 0x3e]
movq qword [ebp - 0x24], xmm0
push ecx
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x1c], 0
call fcn.100536e0
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x10053465
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x100533b4
cmp eax, 2
je 0x100533b4
cmp eax, 7
jne 0x10053480
mov eax, dword [ebp + 0x10]
test al, 1
je 0x100533c5
push str.Invalid_registry_value_length_for_a_Unicode_string
jmp 0x10053485
test eax, eax
je 0x10053424
mov ecx, dword [ebp - 0x20]
mov eax, ecx
mov edx, dword [ebp - 0x24]
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x10053424
cmp word [ecx - 2], 0
lea eax, [ecx - 2]
mov dword [ebp - 0x3c], 0
cmove ecx, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], 7
cmp edx, ecx
je 0x1005340f
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3c]
call fcn.10004420
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.1000db40
lea ecx, [ebp - 0x3c]
call fcn.10002a60
jmp 0x1005343d
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x24]
call fcn.10022400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 0xc
push str.Failed_to_get_registry_value_length
lea ecx, [ebp - 0x3c]
call fcn.10005d60
lea edx, [ebp - 0x3c]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.1000a4f0
push str.Registry_value_is_not_string
lea ecx, [ebp - 0x30]
call fcn.100083f0
push 0x100d6b98
lea eax, [ebp - 0x30]
push eax
call fcn.10083bba
int3
Function at 0x10059030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x100d800c]
xor eax, esp
mov dword [esp + 0x30], eax
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
cmp dword [esi + 4], 0xffffffff
je 0x100590c4
mov eax, dword [ecx]
cmp eax, dword [esi]
jl 0x100590c4
push edx
push ecx
mov edx, str._FT_T
lea ecx, [esp + 0x24]
call fcn.10058e00
add esp, 8
mov dword [esp + 4], 0
cmp dword [esp + 0x30], 0x10
lea ecx, [esp + 8]
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
cmovae eax, dword [esp + 0x1c]
xorps xmm0, xmm0
push ecx
lea ecx, [esp + 8]
movlpd qword [esp + 0xc], xmm0
push ecx
push dword [esp + 0x34]
mov dword [esp + 0x20], 0xffffffff
push eax
push dword [esi + 4]
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x1c]
call fcn.10003840
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 8
Function at 0x10059960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1a1d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], edx
mov edi, ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x48], ecx
mov ecx, dword [eax]
test ecx, ecx
je 0x100599b7
push edx
push edi
call fcn.10059030
mov edx, dword [ebp - 0x44]
mov esi, dword [esi]
test esi, esi
je 0x10059aab
cmp dword [esi + 0x28], 0xffffffff
je 0x10059aab
mov eax, dword [edi]
cmp eax, dword [esi + 0x18]
jl 0x10059aab
push edx
push edi
mov edx, str._FT_T
lea ecx, [ebp - 0x40]
call fcn.10058e00
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push eax
push dword [esi + 0x28]
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
add dword [esi + 0x30], eax
mov ecx, dword [esi + 0x30]
adc dword [esi + 0x34], 0
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x24]
jb 0x10059a9c
ja 0x10059a4f
cmp ecx, dword [esi + 0x20]
jbe 0x10059a9c
push 0x10
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
push 8
push dword [esi + 0x28]
movups xmmword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
cmp eax, dword [esi + 0x24]
jb 0x10059a9c
ja 0x10059a7f
cmp ecx, dword [esi + 0x20]
jbe 0x10059a9c
push 3
lea edx, [esi + 0x28]
mov ecx, esi
call fcn.10058030
add esp, 4
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10003840
push dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov ecx, edi
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.10059b40
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret
Function at 0x10059b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1a6d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov edi, dword [eax]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
test edi, edi
je 0x10059c2f
mov eax, dword [ebx]
cmp eax, dword [edi + 0x18]
jl 0x10059c2f
lea esi, [edi + 0x38]
push esi
mov dword [ebp - 0x3c], esi
call fcn.1006eccb
add esp, 4
test eax, eax
jne 0x10059ce6
push dword [ebp - 0x30]
mov edx, str._FT_T
mov dword [ebp - 4], eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10058e00
add esp, 8
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x2c]
call fcn.10053a20
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x10059c0d
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10059c03
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10059cec
push edx
push ecx
call fcn.1006d8b6
add esp, 8
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.1006ecdc
mov eax, dword [ebp - 0x34]
add eax, 0x68
push eax
call fcn.1007263f
mov edx, dword [ebp - 0x30]
add esp, 8
mov ecx, dword [ebp - 0x14]
mov esi, dword [ecx]
test esi, esi
je 0x10059c9e
cmp dword [esi + 4], 0xffffffff
je 0x10059c9e
mov eax, dword [ebx]
cmp eax, dword [esi]
jl 0x10059c9e
push edx
push ebx
mov edx, str._H:_M:_S
lea ecx, [ebp - 0x2c]
call fcn.10058e00
add esp, 8
mov dword [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp byte [esi + 8], 0
je 0x10059c6d
push eax
mov ecx, esi
call fcn.100590e0
jmp 0x10059c8f
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x14]
push 0
cmovae eax, dword [ebp - 0x2c]
push ecx
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.10003840
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
test ecx, ecx
je 0x10059cca
mov edi, dword [ecx + 0x24]
test edi, edi
je 0x10059cca
mov eax, dword [ebx]
cmp eax, dword [ecx + 0x28]
jl 0x10059cca
mov eax, dword [edi]
push dword [ebp - 0x30]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret
push eax
call fcn.1006e966
call fcn.100869bf
int3
Function at 0x10063c40
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
cmp dword [esi], 0
jne 0x10063dca
mov edx, dword [esi + 8]
sub edx, dword [esi + 4]
sar edx, 3
cmp edx, 2
jle 0x10063dca
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
movq xmm0, qword [ecx]
mov eax, dword [ecx + 8]
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], eax
mov eax, edx
mov dword [ebp - 4], 0
shr eax, 1
mov edi, 1
add eax, edx
mov dword [ebp - 0x18], edi
cmp eax, edi
jbe 0x10063cbf
add edi, edi
cmp edi, eax
jb 0x10063cb6
mov dword [ebp - 0x18], edi
lea ebx, [edi*4]
push ebx
call fcn.10062a10
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10063cef
lea ecx, [ebp - 0x30]
call fcn.10062a90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 0
push eax
call fcn.10083a60
mov edx, dword [esi + 4]
add esp, 0xc
mov ebx, edx
mov dword [ebp - 0x14], edx
cmp ebx, dword [esi + 8]
je 0x10063d74
mov eax, dword [ebx + 4]
test eax, eax
je 0x10063d13
xor esi, esi
jmp 0x10063d15
mov esi, dword [ebx]
test eax, eax
cmovne esi, eax
test esi, esi
je 0x10063d69
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor ecx, eax
lea eax, [edi - 1]
and eax, ecx
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
lea edi, [edx + eax*4]
mov edx, dword [edi]
test edx, edx
je 0x10063db0
mov edi, dword [ebp - 0x18]
cmp edx, esi
je 0x10063d66
inc eax
lea edx, [edi - 1]
add eax, ecx
inc ecx
and eax, edx
cmp ecx, edx
jbe 0x10063d46
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add ebx, 8
cmp ebx, dword [esi + 8]
jne 0x10063d08
mov dword [esi + 8], edx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebx]
cmp eax, edi
je 0x10063d94
mov esi, dword [eax]
push eax
call fcn.100879df
add esp, 4
mov eax, esi
cmp esi, edi
jne 0x10063d83
mov eax, dword [ebp - 0x28]
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x14]
mov dword [edi], esi
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edi, dword [ebp - 0x18]
mov dword [edx], eax
mov dword [edx + 4], ecx
add edx, 8
mov dword [ebp - 0x14], edx
jmp 0x10063d69
mov edx, dword [esi + 8]
mov ecx, dword [esi + 4]
call fcn.10069540
mov dword [esi + 8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100686c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
mov edi, ecx
mov esi, ebx
mov al, byte [ebx]
test al, al
je 0x100686f0
movsx eax, al
lea esi, [esi + 1]
add eax, edx
imul edx, eax, 0x401
mov eax, edx
shr eax, 6
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x100686d5
lea eax, [edx + edx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
and ecx, 0x3f
mov esi, dword [edi + ecx*4]
test esi, esi
je 0x10068760
mov eax, dword [esi]
dec eax
cmp eax, 3
ja case.default.0x1006870c
jmp dword [eax*4 + 0x10068774]
lea eax, [esi + 0x1c]
jmp 0x10068729
lea eax, [esi + 0x10]
jmp 0x10068729
lea eax, [esi + 0xc]
jmp 0x10068729
lea eax, [esi + 9]
jmp 0x10068729
xor eax, eax
mov ecx, ebx
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10068750
test dl, dl
je 0x1006874c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10068750
add eax, 2
add ecx, 2
test dl, dl
jne 0x10068730
xor eax, eax
jmp 0x10068755
sbb eax, eax
or eax, 1
test eax, eax
je 0x10068769
mov esi, dword [esi + 4]
test esi, esi
jne 0x10068704
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1006dc93
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x158
push esi
mov byte [ebp - 0x4c], 0x53
mov byte [ebp - 0x4b], 0x54
mov byte [ebp - 0x4a], 0x4f
mov byte [ebp - 0x49], 0x58
mov byte [ebp - 0x48], 0x31
mov byte [ebp - 0x47], 0x42
mov byte [ebp - 0x46], 0x71
mov byte [ebp - 0x45], 0x4f
mov byte [ebp - 0x44], 0x3e
mov byte [ebp - 0x43], 0x36
mov byte [ebp - 0x42], 0x36
mov byte [ebp - 0x41], 0x66

Function at 0x1006e3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
invalid
inc ebp
Function at 0x1006e720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
inc ebp
or byte [ebx], al
inc esp
or bh, byte [eax - 0x77]
inc ebp
clc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x1006e783
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x18]
jae 0x1006e7c5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1006e680
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x1006e7c3
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
jmp 0x1006e7c7
jmp 0x1006e77a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100838b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, 0xfffffffe
je 0x100838cf
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call fcn.1006d58e
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add ecx, edi
xor ecx, dword [eax + edi]
pop edi
pop esi
pop ebp
jmp fcn.1006d58e