joyce8/EMBER2024-capa huggingface dataset:
Function at 0x86b6e0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0xf0000040
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x14], 0
and ecx, 3
mov dword [esp + 0x10], 0
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x14]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 4
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x86b7d5
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x86b7b5
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x86b7b5
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea edx, [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push edx
push eax
push 4
push ecx
call edi
test eax, eax
je 0x86b7b5
cmp esi, dword [esp + 0x14]
jb 0x86b7b5
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x2c]
push 0
push edx
push ebp
push 2
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x86b7c4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x86b7d5
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x86cff0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push esi
mov esi, 1
push edi
xor ebp, ebp
push esi
push ebp
call dword [0x8d0938]
mov edi, eax
add esp, 8
test edi, edi
je 0x86d044
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x86d05c
cmp esi, ebx
je 0x86d05c
cmp esi, 0x8000
ja 0x86d05c
cmp esi, ebx
jb 0x86d055
push esi
push edi
call dword [0x8d0938]
mov edi, eax
add esp, 8
test edi, edi
jne 0x86d00c
push ebp
call dword [0x8d0934]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x8d0934]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x875350
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [esp + 0x8c]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0x780]
push edi
mov edi, dword [eax]
mov dword [esp + 0x10], 0x80
mov edx, dword [ebx + 0x144]
lea eax, [esp + 0x10]
lea ebp, [ebx + 0x14c]
lea ecx, [esp + 0x18]
push eax
push ecx
mov eax, dword [ebp]
mov ecx, dword [ebx + 0x14]
add edx, 4
push 0
push edx
push eax
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebx + 0x13c], eax
mov eax, dword [ebx + 0x138]
test eax, eax
jne 0x8753d9
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x18]
mov edx, ecx
lea edi, [ebx + 0xb8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov dword [ebx + 0x138], eax
mov eax, dword [ebx + 0x13c]
mov esi, 4
cmp eax, esi
jge 0x87540a
push str.Received_too_short_packet
push edi
call fcn.0085e690
add esp, 8
mov dword [ebx + 0xc], 7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x88
ret
push ebp
call fcn.00875580
and eax, 0xffff
add esp, 4
mov dword [ebx + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x875427
jmp dword [eax*4 + 0x875570]
cmp dword [ebx + 0x13c], esi
jle case.0x875427.4
push ebp
call fcn.00874f30
mov cx, word [ebx + 0x30]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x875427.4
mov edx, dword [ebx + 0x13c]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x9c]
sub edx, esi
add eax, esi
push edx
push eax
push 1
push ecx
call fcn.0085ebc0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x875490
push 5
push ebx
call fcn.00874680
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
mov eax, dword [ebx + 0x13c]
mov ecx, dword [edi + 0x98]
sub eax, 4
cdq
add ecx, eax
mov dword [edi + 0x98], ecx
mov ebp, dword [edi + 0x9c]
adc ebp, edx
mov dword [edi + 0x9c], ebp
mov eax, dword [edi + 0x98]
mov edx, ebp
push edx
push eax
push edi
call fcn.0086bb50
jmp 0x875539
push ebp
call fcn.00874f30
mov ebp, dword [ebp]
and eax, 0xffff
add ebp, esi
mov esi, dword [ebx + 0x13c]
sub esi, 4
mov dword [ebx + 8], eax
push esi
push ebp
call fcn.008755a0
add esp, 0xc
cmp eax, esi
jae case.0x875427.4
push ebp
push str.TFTP_error:__s_n
push edi
call fcn.0085e5d0
jmp 0x875539
mov ecx, dword [ebx + 0x13c]
mov edx, dword [ebp]
sub ecx, 2
add edx, 2
push ecx
push edx
push ebx
call fcn.008755d0
add esp, 0xc
test eax, eax
je case.0x875427.4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
push str.Internal_error:_Unexpected_packet
push 0x8d33b0
push edi
call fcn.0085e690
add esp, 0xc
mov eax, dword [esp + 0x9c]
push eax
call fcn.0086bd30
add esp, 4
test eax, eax
je 0x8753fd
push 5
push ebx
call fcn.00874680
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
Function at 0x877770
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x8777a9
mov ecx, dword [esp + 0x194]
push eax
push str.WSAStartup_failed___d_
push ecx
call fcn.0085e690
add esp, 0xc
mov eax, 2
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ax, word [esp]
cmp al, 2
jne 0x8777c9
xor edx, edx
mov dl, ah
test dl, dl
jne 0x8777c9
xor eax, eax
add esp, 0x190
ret
mov eax, dword [esp + 0x194]
push str.insufficient_winsock_version_to_support_telnet
push eax
call fcn.0085e690
add esp, 8
mov eax, 2
add esp, 0x190
ret

Function at 0x877950
Capabilities:
Send data
Send data on socket

Disassembly:
mov al, byte [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
lea ecx, [esp + 0x14]
mov edx, dword [esi + 0x408]
mov edi, dword [esi]
push 3
push ecx
push edx
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], al
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x87799d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0085e690
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
push eax
push ebx
push str.SENT
push ecx
call fcn.008779c0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x878b40
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push edi
mov eax, dword [eax]
mov dword [esp + 8], eax
mov edi, dword [eax + 0x128]
mov eax, dword [esp + 0x14]
cmp eax, 0x1f
jne 0x878ca9
push ebp
push esi
lea ebp, [edi + 0x1cb0]
lea esi, [edi + 0x1eb0]
cmp ebp, esi
mov dword [esi], ebp
jae 0x878b7d
mov byte [ebp], 0xff
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x878b8b
mov byte [eax], 0xfa
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x878b99
mov byte [eax], 0x1f
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov cx, word [edi + 0x1ca8]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push ecx
call ebx
mov dx, word [edi + 0x1caa]
mov dword [esp + 0x1c], eax
push edx
call ebx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x878bc8
mov dl, byte [esp + 0x1c]
mov byte [ecx], dl
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x878bd9
mov dl, byte [esp + 0x1d]
mov byte [ecx], dl
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x878be6
mov byte [ecx], al
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x878bf3
mov byte [ecx], ah
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x878c01
mov byte [eax], 0xff
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x878c0f
mov byte [eax], 0xf0
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
mov ebx, dword [esp + 0x10]
mov ecx, eax
lea edx, [edi + 0x1cb2]
sub ecx, ebp
mov dword [edi + 0x1eb4], eax
sub ecx, 2
mov dword [esi], ebp
push ecx
push edx
push 0x3e
push ebx
call fcn.00878830
add esp, 0x10
mov esi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push ebp
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp + 0x408]
push eax
call esi
test eax, eax
jge 0x878c68
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0085e690
add esp, 0xc
lea ecx, [edi + 0x1cb3]
push 4
push ecx
push ebp
call fcn.00878cb0
mov edx, dword [ebp + 0x408]
add esp, 0xc
add edi, 0x1cb7
push 0
push 2
push edi
push edx
call esi
pop esi
pop ebp
test eax, eax
jge 0x878ca9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0085e690
add esp, 0xc
pop edi
pop ebx
pop ecx
ret
Function at 0x87b270
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
shr eax, 0x1f
mov ebx, dword [edi]
add edx, eax
cmp edx, 2
je 0x87b2ac
push str.Couldnt_set_desired_mode
push ebx
call fcn.0085e690
add esp, 8
mov eax, 0x11
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x87b2c3
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0085e5d0
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 0x13
jne 0x87b2db
push edi
call fcn.00879c30
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x87b2ef
push edi
call fcn.0087b320
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x87b303
push edi
call fcn.0087b430
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x87b313
push edi
call fcn.0087b450
add esp, 4
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x87ba60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov ebp, dword [ebx + 0x40c]
mov esi, dword [ebx]
lea eax, [esp + 0x20]
push edi
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
or edi, 0xffffffff
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x87baae
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebp
push ebx
call fcn.00864580
add esp, 8
cmp edi, 0xffffffff
jne 0x87bad8
push str.Error_accept__ing_server_connect
push esi
call fcn.0085e690
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push str.Connection_accepted_from_server_n
push esi
call fcn.0085e5d0
push 1
push edi
mov dword [ebx + 0x544], 0
mov dword [ebx + 0x40c], edi
call fcn.00888d90
mov dword [ebx + 0x85c], 1
mov eax, dword [esi + 0x600]
add esp, 0x10
test eax, eax
je 0x87bb51
push 1
push esi
call fcn.0085e570
mov ecx, dword [esi + 0x604]
push 1
push edi
push ecx
call dword [esi + 0x600]
push 0
push esi
mov edi, eax
call fcn.0085e570
add esp, 0x1c
test edi, edi
je 0x87bb51
push ebx
call fcn.0087a570
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x886ad0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push 0
push 0
push 0x4004747b
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x886b12
lea edx, [esp + 0xc]
push 4
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
pop ecx
ret

Function at 0x887410
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
test eax, eax
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
je 0x88742a
cmp dword [eax], 0
jne 0x887444
test ebx, ebx
je 0x887433
cmp dword [ebx], 0
jne 0x887444
test esi, esi
je 0x8874d8
cmp dword [esi], 0
je 0x8874d8
mov ecx, dword [esp + 0x24]
push ebp
test ecx, ecx
lea ebp, [esp + 0xc]
jge 0x887455
xor ebp, ebp
jmp 0x887498
jle 0x88748c
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0xc], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
shl edx, 3
mov dword [esp + 0x10], edx
jmp 0x887498
test ecx, ecx
jne 0x887498
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
test esi, esi
je 0x8874a5
cmp dword [esi], 0
je 0x8874a5
mov edx, esi
jmp 0x8874a7
xor edx, edx
test ebx, ebx
je 0x8874b4
cmp dword [ebx], 0
je 0x8874b4
mov ecx, ebx
jmp 0x8874b6
xor ecx, ecx
test eax, eax
je 0x8874bf
cmp dword [eax], 0
jne 0x8874c1
xor eax, eax
push ebp
push edx
push ecx
push eax
mov eax, dword [esp + 0x28]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebp
pop esi
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x24]
push ecx
call fcn.008873e0
add esp, 4
pop esi
pop ebx
add esp, 8
ret
Function at 0x88c3a0
Capabilities:
Move file

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.008669f0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 1
push ebx
push ebp
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x88c401
push edi
push esi
call fcn.008669f0
push edx
push eax
call fcn.00866a90
add esp, 0x10
test edx, edx
jl 0x88c408
jg 0x88c3de
test eax, eax
jb 0x88c408
test edx, edx
jg 0x88c408
jl 0x88c3eb
cmp eax, 0x3e8
ja 0x88c408
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x88c3c3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x890f40
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x890f72
push 0x2e
push esi
call fcn.008513f0
add esp, 8
test eax, eax
je 0x890f70
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x890fc0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x20
push 0xf0000040
push 1
push 0
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x890fe9
add esp, 0x20
ret
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x10], ecx
push edx
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0x14], 8
mov dword [esp + 0x24], ecx
mov byte [esp + 0x15], 2
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.008910c0
lea ecx, [esp + 0x20]
push 8
push ecx
call fcn.008966f0
mov ecx, dword [esp + 0x10]
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push 0
push 0
push 0x14
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x891068
mov edx, dword [esp]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 4]
mov dword [eax + 4], ecx
lea ecx, [esp + 4]
push edx
mov edx, dword [esp + 0xc]
push ecx
push eax
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
add esp, 0x20
ret
Function at 0x8967a0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0xf0000040
push 1
lea edi, [esi + 4]
push 0
push 0
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x8967de
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret

Function at 0x8967f0
Capabilities:
Hash data via wincrypt

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
ret

Function at 0x8971d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push eax
call dword [0x8d0930]
mov edi, eax
add esp, 4
test edi, edi
jne 0x8971f3
pop edi
pop esi
ret
lea eax, [edi + 0xc]
push ebx
mov dword [edi], esi
mov dword [edi + 4], eax
mov ebx, dword [esi + 0xc]
mov edx, eax
add edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [edi + 8], edx
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
push ebp
jbe 0x89723e
push eax
call dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
push ebx
push eax
push ecx
call dword [esi + 4]
mov ebx, dword [edi + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [edi + 4]
add ebx, eax
push edx
push ebx
call dword [esi + 8]
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x1c], eax
jmp 0x897242
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi + 4]
push ecx
call dword [esi]
mov edx, dword [edi + 8]
push edx
call dword [esi]
mov eax, dword [esp + 0x24]
add esp, 8
xor ebp, ebp
test eax, eax
jbe 0x8972a8
mov dword [esp + 0x1c], eax
mov ebp, eax
mov al, byte [ebx]
mov cl, byte [0x8cb10c]
xor al, cl
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
mov edx, dword [edi + 4]
push 1
push ecx
push edx
call dword [esi + 4]
mov al, byte [ebx]
mov dl, byte [0x8cb10d]
xor al, dl
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
mov edx, dword [edi + 8]
push 1
push ecx
push edx
inc ebx
call dword [esi + 4]
mov eax, dword [esp + 0x34]
add esp, 0x18
dec eax
mov dword [esp + 0x1c], eax
jne 0x897261
cmp ebp, dword [esi + 0x10]
jae 0x8972d4
mov eax, dword [edi + 4]
push 1
push 0x8cb10c
push eax
call dword [esi + 4]
mov ecx, dword [edi + 8]
push 1
push 0x8cb10d
push ecx
call dword [esi + 4]
mov eax, dword [esi + 0x10]
add esp, 0x18
inc ebp
cmp ebp, eax
jb 0x8972ad
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x899685
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x8996a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0084be35
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x8996c8
test byte [esp + 8], 2
je 0x8996c8
call fcn.0084bea8
mov dword [eax], 0xd
call fcn.0084beb1
mov dword [eax], 5
jmp 0x8996a1
xor eax, eax
ret
Function at 0x10004676
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100306c4
call fcn.10013590
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100046f3
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x100046f3
call fcn.10002c1c
mov esi, eax
jmp 0x100047ca
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10004716
call fcn.10002c1c
jmp 0x100047bd
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000470c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10004746
mov esi, 0x8007000e
jmp 0x100047bf
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.100027e3
jmp 0x1000476c
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000473f
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000470c
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000453d
mov esi, eax
test edi, edi
je 0x100047ca
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x100047e3
lea ecx, [ebp - 0x418]
call fcn.1000379b
mov eax, esi
call fcn.100134b0
ret 0x10
Function at 0x1000819e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x10030b87
call fcn.100134d0
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.100038ff
push eax
lea ecx, [edi + 4]
call fcn.10001c63
mov ebx, dword [ebp + 8]
lea ecx, [edi + 4]
and dword [ebp - 4], 0
push ebx
call fcn.1000c118
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000824a
and dword [edi], 0
test ebx, ebx
je 0x10008252
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
push 0x3a
pop ecx
cmp eax, 2
jne 0x100081fd
cmp word [ebx + 2], cx
jne 0x100081fd
mov dword [edi], 1
push ebx
call esi
cmp eax, 3
jne 0x1000821b
push 0x3a
pop eax
cmp word [ebx + 2], ax
jne 0x1000821b
cmp word [ebx + 4], 0x5c
jne 0x1000821b
mov dword [edi], 1
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10008241
mov dword [edi], 1
jmp 0x10008252
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10008252
shr eax, 4
and eax, 1
mov dword [edi], eax
mov eax, edi
call fcn.10013470
ret 4

Function at 0x100085d4
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100468a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x100472a8
mov dword [0x100472a8], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10008699
push 0x40
pop esi
push esi
push eax
lea eax, [ebp - 0x44]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x4c], 1
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], esi
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000866e
movsx eax, byte [ebp - 0x44]
sub eax, 0x30
mov dword [0x100472b8], 2
mov dword [0x100472ac], eax
lea eax, [ebp - 0x42]
push eax
call sub.msvcrt.dll_atoi
mov edx, eax
pop ecx
mov dword [0x100472b0], edx
jmp 0x1000869f
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, ax
xor ecx, ecx
shr edx, 8
cmp al, 4
movzx esi, al
seta cl
mov dword [0x100472ac], esi
inc ecx
mov dword [0x100472b0], edx
mov dword [0x100472b8], ecx
jmp 0x100086a5
mov edx, dword [0x100472b0]
mov esi, dword [0x100472ac]
cmp esi, 6
ja 0x100086b1
jne 0x100086cf
cmp edx, 2
jb 0x100086cf
push str.RtlGetVersion
push 0x10032f9c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100086cf
push edi
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002e36c
leave
ret