joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73df7e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov dword [ebx + 8], 0x73da1140
mov dword [ebx + 0xc], 0
lock inc dword [0x73f3f110]
mov dword [ebx + 8], 0x73da21f0
mov dword [ebx], 0x73da2200
mov ecx, dword [ebp + 8]
mov dword [ebx + 4], 0x73da2244
mov dword [ebx + 8], 0x73da2270
mov byte [ebx + 0x14], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x10], 0x73da1f78
mov dword [ebx + 0x88], ecx
test ecx, ecx
je 0x73df7f0b
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x73f59474]
call esi
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x73df7f81
movzx eax, byte [edx + 4]
lea esi, [edx + 8]
mov byte [ebx + 0x14], al
mov ecx, 7
push edi
lea edi, [ebx + 0x18]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0x24]
mov ecx, 7
lea edi, [ebx + 0x34]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 0x40]
mov dword [ebx + 0x50], eax
mov eax, dword [edx + 0x44]
mov dword [ebx + 0x54], eax
mov eax, dword [edx + 0x48]
mov dword [ebx + 0x58], eax
mov eax, dword [edx + 0x4c]
mov dword [ebx + 0x5c], eax
mov eax, dword [edx + 0x50]
mov dword [ebx + 0x60], eax
mov eax, dword [edx + 0x54]
mov dword [ebx + 0x64], eax
mov eax, dword [edx + 0x58]
mov dword [ebx + 0x68], eax
mov eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x64]
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], ecx
mov eax, dword [edx + 0x68]
mov dword [ebx + 0x78], eax
movzx eax, byte [edx + 0x6c]
mov byte [ebx + 0x7c], al
mov eax, dword [edx + 0x70]
mov dword [ebx + 0x80], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x73e22670
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x73e226d8
push esi
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
cmp ecx, 0xffffffff
je 0x73e226d8
push esi
push ecx
push esi
push 2
push esi
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x73e226d8
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
je 0x73e226d8
mov bl, 1
jmp 0x73e226de
xor bl, bl
test esi, esi
je 0x73e226e5
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x73e226f1
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x73e29720
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push esi
push 0
push 0x80
push 3
push eax
push 5
push 0x80000000
push ebx
mov esi, ecx
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x73e29796
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x73e29777
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [esi + 0x80]
push 0
push ebx
push eax
mov ecx, dword [ecx + 0x17c]
call fcn.73debf30
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
test dword [esi + 0x20], 0x800000
push edi
je 0x73e297f8
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x73e297f5
cmp dword [ebp - 4], 0
jne 0x73e297f5
push 0
push ebx
push 0
push 2
push 0
push dword [esi + 0x10]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x73e297f5
push ebx
push 0
push 0
push 4
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
push edi
mov dword [esi + 0x14], eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp dword [esi + 0x14], 0
jne 0x73e2984c
mov ebx, dword [ebp + 8]
and dword [esi + 0x20], 0xff7fffff
push 0x8080
push dword [esi + 0x10]
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__open_osfhandle]
add esp, 8
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x73e2984c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov eax, dword [eax]
test eax, eax
jle 0x73e2982c
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [esi + 0x80]
push 0
push ebx
push eax
mov ecx, dword [ecx + 0x17c]
call fcn.73debf30
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x73e41470
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi]
shl eax, 0xe
xor eax, dword [ebx + 0x1b8]
and eax, 0x200000
xor eax, dword [ebx + 0x1b8]
mov dword [ebx + 0x1b8], eax
or dword [ebx + 0x330], 8
movzx ecx, word [edi]
mov esi, dword [ebx + 0x330]
shl ecx, 0x16
or esi, 0x10
xor ecx, eax
and ecx, 0x400000
xor ecx, eax
mov dword [ebx + 0x1b8], ecx
mov dword [ebx + 0x330], esi
or esi, 0x20
movzx eax, word [edi]
xor eax, ecx
and eax, 2
xor eax, ecx
mov dword [ebx + 0x1b8], eax
or dword [ebx + 0x32c], 0x8000
movzx ecx, word [edi]
shl ecx, 0x15
xor ecx, eax
and ecx, 0x800000
xor ecx, eax
mov dword [ebx + 0x1b8], ecx
mov dword [ebx + 0x330], esi
or esi, 0x40
movzx eax, word [edi]
shl eax, 0x15
xor eax, ecx
and eax, 0x1000000
xor eax, ecx
mov dword [ebx + 0x1b8], eax
mov dword [ebx + 0x330], esi
or esi, 0x80
movzx ecx, word [edi]
shl ecx, 0x15
xor ecx, eax
and ecx, 0x2000000
xor ecx, eax
mov dword [ebx + 0x1b8], ecx
mov dword [ebx + 0x330], esi
or esi, 0x100
movzx eax, word [edi]
shl eax, 0x15
xor eax, ecx
and eax, 0x4000000
xor eax, ecx
mov dword [ebx + 0x1b8], eax
mov dword [ebx + 0x330], esi
or esi, 0x200
movzx ecx, word [edi]
shl ecx, 0x15
xor ecx, eax
and ecx, 0x8000000
xor ecx, eax
mov dword [ebx + 0x1b8], ecx
mov dword [ebx + 0x330], esi
or esi, 0x400
movzx eax, word [edi]
shl eax, 0x14
xor eax, ecx
and eax, 0x10000000
xor eax, ecx
mov dword [ebx + 0x1b8], eax
mov dword [ebx + 0x330], esi
movzx ecx, word [edi]
shl ecx, 0x10
xor ecx, eax
and ecx, 0x20000000
xor ecx, eax
mov dword [ebx + 0x1b8], ecx
or esi, 0x800
mov dword [ebp - 4], 0x800
mov dword [ebx + 0x330], esi
or esi, 0x1000
movzx edx, word [edi]
shl edx, 0x14
xor edx, ecx
and edx, 0x40000000
xor edx, ecx
mov ecx, 0x1800
mov dword [ebx + 0x1b8], edx
mov dword [ebx + 0x330], esi
movzx eax, word [edi]
and ax, cx
xor ecx, ecx
cmp ax, word [ebp - 4]
mov dword [ebp - 4], 0x8000
setne cl
and edx, 0x7fffffff
dec ecx
or esi, 0x2000
and ecx, 0x80000000
mov dword [ebx + 0x330], esi
or ecx, edx
mov edx, 0x1000
mov dword [ebx + 0x1b8], ecx
mov ecx, 0x1800
movzx eax, word [edi]
and ax, cx
xor ecx, ecx
cmp ax, dx
mov eax, dword [ebx + 0x1bc]
mov edx, 0x4000
sete cl
and eax, 0xfffffffe
or ecx, eax
or esi, 0x4000
mov dword [ebx + 0x1bc], ecx
mov ecx, 0xc000
mov dword [ebx + 0x330], esi
movzx eax, word [edi]
and ax, cx
xor ecx, ecx
cmp ax, dx
mov eax, dword [ebx + 0x1c0]
mov edx, 0xc000
setne cl
and eax, 0xffdfffff
dec ecx
and ecx, 0x200000
or ecx, eax
mov dword [ebx + 0x1c0], ecx
or dword [ebx + 0x33c], 0x400000
movzx eax, word [edi]
mov esi, dword [ebx + 0x33c]
and ax, dx
xor edx, edx
cmp ax, word [ebp - 4]
setne dl
and ecx, 0xffbfffff
dec edx
or esi, 0x800000
and edx, 0x400000
or edx, ecx
xor ecx, ecx
mov dword [ebx + 0x1c0], edx
mov dword [ebx + 0x33c], esi
movzx eax, word [edi]
mov edi, 0xc000
and ax, di
cmp ax, di
pop edi
setne cl
and edx, 0xff7fffff
dec ecx
and ecx, 0x800000
or ecx, edx
or esi, 0x1000000
mov dword [ebx + 0x33c], esi
mov dword [ebx + 0x1c0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x73e6f5b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0x73db62ac
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x73e6f5d4
mov eax, 0x80029c4a
pop esi
mov esp, ebp
pop ebp
ret
push 0x73db62c4
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x73f3f138], eax
test eax, eax
jne 0x73e6f5f3
mov eax, 0x7f
pop esi
mov esp, ebp
pop ebp
ret
push 0x73db62e0
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x73f3f13c], eax
test eax, eax
je 0x73e6f5e9
push 0x73db6300
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x73f3f140], eax
test eax, eax
je 0x73e6f5e9
push 0x73db6314
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x73f3f144], eax
test eax, eax
je 0x73e6f5e9
push 0x73db6328
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x73f3f148], eax
test eax, eax
je 0x73e6f5e9
push 0x73db6338
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x73f3f14c], eax
test eax, eax
je 0x73e6f5e9
push 0x73db634c
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x73f3f150], eax
test eax, eax
je 0x73e6f5e9
mov esi, dword [0x73f3f138]
mov ecx, esi
push 0
push 0
push 0x73db6360
push 0x73f3f134
call dword [0x73f59474]
call esi
test eax, eax
jne 0x73e6f72a
mov esi, dword [0x73f3f140]
mov ecx, esi
push eax
lea eax, [ebp - 4]
push eax
push 4
push 0x73f3f154
push 0x73db6370
push dword [0x73f3f134]
call dword [0x73f59474]
call esi
test eax, eax
jne 0x73e6f72a
mov esi, dword [0x73f3f140]
mov ecx, esi
push eax
lea eax, [ebp - 4]
push eax
push 4
push 0x73f3f158
push 0x73db6394
push dword [0x73f3f134]
call dword [0x73f59474]
call esi
test eax, eax
jne 0x73e6f72a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.73e72750
add esp, 0x10
test eax, eax
jne 0x73e6f72a
mov eax, dword [0x73f3f134]
test eax, eax
je 0x73e6f725
mov esi, dword [0x73f3f13c]
mov ecx, esi
push 0
push eax
call dword [0x73f59474]
call esi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x73e77870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0xac], 2
jne 0x73e778e7
mov edx, dword [ebp + 0xc]
mov eax, 0xb170a1bf
push esi
mov esi, dword [ebp + 8]
cmp edx, 4
jb 0x73e778b0
push edi
mov edi, edx
shr edi, 2
mov ecx, dword [esi]
sub edx, 4
add ecx, eax
add esi, 4
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
sub edi, 1
jne 0x73e77893
pop edi
test edx, edx
je 0x73e778ce
movzx ecx, byte [esi]
lea esi, [esi + 1]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
sub edx, 1
jne 0x73e778b4
imul eax, eax, 0x19660d
xor edx, edx
or ecx, 0xffffffff
pop esi
add eax, 0x3c6ef35f
div ecx
mov eax, edx
pop ebp
ret 8
push 0xffffffffffffffff
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.73e73b50
add esp, 0xc
pop ebp
ret 8
Function at 0x73e7b5b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov ecx, 0x80000000
mov dword [eax], 0
mov dword [ebp - 8], 0
push esi
push edi
cmp ebx, 1
je 0x73e7b5dd
test ebx, ebx
jns 0x73e7b5eb
mov ecx, 0xc0000000
cmp ebx, 1
jne 0x73e7b5eb
xor eax, eax
jmp 0x73e7b5f5
mov eax, ebx
or eax, 0xbfffffff
shr eax, 0x1d
mov edi, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push eax
push ecx
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x73e7b642
test ebx, ebx
je 0x73e7b6a5
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x73e7b6a5
mov dword [ebp - 8], 1
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 1
jne 0x73e7b69e
push 0x73dbf874
push 0x14
call fcn.73de068a
mov edi, eax
add esp, 8
test edi, edi
je 0x73e7b69e
mov dword [edi + 4], ebx
mov ebx, dword [ebp - 4]
mov dword [edi + 0x10], esi
add ebx, 0x80c0
mov dword [edi + 0xc], 0
mov dword [edi], sym.dbghelp.dll_DbgHelpCreateUserDump
mov dword [edi + 8], 0x73daaaa0
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x73f59474]
call esi
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x73e7b6b0
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ebx, dword [ebp - 4]
xor edi, edi
add ebx, 0x80c0
mov eax, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x73e7b6ca
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x73f59474]
call esi
mov eax, ebx
mov dword [eax], edi
test edi, edi
jne 0x73e7b6eb
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ebp + 0xc], eax
pop edi
setne al
add eax, 2
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 8], 0
je 0x73e7b786
mov edx, dword [ebp - 4]
xor ecx, ecx
mov esi, dword [ebp + 0x14]
mov eax, 0x73db78c8
mov byte [edx + 0x80b8], 1
lea esp, [esp]
cmp esi, dword [eax]
je 0x73e7b72c
add eax, 0x28
inc ecx
cmp eax, 0x73db79e0
jl 0x73e7b710
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [eax], 4
jmp 0x73e7b756
push dword [ebp + 0x14]
lea eax, [ecx + ecx*4]
mov ecx, 0xa
push dword [ebp + 0x10]
lea esi, [eax*8 + 0x73db78c8]
lea edi, [edx + 0x807c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
call fcn.73e7a7a0
mov edi, eax
test edi, edi
jne 0x73e7b793
mov ecx, dword [ebx]
test ecx, ecx
je 0x73e7b76c
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x73f59474]
call esi
push dword [ebp + 8]
mov dword [ebx], 0
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
call fcn.73e7ab30
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x73e993a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
mov ebx, 0x630458e9
push esi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
push edi
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
xor eax, eax
mul ebx
imul ecx, ecx, 0x1000193
mov esi, eax
mov edi, edx
mov eax, ecx
mul ebx
mov dword [ebp - 4], eax
mov ebx, edx
mov eax, ecx
mov ecx, 0xde5fb9d2
mul ecx
add eax, esi
mov ecx, edx
mov edx, dword [ebp - 4]
adc ecx, edi
xor edi, edi
add edi, edx
adc eax, ebx
cmp eax, ebx
ja 0x73e9941b
jb 0x73e99414
cmp edi, edx
jae 0x73e9941b
mov esi, 1
jmp 0x73e9941d
xor esi, esi
xor eax, eax
mov edx, 0xde5fb9d2
mul edx
add eax, esi
add eax, ecx
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x73eb25b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x73f3f788
mov ebx, ecx
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp byte [ebx + 4], 0
jne 0x73eb274f
lea eax, [ebp - 4]
mov byte [ebx + 4], 1
push eax
push 1
push 0
push 0x73db81e8
push dword [ebx]
call dword [sym.imp.api_ms_win_core_localregistry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x73eb274f
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x73db8234
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_localregistry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x73eb2627
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_localregistry_l1_1_0.dll_RegCloseKey]
push 0x73f3f788
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
xor ecx, ecx
shr eax, 1
mov edx, 2
mov dword [ebp - 0xc], eax
inc eax
mul edx
push edi
push 0x73dbf874
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.73de06fd
mov edi, eax
add esp, 8
test edi, edi
jne 0x73eb266f
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_localregistry_l1_1_0.dll_RegCloseKey]
pop edi
push 0x73f3f788
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x73db8234
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_localregistry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.api_ms_win_core_localregistry_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x73eb26f9
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [ebp - 0x10]
cmp eax, 1
jne 0x73eb26be
pop esi
mov dword [ebx + 8], edi
pop edi
push 0x73f3f788
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x73eb26f9
push 0
push 0
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x73eb26f9
xor ecx, ecx
mov edx, 2
mul edx
push 0x73dbf874
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.73de06fd
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x73eb2714
push edi
call fcn.73de0647
add esp, 4
pop esi
pop edi
push 0x73f3f788
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
push edi
mov esi, eax
call fcn.73de0647
mov eax, dword [ebp - 0xc]
add esp, 4
test esi, esi
jne 0x73eb274a
push eax
call fcn.73de0647
add esp, 4
pop esi
pop edi
push 0x73f3f788
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov dword [ebx + 8], eax
pop edi
push 0x73f3f788
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x73eb3130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 8
jb 0x73eb31d9
mov ecx, edi
shr ecx, 3
mov dword [ebp - 4], ecx
push ebx
mov ebx, dword [esi + 4]
sub edi, 8
mov ecx, dword [esi]
add esi, 8
xor ecx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
mov dword [ebp - 8], ecx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*4 + 0x73f3fbb8]
mov edx, dword [ebp - 8]
xor eax, dword [ecx*4 + 0x73f3ffb8]
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
xor eax, dword [ecx*4 + 0x73f40bb8]
mov ecx, edx
shr ecx, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x73f40fb8]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x73f3f7b8]
mov ecx, edx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x73f407b8]
movzx ecx, bl
xor eax, dword [ecx*4 + 0x73f403b8]
movzx ecx, dl
xor eax, dword [ecx*4 + 0x73f413b8]
sub dword [ebp - 4], 1
jne 0x73eb3153
pop ebx
test edi, edi
je 0x73eb31fa
lea ecx, [ecx]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x73f3f7b8]
sub edi, 1
jne 0x73eb31e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x73eb3470
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x73f3f118]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jae 0x73eb3485
mov ecx, eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [edi + 4], eax
lea eax, [edi + 0x18]
push eax
push esi
mov dword [edi + 8], ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
push 0
push 0
push 0
push 2
push 0
push esi
mov dword [edi + 4], 0
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
mov dword [edi + 0x14], eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x73ecad80
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.73ecad90
Function at 0x73ed1ce1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ax, word [0x73f3e660]
push esi
or esi, 0xffffffff
cmp ax, si
jne 0x73ed1d43
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 2
push eax
push 0x73dbb6ac
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
cmp eax, 1
jne 0x73ed1d30
mov eax, dword [ebp - 4]
cmp ax, 0x30
je 0x73ed1d25
cmp ax, 0x31
je 0x73ed1d25
cmp ax, 0x32
jne 0x73ed1d30
add eax, 0xffffffd0
mov word [0x73f3e660], ax
jmp 0x73ed1d36
mov ax, word [0x73f3e660]
cmp ax, si
jne 0x73ed1d43
xor eax, eax
mov word [0x73f3e660], ax
cwde
pop esi
sub eax, 0
je 0x73ed1d50
sub eax, 1
je 0x73ed1d54
dec eax
xor al, al
leave
ret
mov al, 1
leave
ret

Function at 0x73ed24fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov ecx, 0x811c9dc5
cmp dword [ebp + 8], esi
jbe 0x73ed2521
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, dword [ebp + 8]
jb 0x73ed250f
mov eax, ecx
pop esi
leave
ret 4

Function at 0x73ed491b
Capabilities:
Allocate thread local storage

Disassembly:
push 8
push 0x73f34b80
call fcn.73de0d20
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x73ed49c0
sub eax, 1
je 0x73ed4955
dec eax
sub eax, 1
jne 0x73ed4a1a
call fcn.73dd4781
call fcn.73dd4e2e
jmp 0x73ed4a1a
mov eax, dword [ebp + 8]
mov dword [0x73f3bb60], eax
mov dword [0x73f3bb6c], 0x94
push 0x73f3bb6c
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExA]
push 0x100
push 0
push 0x73f3dbd0
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edx, str.C:Usersdev4rAppDataLocalTemp_
call fcn.73dd40e8
push 0x73f3bc14
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
push 0x73f3dee8
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov dword [0x73f3bb64], eax
test eax, eax
je 0x73ed4a2d
call fcn.73dd513d
test eax, eax
jne 0x73ed4a1a
jmp 0x73ed4a2d
call fcn.73dd4e2e
call fcn.73dd5159
mov eax, dword [0x73f3bc2c]
test eax, eax
je 0x73ed49df
cmp eax, 0xffffffff
je 0x73ed49df
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_FreeLibrary]
mov eax, dword [0x73f3bc60]
test eax, eax
je 0x73ed49f4
cmp eax, 0xffffffff
je 0x73ed49f4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_FreeLibrary]
mov ecx, dword [0x73f3dcd0]
call fcn.73dd51a1
push 0x73f3bc14
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
push 0x73f3dee8
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
call fcn.73ee4b3d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x73ed4a36
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc