joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6295c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6343e0
cmp edx, dword [eax]
je 0x6295e3
add eax, 8
inc ecx
cmp eax, 0x634470
jl 0x6295d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6343e0]
jne 0x629711
mov eax, dword [0x63cd88]
cmp eax, 1
je 0x6296eb
test eax, eax
jne 0x629614
cmp dword [0x634308], 1
je 0x6296eb
cmp edx, 0xfc
je 0x629711
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62964b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629fa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a430
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62968e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a430
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62eecc
push edi
call fcn.0062c300
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629fa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629fb0
lea eax, [ebp - 0xa0]
push 0x62eeac
push eax
call fcn.00629fb0
push dword [esi + 0x6343e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629fb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c274
add esp, 0x2c
pop edi
jmp 0x629711
lea eax, [ebp + 8]
lea esi, [esi + 0x6343e4]
push 0
push eax
push dword [esi]
call fcn.0062a430
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x74117455
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x48035864
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x47c1b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x66000]
push edi
jmp 0x47c1ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47c1d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c1c0
mov eax, 1
add ebx, ebx
jne 0x47c1e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47c1f4
jne 0x47c213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c213
dec eax
add ebx, ebx
jne 0x47c200
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47c1d8
add ebx, ebx
jne 0x47c20f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47c265
xor ecx, ecx
sub eax, 3
jb 0x47c22b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47c29a
sar eax, 1
mov ebp, eax
jmp 0x47c236
add ebx, ebx
jne 0x47c236
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c204
inc ecx
add ebx, ebx
jne 0x47c244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c204
add ebx, ebx
jne 0x47c251
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47c246
jne 0x47c262
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47c246
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47c284
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47c276
jmp 0x47c1c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47c284
add edi, ecx
jmp 0x47c1c6
pop esi
mov edi, esi
mov ecx, 0x297d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47c2a2
cmp byte [edi], 6
jne 0x47c2a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47c2a7
lea edi, [esi + 0x79000]
mov eax, dword [edi]
or eax, eax
je 0x47c31f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7c000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7c118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47c2d4
mov ecx, edi
jns 0x47c303
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7c11c]
or eax, eax
je 0x47c319
mov dword [ebx], eax
add ebx, 4
jmp 0x47c2f1
call dword [esi + 0x7c12c]
mov ebp, dword [esi + 0x7c120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47c353
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x100014be
Capabilities:
Delete file

Disassembly:
add byte [eax], al
xchg ebp, eax
and dword [ecx + 0x66], esp
sub esi, dword [esi + 0x4f]
not edi
ror ebx, 0x8a
or byte [esi + 0x7dc], 0
xor edx, dword [esp - 3]
call dword [sym.imp.winmm.dll_mixerGetControlDetailsA]
call fcn.10001c42
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [edi + ebx*4 + 0x7a]
shr ecx, 0x62
call 0x10000788
lea ebx, [edx]
ret

Function at 0x10001aaa
Capabilities:
Encode data using xor

Disassembly:
call fcn.100023f0
push dword [eax - 0xc]
mov byte [esi + 0xdce], 0
jge 0x10001b39
add byte [eax], al
add byte [ebp + 0x7f], bh
mov ebx, dword [esp - 0x11]
shl eax, 0xe2
or dword [ebp - 3], esp
push eax
lea eax, [eax + edx*2 - 0x43ec8b66]
xor edi, esi
xor dword [edi + 0xe66], 0x6600
call dword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteSize]
xchg esi, eax
call 0x10000e1e
add edi, 0xb22
dec ecx
xor ebx, 0xae
je 0x10001ab5
int3
add byte [eax], al
add byte [esi], bl
add byte [ecx + 0xdc0f6], al
add byte [ecx + 0x40a97], al
add byte [eax], al
or al, byte [eax]
add byte [edi], cl
cmp ecx, 2
add byte [eax], al
call fcn.100021be
add edx, eax
xchg ebx, eax
xchg ebx, eax
mov edi, edi
push edi
mov edi, dword [esp + 8]
sub edi, 0x10000000
add dword [esp + 4], edi
pop edi

Function at 0x100021f4
Capabilities:
Create process on windows

Disassembly:
add byte [eax], dl
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
adc bh, bh
mov bl, 0x50
or dword [eax], eax
add byte [ebp - 0x2cbb723d], al
sub bh, bh
adc eax, fcn.10001174
invalid
xchg ebx, eax
rol ecx, 0x62
xchg edi, eax
shr esi, 0xba
js 0x100021b7
push dword [ebx + 0xd86]
xchg esi, eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
and esi, dword [ebp + 0x395]
call fcn.1000310f
mov esp, dword [esi + 0x74]
add dword [edx - 0x4c], ecx
add edi, esi
shl edi, 0x84
xor edx, 0xe9e
add byte [eax], al

Function at 0x100023f0
Capabilities:
Get file size
Get file version info

Disassembly:
sub edx, dword [ebp - 0x21]
pushal
jge 0x10002413
leave
sub ebx, dword [edx - 7]
jle 0x10002693
push 0x74a
call fcn.10002ea6
shl ecx, 0xa4
ret
adc byte [ebp - 0x3e2808e7], cl
loopne fcn.10002493
and ebx, dword [esp - 2]
ror ebx, 0x8a
add esi, edx
push dword [ecx - 0x2a]
ljmp 0x6725:0x35368a8d

Function at 0x100024b6
Capabilities:
Accept command line arguments

Disassembly:
adc byte [esi], al
add byte [eax], al
or edx, edx
or dword [ebp - 0x6e], eax
call fcn.1000332a
rol edx, 0xe
xchg ebp, eax
invalid
invalid
Function at 0x10002684
Capabilities:
Get file size
Get file version info

Disassembly:
sldt word [eax]
add byte [esi + 0x3e680000], dl
add byte [eax + 0x3e], ch
add dword [eax], eax
add byte [ebp - 0x721525a4], cl
mov dh, byte [esi]
xor eax, 0xf8d6725
mov esi, dword [esp - 0x1a]
lea esi, [edx]
push 0x2d6
and esi, dword [ebx + 0x23]
push dword [eax + 0x60]
shr edx, 0xa8
push 0x7a
inc ebx
push edx
xchg esi, eax
mov edx, 0x990
call dword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteSize]
not eax
lea eax, [edi + edx*4 - 0x59ea0318]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, 0x444
test byte [esp + eax], 0
mov dword [ebx + 0x130], ebx
sub word [esi + 0xc0], 0xc000
lea edi, [ecx + 0x5c]
pop esp
push 0x164
call dword [fcn.100011dc]
mov esi, 0x4e0
push 0xffffffffffffffaa
push 0x7c
call fcn.100025f6
js 0x1000287b
shr eax, 0xc6
xor edx, 0xf48
mov esi, dword [edx + 0x16b]
or dword [ebx + 0x37], eax
xor eax, edi
call dword [sym.imp.version.dll_GetFileVersionInfoA]
call dword [sym.imp.user32.dll_PostMessageA]
mov ecx, 0xabc
xchg edi, eax
call fcn.10001aa9
call fcn.10003658
sub ebx, 0x654
test ebx, edx
xchg esi, eax
invalid
cdq
invalid
invalid

Function at 0x1000268a
Capabilities:
Get file size
Get file version info

Disassembly:
sldt word [eax]
add byte [esi + 0x3e680000], dl
add byte [eax + 0x3e], ch
add dword [eax], eax
add byte [ebp - 0x721525a4], cl
mov dh, byte [esi]
xor eax, 0xf8d6725
mov esi, dword [esp - 0x1a]
lea esi, [edx]
push 0x2d6
and esi, dword [ebx + 0x23]
push dword [eax + 0x60]
shr edx, 0xa8
push 0x7a
inc ebx
push edx
xchg esi, eax
mov edx, 0x990
call dword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteSize]
not eax
lea eax, [edi + edx*4 - 0x59ea0318]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, 0x444
test byte [esp + eax], 0
mov dword [ebx + 0x130], ebx
sub word [esi + 0xc0], 0xc000
lea edi, [ecx + 0x5c]
pop esp
push 0x164
call dword [fcn.100011dc]
mov esi, 0x4e0
push 0xffffffffffffffaa
push 0x7c
call fcn.100025f6
js 0x1000287b
shr eax, 0xc6
xor edx, 0xf48
mov esi, dword [edx + 0x16b]
or dword [ebx + 0x37], eax
xor eax, edi
call dword [sym.imp.version.dll_GetFileVersionInfoA]
call dword [sym.imp.user32.dll_PostMessageA]
mov ecx, 0xabc
xchg edi, eax
call fcn.10001aa9
call fcn.10003658
sub ebx, 0x654
test ebx, edx
xchg esi, eax
invalid
cdq
invalid
invalid
Function at 0x100027ed
Capabilities:
Connect pipe
Get file version info

Disassembly:
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
call fcn.10002684
sub dword [edx + 0x73], esi
or dword [ecx + 0x4b], ebp
or eax, dword [eax + 0x258]
call dword [sym.imp.user32.dll_CharUpperA]
mov dword [eax + 0xdac], 0xac00
call dword [sym.imp.user32.dll_IsCharUpperA]
add edx, edi
mov eax, ecx
and byte [esi + 0x644], 0
inc esi
push dword [esi + 0x2c0]
sub dword [edx + 0x145], esi
push dword [ecx + 0xb5c]
add dword [eax + 0x4a0], edx
xor dword [esp + 0xf4], ecx
xor esi, edi
call dword [fcn.100011a8]
add edi, 0xe7c
sub byte [edi + 0x8f6], 0
push dword [edx + 0x9e]
shr eax, 0xc6
call dword [sym.imp.ntdll.dll_RtlFindClearBits]
push dword [esi + 0x332]
add esi, 0x5a4
xchg ebx, eax
rol ebx, 0x66
jb 0x10002b91
jge 0x10002e77
mov ebp, dword [ebp + 6]
call dword [fcn.100011a8]
pop ebx
ret
rcl byte [esi + 0x93eb8], 0
mov dword [edx + 0x57], ebp
call dword [sym.imp.user32.dll_PostMessageA]
or ebp, dword [esp - 0x2f]
add edx, 0xd36
ror ecx, 0xde
test edx, ebx
call fcn.10001c3f
mov esi, ebx
or dword [eax + 0x26], ebp
shr ebx, 0x7e
xor dword [esi + 0x1fa], ebx
jae 0x10002bd8
push dword [edx + 0x7fc]
ror ebx, 0xb8
jns 0x10002bdf
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov al, 0x10
add byte [eax], dl
add edx, 0x190
pop edi
call dword [sym.imp.version.dll_GetFileVersionInfoA]
add dword [eax], eax
add byte [edi - 1], bl
adc eax, sym.imp.version.dll_GetFileVersionInfoA
ret
or al, 0x83
mov al, 0xff
jb 0x10002e92
invalid

Function at 0x10002b7b
Capabilities:
Connect pipe
Get file version info

Disassembly:
or ebx, dword [esp - 0x26]
mov esi, 0xf0
rol eax, 0x38
mov ebx, dword [ecx + 0x5b]
lea edx, [esi + 0x3799006e]
rol eax, 0x96
xchg esi, eax
mov eax, 0x93e

Function at 0x100032a2
Capabilities:
Terminate process

Disassembly:
ror ebx, 0x8a
jo 0x10003bdc
push 0x5d6
shl ebx, 0x7e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [ebp + 0x68]
sbb al, byte [esi]
add byte [eax], dl
push 0xffffffffffffffd8
push fcn.10008654
call fcn.100023c2
add ebx, 0xc02
rol ecx, 0x6a
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call fcn.10003fb9
sub ebp, dword [ebp + 0xf]
shr esi, 0x86
not edx
int3
Function at 0x1000409e
Capabilities:
Terminate thread

Disassembly:
add byte [eax], dl
push 0x34
push 0x100005ea
push 0x10006713
call fcn.10002511
lea ecx, [eax + edx*8 + 0x36]
mov ecx, ebp
lea edi, [ebx + 0x54]
call fcn.10002b33
call dword [sym.imp.version.dll_GetFileVersionInfoA]
mov ebx, 0x498
sub eax, ecx
push dword [edx + 0x2a]
inc ebp
push edx
push dword [esp + 4]
push dword [esp + 8]
push esp
push 0x1000906e
add al, 0xff
je 0x100033c2
or byte [eax + ebp*2 + 0x6e], dl
nop
add byte [eax], dl
call fcn.10002427
push dword [ebx + 0x77a]
add ecx, edi
shr eax, 0xca
nop
inc esi
push dword [eax - 0x54]
not eax
xchg ebx, eax
jae 0x1000339a
jmp 0x1000908a
add byte [eax], al
call fcn.10006f00
cmp eax, 1
je 0x10004087
invalid
mov ch, 0xc
add byte [eax], al
push dword [esp + 8]
push ecx
push dword [esp + 8]
push 0x10000f82
call fcn.10002511
adc byte [ebx + 0xbb6], 0
push 0xf5e
shl esi, 0x86
sub edx, 0xb08
nop
lea eax, [edx - 0x72a78902]
test esi, ecx
sub edi, edx
leave
push dword [ebx + 0xaae]
jmp 0x1000c5e9
xor esi, ebx
push ebp
push dword [esp + 8]
push 0x1000093a
push 0x100015e0
call fcn.100023c2
call fcn.10003f84
lea ebx, [esi + ebx*4 + 0x18df26ae]
add ecx, dword [esp - 0x44]
test ebx, ebx
nop
or edx, eax
mov edx, ecx
xchg esp, eax
jmp fcn.100079f9
push eax
push ebx
push 0x10000c94
push eax
push dword [esp + 0xc]
push 0x10005827
call fcn.100023c2
mov byte [ebx + 0xfee], 0
sub esi, 0xf
add byte [eax], al
add cl, al
loop 0x100040bd
sub dword [ebx + 0x26], eax
xor ebx, edi
xor ecx, 0xdb4
cwde
xchg ebp, eax
push 0x7c
push dword [esp + 4]
push dword [esp + 8]
push 0x10000992
push 0x10000dba
push dword [esp + 8]
push 0x100007f8
push 0x100039cc
call fcn.10002c26
inc dword [ecx + 0xda2eb]
add byte [ecx], al
outsb dx, byte [esi]
in al, dx
ror eax, 0x5c
sub dword [esp + 0x16d], ebx
sub edx, eax
add esi, 0x1e0
sub edi, 0xeaa
mov ebp, esp
push dword [esp + 0xc]
jmp 0x10004d21
ret 0x10
push esp
push edx
call fcn.1000cdeb
add esp, 0xfffffcf8
push dword [esp + 0xc]
push 0x1a
push 0x10000ad8
push 0x10006e50
call fcn.10002427
not ebx
shl ecx, 0x6a
lea edx, [esi + ebx*2 - 0x2f13424a]
mov dword [esi + 0x649], ebx
push 0xffffffffffffffc0
push dword [edi + 0xa]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
mov edx, edi
push edx
jmp 0x1000ae0f
xchg edx, eax
cwde
leave

Function at 0x10007184
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push 0x100008aa
push dword [esp + 8]
push 0x10000028
push 0x100063e7
call fcn.10002511
call dword [sym.imp.winmm.dll_midiStreamPause]
and word [eax + 0xcfa], 0xfa00
call 0x10007184
call dword [sym.imp.comdlg32.dll_PageSetupDlgW]
sub ebp, dword [esp - 0x7c]
push 0x10
jp 0x10007154
or byte [eax + 0x28], ch
add byte [eax], al
adc byte [eax - 0x19], ch
arpl word [eax], ax
adc al, ch
lodsd eax, dword [esi]
mov bl, 0xff
invalid
push ecx
add ecx, dword [ecx + 0x3c]
push dword [esp + 0xc]
push dword [esp + 4]
push 0x66
push 0xffffe6f
Function at 0x100072df
Capabilities:
Get file size

Disassembly:
push 0x100003ee
push 0x1000041c
push 0x10000bb2
push fcn.100034e0
call fcn.10002427
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
lea eax, [eax - 0x65d0771a]
call dword [sym.imp.comdlg32.dll_GetFileTitleA]
jp 0x100077f2
dec edi
push 0x5e
mov esi, eax
push dword [edi + 0xa]
ret
add byte [eax], al
push 0x1000049e
push dword [esp + 4]
push 0x10000f0c
push 0x10003df9
call fcn.10002c26
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
and esi, dword [esi + 0xd]
push 0x2c
pop ebx
jmp 0x1000b06a
mov ecx, dword [ecx + 0x80]
add ecx, dword [ebp + 8]
push 0x10000700
push dword [esp + 4]

Function at 0x10007997
Capabilities:
Read file on windows

Disassembly:
push 0x100000b4
push 0xfffd57b
call fcn.100023c2
add edi, edx
xchg esi, eax
push dword [edi - 0x46]
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
call dword [fcn.10001198]
or dword [ebp - 0x7f], ebp
xchg ebp, eax
call dword [fcn.100010b4]
call fcn.10005f33
add eax, ecx
mov eax, dword [eax + edx*4]
push 0xfffffffffffffffe
push edx
push ecx
push 0x10004fda
call fcn.1000248c
and dword [esi + 0xce0], 0xe000
or word [edi + 0x5aa], 0xaa00
xchg edi, eax
ret

Function at 0x10007beb
Capabilities:
Create process on windows

Disassembly:
je 0x10007c11
or byte [eax - 0x14], ch
push esp
add byte [eax], dl
call fcn.100023c2
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
push dword [ecx + 0x74]
xor esi, 0x24e
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, 0xf8c
sub eax, ecx
pop ebp
call fcn.10009584
push dword [esp + 4]
push 0x10000490
push 0x16
add byte [ebx], ch
rcr dword [ebp - 0x18], 0x6a
sbb dword [eax], eax
add bh, bh
je 0x10007c41
add al, 0x68
nop
add al, 0
adc byte [edx + 0x16], ch
push 0xfffdbc3
call fcn.10002511
call dword [fcn.100011a8]
xor ebx, 0xb02
call dword [sym.imp.comdlg32.dll_GetFileTitleW]
push 0xffffffffffffff8e
xchg ebp, eax
dec esi
int3

Function at 0x10008043
Capabilities:
Delete registry value

Disassembly:
leave
leave
mov edi, edi
push edx
push dword [esp + 4]
push 0x10000420
dec esp
call dword [sym.imp.comdlg32.dll_PageSetupDlgW]
mov esi, dword [esi + 0x62c]
add byte [ecx + 0x77ff7d53], cl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
leave

Function at 0x10008051
Capabilities:
Delete registry value

Disassembly:
push 0xfffdf38
call fcn.10002c26
mov esp, dword [ebx - 0x15]
jne 0x10008817
mov ebx, dword [ebx - 0x5a]

Function at 0x10008067
Capabilities:
Delete registry value

Disassembly:
call dword [sym.imp.ntdll.dll_NtCreateMailslotFile]
call fcn.100047ae
add eax, 0x1000
inc dword [0x1000]
push dword [esp + 8]
push eax
push esi
push esp
push 0xfffc71c
call fcn.10002c26
jge 0x100080f8
call dword [sym.imp.SETUPAPI.dll_CM_Set_DevNode_Registry_PropertyW]
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push dword [edi - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, ecx
mov edx, ecx
xchg ebx, eax
jnp 0x10008071
push ecx
invalid
Function at 0x100080a7
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push dword [esp + 8]
push 0x7a
push 0xffffffffffffffb8
push 0xfffbbc4
call fcn.10002c26
push dword [edi + 0x62]
push 0xffffffffffffff94
jae 0x1000877d
call dword [sym.imp.winmm.dll_mixerGetLineInfoW]
xchg edx, eax
push 0x14
push 0x1000014a
push dword [esp + 4]
push 0xffffffffffffffac
push dword [esp + 0xc]
push 0xffff372
call fcn.100023c2
call fcn.10008cd3
jb 0x1000810f
push dword [eax + 0xb52]
invalid
invalid
sbb byte [ecx], dl

Function at 0x100081c5
Capabilities:
Get file version info

Disassembly:
or byte [edx - 0x70], ch
push dword [esp + 0xc]
push 0xfffe3c4
call fcn.10002511
jle 0x10008963
call fcn.1000868d
push dword [eax - 0x1a]
test edx, edx
dec esp
xchg ebp, eax
fadd qword [esi]
push ds
mov ah, 0x89
test al, 0xbd
add al, byte [eax]
add byte [ebp - 0x363f743d], al

Function at 0x10008948
Capabilities:
Get file version info

Disassembly:
pop eax
push 0x10000c78
push edx
push 0x100002de
fiadd word [edx]
add byte [eax], dl
push 0xfffc406
call fcn.10002427
push dword [edx + 0x40]
lea edi, [esi - 0x4be1f924]
mov dword [eax + 0x2bd], ebp
test ebx, eax
mov eax, eax
leave
leave
test ebx, eax
js 0x100089a2
xchg edx, eax
push dword [esp + 0xc]
jmp 0x10009198
fcom dword [ecx]
add byte [eax], dl
int3

Function at 0x10008950
Capabilities:
Get file version info

Disassembly:
pop eax
push 0x10000c78
push edx
push 0x100002de
fiadd word [edx]
add byte [eax], dl
push 0xfffc406
call fcn.10002427
push dword [edx + 0x40]
lea edi, [esi - 0x4be1f924]
mov dword [eax + 0x2bd], ebp
test ebx, eax
mov eax, eax
leave
leave
test ebx, eax
js 0x100089a2
xchg edx, eax
push dword [esp + 0xc]
jmp 0x10009198
fcom dword [ecx]
add byte [eax], dl
int3

Function at 0x10008f97
Capabilities:
Get file size

Disassembly:
dec dword [ecx + 0x4f781]
add byte [eax + 0x7e], ch
add eax, 0xd8850000
mov ebx, dword [eax - 0x4e]
mov dword [ebp - 0x5b], ebp
push 0x7a
popal
call fcn.1000bcba
sub ecx, 2
push eax
push 0x10000094
push dword [esp + 0xc]
push 0x10003d37
call fcn.10002511
push dword [ebx - 0x12]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ebx, [ebx + eax - 0x54]
mov ebx, dword [esi + 0x4b6]
sub dword [edx + 0xde8], 0xe800
test eax, edx
ret

Function at 0x100093f8
Capabilities:
Read file on windows

Disassembly:
mov edx, 0x11ac15ff
add byte [eax], dl
pop eax
push eax
push 0x10000a68
push 0xe
push 0xfff9d7a
call fcn.10002c26
push 0x30
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
call dword [sym.imp.winmm.dll_mixerGetControlDetailsA]
call dword [sym.imp.winmm.dll_midiStreamProperty]
mov dword [eax + 0x1e], esi
mov dword [eax - 0x3d], eax
mov ebx, edx
xchg ebx, eax
sub ecx, 2
mov ecx, dword [ecx]
push esi
push 0x100007f4
push dword [esp + 0xc]
push ecx
push dword [esp + 4]
push esi
push 0x1000012a
push 0xfffa0d9
call fcn.1000248c
call fcn.10009a54
invalid

Function at 0x1000b1e7
Capabilities:
Connect pipe

Disassembly:
xchg byte [esi + 7], bl
add byte [eax], al
add byte [esi - 0x6a], bl
dec edx
xchg edx, eax
mov ebp, dword [esi + 0x36]
test edx, ecx
dec esp
push 0xffffffffffffffb0
push 0x10000db6
invalid
js 0x1000b1bf
Function at 0x1000b7a2
Capabilities:
Delete registry value
Get file size

Disassembly:
stosb byte es:[edi], al
loop 0x1000b7a8
add byte [eax], al
mov dword [edx + 0xe2a], 0x2a00
sub byte [edx], 0xe
add byte [eax], al
add byte [edx], ch
add byte [eax], al
xchg esp, eax
call fcn.1000ba31
call fcn.1000bb48
xchg esp, eax
call fcn.1000cb4f
push 0x100009ee
push dword [esp + 8]
push ebx

Function at 0x1000b7cc
Capabilities:
Delete registry value
Get file size

Disassembly:
push 0xfff8926
call fcn.10002427
call dword [sym.imp.user32.dll_PostMessageA]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jl 0x1000b80b
dec esp
xchg edi, eax
call fcn.10003c16
pop ebp
push 0x52
push 0xffffffffffffffb0
mov al, 0x50
push 0x10001f30
call fcn.1000248c
mov dword [edx - 0x6d], esi
push esp
jns 0x1000c13e
call dword [sym.imp.winmm.dll_midiOutGetNumDevs]
push 0xfffffffffffffff2
dec esi
inc ebx
jmp fcn.10007082
add byte [eax], al
add al, ch
push 0x52
mov esi, edx
int3

Function at 0x1000c3dd
Capabilities:
Delete registry value

Disassembly:
jnp 0x1000c3db
mov ch, 0x56
int3
mov edx, ebx
leave
push edi
push dword [esp + 8]
push 0x5e
push 0x100007cc
push 0x10000da2
push 0xfffce44
call fcn.10002511
mov dword [esi - 0x5a], esp
js 0x1000c361
mov word [eax + 0x664], 0x6400
add byte [ecx + edi*2 - 0x4d], ah

Function at 0x1000d300
Capabilities:
Accept command line arguments

Disassembly:
adc eax, sym.imp.ntdll.dll_NtFreeVirtualMemory
push 0xffffffffffffffee
mov edx, ebp
xchg ebx, eax
push dword [esp + 8]
push 0x100002ac
push 2
push 0xffffffffffffffa0

Function at 0x1000e50b
Capabilities:
Encode data using xor

Disassembly:
test dword [edi + 0x343600e7], ecx
stosb byte es:[edi], al
test al, 0x85
loop 0x1000e597
cmp byte [edx], 0x28
inc edx
invalid
add dword [esi + 0x33], 0xfffffff9
xor ah, byte [edi + 0x28d00c3d]
mov esi, 0xb3f7ca23
jg 0x1000e5c9
dec esp
inc ecx
or ah, dl
cmc
add al, 0x9c
adc ebp, dword [di]
or esi, esi
ljmp 0x71ec
jae 0x1000e62f
das
xchg ecx, eax
hlt
inc edi
retf