joyce8/EMBER2024-capa huggingface dataset:
Function at 0x108acf7
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x46c
mov eax, 0x10a3a20
call fcn.010044ce
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x418], ax
xor esi, esi
lea eax, [ebp - 0x416]
push esi
push eax
mov ebx, ecx
call sub.msvcrt.dll_memset
push 0x60
mov dword [ebp - 0x448], 0x104
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x43c], esi
call sub.MFC42u.dll_operatornew
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x420], ecx
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x108ad86
add ebx, 0x1c
push ebx
call fcn.010295ce
mov dword [ebp - 0x41c], eax
jmp 0x108ad8c
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x45c]
push eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x424]
push eax
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x108af2e
cmp dword [ebp - 0x424], esi
je 0x108af2b
lea ecx, [ebp - 0x454]
call fcn.01029633
mov dword [ebp - 4], 1
mov dword [ebp - 0x428], esi
cmp dword [ebp - 0x424], esi
jbe 0x108aee2
lea eax, [ebp - 0x45c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x440], 0xff
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x108aeca
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x478]
call fcn.0100b2e8
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x478]
push eax
mov byte [ebp - 4], 2
call fcn.0108a535
push esi
push 1
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 1
call fcn.01008010
mov ecx, dword [ebp - 0x41c]
call fcn.0108abf8
test eax, eax
je 0x108aea3
mov ecx, dword [ebp - 0x41c]
call fcn.01088efb
test eax, eax
je 0x108aeca
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], ebx
push eax
lea ecx, [ebp - 0x454]
inc ebx
call fcn.0108a1a5
lea ecx, [ebp - 0x210]
push ecx
mov ecx, eax
call fcn.0100b314
inc dword [ebp - 0x428]
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x424]
jb 0x108ae18
xor edi, edi
cmp ebx, esi
jbe 0x108af1c
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x420], edi
call fcn.0108a1a5
mov ecx, dword [ebp - 0x41c]
push eax
call fcn.0108a535
mov ecx, dword [ebp - 0x41c]
call fcn.0108aae1
inc edi
cmp edi, ebx
jb 0x108aee8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.01089bca
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x41c]
cmp ecx, esi
je 0x108af3f
push 1
call fcn.0101165c
mov eax, ebx
call fcn.0100450b
ret 4
Function at 0x108b06d
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10aa090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x210], ebx
cmp dword [esi + 0xc], ebx
jne 0x108b09d
mov eax, 0x80004005
jmp 0x108b1cc
push edi
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x108b0b9
cmp eax, edi
jbe 0x108b0bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0108d3ac
cmp eax, ebx
mov dword [ebp - 0x214], eax
jl 0x108b1b9
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, 0xb7
test eax, eax
jne 0x108b11c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
je 0x108b11c
test eax, eax
jle 0x108b10e
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x214], eax
test eax, eax
jl 0x108b1b9
push dword [esi + 4]
call fcn.01008072
mov eax, dword [ebp - 0x210]
and dword [ebp - 0x210], 0
mov dword [esi + 4], eax
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x108b17a
push dword [0x10af448]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0100fbdc
test eax, eax
jl 0x108b17a
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0108d3ac
mov dword [ebp - 0x214], eax
test eax, eax
jl 0x108b1b9
push 0
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x108b1a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
je 0x108b1a0
mov dword [ebp - 0x214], 1
push dword [esi + 4]
call fcn.01008072
mov eax, dword [ebp - 0x210]
and dword [ebp - 0x210], 0
pop ecx
mov dword [esi + 4], eax
push dword [ebp - 0x210]
call fcn.01008072
mov eax, dword [ebp - 0x214]
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100449b
leave
ret
Function at 0x108d58e
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi - 0xc]
neg eax
lea ecx, [esi + 4]
sbb eax, eax
and eax, ecx
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
call fcn.0108b2f1
lea eax, [esi + 0x8c]
cmp dword [eax], edi
je 0x108d6a7
push dword [esi + 0x5c]
mov dword [eax], edi
call fcn.01008072
mov eax, dword [esi + 0x6c]
pop ecx
cmp eax, edi
je 0x108d5dc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x6c], edi
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x108d5ec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x70], edi
mov eax, dword [esi + 0x74]
push ebx
mov ebx, 0x1055a08
cmp eax, edi
je 0x108d61f
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push ebx
push eax
call dword [ecx]
test eax, eax
jl 0x108d61f
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x108d61f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x74], edi
cmp eax, edi
je 0x108d64f
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push ebx
push eax
call dword [ecx]
test eax, eax
jl 0x108d64f
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x108d64f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x78]
mov dword [esi + 0x7c], edi
cmp eax, edi
je 0x108d67f
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push ebx
push eax
call dword [ecx]
test eax, eax
jl 0x108d67f
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x108d67f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x78]
pop ebx
cmp eax, edi
je 0x108d690
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x78], edi
mov eax, dword [esi + 0x64]
cmp eax, edi
je 0x108d6a7
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0x64]
call fcn.01008072
pop ecx
mov eax, dword [ebp - 8]
cmp eax, edi
pop edi
pop esi
je 0x108d6ba
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
leave
ret
Function at 0x1090245
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi - 4]
neg eax
lea ecx, [esi + 4]
sbb eax, eax
and eax, ecx
push eax
lea ecx, [ebp - 4]
call fcn.0108b2f1
lea eax, [esi + 0x94]
xor ebx, ebx
cmp dword [eax], ebx
je 0x10902fa
mov dword [eax], ebx
cmp dword [esi + 0x9c], ebx
je 0x1090287
push ebx
lea ecx, [esi - 4]
call fcn.010901f2
push edi
lea edi, [esi + 0x8c]
mov eax, dword [edi]
cmp eax, ebx
je 0x109029c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
cmp dword [esi + 0x98], ebx
je 0x10902b0
push dword [esi + 0x90]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0x90]
call fcn.01008072
push dword [esi + 0x6c]
call fcn.01008072
push dword [esi + 0x74]
call fcn.01008072
lea edi, [esi + 0x84]
mov eax, dword [edi]
add esp, 0xc
cmp eax, ebx
je 0x10902e2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
lea edi, [esi + 0x88]
mov eax, dword [edi]
cmp eax, ebx
je 0x10902f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebx
mov dword [esi + 0x20], ebx
pop edi
mov eax, dword [ebp - 4]
pop esi
cmp eax, ebx
pop ebx
je 0x109030d
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
leave
ret
Function at 0x10903a7
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
or dword [ebp - 8], 0xffffffff
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, esi
xor edi, edi
neg eax
lea ecx, [esi + 8]
sbb eax, eax
and eax, ecx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.0108b2f1
cmp dword [esi + 0x98], ebx
jne 0x10903eb
mov edi, 0x802a0035
jmp 0x109055b
mov eax, dword [esi + 0x94]
cmp eax, ebx
jne 0x1090410
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1090406
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x80004005
jmp 0x1090577
cmp dword [esi + 0x9c], ebx
jne 0x109055b
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1090468
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x109045e
call esi
cmp eax, ebx
jle 0x1090457
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x109055b
mov edi, 0x8000ffff
jmp 0x109055b
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
push esi
call dword [eax + 0x14]
push 1
mov ecx, esi
call fcn.010901f2
mov edi, eax
cmp edi, ebx
jge 0x10904d5
jmp 0x109055b
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x78]
push dword [ebp - 4]
add eax, dword [esi + 0x80]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10904c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10904b9
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov edi, eax
jl 0x109055b
mov eax, dword [ebp - 4]
add dword [esi + 0x84], eax
mov eax, dword [ebp - 0x10]
add dword [esi + 0x80], eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.0108fd92
cmp dword [ebp - 4], ebx
ja 0x1090486
mov ecx, esi
call fcn.0108fa31
mov edi, eax
cmp edi, ebx
jl 0x109055b
push ebx
call fcn.010901f2
mov edi, eax
cmp edi, ebx
jl 0x109055b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x94]
lea ebx, [esi + 0x90]
push ebx
push eax
call fcn.0108d2c1
mov edi, eax
test edi, edi
jl 0x1090559
mov ebx, dword [ebx]
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push ebx
call dword [eax + 0x10]
mov edi, eax
test edi, edi
jl 0x1090559
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp eax, dword [ebp - 0xc]
je 0x109054d
mov edi, 0x80004005
jmp 0x109055b
mov dword [esi + 0x9c], 1
jmp 0x109055b
xor ebx, ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1090575
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1090fe5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1090ff8
xor eax, eax
jmp 0x10910ce
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x10910b1
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x10910d8]
inc edx
sub edi, 8
dec esi
jne 0x1091016
pop ebx
test edi, edi
je 0x10910ca
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x10910d8]
inc edx
dec edi
jne 0x10910b5
pop edi
not eax
pop esi
pop ebp
ret 0xc
Function at 0x1091f44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 0xc], edi
jmp 0x1091f59
mov edi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp - 8], eax
jne 0x1091f78
test ecx, ecx
jne 0x1091f86
test edx, edx
jne 0x1091f86
mov dword [ebp - 8], edi
jmp 0x1091ff0
cmp eax, 0xffffffff
jne 0x1091f86
mov dword [ebp - 8], 0xfffffffe
jmp 0x1091ff0
mov eax, dword [esi + 0x24]
lea eax, [edi + eax - 0x106]
cmp ecx, eax
jb 0x1091ff0
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x1091fb7
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x1091fd6
add dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x1092093
mov ebx, dword [esi + 0x6c]
add ebx, dword [esi + 0x64]
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 8]
add ebx, dword [esi + 0x30]
mov dword [ebp - 4], eax
cmp eax, ecx
jbe 0x1092015
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x109201f
xor eax, eax
jmp 0x1092054
sub eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
cmp dword [eax + 0x18], 0
jne 0x109203e
push dword [ebp - 4]
push dword [edi]
push dword [edi + 0x30]
call fcn.010933a0
mov dword [edi + 0x30], eax
push dword [ebp - 4]
push dword [edi]
push ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x6c], eax
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x109207f
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [ecx + eax]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x1092093
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x1091f56
pop edi
pop ebx
leave
ret
Function at 0x41ed00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x3c], 0xdf24
mov dword [ebp - 0x48], 0xbd5f
mov dword [ebp - 0x2c], 0xea58
mov dword [ebp - 0x38], 0x90f7
mov dword [ebp - 0x54], 0xa293
mov dword [ebp - 0x4c], 0x7e4f
mov dword [ebp - 0x6c], 0xb108
mov dword [ebp - 0x34], 0xbba6
mov dword [ebp - 0x44], 0xc247
mov dword [ebp - 0x50], 0xc1
mov dword [ebp - 0x8c], 0xe016
mov dword [ebp - 0x80], 0xf8f0
mov dword [ebp - 0x90], 0x101c6
mov dword [ebp - 8], 0x57e3
mov dword [ebp - 0x20], 0x170a2
mov dword [ebp - 0x18], 0x132fa
mov dword [ebp - 0x94], 0x4e47
mov dword [ebp - 0x30], 0x1458d
mov dword [ebp - 0x24], 0x3dc5
mov dword [ebp - 0x10], 0x3ab0
mov dword [ebp - 0x40], 0x152c
mov dword [ebp - 4], 0x33d2
mov dword [ebp - 0x14], 0xbcd4
mov dword [ebp - 0x58], 0x6518
mov dword [ebp - 0x28], 0x52db
mov dword [ebp - 0x1c], 0x662f
mov dword [ebp - 0x98], 0x1252b
mov dword [ebp - 0xc], 0x203f
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x2c]
jl 0x41ee16
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 8]
nop
nop
inc eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [ebp - 0x68]
jge 0x41ee5a
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x3c]
jge 0x41ee5a
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x54]
jge 0x41ee5a
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
jge 0x41ee5a
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x10]
jge 0x41ee5a
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jge 0x41ee5a
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x20]
jge 0x41ee5a
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x14]
jge 0x41ee5a
mov eax, dword [ebp - 0x14]
dec eax
nop
nop
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
cdq
idiv dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x41ee5a
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x38]
sub edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401000
Capabilities:
Accept command line arguments
Access peb ldr_data
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
push esi
push edi
lea eax, [esp + 0x14]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x401174
cmp dword [esp + 0x14], 1
jl 0x401174
xorps xmm0, xmm0
mov dword [esp + 0x38], 0x44
push str.KrkrUniversalPatch.dll
lea eax, [esp + 0x1c]
movlpd qword [esp + 0x40], xmm0
push eax
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movaps xmmword [esp + 0x28], xmm0
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + 0x1c]
sub ecx, 0x10
mov edi, ecx
mov ecx, dword [ecx + 0x10]
sub ecx, 0x10
mov edx, dword [ecx + 0x30]
test edx, edx
je 0x4010e4
mov eax, dword [edx]
mov esi, dword [edx + 4]
and eax, 0xffdfffdf
and esi, 0xffdfffdf
cmp eax, 0x45004b
jne 0x4010e4
cmp esi, 0x4e0052
jne 0x4010e4
mov eax, dword [edx + 8]
mov esi, dword [edx + 0xc]
and eax, 0xffdfffdf
and esi, 0xffdfffdf
cmp eax, 0x4c0045
jne 0x4010e4
cmp esi, 0x120013
jne 0x4010e4
cmp word [edx + 0x10], 0x2e
je 0x4010ea
cmp edi, ecx
jne 0x401091
xor ecx, ecx
mov ecx, dword [ecx + 0x18]
mov edx, 0x638020fb
call fcn.004015c0
push 0
lea ecx, [esp + 0x24]
mov dword [0x4145a8], eax
push ecx
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push str.moroclo.exe
push 0
push 0
call eax
test eax, eax
je 0x40115c
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub esp, 0xc
push eax
call fcn.00401330
add esp, 0x10
push 0
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtResumeThread]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Krkr_Universal_Patch
push str.Couldnt_Launch_Game
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4011e0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
mov eax, 0x5a4d
push edi
cmp word [esi], ax
jne 0x401240
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x401240
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
cmp cx, dx
je 0x40121a
mov edx, 0x20b
cmp cx, dx
jne 0x401240
mov ecx, 0x88
jmp 0x40121f
mov ecx, 0x78
mov edx, dword [eax + 0x50]
lea edi, [eax + ecx]
mov ecx, edi
call fcn.004011a0
test eax, eax
je 0x401240
mov eax, dword [edi]
cmp dword [eax + esi + 0x1c], edx
jae 0x401240
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x40230a
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x441900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401648
push 0xc
call fcn.00404aab
pop ecx
test eax, eax
je 0x402343
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004016a1
jmp 0x402345
xor eax, eax
mov esi, dword [eax + 4]
shl esi, 2
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
lea eax, [ebp - 0x20]
mov ebx, 0x4ac
mov edi, 0x441440
sub esi, 0x40
push eax
push 0x40
push ebx
push edi
push 0xffffffffffffffff
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push edi
mov dword [ebp - 0x24], esi
call fcn.004020fc
push 0x3f
push section..data
push 0x1b400
mov esi, 0x426040
push esi
call fcn.00401c27
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push esi
push 0x4415c8
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateCaret]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp - 0x1c]
call fcn.00401fb0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret

Function at 0x4039ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403a0e
jl 0x403a05
test edi, edi
jne 0x403a0e
xor eax, eax
xor edx, edx
jmp 0x403acf
cmp dword [ebx + 0x38], 0
je 0x403a23
push eax
push edi
push dword [ebp + 8]
call fcn.00403ad5
jmp 0x403acf
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403a6a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403a6a
cmp eax, edi
jb 0x403a44
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405610
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x403a70
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x403ac4
mov ecx, ebx
call fcn.00403116
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x403aaf
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040a942
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x403ac4
jmp 0x403a82
test edx, edx
je 0x403ac4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a942
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc