joyce8/EMBER2024-capa huggingface dataset:
Function at 0x85bac0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
call fcn.0084bcb0
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 0x400]
xor esi, esi
test ecx, ecx
jle 0x85baff
jmp 0x85bae0
mov ecx, esi
and ecx, 0x1f
mov edi, 1
shl edi, cl
test eax, edi
setne cl
mov byte [esi + edx], cl
mov ecx, dword [edx + 0x400]
inc esi
cmp esi, ecx
jl 0x85bae0
mov ecx, dword [edx + 0x400]
xor esi, esi
test ecx, ecx
jle 0x85bb2c
jmp 0x85bb10
mov cl, byte [esi + edx]
inc eax
imul eax, eax, 0x10dcd
xor cl, al
je 0x85bb13
mov byte [esi + edx], cl
mov ecx, dword [edx + 0x400]
inc esi
cmp esi, ecx
jl 0x85bb10
mov eax, dword [edx + 0x400]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
sub eax, ecx
mov byte [edx], 0
mov byte [edx + 1], 2
lea edi, [eax + edx]
mov edx, ecx
shr ecx, 2
mov byte [edi - 1], 0
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x85d600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], 0
jne 0x85d625
call fcn.007cb270
mov dword [eax], 0x16
xor eax, eax
jmp 0x85d6d6
push 0x74
push str.threadex.c
push 2
push 0x8c
push 1
call fcn.007c6b60
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x85d648
jmp 0x85d6b4
mov eax, dword [ebp - 0xc]
push eax
call fcn.007cd0e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x4c], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x50], ecx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0xffffffff
cmp dword [ebp + 0x1c], 0
jne 0x85d67c
lea eax, [ebp - 4]
mov dword [ebp + 0x1c], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0x85d6e0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x85d6af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x85d6b4
mov eax, dword [ebp - 8]
jmp 0x85d6d6
push 2
mov eax, dword [ebp - 0xc]
push eax
call fcn.007c7290
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x85d6d4
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.007cb1d0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x85e150
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x85e16f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x85e176
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x85e18d
mov ecx, dword [ebp - 4]
push ecx
call fcn.007cb1d0
add esp, 4
or eax, 0xffffffff
jmp 0x85e18f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x85e220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8c7b48
push 0x7cd5e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffed8
mov eax, dword [0x906980]
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x128]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x134]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x104
jle 0x85e34a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x12c]
add eax, 4
and eax, 0xfffffffc
call fcn.007c94b0
mov dword [ebp - 0x138], esp
mov dword [ebp - 0x18], esp
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], 0xffffffff
jmp 0x85e324
cmp dword [ebp - 0x12c], 0
je 0x85e34a
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x12c]
add edx, 1
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x12c], 0
je 0x85e381
mov eax, dword [ebp - 0x134]
movzx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x85e381
mov edx, dword [ebp - 0x134]
movzx eax, byte [edx]
push eax
call fcn.00860240
add esp, 4
sub eax, 0x40
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x130], 0
je 0x85e39b
push 2
mov ecx, dword [ebp - 0x134]
push ecx
call fcn.007c7290
add esp, 8
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x20]
call fcn.007d6cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x85e6b0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x85e6cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x85e6d4
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x85e6eb
mov ecx, dword [ebp - 4]
push ecx
call fcn.007cb1d0
add esp, 4
or eax, 0xffffffff
jmp 0x85e6ed
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x85e700
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x85e71d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x85e724
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x85e73b
mov ecx, dword [ebp - 4]
push ecx
call fcn.007cb1d0
add esp, 4
or eax, 0xffffffff
jmp 0x85e73d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x8604c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x906980]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x86053e
mov eax, dword [ebp + 8]
push eax
call fcn.00860620
add esp, 4
test eax, eax
jne 0x860504
call fcn.007cb280
mov dword [eax], 0xf
call fcn.007cb270
mov dword [eax], 0xd
xor eax, eax
jmp 0x860605
mov ecx, dword [ebp + 8]
add ecx, 0x40
mov byte [ebp - 4], cl
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x118]
push eax
push 0x104
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dword [ebp - 0x120], eax
jmp 0x860556
lea edx, [ebp - 0x118]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x86057a
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x104
jbe 0x860581
xor eax, eax
jmp 0x860605
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x8605d8
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp + 0x10]
jle 0x8605a6
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
jmp 0x8605af
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
push edx
call fcn.007c66d0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x8605d6
call fcn.007cb270
mov dword [eax], 0xc
xor eax, eax
jmp 0x860605
jmp 0x8605f2
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp + 0x10]
jle 0x8605f2
call fcn.007cb270
mov dword [eax], 0x22
xor eax, eax
jmp 0x860605
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.007d0bd0
add esp, 8
mov ecx, dword [ebp - 0xc]
call fcn.007d6cb0
mov esp, ebp
pop ebp
ret
Function at 0x865950
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x20]
push ebp
xor ebp, ebp
push ebp
push ebp
mov eax, 1
push ebp
mov word [esp + 0x14], ax
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x24], 0x2b11
mov dword [esp + 0x28], 0x5622
mov word [esp + 0x2c], 2
mov word [esp + 0x2e], 0x10
mov word [esp + 0x30], bp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x8659b0
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x10]
xor ebx, ebx
add esi, 0x18
lea eax, [esi - 4]
push 0x20
push eax
lea ecx, [esi + 0x1c]
push edi
mov dword [eax], ecx
mov dword [esi], 0x8c0
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
test eax, eax
jne 0x865a06
inc ebx
add esi, 0x8e0
cmp ebx, 2
jl 0x8659c0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov dword [ecx + 0xc], 0xffffffff
mov dword [ecx + 4], edx
jmp 0x865a17
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WINMM.dll_waveInClose]
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov dword [ecx], eax
xor ecx, ecx
cmp eax, ebp
setne cl
pop edi
pop esi
pop ebx
pop ebp
dec ecx
and ecx, 0xfffffffe
mov eax, ecx
add esp, 0x18
ret
Function at 0x865eb0
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x10
mov eax, dword [0x906980]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
push edi
xor edi, edi
cmp eax, edi
lea ebx, [ebp + 0x2fd0]
je 0x86606b
mov ecx, dword [ebp + 0x1360]
push esi
mov esi, 1
cmp ecx, esi
mov cl, byte [ebp + 0x26ec]
jne 0x86601c
test cl, cl
jne 0x865f01
push eax
call dword [sym.imp.WINMM.dll_waveInStop]
mov dword [ebp + 0x1360], edi
mov ecx, dword [ebp]
push 0xc
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], 4
call dword [sym.imp.WINMM.dll_waveInGetPosition]
mov edx, dword [ebp + 0x11d4]
imul edx, edx, 0x8e0
lea eax, [edx + ebp]
lea esi, [eax + 0x34]
push 0x20
add eax, 0x14
push eax
mov eax, dword [ebp]
lea edi, [ebp + 0x2710]
mov ecx, 0x230
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
jne 0x86606a
mov edi, dword [ebp + 0x11d4]
mov esi, dword [ebp + 0x135c]
xor ecx, ecx
test edi, edi
sete cl
add esi, 0x8c0
push 0x460
lea eax, [ebp + 0x2710]
mov dword [ebp + 0x135c], esi
push eax
lea esi, [ebx + 9]
push esi
mov dword [ebp + 0x11d4], ecx
call fcn.008668e0
mov cl, byte [ebp + 0x26fd]
add esp, 0xc
test cl, cl
jne 0x865fe2
xor ecx, ecx
mov cl, byte [ebp + 0x26fc]
mov dl, cl
inc dl
mov byte [ebp + 0x26fc], dl
push ecx
mov ecx, dword [ebp + 0x270c]
push ecx
push eax
push esi
call dword [ebp + 0x2704]
mov edx, dword [esp + 0x38]
add esp, 0x10
pop esi
pop edi
mov dword [ebp + 0x2700], edx
mov dword [ebp + 0x26f4], 0
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
call fcn.007d6cb0
add esp, 0x10
ret
mov dword [ebx], eax
mov al, byte [ebx + 8]
inc al
push ebx
mov byte [ebx + 8], al
mov eax, dword [ebp + 0x33dc]
push 0x890978
push eax
call fcn.008670b0
add esp, 0xc
pop esi
pop edi
mov dword [ebp + 0x26f4], 0
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
call fcn.007d6cb0
add esp, 0x10
ret
cmp cl, 1
jne 0x86606a
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
test eax, eax
jne 0x866032
mov dword [ebp + 0x1360], esi
mov edx, dword [ebp]
mov esi, dword [sym.imp.WINMM.dll_waveInAddBuffer]
push 0x20
lea ecx, [ebp + 0x14]
push ecx
push edx
call esi
mov ecx, dword [ebp]
push 0x20
lea eax, [ebp + 0x8f4]
push eax
push ecx
call esi
mov dword [ebp + 0x11d4], edi
mov dword [ebp + 0x135c], edi
call fcn.00866960
mov dword [ebp + 0x26f4], edi
pop esi
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
call fcn.007d6cb0
add esp, 0x10
ret
Function at 0x866a80
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
push 0x14
mov dword [esp + 8], 1
call fcn.0078af30
mov esi, eax
add esp, 4
xor eax, eax
test esi, esi
je 0x866b24
mov ecx, esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
push 0x11
mov dword [ecx + 8], eax
push 2
mov dword [ecx + 0xc], eax
push 2
mov dword [ecx + 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x866b01
mov ecx, dword [esp + 0xc]
push edi
lea edi, [esi + 4]
xor edx, edx
mov eax, edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
push ecx
mov word [edi], 2
mov dword [esi + 8], edx
call fcn.00866d10
mov edx, dword [esi]
add esp, 4
push 0x10
push edi
push edx
mov word [esi + 6], ax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
pop edi
jne 0x866b0f
push esi
call fcn.0078af60
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esi]
lea eax, [esp + 4]
push eax
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x866b50
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x906980]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
test eax, eax
je 0x866baa
xor edx, edx
mov dword [esp], edx
mov dword [esp + 4], edx
push 0x10
mov dword [esp + 8], eax
mov ax, word [ecx + 4]
mov dword [esp + 0xc], edx
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [ecx]
mov word [esp + 0x12], ax
mov eax, dword [esp + 0x30]
push eax
push edx
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [esp + 0x10]
call fcn.007d6cb0
add esp, 0x14
ret

Function at 0x866bc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x906980]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp], 0x10
jne 0x866be8
mov ecx, dword [esp + 0x14]
call fcn.007d6cb0
add esp, 0x18
ret
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
lea edx, [esp]
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x2c]
push 0
push edx
mov edx, dword [eax]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x866c25
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 8]
mov dword [ecx], edx
movzx edx, word [esp + 6]
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x14]
call fcn.007d6cb0
add esp, 0x18
ret
Function at 0x401029
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.0041ed7f
xor ebp, ebp
pop ecx
test eax, eax
je 0x401076
push str.Windows_original_main_args:_n
call fcn.00401104
pop ecx
mov esi, ebp
call fcn.0040e687
cmp dword [eax], ebp
jle 0x401076
call fcn.0040e68d
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401104
add esp, 0xc
inc esi
call fcn.0040e687
cmp esi, dword [eax]
jl 0x401054
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040120f
call fcn.00401277
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401127
pop ecx
pop ecx
mov esi, eax
call fcn.0040127d
mov edx, ebp
test ebx, ebx
jle 0x4010b0
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x4010a5
mov edi, dword [0x431004]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010bf
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010cb
mov edx, dword [esi]
mov ecx, dword [0x431990]
test ecx, ecx
push ebp
push ebp
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x42526c
push 0x425270
push dword [0x431994]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401d57
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4042f7
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0041ed7f
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x40446a
jg 0x404326
test esi, esi
jb 0x40446a
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.00417558
add esp, 0xc
test eax, eax
js 0x40446a
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404388
push edi
call fcn.00404879
pop ecx
test eax, eax
je 0x40437f
push ebx
push esi
push edi
push ebp
call fcn.0041ed7f
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40446f
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.0041ed7f
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x40446a
jg 0x4043b1
cmp ebp, ebx
jb 0x40446a
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043c6
jl 0x4043c0
cmp ebp, ecx
jae 0x4043c6
mov esi, ebp
mov ecx, eax
jmp 0x4043ca
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0041ed7f
add esp, 0x10
cmp edx, ebx
jl 0x40446a
jg 0x4043f0
cmp eax, ebx
jb 0x40446a
push 0x10015
call fcn.0041ed7f
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40446a
push esi
push ebx
push dword [esp + 0x24]
call fcn.00417558
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404463
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40445f
cmp byte [esi], 0x50
jne 0x40445e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40445e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404476
dec esi
cmp esi, ebx
jae 0x40441f
push ebx
call fcn.0041ed7f
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a130
push ebx
call fcn.0041ed7f
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404879
add esp, 0x14
test eax, eax
je 0x4044b6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.0041ed7f
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40446f
Function at 0x41ed7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x41ed8e
pop dword [ebp - 0x18]
mov eax, 0x63e646f5
add eax, 0x9c5ba699
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x7b1679ab
sub dword [ebp - 0x28], 0x2cc43460
mov dword [ebp - 0x24], 0xf61b196f
sub dword [ebp - 0x24], 0xc3e7cd2a
mov dword [ebp - 0x20], 0xa2f72fcb
sub dword [ebp - 0x20], 0x56aaeb9d
mov dword [ebp - 0x1c], 0x5fcba6b4
add dword [ebp - 0x1c], 0xa034594c
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x74643a05
sub dword [ebp - 0x28], 0xfff1d0af
mov dword [ebp - 0x24], 0xe8eb68f6
add dword [ebp - 0x24], 0x5880f87f
mov dword [ebp - 0x20], 0xf71b8ee7
add dword [ebp - 0x20], 0x6c53dd85
mov dword [ebp - 0x1c], 0x540ae36b
add dword [ebp - 0x1c], 0xabf51c95
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x977a4fd6
sub eax, 0x9737ff7e
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x42378
push 0
call eax
mov ecx, 0x4c452fd0
add ecx, 0xb3bb29e2
xor ebx, ebx
add ebx, eax
mov esi, 0x1f76e6b0
sub esi, 0x1f330cb0
add esi, dword [ebp - 0x18]
mov edi, 0x3a218b78
sub edi, 0xd128a7c2
mov dword [ebp - 0x10], 0x570ba21d
mov edx, dword [esi]
sub dword [ebp - 0x10], ebx
add edx, edi
xor dword [ebp - 4], 0xb0e06506
mov dword [ebx], edx
sub dword [ebp - 8], 0x13403043
add ebx, 0x2aa7ba1e
sub ebx, 0x2aa7ba1a
add esi, 4
loop 0x41eead
add eax, 0x2d31a5d5
add eax, 0xd2cfb3c6
mov ebx, eax
add eax, 5
mov ecx, 0x7cda564e
sub ecx, 0x7c9a564e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x100023fd
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
je 0x1000240f
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
jmp 0x10002415
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call sym.java.dll_JNU_CallStaticMethodByName
mov esi, eax
pop ecx
cmp esi, edi
je 0x1000243f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x29c]
push esi
mov edi, eax
call dword [sym.imp.msvcr100.dll_free]
pop ecx
jmp 0x1000244d
push str.memory_allocation_error
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowOutOfMemoryError_8
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x10006ed9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xe0
mov eax, dword [0x1001cf10]
xor eax, ebp
mov dword [ebp + 0x74], eax
push edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
xor edi, edi
and dword [ebp - 0x5c], edi
push edi
push str.SystemCurrentControlSetControlTimeZoneInformation
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006f4f
and dword [ebp - 0x60], edi
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
push edi
push str.ActiveTimeBias
push dword [ebp - 0x5c]
mov dword [ebp - 0x64], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x10006f41
mov edi, dword [ebp - 0x68]
push dword [ebp - 0x5c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
pop ebx
je 0x10006f61
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.kernel32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x10006f61
mov edi, dword [ebp - 0x58]
lea eax, [ebp + 0x54]
push eax
mov eax, edi
call fcn.100067f8
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.msvcr100.dll__strdup]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop edi
call fcn.100122d0
add ebp, 0x78
leave
ret

Function at 0x10007644
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
push edi
xor ebx, ebx
push ebx
push 1
push ebx
mov edi, str.J2SE
push edi
lea eax, [ebp - 8]
push eax
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x1000767f
push 8
push 1
push ebx
push edi
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x1000767f
xor al, al
jmp 0x100076d4
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x2ac]
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x2e0]
mov edi, eax
cmp edi, ebx
je 0x100076c7
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptGenRandom]
test eax, eax
je 0x100076b9
mov byte [ebp - 1], 1
mov eax, dword [esi]
push ebx
push edi
push dword [ebp + 0x10]
push esi
call dword [eax + 0x300]
push ebx
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc