joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100d0580
push 0x10080750
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100d65e8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edx, ecx
mov dword [ebp - 0x20], edx
mov edi, dword [ebp + 8]
mov dword [edi], 0
xor esi, esi
cmp ebx, 4
jl 0x10036fa5
mov eax, ebx
and eax, 0x80000003
jns 0x10036e7c
dec eax
or eax, 0xfffffffc
inc eax
jne 0x10036fa5
mov dword [ebp - 4], esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
jge 0x10036eac
mov al, byte [ecx + edx]
cmp al, 0x80
jae 0x10036f9e
movzx eax, al
cmp byte [eax + 0x100d81e8], 0xff
je 0x10036f9e
inc ecx
jmp 0x10036e87
push ebx
call fcn.1007d096
mov dword [ebp - 0x1c], eax
push ebx
push 0
push eax
call fcn.1007f340
add esp, 0x10
mov edx, dword [ebp - 0x1c]
cmp esi, ebx
jge 0x10036f71
mov ecx, dword [ebp - 0x20]
movzx eax, byte [esi + ecx]
mov dl, byte [eax + 0x100d81e8]
inc esi
mov dword [ebp - 0x24], esi
movzx eax, byte [esi + ecx]
mov al, byte [eax + 0x100d81e8]
inc esi
mov dword [ebp - 0x24], esi
movzx ecx, al
mov dword [ebp - 0x2c], ecx
shr ecx, 4
and ecx, 3
movzx eax, dl
shl eax, 2
or ecx, eax
mov eax, dword [edi]
mov edx, dword [ebp - 0x1c]
mov byte [edx + eax], cl
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x10036f71
movzx eax, al
mov al, byte [eax + 0x100d81e8]
movzx ecx, al
mov eax, ecx
shr eax, 2
and eax, 0xf
mov edx, dword [ebp - 0x2c]
and edx, 0xf
shl edx, 4
or eax, edx
mov edx, dword [ebp - 0x1c]
mov edi, dword [edi]
mov byte [edi + edx], al
mov edi, dword [ebp + 8]
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x10036f71
movzx eax, al
mov al, byte [eax + 0x100d81e8]
and ecx, 3
shl ecx, 6
movzx eax, al
or ecx, eax
mov eax, dword [edi]
mov byte [eax + edx], cl
inc dword [edi]
jmp 0x10036ec4
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037a00
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov eax, ecx
ret

Function at 0x10037a30
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x10040dc0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100af980
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100d65e8]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x100d65e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 0x100d9cc0
push 0x100bd534
push 1
push 0
push 0x100bd604
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0x100d9cc0], 0
jne 0x10040e40
mov eax, 0xfffffffd
jmp 0x10040f02
lea ecx, [esp + 8]
call fcn.1003dbc0
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 8
jb 0x10040e59
mov eax, dword [eax]
push eax
lea ecx, [esp + 8]
call fcn.1003c790
mov byte [esp + 0x30], 1
mov edx, dword [eax]
test edx, edx
je 0x10040e72
mov edx, dword [edx]
jmp 0x10040e74
xor edx, edx
mov eax, dword [0x100d9cc0]
push 0x100d9cbc
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov byte [esp + 0x30], 0
lea ecx, [esp + 4]
call fcn.1003c830
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x10040eba
push dword [esp + 8]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
cmp dword [0x100d9cc0], eax
jne 0x10040ee0
mov eax, 0xfffffffc
jmp 0x10040f02
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [0x100d9cbc]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
neg eax
sbb eax, eax
and eax, 0xfffffffa
inc eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1007e654
mov esp, ebp
pop ebp
ret
Function at 0x10041900
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37cc
call fcn.10080720
mov eax, dword [0x100d65e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
xor eax, eax
push edi
mov dword [ebp - 0x37c8], eax
xor edi, edi
lea ebx, [ebx]
push edi
lea eax, [ebp - 0x108]
push str..PhysicalDrive_d
push eax
call fcn.10041fe0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10041b05
push 0x2710
xorps xmm0, xmm0
lea eax, [ebp - 0x33d0]
movq qword [ebp - 0x37c4], xmm0
push 0
push eax
mov dword [ebp - 0x37cc], 0
mov dword [ebp - 0x37bc], 0
mov dword [ebp - 0x37c4], 0
mov dword [ebp - 0x37c0], 0
call fcn.1007f340
add esp, 0xc
lea eax, [ebp - 0x37cc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x33d0]
push eax
push 0xc
lea eax, [ebp - 0x37c4]
push eax
push 0x2d1400
push esi
call ebx
test eax, eax
je 0x10041af8
mov edx, dword [ebp - 0x33c4]
lea eax, [ebp - 0xcc0]
push eax
push 0
lea ecx, [ebp - 0x33d0]
call fcn.100417a0
mov edx, dword [ebp - 0x33c0]
lea eax, [ebp - 0x8d8]
push eax
push 0
lea ecx, [ebp - 0x33d0]
call fcn.100417a0
mov edx, dword [ebp - 0x33bc]
lea eax, [ebp - 0x37b8]
push eax
push 0
lea ecx, [ebp - 0x33d0]
call fcn.100417a0
mov edx, dword [ebp - 0x33b8]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x33d0]
call fcn.100417a0
add esp, 0x20
cmp byte [0x100dadc0], 0
jne 0x10041abf
mov al, byte [ebp - 0x4f0]
test al, al
je 0x10041abf
cmp al, 0xa
je 0x10041abf
movsx eax, al
push eax
call fcn.1008056b
add esp, 4
test eax, eax
jne 0x10041a86
movsx eax, byte [ebp - 0x4dd]
push eax
call fcn.1008056b
add esp, 4
test eax, eax
je 0x10041abf
lea eax, [ebp - 0x4f0]
push eax
push 0x400
push 0x100dadc0
call fcn.10082250
lea eax, [ebp - 0x8d8]
push eax
push 0x400
push 0x100da9c0
call fcn.10082250
add esp, 0x18
mov dword [ebp - 0x37c8], 1
push 0x2710
lea eax, [ebp - 0x33d0]
push 0
push eax
call fcn.1007f340
add esp, 0xc
lea eax, [ebp - 0x37cc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x33d0]
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
jmp 0x10041afe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x10041930
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x37c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007e654
mov esp, ebp
pop ebp
ret
Function at 0x10041d70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x100d65e8]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x100bd8b9
push 0x400
push 0x100dadc0
xor edi, edi
call fcn.10082250
add esp, 0xc
lea eax, [esp + 8]
push 0x114
push edi
push eax
call fcn.1007f340
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 2
jne 0x10041df4
call fcn.10041420
test eax, eax
jne 0x10041e10
call fcn.10041c30
test eax, eax
jne 0x10041e10
call fcn.10041900
test eax, eax
jne 0x10041e10
call fcn.10041650
jmp 0x10041e10
xor esi, esi
test edi, edi
jne 0x10041e10
cmp byte [0x100dadc0], 0
jne 0x10041e10
call fcn.10041b30
inc esi
mov edi, eax
cmp esi, 0xa
jl 0x10041df6
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, esp
mov eax, 0x100dadc0
call fcn.1007e654
mov esp, ebp
pop ebp
ret
Function at 0x10042c80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afe29
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x100d65e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x74], 0
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov dword [ebp - 0x80], ebx
mov word [ebx], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x74], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10019c30
mov dword [ebp - 0x7c], eax
mov dword [ebp - 4], 1
call fcn.10033480
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10019c30
add esp, 0x10
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0xa4]
mov ecx, 6
cmp cx, ax
je 0x10042d3d
mov ecx, 9
cmp cx, ax
je 0x10042d3d
xor al, al
jmp 0x10042d3f
mov al, 1
movzx eax, al
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10019c30
mov edi, eax
mov byte [ebp - 4], 3
call fcn.10033560
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10019c30
add esp, 0x10
mov esi, eax
mov byte [ebp - 4], 4
push 4
push str.il
mov ecx, ebx
call fcn.100068c0
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.100067b0
push 4
push str.ob
mov ecx, eax
call fcn.100068c0
push 0xffffffffffffffff
push 0
push edi
mov ecx, eax
call fcn.100067b0
push 4
push str.ov
mov ecx, eax
call fcn.100068c0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x78]
mov ecx, eax
call fcn.100067b0
push 4
push str.ts
mov ecx, eax
call fcn.100068c0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x7c]
mov ecx, eax
call fcn.100067b0
push 5
push str.tp3
mov ecx, eax
call fcn.100068c0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 8
jb 0x10042df9
push dword [ebp - 0x28]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 8
jb 0x10042e22
push dword [ebp - 0x40]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x5c], 8
jb 0x10042e4b
push dword [ebp - 0x70]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
mov byte [ebp - 4], al
cmp dword [ebp - 0x44], 8
jb 0x10042e73
push dword [ebp - 0x58]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov word [ebp - 0x58], ax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007e654
mov esp, ebp
pop ebp
ret
Function at 0x10043360
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [esi + 8]
mov dword [esi + 4], edi
cmp ecx, eax
je 0x10043381
push 0xffffffffffffffff
push 0
push eax
call fcn.1000f660
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
cmp edi, 8
je 0x100433a1
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
test al, al
je 0x100433a1
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0xc
push 0
push 0
push esi
push 0x10043cb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc

Function at 0x10047070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b07b0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100d65e8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x100d65e8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x28]
call fcn.1001f3b0
mov byte [esp + 0x50], 1
cmp word [esi], 0
jne 0x100470e1
xor ecx, ecx
jmp 0x100470f5
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100470e6
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x30]
call fcn.100068c0
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push 0x20019
push eax
push SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.10036580
mov esi, dword [esp + 0x10]
test eax, eax
jne 0x10047191
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push str.Flags
push esi
mov dword [esp + 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x10047166
cmp dword [esp + 0x20], 4
mov eax, 0xd
cmovne edi, eax
test esi, esi
je 0x10047177
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
test edi, edi
jne 0x10047191
test dword [esp + 0x1c], 1
je 0x10047191
xor bl, bl
jmp 0x10047193
mov bl, 1
mov byte [esp + 0x50], 0
cmp dword [esp + 0x3c], 8
jb 0x100471ab
push dword [esp + 0x28]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
mov dword [esp + 0x50], 0xffffffff
test esi, esi
je 0x100471e7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
jmp 0x100471eb
mov dword [esp + 0x14], eax
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1007e654
mov esp, ebp
pop ebp
ret
Function at 0x10047300
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0656
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x100d65e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 4], 0
cmp dword [edx + 0x14], 8
jb 0x10047364
mov edx, dword [edx]
push 0x20019
push edx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x23c]
call fcn.10036580
test eax, eax
jne 0x10047540
mov esi, dword [ebp - 0x23c]
lea ecx, [ebp - 0x250]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
push esi
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1004750f
mov esi, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
xor ebx, ebx
add eax, edx
je 0x10047432
xor edi, edi
cmp dword [edi + esi + 0x14], 8
mov ecx, dword [edi + esi + 0x10]
lea eax, [edi + esi]
jb 0x100473f1
mov eax, dword [eax]
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100813b7
add esp, 0xc
test eax, eax
je 0x10047444
mov eax, dword [ebp - 0x240]
inc ebx
mov esi, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add edi, 0x18
cmp ebx, eax
jb 0x100473e1
mov edi, dword [ebp - 0x240]
mov eax, dword [ebp - 0x248]
mov esi, dword [ebp - 0x23c]
inc eax
jmp 0x10047388
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x10047496
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10047487
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.1000f9f0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x23c]
push 0x100db248
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.10046ee0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x21c], 8
jb 0x100474e0
push dword [ebp - 0x230]
call fcn.1007d9ed
add esp, 4
mov edi, dword [ebp - 0x240]
xor eax, eax
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
inc eax
jmp 0x10047388
test esi, esi
je 0x1004752c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov bl, 1
jmp 0x10047548
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x238], 0
mov bl, 1
jmp 0x10047548
mov eax, dword [ebp - 0x23c]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x10047564
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], 0
mov al, bl
mov dword [ebp - 0x238], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007e654
mov esp, ebp
pop ebp
ret
Function at 0x1004a410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
test ebx, ebx
jne 0x1004a46a
cmp byte [esi + 0x2c], bl
jne 0x1004a461
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
lea edi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004a440
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.10048b00
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov edi, dword [esi + 0x18]
test edi, edi
je 0x1004a480
mov ecx, edi
mov edi, dword [edi + 0x28]
mov eax, dword [ecx]
push 1
call dword [eax]
test edi, edi
jne 0x1004a471
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.10084e25
push ebx
call fcn.10092855
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.10084e25
add esp, 0x1c
test edi, edi
jg 0x1004a4ec
cmp byte [esi + 0x2c], 0
jne 0x1004a461
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
lea edi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004a4e0
jmp 0x1004a447
lea eax, [edi + 1]
push eax
call fcn.1007d99e
push ebx
mov ebx, dword [ebp + 8]
push 1
mov edi, eax
push ebx
push edi
mov byte [edi], 0
call fcn.100a0990
add esp, 0x14
cmp eax, 1
je 0x1004a544
push edi
call fcn.1007d9ed
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x1004a461
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004a538
jmp 0x1004a447
mov byte [edi + ebx], 0
cmp byte [edi], 0
mov eax, edi
mov ecx, edi
je 0x1004a56d
mov dl, byte [eax]
cmp dl, 0xd
jne 0x1004a564
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0xa
jne 0x1004a568
jmp 0x1004a567
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x1004a551
push 0
mov byte [ecx], 0
mov eax, dword [esi]
push 0
push edi
mov ecx, esi
call dword [eax + 8]
push edi
call fcn.1007d9ed
add esp, 4
xor eax, eax
cmp byte [esi + 0x2c], al
pop edi
pop esi
sete al
pop ebx
pop ebp
ret 8
Function at 0x1004ad30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0cac
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100d65e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.TiXmlBase.0
mov dword [ebx + 8], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebx], vtable.TiXmlNode.0
mov dword [ebx + 0x20], 0x100d9cc4
mov byte [ebp - 4], 1
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 5
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebp - 4], 2
lea ecx, [ebx + 0x2c]
mov dword [ebx], vtable.TiXmlDeclaration.0
mov dword [ecx], 0x100d9cc4
mov byte [ebp - 4], 3
mov dword [ebx + 0x30], 0x100d9cc4
mov byte [ebp - 4], 4
mov dword [ebx + 0x34], 0x100d9cc4
mov byte [ebp - 4], 5
push 3
push 0x100bde10
call fcn.10048b00
push 5
push str.UTF_8
lea ecx, [ebx + 0x30]
call fcn.10048b00
push 0
push 0x100bd8b9
lea ecx, [ebx + 0x34]
call fcn.10048b00
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10050410
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
xorps xmm0, xmm0
push edi
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0
movq qword [ebp - 0x28], xmm0
movq qword [ebp - 0x20], xmm0
movq qword [ebp - 0x18], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
xor ebx, ebx
sub edx, 1
sbb ebx, ebx
and eax, edx
mov dword [edi], eax
mov eax, edx
mov dword [ebp - 4], edx
not eax
mov dword [ebp - 8], ebx
mov dword [ebp + 0x20], eax
and eax, dword [ebp + 8]
not ebx
mov dword [ecx], eax
mov edx, ebx
and edx, dword [ebp + 0xc]
mov dword [ecx + 4], edx
mov eax, dword [edi]
mov ecx, dword [ebp + 0x1c]
cdq
add eax, dword [ebp - 4]
pop edi
adc edx, dword [ebp - 8]
add eax, dword [ebp + 0x10]
pop esi
adc edx, dword [ebp + 0x14]
and eax, dword [ebp + 0x20]
and edx, ebx
mov dword [ecx], eax
mov dword [ecx + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10050550
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push 0
cmp byte [esi + 0x10], 0
push 0
mov ecx, 0x1000002
push 0
mov eax, 2
cmovne eax, ecx
push eax
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp edx, dword [0x100d87b0]
jne 0x100505f5
cmp ecx, dword [0x100d87b4]
jne 0x100505f5
mov eax, dword [edi + 8]
cmp eax, dword [0x100d87b8]
jne 0x100505f5
mov eax, dword [edi + 0xc]
cmp eax, dword [0x100d87bc]
jne 0x100505f5
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1005066e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, edx
add ecx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x1005066e
jb 0x100505ee
cmp ecx, 0x7ffffffe
ja 0x1005066e
mov dword [esi + 8], edx
xor ecx, ecx
jmp 0x10050646
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0xc]
xorps xmm0, xmm0
push dword [edi + 8]
movlpd qword [ebp - 0x14], xmm0
push ecx
push edx
call fcn.10050410
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
cdq
add esp, 0x1c
add eax, dword [edi + 8]
adc edx, dword [edi + 0xc]
mov dword [ebp - 8], eax
test ecx, ecx
jl 0x1005066e
mov ebx, dword [ebp - 0x14]
jg 0x10050636
test ebx, ebx
jb 0x1005066e
test edx, edx
jl 0x1005066e
jg 0x10050640
test eax, eax
jb 0x1005066e
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
push dword [ebp - 8]
push ebx
push ecx
push 4
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
test eax, eax
je 0x1005066e
add eax, dword [ebp - 4]
pop edi
mov dword [esi + 4], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4