joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f60c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4f60dd
mov edi, dword [esi + 0xc]
jmp 0x4f611d
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4f60f6
call fcn.004205a4
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4f610b
call fcn.004205a4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4f611d
call fcn.004205a4
call fcn.0041dc71
cmp dword [eax + 0x3c], 0
je 0x4f6132
push edi
mov ecx, ebx
call fcn.004f4eef
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004f5fdf
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4f6150
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4f615c
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x51033a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x587c1c]
jne 0x510344
repz ret
jmp fcn.00517303
Function at 0x523358
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x587c1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00516d2b
and dword [ebp - 0x14], 0
cmp dword [0x58fbdc], 0
mov dword [ebp - 0x18], eax
jne 0x52340b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5234b3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x562f48
push ebx
call edi
test eax, eax
je 0x5234b3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x562f38
push ebx
mov dword [0x58fbdc], eax
call edi
push eax
call esi
push 0x562f24
push ebx
mov dword [0x58fbe0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x58fbe4], eax
call edi
push eax
call esi
mov dword [0x58fbec], eax
test eax, eax
je 0x52340b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x58fbe8], eax
mov eax, dword [0x58fbe8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x523464
cmp dword [0x58fbec], ecx
je 0x523464
push eax
call esi
push dword [0x58fbec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x523464
test ebx, ebx
je 0x523464
call edi
test eax, eax
je 0x52345b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x52345b
test byte [ebp - 8], 1
jne 0x523464
or dword [ebp + 0x10], 0x200000
jmp 0x523497
mov eax, dword [0x58fbe0]
cmp eax, dword [ebp - 0x18]
je 0x523497
push eax
call esi
test eax, eax
je 0x523497
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x523497
mov eax, dword [0x58fbe4]
cmp eax, dword [ebp - 0x18]
je 0x523497
push eax
call esi
test eax, eax
je 0x523497
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x58fbdc]
call esi
test eax, eax
je 0x5234b3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5234b5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051033a
leave
ret
Function at 0x13151000
Capabilities:
Delete file
Download url
Get common file path
Get file size
Read file on windows
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0x1c0]
sub esp, 0x240
mov eax, dword [0x13182360]
xor eax, ebp
mov dword [ebp + 0x1bc], eax
mov eax, dword [ebp + 0x1cc]
push ebx
push esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1d0]
push edi
mov dword [ebp - 0x50], eax
push 0x6c
pop eax
xor ebx, ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x80], 0x75
mov dword [ebp - 0x7c], 0x72
mov dword [ebp - 0x74], 0x6d
mov dword [ebp - 0x70], 0x6f
mov dword [ebp - 0x6c], 0x6e
mov dword [ebp - 0x68], 0x2e
mov dword [ebp - 0x64], 0x64
mov dword [ebp - 0x58], ebx
xor eax, eax
lea esi, [ebp + eax*4 - 0x80]
cmp dword [esi], ebx
je 0x1315108e
mov cl, byte [esi]
mov byte [ebp + eax - 0x44], cl
mov byte [ebp + eax - 0x43], bl
inc eax
cmp eax, 0xfffff
jl 0x13151074
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x200
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
push edi
push 0x200
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push edi
call dword [sym.imp.WINMM.dll_timeGetTime]
push eax
push 0x1315f1d0
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
push ebx
push ebx
push edi
push dword [ebp - 0x48]
push ebx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x1315117a
cmp byte [ebp + 0x1d4], bl
je 0x131510fc
mov eax, dword [ebp - 0x50]
push edi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
jmp 0x1315117c
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x48], eax
je 0x1315117a
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x4c], eax
inc eax
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [ebp - 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x4c]
inc ecx
push ecx
push ebx
push eax
call fcn.131556d0
add esp, 0xc
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
push dword [eax]
mov dword [ebp - 0x54], ebx
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push edi
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 0x4c]
jmp 0x1315117c
xor eax, eax
mov ecx, dword [ebp + 0x1bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1315574a
add ebp, 0x1c0
leave
ret
Function at 0x1315574a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x13182360]
jne 0x13155754
repz ret
jmp fcn.13155cf8

Function at 0x13156f94
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x131823b0]
je 0x13156faf
inc edi
cmp edi, 0x17
jb 0x13156fa0
cmp edi, 0x17
jae 0x1315712f
push ebp
push 3
call fcn.1315a625
cmp eax, 1
pop ecx
je 0x131570fb
push 3
call fcn.1315a625
test eax, eax
pop ecx
jne 0x13156fe3
cmp dword [0x13182370], 1
je 0x131570fb
cmp ebx, 0xfc
je 0x1315712e
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x13183770
push ebp
call fcn.131595eb
add esp, 0xc
test eax, eax
je 0x13157019
push esi
push esi
push esi
push esi
push esi
call fcn.13158dca
add esp, 0x14
push 0x104
mov esi, 0x13183789
push esi
push 0
mov byte [0x1318388d], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x1315705d
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.131595eb
add esp, 0xc
test eax, eax
je 0x1315705d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.13158dca
add esp, 0x14
push esi
call fcn.13159560
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x131570a2
push esi
call fcn.13159560
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x13183a84
push 0x1315f8c4
sub ecx, eax
push ecx
push eax
call fcn.1315a572
add esp, 0x14
test eax, eax
je 0x131570a2
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.13158dca
add esp, 0x14
jmp 0x131570a4
xor esi, esi
push 0x1315f8c0
push ebx
push ebp
call fcn.1315a501
add esp, 0xc
test eax, eax
je 0x131570c4
push esi
push esi
push esi
push esi
push esi
call fcn.13158dca
add esp, 0x14
push dword [edi*8 + 0x131823b4]
push ebx
push ebp
call fcn.1315a501
add esp, 0xc
test eax, eax
je 0x131570e6
push esi
push esi
push esi
push esi
push esi
call fcn.13158dca
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1315a344
add esp, 0xc
jmp 0x1315712e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1315712e
cmp ebp, 0xffffffff
je 0x1315712e
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x131823b4]
push dword [esi]
call fcn.13159560
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1315a344
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.13157aec
xor ebx, ebx
cmp dword [0x13183d74], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1315a41a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1315a4fa
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1315a4fa
push eax
call fcn.13157a7e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x13183d74], eax
call esi
push eax
call fcn.13157a7e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x13183d78], eax
call esi
push eax
call fcn.13157a7e
mov dword [0x13183d7c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.13156d21
test eax, eax
pop ecx
pop ecx
je 0x1315a3e8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.13158dca
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1315a41a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.13157a7e
cmp eax, ebx
pop ecx
mov dword [0x13183d84], eax
je 0x1315a41a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.13157a7e
pop ecx
mov dword [0x13183d80], eax
mov eax, dword [0x13183d80]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1315a49f
cmp dword [0x13183d84], ecx
je 0x1315a49f
push eax
call fcn.13157af5
push dword [0x13183d84]
mov esi, eax
call fcn.13157af5
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1315a49f
cmp edi, ebx
je 0x1315a49f
call esi
cmp eax, ebx
je 0x1315a46c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1315a46c
test byte [ebp - 0x18], 1
jne 0x1315a49f
lea eax, [ebp - 0x10]
push eax
call fcn.13156d58
test eax, eax
pop ecx
je 0x1315a487
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.13158dca
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1315a496
or dword [ebp + 0x10], 0x200000
jmp 0x1315a4da
or dword [ebp + 0x10], 0x40000
jmp 0x1315a4da
mov eax, dword [0x13183d78]
cmp eax, dword [ebp - 8]
je 0x1315a4da
push eax
call fcn.13157af5
cmp eax, ebx
pop ecx
je 0x1315a4da
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1315a4da
mov eax, dword [0x13183d7c]
cmp eax, dword [ebp - 8]
je 0x1315a4da
push eax
call fcn.13157af5
cmp eax, ebx
pop ecx
je 0x1315a4da
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x13183d74]
call fcn.13157af5
cmp eax, ebx
pop ecx
je 0x1315a4fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1315a4fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000d68b
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000d68b
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10

Function at 0x1000d68b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000d69a
pop dword [ebp - 0x20]
mov eax, 0x74a068b3
sub eax, 0x649f9219
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3cb4d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x9066e2eb
add ecx, 0x6f995714
mov edi, eax
mov esi, 0x1004bc00
add esi, dword [ebp - 0x20]
mov ebx, 0xac6fc6e
add ebx, 0xf071c74a
sub dword [ebp - 4], 0x99c7ec07
mov edx, dword [esi]
add edx, ebx
sub dword [ebp - 0x18], 0x662e5726
mov dword [edi], edx
xor dword [ebp - 0x1c], 0xf8be10c
add edi, 0xd687bbd3
sub edi, 0xd687bbcf
add esi, 4
loop 0x1000d6ee
add eax, 0xdacf
xor ebx, ebx
add ebx, eax
add eax, 0x1d6e38ad
add eax, 0xe291c758
mov ecx, 0x78fce680
sub ecx, 0x68fce680
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10001be0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll_vsprintf_s]
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret

Function at 0x10001c20
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
push 0x10
push eax
push edx
push ecx
push 0
push 0
push 0x21
call dword [sym.imp.bcrypt.dll_BCryptHash]
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x10]
push eax
push str._02x
push edi
call ebx
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x10001c50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001c80
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
mov eax, ecx
push str.yyyy_yyyy
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push 0
push 0x52534d42
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov esi, eax
test esi, esi
je 0x10001dbe
lea ecx, [esi + 8]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0
push 0x52534d42
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor esi, esi
mov dword [esp + 8], eax
test eax, eax
je 0x10001db7
cmp byte [esi + edi + 8], 1
je 0x10001d37
mov al, byte [esi + edi + 9]
test al, al
je 0x10001db7
movzx eax, al
add esi, eax
lea eax, [edi + 8]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10001d23
nop dword [eax + eax]
inc eax
add esi, eax
lea eax, [edi + 8]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10001d10
inc esi
cmp esi, dword [esp + 8]
jb 0x10001ce3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10001db7
movups xmm1, xmmword [esi + edi + 0x10]
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd ecx, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
movzx eax, cl
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
movzx eax, al
push eax
push ecx
movd ecx, xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
movzx eax, cl
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
movzx eax, al
push eax
push ecx
movd ecx, xmm0
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movd eax, xmm1
push eax
push str._08x__04x_04x__02x_02x_02x_02x__02x_02x_02x_02x
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x34
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001dd0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push 0x64
lea eax, [ebp - 0x6c]
mov ebx, edx
push 0
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.SoftwareStartIsBackLicense
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001e27
cmp eax, 2
je 0x10001e27
push eax
push str.SoftwareStartIsBackLicense
push esi
push str.SIBActivation:_RegOpenKeyEx__x_hs_error__d
call fcn.10001be0
add esp, 0x10
mov eax, dword [ebp - 4]
test eax, eax
je 0x10001ee2
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0x64
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10001ebb
cmp dword [ebp - 8], 0x1e
jle 0x10001ebb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareStartIsBackLicense
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.10001c20
add esp, 4
push 0x21
push ebx
push 1
push 0
push str.LicenseHash
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x21
push eax
push ebx
push 0
push 0
push str.LicenseHash
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001ef0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
push 8
push 0x9b
push str.RSA1
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edx
push eax
push str.RSAPUBLICBLOB
push 0
push 0xe1
mov esi, ecx
mov dword [ebp - 4], 0
call dword [sym.imp.bcrypt.dll_BCryptImportKeyPair]
test eax, eax
je 0x10001f41
push eax
push str.SIBActivation:_BCryptImportKeyPair_failed__x
call fcn.10001be0
add esp, 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
push 0x80
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0
push 0x80
push esi
push dword [ebp - 4]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.bcrypt.dll_BCryptDestroyKey]
test esi, esi
je 0x10001f94
push 0
push str.SIBActivation:_BCryptEncrypt_failed__x
call fcn.10001be0
add esp, 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x10001fa1
mov dword [eax], 0
mov edx, dword [ebp - 0xc]
push ebx
xor ebx, ebx
push edi
lea eax, [edx + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [edx + 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0xffffffa0
mov dword [ebp - 0x18], eax
nop dword [eax]
lea edi, [ebp - 0x7c]
mov esi, 0x1c
add edi, ebx
lea ecx, [edi - 0x20]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000208a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001fd0
cmp ebx, 0x1a
ja 0x10002008
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10002008
cmp dword [edi + 0x40], 0x52455054
jne 0x10002008
cmp word [edi + 0x44], 0x534b
jne 0x10002008
mov dword [ecx], 1
mov ecx, edi
mov edx, str.4e9934f69c3fd8c3e8502a2fd1ab89c2e78671d38a9b97ba313f5eaba6fd420f
mov esi, 0x3c
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000203b
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002014
mov eax, dword [ebp + 8]
test eax, eax
je 0x10002032
mov dword [eax], 1
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov ecx, edi
mov esi, 0x1c
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000205f
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002045
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
lea ecx, [edi + 0x20]
mov esi, 0x1c
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000208a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002070
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
inc ebx
cmp ebx, dword [ebp - 0x18]
ja 0x10002098
mov edx, dword [ebp - 0xc]
jmp 0x10001fc0
mov ecx, dword [ebp - 8]
xor eax, eax
test ecx, ecx
je 0x100020b8
cmp byte [ebp + eax - 0x9c], 0x20
jae 0x100020b3
mov byte [ebp + eax - 0x9c], 0x20
inc eax
cmp eax, ecx
jb 0x100020a1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x9c]
push eax
push edx
push str.SIBActivation:_mismatch__expected__s_decrypted__s
mov byte [ebp - 0x1c], 0
call fcn.10001be0
add esp, 0xc
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret