joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003568
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x10003582
xor eax, eax
jmp 0x10003702
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x10003596
xor eax, eax
jmp 0x10003702
cmp word [ebx + 0x14], 0xe0
jne 0x100035a6
cmp word [ebx + 0x18], 0x10b
je 0x100035ad
xor eax, eax
jmp 0x10003702
mov dword [0x1005347c], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.100034ec
add esp, 8
test eax, eax
jne 0x100035d8
xor eax, eax
jmp 0x10003702
mov edx, dword [0x1005347c]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10003534
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x1000360a
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x10003702
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x100036d4
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x100036c6
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x100036c1
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x100036b8
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x100036ad
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x100036ad
test cl, cl
je 0x100036a2
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x100036ad
add eax, 2
add edx, 2
test cl, cl
jne 0x10003686
jne 0x100036ad
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x10003702
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x1000366c
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x10003644
jmp 0x10003700
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x100036f8
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x100036f4
cmp dword [eax], 0
je 0x100036f4
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x10003702
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x100036db
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003814
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
push 0xf003f
push str.ServicesActive
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
test eax, eax
jne 0x10003831
xor eax, eax
jmp 0x1000386e
push 0xf01ff
push str.NTice
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
push esp
push ebx
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x10003858
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x1000386e
cmp dword [esp + 4], 4
jne 0x1000386c
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
jmp 0x1000386e
xor eax, eax
add esp, 0x1c
pop ebx
ret

Function at 0x100038d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x100038e9
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100038f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebp
ret
Function at 0x10003910
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc30
push ebx
push esi
push edi
lea edi, [ebp - 0x238]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x1004f9c4
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.100038a8
pop ecx
test eax, eax
je 0x1000394c
push ebx
call fcn.100038f0
pop ecx
mov dword [ebp - 0x2cc], 0x94
lea eax, [ebp - 0x2cc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2bc], 1
jne 0x1000398a
push ebx
call fcn.10003784
pop ecx
test eax, eax
jne 0x10003981
push ebx
call fcn.100037bc
pop ecx
test eax, eax
je 0x100039a7
push ebx
call fcn.100038f0
pop ecx
jmp 0x100039a7
push ebx
call fcn.100038d0
pop ecx
test eax, eax
jne 0x100039a0
push ebx
call fcn.10003874
pop ecx
test eax, eax
je 0x100039a7
push ebx
call fcn.100038f0
pop ecx
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x10003a13
jmp 0x10003a02
push str.explorer.exe
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x100039f4
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x230]
jne 0x10003a02
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x100039d6
cmp esi, dword [ebp - 4]
je 0x10003a38
cmp dword [ebp - 4], 0
je 0x10003a38
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x10003b16
xor edx, edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], edx
push 0x105
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x1004fb69
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x10003b16
lea eax, [ebp - 8]
lea edx, [ebp - 0x12cc]
push eax
push 0x1000
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10003af2
xor esi, esi
lea ebx, [ebp - 0x12cc]
jmp 0x10003ae8
push 0x104
lea eax, [ebp - 0x13d0]
push eax
mov edx, dword [ebx]
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x10003ae4
lea ecx, [ebp - 0x13d0]
push ecx
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x10003ae4
mov dword [ebp - 0xc], 1
jmp 0x10003af2
inc esi
add ebx, 4
mov edx, dword [ebp - 8]
shr edx, 2
cmp esi, edx
jb 0x10003aab
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0xc], 0
jne 0x10003b16
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x1f0fff
dec dword [edi]
pop ds
add al, ch
sal byte [edx + 0x6a0000], 1
Function at 0x10003b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
je 0x10003b81
jne 0x10003b81
jmp fcn.10003b05
cmp esi, 8
jb 0x10003bbf
xor ebx, ebx
jmp 0x10003bb6
mov eax, dword [ebp + 0x10]
mov edx, ebx
add edx, edi
push eax
push edx
call fcn.10003bc4
add esp, 8
movsx ecx, word [ebp + 0xc]
mov eax, 0x64
sub eax, ecx
imul esi
mov ecx, 0x64
xor edx, edx
div ecx
add ebx, eax
add ebx, 8
mov eax, esi
sub eax, 8
cmp ebx, eax
jbe 0x10003b8a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10003bc4
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.100019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003c77
mov eax, fcn.10001694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003c77
mov eax, fcn.10003e20
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003c77
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x10003c77
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x10003c3f
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003c94
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.100019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003d4a
mov eax, fcn.10001694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003d4a
mov eax, fcn.10003c94
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003d4a
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x10003d4a
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x10003d12
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003e70
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.100019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003f26
mov eax, fcn.10001694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003f26
mov eax, fcn.10003e20
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x10003f26
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x10003f26
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x10003eee
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100055c8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x100099c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x10009a26
call fcn.10009974
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.10005cb4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.10005cb4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x10009a84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x100519ac], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x10009b5e
cmp dword [0x100519a8], 0
jne 0x10009b5e
cmp dword [0x10051b9c], 0
je 0x10009b18
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.10009874
add esp, 8
mov ebx, eax
test eax, eax
jne 0x10009afe
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.10009874
add esp, 8
mov ebx, eax
test eax, eax
jne 0x10009afe
lea ebx, [ebp - 0x84]
jmp 0x10009aff
inc ebx
call fcn.10009a40
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x10009b99
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x100519b0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.10005cb4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x100519b3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x10009b99
cmp dword [0x100519a8], 0
je 0x10009b78
cmp dword [0x100519a8], 0xffffffff
je 0x10009b99
push esi
call dword [0x100519a8]
pop ecx
mov eax, dword [0x100519ac]
test eax, eax
je 0x10009b99
cmp dword [0x100519ac], 0xffffffff
je 0x10009b99
cmp byte [eax], 0
je 0x10009b99
push esi
push eax
call fcn.100099c4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a3dc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x10053efc], 0
jne 0x1000a45d
cmp dword [0x10053f1c], 0
jne 0x1000a40c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x10053f1c], eax
test eax, eax
jne 0x1000a40c
push str.GetEnvironmentStrings_failed
call fcn.10009bb0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x10053f1c]
jmp 0x1000a420
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.10005cb4
pop ecx
mov edi, eax
test eax, eax
jne 0x1000a418
lea edi, [ebp + 1]
push edi
call fcn.10004b80
pop ecx
mov ebx, eax
mov dword [0x10053f00], ebx
test ebx, ebx
jne 0x1000a44a
xor eax, eax
jmp 0x1000a520
push edi
mov edx, dword [0x10053f1c]
push edx
push ebx
call fcn.10005b64
add esp, 0xc
jmp 0x1000a47d
xor esi, esi
mov ebx, dword [0x10053efc]
jmp 0x1000a477
push eax
call fcn.10005cb4
pop ecx
test eax, eax
jne 0x1000a473
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x1000a467
lea ebx, [esi + 4]
push 4
mov dword [0x10053f04], ebx
inc ebx
push ebx
call fcn.100046e4
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x1000a4a0
xor eax, eax
jmp 0x1000a520
cmp dword [0x10053efc], 0
jne 0x1000a4d1
xor esi, esi
mov ebx, dword [0x10053f00]
mov eax, dword [esp]
mov ebp, eax
jmp 0x1000a4c2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.10005cb4
pop ecx
mov edi, eax
test eax, eax
jne 0x1000a4b8
jmp 0x1000a502
xor esi, esi
mov ebx, dword [0x10053efc]
mov eax, dword [esp]
mov edi, eax
jmp 0x1000a4fc
push eax
call fcn.10005cb4
pop ecx
test eax, eax
je 0x1000a4f1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x1000a4f5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x1000a4e0
mov eax, dword [0x10053efc]
test eax, eax
je 0x1000a512
push eax
call fcn.10004b90
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x10053efc], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000cca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x1005260c
sub eax, eax
test esi, esi
je 0x1000cd80
sub eax, 1
test ecx, ecx
je 0x1000cd7e
test esi, 3
je 0x1000ccde
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1000ccc3
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x1000cd65
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1000ccec
mov ecx, edx
test ecx, ecx
je 0x1000cd7e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1000cd6b
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x1000d064
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.1000d0e7
jae 0x1000d072
xor ecx, ecx
call fcn.1000d0e7
jae 0x1000d0a1
xor eax, eax
call fcn.1000d0e7
jae 0x1000d0b1
mov bl, 2
inc ecx
mov al, 0x10
call fcn.1000d0e7
adc al, al
jae 0x1000d093
jne 0x1000d0dd
stosb byte es:[edi], al
jmp 0x1000d075
call fcn.1000d0f3
sub ecx, ebx
jne 0x1000d0ba
call fcn.1000d0f1
jmp 0x1000d0d9
lodsb al, byte [esi]
shr eax, 1
je 0x1000d103
adc ecx, ecx
jmp 0x1000d0d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.1000d0f1
cmp eax, 0x7d00
jae 0x1000d0d6
cmp ah, 5
jae 0x1000d0d7
cmp eax, 0x7f
ja 0x1000d0d8
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1000d075
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x1000d430
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x1000d49f
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x1000d467
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1000dda0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x1000de3f
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.10005cb4
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x10052ece
call fcn.10005e2c
add esp, 0xc
test eax, eax
jne 0x1000de3f
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x1000de3c
mov ecx, dword [ebp + 0x10]
mov esi, 0x10052efa
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10005c78
add esp, 8
mov eax, 1
jmp 0x1000de4a
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x1000ddbf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401960
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401972
mov eax, dword [0x57d09f]
shl eax, 2
mov dword [0x57d0a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.0056d918
pop edx
call fcn.0056d85c
call fcn.0056da74
push 0
call fcn.0056f5f8
pop ecx
push 0x57d048
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x57d0a7], eax
push 0
jmp fcn.005790d8

Function at 0x401e70
Capabilities:
Hash data with md5

Disassembly:
push 0x40
push 0
push 0x58b1c0
call fcn.0056e523
add esp, 0xc
xor eax, eax
mov dword [0x58b204], eax
mov dword [0x58b200], eax
mov dword [0x58b208], 0x67452301
mov dword [0x58b20c], 0xefcdab89
mov dword [0x58b210], 0x98badcfe
mov dword [0x58b214], 0x10325476
ret

Function at 0x404550
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, 0x57dc58
call fcn.0056e9f4
mov dword [ebp - 0x14], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.0057bdd0
inc dword [ebp - 0x14]
lea edx, [ebp - 0x50]
mov word [ebp - 0x20], 0xc
push 0x1e
push 0
push edx
call fcn.0056e523
add esp, 0xc
lea ecx, [ebp - 0x154]
push 0x104
push 0
push ecx
call fcn.0056e523
add esp, 0xc
mov eax, ebx
call fcn.004ce1f0
mov dword [ebp - 0x50], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x4c], 3
mov word [ebp - 0x40], 0x414
mov word [ebp - 0x20], 0x18
mov edx, 0x57d50b
call fcn.0057bd90
inc dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0057bf04
cmp dword [ebp - 0xc], 0
je 0x4045f8
mov edx, dword [ebp - 0xc]
jmp 0x4045fd
mov edx, 0x57d50e
mov dword [ebp - 0x48], edx
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0057beb4
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0057beb4
xor eax, eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x50]
push ecx
call sub.SHELL32.DLL_SHFileOperationW
test eax, eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.0057beb4
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4069c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x406a16
test eax, edx
je 0x406a19
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4069d9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4069ff
add ecx, 4
js 0x4069ef
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4069fc
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x406a25
test edx, edx
jne 0x4069cc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret