joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046356
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100735e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100463a2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x75f9
push 0x3c04
push 1
push dword [ebp - 0x24]
call fcn.100464e0
add esp, 0x10
jmp 0x100464cf
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xdcd
mov dword [ebp - 0x2c], 0x10009148
cmp dword [ebp - 0x20], 0x1002
jle 0x1004642c
and dword [ebp - 0x18], 0
jmp 0x100463d2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x535e
jge 0x1004642c
and dword [ebp - 0x1c], 0
jmp 0x100463e8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1e2c
jge 0x1004642a
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.1000b06a
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1000f793
push eax
call fcn.100598a3
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1000f789
jmp 0x100463e1
jmp 0x100463cb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xcde
jge 0x10046448
push dword [ebp - 0x2c]
call fcn.100598a3
pop ecx
jmp 0x10046464
or dword [ebp - 4], 0xffffffff
jmp 0x1004646e
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100464c5
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x100464a6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x100464c3
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1000fa89
mov dword [eax], 0xc01d4c3f
jmp 0x1004649b
jmp 0x100464cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047fb0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10048014
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10047ff4
mov byte [ebp - 1], 0
push 0x7220
push 0x5761
push 1
lea eax, [ebp - 1]
push eax
push 1
call fcn.10043589
add esp, 0x14
jmp 0x10048012
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10048012
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10048030
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
call fcn.10038769
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1004f3bb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1004f41a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1004f403
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004f401
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1004f418
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xfffffffa
jmp 0x1004f43f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 1
push dword [ebp - 0x28]
call fcn.10039f40
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1004f560
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004f5d0
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1004f592
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1004f5ce
push 0
push 0x841
push 0x20c0
push 0
push 0x6fb
push 0x67d
push 0x4e1
push 0x2cb
push 0x17a1
push 0xbd2
push 0x1b75
push 0x1889
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1004f5f1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0xe78
call fcn.10050cf6
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10050564
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100505b6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10050590
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x100505b4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100505b4
push 0
push 0x5d
push 1
call fcn.100504ce
add esp, 0xc
jmp 0x100505fe
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100505e0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100505de
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x100505fe
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100505fe
push 0
call fcn.10045fde
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10050738
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x100507ef
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100507d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jle 0x100507ab
mov dword [ebp - 0x10], 1
jmp 0x100507af
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
jge 0x100507c2
mov dword [ebp - 0x14], 1
jmp 0x100507c6
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x100507ed
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100507ed
push 1
push 0
push 0x4062
call fcn.100436ce
add esp, 0xc
jmp 0x10050858
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10050831
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1005082f
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10050858
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x10050b76
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10050c01
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10050bed
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10050bce
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x10050beb
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000fa89
mov dword [eax], 0x80997408
jmp 0x10050bc3
jmp 0x10050bff
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10050bff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10050c1e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push 0x2cdd
push dword [ebp - 0x24]
push 1
push 0x58cf
call fcn.1003bd0c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1005399e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100726d7
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x10053ac2
cmp byte [ebx + 0x45], 0
je 0x10053ac2
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x100539e8
xor al, al
jmp 0x10053ac4
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.100117b9
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10053a4d
dec eax
je 0x10053a51
dec eax
dec eax
je 0x10053aaf
xor bl, bl
jmp 0x10053ab1
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x10053a90
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1005ae2d
add esp, 0x10
cmp esi, eax
jne 0x10053a49
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x10053aaf
test esi, esi
jne 0x10053a13
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.1001f9b7
jmp 0x10053a0b
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000ff15
mov al, bl
jmp 0x10053ac4
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006e6b5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10078740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005db28
mov dword [ebp - 0x14], eax
cmp dword [0x1061b7d0], esi
jne 0x1006e7a8
push 0x800
push esi
push 0x1000769c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006e735
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006e888
push esi
push esi
push 0x1000769c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006e888
push 0x100076b4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006e888
push eax
call ebx
push 0x100076c0
push edi
mov dword [0x1061b7d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076d0
push edi
mov dword [0x1061b7d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076e4
push edi
mov dword [0x1061b7d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061b7e0], eax
test eax, eax
je 0x1006e7a5
push 0x10007700
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061b7dc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006e7cd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006e7c0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006e7e2
push 4
pop eax
jmp 0x1006e88a
cmp dword [ebp - 0x14], esi
je 0x1006e7e2
push dword [0x1061b7d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006e7c7
mov eax, dword [0x1061b7dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006e840
cmp dword [0x1061b7e0], edi
je 0x1006e840
push eax
call ebx
push dword [0x1061b7e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006e840
test eax, eax
je 0x1006e840
call ecx
test eax, eax
je 0x1006e835
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006e835
test byte [ebp - 8], 1
jne 0x1006e840
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006e870
mov eax, dword [0x1061b7d4]
cmp eax, edi
je 0x1006e86d
push eax
call ebx
test eax, eax
je 0x1006e86d
call eax
mov esi, eax
test esi, esi
je 0x1006e86d
mov eax, dword [0x1061b7d8]
cmp eax, edi
je 0x1006e86d
push eax
call ebx
test eax, eax
je 0x1006e86d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1061b7d0]
call ebx
test eax, eax
je 0x1006e888
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006e88a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b781
mov esp, ebp
pop ebp
ret
Function at 0x10007910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push dword [eax - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret 4

Function at 0x10008760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x100088e4
cmp esi, 0x40
jb 0x100088cd
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x10008807
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x100088cd
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x10008820
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x100088cd
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x10008830
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x10008860
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x100088e4
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x100088d1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x1000b750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c5b14
mov dword [ebp - 0x20], 0x65004e
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x420074
mov dword [ebp - 0x18], 0x690072
mov edx, 0xf
mov dword [ebp - 0x14], 0x670064
sub esi, eax
mov dword [ebp - 0x10], 0x2e0065
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x1000b7bf
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000b7bf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000b7a1
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c5b14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x1000c720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000c779
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000c779
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000c76a
cmp esi, edx
jae 0x1000c779
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000c758
cmp esi, edx
jae 0x1000c779
cmp word [esi], 0
je 0x1000c779
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000d160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x1000d176
mov eax, 1
pop esi
pop ebp
ret 4
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000d1c0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000d1c0
push 1
push edi
call fcn.100440d0
add esp, 8
test eax, eax
je 0x1000d1c0
push edi
lea ecx, [esi + 0xc]
call fcn.1005e160
test eax, eax
je 0x1000d1b7
pop edi
mov dword [esi + 4], 1
mov eax, 1
pop esi
pop ebp
ret 4
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x1000e230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c5d34
mov dword [ebp - 0x20], 0x4e002f
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x53004f
push edi
mov dword [ebp - 0x18], 0x540045
mov edx, 0xf
mov dword [ebp - 0x14], 0x550041
sub esi, eax
mov dword [ebp - 0x10], 0x4f0054
mov dword [ebp - 0xc], 0x550052
mov dword [ebp - 8], 0x4e
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x1000e2a0
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000e2a0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000e282
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x101c5d34
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x1000e350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x4e002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x101c5ce0
mov dword [ebp - 0x20], 0x51004f
mov dword [ebp - 0x1c], 0x490055
mov edx, 0x10
mov dword [ebp - 0x18], 0x4b0043
sub esi, eax
mov dword [ebp - 0x14], 0x41004c
mov dword [ebp - 0x10], 0x4e0055
mov dword [ebp - 0xc], 0x480043
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x1000e3ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000e3ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000e3b0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c5ce0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x1000e3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x4e002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x101c5bc0
mov dword [ebp - 0x1c], 0x50004f
mov dword [ebp - 0x18], 0x4f0052
mov edx, 0xe
mov dword [ebp - 0x14], 0x4f004d
sub esi, eax
mov dword [ebp - 0x10], 0x490054
mov dword [ebp - 0xc], 0x4e004f
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x1000e45e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000e45e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000e440
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c5bc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x1000e480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x55002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x101c5c24
mov dword [ebp - 0x18], 0x49004e
mov dword [ebp - 0x14], 0x53004e
mov edx, 0xc
mov dword [ebp - 0x10], 0x410054
sub esi, eax
mov dword [ebp - 0xc], 0x4c004c
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x1000e4ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000e4ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000e4d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c5c24
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret