joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033c25
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100656c1
call fcn.10064060
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], 0x595b
mov esi, edx
cmp dword [ebp - 0x1c], 0x5c68
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
jle 0x10033c9c
xor ebx, ebx
xor esi, esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], 0x7b4e
lea eax, [esi + ebx]
mov ecx, 0x10082178
xor eax, edi
cdq
push edx
push eax
call fcn.100073fb
dec edi
dec dword [ebp - 0x14]
jne 0x10033c60
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x68ab
jl 0x10033c56
inc esi
cmp esi, 0x1a1c
jl 0x10033c51
inc ebx
cmp ebx, 0x6b72
jl 0x10033c4f
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5778
jge 0x10033cd7
mov edx, str.zzy_kutzhuwaj_bkwksjdnt_igfdhe_mav_bhhbwwp_qwmsngu_etqjc_xvyiux_chofp_twbfwzp
mov ecx, 0x10082178
call fcn.1000bae6
jmp 0x10033cd7
cmp byte [ebp + 0x1c], 0
je 0x10033ce4
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x10033d16
mov edx, dword [ebp + 0x18]
mov dword [edx], 0xffffffed
cmp dword [edx], 0xd
je 0x10033d16
mov edi, dword [ebp + 0x14]
mov dword [esi], 0
jmp 0x10033d0a
mov ecx, dword [esi]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xa191a83a
inc dword [esi]
cmp dword [esi], 2
jl 0x10033cfd
inc dword [edx]
cmp dword [edx], 0xd
jne 0x10033cf5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034caf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006572f
call fcn.10064060
sub esp, 0x38
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10034ce6
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push dword [eax]
call fcn.1000cb66
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x4e2f
cmp dword [ebp - 0x24], 0x4f5e
jle 0x10034d6b
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], 0x7b83
mov dword [ebp - 0x18], ebx
xor edi, edi
and dword [ebp - 0x28], 0
mov esi, ebx
mov ebx, dword [ebp - 0x28]
and esi, edi
mov eax, esi
mov ecx, 0x10082178
xor eax, ebx
cdq
push edx
push eax
call fcn.100073fb
inc ebx
cmp ebx, 0x45ce
jl 0x10034d14
mov ebx, dword [ebp - 0x18]
inc edi
cmp edi, 0x1f44
jl 0x10034d09
dec ebx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
jne 0x10034d07
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x34e
jl 0x10034cfb
push 0x23e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov dword [ebp - 0x1c], 0x7401
cmp dword [ebp - 0x1c], 0x77c4
jle 0x10034dd4
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov eax, esi
mov esi, 0x3ee8
cdq
idiv edi
mov ebx, edx
mov eax, ebx
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10034da5
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10007f12
inc ebx
dec esi
jne 0x10034d8e
mov esi, dword [ebp - 0x20]
inc edi
cmp edi, 0xb6c
jl 0x10034d82
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x154
jl 0x10034d80
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
cmp dword [ebp - 0x1c], 0x73de
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [eax], ecx
jge 0x10034df4
push str.fbbflnsxe_kzvyn_rbocvkcmf_dsve_idhqrookt_qiqwth
call fcn.1004da5d
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x4b35
jge 0x10034cd5
mov edx, str.bmsglal_nefpmdgl_cgrzml_uoqhov_kpwk_fgcqivdt_hlmpazrfq
mov ecx, 0x10082178
call fcn.1000bae6
jmp 0x10034cd5
Function at 0x10035bad
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov dword [esp + 0x10], 0x6eac
mov esi, edx
cmp dword [esp + 0x10], 0x7037
mov ebx, ecx
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
jle 0x10035c4e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
lea ebx, [edi + esi]
mov esi, 0x124e
mov eax, ebx
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035c0e
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10007f12
dec ebx
dec esi
jne 0x10035bf6
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x346b
jl 0x10035bee
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x2524
jl 0x10035bec
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x6bec
jge 0x10035c63
push str.nrsghpay_inpjeay_fjsmqaxif_aktfhuvs_tldb_hbvzu
call fcn.1004da5d
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10035c8f
push 0x1a
pop ecx
cmp dword [ebx], ecx
jge 0x10035c7a
mov eax, dword [ebp + 8]
movsx edx, byte [eax]
add edx, dword [ebx]
jmp 0x10035c84
mov eax, dword [ebx]
cdq
idiv ecx
movsx eax, byte [esi]
add edx, eax
mov ecx, dword [ebp + 0x1c]
push edx
call fcn.10035e68
jmp 0x10035c98
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xfffffff6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035ed2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x100834d4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x100834d4], ecx
inc edx
cmp edx, esi
jl 0x10035ee7
mov dword [0x100834d0], esi
pop esi
pop ebp
ret 8

Function at 0x10035f0d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100834d4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10083860
jl 0x10035f1b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10083b04
jl 0x10035f5b
mov ecx, dword [0x10084850]
xor ecx, dword [0x100834d4]
and ecx, edi
xor ecx, dword [0x10084850]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100834d0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10083b04]
mov dword [0x10083e90], eax
pop esi
ret
Function at 0x100365b4
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x100657c3
call fcn.10064060
sub esp, 0x1c
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100366aa
mov dword [ebp - 0x20], 0x4a0d
xor esi, esi
cmp dword [ebp - 0x20], 0x4a49
jle 0x10036650
mov dword [ebp - 0x14], esi
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
lea eax, [ebx + edi]
mov ebx, 0x446f
mov dword [ebp - 0x24], eax
mov edi, eax
mov eax, edi
mov ecx, 0x10082178
xor eax, esi
cdq
push edx
push eax
call fcn.100073fb
dec edi
dec ebx
jne 0x10036600
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0xa5
jl 0x100365f3
inc edi
mov dword [ebp - 0x1c], edi
push 0
pop esi
cmp edi, 0x6091
jl 0x100365eb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x4037
jl 0x100365e6
push esi
push 0x1291
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x49bd
jge 0x10036689
mov edx, str.rrqqwoidv_ohtbbeccm_jfdndcw_qrladdkcs_tdd_kluoj_tvmaqyt_dsidi_jdobocic_nkeeutw_mldrpwh_piorm
mov ecx, 0x10082178
call fcn.1000bae6
jmp 0x10036689
mov edx, dword [ebp + 0x18]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x10036705
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xcce57bf5
inc dword [edx]
cmp dword [edx], 2
jl 0x10036696
jmp 0x10036705
mov ebx, dword [ebp + 0x10]
mov esi, 0x9dade661
mov edi, dword [ebp + 0x24]
mov eax, dword [ebx]
mov eax, dword [ebx]
cmp esi, eax
sbb eax, eax
add eax, 0x43f83dfa
neg eax
sbb eax, eax
inc eax
cmp eax, dword [edi]
jge 0x100366d1
xor esi, esi
cmp dword [edi], esi
je 0x100366d4
xor esi, esi
inc esi
mov eax, dword [edx]
mov edx, dword [ebp + 8]
mov dword [eax + 4], esi
lea eax, [esi - 0x6986]
mov dword [edx], eax
mov eax, dword [edx]
mov ecx, dword [ecx]
mov eax, dword [edx]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp + 0x30]
setg dl
mov dword [eax], edx
mov eax, dword [eax]
mov eax, dword [ebx]
mov eax, dword [edi]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xd62a04f7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100371fe
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100657ff
call fcn.10064060
sub esp, 0x10
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10037228
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x100372d6
mov dword [ebp - 0x1c], 0x48dd
cmp dword [ebp - 0x1c], 0x4b4e
jle 0x1003726e
xor esi, esi
mov edi, esi
mov dword [ebp - 0x18], 0x36b2
xor ebx, ebx
mov eax, edi
mov ecx, 0x10082178
xor eax, ebx
cdq
push edx
push eax
call fcn.100073fb
inc ebx
cmp ebx, 0x1d41
jl 0x10037245
dec edi
dec dword [ebp - 0x18]
jne 0x10037243
inc esi
cmp esi, 0x4e8e
jl 0x1003723a
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4706
jge 0x1003728a
mov edx, str.tmad_npa_ycfbt_bccowgft_xeqvngx
mov ecx, 0x10082178
call fcn.1000bae6
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
dec dword [ecx]
xor ecx, ecx
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, 0xee95
mov eax, dword [ebp + 0x18]
sete cl
xor edx, edx
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [ebp + 0x34]
setge dl
xor ecx, ecx
mov eax, dword [eax]
add eax, 0x11be4995
cmp eax, edx
mov eax, dword [ebp + 0xc]
setg cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e6ef
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065ae1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003e75d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 0x2ff
push dword [ebp - 0x28]
push 0x6190
push 0x3972
push dword [ebp - 0x2c]
push 0
push 0x5dff
push 0x394e
push 0x1a19
push 0x1744
call fcn.1003fe2a
add esp, 0x28
jmp 0x1003e8a6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1003e8a0
mov dword [ebp - 0x24], 0x1d68
mov dword [ebp - 0x3c], str.qem_gswhgbhk_odllg_axzrchse_qcycx_aevaz_mnvqgnq_pewud
cmp dword [ebp - 0x24], 0x1ee1
jle 0x1003e83b
and dword [ebp - 0x1c], 0
jmp 0x1003e79f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x464d
jge 0x1003e83b
and dword [ebp - 0x14], 0
jmp 0x1003e7b9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xcb7
jge 0x1003e836
and dword [ebp - 0x18], 0
jmp 0x1003e7cf
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6e27
jge 0x1003e831
and dword [ebp - 0x20], 0
jmp 0x1003e7e5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5e80
jge 0x1003e82f
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, cl
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10001aad
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.100071e0
push eax
call fcn.1004da5d
pop ecx
lea ecx, [ebp - 0x64]
call fcn.100071c2
jmp 0x1003e7de
jmp 0x1003e7c8
jmp 0x1003e7b2
jmp 0x1003e798
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1c6d
jge 0x1003e857
push dword [ebp - 0x3c]
call fcn.1004da5d
pop ecx
jmp 0x1003e873
or dword [ebp - 4], 0xffffffff
jmp 0x1003e87d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1003e89e
push 0
push 0
push 0xa76
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
jmp 0x1003e8a6
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016560
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebx - 0x10], dh
vmovaps xmm7, xmmword [ebx - 0x20]
dec ecx
mov esp, ebx
inc ecx
pop esi
inc ecx
pop esp
pop edi
jmp fcn.010197d0
Function at 0x41a477
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a119

Function at 0x41a482
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a2a8

Function at 0x41a87c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00408ef0
mov eax, dword [0x431040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004183b6
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41a8be
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41aa1a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00425120
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47f090]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041ba4c
mov ecx, dword [esi*4 + 0x47f090]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41aa13
cmp eax, dword [edi + ecx + 0x24]
jne 0x41aa13
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41aa13
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041ba4c
add esp, 0x14
test edx, edx
jl 0x41aa13
jg 0x41a989
test eax, eax
jb 0x41aa13
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41aa13
jl 0x41a9a3
cmp dword [ebp - 0x1008], eax
ja 0x41aa13
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41a9c1
test ebx, ebx
je 0x41a9fa
cmp ecx, edi
jae 0x41a9fa
mov al, byte [ecx]
cmp al, 0xd
jne 0x41a9db
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41a9e7
cmp byte [ecx + 1], 0xa
jne 0x41a9e7
inc ecx
jmp 0x41a9e7
movzx eax, al
movsx eax, byte [eax + 0x431310]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41a9c1
cmp edx, ebx
jne 0x41a9c1
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41aa18
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00408141
leave
ret
Function at 0x41aeea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x47f090]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41af2a
cmp byte [ebx], 0xa
jne 0x41af2a
or byte [eax + edi + 0x28], 4
jmp 0x41af2f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41b02d
mov al, byte [edx]
cmp al, 0x1a
je 0x41b00f
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41af5e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41af83
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41af8d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41af40
jmp 0x41b02d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b00a
cmp dword [ebp - 0xc], 0
je 0x41b00a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x47f090]
test byte [eax + edi + 0x28], 0x48
je 0x41afe4
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41afcf
mov byte [esi], dl
jmp 0x41afe0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x47f090]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41b02d
cmp byte [ebp - 1], 0xa
jne 0x41aff3
cmp esi, ebx
jne 0x41aff3
mov byte [esi], 0xa
jmp 0x41b02c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041ba6a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41b02d
mov byte [esi], 0xd
jmp 0x41b02c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x47f090]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b029
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b02d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41b036
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x47f090]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b079
cmp word [esi], dx
jne 0x41b079
or byte [edi + eax + 0x28], 4
jmp 0x41b07e
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41b1d1
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41b1b1
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41b0c0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41b0f6
cmp eax, edx
jae 0x41b102
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41b098
jmp 0x41b1d1
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b1ad
cmp dword [ebp - 0x14], 0
je 0x41b1ad
mov eax, dword [ebx*4 + 0x47f090]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41b185
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41b14e
mov word [esi], cx
jmp 0x41b181
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x47f090]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x47f090]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x47f090]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41b1d1
pop ebx
cmp word [ebp - 4], bx
jne 0x41b196
cmp esi, dword [ebp + 0xc]
jne 0x41b196
mov word [esi], bx
jmp 0x41b1ce
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041ba6a
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41b1d1
push 0xd
jmp 0x41b1ca
mov ecx, dword [ebx*4 + 0x47f090]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b1c8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b1d1
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1000c080
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp - 0x34]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call 0x100bdc76
test eax, eax
js 0x1000c176
cmp word [ebp - 0x34], 6
je 0x1000c176
lea eax, [ebp - 4]
push eax
push 0x10004068
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000c12d
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x10004084
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c124
cmp dword [ebp - 0xc], eax
je 0x1000c124
push 0x10004098
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000c124
push 0x100040a4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000c124
push dword [ebp + 8]
mov ecx, esi
call dword [0x100ae518]
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
cmp esi, 0x78
je 0x1000c145
cmp esi, 0xdc
jb 0x1000c176
cmp esi, 0x140
jae 0x1000c176
push 0x3594
call fcn.1000efa0
add esp, 4
test eax, eax
je 0x1000c176
mov ecx, eax
mov edx, 0x20
and ecx, 0x1f
sub edx, ecx
push esi
mov dword [eax + edx - 4], edx
lea ecx, [eax + edx]
call fcn.1000cab0
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4