joyce8/EMBER2024-capa huggingface dataset:
Function at 0x205080
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xe
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x2050ad
je 0x2050a9
shr esi, 1
jae 0x2050ce
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.002045a8
jmp 0x20508c
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x2050df
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00203715
pop ebx
jae 0x20508c
pop esi
pop edx
pop eax
jmp fcn.00202d95
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x20508c
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x20508c
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x20508c

Function at 0x205183
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x2051a3
and esi, 0xfffffffe
jne 0x2051ad
xchg dword [ebx], esi
call fcn.002045a8
pop edi
pop esi
ret
call fcn.002045d0
mov edi, dword [ebx]
or edi, edi
je 0x2051bd
cmp ecx, dword [edi - 4]
je 0x2051dd
call fcn.00204574
jb 0x2051ed
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.002045a8
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.002045a8
pop edi
pop esi
jmp fcn.00202d95

Function at 0x2055e8
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.002045d0
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.002045d0
jecxz 0x20565e
test ebx, ebx
je 0x205666
add ebx, ecx
xchg ecx, ebx
call fcn.00204574
jb 0x205673
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.002045a8
mov esi, dword [ebp + edi - 0x6c]
call fcn.002045a8
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00202d95

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404730
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x14]
lea ebp, [eax - 0x2794]
push edi
lea edi, [eax - 0x11]
add esi, 0xffffde9e
mov eax, ebp
mov dword [esp + 0x10], esi
add ebx, 0xffffde62
xor eax, 0x2783
cmp esi, eax
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0x1c]
jge 0x40485e
mov eax, ebp
xor eax, 0x26ab
cmp ebp, eax
jg 0x40479a
mov eax, dword [esi + 0xc]
xor ebx, 0x288f
sub eax, dword [esi + 0xc8]
add eax, 0x1e2022
mov dword [esp + 0x2c], ebx
xor dword [0x7a1418], eax
mov eax, dword [esp + 0x24]
add eax, 0x246
cmp edi, eax
jge 0x40485e
mov ecx, dword [0x7a1444]
mov eax, dword [ecx + 0xc4]
or eax, edi
cmp dword [0x7a1394], eax
jne 0x40485e
mov eax, dword [ecx + 0x34]
add eax, dword [esi + 4]
xor eax, dword [esi + 0xa8]
mov edx, dword [ecx + 4]
cmp edx, eax
ja 0x40485e
mov ebx, edx
mov edx, dword [esi + 0xa8]
mov eax, dword [ecx + 0x10]
and eax, 0x1fb4
or eax, ebp
push ecx
push eax
mov eax, dword [ecx + 0x114]
and eax, 0x500
or eax, 0x207d
push eax
mov eax, dword [ecx + 0x48]
and eax, edx
or eax, edi
push eax
mov eax, dword [esi + 0xc8]
imul eax, dword [0x7a1390]
or eax, dword [0x7a1410]
push eax
mov eax, dword [esi + 0xc4]
xor eax, 0x2020
or eax, 0x1dd7
push eax
mov eax, dword [esi + 0x3c]
add eax, 0x219e
push eax
call fcn.00405df9
mov ecx, dword [0x7a1444]
add ebx, 2
mov edx, dword [esi + 0xa8]
add esp, 0x1c
mov eax, dword [ecx + 0x34]
add eax, dword [esi + 4]
xor eax, edx
cmp ebx, eax
jbe 0x4047e4
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
add eax, 0x23d7
cmp edi, eax
jl 0x404898
mov eax, dword [esi]
cmp eax, dword [esi + 0x74]
jb 0x404882
mov eax, dword [esi + 0x48]
add eax, 0x160147
or dword [0x7a137c], eax
jmp 0x404898
mov eax, dword [0x7a13a4]
add eax, dword [0x7a13c4]
xor eax, dword [0x7a1404]
mov dword [0x7a1324], eax
pop edi
pop esi
pop ebp
lea eax, [ebx + 0xe2]
pop ebx
pop ecx
ret
Function at 0x40698f
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
add eax, 0x381
push esi
mov esi, dword [esp + 0xc]
xor eax, 0x3934
add esi, 0xffffd980
lea edx, [ecx + 0x10c]
push edi
lea edi, [ecx - 0x23d7]
cmp esi, eax
je 0x406a7c
lea eax, [edi + 0x2054]
xor ecx, 0x3aa
cmp ecx, eax
je 0x406a44
mov ecx, dword [0x7a1444]
add edx, 0xffffff80
mov edi, dword [esp + 0x14]
mov eax, dword [ecx + 0xf0]
xor eax, dword [edi + 0xc4]
xor eax, 0x9bc6d3b3
sub dword [ecx + 0xf8], eax
mov ecx, dword [0x7a1444]
mov esi, dword [ecx + 0x4c]
cmp esi, dword [0x7a1370]
ja 0x406a7c
mov eax, esi
imul eax, esi
add dword [ecx + 0xf8], eax
mov eax, dword [0x7a13e8]
add eax, 0xffe7d02f
add dword [edi + 0x9c], eax
mov eax, dword [0x7a1424]
add eax, 0xfff607f9
add eax, dword [edi + 0x5c]
inc esi
mov dword [0x7a1424], eax
cmp esi, dword [0x7a1370]
ja 0x406a7c
mov ecx, dword [0x7a1444]
jmp 0x406a06
mov eax, esi
sub eax, edi
push ebx
mov ebx, esi
cmp esi, eax
jge 0x406a7b
mov ecx, dword [0x7a1444]
add ebx, 2
mov eax, dword [0x7a13c8]
xor eax, esi
imul eax, dword [ecx + 0x78]
mov dword [ecx + 0x78], eax
mov ecx, esi
mov eax, dword [0x7a13d4]
xor eax, 0x257d
imul edi, eax
sub ecx, edi
cmp ebx, ecx
jl 0x406a4f
pop ebx
xor edx, 0x3bd7
pop edi
mov eax, edx
pop esi
ret

Function at 0x406a87
Capabilities:
Connect pipe

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
lea eax, [edx + 0x194]
add ebx, 0xfffffa1b
lea esi, [ecx + 0x56]
add edi, 0xffffd771
mov dword [esp + 0x18], esi
lea ebp, [ecx - 0x2148]
cmp ebx, eax
jle 0x406b17
mov edx, dword [esp + 0x14]
mov eax, dword [0x7a13cc]
add eax, 0x12e1e
add eax, dword [edx + 0xc]
mov dword [edx + 0x4c], eax
mov eax, dword [edx + 0x78]
cmp eax, dword [0x7a13dc]
jbe 0x406ae4
mov dword [edx + 0x50], 0x463abcad
mov ecx, dword [0x7a1354]
add ecx, dword [0x7a1344]
mov eax, dword [0x7a1444]
xor ecx, 0xca239
mov dword [eax + 0xf8], ecx
mov eax, dword [edx + 0x64]
add eax, 0x7f45
xor dword [0x7a1418], eax
add edi, 0x229d
jmp 0x406b84
mov eax, dword [0x7a1444]
mov eax, dword [eax + 0x2c]
xor eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, edx
push eax
lea eax, [ecx + 0x1f1b]
push eax
call esi
mov eax, dword [0x7a1444]
mov eax, dword [eax + 0x48]
or eax, dword [esp + 0x18]
add eax, 0x1dd7
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x118]
and ecx, dword [eax + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
imul eax, ebp, 0x288f
and ebx, ebp
push eax
push ebx
call esi
mov edx, dword [0x7a1444]
imul ecx, dword [edx + 0x114], 0x2783
or ecx, dword [edx + 0x100]
sub dword [edx + 0xa0], ecx
xor edi, 0x3d6c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x445ec8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x445ed0
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4460b9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push esi
call sub.kernel32.dll_GlobalFindAtomA
mov word [0x51af52], ax
cmp word [0x51af52], 0
jne 0x446080
invalid
in al, 0xcb

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4049be
Capabilities:
Initialize winhttp library
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0x42b618
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x280a7
jne 0x4049fd
xor esi, esi
cmp dword [0x90a36c], 0xc8b
jne 0x4049f1
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push esi
call fcn.00404fef
pop ecx
call fcn.0040505d
push 0x90a370
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
cmp eax, 0x35d85
jne 0x404a34
cmp dword [0x90a36c], 0xa95
jne 0x404a27
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 0x242
push esi
call fcn.00404e12
pop ecx
pop ecx
mov eax, dword [0x42abb8]
mov dword [0x90a36c], eax
call fcn.00404988
xor edi, edi
cmp edi, 0x656289
jne 0x404a57
call fcn.00404968
mov dword [0x90a358], eax
inc edi
cmp edi, 0x66d056
jl 0x404a45
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp edi, 0x85b4
jge 0x404a80
push esi
push esi
call dword [sym.imp.USER32.dll_EndPaint]
push esi
push esi
call dword [sym.imp.USER32.dll_GetAncestor]
cmp edi, 0x8baca92
jg 0x404a9a
inc edi
mov eax, edi
cdq
cmp edx, 1
jl 0x404a62
jg 0x404a9a
cmp eax, 0x54ca73e6
jb 0x404a62
push dword [0x90a36c]
mov eax, dword [0x426ee8]
push esi
mov dword [0x9784c4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
mov dword [0x8e73f8], eax
cmp dword [0x90a36c], esi
jbe 0x404ace
call fcn.00404943
inc ecx
cmp ecx, dword [0x90a36c]
jb 0x404ac0
xor edi, edi
cmp edi, 0x1095b
jne 0x404afc
mov dword [ebp - 8], 0x20
add dword [ebp - 8], 0x20
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [0x90a36c]
push dword [0x8e73f8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
cmp edi, 0x2846a
jl 0x404ad0
call fcn.004048b1
xor edi, edi
mov eax, dword [0x90a36c]
add eax, edi
cmp eax, 0x5e
jne 0x404b22
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
inc edi
cmp edi, 0x57ffb
jl 0x404b0c
xor edi, edi
cmp dword [0x90a36c], 0x23
jne 0x404b4b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp edi, 0x156cae
jne 0x404b58
call fcn.00404993
inc edi
cmp edi, 0x7b
jl 0x404b2d
pop edi
pop esi
leave
ret

Function at 0x405e44
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4260c8]
jne 0x405e4e
repz ret
jmp fcn.00408ba3
Function at 0x4087b1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406ad8
and dword [ebp - 4], 0
cmp dword [0x42b1c4], 0
mov ebx, eax
jne 0x408862
push 0x4019d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408913
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019c8
push edi
call esi
test eax, eax
je 0x408913
push eax
call fcn.00406a66
mov dword [esp], 0x4019b8
push edi
mov dword [0x42b1c4], eax
call esi
push eax
call fcn.00406a66
mov dword [esp], 0x4019a4
push edi
mov dword [0x42b1c8], eax
call esi
push eax
call fcn.00406a66
mov dword [esp], 0x401988
push edi
mov dword [0x42b1cc], eax
call esi
push eax
call fcn.00406a66
pop ecx
mov dword [0x42b1d4], eax
test eax, eax
je 0x408862
push 0x401970
push edi
call esi
push eax
call fcn.00406a66
pop ecx
mov dword [0x42b1d0], eax
mov eax, dword [0x42b1d0]
cmp eax, ebx
je 0x4088ba
cmp dword [0x42b1d4], ebx
je 0x4088ba
push eax
call fcn.00406ae1
push dword [0x42b1d4]
mov esi, eax
call fcn.00406ae1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4088ba
test edi, edi
je 0x4088ba
call esi
test eax, eax
je 0x4088b1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4088b1
test byte [ebp - 0xc], 1
jne 0x4088ba
or dword [ebp + 0x10], 0x200000
jmp 0x4088f3
mov eax, dword [0x42b1c8]
cmp eax, ebx
je 0x4088f3
push eax
call fcn.00406ae1
pop ecx
test eax, eax
je 0x4088f3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4088f3
mov eax, dword [0x42b1cc]
cmp eax, ebx
je 0x4088f3
push eax
call fcn.00406ae1
pop ecx
test eax, eax
je 0x4088f3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42b1c4]
call fcn.00406ae1
pop ecx
test eax, eax
je 0x408913
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408915
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1003096
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
lea eax, [eax + esi*4 - 4]
mov ecx, 0xff
je 0x10030ef
push ebx
push edi
mov edi, edx
shr edi, 0x10
and edi, ecx
mov edi, dword [edi*4 + 0x102a098]
movzx ebx, dh
xor edi, dword [ebx*4 + 0x102a498]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x1029898]
and edx, ecx
xor edi, dword [edx*4 + 0x1029c98]
xor edi, dword [eax]
dec esi
sub eax, 4
test esi, esi
mov edx, edi
jne 0x10030b4
pop edi
pop ebx
mov eax, edx
shr eax, 0x10
and eax, ecx
mov eax, dword [eax*4 + 0x102a098]
movzx esi, dh
xor eax, dword [esi*4 + 0x102a498]
mov esi, edx
shr esi, 0x18
xor eax, dword [esi*4 + 0x1029898]
mov esi, edx
and esi, ecx
xor eax, dword [esi*4 + 0x1029c98]
pop esi
xor eax, edx
pop ebp
ret 0xc
Function at 0x10047b6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, dword [esi + 8]
shl eax, 2
mov ebx, dword [eax + 0x1029884]
mov edi, dword [eax + 0x10028b4]
mov dword [ebp - 0xc], ecx
sub ecx, dword [esi + 0xc]
cmp ebx, edi
jae 0x10047f8
test ebx, ebx
jbe 0x10047f8
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0xc]
sub edi, eax
mov ebx, edi
mov eax, dword [esi + 8]
cmp ecx, dword [eax*4 + 0x10028b4]
jae 0x100ef54
mov eax, dword [esi + 8]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx*4 + 0x1029884]
lea eax, [eax*4 + 0x10028b4]
cmp ecx, dword [eax]
jae 0x100ef54
pop edi
mov byte [esi + 0x14], 0
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp eax, 0xffffffff
mov edi, ebx
mov dword [ebp - 4], ecx
jne 0x1015311
cmp dword [esi + 0x20], ecx
je 0x100f139
mov eax, dword [esi + 0x20]
test eax, eax
je 0x100ef87
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x18], eax
test ebx, ebx
je 0x1004824
mov ebx, 0x100f088
mov ecx, esi
call fcn.0100f0ad
test al, al
jne 0x1004824
push 0x100f098
push dword [0x102b8bc]
push dword [0x102b8b8]
call dword [0x102b8b4]
test al, al
jne 0x1015328
push 0x4ff
push edi
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push dword [0x102b8bc]
mov edi, eax
push dword [0x102b8b8]
call dword [0x102b8b4]
test al, al
jne 0x1015349
mov eax, dword [esi + 8]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx*4 + 0x1029884]
lea eax, [eax*4 + 0x10028b4]
cmp ecx, dword [eax]
mov eax, dword [esi + 8]
jae 0x1015368
sub edi, dword [esi + 0xc]
shl eax, 2
mov edx, dword [eax + 0x1029884]
test edx, edx
mov dword [ebp - 0x10], edi
je 0x100f151
mov ecx, dword [eax + 0x10028b4]
mov eax, ecx
sub eax, edx
xor edx, edx
div dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp edi, eax
jae 0x1004824
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp eax, 0x102
je 0x100f078
cmp dword [ebp - 4], eax
jbe 0x100f158
mov ecx, dword [ebp + 8]
cmp dword [ebp + eax*4 - 0x18], ecx
je 0x1004824
test edi, edi
jne 0x100ef94
jmp 0x1004824
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
lea ecx, [esi + 0x1c]
call fcn.0100187b
jmp 0x100ef76
xor ecx, ecx
jmp 0x100f044
je 0x100f078
jmp 0x1004824
cmp eax, ecx
je 0x100ef6d
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
jmp 0x100ef6d
push edi
push 0x1015374
push 0x100f098
push dword [0x102b8bc]
push dword [0x102b8b8]
call fcn.0102250a
jmp 0x100efc2
push dword [ebp - 0xc]
push 0x1015374
push ebx
push dword [0x102b8bc]
push dword [0x102b8b8]
call fcn.0102250a
jmp 0x100effd
mov edi, dword [eax*4 + 0x1029884]
jmp 0x100f058
Function at 0x1007469
Capabilities:
Read file via mapping

Disassembly:
push 0xc
mov eax, 0x1023655
call fcn.0100165a
push 0x10000
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x14], esi
je 0x1010f8b
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, eax
cmp edi, ebx
jl 0x1010fa8
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 4
push ebx
push ebx
push 4
push dword [0x102b8c8]
call edi
cmp eax, ebx
je 0x1010fc7
mov ebx, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push eax
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
je 0x1010feb
lea eax, [ebx + 4]
cmp eax, 0x10000
ja 0x1011008
push eax
push 0
push 0
push 4
push dword [0x102b8c8]
call edi
mov edi, eax
test edi, edi
je 0x1010feb
push dword [ebp - 0x14]
lea ebx, [edi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x1011023
push dword [ebp - 0x18]
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x1007545
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x1011028
push dword [ebp + 8]
push 0x1007574
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoUnmarshalInterface]
or dword [ebp - 4], 0xffffffff
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1007569
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.01001641
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100756b
and eax, 0xffff
or eax, 0x80070000
jmp 0x100756b
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x1010fc0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x100756b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1010fdb
and eax, 0xffff
or eax, 0x80070000
or dword [ebp - 4], 0xffffffff
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jmp 0x1007561
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007556
and eax, 0xffff
or eax, 0x80070000
jmp 0x1007556
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1011019
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x800700a0
jmp 0x100756b
push edi
call esi
jmp 0x1010feb
call esi
jmp 0x1007556
Function at 0x1007852
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
xor eax, eax
jmp 0x1007927
push 0x260
mov eax, 0x10259f5
call fcn.01002df2
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
push 0
mov edi, ecx
mov dword [ebp - 0x228], eax
call esi
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x100792f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x220]
push ecx
push 0
lea ecx, [ebp - 0x224]
push ecx
push 0
push ebx
push eax
call esi
test eax, eax
jne 0x100a04c
cmp dword [ebp - 0x224], 1
jne 0x100b5a6
and dword [ebp - 4], 0
cmp dword [ebp - 0x224], 2
je 0x100b5c5
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x228]
shr eax, 1
push eax
call fcn.01002db2
lea ecx, [ebp - 0x220]
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push dword [edi + 0x9c]
call esi
mov edi, eax
test edi, edi
jne 0x1014578
or dword [ebp - 4], 0xffffffff
shr dword [ebp - 0x220], 1
mov ecx, dword [ebp - 0x228]
je 0x100a058
mov eax, dword [ebp - 0x220]
dec eax
push eax
call fcn.01005065
xor eax, eax
inc eax
call fcn.01002e32
ret 8
push 6
call esi
jmp 0x1007846
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1007846
push 0
jmp 0x100791f
cmp dword [ebp - 0x224], 7
je 0x10078b8
cmp dword [ebp - 0x224], 2
je 0x10078b8
jmp 0x100a04c
cmp dword [ebp - 0x220], 0x208
jae 0x1014522
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push dword [edi + 0x9c]
call esi
mov ecx, dword [ebp - 0x228]
mov esi, 0x104
push esi
mov edi, eax
call fcn.01002db2
push esi
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [eax - 1]
cmp ecx, 0x102
mov dword [ebp - 0x220], eax
ja 0x101454f
add eax, eax
mov dword [ebp - 0x220], eax
jmp 0x10078f9
push 0x80010135
lea ecx, [ebp - 0x23c]
call fcn.01019efc
mov esi, eax
lea edi, [ebp - 0x24c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1026770
lea eax, [ebp - 0x24c]
push eax
call sub.msvcrt.dll__CxxThrowException
push 0x80010135
lea ecx, [ebp - 0x23c]
call fcn.01019efc
mov esi, eax
lea edi, [ebp - 0x25c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1026770
lea eax, [ebp - 0x25c]
jmp 0x1014549
jle 0x1014586
and edi, 0xffff
or edi, 0x80070000
push edi
lea ecx, [ebp - 0x23c]
call fcn.01019efc
mov esi, eax
lea edi, [ebp - 0x26c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1026770
lea eax, [ebp - 0x26c]
jmp 0x1014549