joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40288e
pop dword [ebp - 0x1c]
mov eax, 0xeab1bc25
add eax, 0x158e6c69
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x6497f130
add dword [ebp - 0x2c], 0xe9ba541b
mov dword [ebp - 0x28], 0x3d6e7130
add dword [ebp - 0x28], 0xf4c4db15
mov dword [ebp - 0x24], 0x809701d
sub dword [ebp - 0x24], 0xbbbd2bef
mov dword [ebp - 0x20], 0x3dbb42e5
add dword [ebp - 0x20], 0xc244bd1b
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x55a8935
add dword [ebp - 0x2c], 0x6f17e021
mov dword [ebp - 0x28], 0x7d5615b0
sub dword [ebp - 0x28], 0x3be9b43b
mov dword [ebp - 0x24], 0x3f4f169e
add dword [ebp - 0x24], 0x242055ce
mov dword [ebp - 0x20], 0xf060c98
add dword [ebp - 0x20], 0xf0f9f368
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba06
push 0
call eax
mov ecx, 0x5c1f
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x1c]
mov edi, 0x8a1acd47
sub edi, 0x3104e36a
mov ebx, dword [edx]
sub dword [ebp - 8], 0x360f920f
sub ebx, edi
xor dword [ebp - 0x18], 0xb3fb7ed3
mov dword [esi], ebx
add dword [ebp - 0xc], edi
add esi, 0x6455c8bf
sub esi, 0x6455c8bb
add edx, 0xd267ebb5
sub edx, 0xd267ebb1
loop 0x40299a
add eax, 0xfa7ccbcb
sub eax, 0xfa7b687c
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0xdff1a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jb 0xdff1da
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 8], ecx
jb 0xdff1ff
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jle 0xdff1eb
mov eax, dword [ebp + 8]
jmp 0xdff214
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0xdff1be
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0xe116e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [0x10095fa0]
or eax, dword [0x10095fa4]
jne 0xe11747
push 0x33
call fcn.00e1170d
mov eax, dword [0x10095fa0]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10095fa4]
mov dword [ebp - 8], ecx
push 0x33
call fcn.00e1175f
Function at 0xe1b960
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
cmp dword [0x10096060], 0
jne 0xe1b983
xor eax, eax
xor edx, edx
jmp 0xe1bb4f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x48], eax
cmp dword [ebp + 0x10], 0
jle 0xe1b9b2
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x54], edx
jmp 0xe1b9bb
xorpd xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
jle 0xe1b9f0
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x48]
add eax, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x68], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x64], eax
jmp 0xe1b9f9
xorpd xmm0, xmm0
movlpd qword [ebp - 0x68], xmm0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x28], edx
cmp dword [ebp + 0x10], 0
jle 0xe1ba2e
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x48]
add ecx, 8
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0xe1ba37
xorpd xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x38], eax
cmp dword [ebp + 0x10], 0
jle 0xe1ba6c
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0xe1ba75
xorpd xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
sub eax, 8
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0xe1bad0
add dword [esp], 5
retf
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00e5e5f4
mov esp, ebp
pop ebp
ret
Function at 0xe1bb60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
cmp dword [ebp + 8], 0
je 0xe1bb8a
cmp dword [ebp + 0xc], 0
jne 0xe1bb84
cmp dword [ebp + 0x10], 0
je 0xe1bb8a
cmp dword [ebp + 0x14], 0
jne 0xe1bb8e
xor al, al
jmp 0xe1bbf2
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x33
call fcn.00e1bba5
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00e5e5f4
mov esp, ebp
pop ebp
ret

Function at 0xe1bff0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
cmp dword [ebp + 8], 0
je 0xe1c01a
cmp dword [ebp + 0xc], 0
jne 0xe1c014
cmp dword [ebp + 0x10], 0
je 0xe1c01a
cmp dword [ebp + 0x14], 0
jne 0xe1c01c
jmp 0xe1c06f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
push 0x33
call 0xe1c02f
add dword [esp], 5
retf
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00e5e5f4
mov esp, ebp
pop ebp
ret

Function at 0xe1c0d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
push 0x33
call 0xe1c0f0
add dword [esp], 5
retf

Function at 0xe23b50
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0xe23b99
mov al, byte [esi]
push eax
call fcn.00e30f40
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0xe23b77
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0xe2cbe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x71e], 0
je 0xe2cc63
cmp dword [edi + 0x1b0], 0
je 0xe2cc2d
push esi
push 1
push edi
call fcn.00e1fac0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00e1fac0
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0xe2cc63
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x10081650
push 2
push eax
call fcn.00e5f265
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00e5f265
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0xe2f2e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00e12180
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00e6b312
Function at 0xe34d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0xe34d6e
cmp dword [esi + 0x78], 0
je 0xe34d6e
push 2
push 3
push esi
call fcn.00e31560
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00e34750
add esp, 4
test esi, esi
je 0xe34d8e
cmp dword [esi + 0x78], 0
je 0xe34d8e
push 3
push esi
call fcn.00e315a0
add esp, 8
pop esi
pop ebp
ret
Function at 0xe40910
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.00e63ef4
add esp, 0x18
test eax, eax
je 0xe40932
cmp eax, 0xffffffff
jne 0xe40934
xor eax, eax
pop ebp
ret

Function at 0xe465f0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
push ebx
sar edx, 5
push esi
mov esi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 2
je 0xe4662d
push 0x100861ec
push esi
call fcn.00e2cc70
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0xe46644
push ecx
push 0x10086208
push esi
call fcn.00e2cd30
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0xe4665d
push ebx
push esi
call fcn.00e462b0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0xe46672
push esi
call fcn.00e452e0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0xe46687
push esi
call fcn.00e46290
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0xe46697
push esi
call fcn.00e464d0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xe5cdc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100928cc]
mov edi, eax
add esp, 4
test edi, edi
jne 0xe5cded
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0xe5ce34
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0xe5ce3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xe5ce9a
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0xe5ce60
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0xe5cec7
nop
mov eax, dword [esi + 4]
push 1
push 0x10089165
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x10089164
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0xe5cea0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xed6c1c
Capabilities:
Encode data using xor

Disassembly:
and byte [eax], 0x59
sub byte [esi], dh
dec esp
sahf
into
adc al, al
inc esp
cld
lahf
mov eax, 0xe84b7018
mov ecx, dword [esi + 0x54990562]
mov dword [ebp - 0x1047e341], esp
jecxz 0xed6c0c
popfd
push ds
pop edx
sub byte [edx - 0xa396914], ah
ficomp word [edi]
mov dh, 0x95
sbb byte [edx - 0x3de40a0e], bl
insd dword es:[edi], dx
adc al, 0x5f
std
push edi
test dword [edx - 0x5c5a4280], eax
pop ebx
cmpsb byte [esi], byte es:[edi]
cdq
fcmovnu st(0), st(4)
ja 0xed6b8d
sar esp, 1
test al, 0xa5
enter 0xffffffffffffb1ec, 0xffffffffffffffc9
add bl, byte [esi + eax*2 - 0x4ea24d65]
std
mov byte [esi - 0x22044e88], dl
movsd dword es:[edi], dword [esi]
jns 0xed6bd7
mov edx, 0x7ab2efa5
in al, dx
test ebx, ebx
push eax
pop edx
pop edx
rep lodsb al, byte [esi]
push es
cmp al, 0x5a
mov eax, 0x22bf7160
int 0x72
out dx, eax
insd dword es:[edi], dx
jge 0xed6b6e
sub byte [eax], ch
adc byte [ebx], dh
in eax, dx
sbb dword [eax + 0x5a], eax
hlt
inc esp
test cl, ah
xchg esp, eax
mov bh, 0x5c
jns 0xed6ba6
lodsd eax, dword [esi]
nop
xor ecx, dword [ebx + esi*2 - 0x67]
jb 0xed6c4b
invalid
pop ecx
pop ecx
test al, 0x53
push esp
or byte [edi + ecx*2], bh
mov dword [0xd9225a5f], eax
cmp al, 0xeb
cmp dword [edi - 0xe], edx
aas
loopne 0xed6c20
jg 0xed6bd9
leave
sub eax, 0x3759159a
salc
aad 0xb0
movsd dword es:[edi], dword [esi]
push ebp
insb byte es:[edi], dx
xchg ebp, eax
push esp
mov ch, 0x2e
xor eax, 0xc22b5a34
push es
xor byte [edx + edx*8 - 0x62], dh
lahf
add eax, dword [ecx]
pop esi
rcr byte [esi + 0x5e01039f], cl
invalid
Function at 0x100014cd
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x664
mov eax, 0x1002d938
call fcn.1000ef3b
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x65c]
mov esi, dword [ebp + 0x14]
push str.51759bca7c029c679ff36ad8ae674d39_87c403a6ceaf04ae3a707cdb5bde13d1
call fcn.1000ae4c
pop ecx
lea eax, [ebp - 0x65c]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], ebx
call fcn.1000b91a
push dword [ebp - 0x65c]
call fcn.10004e12
mov dword [ebp - 0x66c], 0x10040b64
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x668]
shl eax, 5
mov byte [ebp - 4], 3
lea eax, [eax + 0x10042090]
push eax
call fcn.1000ae4c
push dword [ebp + 8]
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], 4
call fcn.1000ae4c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 5
call fcn.1000ae4c
push esi
lea ecx, [ebp - 0x65c]
mov byte [ebp - 4], 6
call fcn.1000ae4c
add esp, 0x14
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x660]
push eax
lea edx, [ebp - 0x65c]
lea ecx, [ebp - 0x670]
call fcn.1000c9b7
lea ecx, [ebp - 0x618]
push 0x400
mov dword [ebp - 0x66c], ecx
lea ecx, [ebp - 0x66c]
push dword [eax]
call fcn.1000b3b0
push dword [ebp - 0x670]
call fcn.10004e12
push dword [ebp - 0x65c]
call fcn.10004e12
push dword [ebp - 0x660]
call fcn.10004e12
push dword [ebp - 0x664]
call fcn.10004e12
push dword [ebp - 0x668]
call fcn.10004e12
add esp, 0x14
lea eax, [ebp - 0x218]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push esi
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push str._s_s_s_s.license_x64
push eax
call fcn.10001256
add esp, 0x18
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
test eax, eax
je 0x10001681
lea eax, [ebp - 0x114]
push 0x100372dc
push eax
call fcn.10012f0a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10001681
lea ecx, [ebp - 0x618]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000165d
push esi
xor ebx, ebx
lea eax, [ebp - 0x618]
inc ebx
sub ecx, edx
push ebx
push ecx
push eax
call fcn.10013422
push esi
call fcn.1001312d
add esp, 0x14
push 0x10040b64
call fcn.10004e12
push dword [ebp - 0x638]
call fcn.10015041
push dword [ebp - 0x658]
call fcn.10015041
add esp, 0xc
mov eax, ebx
call fcn.1000eef9
ret 0x14
Function at 0x10007592
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xc], esi
mov ebx, dword [esi + 0x2c]
lea ecx, [esi + 0x38]
mov dword [ebp - 0x18], ebx
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x3c]
add eax, 0xfffffefa
sub edi, dword [esi + 0x74]
add eax, ebx
sub edi, dword [esi + 0x6c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edi
cmp dword [esi + 0x6c], eax
jb 0x10007656
mov ecx, dword [ecx]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.1000fbb0
mov ecx, dword [esi + 0x4c]
add esp, 0xc
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
sub dword [esi + 0x5c], ebx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
mov edi, dword [ebp - 8]
movzx ecx, bx
mov dword [ebp - 4], ecx
lea esi, [esi - 2]
movzx eax, word [esi]
mov edx, eax
sub eax, ecx
xor ecx, ecx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [esi], cx
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x100075f9
mov esi, dword [ebp - 0xc]
mov edi, ebx
movzx ecx, bx
mov dword [ebp - 8], ecx
mov eax, dword [esi + 0x40]
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
movzx eax, word [esi]
mov edx, eax
sub eax, ecx
xor ecx, ecx
movzx eax, ax
cmp edx, ebx
cmovae ecx, eax
mov word [esi], cx
mov ecx, dword [ebp - 8]
sub edi, 1
jne 0x10007629
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
add edi, ebx
lea ecx, [esi + 0x38]
mov dword [ebp - 8], ecx
mov ebx, dword [esi]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 4]
test eax, eax
je 0x10007726
mov ebx, dword [esi + 0x74]
add ebx, dword [ecx]
mov edx, dword [esi + 0x6c]
add ebx, edx
cmp eax, edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
cmovbe edi, eax
test edi, edi
jne 0x10007683
xor edi, edi
jmp 0x100076e2
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x100076a4
mov edx, dword [ebx]
mov ecx, dword [ebx + 0x30]
push edi
call fcn.10006e69
pop ecx
mov ecx, dword [ebp - 8]
jmp 0x100076c3
mov dword [ebp - 4], ecx
cmp eax, 2
jne 0x100076c9
mov edx, dword [ebx]
test edx, edx
jne 0x100076b6
xor eax, eax
jmp 0x100076c0
mov ecx, dword [ebx + 0x30]
push edi
call fcn.100070a9
pop ecx
lea ecx, [esi + 0x38]
mov dword [ebp - 4], ecx
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x14]
call fcn.1000fbb0
add dword [ebx], edi
add esp, 0xc
add dword [ebx + 8], edi
mov edx, dword [esi + 0x6c]
mov ecx, dword [ebp - 4]
add edi, dword [esi + 0x74]
mov dword [esi + 0x74], edi
cmp edi, 3
jb 0x1000770b
mov eax, dword [ecx]
mov ecx, dword [esi + 0x58]
movzx edx, byte [eax + edx]
mov dword [esi + 0x48], edx
shl edx, cl
mov ecx, dword [esi + 0x6c]
movzx eax, byte [eax + ecx + 1]
xor edx, eax
and edx, dword [esi + 0x54]
mov dword [esi + 0x48], edx
cmp edi, 0x106
jae 0x10007726
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x10007726
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
jmp 0x100075a9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009a82
Capabilities:
Get system firmware table

Disassembly:
push 0x1c
mov eax, 0x1002e405
call fcn.1000ef08
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
push eax
push eax
push 0x52534454
push 0x52534d42
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov edi, eax
test edi, edi
je 0x10009b2a
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
push ecx
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.1000b81c
push edi
mov edi, dword [ebp - 0x28]
push edi
push 0x52534454
push 0x52534d42
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov edx, dword [ebp - 0x24]
mov ecx, edx
sub ecx, edi
cmp eax, ecx
jne 0x10009af6
mov eax, dword [ebp - 0x20]
mov dword [esi], edi
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov byte [esi + 0xc], 1
jmp 0x10009b2e
test edi, edi
je 0x10009b2a
mov eax, dword [ebp - 0x20]
sub eax, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp eax, 0x1000
jb 0x10009b21
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100018a1
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
push eax
push edi
call fcn.1000e460
pop ecx
pop ecx
mov byte [esi + 0xc], 0
mov eax, esi
call fcn.1000eee5
ret

Function at 0x1000c35f
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
mov esi, ecx
push 0
push esi
call fcn.10010130
add esp, 0xc
mov dword [esi + 0x40], 0x67452301
mov dword [esi + 0x44], 0xefcdab89
mov eax, esi
mov dword [esi + 0x48], 0x98badcfe
mov dword [esi + 0x4c], 0x10325476
and dword [esi + 0x50], 0
and dword [esi + 0x54], 0
pop esi
ret
Function at 0x1000d7d1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x1000d7f2
jl 0x1000d7e9
test edi, edi
jne 0x1000d7f2
xor eax, eax
xor edx, edx
jmp 0x1000d8b3
cmp dword [ebx + 0x38], 0
je 0x1000d807
push eax
push edi
push dword [ebp + 8]
call fcn.1000a39f
jmp 0x1000d8b3
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000d84e
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x1000d84e
cmp eax, edi
jb 0x1000d828
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.1000fbb0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x1000d854
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x1000d8a8
mov ecx, ebx
call fcn.1000d0f5
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x1000d893
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10019715
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x1000d8a8
jmp 0x1000d866
test edx, edx
je 0x1000d8a8
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10019715
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x1001aeec
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001af2b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001af2b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001af2b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001af2b
cmp dword [ecx + 0x74], 0xe
jbe 0x1001af2b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret