joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007ed0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x10025080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x210], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x1001e1e4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x218], eax
cmp dword [ebp + 0xc], 1
jb 0x10007f23
cmp dword [ebp + 0xc], 0x1000
jbe 0x10007f35
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1000810e
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.100062d0
test eax, eax
jne 0x10007f5b
jmp 0x1000810e
cmp dword [ebp - 0x218], 0
je 0x10007f70
cmp dword [ebp - 0x218], 0x104
jb 0x10007f7a
jmp 0x1000810e
push 0x1001e1ec
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.100059d0
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x10007fa9
jmp 0x1000810e
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x210]
lea eax, [edx + ecx + 0xc]
push eax
push 0x1001e204
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.10006be0
add esp, 0x10
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x10007fee
jmp 0x1000810e
push 0x10
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.1000aa60
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.1000aa60
add esp, 0xc
mov dword [ebp - 0x274], 0x44
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x274]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x1000810e
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
push 0x1001e28c
mov edx, dword [ebp - 0x230]
push edx
call fcn.10007730
test eax, eax
jne 0x100080a3
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000810e
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x21c], 0x1f4
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x21c], 0
je 0x10008104
jmp 0x1000810e
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x210]
push eax
call fcn.10006710
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009a3f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10008130
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x10025080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x418], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.WINDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x420], eax
cmp dword [ebp + 0xc], 1
jb 0x10008183
cmp dword [ebp + 0xc], 0x1000
jbe 0x10008195
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1000837b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.100062d0
test eax, eax
jne 0x100081bb
jmp 0x1000837b
cmp dword [ebp - 0x420], 0
je 0x100081d0
cmp dword [ebp - 0x420], 0x104
jb 0x100081da
jmp 0x1000837b
push str._sysnative_rundll32.exe
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.10006b30
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jge 0x10008209
jmp 0x1000837b
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x418]
lea eax, [edx + ecx + 0xc]
push eax
push str.rundll32.exe___hs__1
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call fcn.10006c40
add esp, 0x10
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jge 0x1000824e
jmp 0x1000837b
push 0x10
push 0
lea edx, [ebp - 0x438]
push edx
call fcn.1000aa60
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x47c]
push eax
call fcn.1000aa60
add esp, 0xc
mov dword [ebp - 0x47c], 0x44
lea ecx, [ebp - 0x438]
push ecx
lea edx, [ebp - 0x47c]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [ebp + 0x14]
test eax, eax
je 0x1000837b
mov edx, dword [ebp - 0x418]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
push 0x1001e28c
mov edx, dword [ebp - 0x438]
push edx
call fcn.10007730
test eax, eax
jne 0x10008303
push 0xffffffffffffffff
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000837b
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x424], 0x1f4
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x424], 0
je 0x10008371
jmp 0x1000837b
mov dword [ebp - 0x428], 1
lea ecx, [ebp - 0x418]
push ecx
call fcn.10006710
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009a3f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10010721
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10010760
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010760
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010760
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10010760
cmp dword [ecx + 0x74], 0xe
jbe 0x10010760
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10014a9e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10014b3b
push ebx
push esi
call fcn.10014a67
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100149fb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10014ae8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014b3a
push edi
push eax
call fcn.10011885
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10014b08
call fcn.1001184b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10014b39
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100149fb
add esp, 0x20
test eax, eax
jne 0x10014b27
push edi
call fcn.1001184b
jmp 0x10014b2f
push ebx
call fcn.1001184b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10014da8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001fb84
push 0x1001fb7c
push str.FlsAlloc
push 0x1f
call fcn.10014cc4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014ddc
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d274]
call esi
jmp 0x10014de2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10014e26
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001fb94
push 0x1001fb8c
push str.FlsGetValue
push 0x21
call fcn.10014cc4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014e5d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d274]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10014e65
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001fb9c
push 0x1001fb94
push str.FlsSetValue
push 0x22
call fcn.10014cc4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014e9f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001d274]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001c5b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001c5dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001c5dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10004440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10004474
sub eax, 1
jne 0x1000447a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0x10002530
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
mov eax, 1
pop ebp
ret 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
pop ebp
ret 0xc
Function at 0x100088b0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10010228
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100163d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov edi, dword [ebp + 0xc]
mov bh, 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [edi + 1]
push eax
call fcn.1000e7ea
mov esi, eax
add esp, 4
test esi, esi
je 0x1000890c
lea eax, [edi + 1]
push eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1000890e
xor esi, esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push edi
push esi
push dword [ebp - 0x24]
mov dword [ebp - 0x1c], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
setne bl
test eax, eax
je 0x10008982
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10008982
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], esi
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x100089b1
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [eax + 8]
call eax
mov bh, al
test bh, bh
je 0x10008982
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ebp - 0x24]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
setne bl
test eax, eax
jne 0x10008937
and bl, bh
test esi, esi
je 0x10008991
push esi
call fcn.1000e7e5
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e652
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
Function at 0x1000a360
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x1004bf84
push 0x64
call fcn.1000ee7c
mov esi, eax
add esp, 8
test esi, esi
je 0x1000a4cb
push 0x63
lea ecx, [esi + 1]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 4]
mov byte [esi], 1
push 2
push eax
call sub.MSVCP140.dll__Mtx_init_in_situ
lea eax, [esi + 0x34]
push eax
call sub.MSVCP140.dll__Cnd_init_in_situ
xorps xmm0, xmm0
mov dword [0x1003be20], esi
add esp, 0x18
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x1000a3de
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000a3d3
cmp byte [eax], 0
je 0x1000a3d3
push eax
push esi
call fcn.1000a950
jmp 0x1000a3db
push 0
push esi
call fcn.1000a8d0
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x10016730
mov dword [0x1003bc1c], eax
call sub.MSVCP140.dll__Mtx_lock
add esp, 4
test eax, eax
jne 0x1000a4da
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000a415
movups xmm0, xmmword [eax]
movups xmmword [0x100377d4], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x1000a41f
xorps xmm0, xmm0
movups xmmword [0x100377d4], xmm0
movq qword [0x100377e4], xmm0
xorps xmm0, xmm0
push 0x10016730
movups xmmword [0x100377ec], xmm0
movq qword [0x100377fc], xmm0
call sub.MSVCP140.dll__Mtx_unlock
add esp, 4
cmp dword [0x100377d0], 0
jne 0x1000a4d5
push esi
call fcn.1000dbc0
mov dword [0x100377d0], eax
mov dword [eax + 8], 0x10008c90
mov eax, dword [0x100377d0]
mov dword [eax + 0xc], 0x10008c40
mov al, 1
mov esi, dword [0x1003be20]
xchg byte [esi], al
push 4
call fcn.1000e663
add esp, 8
test eax, eax
je 0x1000a48d
mov dword [eax], esi
jmp 0x1000a48f
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10008ca0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1000a4e0
cmp dword [esi + 0x60], 0
je 0x1000a4bd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x1003be20], 0
pop esi
mov esp, ebp
pop ebp
ret
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1000a950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x100163d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push 0
push str.SoftwareValveSteam
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000a9c4
push str.Error_opening_Steam_key_n
jmp 0x1000aa84
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000aa7f
mov ecx, dword [ebp - 0xa94]
cmp ecx, 1
jb 0x1000aa7f
shr ecx, 1
mov eax, esi
je 0x1000aa38
lea edx, [esi + 0x5c]
nop word [eax + eax]
cmp word [ebp + eax*2 - 0x28c], 0x2f
jne 0x1000aa33
mov word [ebp + eax*2 - 0x28c], dx
inc eax
cmp eax, ecx
jb 0x1000aa20
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push str.__s__steam:__rungameid__s
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.1000a860
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1000a570
add esp, 0x1c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e652
mov esp, ebp
pop ebp
ret
push str.Error_reading_SteamExe_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.1000aac0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.1000e652
mov esp, ebp
pop ebp
ret
Function at 0x1000ab30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100163d4]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x10011588]
push ebx
push esi
push edi
push 0
push 0
mov dword [ebp - 0xc], eax
mov esi, ecx
mov ax, word [0x1001158c]
push 3
movups xmmword [ebp - 0x34], xmm0
push 0
movups xmm0, xmmword [0x10011570]
mov word [ebp - 8], ax
mov eax, 0x30
push 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push 0xc0000000
movq xmm0, qword [0x10011580]
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x1000ac00
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x1000abc9
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x1000ac16
inc ax
mov word [ebp - 0xa], ax
jmp 0x1000abdf
cmp eax, 0xe7
jne 0x1000ac16
push 0x2710
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x1000ac16
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1000abb0
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e652
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e652
mov esp, ebp
pop ebp
ret
Function at 0x10001570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x100016dc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100016dc
mov ecx, dword [esi + 0x3cc]
xor edx, edx
div ecx
mov dword [ebp - 4], eax
test edx, edx
jne 0x100016dc
mov edx, dword [ebp + 0x14]
push ebx
push edi
cmp edx, 1
jne 0x10001638
mov edi, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0x14], edx
mov dword [ebp - 4], edi
mov dword [ebp + 8], ebx
test eax, eax
je 0x100016da
lea ebx, [esi + 0x3f4]
nop
cmp byte [esi + 4], 0
mov eax, ebx
je 0x100015f5
xor edx, edx
test ecx, ecx
jle 0x100015f5
sub edi, ebx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x100015e0
mov edi, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100016f0
push dword [esi + 0x3cc]
push dword [ebp + 8]
push ebx
call fcn.1002dd30
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
add edi, ecx
div ecx
inc dword [ebp + 0x14]
add esp, 0xc
add dword [ebp + 8], ecx
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], eax
jb 0x100015d0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 2
jne 0x100016a7
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ebx
jbe 0x100016da
lea eax, [esi + 0x3f4]
push edi
push eax
mov ecx, esi
call fcn.100016f0
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.10001db0
push dword [esi + 0x3cc]
lea eax, [esi + 0x3f4]
push edi
push eax
call fcn.1002dd30
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
inc ebx
div ecx
add dword [ebp + 8], ecx
add esp, 0xc
add edi, ecx
cmp ebx, eax
lea eax, [esi + 0x3f4]
jb 0x10001657
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], edi
jbe 0x100016da
push eax
push ebx
mov ecx, esi
call fcn.100016f0
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
inc edi
div ecx
add dword [ebp + 8], ecx
add ebx, ecx
cmp edi, eax
mov eax, dword [ebp + 8]
jb 0x100016b7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x10001de3
xor edx, edx
cmp dword [esi + 0x3cc], edx
jle 0x10001de3
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
nop
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x10001dd0
pop edi
pop esi
pop ebp
ret 8
Function at 0x10002fa0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, dword [ebp + 8]
xor bl, bl
cmp dword [edi + 0x10], 0
je 0x100030da
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x100030d1
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10002fcf
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
test eax, eax
je 0x100030d1
push 0x10070758
push eax
call fcn.1001711d
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x100030d1
cmp dword [esi + 0x14], 0x10
jb 0x10003005
mov esi, dword [esi]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100030b7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x100566c4
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100030b7
mov eax, dword [ebp - 0xc]
push 0x10070758
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 4], ecx
call fcn.1001711d
mov esi, eax
add esp, 8
test esi, esi
je 0x100030b9
cmp dword [edi + 0x14], 0x10
jb 0x10003069
mov edi, dword [edi]
push edi
push dword [ebp - 4]
push str.StringFileInfo_08lx_s
push 0x80
push esi
call fcn.10003110
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100030b3
mov edx, dword [ebp - 0x14]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100030a0
sub ecx, edi
push ecx
mov ecx, dword [ebp + 0x10]
push edx
call fcn.10001eb0
mov bl, 1
jmp 0x100030b9
xor esi, esi
push dword [ebp + 8]
call fcn.100170e7
add esp, 4
test esi, esi
je 0x100030d1
push esi
call fcn.100170e7
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret