joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4083c2
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esi
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x2c]
mov ebp, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x408446
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x490698]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40843e
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40842f
cmp dword [esp + 0x18], ebx
jne 0x40842f
push ebx
push edi
push dword [esp + 0x1c]
call fcn.00408460
mov ebp, eax
push edi
push 0
push dword [0x490698]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x409e20
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x409e52
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409e4d
cmp dword [esp + 0xc], esi
je 0x409e69
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x40c38b
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40c4d3
xor ecx, ecx
cmp word [eax], cx
je 0x40c4d3
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x40c3e4
cmp eax, 3
jne 0x40c41e
cmp word [esp + 0xa], 0x3a
jne 0x40c41e
cmp eax, 2
jne 0x40c402
lea eax, [esp + 8]
push 0x429350
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40c4d3
push 0xfffffffffffffffe
pop edi
jmp 0x40c4d3
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40c433
cmp ax, bx
jne 0x40c43d
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x40c426
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x40c47c
test byte [esp + 0x21c], 0x10
je 0x40c463
push 0xfffffffffffffffe
pop edi
jmp 0x40c473
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40c4d1
cmp word [esp + 0x10], bp
jne 0x40c48a
cmp word [esp + 0x12], bp
je 0x40c4a9
cmp word [esp + 0x10], bx
jne 0x40c498
cmp word [esp + 0x12], bx
je 0x40c4a9
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x40c4d1
cmp word [esp + 0x12], ax
jne 0x40c4d1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x40c4be
test al, 0x10
je 0x40c4d1
jmp 0x40c4ce
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40c4d1
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x40e730
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x40e75f
push esi
call fcn.0040e910
add esp, 4
cmp byte [esi + 0x40], 0
je 0x40e758
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x40e7e2
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x40e7cd
mov eax, dword [esi + 8]
test eax, eax
je 0x40e785
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x40e7c8
cmp eax, 2
je 0x40e7cd
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40e776
cmp eax, 3
je 0x40e7ad
cmp eax, 1
jne 0x40e776
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x40e776
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x40e776
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0040e810
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x40e804
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0040e810
add esp, 4
pop edi
pop esi
ret

Function at 0x40e810
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x40e83c
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x40e8c2
lea ebx, [esi + 0x78]
jmp 0x40e850
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x40e896
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40e875
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x40e8d8
cmp eax, dword [esi + 0x60]
jb 0x40e857
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x40e850
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x40fa50
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.0041bc70
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.0041bc40
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40fa97
push edi
call fcn.0041bc80
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.0040f6e0
mov dword [esi + 4], fcn.0040f570
mov dword [esi + 8], fcn.0040f640
mov dword [esi + 0xc], fcn.0040f4c0
mov dword [esi + 0x10], 0x40fdb0
mov dword [esi + 0x14], 0x40fd40
mov dword [esi + 0x18], 0x40fba0
mov dword [esi + 0x1c], 0x40f370
mov dword [esi + 0x20], 0x40f220
mov dword [esi + 0x24], 0x40f950
mov dword [esi + 0x28], 0x40fe20
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x40fb7a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x40fb7a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x40fb69
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x40fb71
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x413340
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x413365
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x41336b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x413480
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x4133bd
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x413416
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x413400
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x4133e0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x413461
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x413440
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x413440
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x4133a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100012fa
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x10017354], 0
jne 0x1000132a
push 0x10012fd8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10001323
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10017358], eax
mov byte [0x10017354], 1
mov eax, dword [0x10017358]
test eax, eax
je 0x10001342
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x1000134e
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4

Function at 0x100013a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x100013b4
push 0xd
pop eax
jmp 0x100013e7
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x100013bb
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100013eb
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 4]
push dword [esi]
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.10001368
mov ebx, eax
cmp ebx, edi
je 0x1000142e
cmp dword [ebp - 0xc], edi
je 0x1000142a
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000149b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1000144c
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xc]
call fcn.100013eb
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x100014a2
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x100
call ebx
test eax, eax
je 0x10001436
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
je 0x10001482
push dword [ebp - 0xc]
call ebx
mov dword [ebp - 0xc], edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
call fcn.100012fa
mov esi, eax
cmp dword [ebp - 0xc], edi
je 0x10001499
push dword [ebp - 0xc]
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 0xc], edi
je 0x100014b0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x1000149b
Function at 0x100017ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
push edi
xor edi, edi
push 2
push edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0x40c], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
jne 0x10001806
call fcn.10001150
mov esi, eax
jmp 0x100018e3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x10001823
call fcn.10001150
jmp 0x100018da
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x10001819
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x10001866
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x1000185c
lea eax, [ebp - 0x40c]
call fcn.10003680
mov eax, 0x8007000e
jmp 0x100018fe
push 2
push eax
call fcn.10003c8a
pop ecx
pop ecx
cmp eax, 0x400
jbe 0x10001886
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.10003a43
jmp 0x10001892
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], edi
jne 0x100018a1
mov esi, 0x8007000e
jmp 0x100018dc
push esi
push dword [ebp - 0x40c]
push esi
push dword [ebp + 8]
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x10001819
mov edx, dword [ebp - 0x40c]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x40c]
lea ecx, [ebp - 8]
call fcn.10002161
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x100018fc
lea eax, [ebp - 0x40c]
call fcn.10003680
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1000973d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10015b00]
jne 0x10009747
repz ret
jmp fcn.1000b97a

Function at 0x10009cf0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10007422
and dword [ebp - 4], 0
cmp dword [0x10016ef4], 0
mov ebx, eax
jne 0x10009da1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10009e52
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10009e52
push eax
call fcn.100073b0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10016ef4], eax
call esi
push eax
call fcn.100073b0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10016ef8], eax
call esi
push eax
call fcn.100073b0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10016efc], eax
call esi
push eax
call fcn.100073b0
pop ecx
mov dword [0x10016f04], eax
test eax, eax
je 0x10009da1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100073b0
pop ecx
mov dword [0x10016f00], eax
mov eax, dword [0x10016f00]
cmp eax, ebx
je 0x10009df9
cmp dword [0x10016f04], ebx
je 0x10009df9
push eax
call fcn.1000742b
push dword [0x10016f04]
mov esi, eax
call fcn.1000742b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10009df9
test edi, edi
je 0x10009df9
call esi
test eax, eax
je 0x10009df0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10009df0
test byte [ebp - 0xc], 1
jne 0x10009df9
or dword [ebp + 0x10], 0x200000
jmp 0x10009e32
mov eax, dword [0x10016ef8]
cmp eax, ebx
je 0x10009e32
push eax
call fcn.1000742b
pop ecx
test eax, eax
je 0x10009e32
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10009e32
mov eax, dword [0x10016efc]
cmp eax, ebx
je 0x10009e32
push eax
call fcn.1000742b
pop ecx
test eax, eax
je 0x10009e32
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10016ef4]
call fcn.1000742b
pop ecx
test eax, eax
je 0x10009e52
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10009e54
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001080
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor eax, eax
xor edx, edx
xor esi, esi
push edi
cmp dword [ebp + 0xc], eax
jle 0x10001187
mov edi, dword [ebp + 8]
nop dword [eax + eax]
mov cl, byte [esi + edi]
movzx ebx, cl
cmp cl, 0x3d
jne 0x100010c0
inc eax
cmp eax, 2
jle 0x100010c5
mov eax, 0xffffffee
pop edi
test eax, eax
pop esi
sete al
pop ebx
pop ebp
ret
cmp cl, 0x7f
ja 0x100010b1
mov cl, byte [ebx + 0x100292d0]
cmp cl, 0x7f
je 0x100010b1
cmp cl, 0x40
jae 0x100010d9
test eax, eax
jne 0x100010b1
inc esi
inc edx
cmp esi, dword [ebp + 0xc]
jl 0x100010a0
test edx, edx
je 0x10001187
mov ecx, dword [ebp + 0x14]
lea eax, [edx + edx*2]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x1000110d
mov dword [ecx], eax
mov eax, 0xfffffff0
pop edi
test eax, eax
pop esi
sete al
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp + 0xc], ecx
mov edi, 3
test esi, esi
jle 0x1000117f
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx]
mov dl, byte [ecx + 0x100292d0]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
mov edx, dword [ebp + 0xc]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0xc], edx
cmp edx, 4
jne 0x10001173
xor ecx, ecx
mov dword [ebp + 0xc], ecx
test edi, edi
jle 0x1000115e
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x1000116b
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x10001173
mov byte [eax], bl
inc eax
mov ecx, dword [ebp + 8]
dec esi
inc ecx
mov dword [ebp + 8], ecx
test esi, esi
jg 0x10001123
mov ecx, dword [ebp + 0x14]
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop edi
test eax, eax
pop esi
sete al
pop ebx
pop ebp
ret

Function at 0x100011a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x100011e1
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.10002290
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10003140
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100273cb
mov eax, dword fs:[0]
push eax
sub esp, 0x83c
mov eax, dword [0x1003a064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xa0], 8
lea eax, [edi + 0x8c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x848], ecx
mov dword [ebp - 0x844], edx
jb 0x10003192
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, esi
jne 0x100032f9
xor eax, eax
mov dword [ebp - 0x818], 0
push eax
push 0x10029424
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
call fcn.10002740
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10012430
push esi
lea eax, [ebp - 0x810]
push 0x10029428
push eax
call fcn.10002860
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push dword [ebp - 0x848]
je 0x1000326e
push eax
mov ecx, edi
call fcn.10003080
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x100032c2
mov ecx, eax
call fcn.10002470
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x828], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x818], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x100032c2
push 0x10029464
push eax
call fcn.1000c100
add esp, 0x14
lea ecx, [ebp - 0x828]
call fcn.10002470
movups xmm0, xmmword [ebp - 0x840]
xor eax, eax
mov word [ebp - 0x840], ax
movups xmmword [ebp - 0x828], xmm0
movq xmm0, qword [ebp - 0x830]
movq qword [ebp - 0x818], xmm0
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x82c], 7
lea ecx, [ebp - 0x840]
call fcn.10002470
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.10017800
add esp, 4
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.10002470
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000fe5f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004550
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x1003a064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.10012430
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10004587
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x10029518
push eax
call fcn.10002860
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100045c1
lea eax, [ebp - 0x20c]
push eax
call fcn.1000a650
add esp, 4
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.10012430
push str.userconfig.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call fcn.10002860
lea ecx, [ebp - 0x61c]
add esp, 0x1c
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004600
sub ecx, edx
lea eax, [ebp - 0x61c]
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0x8c]
call fcn.10002740
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.10012430
push str.Config.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push str._s_s
push eax
call fcn.10002860
lea ecx, [ebp - 0x824]
add esp, 0x1c
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004660
sub ecx, edx
lea eax, [ebp - 0x824]
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0xa4]
call fcn.10002740
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10012430
lea eax, [ebp - 0xa44]
push str.XsfyPath
push eax
call fcn.1000a910
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x100046b1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x10029570
push eax
call fcn.10002860
mov edx, dword [ebp - 0xa30]
add esp, 0xc
cmp edx, 8
jb 0x10004706
mov ecx, dword [ebp - 0xa44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100046fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004793
push edx
push ecx
call fcn.1000fe4c
add esp, 8
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004726
lea eax, [ebp - 0x414]
push eax
call fcn.1000a650
add esp, 4
push 0x208
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.10012430
push str.Config.ini
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push str._s_s
push eax
call fcn.10002860
lea ecx, [ebp - 0xa2c]
add esp, 0x1c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004762
sub ecx, edx
lea eax, [ebp - 0xa2c]
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0xbc]
call fcn.10002740
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000fe5f
mov esp, ebp
pop ebp
ret
call fcn.100142d9
int3