joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72a6e7b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x28
mov ebx, dword [ebp + 8]
test byte [0x72a768c4], 8
jne 0x72a6e8a0
test ebx, ebx
je 0x72a6e890
mov eax, dword [ebx]
test eax, eax
jne 0x72a6e830
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 4]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x1c]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov eax, dword [eax]
mov dword [esp], eax
call dword [edx + 0x18]
sub esp, 0x10
test eax, eax
je 0x72a6e8f2
mov esi, 1
xor ebx, ebx
mov dword [esp], ebx
call sym._SetLastError_4
mov eax, esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x10
cmp eax, 1
jne 0x72a6e890
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x72a6e890
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov dword [esp + 0xc], esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp + 8], esi
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
jne 0x72a6e80a
call sym._GetLastError_0
mov ebx, eax
test byte [0x72a768c4], 2
jne 0x72a6e907
xor eax, eax
test ebx, ebx
sete al
mov esi, eax
jmp 0x72a6e811
xor esi, esi
mov ebx, 6
jmp 0x72a6e811
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.LocalReadPrinter__p___p___lu___p__n
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x606
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.LocalReadPrinter
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0x72a79aad
mov dword [esp + 4], 0x72a768c4
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x72a6e7c8
call sym._GetLastError_0
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
mov esi, eax
jmp 0x72a6e811
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.ReadFile_failed_with_error__lu__n
mov dword [esp + 0x10], 0x63b
mov dword [esp + 0xc], str.LocalReadPrinter
mov dword [esp + 8], 0x72a79aad
mov dword [esp + 4], 0x72a768c4
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a6e880
Function at 0x72a70ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x14]
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x72a70d71
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._DllAllocSplMem_4
sub esp, 4
mov ebx, eax
test eax, eax
je 0x72a70df0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x72a70d90
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x72a76910], 2
jne 0x72a70db0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x72a76910], 2
jne 0x72a70e32
mov dword [esp], ebx
xor ebx, ebx
call sym._DllFreeSplMem_4
sub esp, 4
jmp 0x72a70d7c
mov dword [esp + 0x18], eax
xor ebx, ebx
mov dword [esp + 0x14], str.RegQueryValueExW_failed_with_status__ld__n
mov dword [esp + 0x10], 0x24
mov dword [esp + 0xc], str.AllocAndRegQueryWSZ
mov dword [esp + 8], 0x72a7af29
mov dword [esp + 4], 0x72a76910
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a70d67
test byte [0x72a76910], 2
je 0x72a70d7a
mov dword [esp + 0x14], str.DllAllocSplMem_failed__n
mov dword [esp + 0x10], 0x2c
mov dword [esp + 0xc], str.AllocAndRegQueryWSZ
mov dword [esp + 8], 0x72a7af29
mov dword [esp + 4], 0x72a76910
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a70d67
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.RegQueryValueExW_failed_with_status__ld__n
mov dword [esp + 0x10], 0x34
mov dword [esp + 0xc], str.AllocAndRegQueryWSZ
mov dword [esp + 8], 0x72a7af29
mov dword [esp + 4], 0x72a76910
mov dword [esp], 1
call sym._ros_dbg_log
jmp 0x72a70d9d
Function at 0x72a70f00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test edi, edi
je 0x72a70f18
xor edx, edx
mov word [edi], dx
test eax, eax
je 0x72a70f22
cmp word [eax], 0x5c
je 0x72a70f30
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [eax + 2], 0x5c
jne 0x72a70f22
lea ebx, [eax + 4]
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sym._wcschr
test eax, eax
je 0x72a71030
sub eax, ebx
sar eax, 1
mov esi, eax
test esi, esi
je 0x72a70f22
test byte [0x72a76910], 1
jne 0x72a70fe0
mov eax, esi
neg eax
cmp esi, 0xf
ja 0x72a70f24
test edi, edi
je 0x72a70f8b
lea eax, [esi + esi]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], edi
call sym._memmove
xor eax, eax
mov word [edi + esi*2], ax
lea eax, [ebp - 0x34]
lea edi, [ebp - 0x30]
mov dword [ebp - 0x34], 0x10
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._GetComputerNameW_8
sub esp, 8
test eax, eax
je 0x72a70fd0
cmp dword [ebp - 0x34], esi
jne 0x72a70fd0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x72a70f22
lea esi, [esi]
mov eax, esi
jmp 0x72a70f24
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._wine_dbgstr_wn
mov dword [esp + 0x14], str.found__s_n
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x6e
mov dword [esp + 0xc], str.copy_servername_from_name
mov dword [esp + 8], 0x72a7af29
mov dword [esp + 4], 0x72a76910
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x72a70f65
mov dword [esp], ebx
call sym._lstrlenW_4
sub esp, 4
mov esi, eax
jmp 0x72a70f58
Function at 0x72a73af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x72a7b274
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401b5a
pop dword [ebp - 0x18]
mov eax, 0x401b5a
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xabd1aa28
sub dword [ebp - 0x28], 0x5d7f64dd
mov dword [ebp - 0x24], 0xc3c7f273
sub dword [ebp - 0x24], 0x9194a62e
mov dword [ebp - 0x20], 0x5d2043e
sub dword [ebp - 0x20], 0xb985c010
mov dword [ebp - 0x1c], 0x19ec04c2
sub dword [ebp - 0x1c], 0x19ec04c2
lea eax, [ebp - 0x28]
push eax
mov eax, 0xb4ebf24c
add eax, 0x4b54de08
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x994f7fbd
add dword [ebp - 0x28], 0xdb22e999
mov dword [ebp - 0x24], 0xe5ee40a9
add dword [ebp - 0x24], 0x5b7e20cc
mov dword [ebp - 0x20], 0x8803759e
add dword [ebp - 0x20], 0xdb6bf6ce
mov dword [ebp - 0x1c], 0x71826782
sub dword [ebp - 0x1c], 0x71826782
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x88da0726
add eax, 0x7766c926
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38389
push 0
call eax
mov ecx, 0x4214
xor ebx, ebx
add ebx, eax
mov esi, 0xf8a4fb17
add esi, 0x79cb4e9
add esi, dword [ebp - 0x18]
mov edx, 0x1768237f
add edx, 0x18fc138c
sub dword [ebp - 4], 0x291363fd
mov edi, dword [esi]
sub dword [ebp - 4], ebx
add edi, edx
xor dword [ebp - 4], edx
mov dword [ebx], edi
xor dword [ebp - 0x10], 0x906f43f8
add ebx, 4
add esi, 0x5096a42f
sub esi, 0x5096a42b
loop 0x401c73
add eax, 0xfb23
xor ebx, ebx
add ebx, eax
add eax, 0x14fde9d9
add eax, 0xeb02162c
mov ecx, 0xa9f2482
add ecx, 0xf5a0db7e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x100018b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100018c5
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10001bc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call fcn.10004d20
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call fcn.1000cc03
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001c5b
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x10001c9d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10019282
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10001c85
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001c9d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.1000cc03
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0x78c
leave
ret

Function at 0x10001e92
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10001eb3
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001eb3
inc esi
mov eax, esi
pop esi
ret
Function at 0x100028fc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183ad
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002956
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.1000cc03
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002973
call fcn.100035cd
jmp 0x10002975
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.1000cc03
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100029c0
call fcn.1000390e
jmp 0x100029c0
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret

Function at 0x100029ea
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183dd
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002a44
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.1000cc03
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002a61
call fcn.100035cd
jmp 0x10002a63
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.1000cc03
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x10002aae
call fcn.1000390e
jmp 0x10002aae
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.1000cc03
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.1000cc03
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1000cc03
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x1000cc03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000cc12
pop dword [ebp - 0x50]
mov eax, 0x390f7cb0
sub eax, 0x290eb09e
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x4f11a71a
sub dword [ebp - 0x60], 0xbf61cf
mov dword [ebp - 0x5c], 0x6be016a4
add dword [ebp - 0x5c], 0xc65335a1
mov dword [ebp - 0x58], 0x8572dc11
sub dword [ebp - 0x58], 0x392697e3
mov dword [ebp - 0x54], 0x14d21e0f
add dword [ebp - 0x54], 0xeb2de1f1
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa44ec980
sub dword [ebp - 0x60], 0x2fdc602a
mov dword [ebp - 0x5c], 0xae8c0265
sub dword [ebp - 0x5c], 0x6d1fa0f0
mov dword [ebp - 0x58], 0x7d089fa4
add dword [ebp - 0x58], 0xe666ccc8
mov dword [ebp - 0x54], 0x833c98bc
add dword [ebp - 0x54], 0x7cc36744
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38352
push 0
call eax
mov ecx, 0x3b2d
xor esi, esi
add esi, eax
mov edx, 0x1002be00
add edx, dword [ebp - 0x50]
mov edi, 0x916dc4dd
xor dword [ebp - 0x30], esi
mov ebx, dword [edx]
add dword [ebp - 0x2c], 0xb41d16f0
xor ebx, edi
add dword [ebp - 0x30], 0x59c4fded
mov dword [esi], ebx
add dword [ebp - 0x44], 0x7f869e8f
add esi, 0x1d756f08
add esi, 0xe28a90fc
add edx, 0x4632dd59
sub edx, 0x4632dd55
loop 0x1000cd1a
add eax, 0xbc357841
sub eax, 0xbc3498ba
mov ebx, eax
add eax, 0x5781590d
add eax, 0xa87ea6f8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10001c50
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001ce8
push str.avifil32.dll
call fcn.1000d2cd
test al, al
jne 0x10001c6d
pop esi
ret
push str.AVIFileInit
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10001d30
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001dc8
push str.winmm.dll
call fcn.1000d2cd
test al, al
jne 0x10001d4d
pop esi
ret
push str.mmioInstallIOProcA
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret
Function at 0x10005720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x1000587f
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x1000587f
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x1000579f
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x1000588e
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x100057bc
mov dl, bl
xor edi, edi
jmp 0x100057ec
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x1000578e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x10005791
mov edx, ebx
cmp ebx, 0x800
jae 0x100057d1
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x100057ec
cmp ebx, 0x10000
jae 0x100057e3
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x100057eb
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 0xc]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 8]
jl 0x1000587f
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x10005823
cmp edi, 3
jae 0x1000582e
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x10005831
mov eax, dword [ebp - 8]
test eax, eax
je 0x10005856
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp - 8], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x10005838
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x10005749
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x10005887

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000d2cd
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4
Function at 0x4034c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4034d2
pop dword [ebp - 0x24]
mov eax, 0x4034d2
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xa9526079
add dword [ebp - 0x34], 0xa4ffe4d2
mov dword [ebp - 0x30], 0x96ce4b4f
sub dword [ebp - 0x30], 0x649aff0a
mov dword [ebp - 0x2c], 0x1187e9c9
add dword [ebp - 0x2c], 0x3ac45a65
mov dword [ebp - 0x28], 0xd3d1f3b
add dword [ebp - 0x28], 0xf2c2e0c5
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x841a9f1d
add dword [ebp - 0x34], 0xf057ca39
mov dword [ebp - 0x30], 0x7ffb2bf3
add dword [ebp - 0x30], 0xc1713582
mov dword [ebp - 0x2c], 0xbedfa7d
add dword [ebp - 0x2c], 0x578171ef
mov dword [ebp - 0x28], 0x73af2ea
sub dword [ebp - 0x28], 0x73af2ea
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x339a8
push 0
call eax
mov ecx, 0xe03ac04a
add ecx, 0x1fc57a8e
xor edi, edi
add edi, eax
mov ebx, 0xb6bd55a
add ebx, 0xf4d4aea6
add ebx, dword [ebp - 0x24]
mov esi, 0x36e8d181
xor dword [ebp - 0x14], ebx
mov edx, dword [ebx]
add dword [ebp - 0x1c], edx
xor edx, esi
xor dword [ebp - 0x10], esi
mov dword [edi], edx
xor dword [ebp - 8], 0xd98f9981
add edi, 0xceddf4f0
add edi, 0x31220b14
add ebx, 0x95a129b4
sub ebx, 0x95a129b0
loop 0x4035e1
add eax, 0xde33
mov ebx, eax
add eax, 0xf9e32658
sub eax, 0xf9e32653
mov ecx, 0x73b595aa
sub ecx, 0x737595aa
add ecx, dword [ebp - 0x24]
call ebx
leave
ret