joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003751
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1004b3b0
call fcn.1004ae30
sub esp, 0x2c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x20], ecx
je 0x100038f7
cmp byte [ebp + 0x14], 0
je 0x100038ce
xor ebx, ebx
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 0x51f3
cmp dword [ebp - 0x1c], 0x54e7
jle 0x100037f4
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp - 0x14], 0x3074
mov esi, ebx
mov ebx, dword [ebp + 0x18]
mov eax, ebx
mov ecx, 0x10062a18
and eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.10003a17
inc esi
cmp esi, 0x3c77
jl 0x100037b3
mov esi, dword [ebp - 0x18]
add ebx, esi
dec dword [ebp - 0x14]
push 0
mov dword [ebp + 0x18], ebx
pop ebx
jne 0x100037ae
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x57a1
jl 0x100037a4
inc edi
cmp edi, 0x1f70
jl 0x100037a1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.10003c92
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0x4e9a
jge 0x10003839
mov edx, str.bjkryfwzr_civq_sxftmqne_lotaz_yihutbc_skpa_xvx_kqn
mov ecx, 0x10062a18
call fcn.10006198
jmp 0x10003839
mov dword [ebp - 4], ebx
mov eax, dword [0x10064f64]
test al, 1
jne 0x10003869
or eax, 1
mov dword [0x10064f64], eax
push 0x148c
mov byte [ebp - 4], 3
call fcn.10012e37
mov byte [0x10063bbc], al
mov byte [ebp - 4], bl
mov eax, dword [0x10064f64]
pop ecx
test al, 2
jne 0x1000388c
or eax, 2
mov dword [0x10064f64], eax
push 0xddc
mov byte [ebp - 4], 4
call fcn.10012e37
pop ecx
mov byte [0x10064f54], al
mov byte [ebp - 4], bl
push ecx
push 0x610c
push ecx
push 0x10064f54
lea eax, [ebp - 0x38]
mov ecx, 0x10063bbc
push 1
push eax
lea edx, [ebp - 0x20]
call fcn.100036ef
mov ecx, dword [ebp + 0x24]
lea eax, [ebp - 0x38]
add esp, 0x18
cmp ecx, eax
je 0x100038c1
push 0xffffffffffffffff
push ebx
push eax
call fcn.10004345
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.1000446c
jmp 0x10003925
push 0x1a
pop ecx
cmp dword [esi], ecx
jge 0x100038df
mov eax, dword [ebp + 8]
movzx edx, word [eax]
add edx, dword [esi]
jmp 0x100038ec
mov eax, dword [esi]
cdq
idiv ecx
mov eax, dword [ebp + 0x1c]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0xc]
push edx
call fcn.10003b8f
jmp 0x10003925
cmp byte [ebp + 0x20], 0
je 0x10003916
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10003925
xor ebx, ebx
push ebx
push 0x24f0
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
jmp 0x10003925
xor ebx, ebx
push ebx
push 0xf41
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100044b4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100044cb
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100044ed
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10063bc4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10063f50
jl 0x100044fb
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100641f4
jl 0x1000453b
mov ecx, dword [0x10064f40]
xor ecx, dword [0x10063bc4]
and ecx, edi
xor ecx, dword [0x10064f40]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10063bc0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100641f4]
mov dword [0x10064580], eax
pop esi
ret
Function at 0x100070ae
Capabilities:
Resume thread

Disassembly:
mov eax, 0x1004b5db
call fcn.1004ae30
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
test cl, cl
je 0x1000719d
mov dword [ebp - 0x24], 0x7b7a
xor ebx, ebx
cmp dword [ebp - 0x24], 0x7ccc
jle 0x10007149
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov eax, esi
mov dword [ebp - 0x1c], 0x2133
mov dword [ebp - 0x18], eax
mov ebx, eax
mov esi, 0x1865
mov eax, ebx
mov ecx, 0x10062a18
cdq
push edx
push eax
call fcn.10003a17
dec ebx
dec esi
jne 0x10007103
mov eax, dword [ebp - 0x18]
add eax, edi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x100070fc
mov esi, dword [ebp - 0x20]
inc edi
cmp edi, 0x14cb
jl 0x100070f0
inc esi
mov dword [ebp - 0x20], esi
push 0
pop ebx
cmp esi, 0x63f4
jl 0x100070ee
push 0xaeb
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
cmp byte [ebp + 0x18], 0
je 0x1000715f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10007166
call fcn.1000734f
jmp 0x10007166
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x7803
jge 0x10007181
mov edx, str.cljqltgds_tigmgbjfs_oxcgcgot
mov ecx, 0x10062a18
call fcn.10006198
jmp 0x100071d5
cmp byte [ebp + 0x10], 0
je 0x100071d0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
push dword [ebp + 0xc]
imul edx, dword [esi], 0x18
add edx, dword [edi]
call fcn.10006bdf
pop ecx
imul ecx, dword [esi], 0x18
push eax
add ecx, dword [edi]
call fcn.1000a7f9
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100042fb
jmp 0x100071d5
mov eax, dword [ebp + 0x14]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000755a
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004b67e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push esi
push edi
push 0x44
xor esi, esi
lea eax, [esp + 0x54]
push esi
push eax
mov ebx, edx
mov edi, ecx
call fcn.1002a86b
add esp, 0xc
lea eax, [esp + 0x28]
push 0x10
push esi
push eax
call fcn.1002a86b
add esp, 0xc
mov dword [esp + 0x50], 0x44
cmp dword [edi + 0x14], 8
jb 0x100075b6
mov ecx, dword [edi]
jmp 0x100075b8
mov ecx, edi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
lea eax, [ecx + eax*2]
jb 0x100075c6
mov edi, dword [edi]
push dword [esp + 0x10]
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], esi
push eax
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.1000ba12
lea eax, [esp + 0xc]
mov dword [esp + 0xa4], esi
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], esi
call fcn.1000add3
cmp dword [ebx + 0x14], 8
jb 0x10007602
mov ebx, dword [ebx]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x54]
push eax
push ebx
push esi
push 0x8000000
push 1
push esi
push esi
push dword [esp + 0x3c]
mov ebx, 0x1421
push esi
push ebx
push 0x8d8
call fcn.10027aff
pop ecx
pop ecx
call eax
test eax, eax
je 0x10007717
mov dword [esp + 0x10], 0x21f3
cmp dword [esp + 0x10], 0x2583
jle 0x100076d6
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, esi
mov dword [esp + 0xc], esi
mov ebx, esi
mov dword [esp + 0x14], esi
mov eax, edi
mov dword [esp + 0x18], 0x142b
cdq
idiv ebx
mov ebx, edx
mov edi, esi
mov eax, ebx
lea ecx, [esp + 0x38]
and eax, edi
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000768c
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push esi
push 1
lea ecx, [esp + 0x40]
call fcn.100040fa
inc edi
cmp edi, 0x298d
jl 0x10007672
dec ebx
dec dword [esp + 0x18]
jne 0x10007670
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0xc]
inc ebx
mov dword [esp + 0x14], ebx
cmp ebx, 0x1fed
jl 0x10007661
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x38f8
jl 0x1000765b
mov ebx, 0x1421
cmp dword [esp + 0x10], 0x1fed
jge 0x100076eb
push str.quxouw_olt_mta_svogn_zkr_arpx_tgemh_mbpvi_dxk_sgpxbzvly_joojxklo_esjkyzp
call fcn.10036008
pop ecx
mov dword [esp + 0xa4], esi
mov edi, 0xbc5
push dword [esp + 0x28]
push ebx
push edi
call fcn.10027aff
pop ecx
pop ecx
call eax
push dword [esp + 0x2c]
push ebx
push edi
call fcn.10027aff
pop ecx
pop ecx
call eax
jmp 0x1000771a
push 3
pop esi
lea ecx, [esp + 0x1c]
call fcn.1000b30b
mov ecx, dword [esp + 0x9c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c196
Capabilities:
Resume thread

Disassembly:
push 0
test cl, cl
je 0x1000c1a3
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
ret
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x1000e849
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
je 0x1000e862
cmp byte [ecx], 0
je 0x1000e891
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000e891
push esi
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x1000e88b
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1000e887
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
mov eax, dword [esi]
dec dword [esi]
cmp dword [esi], 0xfffffffa
je 0x1000e86e
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001421f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014254
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10014245
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x10014252
push 0xf95
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x10014286
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 8]
push dword [eax]
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10011cf4
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10015338
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10015399
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001537e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001537c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x10015397
push 0x1e36
push 0x257b
push 0
push 0x8ed
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x100153ab
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 0x14]
call fcn.1001526f
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10016183
Capabilities:
Create process on windows
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bab9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100162dc
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100161e9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x100162da
mov dword [ebp - 0x20], 0x11be
mov dword [ebp - 0x3c], str.qcif_mkdcao_dors
cmp dword [ebp - 0x20], 0x15a1
jle 0x10016288
push 0
push 0
push 0
push 0
push 0x2266
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
and dword [ebp - 0x14], 0
jmp 0x1001622e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4fdd
jge 0x10016288
and dword [ebp - 0x18], 0
jmp 0x10016244
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3a6f
jge 0x10016286
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10003995
push eax
call fcn.10036008
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1000398b
jmp 0x1001623d
jmp 0x10016227
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1196
jge 0x100162a4
push dword [ebp - 0x3c]
call fcn.10036008
pop ecx
jmp 0x100162c0
or dword [ebp - 4], 0xffffffff
jmp 0x100162ca
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10016304
lea eax, [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x100162f6
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x10016304
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100186c4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bb21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1001871d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
push 0x786d
push dword [ebp - 0x2c]
push 1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1001888b
add esp, 0x14
jmp 0x1001887a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10018752
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1001874d
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001887a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], 0x45f7
mov dword [ebp - 0x58], str.ifw_puz_jfya_rbd_ezfhfjjkf_qxrohmhwq_yfmvbpuze_mok
cmp dword [ebp - 0x28], 0x4953
jle 0x10018825
and dword [ebp - 0x20], 0
jmp 0x10018786
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7277
jge 0x10018825
and dword [ebp - 0x18], 0
jmp 0x100187a0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x37f1
jge 0x10018820
and dword [ebp - 0x1c], 0
jmp 0x100187b6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x25b5
jge 0x1001881b
and dword [ebp - 0x24], 0
jmp 0x100187cc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3300
jge 0x10018819
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0x24]
sar eax, cl
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
call fcn.10003995
push eax
call fcn.10036008
pop ecx
lea ecx, [ebp - 0x78]
call fcn.1000398b
jmp 0x100187c5
jmp 0x100187af
jmp 0x10018799
jmp 0x1001877f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.10003c92
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4559
jge 0x10018854
push dword [ebp - 0x58]
call fcn.10036008
pop ecx
jmp 0x10018870
or dword [ebp - 4], 0xffffffff
jmp 0x1001887a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b0ed
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001b115
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x2f2a
push 0
push dword [ebp - 8]
call fcn.1001c3f0
add esp, 0xc
jmp 0x1001b14b
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001b135
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001b14b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10027311
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bd22
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100274ca
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x7b20
mov dword [ebp - 0x2c], str.hdbmnw_zllphxhyw_kattmg_jnv_ufozh_glprrb_pwzsjgwq
cmp dword [ebp - 0x1c], 0x7cd4
jle 0x100273e5
and dword [ebp - 0x14], 0
jmp 0x10027375
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6cc7
jge 0x100273d1
and dword [ebp - 0x18], 0
jmp 0x1002738b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1184
jge 0x100273cf
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10003995
push eax
call fcn.10036008
pop ecx
lea ecx, [ebp - 0x78]
call fcn.1000398b
jmp 0x10027384
jmp 0x1002736e
push 0x167d
push 0
push 0x880
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x77cb
jge 0x10027401
push dword [ebp - 0x2c]
call fcn.10036008
pop ecx
jmp 0x1002741d
or dword [ebp - 4], 0xffffffff
jmp 0x10027427
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100274c0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10027484
mov ecx, dword [ebp - 0x20]
call fcn.1002a9aa
movzx eax, al
test eax, eax
jne 0x100274be
push dword [ebp - 0x54]
mov ecx, dword [ebp - 0x20]
call fcn.1002a96c
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov dword [eax], ecx
push 0x2ef0
push dword [ebp - 0x24]
push 1
push 0x259f
push 0x1179
push 0
push 0x793f
push 0x6f82
call fcn.10027b2c
add esp, 0x20
jmp 0x100274c8
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x100274d2
push 1
call fcn.1001c71d
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bb38
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], cl
test cl, cl
je 0x1002bb69
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002bb71
push 0x2f98
mov dl, 1
push 0
push 0x5904
mov cl, dl
call fcn.1002b74a
add esp, 0xc
jmp 0x1002bb71
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esp, ebp
pop ebp
ret

Function at 0x1002c1f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0xc], 0
je 0x1002c214
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002c226
push 0
push 0x24f0
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
jmp 0x1002c226
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002c226
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x1002c22a
Capabilities:
Get thread local storage value
Query environment variable

Disassembly:
mov eax, 0x1004bdeb
call fcn.1004ae30
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x3ff8
mov eax, ecx
cmp dword [ebp - 0x18], 0x42e7
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
jle 0x1002c292
xor esi, esi
mov dword [ebp - 0x14], esi
mov edi, esi
mov ebx, 0x75a4
xor esi, esi
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10062a18
cdq
push edx
push eax
call fcn.10003a17
inc esi
cmp esi, 0x1fe0
jl 0x1002c260
dec edi
dec ebx
jne 0x1002c25e
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x60a7
jl 0x1002c257
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 8], 0
je 0x1002c2a8
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002c2b8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1002c2b8
cmp byte [eax], 0
je 0x1002c2b8
push 0x240
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3db4
jge 0x1002c2d4
mov edx, str.qrmaipkkd_tmzsz_wizoudmzo
mov ecx, 0x10062a18
call fcn.10006198
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret