joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1816b7e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x181d4868]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1816b827
cmp byte [ebx], 0xa
jne 0x1816b827
or byte [eax + edi + 0x28], 4
jmp 0x1816b82c
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1816b92a
mov al, byte [edx]
cmp al, 0x1a
je 0x1816b90c
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1816b85b
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1816b880
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1816b88a
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1816b83d
jmp 0x1816b92a
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1816b907
cmp dword [ebp - 0xc], 0
je 0x1816b907
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x181d4868]
test byte [eax + edi + 0x28], 0x48
je 0x1816b8e1
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1816b8cc
mov byte [esi], dl
jmp 0x1816b8dd
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x181d4868]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1816b92a
cmp byte [ebp - 1], 0xa
jne 0x1816b8f0
cmp esi, ebx
jne 0x1816b8f0
mov byte [esi], 0xa
jmp 0x1816b929
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1816b690
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1816b92a
mov byte [esi], 0xd
jmp 0x1816b929
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x181d4868]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1816b926
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1816b92a
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1816b933
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x181d4868]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1816b976
cmp word [esi], dx
jne 0x1816b976
or byte [edi + eax + 0x28], 4
jmp 0x1816b97b
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1816bace
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1816baae
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1816b9bd
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1816b9f3
cmp eax, edx
jae 0x1816b9ff
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1816b995
jmp 0x1816bace
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1816baaa
cmp dword [ebp - 0x14], 0
je 0x1816baaa
mov eax, dword [ebx*4 + 0x181d4868]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1816ba82
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x1816ba4b
mov word [esi], cx
jmp 0x1816ba7e
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x181d4868]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x181d4868]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x181d4868]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x1816bace
pop ebx
cmp word [ebp - 4], bx
jne 0x1816ba93
cmp esi, dword [ebp + 0xc]
jne 0x1816ba93
mov word [esi], bx
jmp 0x1816bacb
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1816b690
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1816bace
push 0xd
jmp 0x1816bac7
mov ecx, dword [ebx*4 + 0x181d4868]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1816bac5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1816bace
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x18172974
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.181727e5

Function at 0x18172d6e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1816d5c0
mov eax, dword [0x181ce008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1815e421
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x18172db0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x18172f0c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1816d5f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x181d4868]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1816b672
mov ecx, dword [esi*4 + 0x181d4868]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x18172f05
cmp eax, dword [edi + ecx + 0x24]
jne 0x18172f05
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18172f05
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1816b672
add esp, 0x14
test edx, edx
jl 0x18172f05
jg 0x18172e7b
test eax, eax
jb 0x18172f05
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x18172f05
jl 0x18172e95
cmp dword [ebp - 0x1008], eax
ja 0x18172f05
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x18172eb3
test ebx, ebx
je 0x18172eec
cmp ecx, edi
jae 0x18172eec
mov al, byte [ecx]
cmp al, 0xd
jne 0x18172ecd
lea eax, [edi - 1]
cmp ecx, eax
jae 0x18172ed9
cmp byte [ecx + 1], 0xa
jne 0x18172ed9
inc ecx
jmp 0x18172ed9
movzx eax, al
movsx eax, byte [eax + 0x181ce9a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x18172eb3
cmp edx, ebx
jne 0x18172eb3
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x18172f0a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.18145efd
leave
ret
Function at 0x18173346
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.181732c2
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x181734be
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x181734be
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1817346d
jg 0x1817339f
test eax, eax
je 0x18173463
push 1
push 0x1000
call fcn.1815b782
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x181733c5
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1817345a
push 0x8000
push ebx
call fcn.181719f5
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x181733f1
jg 0x181733ec
cmp ecx, 0x1000
jb 0x181733f1
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1816a1bc
add esp, 0x10
cmp eax, 0xffffffff
je 0x18173436
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x181733ec
jl 0x1817341d
test ecx, ecx
jne 0x181733de
push dword [ebp - 0xc]
push ebx
call fcn.181719f5
push esi
call fcn.1815b748
add esp, 0xc
xor edi, edi
jmp 0x181734cf
cmp byte [edi + 0x24], 0
je 0x1817344d
cmp dword [edi + 0x20], 5
jne 0x1817344d
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x18173458
mov edi, dword [edi + 0x18]
jmp 0x1817345a
xor edi, edi
push esi
call fcn.1815b748
pop ecx
jmp 0x181734cf
test ecx, ecx
jg 0x1817342f
jl 0x1817346d
test eax, eax
jae 0x1817342f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1816b690
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x18173490
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1817342f
jmp 0x181734c7
push ebx
call fcn.18168de4
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1817342f
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x181734cf
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x181734cc
mov edi, dword [edi + 0x18]
jmp 0x181734cf
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1816b690
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404bef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bf9
repz ret
jmp fcn.0040883b

Function at 0x4060f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029c4
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x4061a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406255
push eax
call fcn.00402952
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x4061a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061fc
cmp dword [0x40e55c], ebx
je 0x4061fc
push eax
call fcn.004029cd
push dword [0x40e55c]
mov esi, eax
call fcn.004029cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061fc
test edi, edi
je 0x4061fc
call esi
test eax, eax
je 0x4061f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061f3
test byte [ebp - 0xc], 1
jne 0x4061fc
or dword [ebp + 0x10], 0x200000
jmp 0x406235
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406235
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.004029cd
pop ecx
test eax, eax
je 0x406255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x151b44b8
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x5b796ca0
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x513633
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00512524
and dword [ebp - 4], 0
cmp dword [0x51ede0], 0
mov ebx, eax
jne 0x5136e4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x513795
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x513795
push eax
call fcn.005124b2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x51ede0], eax
call esi
push eax
call fcn.005124b2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x51ede4], eax
call esi
push eax
call fcn.005124b2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x51ede8], eax
call esi
push eax
call fcn.005124b2
pop ecx
mov dword [0x51edf0], eax
test eax, eax
je 0x5136e4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005124b2
pop ecx
mov dword [0x51edec], eax
mov eax, dword [0x51edec]
cmp eax, ebx
je 0x51373c
cmp dword [0x51edf0], ebx
je 0x51373c
push eax
call fcn.0051252d
push dword [0x51edf0]
mov esi, eax
call fcn.0051252d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x51373c
test edi, edi
je 0x51373c
call esi
test eax, eax
je 0x513733
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x513733
test byte [ebp - 0xc], 1
jne 0x51373c
or dword [ebp + 0x10], 0x200000
jmp 0x513775
mov eax, dword [0x51ede4]
cmp eax, ebx
je 0x513775
push eax
call fcn.0051252d
pop ecx
test eax, eax
je 0x513775
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x513775
mov eax, dword [0x51ede8]
cmp eax, ebx
je 0x513775
push eax
call fcn.0051252d
pop ecx
test eax, eax
je 0x513775
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x51ede0]
call fcn.0051252d
pop ecx
test eax, eax
je 0x513795
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x513797
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x51549e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x51c948]
jne 0x5154a8
repz ret
jmp fcn.00516bc5
Function at 0x661d764d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x662923bc], ebx
push esi
jne 0x661d768b
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x661d7681
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x662923b8], eax
mov dword [0x662923bc], 1
mov eax, dword [0x662923b8]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x661d76a6
push dword [ebp + 0xc]
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x661d76d7
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jne 0x661d76cf
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x661d76c0
push dword [edi + 8]
call dword [edi]
jmp 0x661d76c6
push dword [edi + 0xc]
call dword [edi + 4]
test eax, eax
je 0x661d76d7
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push dword [ebp + 0xc]
push eax
call esi
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x661d7cf2
Capabilities:
Check mutex on windows

Disassembly:
push 0
mov eax, 0x6623ff45
call fcn.6623ba18
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
mov dword [ebp - 4], eax
push 1
push dword [ebp + 0xc]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
call fcn.661d7c28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x661d7d35
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.6623baf0
ret 8
Function at 0x661f0b64
Capabilities:
Check if file exists

Disassembly:
push 0x21c
mov eax, 0x662460f0
call fcn.6623ba81
mov edi, ecx
xor ebx, ebx
cmp byte [edi + 0x8c], bl
mov esi, edx
mov dword [ebp - 0x220], esi
je 0x661f0b9c
lea eax, [edi + 0x90]
cmp dword [eax], ebx
je 0x661f0b9c
push eax
call fcn.661d564a
jmp 0x661f0c81
mov eax, dword [edi + 0x50]
push 0x104
lea edx, [ebp - 0x218]
call fcn.661d100a
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.661d108a
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x228]
push eax
call fcn.662376e6
mov eax, dword [eax]
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x661f0c60
lea eax, [ebp - 0x21c]
push eax
push edi
call fcn.661f0877
test al, al
je 0x661f0c60
cmp byte [edi + 0x8c], bl
je 0x661f0c31
mov esi, dword [ebp - 0x21c]
add edi, 0x90
mov eax, dword [edi]
cmp eax, ebx
je 0x661f0c1f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
mov dword [edi], esi
je 0x661f0c2b
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov esi, dword [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x21c], ebx
mov dword [esi], eax
mov byte [ebp - 4], bl
lea eax, [ebp - 0x21c]
push eax
call fcn.661da1c1
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
push eax
call fcn.661d1665
jmp 0x661f0c81
mov byte [ebp - 4], bl
lea eax, [ebp - 0x21c]
push eax
call fcn.661da1c1
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x224]
push eax
call fcn.661d1665
mov dword [esi], ebx
mov eax, esi
call fcn.6623bb04
ret
Function at 0x661f1b2f
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xc
mov eax, 0x6624b4af
call fcn.6623ba18
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebx], vtable.GCColoredIUnknown.0
mov dword [ebx + 4], 1
mov dword [ebx + 0x20], esi
mov dword [ebp - 4], esi
lea eax, [ebx + 0x24]
mov dword [ebp - 0x14], eax
mov dword [eax], esi
mov byte [ebp - 4], 2
lea eax, [ebx + 0x28]
push eax
call fcn.661f1ccb
mov byte [ebp - 4], 3
mov dword [ebx + 0x38], esi
mov byte [ebp - 4], 4
lea eax, [ebx + 0x3c]
push eax
call fcn.661f1d13
mov byte [ebp - 4], 5
mov dword [ebx + 0x54], esi
mov byte [ebp - 4], 6
xor ecx, ecx
push ecx
mov eax, 0x661f2dbd
push eax
push ebx
lea edi, [ebx + 0x5c]
mov dword [ebx + 0x58], esi
call fcn.661f5762
mov byte [ebp - 4], 7
xor ecx, ecx
push ecx
mov eax, 0x661f2e23
push eax
push ebx
lea edi, [ebx + 0x64]
mov dword [ebx + 0x60], esi
call fcn.661f5762
mov byte [ebp - 4], 8
push 0xc
mov dword [ebx + 0x68], esi
mov dword [ebx + 0x6c], esi
mov dword [ebx + 0x70], esi
call dword [sym.imp.GrooveUtil.DLL_public:_static_void____stdcall_GCThunkHeap::Alloc_unsigned_long_int_]
mov edi, eax
cmp edi, esi
je 0x661f1bf9
push 0xc
push edi
mov byte [edi], 0xb8
mov byte [edi + 5], 0xb9
mov word [edi + 0xa], 0xe0ff
mov dword [edi + 1], 0x661f2f7b
mov dword [edi + 6], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, edi
mov dword [ebx + 0x74], esi
mov byte [ebp - 4], 9
lea esi, [ebx + 0x1c]
push esi
push 4
call dword [sym.imp.GrooveUtil.DLL_public:_static_unsigned_long_int___stdcall_GCStdCryptProv::GetHandle_void_]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x661f1c26
push 0x80004005
push 0x2e6b3474
call fcn.661d7d78
mov eax, 0x66292304
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xa
mov edi, dword [esi]
or dword [ebp - 0x10], 0xffffffff
lea esi, [ebp - 0x10]
mov dword [ebp - 0x14], edi
call fcn.661f5a5f
test eax, eax
jne 0x661f1c79
push 0x10
call dword [sym.imp.GrooveNew.DLL_void____cdecl_GrooveNew_unsigned_int_]
pop ecx
mov ecx, eax
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
lea edx, [ecx + 4]
mov edi, edx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
mov dword [edx], ebx
mov ebx, esi
mov edi, ecx
mov dword [ecx], eax
call fcn.661f59e4
mov ebx, dword [ebp + 8]
jmp 0x661f1c7c
mov dword [eax + 4], ebx
mov byte [ebp - 4], 9
push 0x66292304
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x94], eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.6623baf0
ret 4
Function at 0x661f6ac1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x661f6b19
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x661f6b0a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x661f6b06
cmp edi, eax
jae 0x661f6b0a
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x661f6af8
cmp edi, eax
jb 0x661f6b0e
xor eax, eax
jmp 0x661f6b18
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret 8