joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007784
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push dword [ebp + 0xc]
mov dword [ebp - 0x108], eax
mov eax, edi
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push esi
mov ebx, 0x80004005
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1007864
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1007864
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1007864
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
and edi, 0xf
jbe 0x1007818
dec edi
movzx eax, word [esi]
lea esi, [esi + eax*2 + 2]
jne 0x100780e
movzx edi, word [esi]
mov eax, 0x80
cmp edi, eax
jae 0x1007864
add esi, 2
push esi
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0100597a
mov ebx, eax
test ebx, ebx
jge 0x1007843
cmp ebx, 0x8007007a
jne 0x1007864
xor eax, eax
mov word [ebp + edi*2 - 0x104], ax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x108]
call fcn.0100597a
mov ebx, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.010052d1
leave
ret 0x14

Function at 0x100787c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
mov dword [ebp - 0x48], 0x80004005
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push edi
push esi
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
pop edi
pop esi
test eax, eax
jne 0x10078fd
mov eax, dword [ebp + 0x18]
cmp eax, 0x20
jb 0x10078e4
push 0x20
pop eax
xor ecx, ecx
mov word [ebp + eax*2 - 0x46], cx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x50]
call fcn.0100597a
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
xor ecx, ebp
call fcn.010052d1
leave
ret 0x14
Function at 0x10079a7
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x334], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x348], eax
xor eax, eax
xor edi, edi
push 0xfe
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x126]
push edi
push eax
mov esi, 0x80004005
mov dword [ebp - 0x338], edi
call sub.msvcrt.dll_memset
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x344], 0x100
mov word [ebx], ax
cmp dword [0x100b6c4], edi
jne 0x1007b3a
push 0x104
lea eax, [ebp - 0x330]
push eax
mov dword [0x100b6c4], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1007b2a
push 0x10014ec
push 0x104
lea eax, [ebp - 0x330]
push eax
call fcn.010059b4
test eax, eax
jl 0x1007b2a
push dword [ebp + 0xc]
lea eax, [ebp - 0x330]
push 8
push eax
call fcn.01008e0b
mov dword [ebp - 0x340], eax
cmp eax, edi
je 0x1007b2a
and dword [0x100b6c4], 0
push 8
pop ecx
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
rep stosd dword es:[edi], eax
push 0x12
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x334]
mov dword [ebp - 0x338], 1
push dword [ebp - 0x33c]
call fcn.01007913
mov esi, eax
test esi, esi
jl 0x1007b1d
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.010076e3
mov esi, eax
test esi, esi
jl 0x1007b1d
push 0x80
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x334]
push dword [ebp + 0xc]
push dword [ebp - 0x340]
call fcn.01007784
mov esi, eax
test esi, esi
jl 0x1007b1d
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 0x1c]
push ebx
call fcn.0100597a
mov esi, eax
xor eax, eax
test esi, esi
setl al
mov dword [ebp - 0x338], eax
push dword [ebp - 0x340]
call fcn.01008cf6
xor edi, edi
cmp dword [0x100b6c4], edi
jne 0x1007b3a
cmp dword [ebp - 0x338], edi
je 0x1007b80
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x128]
push eax
push edi
push edi
push dword [ebp - 0x348]
mov esi, 0x80004005
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007b80
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 0x1c]
push ebx
call fcn.0100597a
mov esi, eax
cmp esi, edi
jl 0x1007b80
mov esi, 0x40203
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010052d1
leave
ret 0x18
Function at 0x1008982
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x100b6c8], edi
jne 0x1008a9e
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x10089e9
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x100b6c8], edi
pop esi
je 0x1008a71
dec eax
jne 0x1008a9e
cmp dword [ebp - 0x11c], 5
jne 0x1008a5e
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x1008a52
dec eax
je 0x1008a3f
dec eax
je 0x1008a25
mov dword [0x100b6c8], 0x14
jmp 0x1008a9e
cmp word [ebp - 0xc], 1
jb 0x1008a36
mov dword [0x100b6c8], 0x10
or dword [0x100b6c8], 4
jmp 0x1008a9e
cmp word [ebp - 0xc], 2
jb 0x1008a36
mov dword [0x100b6c8], 8
jmp 0x1008a36
mov dword [0x100b6c8], 4
jmp 0x1008a9e
cmp dword [ebp - 0x11c], 4
ja 0x1008ab0
mov dword [0x100b6c8], 2
cmp dword [ebp - 0x11c], 4
jne 0x1008a9e
cmp dword [ebp - 0x118], edi
je 0x1008a94
cmp dword [ebp - 0x118], 0xa
je 0x1008a94
cmp dword [ebp - 0x118], 0x5a
jne 0x1008a9e
mov dword [0x100b6c8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x100b6c8]
xor ecx, ebp
pop edi
call fcn.010052d1
leave
ret
mov dword [0x100b6c8], 0x20
jmp 0x1008a9e

Function at 0x1008ac1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1008b15
push 3
lea eax, [ebp - 0x44]
push 0x10019f8
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.010052d1
leave
ret

Function at 0x1008b2a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x100b6cc]
jne 0x1008bc5
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x1001928
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008bc4
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x10019e0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1008bc4
push 3
push dword [esi*8 + 0x1001778]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x1008bb6
inc esi
cmp esi, 0x1c
jb 0x1008b95
jmp 0x1008bc4
mov ax, word [esi*8 + 0x100177c]
mov word [0x100b6cc], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x100b6cc]
xor ecx, ebp
call fcn.010052d1
leave
ret
Function at 0x4017f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40184b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40184b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401838
cmp esi, edx
jae 0x40184b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401826
cmp esi, edx
jae 0x40184b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411780
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x41b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str._ChromaSDKService__Service_pausing...
push 0xe9
push str.c:workspacechromasdkRC3.36CoreSDKServiceChromaSDKService.cpp
push 3
call fcn.0040ba10
push eax
call fcn.0040bed0
add esp, 0x14
mov dword [esi + 8], 3
cmp dword [esi + 0x34], 0
lea edi, [esi + 8]
je 0x4039ac
call fcn.00410150
mov eax, dword [esi + 0x34]
test eax, eax
je 0x4039a5
push 1
push eax
call fcn.004102e6
add esp, 8
mov dword [esi + 0x34], 0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403aa7
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
call fcn.00401a70
mov ecx, eax
test ecx, ecx
je 0x403b2f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0x4136c8
lea eax, [ebp - 0x220]
push str._sServices_s
push eax
call fcn.00401620
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
add esp, 0x10
mov dword [ebp - 0x21c], 0
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403a88
push 1
push edi
push 3
push eax
push str.Status
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x403aa7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [0x41c68c]
test esi, esi
je 0x403af0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x403ac6
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x403adb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
push 0x1c
push esi
call fcn.004102e6
add esp, 8
mov dword [0x41c68c], 0
push str._ChromaSDKService__Service_has_paused
push 0x118
push str.c:workspacechromasdkRC3.36CoreSDKServiceChromaSDKService.cpp
push 3
call fcn.0040ba10
push eax
call fcn.0040bed0
add esp, 0x14
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004102d8
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401b70
int3
Function at 0x403b40
Capabilities:
Create thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4117d2
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x41b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str._ChromaSDKService__Service_resuming...
push 0x11f
push str.c:workspacechromasdkRC3.36CoreSDKServiceChromaSDKService.cpp
push 3
call fcn.0040ba10
push eax
call fcn.0040bed0
add esp, 0x14
mov dword [esi + 8], 1
cmp dword [esi + 0x34], 0
lea edi, [esi + 8]
jne 0x403bde
push 1
call fcn.00410317
add esp, 4
mov dword [ebp - 0x21c], eax
mov dword [esi + 0x34], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0x40fe50
push 0
push 0
mov dword [0x41c684], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41c680], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403cd9
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
call fcn.00401a70
mov ecx, eax
test ecx, ecx
je 0x403d4b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0x4136c8
lea eax, [ebp - 0x21c]
push str._sServices_s
push eax
call fcn.00401620
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
add esp, 0x10
mov dword [ebp - 0x220], 0
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403cba
push 1
push edi
push 3
push eax
push str.Status
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x403cd9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x41c68c], 0
jne 0x403d0c
push 0x1c
call fcn.00410317
add esp, 4
mov dword [ebp - 0x21c], eax
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00402ce0
mov dword [ebp - 4], 0xffffffff
mov dword [0x41c68c], eax
push str._ChromaSDKService__Service_has_resumed
push 0x151
push str.c:workspacechromasdkRC3.36CoreSDKServiceChromaSDKService.cpp
push 3
call fcn.0040ba10
push eax
call fcn.0040bed0
add esp, 0x14
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004102d8
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401b70
int3
Function at 0x405650
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0xf023f
push 0
push str.SoftwareRazer_Chroma_SDKServicesRzSDKService.exeRzSvcHost
push 0x80000002
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405754
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push dword [esp + 0x10]
push str._d_Service_Host_modules_detected.
push 0x31c
push str.c:workspacechromasdkRC3.36CoreSDKServiceChromaSDKService.cpp
push 3
call fcn.0040ba10
push eax
call fcn.0040bed0
mov eax, dword [esp + 0x30]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00410b27
xor esi, esi
add esp, 0x1c
mov edi, eax
cmp dword [esp + 0x10], esi
jbe 0x405741
nop word [eax + eax]
mov ecx, dword [esp + 0x18]
inc ecx
push ecx
push 0
push edi
mov dword [esp + 0x28], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push 0
push 0
push 0
push 0
push eax
push edi
push esi
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40573a
push edi
mov ecx, ebx
call fcn.00404be0
inc esi
cmp esi, dword [esp + 0x10]
jb 0x405700
push edi
call fcn.00410b30
add esp, 4
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b98c
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40b9c7
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40b9ae
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40b9bf
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40b9c9
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40b9a4
xor eax, eax
pop edi
pop esi
ret

Function at 0x40bb90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebx + 0x318b0441], 1
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40bba0
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40bb91
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040b94c
rol dword [esp + ecx*8 - 0x57ba724c], 0x50
call fcn.0040b95c
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040b911
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40bc3a
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040b94c
and dword [ebx + 0x22], ebp
cmp dword [ebp - 0x17af3fbb], ecx
invalid

Function at 0x410f09
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x410f48
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410f48
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410f48
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x410f48
cmp dword [ecx + 0x74], 0xe
jbe 0x410f48
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100364d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1005274]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x10036e2
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100366b
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x10036e2
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100369c
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x10036c2
cmp cx, 0x2f
jne 0x10036c9
xor ecx, ecx
mov word [eax], cx
jmp 0x10036b1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x10036e4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010040c3
leave
ret
Function at 0x10036f5
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x1005274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1003735
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100374a
sub eax, ecx
sar eax, 1
push 0x1001d40
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x10037a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1003930
mov ecx, 0x1001d3c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10037d6
test dx, dx
je 0x10037d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10037d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10037b0
xor eax, eax
jmp 0x10037db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10038f6
mov ecx, 0x1001d34
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003814
test dx, dx
je 0x1003810
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003814
add eax, 4
add ecx, 4
test dx, dx
jne 0x10037ee
xor eax, eax
jmp 0x1003819
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10038f6
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x100385a
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.01003bb4
test eax, eax
je 0x10038f6
cmp dword [edi + 0xc], 0
je 0x10038d3
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.0100357a
test eax, eax
je 0x10038d3
test byte [ebp - 0x75c], 0x10
je 0x10038f6
lea esi, [ebp - 0x30c]
call fcn.0100364d
test eax, eax
je 0x10038f6
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.010033bf
jmp 0x10038f6
lea esi, [ebp - 0x20c]
call fcn.0100364d
test eax, eax
je 0x10038f6
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01003498
mov esi, eax
test esi, esi
jne 0x1003913
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x10037a5
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x100392e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x100392e
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010040c3
leave
ret 8