joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
mov ebx, edx
lea edx, [ebp - 0x22a]
mov eax, ebx
sub esp, 0x23c
mov word [ebp - 0x21a], cx
mov dword [ebp - 0x22a], 0x790074
mov dword [ebp - 0x226], 0x650070
mov dword [ebp - 0x222], 0x650064
mov dword [ebp - 0x21e], 0x200066
mov dword [ebp - 0x238], 0x750070
mov dword [ebp - 0x234], 0x6c0062
mov dword [ebp - 0x230], 0x630069
mov word [ebp - 0x22c], di
call sym._AddToTLDataStrW
mov eax, dword [0x411c58]
cmp dword [esi], eax
je 0x405af8
mov edx, 0x40f190
mov eax, ebx
lea edi, [ebp - 0x218]
call sym._AddToTLDataStrW
mov edx, str.uuid
mov eax, ebx
call sym._AddToTLDataStrW
mov edx, 0x40f194
mov eax, ebx
call sym._AddToTLDataStrW
mov dword [esp + 8], 0x100
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
sub esp, 0xc
cmp word [ebp - 0x218], 0
je 0x405b60
mov eax, edi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405aa8
sub eax, edi
sar eax, 1
dec eax
xor edx, edx
mov word [ebp + eax*2 - 0x218], dx
lea edx, [ebp - 0x216]
mov eax, ebx
call sym._AddToTLDataStrW
mov edx, 0x40f198
mov eax, ebx
call sym._AddToTLDataStrW
cmp dword [esi + 0x28], 6
je 0x405b40
mov edx, 0x40f1a2
mov eax, ebx
call sym._AddToTLDataStrW
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x411c5c]
cmp dword [esi + 4], eax
jne 0x405a52
mov eax, dword [0x411c60]
cmp dword [esi + 8], eax
jne 0x405a52
mov eax, dword [0x411c64]
cmp dword [esi + 0xc], eax
jne 0x405a52
cmp dword [esi + 0x28], 6
jne 0x405aeb
mov edx, 0x40f190
mov eax, ebx
call sym._AddToTLDataStrW
jmp 0x405b4c
mov edx, 0x40f19c
mov eax, ebx
call sym._AddToTLDataStrW
lea edx, [ebp - 0x238]
mov eax, ebx
call sym._AddToTLDataStrW
jmp 0x405adf
mov eax, 0xffffffff
jmp 0x405ab6
Function at 0x405b70
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov edx, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
cmp eax, 5
je 0x405bd0
cmp eax, 0x4e
je 0x405d28
cmp eax, 1
je 0x405c88
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.user32.dll_DefWindowProcW]
sub esp, 0x10
mov ebx, eax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [0x40e308]
movzx esi, bx
mov edi, dword [sym.imp.user32.dll_MoveWindow]
shr ebx, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x28
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
lea eax, [ebx - 0x2b]
sub ebx, 0x57
sub esp, 0x18
mov dword [esp + 0x10], eax
lea eax, [esi - 6]
sub esi, 0x1a
mov dword [esp + 0xc], eax
mov eax, dword [0x40e30c]
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0x28
mov dword [esp + 4], 3
mov dword [esp], eax
call edi
mov eax, dword [0x40e310]
sub esp, 0x18
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0x22
mov dword [esp + 4], 0xa
mov dword [esp], eax
call edi
mov eax, ebx
sub esp, 0x18
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
xor eax, eax
mov dword [ebp - 0x26], 0x740053
xor ebx, ebx
mov word [ebp - 0x1a], ax
mov eax, dword [0x40e33c]
mov dword [ebp - 0x22], 0x740061
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x26]
mov dword [ebp - 0x1e], 0x630069
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.user32.dll_CreateWindowExW]
mov dword [0x40e308], eax
sub esp, 0x30
mov eax, esi
call sym._CreateTabCtrl
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp edx, 0x7d2
je 0x405d48
lea esp, [ebp - 0x10]
xor ebx, ebx
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp dword [ebx + 8], 0xfffffdd9
jne 0x405d30
mov eax, dword [0x40e310]
mov dword [esp + 4], 0
mov esi, dword [sym.imp.user32.dll_ShowWindow]
mov dword [esp], eax
call esi
mov eax, dword [0x40e30c]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x130b
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
mov ebx, eax
test eax, eax
jne 0x405d30
mov eax, dword [0x40e310]
mov dword [esp + 4], 5
mov dword [esp], eax
call esi
sub esp, 8
jmp 0x405bc0
Function at 0x4074c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ecx, 0x32
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x4e0]
mov esi, 0x40e0c0
push ebx
mov ebx, eax
sub esp, 0x52c
mov dword [ebp - 0x4f0], edx
mov edx, dword [sym.imp.user32.dll_LoadStringW]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x418]
mov dword [esp], eax
lea edi, [ebp - 0x218]
mov dword [ebp - 0x4ec], edx
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], esi
mov dword [esp + 4], 1
call edx
mov edx, dword [ebp - 0x4ec]
sub esp, 0x10
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], edi
mov dword [esp + 4], 2
mov dword [esp], ebx
call edx
sub esp, 0x10
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.user32.dll_CreateWindowExW]
sub esp, 0x30
test eax, eax
je 0x4076f8
mov esi, eax
mov dword [esp + 4], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp], 0x50000000
call dword [sym.imp.comctl32.dll_CreateStatusWindowW]
lea ecx, [ebp - 0x4e0]
sub esp, 0x10
mov dword [0x40e328], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ebx
mov dword [esp], esi
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x1c], 0xa
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x50000000
call sym._CreateToolbarEx_52
mov edi, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x34
mov dword [0x40e32c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6f
mov dword [esp + 4], 0x401
mov dword [esp], eax
call edi
mov eax, dword [0x40e32c]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x71
mov dword [esp + 4], 0x401
mov dword [esp], eax
call edi
mov eax, dword [0x40e32c]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x74
mov dword [esp + 4], 0x401
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x4f0]
mov dword [0x40e320], esi
sub esp, 0x10
mov dword [0x40e33c], ebx
mov dword [esp], esi
mov dword [0x40e340], 1
mov dword [0x40e344], 5
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
mov dword [esp], esi
call dword [sym.imp.user32.dll_UpdateWindow]
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407710
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, dword fs:[0x18]
sub esp, 0x1c
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], 0x210
mov dword [esp + 4], 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor edx, edx
mov word [eax], dx
sub esp, 0xc
mov dword [ebx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40c360
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x4c
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
cmp eax, 5
je 0x40c3c0
cmp eax, 0x4e
je 0x40c4b0
cmp eax, 1
je 0x40c410
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.user32.dll_DefWindowProcW]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, esi
movzx esi, si
mov dword [esp + 0x14], 1
shr eax, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov eax, dword [0x40e330]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_MoveWindow]
xor eax, eax
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [0x40e33c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0x7d1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50000007
mov dword [esp + 8], 0
mov dword [esp + 4], str.SysTreeView32
mov dword [esp], 0
call dword [sym.imp.user32.dll_CreateWindowExW]
sub esp, 0x30
mov dword [0x40e330], eax
call sym._AddBaseEntries
call sym._AddComponentCategories
call sym._AddCOMandAll
call sym._AddApplicationID
call sym._AddTypeLib
call sym._AddInterfaces
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
xor eax, eax
cmp ebx, 0x7d1
jne 0x40c3a9
mov edx, dword [esi + 8]
cmp edx, 0xfffffe3a
je 0x40c548
cmp edx, 0xfffffe3d
je 0x40c520
cmp edx, 0xfffffe36
jne 0x40c3a9
mov eax, dword [esi + 0x34]
test eax, eax
je 0x40c3a9
mov edx, dword [eax + 0x604]
test edx, edx
jne 0x40c566
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
jmp 0x40c3a9
mov edx, dword [esi + 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
call sym._RefreshMenu
mov edx, dword [esi + 0x3c]
mov dword [esp], edx
call sym._RefreshDetails
mov eax, dword [ebp - 0x1c]
jmp 0x40c3a9
mov dword [esp + 4], 0
mov edx, dword [esi + 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
call sym._CreateInst
mov eax, dword [ebp - 0x1c]
jmp 0x40c3a9
mov edx, dword [esi + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [esp], edx
call sym._ReleaseInst
mov eax, dword [ebp - 0x1c]
jmp 0x40c4f2
Function at 0x40d9a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40d9fb
cmp byte [esi + ebx - 1], 0xa
je 0x40d9cf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40e5f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40dac0
Capabilities:
Access peb ldr_data
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop

Function at 0x40dc40
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40dccd
cmp al, 9
je 0x40dcc0
cmp al, 0x20
je 0x40dcc0
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x40dd28
cmp al, 0x22
je 0x40dd30
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x40dccd
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x40dc80
test edi, 1
jne 0x40dc80
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x40dcc0
cmp al, 0x20
je 0x40dcc0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x40dce8
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x40dc97
and dword [ebp - 0x6c], 1
jne 0x40dc90
xor edi, 1
jmp 0x40dc97
Function at 0x10006ae2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10006af1
pop dword [ebp - 0x44]
mov eax, 0x10006af1
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x50d4df58
add dword [ebp - 0x54], 0xfd7d65f3
mov dword [ebp - 0x50], 0xbdfeaedf
add dword [ebp - 0x50], 0x74349d66
mov dword [ebp - 0x4c], 0xe991617e
sub dword [ebp - 0x4c], 0x9d451d50
mov dword [ebp - 0x48], 0xfdab396a
add dword [ebp - 0x48], 0x254c696
lea eax, [ebp - 0x54]
push eax
mov eax, 0xa6740eb8
add eax, 0x698ca1e8
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xe9597319
sub dword [ebp - 0x54], 0x74e709c3
mov dword [ebp - 0x50], 0xd97d9652
sub dword [ebp - 0x50], 0x981134dd
mov dword [ebp - 0x4c], 0x85526684
add dword [ebp - 0x4c], 0xde1d05e8
mov dword [ebp - 0x48], 0x8b9721a
sub dword [ebp - 0x48], 0x8b9721a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3896c
push 0
call eax
mov ecx, 0x4c81
xor edi, edi
add edi, eax
mov ebx, 0x2d5d5a6b
sub ebx, 0x1d58e26b
add ebx, dword [ebp - 0x44]
mov esi, 0xf53d11
add esi, 0xf8142b32
xor dword [ebp - 0x38], esi
mov edx, dword [ebx]
xor dword [ebp - 4], esi
xor edx, esi
xor dword [ebp - 0x3c], ecx
mov dword [edi], edx
xor dword [ebp - 8], 0x2dd34f4c
add edi, 0xf92ab9f3
sub edi, 0xf92ab9ef
add ebx, 4
loop 0x10006c05
add eax, 0x124d7
mov ebx, eax
add eax, 0xca40f89c
add eax, 0x35bf0769
mov ecx, 0xd4fce30a
sub ecx, 0xc4fce30a
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10003ebd
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov esi, ecx
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
je 0x10003fbd
cmp dword [eax + 8], ebx
je 0x10003fbd
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb edi, edi
neg edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.1001fbc4
test eax, eax
jne 0x10003f1b
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003ee7
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003ee7
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10003f62
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x10003f62
cmp dword [esi + 0x2c], ebx
jne 0x10003f62
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 8], ebx
cmp edi, ebx
je 0x10003fbd
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003fbd
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003f73
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 8]
push 0x3e8
push edi
mov dword [eax + 8], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003faf
mov dword [esi + 0x20], ebx
jmp 0x10003fbd
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.10023451
ret

Function at 0x10004070
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov ebx, ecx
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1001fbc4
test eax, eax
jne 0x100040b5
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004084
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10004084
mov ecx, dword [ebx + 0x24]
xor eax, eax
cmp dword [ebp + 8], eax
sete al
inc eax
mov dword [ecx + 0x18], eax
mov edi, dword [ebx + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100040f1
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100040f1
mov ecx, ebx
call fcn.10003ebd
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004102
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10023451
ret 4
Function at 0x1001cacd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
mov eax, 0x10025ac4
call fcn.100233e2
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
mov eax, edi
call fcn.1001fbc4
pop ecx
test eax, eax
jne 0x1001cba6
mov eax, dword [edi + 4]
mov dword [ebp - 0x5c], eax
inc dword [eax + 0x38]
mov dword [ebp - 0x58], edi
inc dword [edi + 0x14]
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x54], eax
xor eax, eax
mov word [ebp - 0x4c], ax
mov word [ebp - 0x3c], ax
push 4
add edi, 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], edi
pop edi
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x52535048
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], ebx
call fcn.1001fbc4
mov dword [ebp - 0x24], eax
xor eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 8
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x54]
push edi
push eax
mov dword [ebp - 0x20], 0x55524544
call fcn.1001fbc4
or dword [ebp - 4], 0xffffffff
add esp, 0x18
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.1001bc6e
mov eax, esi
call fcn.10023465
ret
Function at 0x1001e1a1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10025ae9
call fcn.100233ac
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebx], esi
call edi
test eax, eax
jne 0x1001e2e2
cmp dword [ebp - 0x1c], 1
jne 0x1001e2e2
mov eax, dword [ebp - 0x14]
shr eax, 1
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
mov dword [ebp - 4], esi
neg ecx
or ecx, eax
push ecx
call fcn.1001fbc4
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x1001e2d4
push dword [ebp - 0x14]
push esi
push eax
call fcn.1001fbc4
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1001e2d4
cmp dword [ebp - 0x1c], 1
jne 0x1001e2d4
shr dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001fbc4
pop ecx
mov dword [ebx], eax
cmp eax, esi
je 0x1001e2d4
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push esi
push eax
call fcn.1001fbc4
lea eax, [ebp - 0x20]
push eax
push 0x1002ac24
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_wcstok_s]
mov edi, eax
add esp, 0x18
cmp edi, esi
je 0x1001e2ba
push edi
call fcn.1001fbc4
pop ecx
test al, al
je 0x1001e2ba
mov eax, dword [ebp - 0x14]
push edi
inc eax
push eax
push dword [ebx]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x1001e2d4
push dword [ebx]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [ebx], esi
jmp 0x1001e2d4
cmp dword [ebp - 0x18], esi
je 0x1001e2e2
push dword [ebp - 0x18]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10023451
ret