joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100087b0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x358
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x162]
mov word [esp + 0x160], bp
mov esi, dword [esp + 0x36c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x160]
push 0x103
push eax
push esi
mov dword [esp + 0x20], 2
mov dword [0x10232184], ebp
call dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [esp + 0x160]
push str.Qt5152QWindowIcon
push ecx
call fcn.100ea1af
add esp, 8
test eax, eax
jne 0x100089a4
lea edx, [esp + 0xbc]
mov ecx, 0x28
lea edi, [esp + 0xbe]
push 0x50
mov word [esp + 0xc0], bp
push edx
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0xbc]
push 0x101edf6c
push eax
call fcn.100e9f49
add esp, 8
cmp eax, ebp
je 0x100089b3
push eax
call fcn.100e9a88
push 0x101edf6c
mov edi, eax
call fcn.100e9a88
add esp, 8
cmp edi, eax
jne 0x100089b3
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push esi
mov dword [esp + 0x18], ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x10008968
push 2
push esi
call edi
cmp eax, ebp
je 0x100088a1
mov esi, eax
xor ebx, ebx
push 5
push esi
call edi
mov esi, eax
cmp esi, ebp
je 0x10008968
inc ebx
cmp ebx, 3
jl 0x100088a3
cmp esi, ebp
je 0x10008968
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push 0x50
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea edx, [esp + 0x18]
push edx
call fcn.100e9a88
push eax
lea eax, [esp + 0x20]
push str.Chrome_RenderWidgetHostHWND
push eax
call fcn.100ea081
add esp, 0x10
test eax, eax
jne 0x10008947
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call ebx
cmp dword [esp + 0x10], eax
je 0x10008930
call ebx
cmp dword [esp + 0x370], eax
jne 0x100089b3
mov edx, dword [esp + 0x374]
mov dword [esp + 0x10], 1
mov dword [edx], edi
mov dword [0x10232184], esi
push str.AliWorkbench.exe
call fcn.100e9a88
push eax
push str.AliWorkbench.exe
push 0x102320dc
call fcn.100ea081
add esp, 0x10
test eax, eax
je 0x100089b3
cmp dword [0x102acd68], ebp
je 0x10008996
mov eax, dword [esp + 0x370]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.IMEnumWndProc_IM_QN_4_ret:__d__hwndPID:__d_
push 0x101edf20
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x18
cmp dword [esp + 0x10], ebp
je 0x100089a4
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x358
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x358
ret
Function at 0x1000c180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101a6478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call fcn.10197149
mov eax, dword [esp + 0x2c]
push 0
push 0x3001
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.101972fb
test eax, eax
je 0x1000c279
lea ecx, [esp + 0xc]
call fcn.101975f5
cmp eax, 0xa00000
jb 0x1000c1e6
push 0
lea ecx, [esp + 0x10]
call fcn.101975c9
mov ecx, dword [0x1021a2a0]
mov dword [esp], ecx
lea edx, [esp + 4]
mov byte [esp + 0x24], 3
push edx
call fcn.10143e00
lea eax, [esp + 8]
push str._Y__m__d__H:_M:_S
push eax
lea ecx, [esp + 0xc]
call fcn.101443b0
mov ecx, dword [esp + 0x30]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 8]
push str._s__s_r_n
push eax
mov byte [esp + 0x34], 4
call fcn.1019420f
add esp, 0x10
lea ecx, [esp + 8]
mov byte [esp + 0x24], 3
call fcn.10196a35
mov edx, dword [esp + 0xc]
push 2
push 0
lea ecx, [esp + 0x14]
call dword [edx + 0x28]
mov eax, dword [esp]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.10197452
lea ecx, [esp + 0xc]
call fcn.10197516
lea ecx, [esp]
mov byte [esp + 0x24], 2
call fcn.10196a35
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.1019723e
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 0
call fcn.10196a35
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.10196a35
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x1000d570
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1000d73e
mov eax, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x7530
push 1
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000d5c8
call ebx
mov ecx, dword [esi + 0x5c]
push eax
push edi
push ecx
push str.CDealDlg::SetTimer__ID_TIMER_ALL__IMType__0x_x__Return:_0x_x__Error:_0x_x_
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
mov edx, dword [esi + 0x1c]
push 0
push 0x3e8
push 0xa
push edx
call ebp
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000d603
call ebx
push eax
mov eax, dword [esi + 0x5c]
push edi
push eax
push str.CDealDlg::SetTimer__ID_TIMER_INIT__IMType__0x_x__Return:_0x_x__Error:_0x_x_
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
mov eax, dword [esi + 0x5c]
cmp eax, 1
je 0x1000d631
cmp eax, 0x10
je 0x1000d631
cmp eax, 0x100
je 0x1000d631
cmp eax, 0x40
je 0x1000d631
cmp eax, 0x80
je 0x1000d631
cmp eax, 0x800
je 0x1000d631
cmp eax, 0x20000
jne 0x1000d66c
mov ecx, dword [esi + 0x1c]
push 0
push 0x2710
push 2
push ecx
call ebp
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000d66c
call ebx
mov edx, dword [esi + 0x5c]
push eax
push edi
push edx
push str.CDealDlg::SetTimer__ID_TIMER_TIMEOUT__IMType__0x_x__Return:_0x_x__Error:_0x_x_
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
mov eax, dword [esi + 0x5c]
cmp eax, 2
je 0x1000d703
cmp eax, 0x80
je 0x1000d703
cmp eax, 0x200
je 0x1000d703
cmp eax, 0x400
je 0x1000d703
cmp eax, 0x1000
je 0x1000d703
cmp eax, 0x10000
je 0x1000d703
cmp eax, 0x800000
je 0x1000d703
cmp eax, 0x800
je 0x1000d703
cmp eax, 0x4000000
je 0x1000d703
cmp eax, 0x20000000
je 0x1000d703
cmp eax, 0x40000000
je 0x1000d703
cmp eax, 0x11
je 0x1000d703
cmp eax, 0x12
je 0x1000d703
cmp eax, 0x14
je 0x1000d703
cmp eax, 0x8000
je 0x1000d703
cmp eax, 0x20000
je 0x1000d703
cmp eax, 8
je 0x1000d703
cmp eax, 0x15
je 0x1000d703
cmp eax, 0x20
je 0x1000d703
cmp eax, 0x10000000
je 0x1000d703
cmp eax, 0x2000000
je 0x1000d703
cmp eax, 0x80000000
jne 0x1000d73e
mov eax, dword [esi + 0x1c]
push 0
push 0x1388
push 3
push eax
call ebp
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000d73e
call ebx
mov ecx, dword [esi + 0x5c]
push eax
push edi
push ecx
push str.CDealDlg::SetTimer__ID_TIMER_CONTENT__IMType__0x_x__Return:_0x_x__Error:_0x_x_
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1000d750
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1000d8d0
mov eax, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_KillTimer]
push 1
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000d7a1
call ebx
mov ecx, dword [esi + 0x5c]
push eax
push edi
push ecx
push str.CDealDlg::KillTimer__ID_TIMER_ALL__IMType__0x_x__Return:_0x_x__Error:_0x_x_
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
mov eax, dword [esi + 0x5c]
cmp eax, 1
je 0x1000d7cf
cmp eax, 0x10
je 0x1000d7cf
cmp eax, 0x100
je 0x1000d7cf
cmp eax, 0x40
je 0x1000d7cf
cmp eax, 0x80
je 0x1000d7cf
cmp eax, 0x800
je 0x1000d7cf
cmp eax, 0x20000
jne 0x1000d803
mov edx, dword [esi + 0x1c]
push 2
push edx
call ebp
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000d803
call ebx
push eax
mov eax, dword [esi + 0x5c]
push edi
push eax
push str.CDealDlg::KillTimer__ID_TIMER_TIMEOUT__IMType__0x_x__Return:_0x_x__Error:_0x_x_
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
mov eax, dword [esi + 0x5c]
cmp eax, 2
je 0x1000d89c
cmp eax, 0x80
je 0x1000d89c
cmp eax, 0x200
je 0x1000d89c
cmp eax, 0x400
je 0x1000d89c
cmp eax, 0x1000
je 0x1000d89c
cmp eax, 0x10000
je 0x1000d89c
cmp eax, 0x800000
je 0x1000d89c
cmp eax, 0x800
je 0x1000d89c
cmp eax, 0x4000000
je 0x1000d89c
cmp eax, 0x20000000
je 0x1000d89c
cmp eax, 0x40000000
je 0x1000d89c
cmp eax, 0x11
je 0x1000d89c
cmp eax, 0x12
je 0x1000d89c
cmp eax, 0x14
je 0x1000d89c
cmp eax, 0x8000
je 0x1000d89c
cmp eax, 0x20000
je 0x1000d89c
cmp eax, 8
je 0x1000d89c
cmp eax, 0x20
je 0x1000d89c
cmp eax, 0x10000000
je 0x1000d89c
cmp eax, 0x2000000
je 0x1000d89c
cmp eax, 0x80000000
je 0x1000d89c
cmp eax, 0x8000000
jne 0x1000d8d0
mov ecx, dword [esi + 0x1c]
push 3
push ecx
call ebp
mov edi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000d8d0
call ebx
mov edx, dword [esi + 0x5c]
push eax
push edi
push edx
push str.CDealDlg::KillTimer__ID_TIMER_CONTENT__IMType__0x_x__Return:_0x_x__Error:_0x_x_
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10011630
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x6c]
call fcn.1000d8e0
mov eax, dword [esi + 0x88]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10011669
mov ecx, dword [esi + 0x88]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
jne 0x10011669
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x102323bc]
push 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100116c3
mov eax, dword [0x102acd68]
test eax, eax
je 0x100116aa
mov eax, dword [0x102323bc]
push eax
push str.CDealThread::Kill___Terminate__th__0x_08x
push str.IMCD
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
mov ecx, dword [0x102323bc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x88], 0
mov eax, 1
pop esi
ret

Function at 0x100162b0
Capabilities:
Get graphical window text

Disassembly:
call fcn.10115150
test eax, eax
je 0x100162cf
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
je 0x10016350
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x10016350
lea ecx, [esi + esi]
xor eax, eax
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.101970fe
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10016350
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebp, eax
test ebp, ebp
je 0x10016350
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xffffffffffffffff
push ebx
xor ebp, ebp
call fcn.10012d00
add esp, 0x10
test eax, eax
je 0x10016350
push esi
call fcn.100e9a88
add esp, 4
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x100168d0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov ecx, 0x102325e8
jmp 0x100168e0
push 0xffffffffffffffff
push 0x101a7078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
mov ecx, dword [0x101c918c]
mov dword [esp], eax
mov dword [eax + 0x14], ecx
mov edx, dword [0x101c918c]
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x18], edx
mov edx, dword [0x101c918c]
mov byte [esp + 0xc], 1
mov dword [eax + 0x1c], edx
mov edx, dword [0x101c918c]
mov byte [esp + 0xc], 2
mov dword [eax + 0x20], edx
mov edx, dword [0x101c918c]
mov byte [esp + 0xc], 3
mov dword [eax + 0x24], edx
mov edx, dword [0x101c918c]
mov byte [esp + 0xc], 4
mov dword [eax + 0x28], edx
mov edx, dword [0x101c918c]
mov byte [esp + 0xc], 5
mov dword [eax + 0x2c], edx
mov edx, dword [0x101c918c]
mov byte [esp + 0xc], 6
mov dword [eax + 0x30], edx
mov byte [esp + 0xc], 7
mov word [eax], cx
mov word [eax + 2], cx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], 0xffffffff
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1001d630
Capabilities:
Log keystrokes via application hook

Disassembly:
push ecx
mov eax, dword [0x102332d4]
push esi
test eax, eax
jne 0x1001d6a2
call fcn.1001d4f0
test eax, eax
je 0x1001d6a2
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov eax, dword [0x102acd68]
test eax, eax
je 0x1001d688
mov ecx, dword [esp + 8]
push esi
push ecx
push edi
push str.HookLineBoard___x____x____x_
push str.LINE
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x1c
test esi, esi
pop edi
je 0x1001d6a2
push esi
push 0
push 0x1001d5d0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x102332d4], eax
pop esi
pop ecx
ret
Function at 0x1001e190
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.10115100
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e27b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.NtDll.dll
call ebx
push 0x101f1f14
mov dword [esi + 0x2c], eax
call ebx
push str.psapi.dll
mov dword [esi + 0x30], eax
call ebx
mov ecx, dword [esi + 0x2c]
mov dword [esi + 0x34], eax
test ecx, ecx
pop ebx
je 0x1001e2cd
mov edx, dword [esi + 0x30]
test edx, edx
je 0x1001e2cd
test eax, eax
je 0x1001e2cd
push str.NtQuerySystemInformation
push ecx
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x34]
push str.EnumProcesses
push eax
call edi
mov ecx, dword [esi + 0x34]
push str.GetModuleFileNameExA
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 0x34]
push str.GetModuleFileNameExW
push edx
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
call fcn.10115150
test eax, eax
je 0x1001e237
mov eax, dword [esi + 0x30]
push str.ProcessIdToSessionId
push eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1001e2cd
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1001e2cd
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1001e2cd
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1001e2cd
mov dword [esi + 0x38], 1
call fcn.10115150
test eax, eax
je 0x1001e2cd
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x1001e2cd
mov dword [esi + 0x38], 0
jmp 0x1001e2cd
push 0x101f1f14
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x30], eax
je 0x1001e2cd
push str.CreateToolhelp32Snapshot
push eax
call edi
mov ecx, dword [esi + 0x30]
push str.Process32First
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi + 0x30]
push str.Process32Next
push edx
mov dword [esi + 0x10], eax
call edi
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x14], eax
test ecx, ecx
je 0x1001e2cd
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1001e2cd
test eax, eax
je 0x1001e2cd
mov dword [esi + 0x3c], 1
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1001e2ed
push str.GetLongPathNameA
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x30]
push str.GetLongPathNameW
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x1001e302
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x1001e302
mov ecx, esi
call fcn.1001e310
pop edi
pop esi
ret
Function at 0x1001e600
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
test esi, esi
je 0x1001e69c
push esi
call fcn.100e9a88
add esp, 4
test eax, eax
je 0x1001e69c
cmp word [esi], 0x5c
jne 0x1001e6e6
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0xc
rep stosd dword es:[edi], eax
push str.SystemRoot_
push esi
stosw word es:[edi], ax
call fcn.100ea081
add esp, 0xc
test eax, eax
pop edi
jne 0x1001e6a8
lea eax, [esp + 4]
push str._SystemRoot_
push eax
call fcn.100e9a63
lea ecx, [esi + 0x18]
lea edx, [esp + 0x26]
push ecx
push edx
mov word [esp + 0x2c], 0x5c
call fcn.100e9a63
add esp, 0x10
lea eax, [esp + 4]
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1001e69c
cmp eax, 0x104
jbe 0x1001e6e6
xor eax, eax
pop esi
add esp, 0x208
ret 8
push 4
push 0x101f2008
push esi
call fcn.100ea081
add esp, 0xc
test eax, eax
jne 0x1001e6e6
lea ecx, [esi + 8]
push 0x103
lea edx, [esp + 8]
push ecx
push edx
call fcn.100e9aa5
mov eax, dword [esp + 0x220]
lea ecx, [esp + 0x10]
dec eax
push eax
push ecx
push esi
call fcn.100e9aa5
add esp, 0x18
mov eax, 1
pop esi
add esp, 0x208
ret 8
Function at 0x10024b10
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101a7b6b
push eax
mov eax, dword [0x102335d4]
mov dword fs:[0], esp
sub esp, 0xe14
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
jne 0x10024d58
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x61e]
mov word [esp + 0x61c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x416]
mov word [esp + 0x414], bx
rep stosd dword es:[edi], eax
push str.OAgent.ini
mov dword [0x102335d4], 1
mov dword [esp + 0xc], ebx
stosw word es:[edi], ax
call fcn.10001b40
push eax
lea eax, [esp + 0x41c]
push 0x101ed298
push eax
call fcn.100e9eda
add esp, 0x10
lea ecx, [esp + 0x414]
lea edx, [esp + 0x61c]
push ecx
push 0x400
push edx
push 0x102323b8
push 0x101b8560
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
jbe 0x10024c0a
cmp word [esp + 0xe1a], bx
jne 0x10024c0a
lea eax, [esp + 0x14]
push 0x400
lea ecx, [esp + 0x620]
push eax
push ecx
call fcn.10146370
add esp, 0xc
mov dword [esp + 8], eax
jmp 0x10024c0e
mov eax, dword [esp + 8]
cmp eax, ebx
jne 0x10024d22
push esi
lea ecx, [esp + 0x10]
call fcn.10116490
mov dword [esp + 0xe28], ebx
mov esi, 0x20019
call fcn.10115070
test eax, eax
je 0x10024c3a
mov esi, 0x20219
push esi
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.10116600
test eax, eax
je 0x10024c98
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
push 0x101b85f4
call fcn.10116a20
cmp eax, ebx
je 0x10024c98
mov ecx, dword [esp + 0xc]
cmp ecx, 0x400
jae 0x10024c8b
mov edx, ecx
mov esi, eax
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10024c8f
mov dword [esp + 0xc], ebx
push eax
call fcn.10197127
add esp, 4
lea ecx, [esp + 0x10]
call fcn.10116650
lea ecx, [esp + 0x10]
mov dword [esp + 0xe28], 0xffffffff
call fcn.10116580
mov eax, dword [esp + 0xc]
pop esi
cmp eax, ebx
jne 0x10024d22
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x61c]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x620]
push eax
push 0x102323b8
push 0x101b85f4
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
jbe 0x10024d1a
cmp word [esp + 0xe1a], bx
jne 0x10024d1a
lea ecx, [esp + 0x14]
push 0x400
lea edx, [esp + 0x620]
push ecx
push edx
call fcn.10146370
add esp, 0xc
jmp 0x10024d1e
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x10024d58
cmp eax, 4
jbe 0x10024d58
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x10024d58
cmp dword [esp + 0x14], 1
je 0x10024d58
mov edx, dword [esp + 0x30]
and edx, 0xffff
lea ecx, [edx + edx + 0x22]
cmp ecx, ebx
je 0x10024d58
add eax, 0xfffffffc
cmp ecx, eax
ja 0x10024d58
mov eax, dword [esp + 0x1c]
mov dword [0x102335d0], eax
mov ecx, dword [esp + 0xe1c]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0xe20
ret
Function at 0x10025d10
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
or eax, 0xffffffff
cmp ecx, 0x4000
ja 0x10025ded
je 0x10025de7
cmp ecx, 0x20
ja 0x10025d6d
je 0x10025d67
dec ecx
cmp ecx, 0x14
ja case.0x10025d42.9
xor edx, edx
mov dl, byte [ecx + 0x10025f20]
jmp dword [edx*4 + 0x10025efc]
mov eax, 1
ret
mov eax, 0x21
ret
mov eax, 5
ret
mov eax, 2
ret
mov eax, 4
ret
mov eax, 6
ret
cmp ecx, 0x400
ja 0x10025db9
je case.0x10025d42.6
cmp ecx, 0x100
ja 0x10025da1
je 0x10025d9b
sub ecx, 0x40
je case.0x10025d42.7
sub ecx, 0x40
jne case.0x10025d42.9
mov eax, 8
ret
mov eax, 7
ret
mov eax, 9
ret
cmp ecx, 0x200
jne case.0x10025d42.9
mov eax, 0xa
ret
mov eax, 0xb
ret
cmp ecx, 0x800
je 0x10025de1
cmp ecx, 0x1000
je 0x10025ddb
cmp ecx, 0x2000
jne case.0x10025d42.9
mov eax, 0xe
ret
mov eax, 0xd
ret
mov eax, 0xc
ret
mov eax, 0xf
ret
cmp ecx, 0x800000
ja 0x10025e85
je 0x10025e7f
cmp ecx, 0x80000
ja 0x10025e51
je 0x10025e4b
cmp ecx, 0x20000
ja 0x10025e39
je 0x10025e33
cmp ecx, 0x8000
je 0x10025e2d
cmp ecx, 0x10000
jne case.0x10025d42.9
mov eax, 0x11
ret
mov eax, 0x10
ret
mov eax, 0x12
ret
cmp ecx, 0x40000
jne case.0x10025d42.9
mov eax, 0x13
ret
mov eax, 0x14
ret
cmp ecx, 0x100000
je 0x10025e79
cmp ecx, 0x200000
je 0x10025e73
cmp ecx, 0x400000
jne case.0x10025d42.9
mov eax, 0x17
ret
mov eax, 0x16
ret
mov eax, 0x15
ret
mov eax, 0x18
ret
cmp ecx, 0x10000000
ja 0x10025ecf
je 0x10025ec9
cmp ecx, 0x4000000
ja 0x10025ebb
je 0x10025eb5
cmp ecx, 0x1000000
je 0x10025eaf
cmp ecx, 0x2000000
jne case.0x10025d42.9
mov eax, 0x1a
ret
mov eax, 0x19
ret
mov eax, 0x1b
ret
cmp ecx, 0x8000000
jne case.0x10025d42.9
mov eax, 0x1c
ret
mov eax, 0x1d
ret
cmp ecx, 0x20000000
je 0x10025ef3
cmp ecx, 0x40000000
je 0x10025eed
cmp ecx, 0x80000000
jne case.0x10025d42.9
mov eax, 0x20
ret
mov eax, 0x1f
ret
mov eax, 0x1e
ret

Function at 0x10025f40
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
dec ecx
cmp ecx, 0x21
ja case.0x10025f50.3
jmp dword [ecx*4 + 0x10026018]
mov eax, 0x40000000
ret
mov eax, 0x20000000
ret
mov eax, 0x10000000
ret
mov eax, 0x8000000
ret
mov eax, SysReAllocString
ret
mov eax, 1
ret
mov eax, 0x11
ret
mov eax, 0x10
ret
mov eax, 2
ret
mov eax, 8
ret
mov eax, 0x20
ret
mov eax, 0x14
ret
mov eax, 0x80
ret
mov eax, 0x100
ret
mov eax, 0x200
ret
mov eax, 0x400
ret
mov eax, 0x800
ret
mov eax, 0x1000
ret
mov eax, 0x15
ret
mov eax, 0x4000
ret
mov eax, 0x8000
ret
mov eax, 0x10000
ret
mov eax, 0x20000
ret
mov eax, 0x40000
ret
mov eax, 0x80000
ret
mov eax, 0x100000
ret
mov eax, 0x200000
ret
mov eax, 0x400000
ret
mov eax, 0x800000
ret
mov eax, 0x1000000
ret
mov eax, 0x2000000
ret
mov eax, 0x4000000
ret