joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9d2d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x9d2d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x9d2d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x9d2d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x9d2d94
push eax
push esi
call fcn.009d520b
add esp, 8
pop esi
ret 0x10

Function at 0x9d2da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x9d2e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x9d2e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x9eb320
push ecx
mov dword [esp + 0x1c], 4
call fcn.009d4dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x9d2dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x9d2e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x9d2ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x9d2eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x9eb320
push ecx
mov dword [esp + 0x1c], 4
call fcn.009d4dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x9d2eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x9d2e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x9d3000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x9d3131
push esi
call fcn.009d6145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.009c5080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x9d3131
push 0
push ebp
call fcn.009c53a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.009c5260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x9d308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009c52f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x9d3121
push 0x9eb918
push edi
call fcn.009d43f0
push eax
push ebx
push esi
call fcn.009d2f60
push 0x9eb8f8
push edi
call fcn.009d43f0
push eax
push ebx
push esi
call fcn.009d2f60
push 0x9eb8d8
push edi
call fcn.009d43f0
push eax
push ebx
push esi
call fcn.009d2f60
push 0x9eb8c0
push edi
call fcn.009d43f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.009d2f60
push 0x9eb8a0
push edi
call fcn.009d43f0
push eax
push ebx
push esi
call fcn.009d2f60
push 0x9eb888
push edi
call fcn.009d43f0
push eax
push ebx
push esi
call fcn.009d2f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9d41b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.009d4140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.009d4140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.009d4140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.009d4140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x9d4bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x9d4c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x9e687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9d4c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x9d4c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x55c25f3e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x309618c0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100162b0
push 0x1001417b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x100011a6
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x1000122f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x100011cd
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x1000122f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x10001208
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x10001208
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x1000122f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x1000122f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100012d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001c3c0]
mov dword [ebp - 4], eax
jmp 0x100012e9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001306
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012e0
mov esp, ebp
pop ebp
ret
Function at 0x10001310
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001c3d0], eax
je 0x1000132e
mov eax, 0x10dd
jmp 0x10001410
mov eax, dword [0x1001c3e0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100013ad
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1000138b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1000138b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001480
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10013c80
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x10001336
mov dword [0x1001c3e0], 0
call fcn.10001420
mov ecx, dword [0x1001c3dc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x100013fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10013c80
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x100013c5
mov dword [0x1001c3dc], 0
mov dword [0x1001c3d0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001980
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001995
xor eax, eax
jmp 0x10001a0a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x100019c2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10001a05
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10001a03
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019ff
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10001a03
xor eax, eax
jmp 0x10001a0a
jmp 0x100019b9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001ac0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1001c3d4], 0
je 0x10001ad9
mov eax, dword [0x1001c3d4]
jmp 0x10001b79
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001aeb
xor eax, eax
jmp 0x10001b79
push 8
call fcn.1001328d
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001b41
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10001b2a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10013c80
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1001c3d4], eax
mov dword [0x1001c3d8], 0
mov eax, dword [ebp - 8]
jmp 0x10001b79
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10001b0b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1001c3dc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1001c3dc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100148ec
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001c010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x3c
call fcn.1001328d
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0xc]
mov ecx, esi
push 0
push 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x10]
push ebx
push edi
call fcn.10009f40
mov byte [ebp - 4], 1
mov dword [esi], vtable.Buttons.0
add esi, 0x28
mov dword [ebp + 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1001328d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x10], esi
mov dword [esi + 8], ebx
mov ebx, dword [ebp - 0x14]
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 4], edi
mov eax, dword [ebx + 0x2c]
cmp eax, dword [ebx + 0x30]
je 0x1000a723
mov dword [eax], esi
add dword [ebx + 0x2c], 4
jmp 0x1000a730
lea ecx, [ebp + 0x10]
push ecx
push eax
lea ecx, [ebx + 0x28]
call fcn.10009de0
mov dword [esi + 0x1c], ebx
cmp dword [ebx + 0x3c], 0
jne 0x1000a746
cmp byte [esi + 0x1a], 0
je 0x1000a746
mov dword [ebx + 0x3c], esi
mov byte [esi + 0x1b], 1
mov esi, dword [ebx + 0x2c]
lea eax, [ebp + 8]
sub esi, dword [ebx + 0x28]
lea ecx, [ebx + 0x34]
push eax
sar esi, 2
call fcn.10005c90
lea ecx, [esi - 1]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b690
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [0x1001c78c], 0x4f0f30
call fcn.10001240
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001ac0
push 0x1000b890
push 0x1001c78c
call fcn.10001b80
call fcn.100014c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x50446f
call esi
mov eax, 0x1000baa0
mov byte [0x50446f], 0xe9
sub eax, 0x504474
mov dword [0x504470], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x50446f
call esi
lea eax, [ebp - 4]
mov dword [0x1001c798], 0x504474
push eax
push 0x40
push 5
push 0x40e0ee
call esi
mov eax, 0x1000bc30
mov byte [0x40e0ee], 0xe9
sub eax, 0x40e0f3
mov dword [0x40e0ef], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e0ee
call esi
lea eax, [ebp - 4]
mov dword [0x1001c790], 0x40e0f3
push eax
push 0x40
push 5
push 0x40e3b6
call esi
mov eax, 0x1000bc50
mov byte [0x40e3b6], 0xe9
sub eax, 0x40e3bb
mov dword [0x40e3b7], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e3b6
call esi
lea eax, [ebp - 4]
mov dword [0x1001c7ac], 0x40e3bb
push eax
push 0x40
push 5
push 0x41101c
call esi
mov eax, 0x1000bc70
mov byte [0x41101c], 0xe9
sub eax, 0x411021
mov dword [0x41101d], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x41101c
call esi
lea eax, [ebp - 4]
mov dword [0x1001c7a0], 0x411021
push eax
push 0x40
push 5
push 0x40e193
call esi
mov eax, 0x1000bc20
mov byte [0x40e193], 0xe9
sub eax, 0x40e198
mov dword [0x40e194], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e193
call esi
lea eax, [ebp - 4]
mov dword [0x1001c784], 0x40e198
push eax
push 0x40
push 5
push 0x40e062
call esi
mov eax, 0x1000bc10
mov byte [0x40e062], 0xe9
sub eax, 0x40e067
mov dword [0x40e063], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x40e062
call esi
lea eax, [ebp - 4]
mov dword [0x1001c7a4], 0x40e067
push eax
push 0x40
push 5
push 0x4110b2
call esi
mov eax, 0x1000bc80
mov byte [0x4110b2], 0xe9
sub eax, 0x4110b7
mov dword [0x4110b3], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x4110b2
call esi
mov dword [0x1001c780], 0x4110b9
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000e6a0
Capabilities:
Encode data using xor
Encrypt data using xtea
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1001c010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x28], ebx
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
cmp eax, 1
jne 0x1000e6cc
mov ax, word [ebx]
mov word [ecx + 2], ax
jmp 0x1000e6ea
cmp eax, 2
jne 0x1000e6e4
mov dword [ecx + 2], 0xc1e7cae
mov ecx, dword [ebx + 0xc]
mov ax, word [ebx]
mov word [ecx + 6], ax
jmp 0x1000e6ea
mov ax, word [ebx]
mov word [ecx], ax
mov eax, dword [0x7998bc]
xor edx, edx
cmp dword [ebx + 8], 2
mov esi, dword [ebx]
sete dl
mov dword [ebp - 0x14], eax
mov eax, dword [0x7998c0]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7998c4]
lea edx, [edx*4 + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [0x7998c8]
add esi, edx
mov ecx, esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], esi
and ecx, 0x80000007
jns 0x1000e735
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x1000e743
mov eax, 8
sub eax, ecx
add esi, eax
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebx + 0xc]
mov eax, esi
add ecx, edx
cdq
and edx, 3
mov dword [ebp - 0x20], ecx
add eax, edx
sar eax, 2
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x1000e7d1
xor ebx, ebx
push edi
mov esi, dword [ecx + ebx*4]
xor eax, eax
mov edi, dword [ecx + ebx*4 + 4]
mov dword [ebp - 0x18], 0x20
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
sub eax, 0x61c88647
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
xor edx, ecx
add edi, edx
sub dword [ebp - 0x18], 1
jne 0x1000e770
mov ecx, dword [ebp - 0x20]
mov dword [ecx + ebx*4], esi
mov dword [ecx + ebx*4 + 4], edi
add ebx, 2
cmp ebx, dword [ebp - 0x24]
jl 0x1000e760
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
pop edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffffe
add ecx, esi
mov word [eax], cx
mov ecx, dword [ebx + 0xc]
mov dword [ebx], esi
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1001c060]
call dword [sym.imp.WS2_32.dll_send]
push dword [ebx + 0xc]
call fcn.100137f6
push 0x10
push ebx
call fcn.100132bd
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop ebx
call fcn.1001327f
mov esp, ebp
pop ebp
ret 4
Function at 0x1000edb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x15c
mov eax, dword [0x1001c010]
xor eax, esp
mov dword [esp + 0x158], eax
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x1000eeca
push 0x104
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movaps xmm0, xmmword [0x10017f60]
lea ecx, [esp + 0x28]
movups xmmword [esp + 0x28], xmm0
lea eax, [esp + 0x58]
sub esp, 0xc
movaps xmm0, xmmword [0x100180f0]
sub eax, ecx
movups xmmword [esp + 0x44], xmm0
mov edi, esp
mov ebx, eax
movaps xmm0, xmmword [0x10018010]
movups xmmword [esp + 0x54], xmm0
sar ebx, 2
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x1000ee5d
push ebx
mov ecx, edi
call fcn.10005c00
push dword [esp + 0x18]
mov esi, dword [edi]
lea eax, [esp + 0x38]
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + ebx*4]
add esp, 0xc
mov dword [edi + 4], eax
lea ecx, [esp + 0x1c]
call fcn.10010440
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1000ee71
mov eax, dword [eax]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
jb 0x1000eeb5
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000eeab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000eeab
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100132bd
add esp, 8
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1001c7c4], eax
call fcn.1000e820
mov ecx, dword [esp + 0x164]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001327f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100127d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100127fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10012824
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1001282a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10012892
jg 0x10012841
test esi, esi
je 0x10012892
test ecx, ecx
jl 0x1001288d
jg 0x1001284b
test eax, eax
je 0x1001288d
cmp edi, ecx
jg 0x1001285f
jl 0x10012855
cmp esi, eax
jae 0x1001285f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10012895
mov ecx, dword [ebp + 8]
jmp 0x1001289f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x100128b9
jg 0x1001289f
test esi, esi
je 0x100128b9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100128b9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc