joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1059fde
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x105a017
xor eax, eax
jmp 0x105a167
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105a01d
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jbe 0x105a039
mov eax, dword [ebp - 8]
inc dword [ebp - 0x14]
add eax, 5
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
jne 0x105a068
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x105a010
push ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov edi, 0x2001f
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push 0x1004eb4
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call fcn.0103592d
add esp, 0x14
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105a13c
cmp dword [ebp + 0x10], esi
je 0x105a116
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x105a116
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105a10f
cmp dword [ebp - 0x1c], 1
jne 0x105a10f
invalid
Function at 0x105a895
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x41c], 0
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x105a997
push ebx
push eax
push 0x100a688
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0103592d
add esp, 0x10
test eax, eax
jl 0x105a996
and dword [ebp - 0x418], 0
push esi
mov esi, 0x20019
call fcn.0105c74e
test eax, eax
je 0x105a8ff
mov esi, 0x20119
lea eax, [ebp - 0x418]
push eax
push esi
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105a995
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x424]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push 0
push 0x100a668
push dword [ebp - 0x418]
xor esi, esi
inc esi
mov dword [ebp - 0x420], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105a989
cmp dword [ebp - 0x420], esi
jne 0x105a989
push ebx
lea eax, [ebp - 0x414]
push eax
push edi
mov dword [ebp - 0x41c], esi
call fcn.0105824d
test eax, eax
je 0x105a989
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x10]
push edi
call fcn.01035831
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
pop edi
call fcn.01047480
leave
ret 0xc

Function at 0x105aaf1
Capabilities:
Copy file
Delete file
Get common file path
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x105ab31
mov eax, 0x80004003
jmp 0x105aefd
test edi, edi
jne 0x105ab40
test eax, eax
jne 0x105ab40
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.010561eb
test eax, eax
jne 0x105ab5a
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x80070002
jmp 0x105aefd
push ebx
mov ebx, 0x208
test edi, edi
je 0x105ac74
cmp dword [ebp + 0x14], 0
je 0x105ab80
lea eax, [ebp - 0x420]
push eax
push edi
call fcn.01056218
invalid
invalid
Function at 0x105af12
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x105afe6
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x105afd5
push edi
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01035831
push 0x100a8e0
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
lea eax, [ebp - 0x414]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x105afd5
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
lea eax, [ebp - 0x20c]
push eax
call fcn.010561eb
test eax, eax
je 0x105afd5
xor esi, esi
inc esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0105720c
test eax, eax
jne 0x105afd5
push eax
push eax
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0105aaf1
push edi
push 0x100a8bc
push 4
call fcn.01055c8a
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01047480
leave
ret 4

Function at 0x105b3bf
Capabilities:
Enumerate services
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push edi
push dword [ebp + 0xc]
xor edi, edi
push 0x100acd8
inc edi
xor ebx, ebx
push 4
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], ebx
call fcn.01055c8a
add esp, 0xc
cmp dword [ebp + 8], ebx
je 0x105b402
push 0x100acc8
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x105b402
mov dword [ebp + 8], ebx
push 0xf003f
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
invalid
Function at 0x105b7b5
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], edi
invalid
invalid

Function at 0x105b8a5
Capabilities:
Delete service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], ebx
jne 0x105b8c3
mov dword [ebp - 4], ebx
jmp 0x105b9ac
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x105b8d2
cmp word [edi], bx
jne 0x105b8d2
xor edi, edi
push dword [ebp + 0xc]
push ebx
call fcn.0105b3bf
test eax, eax
je 0x105b988
mov esi, 0xf003f
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x105b96d
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x105b954
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x105b93d
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x105b92a
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100af08
push 2
call fcn.01055c8a
add esp, 0x10
push dword [ebp + 0xc]
push 0x100aee0
push 4
call fcn.01055c8a
add esp, 0xc
push edi
call esi
jmp 0x105b966
push dword [ebp + 0xc]
push 0x100aebc
push 4
call fcn.01055c8a
add esp, 0xc
push dword [ebp + 8]
call esi
jmp 0x105b9ab
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x105b97d
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100ade0
jmp 0x105b9a1
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x105b998
push 0x57
pop eax
push eax
push dword [ebp + 0xc]
push 0x100af08
push 2
call fcn.01055c8a
add esp, 0x10
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
Function at 0x105cda7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x101
xor edi, edi
push edi
push 0x1001c88
push 0x80000002
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105ce11
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x100b2e4
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105ce04
cmp dword [ebp - 0xc], esi
je 0x105ce07
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [ebp - 8]
pop edi
leave

Function at 0x105ce1c
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov esi, eax
cmp esi, ebx
je 0x105d003
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 4
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
invalid
Function at 0x105e226
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
push edi
inc eax
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x620]
push eax
xor ecx, ecx
mov edi, 0x101
push edi
push ecx
push 0x100bcf8
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x620], ecx
mov dword [ebp - 0x630], ecx
mov dword [ebp - 0x628], ecx
call esi
test eax, eax
je 0x105e2ae
lea eax, [ebp - 0x620]
push eax
push edi
xor edi, edi
push edi
push 0x100bc78
push ebx
mov dword [ebp - 0x62c], 2
call esi
test eax, eax
je 0x105e2b0
xor eax, eax
jmp 0x105e456
xor edi, edi
push 0x100bc50
push 4
call fcn.01055c50
cmp dword [ebp - 0x620], edi
invalid
invalid

Function at 0x105e983
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x1001b38
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105e9f0
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x100beb4
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105e9e6
cmp dword [ebp - 8], esi
jne 0x105e9e6
cmp dword [ebp - 0xc], 1
sete al
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
leave
ret

Function at 0x105f2b7
Capabilities:
Check for time delay via gettickcount
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x20]
push eax
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100c408
push 4
call fcn.01055bad
cmp dword [esi + 0x38], 2
mov dword [esi + 0x48], ebx
je 0x105f30b
invalid
int3
Function at 0x1060e4e
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
call fcn.010607ce
cmp dword [ebp - 0x1c], esi
je 0x10611da
cmp dword [ebp - 0x14], esi
je 0x10611da
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 3
push esi
push esi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, esi
jne 0x10611da
cmp dword [ebp + 0x10], esi
je 0x10611ba
cmp dword [ebp - 4], esi
jne 0x1060f03
cmp dword [ebp - 0x18], esi
jne 0x1060f03
push 2
push 0x1001e44
push 1
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10611cb
mov ebx, dword [ebp - 0x24]
invalid

Function at 0x10612a5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.010607ce
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
cmp dword [ebp - 0x14], esi
je 0x106138d
cmp dword [ebp - 8], esi
je 0x106138d
lea eax, [ebp + 0xc]
push eax
push 3
push esi
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106138d
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp + 8], 1
push dword [ebp + 0xc]
mov dword [ebp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106133e
inc eax
cmp dword [ebp + 8], eax
jne 0x106133e
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], esi
je 0x106138d
test byte [ebp + 0x18], 0x40
je 0x1061366
push 0x3b
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x1061366
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp + 0x18]
xor eax, 0xf
je 0x10613ba
push ebx
call fcn.010587e2
test eax, eax
je 0x106138d
invalid
Function at 0x1065997
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], 1
cmp eax, esi
je 0x1065a9d
cmp ecx, esi
je 0x1065a9d
push ecx
push eax
push 0x100dde8
lea eax, [ebp - 0x248]
push 0x121
push eax
call fcn.0103592d
add esp, 0x14
lea eax, [ebp - 0x24c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x248]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1065aba
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push esi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1065aae
cmp dword [ebp - 0x250], 1
je 0x1065a60
cmp dword [ebp - 0x250], 2
jne 0x1065aae
lea eax, [ebp - 0x248]
push eax
call fcn.010653f3
test eax, eax
je 0x1065aae
lea eax, [ebp - 0x248]
xor esi, esi
push eax
inc esi
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.01065416
test eax, eax
jne 0x1065aae
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047480
leave
ret 8
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1065a9f

Function at 0x1065ade
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x118], 1
invalid

Function at 0x1065cfb
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor eax, eax
sub eax, 0xdfa9425b
cmp dword [0x107305c], esp
and eax, 0x107305c
jg 0x1065d0e
rol edi, 0x1e
sub dword [0x107568c], eax
mov edi, edi
or edi, 0x6aef6ad7

Function at 0x1065d04
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor eax, eax
sub eax, 0xdfa9425b
cmp dword [0x107305c], esp
and eax, 0x107305c
jg 0x1065d0e
rol edi, 0x1e
sub dword [0x107568c], eax
mov edi, edi
or edi, 0x6aef6ad7

Function at 0x1065d10
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor eax, eax
sub eax, 0xdfa9425b
cmp dword [0x107305c], esp
and eax, 0x107305c
jg 0x1065d0e
rol edi, 0x1e
sub dword [0x107568c], eax
mov edi, edi
or edi, 0x6aef6ad7

Function at 0x1065d1c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
shr edi, 0x12
xor edx, ecx
ror esi, 3
call fcn.0100c08c
inc ecx
out 0x10, al

Function at 0x1065d28
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
shr edi, 0x12
xor edx, ecx
ror esi, 3
call fcn.0100c08c
inc ecx
out 0x10, al
Function at 0x10660b8
Capabilities:
Hash data using murmur3

Disassembly:
out 0x59, eax
pop es
add edi, esi
sal dword [ebx], cl
xor eax, 0x1075d90

Function at 0x1066666
Capabilities:
Hash data using murmur3

Disassembly:
and dword [0x1075822], ecx
sub eax, edi
mov dword [0x1075933], edi
inc edx
neg esi
ror edx, 0x11
xchg ecx, edx
invalid
invalid

Function at 0x1066aa7
Capabilities:
Hash data using murmur3

Disassembly:
neg esi
call fcn.01005662
add edi, ebx
push esi
inc ebx
rol eax, 0x1c
sub ebx, esp
inc edx
add ecx, dword [0x1075d92]
rol ecx, 0xd
sub ecx, dword [0x1075df7]
xchg edi, edx
add edi, dword [0x1075fbc]
or ebx, dword [0x1075cd2]
rol eax, 0x1d
xchg ecx, esi
call fcn.0105ce16
call fcn.0105ce61
xchg ecx, esi
ror eax, 0x1d
xchg edi, edx
ror ecx, 0xd
dec edx
add ebx, esp
ror eax, 0x1c
dec ebx
mov edx, 0x5341516c
and dword [0x1075738], edx
inc edi
call fcn.0103bf2e
sub eax, dword [0x1075f39]
mov dword [0x107565b], ebx
ror edi, 0x13
dec ecx
sub edx, dword [0x1075b52]
add esi, dword [0x1075c92]
xchg edx, eax
call fcn.01046396
xor dword [0x10757f2], eax
inc edi
inc ecx
mov dword [0x1075a70], 0x35e9399c
add edi, dword [0x1075ee8]
call fcn.0102137d
dec ecx
dec edi
call fcn.0101c315
xchg edx, eax
inc ecx
rol edi, 0x13
mov dword [0x10755b1], ecx
dec edi
and dword [0x1075848], eax
xor edx, 0x324039cc
sub eax, dword [0x1075ed7]
dec edx
call fcn.0102ec01
rol edx, 0x19
add dword [0x1075a72], edx
or dword [0x10756c2], 0x5962fd7e
rol eax, 1
sub ecx, 0x3317fb14
xor edx, esp
call fcn.01047355
xor edx, esp
add ecx, 0x3317fb14
ror eax, 1
xor dword [0x10759b7], 0xb33ccc15
ror edx, 0x19
inc edx
sub edx, 0x1f95072b
rol eax, 0x13
dec esi
xchg ebx, esi
and dword [0x1075615], ecx
sub edx, dword [0x1075e38]
mov dword [0x10755f8], ecx
call fcn.01005662
xor esi, 0x2da48de7
not edi
xor dword [0x1075a9b], edx
dec edi
add eax, dword [0x1075e79]
call fcn.01041929
call fcn.0102ec01
inc edi
not edi
xor esi, 0x2da48de7
xor dword [0x1075697], eax
xchg ebx, esi
inc esi
ror eax, 0x13
push edx
sub dword [0x10758c6], edi
inc eax
neg esi
add esi, 0x15b7891e
xor edx, ebx
ror edi, 0x1c
sub eax, edx
sub eax, dword [0x1075b46]
xor edx, 0xe399525b
sub eax, dword [0x1075ef8]
sub ecx, dword [0x1075b15]
ror ecx, 6
add edi, edx
mov dword [0x10756ed], edx
ror esi, 0x19
dec edx
xor ebx, 0x2c479b2e
xchg esi, eax
call fcn.01044e99
call fcn.01061379
xchg esi, eax
xor ebx, 0x2c479b2e
inc edx
rol esi, 0x19
or dword [0x10758c5], edx
sub edi, edx
rol ecx, 6
xor edx, 0xe399525b
add eax, edx
rol edi, 0x1c
xor edx, ebx
sub esi, 0x15b7891e
neg esi
dec eax
xor dword [0x1075996], eax
mov edx, 0xd824c7b8
xor dword [0x10758a4], ecx
add ecx, dword [0x1075fb8]
or eax, 0x1075fb8
not edi
sub ebx, dword [0x1075d86]
xchg edx, esi
or dword [0x10755c2], eax
call fcn.0104f1ef
inc esi
inc ebx
not edi
ror ebx, 9
xor esi, 0x63be81e0
ror edx, 0x1e
inc edi
xor eax, 0x5fcfc217
xor dword [0x10759b5], edi
neg ebx
xor eax, 0x207cdfae
and dword [0x107586d], ebx
invalid
invalid
cmpsb byte [esi], byte es:[edi]
Function at 0x401720
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
sub esp, 0x17c
mov eax, dword [0x40d0c8]
xor eax, esp
mov dword [esp + 0x178], eax
push esi
mov esi, dword [esp + 0x18c]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x104
lea ecx, [esp + 0x78]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x74]
push 0x5c
push edx
call fcn.00401bb2
add esp, 8
mov byte [eax + 1], 0
push 0
push 0x40a1a6
lea ecx, [esp + 0x60]
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], 0
mov byte [esp + 0x64], 0
call fcn.00401520
push str.jre_binjavaw.exe
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [esp + 0x58]
je 0x4017ae
push 0x11
push str.jre_binjavaw.exe
jmp 0x4017b5
push 9
push str.javaw.exe
call fcn.004015f0
push 7
push str.__jar__
lea ecx, [esp + 0x60]
call fcn.004015f0
lea eax, [esp + 0x74]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4017d1
sub eax, edx
push eax
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x60]
call fcn.004015f0
push 0x14
push str.KEmulator.jar___jar
lea ecx, [esp + 0x60]
call fcn.004015f0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401800
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x60]
call fcn.004015f0
mov eax, dword [esp + 0x5c]
mov esi, 0x10
cmp dword [esp + 0x70], esi
jae 0x401829
lea eax, [esp + 0x5c]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401857
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [esp + 0x70], esi
pop esi
jb 0x401873
mov ecx, dword [esp + 0x58]
push ecx
call fcn.00401d18
add esp, 4
mov ecx, dword [esp + 0x178]
xor ecx, esp
xor eax, eax
call fcn.00402287
add esp, 0x17c
ret 0x10

Function at 0x402287
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d0c8]
jne 0x402291
repz ret
jmp fcn.0040504c