joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c3f0
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0x60
mov word [ebx], 0
jl 0x43c443
cmp edi, 0x69
jg 0x43c443
push esi
push 1
push 0x40
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 8
mov esi, eax
mov eax, dword [0x4539d8]
push 0x3f
push esi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [edi - 0x60]
push ecx
push esi
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x10
pop esi
jmp 0x43c490
cmp edi, 0x70
jl 0x43c465
cmp edi, 0x87
jg 0x43c465
lea edx, [edi - 0x6f]
push edx
push 0x453300
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x43c490
xor eax, eax
cmp dword [eax*8 + str._bf_tg_fh_ri], edi
je 0x43c478
inc eax
cmp eax, 0x14
jl 0x43c467
jmp 0x43c490
mov eax, dword [eax*8 + 0x453264]
mov ecx, dword [0x4539d8]
push 0x3f
push ebx
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
cmp byte [ebx], 0
jne 0x43c4a0
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [ebx], al
pop edi
pop ebx
ret

Function at 0x43c6b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push 0
push 0x78
push edi
call ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
push 0
push 0x79
push edi
call ebx
push eax
call ebp
xor esi, esi
mov eax, dword [esp + 0x18]
movsx ecx, word [eax + 0x12]
cmp esi, ecx
jne 0x43c6f1
push esi
push eax
push edi
call fcn.0043c660
add esp, 0xc
lea edx, [esi + 0x6e]
push 1
push edx
push edi
call ebx
push eax
call ebp
inc esi
cmp esi, 8
jl 0x43c6da
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x441780
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 0x1f6]
lea ecx, [esp + 0x14]
push ebx
push ecx
test eax, eax
lea edx, [esp + 0x18]
push 1
setne al
push edx
push edi
mov byte [esp + 0x24], al
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4417ec
mov al, byte [esp + 0x10]
test al, al
je 0x4417e1
mov eax, dword [esi + 0x1f6]
push eax
call fcn.00402630
push edi
mov esi, eax
call fcn.00434530
push esi
mov edi, eax
call fcn.00402630
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x441800
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push edi
xor edi, edi
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x13]
push 1
push ecx
push ebx
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x441894
mov al, byte [esp + 0xb]
push esi
test al, al
je 0x44188e
mov esi, dword [esp + 0x18]
mov edx, dword [esi + 0x1fe]
mov eax, dword [esi + 0x44]
push edx
push edi
push eax
push esi
call fcn.00440f40
mov eax, dword [esi + 0x1f6]
add esp, 0x10
test eax, eax
je 0x441893
push ebp
push eax
call fcn.00402630
mov ecx, dword [esi + 0x1f6]
push edi
push ecx
mov ebp, eax
call fcn.00404f70
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], edi
push edx
push ebx
call fcn.00435cb0
push ebp
mov edi, eax
call fcn.00402630
add esp, 0x18
mov eax, edi
pop ebp
pop esi
pop edi
pop ebx
add esp, 8
ret
mov edi, 1
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 8
ret
Function at 0x4439b0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
push ebp
mov dword [eax], ebx
mov ecx, dword [0x453a14]
push esi
mov esi, dword [esp + 0x14]
mov ebp, dword [ecx + 0x90]
mov edx, dword [ecx + 0x11c]
and esi, 0x7fff
mov dword [esp + 0xc], ebx
add esi, ebp
mov dword [esp + 0x14], edx
mov ax, word [esi + 0x18]
cmp ax, bx
jl 0x443ad8
push edi
jmp 0x4439f6
mov edx, dword [esp + 0x18]
movsx eax, ax
lea edi, [eax*8]
sub edi, eax
lea edi, [eax + edi*4]
lea eax, [eax + edi*2]
mov edi, dword [ecx + 0x58]
lea eax, [edi + eax*2]
cmp dword [eax + 0x28], edx
jne 0x443a38
xor edi, edi
cmp word [eax + 2], bx
jl 0x443abd
mov edi, dword [eax + 0x2c]
mov eax, dword [ecx + 0x120]
cmp eax, ebx
jne 0x443abd
mov dword [ecx + 0x120], esi
jmp 0x443ab7
mov dword [eax + 0x28], edx
mov ecx, dword [0x453a14]
xor edi, edi
cmp word [ecx + 0x418], bx
je 0x443a57
mov word [eax + 2], 0xffff
mov dword [eax + 0x2c], ebx
jmp 0x443ab7
mov cx, word [eax + 6]
cmp cx, bx
mov word [eax + 2], cx
jge 0x443a69
mov dword [eax + 0x2c], ebx
jmp 0x443ab7
mov ecx, dword [0x453a14]
cmp dword [ecx + 0x120], ebx
jne 0x443a83
mov dword [ecx + 0x120], esi
mov ecx, dword [0x453a14]
mov dx, word [eax + 6]
jmp 0x443a8f
mov ecx, dword [0x453a14]
mov ebp, dword [ecx + 0x1278]
movsx edx, dx
mov edx, dword [ebp + edx*8]
cmp edx, ebx
je 0x443abd
mov cx, word [edx + 0x16]
mov word [edx + 2], cx
mov edx, ecx
cmp dx, bx
jge 0x443a89
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x2c], ecx
mov edi, ecx
mov ecx, dword [0x453a14]
mov ebp, dword [esp + 0x10]
mov ax, word [esi + 0x1c]
add esi, 4
add ebp, edi
cmp ax, bx
mov dword [esp + 0x10], ebp
jge 0x4439f2
pop edi
mov eax, dword [ecx + 0x120]
cmp eax, ebx
je 0x443b2d
movsx eax, word [eax + 0x18]
lea edx, [eax*8]
sub edx, eax
lea edx, [eax + edx*4]
lea eax, [eax + edx*2]
mov edx, dword [ecx + 0x58]
lea eax, [edx + eax*2]
mov dword [ecx + 0x12c], eax
mov ecx, dword [0x453a14]
movsx eax, word [eax + 2]
mov edx, dword [ecx + 0x1278]
mov eax, dword [edx + eax*8]
cmp eax, ebx
je 0x443b2d
mov edx, dword [esp + 0x18]
mov dword [ecx + 0x124], eax
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
mov dword [edx], ecx
pop ebx
pop ecx
ret
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10003a42
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10003a8f
cmp byte [esi + 0x3d], bl
je 0x10003a8f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003abe
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x10003a96
sub eax, 1
je 0x10003a99
dec eax
sub eax, 1
jne 0x10003abe
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003ab6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10064867
add esp, 0x10
cmp edi, eax
jne 0x10003abe
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10003a91
xor al, al
jmp 0x10003a91

Function at 0x1000693f
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10006959
xor eax, eax
jmp 0x10006a29
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x10006987
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x10006987
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10006a28
cmp dword [esi + 0x4c], 0
je 0x10006a26
mov ecx, esi
call fcn.10003fb9
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100069b3
push dword [esi + 0x4c]
push eax
call fcn.10001d18
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10006a26
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x100069f7
sub eax, 1
je 0x100069f7
dec eax
sub eax, 1
jne 0x10006a26
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x100069a5
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x10006a16
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.10064867
add esp, 0x10
cmp ebp, eax
jne 0x10006a26
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x10006a28
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x100075fb
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x1000761b
jl 0x10007612
test edi, edi
jne 0x1000761b
xor eax, eax
xor edx, edx
jmp 0x100076e2
cmp dword [ebp + 0x38], 0
je 0x10007631
push esi
push edi
push dword [esp + 0x18]
call fcn.100076ec
jmp 0x100076e2
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10007675
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x10007675
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.1005f770
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x1000767d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x100076d8
mov ecx, ebp
call fcn.10003fb9
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x100076b8
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.100641e0
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x100076e8
mov eax, 0xfff
cmp ebx, eax
ja 0x10007694
test ecx, ecx
je 0x100076d8
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.100641e0
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x100076da

Function at 0x100077c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100077e1
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.10007896
jmp 0x10007890
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10007804
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10007806
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10007881
jg 0x10007819
test esi, esi
je 0x10007881
test eax, eax
jl 0x10007863
jg 0x10007823
test ebp, ebp
je 0x10007863
cmp edi, eax
jg 0x10007833
jl 0x1000782d
cmp esi, ebp
jae 0x10007833
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.1005f770
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x10007881
jg 0x10007867
test esi, esi
je 0x10007881
jmp 0x10007867
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x10007881
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.10064867
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x10010209
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1008271a
call fcn.1005d694
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.1000f8ff
pop ecx
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov ebx, dword [edi]
test ebx, ebx
je 0x10010309
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x100102b5
mov eax, edi
mov dword [ebp - 0x1c], 0x78
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.1000fb05
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x100102a4
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.100040ab
jmp 0x100102f6
mov ecx, dword [0x100e7cbc]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x100102f6
test dword [esi + 0x1c], 0x2400
jne 0x100102f6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f916
mov eax, dword [ebx + 4]
mov ebx, eax
test eax, eax
jne 0x10010261
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp edi, 0xb992b8
jl 0x10010254
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x1001037f
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x100e7cbc]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x10010375
test dword [ebx + 0x1c], 0x2400
jne 0x10010375
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f916
mov esi, dword [esi + 4]
test esi, esi
jne 0x10010330
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x10010327
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x100103c4
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.1000df4e
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x10010399
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.1000f9a8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x100181a6
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x100823b2
call fcn.1005d694
sub esp, 0x20
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x100182dc
push 0x10089874
push dword [ebp + 8]
call fcn.1006c366
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100182dc
push 0xc
call fcn.1005d445
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x100181f7
mov ecx, eax
call fcn.1000b3b1
mov esi, eax
jmp 0x100181f9
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x2c]
push 8
pop ecx
push ebx
xor eax, eax
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.100641e0
add esp, 0x10
cmp byte [ebp - 0x2c], 0x43
jne 0x100182c0
cmp byte [ebp - 0x2b], 0x4f
jne 0x100182c0
cmp byte [ebp - 0x2a], 0x4c
jne 0x100182c0
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
call fcn.1005d43c
mov ecx, dword [ebp - 0x28]
mov edi, eax
push ebx
push 1
add ecx, 0xffffffe8
push ecx
push edi
call fcn.100641e0
mov al, byte [ebp - 0x29]
add esp, 0x14
cmp al, 0x4c
jne 0x10018273
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
push edi
call dword [0x100b4178]
add esp, 0xc
jmp 0x100182ae
cmp al, 0x32
jne 0x10018290
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b417c]
jmp 0x100182ab
cmp al, 0x33
jne 0x100182ae
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b4180]
add esp, 0x10
push edi
call fcn.1005d483
push ebx
call fcn.10063951
pop ecx
pop ecx
mov eax, esi
jmp 0x100182de
test esi, esi
je 0x100182d5
mov ecx, esi
call fcn.1000b3e3
push 0xc
push esi
call fcn.1005d475
pop ecx
pop ecx
push ebx
call fcn.10063951
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100299a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x1016890c]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101378a0]
push ebp
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x10029ac6
mov ebp, dword [esp + 0x38]
xor edi, edi
and dword [esp + 0x10], 0
inc edi
and dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
test ecx, ecx
je 0x10029abc
mov esi, dword [0x1013789c]
xor edx, edx
mov eax, ebx
mov dword [esp + 0x3c], 1
div esi
sub esi, edx
cmp ecx, esi
cmovle esi, ecx
test ebx, ebx
je 0x10029a49
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10029a49
cmp dword [esp + 0x28], 0x1000
jne 0x10029a49
test byte [esp + 0x2c], 0xee
je 0x10029a49
mov ecx, dword [esp + 0x24]
cmp esi, ecx
ja 0x10029a49
mov eax, ebx
sub ecx, esi
sub eax, dword [esp + 0x18]
cmp eax, ecx
jbe 0x10029a70
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029a68
xor edi, edi
push esi
push edi
push ebp
call fcn.1005fcf0
jmp 0x10029a7c
mov dword [esp + 0x38], 1
push esi
push ebx
push ebp
call fcn.1005f770
mov edi, dword [esp + 0x48]
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x10029aa8
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029aa8
push ebx
push str.__page_read___could_not_restore_original_permissions_for_ptr__p
call fcn.1005c084
pop ecx
pop ecx
mov ecx, dword [esp + 0x40]
add ebp, esi
add ebx, esi
sub ecx, esi
mov dword [esp + 0x40], ecx
jne 0x100299e8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov esi, 0x101378a0
push esi
call fcn.1005d5bb
cmp dword [0x101378a0], 0xffffffff
pop ecx
jne 0x100299c7
call fcn.10029af5
push esi
mov dword [0x1013789c], eax
call fcn.1005d571
pop ecx
jmp 0x100299c7

Function at 0x10029af5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100e15b0]
sub esp, 0x24
cmp eax, 0xffffffff
jne 0x10029b17
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x100e15b0], eax
leave
ret
Function at 0x10029b19
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x1016890c]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10137898]
push ebp
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x10029c30
mov ebx, dword [esp + 0x38]
xor edi, edi
and dword [esp + 0x10], 0
inc edi
and dword [esp + 0x38], 0
mov ebp, dword [esp + 0x40]
test ebp, ebp
je 0x10029c26
mov esi, dword [0x10137894]
xor edx, edx
mov eax, ebx
mov dword [esp + 0x40], 1
div esi
sub esi, edx
cmp ebp, esi
cmovle esi, ebp
test ebx, ebx
je 0x10029bbe
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10029bbe
cmp dword [esp + 0x28], 0x1000
jne 0x10029bbe
test byte [esp + 0x2c], 0xcc
je 0x10029bbe
mov ecx, dword [esp + 0x24]
cmp esi, ecx
ja 0x10029bbe
mov eax, ebx
sub ecx, esi
sub eax, dword [esp + 0x18]
cmp eax, ecx
jbe 0x10029bdd
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029bd5
xor edi, edi
jmp 0x10029bef
mov dword [esp + 0x38], 1
push esi
push dword [esp + 0x40]
push ebx
call fcn.1005f770
mov edi, dword [esp + 0x4c]
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x10029c18
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029c18
push ebx
push str.__page_write___could_not_restore_original_permissions_for_ptr__p
call fcn.1005c084
pop ecx
pop ecx
add dword [esp + 0x3c], esi
add ebx, esi
sub ebp, esi
jne 0x10029b5d
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov esi, 0x10137898
push esi
call fcn.1005d5bb
cmp dword [0x10137898], 0xffffffff
pop ecx
jne 0x10029b40
call fcn.10029af5
push esi
mov dword [0x10137894], eax
call fcn.1005d571
pop ecx
jmp 0x10029b40
Function at 0x1003f041
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
mov cl, byte [edx]
test cl, cl
je 0x1003f07d
cmp byte [edx + 1], 0
jne 0x1003f06d
cmp cl, 0x61
jl 0x1003f062
cmp cl, 0x7a
jg 0x1003f062
movsx eax, cl
sub eax, 0x20
ret
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x1003f06d
movsx eax, cl
ret
cmp cl, 0x26
jne 0x1003f07d
lea eax, [edx + 1]
push eax
call fcn.1003f0db
pop ecx
ret
mov eax, dword [0x100e40bc]
xor ecx, ecx
push ebx
push esi
jmp 0x1003f0bb
mov esi, edx
mov bl, byte [eax]
cmp bl, byte [esi]
jne 0x1003f0aa
test bl, bl
je 0x1003f0a6
mov bl, byte [eax + 1]
cmp bl, byte [esi + 1]
jne 0x1003f0aa
add eax, 2
add esi, 2
test bl, bl
jne 0x1003f08a
xor eax, eax
jmp 0x1003f0af
sbb eax, eax
or eax, 1
test eax, eax
je 0x1003f0d2
mov eax, dword [ecx*8 + 0x100e40c4]
inc ecx
test eax, eax
jne 0x1003f088
push edx
push str.Unknown_key:__s
call fcn.1005c084
pop ecx
pop ecx
or eax, 0xffffffff
pop esi
pop ebx
ret
mov eax, dword [ecx*8 + 0x100e40b8]
jmp 0x1003f0cf

Function at 0x1003f997
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
sub ecx, eax
push 3
pop edx
movss xmm0, dword [ecx + eax]
xorps xmm0, xmmword [0x1008b8a0]
movss dword [eax], xmm0
lea eax, [eax + 4]
sub edx, 1
jne 0x1003f9a4
ret