joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034c10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x102a8430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
sub esp, 8
mov dword [ebp - 0x38], esi
mov edx, esp
mov dword [edx], edi
test edi, edi
jne 0x10034c3f
xor ecx, ecx
jmp 0x10034c5c
cmp byte [edi], 0
jne 0x10034c48
xor ecx, ecx
jmp 0x10034c5c
mov ecx, edi
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10034c50
sub ecx, esi
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x1c]
mov dword [edx + 4], ecx
push eax
call fcn.100150a0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10034c73
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 8]
mov ebx, eax
cmp ecx, 8
jb 0x10034c91
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.10008df0
test ebx, ebx
jne 0x10034caa
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003ae2a
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x10034d8a
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003b79f
add esp, 4
mov esi, eax
push ebx
push esi
sub esp, 8
mov edx, esp
mov dword [edx], edi
test edi, edi
je 0x10034cf1
cmp byte [edi], 0
jne 0x10034ce5
xor edi, edi
jmp 0x10034cf1
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10034ce8
sub edi, ecx
lea eax, [ebp - 0x1c]
mov dword [edx + 4], edi
push eax
call fcn.100150a0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10034d08
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x10034d24
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.10008df0
push esi
lea ecx, [ebp - 0x1c]
call fcn.10009810
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.10014fa0
mov ecx, dword [ebp - 0x38]
push eax
call fcn.10005820
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x10034d56
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.10001950
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
cmp eax, 8
jb 0x10034d7d
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.10008df0
test esi, esi
je 0x10034d8a
push esi
call fcn.1003b79a
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ae2a
mov esp, ebp
pop ebp
ret 8
Function at 0x10035b15
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x102a8430]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x224]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push eax
call fcn.10008500
push ecx
push ecx
mov ecx, esp
push esi
call fcn.10008080
push 0xe
lea eax, [ebp - 0x23c]
push 0x1006e088
push eax
call fcn.1003851e
pop ecx
mov ecx, esp
push eax
call fcn.10008080
xor esi, esi
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.1000d800
add esp, 0x18
lea ecx, [ebp - 0x23c]
push esi
push 1
call fcn.100085e0
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1003c940
add esp, 0xc
lea ecx, [ebp - 0x20c]
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ecx
push ecx
mov esi, esp
lea eax, [ebp - 0x20c]
push eax
mov dword [esi], eax
call fcn.10007050
pop ecx
lea ecx, [ebp - 0x254]
mov dword [esi + 4], eax
call fcn.100072f0
lea eax, [ebp - 0x254]
push eax
call fcn.100093c0
pop ecx
test al, al
je 0x10035c46
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.100385cd
mov ecx, esp
push ebx
call fcn.100080b0
push ecx
push ecx
lea eax, [ebp - 0x23c]
mov ecx, esp
push eax
call fcn.100080b0
call fcn.1000d7d0
add esp, 0x10
lea ecx, [ebp - 0x23c]
push 0
push 1
test al, al
je 0x10035c41
call fcn.10001360
mov bl, 1
jmp 0x10035c61
call fcn.10001360
sub esp, 0x28
mov eax, esp
and dword [eax + 0x24], 0
lea eax, [ebp - 0x254]
push eax
push edi
call fcn.10038710
add esp, 0x30
mov bl, al
lea ecx, [ebp - 0x254]
call fcn.10007370
push 0
push 1
lea ecx, [ebp - 0x224]
call fcn.100085e0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ae2a
mov esp, ebp
pop ebp
ret
Function at 0x10037984
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.10037ab6
pop ecx
test al, al
je 0x100379b2
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10037dfd
add esp, 0xc
test eax, eax
jns 0x100379b8
push dword [ebp + 8]
call fcn.10037d8d
pop ecx
pop ebp
jmp fcn.10037904
pop ebp
ret

Function at 0x10037b83
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x102a8430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x10037bc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10037c54
push edi
push 0x14
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x10037bee
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10037c41
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10037c16
cmp dword [ebp - 0x1c], 4
je 0x10037c41
cmp dword [ebp - 0x1c], 2
je 0x10037c41
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10037c41
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x80070420
je 0x10037c41
mov ebx, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10037c4e
push esi
call edi
push dword [ebp - 0x24]
call edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ae2a
mov esp, ebp
pop ebp
ret
Function at 0x10037c66
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x102a8430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x10037caa
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10037d7b
push edi
push 0x24
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10037d03
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10037d19
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x10037d68
cmp eax, 3
je 0x10037d1c
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10037d19
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10037d68
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x10037d68
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x1c], 1
mov edi, eax
je 0x10037d68
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1f40
jae 0x10037d5b
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x1c]
cmp eax, 1
jne 0x10037d2f
jmp 0x10037d5e
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x10037d68
mov ebx, 0x800705b4
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10037d75
push esi
call edi
push dword [ebp - 0x24]
call edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1003ae2a
mov esp, ebp
pop ebp
ret
Function at 0x10037dfd
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0xc]
call fcn.100379ba
add esp, 0xc
test al, al
je 0x10037e19
xor eax, eax
pop ebp
ret
push dword [ebp + 8]
call fcn.10037c66
pop ecx
test eax, eax
js 0x10037eb0
push ebx
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x10037e57
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10037eac
push esi
push 2
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x10037e85
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push 1
push dword [ebp + 0x10]
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x10037e99
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test esi, esi
je 0x10037ea4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x6ee790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20e000]
push edi
or ebp, 0xffffffff
jmp 0x6ee7b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6ee7b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ee7a8
mov eax, 1
add ebx, ebx
jne 0x6ee7cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6ee7dc
jne 0x6ee7fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ee7fb
dec eax
add ebx, ebx
jne 0x6ee7e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6ee7c0
add ebx, ebx
jne 0x6ee7f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6ee84d
xor ecx, ecx
sub eax, 3
jb 0x6ee813
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6ee882
sar eax, 1
mov ebp, eax
jmp 0x6ee81e
add ebx, ebx
jne 0x6ee81e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ee7ec
inc ecx
add ebx, ebx
jne 0x6ee82c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6ee7ec
add ebx, ebx
jne 0x6ee839
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6ee82e
jne 0x6ee84a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6ee82e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6ee86c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6ee85e
jmp 0x6ee7ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6ee86c
add edi, ecx
jmp 0x6ee7ae
pop esi
mov edi, esi
mov ecx, 0x9db4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6ee88a
cmp byte [edi], 0x1e
jne 0x6ee88a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6ee88f
lea edi, [esi + 0x2ea000]
mov eax, dword [edi]
or eax, eax
je 0x6ee8fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f37a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f3880]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6ee8bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f3884]
or eax, eax
je 0x6ee8f8
mov dword [ebx], eax
add ebx, 4
jmp 0x6ee8d9
call dword [esi + 0x2f3894]
mov ebp, dword [esi + 0x2f3888]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6ee932
sub esp, 0xffffff80
jmp 0x56a018

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x574b17
Capabilities:
Encode data using xor

Disassembly:
sar byte [edx], 0xc8
sbb dword [ebx - 0x1f], ecx
and al, byte [edi + 0xc]
add edi, edi
and dl, byte [esi - 0x36]
sub cl, byte [edi + esi*8 + 0x72321ad0]
invalid
xor edx, dword [ebp - 0x3d]
and dword [0x118379b2], edx
mov dl, 0x79
adc dword [ecx], 0x55
mov dl, 0x79
adc dword [ecx], 0x55
cmp dword [ecx - 0x2d], eax
sal edx, 1
fsub dword [ecx - 6]
mov bl, 0x24
jecxz 0x574af4
or esp, ecx
sbb eax, ebx
push eax
loop 0x574b12
invalid

Function at 0x57c907
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebp + 0x35a0ea7a], esi
cmpsb byte [esi], byte es:[edi]
bound eax, qword [eax]
iretd
jb 0x57c8e6
mov byte [ecx - 0x27a7646b], ah
pushal
mov dword [0x1944fe61], eax
push eax
mov esp, 0x6913542c
or eax, 0x9ed9965c
sal dword [eax - 0x33572368], 0x73
jns 0x57c98f
mov al, byte [0xd4a49065]
test al, 0x36
sbb bh, cl
retf
mov bl, 0x70
setbe byte [0x6d35095f]
add byte [esi - 0x1e], bh
test eax, 0x41118859
frstor dword [di]
and byte [eax], dh
push ebp
cmp eax, 0xbec97059
rol edx, 0xf8
div byte [edx - 0x173ef787]
mov ah, 0x28
adc dh, cl
cwde
dec ebp
and eax, 0x52969357
outsd dx, dword [esi]
pushfd
push 0xa831a890
mov edx, dword [edi + 0x35]
cdq
mov edx, 0x8e559900
jns 0x57ca11
or al, 0x6e
das
cmpsb byte [esi], byte es:[edi]
pop ebp
mov bl, byte [eax - 0x40]
dec edx
mov al, byte [0xf48f058]
and dword [ebp + ecx*4 - 0x572266a7], edx
mov al, byte [0xdcdd64c9]
mov word [ecx + 0x30f8acc8], fs
fmul qword [ecx + 0x30f8acc8]
jnp 0x57c9ea
cmp eax, edx
imul ebp, dword [edx + 0x40e1f850], 0x7f1e8b51
popal
push ebx
test dword [eax + ebx*4 - 0x6e3f4860], ebx
cwde
ret 0x41b5
rcl byte [ecx + 0x41b5c298], 0x44
sbb byte [eax + 0x780e0e02], ah
leave
push cs
js 0x57ca06
leave
mov al, 0xbb
and al, 0x28
rsm
stosd dword es:[edi], eax
insb byte es:[edi], dx
sbb dh, byte [edi - 2]
cmp al, 0xe2
mov ecx, 0xbdf8b80c
push 0x4a
loopne 0x57ca44
mov al, 0x8e
fidivr dword [esi - 0xfb859a7]
pushal
mov eax, 0x1dd9fed0
dec edi
xchg ecx, eax
adc dword [edx - 0x17e54541], ebx
invalid
jae 0x5c9e031e
push cs
sbb bh, byte [ecx - 0x43333184]
leave
outsb dx, byte [esi]
xor al, 0x90
and al, 0xe4
cmc
arpl word [esi + 0x28059e38], cx
add dword [eax + ecx*4], ebp
das
mov ah, 0xf9
stosb byte es:[edi], al
movsd dword es:[edi], dword [esi]
invalid
Function at 0x5ca727
Capabilities:
Encode data using xor

Disassembly:
wait
cmp ecx, dword [edx - 0x73]
pop ecx
mov esi, 0xda661954
xchg byte [ebx - 0x22], cl
out 0x7e, al
mov dl, 0x48
jbe 0x5ca706
test byte [ebx + 0x64f9dabd], ch
push ds
sub al, 0xc5
add eax, 0x544d4c08
mov byte [edi], ah
pop eax
aaa
xchg byte [ecx - 0x46], al
mov byte [ecx + 0x2bffe28c], 0x97
add al, 0x95
sub al, 0xf2
pop ebp
leave
xchg ecx, eax
cmp eax, ecx
mul esi
loopne 0x5ca77a
adc eax, 0x51f7a464
pop ds
cmp ch, ch
mov esp, 0xb5563b69
imul ebp, dword [eax - 0x74e4742b], 0xf04a5969
pop ecx
nop
cwde
enter 0xd14, 0x2a
mov edx, 0xf499f4d7
sub dword [ebx - 0x56], eax
stosb byte es:[edi], al
mov esi, 0x396e192b
js 0x5ca6d2
xor byte [eax + 0x4174d7a4], ch
jns 0x5ca733
stosb byte es:[edi], al
dec eax
wait
stosd dword es:[edi], eax
fist dword [0xdf7bc6e5]
invalid
and dword [edi + 0x51595e9], esp
cld
test byte [edi], 0xe9
pop esp
sub eax, 0x89c8b8d3
lahf
mov edi, 0xb57af416
out dx, al
ror dword [ecx], cl
invalid
sub ecx, ecx
stc
jg 0x5ca7d4
jnp 0x5ca7f7
xchg byte [ebx + ebx*2 + 0x79], al
xchg esi, eax
fucom st(5)
sub dword [edx - 0x58], ebx
movsb byte es:[edi], byte [esi]
cmp al, 0x99
xor dword [edx], 0xffffffd4
dec ebx
lahf
push cs
add al, byte [eax + 0x61]
test byte [eax - 0x29], 0xc9
xor esp, dword [ebp + esi - 0x7f]
in al, dx
jecxz 0x5ca7d8
or eax, ebp
test al, 0xe4
jb 0x5ca75d
sbb dword [ebx - 0x4f], edx
lodsb al, byte [esi]
xchg ebp, eax
stosb byte es:[edi], al
fnstcw word [0x78d4c521]
and al, 0xe9
xor eax, 0x482fbfb
xchg esi, eax
adc dl, al
push ecx
cli
xchg ecx, eax
popal
pop ebx
adc al, 0x46
mov ah, 0x75
or dword [esi], edx
out dx, al
pop eax
loopne 0x5ca804
jae 0x5ca828
pop esi
or ebp, edi
sub eax, 0x1bfef9a4
movsb byte es:[edi], byte [esi]
stc
invalid
lcall 0x21ac, 0x99316544
ret 0x9815
xor eax, 0xc976a654
cmc
jae 0x5ca7ae
jbe 0x5ca7a6
enter 0xfffffffffffff286, 0x58
pop eax
sbb ecx, edi
xchg ebx, eax
or dword [esi], edx
leave
wait
clc
sti
dec esp
or bh, 0x44
imul byte [eax - 0x17]
sar dl, 1
mov word [esi], cs
pop esp
int 0xf4
lodsb al, byte [esi]
test al, 0xec
mov word [esp + ebx*4 - 0x395f604], fs
imul eax, esp, 0xa
les ecx, [edx]
salc
or eax, 0x28a73604
invalid
Function at 0x10005920
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x114]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.10004850
push 0x6f
mov ecx, esi
call fcn.10005440
pop edi
pop esi
add esp, 0x104
ret 4

Function at 0x10005980
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x208
push ebx
push esi
mov ebx, ecx
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], dl
mov byte [esp + 0xc], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov esi, dword [esp + 0x218]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x110]
push 0x104
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0xc]
lea eax, [esi + eax + 1]
push 0x104
push ecx
push eax
call edi
lea edx, [esp + 0xc]
lea eax, [esp + 0x110]
push edx
push eax
call dword [0x10022758]
push 0x71
mov ecx, ebx
call fcn.10005440
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4

Function at 0x100066b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x25c
push ebx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], bl
push 0x10022da4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x160]
push ecx
push ebx
push str.update
push edx
call fcn.10004520
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [esp + 0x268]
lea eax, [esp + 0x5c]
push eax
push ecx
call fcn.100100b0
add esp, 8
test al, al
jne 0x10006725
pop edi
pop ebx
add esp, 0x25c
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
push 0x10023314
push edx
lea eax, [esp + 0x168]
push str._s_baijinUPdate__s
push eax
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x30], str.WinSta0Default
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
lea eax, [esp + 0x160]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
push ebx
lea ecx, [esp + 0x7c]
push eax
push ecx
call dword [0x1002276c]
test eax, eax
je 0x100067a5
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov bl, 1
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop esi
mov al, bl
pop edi
pop ebx
add esp, 0x25c
ret
Function at 0x10007c70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [str.BBPP_5___Bf]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push edi
lea ecx, [esp + 0x10]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x10]
push str..key
push edx
call fcn.10003fe0
add esp, 8
lea eax, [esp + 0x10]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [0x100225b0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10007d18
push esi
push edi
push ebx
call dword [0x1002268c]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x10022630]
xor eax, eax
test edi, edi
jbe 0x10007d03
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x10007cf5
push edi
push esi
mov ecx, ebp
call fcn.10007c10
push esi
mov edi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x10007d90
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.wINmM.dLl
call fcn.10007d30
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov esi, eax
push str.mixerGetNumDevs
push esi
call edi
push str.mixerOpen
push esi
mov dword [0x10022784], eax
call edi
push str.mixerClose
push esi
mov dword [0x10022788], eax
call edi
push str.mixerSetControlDetails
push esi
mov dword [0x1002278c], eax
call edi
push str.mixerGetLineInfoA
push esi
mov dword [0x10022790], eax
call edi
push str.mixerGetLineControlsA
push esi
mov dword [0x10022794], eax
call edi
push str.mixerGetControlDetailsA
push esi
mov dword [0x10022798], eax
call edi
push str.waveInClose
push esi
mov dword [0x1002279c], eax
call edi
push str.waveInOpen
push esi
mov dword [0x100227a8], eax
call edi
push str.waveInPrepareHeader
push esi
mov dword [0x100227a4], eax
call edi
push str.waveInUnprepareHeader
push esi
mov dword [0x100227ac], eax
call edi
push str.waveInAddBuffer
push esi
mov dword [0x100227b0], eax
call edi
push str.waveInStart
push esi
mov dword [0x100227b4], eax
call edi
push str.waveInStop
push esi
mov dword [0x100227b8], eax
call edi
push str.waveInReset
push esi
mov dword [0x100227bc], eax
call edi
push str.waveOutClose
push esi
mov dword [0x100227c0], eax
call edi
push str.waveOutOpen
push esi
mov dword [0x100227cc], eax
call edi
push str.waveOutPrepareHeader
push esi
mov dword [0x100227c8], eax
call edi
push str.waveOutUnprepareHeader
mov dword [0x100227d0], eax
push esi
call edi
push str.waveOutWrite
push esi
mov dword [0x100227d4], eax
call edi
push str.waveOutReset
push esi
mov dword [0x100227d8], eax
call edi
push str.waveInGetNumDevs
push esi
mov dword [0x100227dc], eax
call edi
push str.waveOutGetNumDevs
push esi
mov dword [0x100227a0], eax
call edi
push str.mixerGetDevCapsA
push esi
mov dword [0x100227c4], eax
call edi
push str.waveInGetDevCapsA
push esi
mov dword [0x1002277c], eax
call edi
pop edi
mov dword [0x10022780], eax
pop esi
ret