joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59cb60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0047a3d0
mov edx, dword [esp + 0x2c]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x1c]
or ecx, 0xffffffff
cmp edx, 1
push esi
setne al
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x3c]
add eax, edi
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x59cb99
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
push ebp
cmp edx, 1
je 0x59cc65
mov ebp, dword [esp + 0x30]
dec ebp
add ebp, esi
cmp dword [esp + 0x44], 0
mov cl, byte [ebp]
movzx edx, cl
mov byte [esp + 0x13], cl
mov dword [esp + 0x14], edx
je 0x59cbd3
sub esi, edx
mov eax, 1
sub esi, edi
pop ebp
dec esi
pop edi
mov dword [ebx], esi
pop esi
pop ebx
add esp, 0x14
ret
lea ecx, [edx + eax]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x59cc45
mov esi, edx
mov eax, esi
shr eax, 0x1f
mov dword [esp + 0x1c], eax
mov edx, esi
lea ebp, [ebp - 1]
sub edx, edi
mov ecx, edi
shr edx, 0x1f
inc edi
shr ecx, 0x1f
xor dl, cl
xor al, cl
movzx ecx, byte [ebp + 1]
or dl, al
movzx eax, byte [esp + 0x13]
dec dl
xor ecx, eax
movzx edx, dl
mov eax, dword [esp + 0x1c]
and edx, ecx
not edx
and ebx, edx
cmp edi, dword [esp + 0x18]
jb 0x59cc07
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x40]
lea eax, [edx + 1]
mov edx, dword [esp + 0x3c]
not ebx
movzx ecx, bl
mov ebx, dword [esp + 0x28]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [ebx], esi
push dword [esp + 0x48]
push ecx
push edi
push edx
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
push ebx
call fcn.0059c840
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x59d130
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.0047a3d0
mov eax, dword [0x665024]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x30]
test eax, eax
je 0x59d242
movups xmm0, xmmword [edi + 0x10]
mov ebx, dword [esp + 0x50]
lea esi, [edi + 0x10]
dec eax
mov dword [esp + 0x10], ebx
movups xmmword [esp + 0x2c], xmm0
and byte [esp + 0x38], 0x7f
lea ecx, [esp + 0x2c]
push 1
mov dword [edi + 0x30], eax
push ecx
psrldq xmm0, 8
movd eax, xmm0
push 0
push 0
and al, 0x7f
mov byte [esp + 0x44], al
mov eax, dword [edi + 0x20]
push 0
push eax
mov dword [esp + 0x30], eax
call fcn.004cb6d0
add esp, 0x18
test eax, eax
je 0x59d242
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push dword [esp + 0x18]
push eax
push ebp
push dword [esp + 0x28]
call fcn.004cc190
add esp, 0x14
test eax, eax
je 0x59d242
push ebx
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call fcn.0059d6e0
add esp, 0x10
test eax, eax
je 0x59d242
lea eax, [esi + 0xf]
xor edx, edx
lea ecx, [esp + 0x1c]
cmp ecx, eax
ja 0x59d213
lea eax, [esp + 0x2b]
cmp eax, esi
jb 0x59d213
mov eax, ecx
sub esi, eax
lea ecx, [esp + 0x1c]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor byte [ecx], al
cmp edx, 0x10
jl 0x59d200
jmp 0x59d224
movups xmm1, xmmword [esp + 0x1c]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esp + 0x1c], xmm1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
or ecx, dword [esp + 0x24]
or eax, dword [esp + 0x28]
or ecx, eax
je 0x59d257
push ebx
push ebp
call fcn.00492980
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004797c8
add esp, 0x30
ret
mov ecx, dword [esp + 0x3c]
mov eax, ebx
mov dword [edi + 0x2c], 0
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004797c8
add esp, 0x30
ret

Function at 0x5b5e34
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b5caa
Function at 0x5c6cf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
push str.DriverInstallorUninstallProcess
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x669e78], 0
jg 0x5c6d47
mov dword [0x669e70], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5c6e69
push 0
push 0
push 0
push 0xf001f
mov eax, dword [0x666c14]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x669e74], eax
cmp dword [0x669e74], 0
je 0x5c6e07
mov ecx, dword [0x669e74]
mov edx, dword [ecx]
sub edx, 1
mov eax, dword [0x669e74]
mov dword [eax], edx
mov ecx, dword [0x669e78]
sub ecx, 1
mov dword [0x669e78], ecx
mov edx, dword [0x669e74]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [0x669e74]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x669e78], 0
jne 0x5c6e05
mov dword [0x669e74], 0
mov dword [0x669e70], 0
cmp dword [0x666c14], 0xffffffff
je 0x5c6de6
mov edx, dword [0x666c14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x666c14], 0xffffffff
cmp dword [0x666c10], 0xffffffff
je 0x5c6e05
mov eax, dword [0x666c10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x666c10], 0xffffffff
jmp 0x5c6e4a
push str._n_driver_load_and_close_not_match_or_load_driver_fail__n
call fcn.0040ff60
add esp, 4
cmp dword [0x666c10], 0xffffffff
je 0x5c6e2a
mov ecx, dword [0x666c10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x669e70], 0
jmp 0x5c6e69
cmp dword [ebp - 8], 0
jne 0x5c6e55
call fcn.005c7720
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x5c7610
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0x32
call fcn.005c7720
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5c76f2
mov dword [ebp - 4], 0x32
jmp 0x5c7657
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x5c76dc
cmp dword [ebp + 0xc], 1
jne 0x5c766c
mov dword [ebp - 0xc], 3
jmp 0x5c7673
mov dword [ebp - 0xc], 1
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
push 1
push 0xf01ff
push 0x654374
push 0x65437c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x5c76d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x430
jne 0x5c76c7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5c764e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x5c770f
jmp 0x5c76dc
cmp dword [ebp - 4], 0
jg 0x5c76f0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x5c770f
jmp 0x5c76f6
xor eax, eax
jmp 0x5c770f
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x5c7720
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.005c7870
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5c77a0
push 0xf01ff
push 0x654384
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x5c779a
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x5c7781
mov dword [ebp - 0xc], 0
jmp 0x5c7788
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x5c779e
xor eax, eax
jmp 0x5c77a7
jmp 0x5c77a4
xor eax, eax
jmp 0x5c77a7
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5c77b0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5c7849
push 0xf01ff
push 0x65438c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x5c7836
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x5c781d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x5c781d
mov dword [ebp - 0xc], 0
jmp 0x5c7824
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x5c7847
push str.OpenService_failed_n
call fcn.0040ff60
add esp, 4
xor eax, eax
jmp 0x5c785d
jmp 0x5c785a
push str.OpenSCManager_failed_n
call fcn.0040ff60
add esp, 4
xor eax, eax
jmp 0x5c785d
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x5c7870
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x665024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x5c78fb
push 0xf01ff
push str.ATSZIO
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x28], 0
je 0x5c78f5
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x5c78dc
mov dword [ebp - 0x2c], 0
jmp 0x5c78e3
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x5c78f9
xor eax, eax
jmp 0x5c7902
jmp 0x5c78ff
xor eax, eax
jmp 0x5c7902
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004797c8
mov esp, ebp
pop ebp
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x44982551
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2527342b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4671c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x310
lea ebp, [esp - 4]
mov eax, dword [0x590700]
xor eax, ebp
mov dword [ebp + 0x310], eax
push 4
mov eax, 0x530dd5
call fcn.00508c91
push 0xffffffffffffffff
push str.LANG_EN
lea ecx, [ebp]
call fcn.00497a73
xor ebx, ebx
lea ecx, [ebp]
push str.LANG_PT
mov dword [ebp - 4], ebx
call fcn.00497c0e
push 4
call fcn.004a01f7
lea eax, [ebp + 0x84]
push eax
call fcn.0049b545
pop ecx
pop ecx
mov byte [ebp - 4], 1
call fcn.0049b704
dec eax
je 0x467370
dec eax
je 0x467333
dec eax
je 0x4672bb
dec eax
jne 0x4673ea
push 0x5660cc
push 0x85
call fcn.0049b6ef
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4673ea
push esi
call fcn.0049b6ef
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4672af
push esi
call fcn.0049b6ef
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4672af
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.004a0204
add esp, 0xc
push ebx
push ecx
mov eax, esp
mov dword [eax], 0x5660dc
call fcn.00467f41
mov ecx, eax
call fcn.004b9fdc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4673ea
xor eax, eax
push 0x206
mov word [ebp + 0x108], ax
lea eax, [ebp + 0x10a]
push ebx
push eax
call fcn.00508650
sub esp, 0x78
lea eax, [ebp + 0x108]
lea esi, [ebp]
push 0x21
pop ecx
mov edi, esp
push str.skin_s_skin_
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x8c
lea eax, [ebp + 0x108]
lea ecx, [ebp + 0x84]
push eax
call fcn.00497cc8
lea ecx, [ebp + 0x84]
call fcn.0049816d
push eax
call fcn.004a01ae
mov dword [esp], 0x566084
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
jmp 0x4673de
push str.skin_
lea ecx, [ebp + 0x84]
call fcn.00497cc8
lea ecx, [ebp + 0x84]
call fcn.0049816d
push eax
call fcn.004a01ae
push ebx
push 1
push str.res.zip
call fcn.004a0292
add esp, 0x10
push ebx
push ecx
mov eax, esp
mov dword [eax], 0x5660b8
jmp 0x4673de
xor eax, eax
push 0x206
mov word [ebp + 0x108], ax
lea eax, [ebp + 0x10a]
push ebx
push eax
call fcn.00508650
sub esp, 0x78
lea eax, [ebp + 0x108]
lea esi, [ebp]
push 0x21
pop ecx
mov edi, esp
push str...lib_skin_s_skin_
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x8c
lea eax, [ebp + 0x108]
lea ecx, [ebp + 0x84]
push eax
call fcn.00497cc8
lea ecx, [ebp + 0x84]
call fcn.0049816d
push eax
call fcn.004a01ae
pop ecx
push ebx
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.00467f41
mov ecx, eax
call fcn.004b9fdc
lea ecx, [ebp + 0x84]
mov byte [ebp - 4], bl
call fcn.00497b76
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00497b76
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x310]
xor ecx, ebp
call fcn.00503ade
lea esp, [ebp + 0x314]
pop ebp
ret
Function at 0x691c2250
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov edx, dword fs:[0x18]
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov eax, dword [eax]
mov dword [esp + 4], 0
shl eax, 3
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebx]
sub esp, 0xc
mov esi, eax
test ecx, ecx
je 0x691c22ae
mov eax, dword [ebx + 4]
lea edx, [esi + 4]
lea ebx, [eax + ecx*4]
lea esi, [esi]
mov dword [edx - 4], 0
mov ecx, dword [eax]
add eax, 4
add edx, 8
mov dword [edx - 8], ecx
cmp eax, ebx
jne 0x691c2298
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret

Function at 0x691c3400
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
mov eax, dword [esi + 8]
mov dword [esp], eax
call dword [eax + 4]
mov ebx, eax
test byte [0x691e0028], 8
jne 0x691c3440
test ebx, ebx
je 0x691c3470
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x691e22e9
mov dword [esp + 8], str.XAPOFX_Release
mov dword [esp + 4], 0x691e0028
mov dword [esp], 3
call fcn.691c2c80
test ebx, ebx
jne 0x691c342d
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4

Function at 0x691c3d20
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, dword fs:[0x18]
sub esp, 0x1c
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax], fcn.691c2cd0
mov ebx, eax
mov eax, dword [ebp + 8]
sub esp, 0xc
mov dword [esp], ebx
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call fcn.691c2cd0
sub esp, 0xc
mov esi, eax
test eax, eax
js 0x691c3d90
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x691c74b0
Capabilities:
Get process heap flags

Disassembly:
test eax, eax
je 0x691c7550
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x2c
mov edx, dword [esi]
mov dword [esp + 4], 0
lea edx, [edx*8 + 8]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, eax
mov eax, dword [esi]
sub esp, 0xc
lea ecx, [edx + 8]
mov dword [edx], eax
mov dword [edx + 4], ecx
test eax, eax
je 0x691c753e
xor ebx, ebx
lea esi, [esi]
mov eax, dword [esi + 4]
lea edi, [ebx*8]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + edi + 4]
call fcn.691c5df0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x58]
mov eax, dword [edx + 4]
mov dword [eax + edi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax + ebx*8]
mov eax, dword [edx + 4]
mov dword [eax + ebx*8], ecx
add ebx, 1
cmp dword [esi], ebx
ja 0x691c7508
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
mov eax, edx
ret

Function at 0x691c7770
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
lea edi, [ebx - 0xc]
test byte [0x691e0038], 8
jne 0x691c77e8
mov esi, 0xffffffff
lock xadd dword [ebx - 4], esi
sub esi, 1
jne 0x691c77db
mov eax, dword [ebx - 0xc]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebx - 8]
sub esp, 4
test eax, eax
je 0x691c77b7
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x691e263f
mov dword [esp + 8], str.XAPO_Release
mov dword [esp + 4], 0x691e0038
mov dword [esp], 3
call fcn.691c4120
jmp 0x691c7788

Function at 0x691c7820
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov ecx, dword [eax]
test ecx, ecx
je 0x691c7852
xor ebx, ebx
lea esi, [esi]
mov edx, dword [esi + 4]
lea eax, [ebx + ebx*2]
add ebx, 1
lea eax, [edx + eax*4]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.691c7770
cmp dword [esi], ebx
ja 0x691c7838
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x691de8b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x691fb140]
test eax, eax
je 0x691de968
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x691de8f0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x691de8dc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x691de99d
mov dword [esp + 4], 0x691f28a0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x691fb140], eax
sub esp, 8
test eax, eax
jne 0x691de8cd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x691de8de
Function at 0x401000
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push ebx
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40102c
pop edi
pop esi
xor eax, eax
pop ebx
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [0x43b9a4], eax
jne 0x40104a
pop edi
mov dword [0x43b9a4], ebx
pop esi
xor eax, eax
pop ebx
ret
push eax
call fcn.00407d5c
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [0x43b9a0], edi
jne 0x40106b
pop edi
mov dword [0x43b9a4], ebx
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [0x43b9a4]
xor eax, eax
mov edx, ecx
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [0x43b9a4]
mov edx, dword [0x43b9a0]
lea eax, [esp + 0x14]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4010c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x43b9a0]
push eax
call fcn.00407d14
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x43b9a4]
mov eax, dword [esp + 0x10]
cmp eax, ecx
je 0x4010eb
mov ecx, dword [0x43b9a0]
push ecx
call fcn.00407d14
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [0x43b9a0]
cmp ecx, ebx
mov dword [0x43b9b0], ebx
mov dword [0x43b9ac], ebx
mov dword [0x43b9a8], eax
jle 0x401124
mov dl, 0xa
cmp byte [eax], 0xd
jne 0x401116
cmp byte [eax + 1], dl
jne 0x401116
mov byte [eax], dl
mov byte [eax + 1], bl
cmp byte [eax], dl
jne 0x401120
inc dword [0x43b9ac]
inc eax
dec ecx
jne 0x401107
pop edi
pop esi
mov eax, 1
pop ebx
ret