joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430b70
Capabilities:
Hash data using sha256

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x1c
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
mov eax, 1
pop edi
ret
Function at 0x432640
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x18
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, 1
pop edi
ret
Function at 0x436d50
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x17
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov eax, 1
pop edi
ret
Function at 0x440890
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x7c
push edi
mov ecx, 0x16
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x8c]
test edi, edi
jne 0x4408be
mov eax, 1
pop edi
add esp, 0x7c
ret
push ebx
mov ebx, dword [esp + 0x88]
push ebp
push esi
mov eax, dword [ebx + 0x428]
mov esi, dword [ebx + 4]
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x417]
mov ebp, dword [ebx + 0x42c]
mov ecx, dword [eax]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0xc]
lea eax, [esi + edi]
cmp eax, 0x3ff
mov dword [esp + 0x2c], edx
mov dword [ebx + 4], eax
jb 0x44091d
xor edx, edx
mov ecx, 0x3ff
div ecx
mov dword [ebx], ecx
mov dword [ebx + 4], edx
jmp 0x44092d
mov ecx, dword [ebx]
cmp ecx, 0x3ff
jae 0x44092d
cmp eax, ecx
jbe 0x44092d
mov dword [ebx], eax
mov edx, edi
and edx, 0x8000000f
jns 0x44093c
dec edx
or edx, 0xfffffff0
inc edx
xor ecx, ecx
mov eax, edi
test edx, edx
cdq
setg cl
and edx, 0xf
add ebp, ecx
add eax, edx
sar eax, 4
add eax, ebp
test edi, edi
mov dword [ebx + 0x42c], eax
jle 0x440a75
lea eax, [edi + 0xf]
mov dword [esp + 0x10], edi
shr eax, 4
mov dword [esp + 0x14], eax
jmp 0x44097b
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x90]
cmp edi, 0x10
jle 0x440985
mov edi, 0x10
lea edx, [esp + 0x30]
push edx
call fcn.00436d50
lea eax, [esp + 0x24]
push 0x10
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.004378f0
lea ebp, [edi + esi - 0x3ff]
add esp, 0x10
test ebp, ebp
jle 0x4409d5
add ebx, 8
mov edx, edi
sub edx, ebp
lea ecx, [esp + 0x30]
lea eax, [ebx + esi]
push edx
push eax
push ecx
call fcn.004378f0
push ebp
lea edx, [esp + 0x40]
push ebx
push edx
call fcn.004378f0
add esp, 0x18
jmp 0x4409ea
add ebx, 8
push edi
lea ecx, [esp + 0x34]
lea eax, [ebx + esi]
push eax
push ecx
call fcn.004378f0
add esp, 0xc
mov ebp, dword [esp + 0x94]
push edi
lea edx, [esp + 0x34]
push ebp
push edx
call fcn.004378f0
lea eax, [esp + 0x24]
push 8
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.004378f0
lea edx, [esp + 0x38]
lea eax, [esp + 0x48]
push edx
push eax
call fcn.004379f0
mov eax, dword [esp + 0x3c]
add esp, 0x20
inc eax
add ebp, edi
mov dword [esp + 0x1c], eax
xor eax, eax
test edi, edi
mov dword [esp + 0x94], ebp
jle 0x440a54
mov cl, byte [esp + eax + 0x20]
mov dl, byte [ebx + esi]
xor dl, cl
mov byte [ebx + esi], dl
inc esi
cmp esi, 0x3ff
jl 0x440a4f
xor esi, esi
inc eax
cmp eax, edi
jl 0x440a38
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
sub ecx, 0x10
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jne 0x440970
mov ebx, dword [esp + 0x90]
xor eax, eax
mov dl, byte [esp + eax + 0x20]
mov cl, byte [ebx + eax + 0x417]
xor cl, dl
mov byte [ebx + eax + 0x417], cl
inc eax
cmp eax, 0x10
jl 0x440a77
mov eax, dword [ebx + 0x430]
cmp eax, 0x20
jge 0x440aab
mov ecx, dword [esp + 0x9c]
add eax, ecx
mov dword [ebx + 0x430], eax
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x7c
ret
Function at 0x4457a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
test eax, eax
jne 0x4457b8
pop ebp
ret
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
and ecx, 0xff
push esi
push edi
test ebx, ebx
mov dword [eax], ebp
mov dword [eax + 4], ecx
je 0x445850
mov ecx, ebp
mov esi, ebx
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [esp + 0x1c]
test cl, cl
je 0x445850
mov esi, ebp
xor edi, edi
shr esi, 2
je 0x445804
mov ecx, ebx
mov edx, esi
xor edi, dword [ecx]
add ecx, 4
dec edx
jne 0x4457fc
mov edx, ebp
xor ecx, ecx
and edx, 3
cmp edx, 1
jne 0x445815
mov cl, byte [ebx + esi*4]
jmp 0x44584a
cmp edx, 2
jne 0x44582a
xor ecx, ecx
mov cl, byte [ebx + esi*4]
shl ecx, 8
xor edx, edx
mov dl, byte [ebx + esi*4 + 1]
jmp 0x445848
cmp edx, 3
jne 0x44584a
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx + esi*4]
mov dl, byte [ebx + esi*4 + 1]
shl ecx, 8
add ecx, edx
shl ecx, 8
xor edx, edx
mov dl, byte [ebx + esi*4 + 2]
add ecx, edx
xor ecx, edi
mov dword [eax + ebp + 0xc], ecx
pop edi
pop esi
mov dword [eax + ebp + 8], 0xdf0adba
pop ebx
add eax, 8
pop ebp
ret

Function at 0x445880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi - 4]
lea ebp, [esi - 8]
test edx, edx
mov ebx, dword [ebp]
mov byte [ecx], 0
setne al
test al, al
je 0x44590e
push edi
mov edx, ebx
xor edi, edi
shr edx, 2
je 0x4458b6
mov eax, esi
mov ecx, edx
xor edi, dword [eax]
add eax, 4
dec ecx
jne 0x4458ae
mov ecx, ebx
xor eax, eax
and ecx, 3
cmp ecx, 1
jne 0x4458c7
mov al, byte [esi + edx*4]
jmp 0x4458fc
cmp ecx, 2
jne 0x4458dc
xor eax, eax
mov al, byte [esi + edx*4]
shl eax, 8
xor ecx, ecx
mov cl, byte [esi + edx*4 + 1]
jmp 0x4458fa
cmp ecx, 3
jne 0x4458fc
xor eax, eax
xor ecx, ecx
mov al, byte [esi + edx*4]
mov cl, byte [esi + edx*4 + 1]
shl eax, 8
add eax, ecx
shl eax, 8
xor ecx, ecx
mov cl, byte [esi + edx*4 + 2]
add eax, ecx
mov ecx, dword [ebx + ebp + 0xc]
xor eax, edi
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setne dl
mov byte [eax], dl
pop edi
mov edx, dword [ebx + ebp + 8]
push ebp
cmp edx, 0xdf0adba
mov edx, dword [esp + 0x18]
setne cl
mov byte [edx], cl
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop esi
pop ebp
pop ebx
ret
Function at 0x449e20
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
sub esp, 0x68
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push edi
push 0xf0000040
push 1
push 0
push 0
push eax
call esi
mov edi, dword [esp + 0x7c]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x449e80
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push ecx
push 0x40
push edx
call ebx
test eax, eax
je 0x449e77
push 0x40
lea eax, [esp + 0x3c]
push 0x40
push eax
push edi
call fcn.00440890
add esp, 0x10
mov ecx, dword [esp + 0x10]
push 0
push ecx
call ebp
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
lea edx, [esp + 0x1c]
push 0
push edx
call esi
test eax, eax
je 0x449ec6
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x38]
push eax
push 0x40
push ecx
call ebx
test eax, eax
je 0x449ebd
push 0x40
lea edx, [esp + 0x3c]
push 0x40
push edx
push edi
call fcn.00440890
add esp, 0x10
mov eax, dword [esp + 0x10]
push 0
push eax
call ebp
push edi
call fcn.00449f20
add esp, 4
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 1
lea edx, [esp + 0x1c]
push 0x20
push edx
push edi
call fcn.00440890
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x14], eax
push 1
lea eax, [esp + 0x18]
push 4
push eax
push edi
call fcn.00440890
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x451c8f
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
cmp esi, eax
je 0x451cdf
cmp word [esi], ax
je 0x451cdf
cmp dword [esp + 0xc], 1
jne 0x451cae
push 0xa
push eax
push eax
push esi
push eax
jmp 0x451cbc
push 1
push eax
push esi
push str.iexplore
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x451ce6
push esi
push str.Failed_to_openurl__ls
push 0x54
push str.E:SVNSoftwareProductsEsManagerTrunkModulesEsManagerSourceUtils.cpp
push 3
call fcn.0041ae60
add esp, 0x14
mov eax, 0xe0600007
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x451cea
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov dx, word [0x4a5e60]
push esi
mov esi, 0x81
push edi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
mov esi, str.cryptext.dll_CryptExtOpenCER
pop ecx
lea edi, [ebp - 0x820]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xf5
xor eax, eax
lea edi, [ebp - 0x7e4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x410]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x208]
xor esi, esi
push eax
push esi
lea eax, [ebp - 0x410]
push str.Cert
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
push 0x100
push 2
push esi
push esi
lea eax, [ebp - 0x208]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, esi
jne 0x451d9e
xor eax, eax
jmp 0x451df0
lea eax, [ebp + 0xc]
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x820]
push 0x208
push eax
call fcn.0041a380
add esp, 0xc
lea eax, [ebp - 0x820]
push 5
push esi
push eax
push str.rundll32.exe
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x45b780
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.00454a40
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x45b7b2
mov dword [esp + 0x2c], 0
jmp 0x45b7cd
mov ecx, ebp
call fcn.00454a40
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.00454a40
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.00454a50
cmp eax, esi
jae 0x45b80d
mov ecx, ebp
call fcn.00454a50
mov dword [esp + 0x10], eax
jmp 0x45b811
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.00454890
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x45b87d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x45b878
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.00455620
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x45b86b
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.00455a90
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x45b838
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x45b826
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8

Function at 0x45e950
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x45e980
push esi
call fcn.0045ee50
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x45e979
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x45ea03
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x45e9ef
mov eax, dword [esi + 8]
test eax, eax
je 0x45e9a4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45e9eb
cmp eax, 2
je 0x45e9ef
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45e997
cmp eax, 3
je 0x45e9ca
cmp eax, 1
jne 0x45e997
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45e997
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45e997
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0045ea30
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45ea23
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0045ea30
add esp, 4
pop esi
ret
Function at 0x461490
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.00468be0
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.00468b90
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x4614d4
push edi
call fcn.00468bf0
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.004615d0
mov dword [esi + 4], fcn.00461720
mov dword [esi + 8], fcn.004617d0
mov dword [esi + 0xc], fcn.00461880
mov dword [esi + 0x10], 0x461930
mov dword [esi + 0x14], 0x4619a0
mov dword [esi + 0x18], 0x461a10
mov dword [esi + 0x1c], 0x461b90
mov dword [esi + 0x20], 0x461d80
mov dword [esi + 0x24], fcn.00461f70
mov dword [esi + 0x28], 0x462070
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x461536
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call sub.MSVCRT.dll_getenv
add esp, 4
cmp eax, ebx
je 0x4615c6
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call sub.MSVCRT.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x4615c6
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x46158f
cmp al, 0x4d
jne 0x4615b3
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x55c4f4
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406adc
mov eax, dword [ebp - 8]
call fcn.00406adc
xor eax, eax
push ebp
push 0x55c5df
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x118], 5
ja 0x55c561
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00406b80
push eax
mov eax, dword [ebp - 4]
call fcn.00406b80
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x55c5c4
lea eax, [ebp - 0x158]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404860
mov dword [ebp - 0x158], 0x3c
mov dword [ebp - 0x154], 0x500
mov eax, 0x55c5ec
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 4]
call fcn.00406b80
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 8]
call fcn.00406b80
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x13c], 1
lea eax, [ebp - 0x158]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c5e6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406aec
ret
Function at 0x1001ad7a
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
jne 0x1001ad9d
mov eax, 0x8876086c
jmp 0x1001aeb2
cmp dword [ebp + 0xc], esi
push ebx
je 0x1001ae35
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x1001ae15
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
push eax
mov dword [ebp + 0xc], eax
call fcn.10154550
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
jne 0x1001adf9
mov eax, 0x8007000e
jmp 0x1001aeb1
push esi
push esi
push dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0xc], esi
je 0x1001ae35
push esi
push 0x10000000
push 3
push esi
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1001ae4e
push esi
push 0x10000000
push 3
push esi
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push dword [ebp - 4]
mov dword [edi], eax
call fcn.10154200
mov eax, dword [edi]
cmp eax, 0xffffffff
pop ecx
je 0x1001ae9f
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x1001ae9f
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x1001ae9f
cmp eax, esi
je 0x1001aeac
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x1001aeaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x1001aeb1
mov dword [edi + 8], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1001b6a0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1001b710
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x101bd9ec
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001b707
cmp dword [ebp - 0xc], 4
jne 0x1001b707
cmp dword [ebp - 0x10], edi
je 0x1001b707
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1023cc90], edi
xor eax, eax
jmp 0x1001b74f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1023cc90], edi
jge 0x1001b74a
lea eax, [ebp - 0x34]
push eax
mov dword [0x1023cc90], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x1001b74a
cmp word [ebp - 0x14], 5
jb 0x1001b74a
call fcn.1001b678
test eax, eax
je 0x1001b74a
emms
mov dword [0x1023cc90], 1
mov eax, dword [0x1023cc90]
pop edi
leave
ret

Function at 0x1001b900
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x1001b923
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x1001b949
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x1001b930
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x1001ba00
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x1001ba37
push esi
call fcn.10022f60
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1001ba30
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x1001bab6
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1001baa0
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x1001ba5a
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x1001ba99
cmp eax, 2
je 0x1001baa0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1001ba50
cmp eax, 3
je 0x1001ba7d
cmp eax, 1
jne 0x1001ba50
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x1001ba50
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x1001ba50
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.1001b900
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x1001bacd
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.1001b900
pop esi
pop ebp
ret 4
Function at 0x100243e6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x100243f5
xor eax, eax
jmp 0x100244d8
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x100244b8
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
inc edx
dec edi
jne 0x10024415
pop edi
test eax, eax
je 0x100244d2
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x101bf960]
inc edx
dec eax
jne 0x100244bc
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc