joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d60
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1004828
call fcn.01002f54
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1006380
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1002b17
cmp eax, esi
jne 0x1002b0a
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1002b1a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002af1
xor esi, esi
inc esi
mov eax, dword [0x100637c]
cmp eax, esi
jne 0x1002b2d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002b5c
mov eax, dword [0x100637c]
test eax, eax
jne 0x1002b56
mov dword [0x100637c], esi
push 0x100117c
push 0x1001170
call fcn.01002a56
pop ecx
pop ecx
test eax, eax
je 0x1002b5c
jmp 0x1002c84
mov dword [0x1006040], esi
mov eax, dword [0x100637c]
cmp eax, esi
jne 0x1002b80
push 0x100116c
push 0x1001164
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100637c], 2
test ebx, ebx
jne 0x1002b8c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006384], 0
je 0x1002bb0
push 0x1006384
call fcn.01002ec9
pop ecx
test eax, eax
je 0x1002bb0
push 0
push 2
push 0
call dword [0x1006384]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1002c0c
test al, al
je 0x1002bca
cmp dword [ebp - 0x1c], 0
jne 0x1002c0c
mov al, byte [esi]
test al, al
je 0x1002bda
cmp al, 0x20
ja 0x1002bda
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1002bca
test byte [ebp - 0x3c], 1
je 0x1002be6
movzx eax, word [ebp - 0x38]
jmp 0x1002be9
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x100603c], eax
cmp dword [0x1006030], 0
jne 0x1002c60
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1002c1b
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1002c2e
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1002bb7
cmp dword [0x1006040], 0
jne 0x1002c6f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100603c]
jmp 0x1002c90
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002f99
ret
call fcn.010030a2
jmp 0x1002ab7
Function at 0x10033b8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 8]
xor edi, edi
call fcn.01003341
test al, al
je 0x1003433
push dword [ebp - 8]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
cmp esi, edi
je 0x1003433
push ebx
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100342b
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003424
push dword [ebp + 8]
lea ecx, [ebp - 4]
push esi
call fcn.01004709
mov edi, dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x10036a6
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x1001c68
xor edi, edi
inc edi
push edi
push 0
push 0x100148c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1003749
mov eax, dword [ebp - 8]
test eax, eax
je 0x1003749
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x10014ac
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, edi
jne 0x10036f9
mov eax, edi
jmp 0x100374e
test esi, esi
jl 0x1003749
mov eax, dword [ebp - 4]
test eax, eax
je 0x1003749
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1003730
cmp dword [ebp - 0xc], edi
jne 0x1003730
push dword [ebp - 0x10]
mov edi, dword [ebp + 8]
call fcn.0100356c
mov eax, dword [ebp - 4]
test eax, eax
je 0x100373d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
sete al
jmp 0x100374e
mov eax, 0x8000ffff
pop edi
pop esi
leave
ret 4
Function at 0x1003778
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x1003799
xor al, al
jmp 0x1003836
push esi
push edi
push 0xa
pop ecx
mov esi, 0x1001544
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x40]
push eax
push 0x20019
mov esi, 0x100153c
lea edi, [ebp - 0xc]
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov byte [ebp - 0x39], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100382c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop edi
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x40]
mov dword [ebp - 0x44], edi
call esi
test eax, eax
jne 0x1003823
cmp dword [ebp - 0x48], edi
jne 0x1003823
cmp dword [ebp - 0x44], edi
jne 0x1003823
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x40]
call esi
test eax, eax
jne 0x1003823
cmp dword [ebp - 0x4c], edi
sete byte [ebp - 0x39]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp byte [ebp - 0x39], bl
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01002d6f
leave
ret 4

Function at 0x100384a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
lea ecx, [ebp - 0x110]
push ecx
push eax
push 0x80000000
mov dword [ebp - 0x114], 0x104
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10038c7
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10038bb
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10038bb
mov bl, 1
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.01002d6f
leave
ret 4

Function at 0x1003b4f
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x100168c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003ba5
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
jmp 0x1003ba7
xor al, al
leave
ret 8
Function at 0x1003bb0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 2
xor ebx, ebx
push ebx
push 0x100168c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003bfa
push 0x10016bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x1003beb
cmp eax, 2
jne 0x1003bed
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x1003bfc
xor al, al
pop ebx
leave
ret

Function at 0x1003d37
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x208], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x1003d7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80004005
jmp 0x1003ed3
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x20c], eax
cmp eax, ebx
jne 0x1003d97
mov esi, 0x8007000e
jmp 0x1003ed3
push eax
push esi
push dword [ebp - 0x21c]
push dword [ebp - 0x208]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1003dbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80004005
jmp 0x1003ec7
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x1001738
push dword [ebp - 0x20c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x1003ded
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80004005
jmp 0x1003e2b
mov esi, dword [ebp - 0x218]
push 1
push ebx
push ebx
push dword [esi + 8]
call fcn.010047f0
mov ecx, dword [esi + 0xc]
xor ebx, ebx
push 1
add eax, ecx
push ebx
adc edx, ebx
push ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
push dword [esi + 0x10]
call fcn.010047f0
mov ecx, dword [esi + 0x14]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov esi, ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x100171c
push dword [ebp - 0x20c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1003ec7
test dword [ebp - 0x208], 0xfffffffc
jbe 0x1003ec7
mov eax, dword [ebp - 0x214]
lea eax, [eax + ebx*4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push 0x10016f4
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.01003c9e
add esp, 0x14
test eax, eax
jl 0x1003eb9
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1003eb9
push dword [ebp - 0x210]
mov ecx, edi
call fcn.0100331b
mov eax, dword [ebp - 0x208]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x1003e59
push dword [ebp - 0x20c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002d6f
leave
ret 4
Function at 0x1003eea
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, 0x200
push esi
lea ecx, [ebp - 0x204]
push ecx
push 0xffffffffffffffff
push dword [eax + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x204]
push eax
push 0x100173c
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.01003c9e
mov esi, eax
add esp, 0x10
cmp esi, edi
jl 0x1003fa4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 0x80000002
mov dword [ebp - 0x408], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, edi
jne 0x1003f9b
lea eax, [ebp - 0x40c]
push eax
push ebx
push edi
push edi
push edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003f8d
xor esi, esi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1003fa2
or eax, 0x80070000
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01002d6f
leave
ret 8

Function at 0x1004125
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0x14]
push eax
push 0x1001c68
push 1
xor ebx, ebx
push ebx
push 0x100148c
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jl 0x10041f7
lea eax, [ebp - 0x10]
push eax
push 0x10014ec
push 1
push ebx
push 0x100146c
call esi
test eax, eax
jl 0x10041e9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push 0x80
lea edx, [ebp - 8]
push edx
push 0x100149c
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10041e0
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x10041e0
jmp 0x10041c3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push 0x10014bc
push 0x10014cc
call fcn.01003440
test al, al
je 0x10041b7
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.01003fb9
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 4]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x1004190
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0xc], ebx
jne 0x1004203
mov eax, dword [ebp + 8]
cmp byte [eax], bl
jne 0x1004203
xor eax, eax
inc eax
jmp 0x1004206
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 4
Function at 0x1004211
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
push 0x1001798
push 0xfe
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x1001794
push esi
push 0x1001788
mov edi, 0x1001784
push edi
call ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1004288
push 0x1001798
push 0xfe
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x100177c
push edi
call ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10043f3
push 0x1001774
push 0xff
lea ebx, [ebp - 0x20c]
call fcn.0100363c
mov esi, dword [ebp - 0x210]
mov eax, ebx
push eax
mov ecx, esi
call fcn.010032f5
mov ebx, 0x105
push ebx
lea eax, [ebp - 0x10c]
push eax
mov byte [esi], 1
mov byte [ebp - 0x10c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x1001738
mov byte [ebp - 8], 0
call esi
mov edi, eax
lea eax, [ebp - 0x10c]
push eax
call esi
add edi, eax
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [eax + edi + 1]
cmp eax, ebx
jb 0x1004319
mov eax, 0x8000ffff
jmp 0x10043f6
push 0x1001738
push ebx
lea eax, [ebp - 0x10c]
push eax
call fcn.01003c2e
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp - 0x10c]
push eax
call fcn.01003c2e
mov edi, dword [ebp - 0x210]
lea eax, [ebp - 0x10c]
push eax
call fcn.01003d37
test eax, eax
lea eax, [ebp - 0x10c]
je 0x10043e6
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10043f3
push 0x1001738
lea eax, [ebp - 0x10c]
push eax
call esi
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp - 0x10c]
push eax
call fcn.01003c2e
test eax, eax
jl 0x10043f3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
sub ebx, eax
push ebx
lea eax, [ebp - 0x10c]
push eax
call fcn.01003c2e
test eax, eax
jl 0x10043f3
lea eax, [ebp - 0x10c]
push eax
lea esi, [ebp - 0x214]
call fcn.01003341
test al, al
je 0x10043f3
lea eax, [ebp - 0x10c]
push eax
call fcn.01003d37
test eax, eax
jne 0x10043f3
lea eax, [ebp - 0x10c]
push eax
call fcn.010033b8
mov dword [edi + 4], eax
xor eax, eax
jmp 0x10043f6
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002d6f
leave
ret 4
Function at 0x100445e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.01003778
mov ecx, esi
mov bl, al
call fcn.01003910
dec eax
je 0x1004683
dec eax
je 0x100461e
dec eax
je 0x10045e8
dec eax
je 0x10045af
dec eax
je 0x10044ee
dec eax
je 0x10044ce
dec eax
jne 0x1004632
cmp dword [esi + 0xc], 0x10003
ja 0x10044e7
jb 0x10046a9
cmp dword [esi + 8], 0x83
ja 0x10044e7
jmp 0x10046a9
cmp dword [esi + 0xc], 0x30001
ja 0x10044e7
jb 0x10046a9
cmp dword [esi + 8], 0
jb 0x10046a9
xor eax, eax
jmp 0x10046ac
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp eax, 0x411
jne 0x1004632
mov ecx, dword [esi + 8]
mov esi, dword [esi + 0xc]
cmp ecx, 0x900
jne 0x100457e
cmp esi, 0x30002
jne 0x100457e
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x1004632
push edi
mov esi, 0x100180c
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x114]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, eax
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.01003c2e
pop edi
test eax, eax
jl 0x1004632
lea eax, [ebp - 0x114]
push eax
lea esi, [ebp - 0xc]
call fcn.01003341
test al, al
jne 0x1004632
jmp 0x10045c5
mov eax, 0x40002
cmp esi, eax
jb 0x10045a3
ja 0x100458d
test ecx, ecx
jb 0x10045a3
cmp esi, eax
ja 0x10045a3
jb 0x100459b
cmp ecx, 0x270f
ja 0x10045a3
mov al, byte [ebp + 8]
jmp 0x10046ac
push esi
push ecx
call fcn.01003a12
jmp 0x10046ac
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10045cc
push 0x1001800
push eax
call fcn.01003759
test al, al
je 0x10045cc
mov al, 1
jmp 0x10046ac
cmp dword [esi + 0xc], 0x10002
ja 0x10044e7
jb 0x10046a9
cmp dword [esi + 8], 0x68
jmp 0x10044e1
mov eax, dword [esi + 0x1c]
push 0x10015cc
push eax
call fcn.01003759
test al, al
jne 0x10045c5
cmp dword [esi + 0xc], 0x10000
ja 0x10044e7
push 1
pop eax
jb 0x10046ac
cmp dword [esi + 8], eax
jbe 0x10046ac
jmp 0x10044e7
mov eax, dword [esi + 8]
mov esi, dword [esi + 0xc]
cmp esi, 0x30005
jb 0x1004636
ja 0x1004632
test eax, eax
jb 0x1004636
xor al, al
jmp 0x10046ac
xor cl, cl
cmp esi, 0x20000
jb 0x100467a
ja 0x1004646
test eax, eax
jb 0x100467a
test bl, bl
je 0x100467a
push 0x10017e0
call fcn.010038dd
test al, al
jne 0x1004678
push 0x10017c4
call fcn.010038dd
test al, al
jne 0x1004678
push 0x10017a4
call fcn.010038dd
test al, al
jne 0x1004678
xor cl, cl
jmp 0x100467a
mov cl, 1
xor eax, eax
test cl, cl
sete al
jmp 0x10046ac
mov ecx, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov eax, 0x50001
cmp esi, eax
jb 0x10046a9
ja 0x1004698
test ecx, ecx
jb 0x10046a9
cmp ecx, 0x41
jne 0x10044e7
cmp esi, eax
jne 0x10044e7
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01002d6f
leave
ret 4
Function at 0x1004709
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
or edx, 0xffffffff
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp ebx, 4
jbe 0x100477d
push edi
lea edi, [ebx - 5]
shr edi, 2
inc edi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001818]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001818]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001818]
inc esi
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001818]
inc esi
sub ebx, 4
dec edi
jne 0x100472a
pop edi
test ebx, ebx
jbe 0x1004797
movzx eax, byte [esi]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x1001818]
inc esi
dec ebx
jne 0x1004781
mov eax, dword [ebp - 4]
pop esi
mov dword [eax], edx
pop ebx
leave
ret 8
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10003ece
pop dword [ebp - 0x44]
mov eax, 0xa18da82b
add eax, 0x6e7296a3
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x1611eb3b
add dword [ebp - 0x54], 0x38405a10
mov dword [ebp - 0x50], 0x713e3946
add dword [ebp - 0x50], 0xc0f512ff
mov dword [ebp - 0x4c], 0x72f595da
sub dword [ebp - 0x4c], 0x26a951ac
mov dword [ebp - 0x48], 0x202d80a5
add dword [ebp - 0x48], 0xdfd27f5b
lea eax, [ebp - 0x54]
push eax
mov eax, 0x34d1990c
add eax, 0xdb2eb738
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x5ed9d97e
sub dword [ebp - 0x54], 0xea677028
mov dword [ebp - 0x50], 0xb68c8766
sub dword [ebp - 0x50], 0x752025f1
mov dword [ebp - 0x4c], 0xe2be824e
sub dword [ebp - 0x4c], 0x7f4f15e2
mov dword [ebp - 0x48], 0x1bca7465
add dword [ebp - 0x48], 0xe4358b9b
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xcf450374
add eax, 0x40bb4ccc
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x35f52
push 0
call eax
mov ecx, 0xb876c559
add ecx, 0x47897ff3
mov ebx, eax
mov edx, 0x47ee8960
sub edx, 0x37edd360
add edx, dword [ebp - 0x44]
mov edi, 0x1a0e4757
sub edi, 0x1168e87
xor dword [ebp - 0x40], 0x105ab917
mov esi, dword [edx]
xor dword [ebp - 0x18], 0xbeb47219
sub esi, edi
add dword [ebp - 4], eax
mov dword [ebx], esi
xor dword [ebp - 0x10], ebx
add ebx, 0x511ffbbe
add ebx, 0xaee00446
add edx, 0xdab50329
add edx, 0x254afcdb
loop 0x10003ff0
add eax, 0xeba276da
sub eax, 0xeba16ed7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403e59
pop dword [ebp - 0x38]
mov eax, 0x403e59
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa2ec11b4
sub dword [ebp - 0x48], 0x5499cc69
mov dword [ebp - 0x44], 0x597bec94
sub dword [ebp - 0x44], 0x2748a04f
mov dword [ebp - 0x40], 0x7def5786
sub dword [ebp - 0x40], 0x31a31358
mov dword [ebp - 0x3c], 0x53d21d06
sub dword [ebp - 0x3c], 0x53d21d06
lea eax, [ebp - 0x48]
push eax
mov eax, 0xd1b20224
sub eax, 0xd1718198
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9bcb821
sub dword [ebp - 0x48], 0x954a4ecb
mov dword [ebp - 0x44], 0xe5acbd22
add dword [ebp - 0x44], 0x5bbfa453
mov dword [ebp - 0x40], 0xf620733c
sub dword [ebp - 0x40], 0x92b106d0
mov dword [ebp - 0x3c], 0xebf69edf
add dword [ebp - 0x3c], 0x14096121
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xfa01bae0
sub eax, 0xf9c13a0c
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39ab5
push 0
call eax
mov ecx, 0x53b0
mov edi, eax
mov edx, 0x411000
add edx, dword [ebp - 0x38]
mov esi, 0x327a21d3
add esi, 0xe09aab47
xor dword [ebp - 0x10], edx
mov ebx, dword [edx]
add dword [ebp - 0x14], 0xc4c730c7
add ebx, esi
add dword [ebp - 0x10], esi
mov dword [edi], ebx
sub dword [ebp - 0x28], 0xaaccbd37
add edi, 4
add edx, 0x47fbcd4c
sub edx, 0x47fbcd48
loop 0x403f6a
add eax, 0x68f98983
add eax, 0x9707b810
xor ebx, ebx
add ebx, eax
add eax, 0x3ae8bdcf
sub eax, 0x3ae8bdca
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret