joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e386d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1011b600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.10008040
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x3c], 0
mov ebx, dword [eax + 4]
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
call fcn.10017e50
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 0
test ebx, ebx
je 0x1001684d
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 8]
test eax, eax
je 0x1001684a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov al, byte [ebp + 0xb]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x10016866
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.10007fa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10016e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e21e0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1011b600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.100af0c0
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1009a2c1
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10016dc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e21e0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1011b600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.100af0c0
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1009a2c1
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10016dc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10027880
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4fb7
mov eax, dword fs:[0]
push eax
mov eax, 0x13a0
call fcn.100b02b0
mov eax, dword [0x1011b600]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x13a8], esi
mov dword [ebp - 0x13a0], esi
mov dword [ebp - 0x13ac], esi
xorps xmm0, xmm0
mov dword [ebp - 0x13a4], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x13a4], 1
call fcn.100054e0
call fcn.1009ad83
mov edx, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1394], edx
mov ecx, 1
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x1394], edx
inc ecx
cmp ecx, 0x270
jb 0x10027925
mov dword [ebp - 0x1398], 0x270
mov edi, 0x10
lea ecx, [ebp - 0x1398]
call fcn.10028430
mov ecx, 0x3e
mul ecx
cmp eax, ecx
jae 0x10027988
cmp eax, 4
jae 0x10027988
mov esi, ecx
lea ecx, [ebp - 0x1398]
call fcn.10028430
mul esi
cmp eax, 4
jb 0x10027970
mov esi, dword [ebp - 0x13a8]
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov byte [ebp - 0x139c], al
cmp ecx, edx
jae 0x100279bd
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0xf
jbe 0x100279ad
mov eax, dword [esi]
add eax, ecx
mov cl, byte [ebp - 0x139c]
mov byte [eax + 1], 0
mov byte [eax], cl
jmp 0x100279d8
push dword [ebp - 0x139c]
mov byte [ebp - 0x13a0], 0
push dword [ebp - 0x13a0]
push ecx
mov ecx, esi
call fcn.10019530
add edi, 0xffffffff
jne 0x10027953
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100af09a
mov esp, ebp
pop ebp
ret
Function at 0x10028430
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1002848d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10028450
mov eax, dword [esi]
jmp 0x10028567
cmp eax, 0x4e0
jb 0x10028567
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x100284a6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x100284f0
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003ccb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x24
test eax, eax
je 0x1003ce58
mov edx, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x30]
push edi
cmp eax, 4
jb 0x1003ccf3
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x1003ccd8
mov dword [esp + 0x40], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ebx
test eax, eax
je 0x1003ce54
cmp eax, 8
jb 0x1003ce39
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x1003cd29
cmp edi, ebx
jae 0x1003ce39
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x1003cd3a
cmp edi, edx
jae 0x1003ce39
cmp eax, 0x40
jb 0x1003cdee
mov edi, eax
mov ecx, eax
mov eax, edx
and edi, 0x3f
sub eax, ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], eax
sub ecx, edi
mov eax, esi
mov dword [esp + 0x2c], ecx
sub eax, ebx
lea edi, [esi + 0x20]
mov dword [esp + 0x20], eax
lea ecx, [ebx + 0x10]
mov ebx, dword [esp + 0x20]
mov eax, edx
sub eax, esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
lea eax, [edx + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + 0x40]
movups xmm0, xmmword [ecx - 0x50]
lea edi, [edi + 0x40]
xorps xmm1, xmm0
movups xmmword [edi - 0x60], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [esi + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ebx + ecx - 0x40], xmm1
movups xmm1, xmmword [edx + edi - 0x40]
mov edx, dword [esp + 0x28]
movups xmm0, xmmword [ecx - 0x30]
xorps xmm1, xmm0
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x10]
add ebp, 0x40
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ebp, dword [esp + 0x2c]
jb 0x1003cd85
cmp dword [esp + 0x30], 8
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jb 0x1003ce35
and eax, 0xfffffff8
lea ecx, [ebx + ebp]
mov dword [esp + 0x30], eax
sub edx, ebx
mov edi, dword [esp + 0x30]
mov eax, esi
sub eax, ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov eax, edx
mov edx, dword [esp + 0x28]
movq xmm1, qword [ecx + eax]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebp, 8
xorps xmm1, xmm0
movq qword [ecx + edx - 8], xmm1
cmp ebp, edi
jb 0x1003ce10
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
cmp ebp, eax
jae 0x1003ce54
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [edi + esi - 1], cl
sub eax, 1
jne 0x1003ce42
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x1004b530
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1004b5df
push esi
call fcn.1005f5b0
add esp, 4
test al, al
jne 0x1004b5df
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1004b557
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.10068dd0
add esp, 0xc
test eax, eax
je 0x1004b58b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.10068dd0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1004b58d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x1004b5be
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.1005c450
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x1004b5a0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10060520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x1011b600]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x78]
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp byte [eax + 0x6cb], 0
je 0x10060702
cmp byte [ebp + 0x18], 0
push ebx
lea ebx, [ebp + 0x18]
je 0x10060701
lea eax, [esp + 0x30]
push eax
push ebx
push 2
call fcn.1006d670
add esp, 0xc
test eax, eax
jg 0x10060701
lea eax, [esp + 0x34]
push eax
push ebx
push 0x17
call fcn.1006d670
add esp, 0xc
test eax, eax
jg 0x10060701
cmp byte [ebx], 0
mov eax, str._none_
push esi
push dword [ebp + 0x14]
mov esi, dword [ebp]
cmovne eax, ebx
mov ebp, dword [esp + 0x14]
push eax
push str.Host__s:_d_was_resolved.
push ebp
call fcn.10056ac0
lea eax, [esp + 0x24]
push 0x400
push eax
call fcn.10046110
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.10046110
add esp, 0x20
test esi, esi
je 0x10060674
lea edx, [edi + 0x10]
mov ecx, dword [esi + 4]
cmp ecx, 0x17
je 0x100605e8
cmp ecx, 2
jne 0x10060669
xor eax, eax
mov byte [esp + 0x48], 0
cmp ecx, 2
lea ebx, [esp + 0x14]
cmovne eax, edx
add ebx, eax
sub ecx, 2
je 0x10060617
sub ecx, 0x15
jne 0x1006062f
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 8
push eax
push 0x17
jmp 0x10060627
push 0x2e
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esi + 0x18]
add eax, 4
push eax
push 2
call fcn.10088720
add esp, 0x10
push ebx
call fcn.10046130
add esp, 4
test eax, eax
je 0x1006064e
push 2
push 0x100f039c
push ebx
call fcn.100460d0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x10060694
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.10046080
mov edi, eax
add esp, 8
test edi, edi
jne 0x10060694
lea edx, [eax + 0x10]
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x100605d7
lea eax, [esp + 0x24]
push eax
call fcn.10046130
add esp, 4
test eax, eax
je 0x100606a4
lea eax, [esp + 0x24]
push eax
call fcn.10046140
add esp, 4
jmp 0x100606a9
push str.too_many_IP__cant_show
push ebp
call fcn.10056ac0
add esp, 8
jmp 0x100606e9
mov eax, str._none_
push eax
push str.IPv6:__s
push ebp
call fcn.10056ac0
lea eax, [esp + 0x20]
push eax
call fcn.10046130
add esp, 0x10
test eax, eax
je 0x100606d5
lea eax, [esp + 0x14]
push eax
call fcn.10046140
add esp, 4
jmp 0x100606da
mov eax, str._none_
push eax
push str.IPv4:__s
push ebp
call fcn.10056ac0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call fcn.100460e0
lea eax, [esp + 0x28]
push eax
call fcn.100460e0
add esp, 8
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
pop edi
pop ebp
xor ecx, esp
call fcn.100af09a
add esp, 0x6c
ret
Function at 0x1006a070
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call fcn.100c0122
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x1006a096
cmp ecx, 0xffffffff
cmovne eax, ecx
ret
Function at 0x100bb9a8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x100e8234]
test eax, eax
je 0x100bb9e7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100bb9e7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100bb9e7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100bb9e7
cmp dword [ecx + 0x74], 0xe
jbe 0x100bb9e7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100e17f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100e181d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100e181d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10bb1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10bb11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10bb107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10bb106a
add dl, dl
jne 0x10bb1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10bb10dc
xor eax, eax
add dl, dl
jne 0x10bb1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10bb117d
add dl, dl
jne 0x10bb10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10bb10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10bb10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10bb10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10bb10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10bb1075
mov eax, 1
add dl, dl
jne 0x10bb10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10bb10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10bb10e1
sub eax, ebx
mov ebx, 1
jne 0x10bb1128
mov ecx, 1
add dl, dl
jne 0x10bb110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10bb1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10bb1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10bb1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10bb113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10bb114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10bb1136
cmp eax, 0x7d00
jae 0x10bb116d
cmp eax, 0x500
jb 0x10bb1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10bb1075
cmp eax, 0x7f
ja 0x10bb1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10bb1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10bb119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10bb1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401299
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4012d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4012d0
lea ebx, [ebx]
cmp esi, eax
jae 0x4012d4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4012c0
cmp esi, eax
jb 0x4012da
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403120
Capabilities:
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xffffffffffffffff
push 0x474b50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4a3eb0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x4a440c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4a440c
mov dword [ebp - 4], 0
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp + 0x80c]
lea eax, [ebp + 0x810]
push eax
push ecx
push 0x400
lea edx, [ebp]
push 0x400
mov ebx, 1
push edx
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCR90.dll__vsnwprintf_s]
add esp, 0x14
test eax, eax
jle 0x40322d
lea eax, [ebp]
push eax
push 0x47eadc
lea ecx, [ebp - 0x14]
push 0x47eacc
push ecx
call fcn.00402e30
add esp, 0x10
push ebx
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.004027a0
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, ebx
jne 0x4031f6
test ecx, ecx
jge 0x4031eb
push 0x80070057
call fcn.00401100
movzx eax, word [eax]
cmp ax, 0xa
jne 0x4031f6
xor bl, bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403215
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x403223
push 0xa
lea ecx, [ebp - 0x14]
call fcn.00402dd0
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40324d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00473c8a
add ebp, 0x804
mov esp, ebp
pop ebp
ret
Function at 0x4084f0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x477a88
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4a3eb0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x4a440c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4a440c
call edx
add eax, 0x10
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x18], 0
test eax, eax
jne 0x408545
push 0x80004003
call fcn.004650f0
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x40]
call eax
mov eax, dword [esp + 0xc]
cmp eax, 0x40
je 0x4085b8
cmp eax, 1
je 0x4085b8
push eax
lea ecx, [esp + 0xc]
push 0x47f050
push ecx
call fcn.00402e30
mov esi, dword [esp + 0x14]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4085a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
push eax
lea ecx, [esp + 0xc]
push 0x47f050
push ecx
call fcn.00402e30
mov esi, dword [esp + 0x14]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4085fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x40d230
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d269
mov eax, dword [esp + 0xc]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 8

Function at 0x40d270
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
mov eax, dword [0x4a3eb0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x224]
push ebp
mov ebp, dword [esp + 0x220]
lea eax, [esp + 8]
push eax
push 0x2001f
mov dword [ebx], 0
mov ecx, dword [str.SOFTWARESamsungKiesDeviceDB]
push 0
push ecx
push SysReAllocString
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d3a9
push esi
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x2c]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
je 0x40d316
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00473c8a
add esp, 0x214
ret
test ebp, ebp
jne 0x40d33a
mov edx, dword [esp + 0x10]
pop esi
pop ebp
mov dword [ebx], edx
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00473c8a
add esp, 0x214
ret
xor esi, esi
cmp dword [esp + 0x10], esi
push edi
jle 0x40d39a
cmp esi, dword [esp + 0x22c]
jge 0x40d39a
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x34]
push ecx
push esi
push edx
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x40d3c0
push 0xa
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.MSVCR90.dll_wcstol]
mov dword [ebp + esi*4], eax
inc esi
add esp, 0xc
cmp esi, dword [esp + 0x14]
mov dword [ebx], esi
jl 0x40d343
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x218]
pop ebp
pop ebx
xor ecx, esp
call fcn.00473c8a
add esp, 0x214
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40d3a7