joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017c02
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x10017c3c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 0x77cd
push 0x3793
push dword [ebp - 4]
push 0x1c4
push 0x1fcc
push 1
call fcn.10017ced
add esp, 0x18
jmp 0x10017ce9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10017c93
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10017c91
push 0
push 0x1cfb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10017ce9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x4a22
push dword [ebp - 0x38]
push 0
push 0x7113
mov eax, dword [ebp - 0x3c]
push dword [eax]
mov eax, dword [ebp - 0x40]
push dword [eax]
mov eax, dword [ebp - 0x44]
push dword [eax]
call fcn.1001effc
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x1001866e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001868b
push 1
call fcn.100187e8
pop ecx
jmp 0x100187e2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100186f4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x100186d5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jge 0x100186ef
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1002b7f6
and dword [eax], 0
jmp 0x100186ca
jmp 0x100187e2
mov dword [ebp - 0x2c], 0x22cd
cmp dword [ebp - 0x2c], 0x610
jge 0x100187c9
xor eax, eax
inc eax
je 0x100187c9
lea eax, [ebp - 0x70]
push eax
push 0x10007818
call fcn.10055feb
pop ecx
pop ecx
lea eax, [ebp - 0x70]
push eax
call fcn.10055f60
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10018749
xor eax, eax
inc eax
imul eax, eax, 0
movsx eax, byte [ebp + eax - 0x70]
cmp eax, 0x30
jne 0x10018749
jmp 0x100187c9
xorpd xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
and dword [ebp - 8], 0
jmp 0x1001875f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jge 0x100187b1
mov eax, dword [ebp - 8]
movsx eax, byte [ebp + eax - 0x70]
cmp eax, 0x30
je 0x100187af
mov eax, dword [ebp - 8]
movsx eax, byte [ebp + eax - 0x70]
sub eax, 0x30
cdq
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
xor eax, eax
inc eax
xor edx, edx
call fcn.1006cc80
sub eax, 1
sbb edx, 0
push edx
push eax
push edi
push esi
call fcn.1005a000
add eax, dword [ebp - 0x34]
adc edx, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
jmp 0x10018758
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x100077a8
call fcn.10056438
add esp, 0xc
jmp 0x10018708
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100187e2
push 0x21c2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e3d6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e46a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001e41d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001e41b
push 0xb10
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x1001e468
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001e44b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1001e468
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1002b7f6
mov dword [eax], 2
jmp 0x1001e440
jmp 0x1001e4e5
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001e4d3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x1001e4b4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jge 0x1001e4d1
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1002b7f6
mov dword [eax], 9
jmp 0x1001e4a9
jmp 0x1001e4e5
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1001e4e5
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esp, ebp
pop ebp
ret
Function at 0x100225a0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10022625
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100225d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10022623
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10022623
push 0x2441
push 0x1049
push 0x20e7
push 0x1e7c
push 0x854
push 0xd46
push 0x4fe
push 0x1d24
push 0x484
push 0xb53
push 0xaa2
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x10022680
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1001ed9c
add esp, 0x28
mov esp, ebp
pop ebp
ret

Function at 0x100229b5
Capabilities:
Delete file
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10022a01
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100229e3
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100229ff
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100229ff
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x10022a15
push 0
push 0x445a
push 0x805
call fcn.1001e9d1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10022a31
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10022ab0
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10022a9a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
push 0x5f6b
push 1
push 0x6296
push 1
mov eax, dword [ebp - 0x20]
push dword [eax]
push 0x6611
call fcn.10018153
add esp, 0x1c
jmp 0x10022aae
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10022aae
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10022ab8
push 0
call fcn.1000b194
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100683c5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10073750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005a248
mov dword [ebp - 0x14], eax
cmp dword [0x1065fba0], esi
jne 0x100684b8
push 0x800
push esi
push 0x100075d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10068445
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10068598
push esi
push esi
push 0x100075d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10068598
push 0x100075f0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10068598
push eax
call ebx
push 0x100075fc
push edi
mov dword [0x1065fba0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000760c
push edi
mov dword [0x1065fba4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007620
push edi
mov dword [0x1065fba8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065fbb0], eax
test eax, eax
je 0x100684b5
push 0x1000763c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065fbac], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100684dd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100684d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100684f2
push 4
pop eax
jmp 0x1006859a
cmp dword [ebp - 0x14], esi
je 0x100684f2
push dword [0x1065fba0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100684d7
mov eax, dword [0x1065fbac]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10068550
cmp dword [0x1065fbb0], edi
je 0x10068550
push eax
call ebx
push dword [0x1065fbb0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10068550
test eax, eax
je 0x10068550
call ecx
test eax, eax
je 0x10068545
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10068545
test byte [ebp - 8], 1
jne 0x10068550
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10068580
mov eax, dword [0x1065fba4]
cmp eax, edi
je 0x1006857d
push eax
call ebx
test eax, eax
je 0x1006857d
call eax
mov esi, eax
test esi, esi
je 0x1006857d
mov eax, dword [0x1065fba8]
cmp eax, edi
je 0x1006857d
push eax
call ebx
test eax, eax
je 0x1006857d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065fba0]
call ebx
test eax, eax
je 0x10068598
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006859a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005794b
mov esp, ebp
pop ebp
ret
Function at 0x1005f44e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1005f45d
pop dword [ebp - 0x2c]
mov eax, 0x5150ca1d
add eax, 0xbeb52a40
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x46ab3
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xbb0d1e5f
add ecx, 0x44f33b4b
mov ebx, eax
mov edi, 0x492653fd
sub edi, 0x390df7fd
add edi, dword [ebp - 0x2c]
mov edx, 0xe06c5de4
xor dword [ebp - 0x20], 0xc384d37e
mov esi, dword [edi]
add dword [ebp - 0x18], eax
add esi, edx
mov dword [ebp - 8], 0x9f3e1cd2
mov dword [ebx], esi
add dword [ebp - 0x28], 0x3cf185d2
add ebx, 0xf02e6f30
add ebx, 0xfd190d4
add edi, 4
loop 0x1005f4b1
add eax, 0x1c33c9a0
add eax, 0xe3cd8fdb
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x100696fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x10069780
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1006974a
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006974a
cmp edi, ebx
jge 0x1006974a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006977a
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006977a
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x10069792
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x10069a28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x1016c088], al
je 0x10069a5f
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10069ac3
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvDX9.x3d_public:_bool___stdcall_MATRIX3D::Decompose_struct__point3d___struct__point3d___struct__point3d___struct__point3d___struct__point4d__const
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvDX9.x3d_public:_bool___stdcall_MATRIX3D::Decompose_struct__point3d___struct__point3d___struct__point3d___struct__point3d___struct__point4d__const
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call sym.drvDX9.x3d_public:_bool___stdcall_MATRIX3D::Decompose_struct__point3d___struct__point3d___struct__point3d___struct__point3d___struct__point4d__const
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e864
leave
ret 0x10

Function at 0x10069ad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10069b00
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10069b31
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10069b2f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvDX9.x3d_public:_bool___stdcall_MATRIX3D::Decompose_struct__point3d___struct__point3d___struct__point3d___struct__point3d___struct__point4d__const
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10069b31
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006e864
leave
ret 8

Function at 0x10069bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
mov eax, dword [ebp + 8]
je 0x10069bf4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10069c0e
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvDX9.x3d_public:_bool___stdcall_MATRIX3D::Decompose_struct__point3d___struct__point3d___struct__point3d___struct__point3d___struct__point4d__const
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1006e864
leave
ret 4

Function at 0x1006e864
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b1980]
jne 0x1006e86e
repz ret
jmp fcn.1006ef63
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40611c
pop dword [ebp - 0x20]
mov eax, 0xc65b3cd6
sub eax, 0xc61adbba
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x626f0d44
add dword [ebp - 0x30], 0xebe33807
mov dword [ebp - 0x2c], 0x5146281c
sub dword [ebp - 0x2c], 0x1f12dbd7
mov dword [ebp - 0x28], 0x335eb8b3
sub dword [ebp - 0x28], 0xe7127485
mov dword [ebp - 0x24], 0xe152aa9
sub dword [ebp - 0x24], 0xe152aa9
lea eax, [ebp - 0x30]
push eax
mov eax, 0xb6f83216
sub eax, 0xb6b7c1b6
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x8079b64c
add dword [ebp - 0x30], 0xf3f8b30a
mov dword [ebp - 0x2c], 0x78c9c6ec
sub dword [ebp - 0x2c], 0x375d6577
mov dword [ebp - 0x28], 0xfba9db4b
add dword [ebp - 0x28], 0x67c59121
mov dword [ebp - 0x24], 0x5a13b08a
add dword [ebp - 0x24], 0xa5ec4f76
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xf9a78ca3
add eax, 0x698e45d
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3581b
push 0
call eax
mov ecx, 0x4398
xor edx, edx
add edx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x20]
mov ebx, 0x8ad6d4b3
add ebx, 0x7f8571c0
xor dword [ebp - 0x1c], esi
mov edi, dword [esi]
add edi, ebx
add dword [ebp - 0x18], 0x324e9108
mov dword [edx], edi
add dword [ebp - 0x1c], ebx
add edx, 4
add esi, 0x654e1b4
sub esi, 0x654e1b0
loop 0x406234
add eax, 0x82dec398
sub eax, 0x82ddc265
mov ebx, eax
add eax, 0x3765e09c
sub eax, 0x3765e097
mov ecx, 0xe3051e2d
sub ecx, 0xe2c51e2d
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1001899b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100189aa
pop dword [ebp - 0x30]
mov eax, 0x13afb73b
add eax, 0xfc51d26f
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3f0d0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xedadf3b7
sub ecx, 0xedadb130
mov esi, eax
mov edx, 0x1003be00
add edx, dword [ebp - 0x30]
mov ebx, 0xb1d59125
mov dword [ebp - 0x24], 0x1221ac04
mov edi, dword [edx]
add dword [ebp - 0x18], ebx
add edi, ebx
mov dword [esi], edi
xor dword [ebp - 8], 0x352ec43d
add esi, 0xf0f23116
add esi, 0xf0dceee
add edx, 0xa5b2aaf5
add edx, 0x5a4d550f
loop 0x100189f8
add eax, 0x7e79e492
add eax, 0x8187185d
xor ebx, ebx
add ebx, eax
add eax, 0xb5bf9a1a
add eax, 0x4a4065eb
mov ecx, 0xb1c1f712
add ecx, 0x5e3e08ee
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001899b
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001899b
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x401680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, 1
test esi, esi
jne 0x40169d
pop esi
lea eax, [ebx + 0x50]
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x4016ee
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
push 1
push 0
push ecx
push edx
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4016ee
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4016e4
xor ebx, ebx
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, 1
test esi, esi
jne 0x40171b
lea eax, [edi + 0x50]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
jbe 0x401767
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x14]
push ecx
xor eax, eax
push 1
push eax
mov word [esi], ax
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401767
lea ecx, [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push esi
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40175d
xor edi, edi
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, 1
test esi, esi
jne 0x40178d
lea eax, [edi + 0x50]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
push 1
push 0
push ecx
push edx
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4017dd
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push eax
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4017d3
xor edi, edi
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret