joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100100a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x41
push esi
mov word [ebp - 0x40], ax
xor esi, esi
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x2a], 0x6c
push eax
mov dword [ebp - 0x2e], 0x6c0064
mov dword [ebp - 0x32], 0x2e0032
mov dword [ebp - 0x3a], 0x700061
mov dword [ebp - 0x3e], 0x760064
mov dword [ebp - 0x36], 0x330069
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010161
lea eax, [ebp - 0x24]
mov dword [ebp - 0x16], 0x79746972
push eax
push edi
mov word [ebp - 0x23], 0x696e
mov word [ebp - 0x20], 0x6169
mov dword [ebp - 0xe], 0x74706972
mov dword [ebp - 0x12], 0x63736544
mov dword [ebp - 0x1b], 0x63655365
mov word [ebp - 9], 0x72
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x21], 0x74
mov word [ebp - 0x1d], 0x7a69
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x24], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001015a
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x10010180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x2e
mov dword [ebp - 0x13], 0x79537465
push esi
mov esi, dword [ebp + 8]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0xe], 0x6574
mov byte [ebp - 0x14], 0x47
mov word [ebp - 8], 0x65
mov word [ebp - 0xb], 0x6954
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 9], 0x6d
mov dword [ebp - 0x28], 0x6c0065
mov dword [ebp - 0x24], 0x320033
mov dword [ebp - 0x30], 0x65004b
mov dword [ebp - 0x1a], 0x6c
mov dword [ebp - 0x2c], 0x6e0072
mov dword [ebp - 0x1e], 0x6c0064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001020c
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x10010220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x55
push esi
mov word [ebp - 0x2c], ax
xor esi, esi
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1a], 0x6c
push eax
mov dword [ebp - 0x22], 0x2e0032
mov dword [ebp - 0x1e], 0x6c0064
mov dword [ebp - 0x2a], 0x650073
mov dword [ebp - 0x26], 0x330072
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100102b8
lea eax, [ebp - 0x14]
mov word [ebp - 0xe], 0x6577
push eax
push edi
mov dword [ebp - 0xb], 0x66667542
mov dword [ebp - 0x13], 0x4c726168
mov byte [ebp - 0x14], 0x43
mov word [ebp - 7], 0x57
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xf], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100102b1
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x100102d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, 0x41
push esi
mov word [ebp - 0x34], ax
xor esi, esi
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x1e], 0x6c
push eax
mov dword [ebp - 0x22], 0x6c0064
mov dword [ebp - 0x26], 0x2e0032
mov dword [ebp - 0x2e], 0x700061
mov dword [ebp - 0x32], 0x760064
mov dword [ebp - 0x2a], 0x330069
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10010379
lea eax, [ebp - 0x18]
mov dword [ebp - 0xf], 0x6f547373
push eax
push edi
mov dword [ebp - 0x18], 0x6e65704f
mov word [ebp - 0xa], 0x6e65
mov dword [ebp - 0x14], 0x636f7250
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010372
push dword [ebp - 0x38]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x10010390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, 0x41
push esi
mov word [ebp - 0x3c], ax
xor esi, esi
push edi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x26], 0x6c
push eax
mov dword [ebp - 0x2a], 0x6c0064
mov dword [ebp - 0x2e], 0x2e0032
mov dword [ebp - 0x36], 0x700061
mov dword [ebp - 0x3a], 0x760064
mov dword [ebp - 0x32], 0x330069
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1001046b
lea eax, [ebp - 0x20]
mov word [ebp - 0x19], 0x6972
push eax
push edi
mov word [ebp - 0xb], 0x6144
mov word [ebp - 0x10], 0x7069
mov word [ebp - 0x1f], 0x7465
mov word [ebp - 0x1c], 0x6365
mov word [ebp - 8], 0x6c
mov word [ebp - 0x16], 0x4479
mov byte [ebp - 0x1d], 0x53
mov word [ebp - 0x13], 0x6373
mov byte [ebp - 0x11], 0x72
mov word [ebp - 0xe], 0x6f74
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 9], 0x63
mov byte [ebp - 0x14], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010464
push dword [ebp + 0x14]
push dword [ebp - 0x40]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100139b7
mov esp, ebp
pop ebp
ret

Function at 0x10010820
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c115
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], 0
push edi
push 2
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100108b9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x100108b0
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call fcn.1001fbba
add esp, 8
test eax, eax
je 0x100108ab
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x10010881
jmp 0x100108b0
mov edi, 1
push esi
call fcn.1000f9e0
add esp, 4
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100108db
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
Function at 0x10011830
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c314
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 0x6f
mov dword [ebp - 0x22], 0x650072
mov word [ebp - 0x24], ax
mov ecx, 0x72
xor eax, eax
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x2c], 0x780065
mov dword [ebp - 0x18], 0x650078
mov dword [ebp - 0x28], 0x6c0070
mov word [ebp - 0x1e], cx
mov word [ebp - 0x14], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push ecx
push eax
call fcn.1000ffe0
add esp, 8
mov dword [ebp - 0x260], 0x22c
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x264], edi
cmp edi, 0xffffffff
je 0x10011a12
lea eax, [ebp - 0x260]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x10011a09
nop
call fcn.1000d860
mov ecx, eax
test ecx, ecx
je 0x10011a30
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10011932
movzx eax, ax
lea ecx, [ebp - 0x268]
push eax
call fcn.10011c40
jmp 0x10011957
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10011935
sub eax, edx
lea ecx, [ebp - 0x268]
sar eax, 1
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.1000e220
mov esi, dword [ebp - 0x268]
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 4], 1
call fcn.1001fbba
add esp, 8
test eax, eax
jne 0x100119ad
mov edi, dword [ebp - 0x258]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.1000ffe0
mov eax, dword [ebp - 0x30]
add esp, 8
cmp eax, dword [ebp - 0x34]
jne 0x100119a7
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x100119e4
mov edi, dword [ebp - 0x264]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100119cc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x260]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x100118f0
jmp 0x10011a09
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10011a03
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x264]
push edi
call fcn.1000f9e0
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000d3a0
int3
Function at 0x10037976
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10037406

Function at 0x10046d49
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10046c5d
Function at 0x4014f3
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x14c
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [0x443b28]
mov dword [ebp - 0x130], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
or eax, 8
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40156c
jmp 0x401607
cmp dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x1c]
je 0x40155d
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
push ecx
jmp 0x401607
xor ecx, ecx
mov edx, edi
call fcn.004014f3
test eax, eax
je 0x40157d
jmp 0x4015a4
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edi, [ebp - 0x121]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x12c]
sub esp, 0x10
test eax, eax
je 0x40153d
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov dword [esp], 2
call fcn.00407ccf
test eax, eax
push edx
je 0x4015e2
mov edx, dword [0x443b28]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x401607
cmp dword [0x443b28], 0
mov eax, 1
jne 0x401607
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
push ecx
setne al
push ecx
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403979
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x4039a4
mov eax, dword [0x41884c]
test eax, eax
je 0x403998
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push eax
mov dword [0x41884c], 0
jmp 0x403a13
cmp dword [0x41884c], 0
je 0x4039bc
mov dword [esp], 0
call fcn.00408270
push ecx
jmp 0x403a13
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x443b7c]
jbe 0x403a13
mov eax, dword [0x443b94]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4038c4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x41884c], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edx
push edx
leave
ret

Function at 0x403a15
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x403a58
xor edx, edx
cmp dword [ebp - 0xc], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x407254
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [0x43e93c], 0x44
mov dword [esp + 0x20], 0x43e93c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x4072d0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x407580
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x4075ab
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push ebx
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4075b2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, 0
cmp eax, 0xffffffff
push ecx
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x40760e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x65
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
jmp 0x40766c
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [ebp - 0x2c], eax
div ecx
mov dword [ebp - 0x30], edx
mov cl, byte [ebp - 0x30]
add ecx, 0x61
mov byte [ebp - 0x1a], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
jne 0x407674
dec esi
jne 0x407624
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x407680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x18], 1
lea edx, [ebp - 0x14]
sbb eax, eax
xor al, al
add eax, 0x20119
mov byte [ebx], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x407722
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x2000
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x40770b
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x40770e
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x1fff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407c18
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x440980
mov dword [esp + 4], eax
call fcn.004077ed
push ebx
push ebx
mov dword [esp], 0x440980
call fcn.00407468
mov ebx, eax
xor eax, eax
test ebx, ebx
push esi
je 0x407cc6
mov dword [esp], ebx
call fcn.0040782b
test byte [0x443b80], 0x80
push ecx
je 0x407c86
mov al, byte [ebx]
cmp al, 0x5c
je 0x407cc4
test al, al
jne 0x407c86
jmp 0x407cc4
call fcn.00407be0
test eax, eax
push edx
je 0x407c77
test byte [eax], 0x10
je 0x407cc4
mov dword [esp], 0x440980
call fcn.004073fc
push ecx
jmp 0x407c92
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x440980
mov dword [esp], 0x440980
call esi
cmp eax, ebx
push edx
mov dword [esp], 0x440980
jg 0x407c68
call fcn.00407386
push ecx
mov dword [esp], 0x440980
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
setne al
push ebx
movzx eax, al
jmp 0x407cc6
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x4082c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x4436c4], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408301
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x4082de
mov dword [edx*4 + 0x4436c0], eax
inc edx
cmp edx, 0x100
jne 0x4082d7
mov eax, dword [ebp + 8]
not eax
jmp 0x40831b
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x4436c0]
test ebx, ebx
jne 0x408308
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x10002850
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x10038080]
xor eax, esp
mov dword [esp + 0x194], eax
call fcn.1000ae50
test eax, eax
jne 0x100029db
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10002980
call fcn.10002240
cmp byte [0x10039e2c], 0
je 0x100028d1
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 1
call fcn.100117f3
add esp, 4
push eax
push 0x10033ff8
push str.CONOUT_
call fcn.1001144b
add esp, 0xc
push 0
call fcn.100117f3
add esp, 4
push eax
push 0x10034004
push str.CONIN_
call fcn.1001144b
add esp, 0xc
push 0x190
lea eax, [esp + 4]
push 0
push eax
call fcn.1000e4f0
add esp, 0xc
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push str.Silkroad_Online_Launcher
push 0
push 0
call dword [0x10039e34]
push str.Ready
push 0
push 0
call dword [0x10039e34]
call fcn.1000ac40
call fcn.10009e40
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1000a310
push 0x10001e90
push 0x10039e34
call fcn.100096c0
push 0x10001f50
push 0x10038b14
call fcn.100096c0
push 0x10002060
push 0x10039e50
call fcn.100096c0
push 0x10001f90
push 0x10039e30
call fcn.100096c0
push 0x10002110
push 0x10038b1c
call fcn.100096c0
call fcn.10009ea0
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x100029db
test eax, eax
jne 0x100029db
call fcn.1000ac40
call fcn.10009e40
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1000a310
push 0x10001e90
push 0x10039e34
call fcn.10009b50
push 0x10001f50
push 0x10038b14
call fcn.10009b50
push 0x10002060
push 0x10039e50
call fcn.10009b50
push 0x10001f90
push 0x10039e30
call fcn.10009b50
call fcn.10009ea0
mov ecx, dword [esp + 0x194]
mov eax, 1
xor ecx, esp
call fcn.1000ca72
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10003982
jl 0x10003975
test ecx, ecx
jne 0x10003982
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10003a42
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10005b40
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100039ee
jg 0x100039ad
test esi, esi
je 0x100039ee
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x100039c5
mov eax, dword [esp + 0x10]
jl 0x100039bf
cmp eax, esi
jae 0x100039c5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1000df70
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10003a0f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10003a2b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10003994
jl 0x10003a2b
test ecx, ecx
jne 0x10003994
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10003a86
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10003a86
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1000df70
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10003af7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10003aac
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10003ae2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10015204
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10003af7
cmp edi, eax
ja 0x10003ac0
test edi, edi
je 0x10003af7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10015204
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc