joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5778c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d9e88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
push 0x741824
mov ebx, ecx
mov dword [esp + 0x2c], 0x741824
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
xor ebp, ebp
sar eax, 2
mov dword [esp + 0x4c], ebp
test eax, eax
ja 0x57791c
push ebp
push 0xf8
push str..SourceFileSystem_r3dFileSystem.cpp
push str.IsValid__
call fcn.00569e90
add esp, 0x10
cmp dword [esp + 0x54], ebp
jne 0x57793a
push ebp
push 0xf9
push str..SourceFileSystem_r3dFileSystem.cpp
push 0x65c1e8
call fcn.00569e90
add esp, 0x10
mov esi, dword [ebx + 0x14]
sub esi, dword [ebx + 0x10]
mov dword [esp + 0x2c], 0x6c667261
sar esi, 2
imul esi, esi, 0x128
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x34], 1
mov dword [esp + 0x24], esi
call fcn.0058b9c7
mov edx, dword [ebx + 0x14]
sub edx, dword [ebx + 0x10]
add esp, 4
sar edx, 2
mov edi, eax
mov dword [esp + 0x24], edi
test edx, edx
jbe 0x5779c1
mov dword [esp + 0x14], edi
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
sar eax, 2
cmp ebp, eax
jb 0x577992
call fcn.0058cec8
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + ebp*4]
mov edi, dword [esp + 0x14]
add dword [esp + 0x14], 0x128
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
inc ebp
sar eax, 2
cmp ebp, eax
jb 0x577980
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x13]
call fcn.0056a720
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push edi
lea ecx, [esp + 0x23]
call fcn.0056a530
test eax, eax
jne 0x5779f0
push str.failed_to_compres_file_list_n
call fcn.00569d50
add esp, 4
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
mov ecx, dword [ebx]
mov edx, dword [esp + 0x18]
sar eax, 2
push esi
push edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], edx
call fcn.0056a500
mov esi, dword [esp + 0x5c]
push esi
push 8
mov dword [esp + 0x50], eax
lea eax, [esp + 0x3c]
push 1
push eax
call fcn.0058d3d9
push esi
push 0x10
lea ecx, [esp + 0x54]
push 1
push ecx
call fcn.0058d3d9
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push esi
push 1
push edx
push eax
call fcn.0058d3d9
push edi
call fcn.0058d52b
mov ecx, dword [esp + 0x58]
push ecx
call fcn.0058d52b
add esp, 0x40
push 0x741824
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x577c10
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d9e2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
push 0x741824
mov esi, ecx
mov dword [esp + 0x14], 0x741824
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x128]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x12c], 0
call fcn.00577370
mov edx, dword [esp + 0x12c]
push edi
push edx
lea eax, [esp + 0x1c]
push 0x67c2fc
push eax
call fcn.00410ac0
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea edx, [esp + 0x14]
push 0x67ad94
push edx
call fcn.0058c9c3
mov esi, eax
add esp, 8
test esi, esi
jne 0x577ccf
mov eax, dword [esp + 8]
push eax
call fcn.0058d52b
lea ecx, [esp + 0x18]
push ecx
push str.r3dFS:_unable_to_open__s_for_writing_n
call fcn.00569b80
add esp, 0xc
push 0x741824
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
jmp 0x577cfd
mov edx, dword [esp + 0xc]
mov edi, dword [esp + 8]
push esi
push edx
push 1
push edi
call fcn.0058d3d9
push esi
call fcn.0058bf50
push edi
call fcn.0058d52b
add esp, 0x18
push 0x741824
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0x579b40
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d9e2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
push 0x741824
mov ebx, ecx
mov dword [esp + 0xc], 0x741824
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
mov dword [esp + 0x120], 0
call fcn.00576cf0
lea ecx, [esp + 0xc]
push 0x659e94
push ecx
call fcn.0058c9c3
mov esi, eax
add esp, 8
test esi, esi
jne 0x579bd9
lea edx, [esp + 0xc]
push edx
push str.r3dFS:_there_is_no_volume_file__s_n
call fcn.00569b80
add esp, 8
push 0x741824
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
push ebp
push edi
push 2
push 0
push esi
call fcn.005914f6
push esi
call fcn.00591730
push 0
push 0
push esi
mov edi, eax
call fcn.005914f6
lea eax, [edi + 1]
push eax
call fcn.0058b9c7
push esi
push 1
mov ebp, eax
push edi
push ebp
call fcn.00591a72
push esi
call fcn.0058bf50
add esp, 0x34
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
lea ecx, [ebx + 0x104]
call fcn.00579840
push ebp
mov bl, al
call fcn.0058d52b
add esp, 4
push 0x741824
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x5865e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x586614
mov cl, byte [edx]
test cl, cl
je 0x586614
mov eax, 0x811c9dc5
movsx ecx, cl
or ecx, 0x20
xor ecx, eax
imul ecx, ecx, 0x1000193
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x5865f3
xor eax, 0x2a
imul eax, eax, 0x1000193
ret
xor eax, eax
ret
Function at 0x58bad0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6b4774]
jne 0x58bada
repz ret
jmp fcn.00595f29

Function at 0x58bcee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x58bd1f
call fcn.00592bee
mov dword [eax], esi
call fcn.00592bdb
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0058cea2
add esp, 0x14
push 0x16
pop eax
jmp 0x58bd74
test dword [ebp + 0xc], 0xfffffff9
jne 0x58bcfb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x58bd4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00592c01
pop ecx
call fcn.00592bdb
mov eax, dword [eax]
jmp 0x58bd74
test al, 0x10
jne 0x58bd72
test al, 1
je 0x58bd72
test byte [ebp + 0xc], 2
je 0x58bd72
call fcn.00592bee
mov dword [eax], 5
call fcn.00592bdb
mov dword [eax], 0xd
jmp 0x58bd43
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a04cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005960a1
and dword [ebp - 4], 0
cmp dword [0x75cfbc], 0
mov ebx, eax
jne 0x5a057d
push 0x670048
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5a062e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x67003c
push edi
call esi
test eax, eax
je 0x5a062e
push eax
call fcn.0059602f
mov dword [esp], 0x67002c
push edi
mov dword [0x75cfbc], eax
call esi
push eax
call fcn.0059602f
mov dword [esp], 0x670018
push edi
mov dword [0x75cfc0], eax
call esi
push eax
call fcn.0059602f
mov dword [esp], 0x66fffc
push edi
mov dword [0x75cfc4], eax
call esi
push eax
call fcn.0059602f
pop ecx
mov dword [0x75cfcc], eax
test eax, eax
je 0x5a057d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0059602f
pop ecx
mov dword [0x75cfc8], eax
mov eax, dword [0x75cfc8]
cmp eax, ebx
je 0x5a05d5
cmp dword [0x75cfcc], ebx
je 0x5a05d5
push eax
call fcn.005960aa
push dword [0x75cfcc]
mov esi, eax
call fcn.005960aa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5a05d5
test edi, edi
je 0x5a05d5
call esi
test eax, eax
je 0x5a05cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5a05cc
test byte [ebp - 0xc], 1
jne 0x5a05d5
or dword [ebp + 0x10], 0x200000
jmp 0x5a060e
mov eax, dword [0x75cfc0]
cmp eax, ebx
je 0x5a060e
push eax
call fcn.005960aa
pop ecx
test eax, eax
je 0x5a060e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5a060e
mov eax, dword [0x75cfc4]
cmp eax, ebx
je 0x5a060e
push eax
call fcn.005960aa
pop ecx
test eax, eax
je 0x5a060e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x75cfbc]
call fcn.005960aa
pop ecx
test eax, eax
je 0x5a062e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5a0630
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002371a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.1000b7d8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x100011f0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0x1002421c
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.1000d71d
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x100330fc
push eax
call fcn.1000f434
push edi
push esi
call fcn.1000bb20
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 4

Function at 0x10002840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100238bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
call fcn.10002fb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x90]
cmp eax, dword [ecx + 0x18]
jae 0x100032dc
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x68]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x288]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0x160]
call fcn.10002dd1
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x2b4]
jae 0x1000329f
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x9c]
mov al, byte [eax + ecx]
mov byte [ebp - 0x3e], al
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x310]
jae 0x10003279
mov eax, dword [ebp - 0x30c]
add eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
jmp 0x10003248
mov eax, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x3e]
add eax, ecx
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x9c]
add eax, 1
mov dword [ebp - 0x9c], eax
jmp 0x100031f8
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x284]
jne 0x100032ce
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x274]
mov edx, dword [ebp - 0x270]
mov esi, dword [ebp - 0x68]
movzx edx, word [edx + esi*2]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x154], eax
jmp 0x100032e6
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
jmp 0x10003194
mov dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x104
call eax
sub esp, 0xc
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x38], eax
Function at 0x10003350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x38]
sub ecx, 1
movzx eax, word [eax + ecx*2]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x48]
movzx ecx, cx
cmp eax, ecx
je 0x10003361
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x38]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0x38]
add eax, 0xffffffff
mov dword [ebp - 0x38], eax
jmp 0x10003330
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x78]
movsx eax, byte [eax + ecx]
cmp eax, 0
je 0x100033a5
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x78]
movsx eax, byte [eax + ecx]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x38]
mov word [ecx + edx*2], ax
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
jmp 0x10003368
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x20]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + 0x5c]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x260], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ebp - 0x260]
add eax, dword [ecx + edx*8 + 0x78]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x8c]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x8c]
add eax, dword [ecx + 0x1c]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x8c]
add eax, dword [ecx + 0x24]
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x8c]
cmp eax, dword [ecx + 0x18]
jae 0x1000357c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x258]
mov edx, dword [ebp - 0x64]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0xcc], 0
mov ecx, dword [ebp - 0x164]
call fcn.10002dd1
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x2bc]
jae 0x1000353f
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xa0]
mov al, byte [eax + ecx]
mov byte [ebp - 0x3f], al
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], ecx
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x308]
jae 0x10003519
mov eax, dword [ebp - 0x304]
add eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x100]
add eax, 1
mov dword [ebp - 0x100], eax
jmp 0x100034e8
mov eax, dword [ebp - 0x104]
movzx ecx, byte [ebp - 0x3f]
add eax, ecx
mov dword [ebp - 0xcc], eax
invalid
test dword [eax - 1], esp
invalid
Function at 0x10003850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x84]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x84]
add eax, dword [ecx + 0x1c]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x84]
add eax, dword [ecx + 0x24]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x5c], 0
Function at 0x100041b0
Capabilities:
Connect to wmi namespace via wbemlocator
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023a06
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor bl, bl
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0x100267e8
push 1
push 0
push 0x100267d8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10004307
push str.rootWMI
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x10004245
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0x10024228
push 0x10033194
lea eax, [ebp - 0x28]
movq qword [ebp - 0x24], xmm0
push eax
mov dword [ebp - 0x24], str.bad_allocation
call fcn.1000f434
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10004266
lea ecx, [ebp - 0x64]
call 0x10003ff0
push 0x10033208
lea eax, [ebp - 0x64]
push eax
call fcn.1000f434
mov ecx, dword [eax]
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x100042f3
mov eax, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push 0x100241e0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x100042df
push 0
push 0
push 3
push 4
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x100042cb
push str._ASUSWMIManager___ConnectToServer__successfully.
mov bl, 1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10004312
push str._ASUSWMIManager___ConnectToServer__CoSetProxyBlanket_failed.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10004312
push str._ASUSWMIManager___ConnectToServer__ConnectServer_failed1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10004312
push str._ASUSWMIManager___ConnectToServer__QueryInterface_failed2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10004312
push str._ASUSWMIManager___ConnectToServer__CoCreateInstance_failed3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10004326
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000c5be
mov esp, ebp
pop ebp
ret
Function at 0x4034b0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004069b0
test esi, esi
jne 0x4034e8
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406aec
jmp 0x403506
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403394
mov edi, eax
test esi, esi
je 0x403506
cmp dword [ebx], 0
je 0x403506
dec esi
jmp 0x4034ef
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403538
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x616008], 0x8088405
inc edx
mov dword [ebx + 0x616008], edx
fld qword [ebx + 0x616784]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x404120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x616024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4041b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x404198
xor eax, eax
push ebp
push 0x404191
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4041f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404198
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x616024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x616024], ax
mov esp, ebp
pop ebp
ret
Function at 0x4049a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00404c54
mov byte [esp], al
cmp byte [esp], 0
jne 0x404b29
test edi, edi
je 0x404b29
mov byte [esp + 1], 0
test ebp, ebp
jle 0x404a60
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x404a3b
cmp edi, 0xffffffff
je 0x4049ff
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4049ff
mov byte [esp], 0
jmp 0x404b29
mov ebx, dword [esi]
cmp ebx, 1
jg 0x404a3b
test ebx, ebx
jne 0x404a34
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00401438
test eax, eax
jne 0x404a34
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x404b29
pause
dec ebp
test ebp, ebp
jg 0x4049e4
cmp edi, 0xffffffff
je 0x404a60
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x404a5e
mov byte [esp], 0
jmp 0x404b29
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4049ae
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00401438
cmp ebx, eax
jne 0x404a60
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00404b9c
mov edx, eax
mov ebx, dword [0x6308cc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x404ac7
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x404ac5
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x404ac7
xor edi, edi
cmp byte [esp], 0
je 0x404af0
mov ebx, dword [esi]
test bl, 1
jne 0x404b09
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00401438
cmp ebx, eax
jne 0x404acd
mov byte [esp + 1], 1
jmp 0x404b09
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00401438
cmp ebx, eax
jne 0x404af0
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x404a7a
cmp byte [esp], 0
je 0x404b29
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405770
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x630054], 0
je 0x4057d1
cmp word [0x630330], 0xd7b2
jne 0x405799
cmp dword [0x630338], 0
jbe 0x405799
mov eax, 0x63032c
call dword [0x630348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4057fc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x616030], 0
jne 0x4057ed
push 0
push 0x61678c
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret