joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042fa5
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10042fbc
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10042fde
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007d474
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007d800
jl 0x10042fec
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007daa4
jl 0x1004302c
mov ecx, dword [0x1007e7f0]
xor ecx, dword [0x1007d474]
and ecx, edi
xor ecx, dword [0x1007e7f0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007d470], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007daa4]
mov dword [0x1007de30], eax
pop esi
ret
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.10036ce6
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.10036ce6
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.10036ce6
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x10036ce6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10036cf5
pop dword [ebp - 0x38]
mov eax, 0x16c44ffd
add eax, 0xf93f1cf8
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x38892365
add dword [ebp - 0x48], 0x15c921e6
mov dword [ebp - 0x44], 0x5111d2e
add dword [ebp - 0x44], 0x2d222f17
mov dword [ebp - 0x40], 0xfd519242
sub dword [ebp - 0x40], 0xb1054e14
mov dword [ebp - 0x3c], 0x3511b5ad
sub dword [ebp - 0x3c], 0x3511b5ad
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x1e908a6
add dword [ebp - 0x48], 0x728960b0
mov dword [ebp - 0x44], 0x3d1a580a
add dword [ebp - 0x44], 0x452096b
mov dword [ebp - 0x40], 0x6e0f1293
add dword [ebp - 0x40], 0xf56059d9
mov dword [ebp - 0x3c], 0x6b51131c
add dword [ebp - 0x3c], 0x94aeece4
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x25887314
add eax, 0xea7c5b70
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d013
push 0
call eax
mov ecx, 0x3d6b
xor esi, esi
add esi, eax
mov edi, 0x48f112cb
add edi, 0xc714a135
add edi, dword [ebp - 0x38]
mov ebx, 0xbd7b270f
add ebx, 0x626a28eb
xor dword [ebp - 0x2c], edx
mov edx, dword [edi]
sub dword [ebp - 0x30], 0x4f962ac
add edx, ebx
xor dword [ebp - 0x34], 0x2e90925a
mov dword [esi], edx
xor dword [ebp - 0x30], 0x9e743b4a
add esi, 4
add edi, 0x81e21f17
sub edi, 0x81e21f13
loop 0x10036e0e
add eax, 0xc7163168
sub eax, 0xc71548e9
xor ebx, ebx
add ebx, eax
add eax, 0x58b09d53
sub eax, 0x58b09d4e
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x431004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x60967860
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x40f355b8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100036d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100036e3
pop dword [ebp - 0x44]
mov eax, 0xaad2da50
add eax, 0x652d5c93
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xcffbc976
sub dword [ebp - 0x54], 0x81a9842b
mov dword [ebp - 0x50], 0x6a76f896
add dword [ebp - 0x50], 0xc7bc53af
mov dword [ebp - 0x4c], 0x4b1dc87a
add dword [ebp - 0x4c], 0x12e7bb4
mov dword [ebp - 0x48], 0x18bb4de7
add dword [ebp - 0x48], 0xe744b219
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x77aefba1
sub dword [ebp - 0x54], 0x33c924b
mov dword [ebp - 0x50], 0x2f252f5e
add dword [ebp - 0x50], 0x12473217
mov dword [ebp - 0x4c], 0x3bd5dcc
add dword [ebp - 0x4c], 0x5fb20ea0
mov dword [ebp - 0x48], 0x2d2ccb2a
add dword [ebp - 0x48], 0xd2d334d6
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3eb93
push 0
call eax
mov ecx, 0x60dd043b
add ecx, 0x9f234ffd
mov edi, eax
mov edx, 0x7837e6c7
sub edx, 0x68354cc7
add edx, dword [ebp - 0x44]
mov esi, 0xe277d1a6
add dword [ebp - 0xc], edx
mov ebx, dword [edx]
xor dword [ebp - 0x40], 0xcd045de
add ebx, esi
sub dword [ebp - 0x30], 0xf99e8029
mov dword [edi], ebx
add edi, 0x6edf37f9
sub edi, 0x6edf37f5
add edx, 0x27918648
add edx, 0xd86e79bc
loop 0x100037f5
add eax, 0x143b3
xor ebx, ebx
add ebx, eax
add eax, 0xd6bac4b4
add eax, 0x29453b51
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1000567b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001ae0c
call fcn.1001a6e0
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100056f8
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x100056f8
call fcn.10003dca
mov esi, eax
jmp 0x100057fe
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000571b
call fcn.10003dca
jmp 0x100057f1
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10005711
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000574e
mov esi, 0x8007000e
jmp 0x100057f3
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x1000582c
jb 0x10005769
cmp eax, 0xffffffff
ja 0x1000582c
cmp eax, 0x400
jbe 0x1000577e
push eax
lea ecx, [ebp - 0x418]
call fcn.100036d4
jmp 0x100057a0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x100057a0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10005744
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10005711
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.100036d4
mov esi, eax
test edi, edi
je 0x100057fe
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10005817
lea ecx, [ebp - 0x418]
call fcn.10003d92
lea ecx, [ebp - 0x428]
call fcn.10004436
mov eax, esi
call fcn.1001a631
ret 0x10
push 0x80070216
call fcn.100036d4
int3
Function at 0x10005e6b
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1001aed0
call fcn.1001a63e
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x20
call fcn.100036d4
mov esi, eax
pop ecx
test esi, esi
je 0x10005eab
and dword [esi + 4], 0
lea ecx, [esi + 8]
mov edi, ecx
xor eax, eax
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
and dword [esi + 0x18], 0
mov edi, dword [ebp - 0x10]
jmp 0x10005ead
xor esi, esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
jne 0x10005ec2
mov ebx, 0x8007000e
jmp 0x10005fa1
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [esi], edi
test edi, edi
je 0x10005f1b
test ebx, ebx
je 0x10005f9c
cmp dword [ebp + 8], 0
jne 0x10005f9c
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call ebx
mov edi, eax
mov eax, dword [esi + 4]
cmp edi, eax
je 0x10005f15
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x10005f0f
push edi
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x10005fe5
jmp 0x10005f37
and dword [esi + 4], 0
xor eax, eax
test eax, eax
jne 0x10005f37
jmp 0x10005eb8
test ebx, ebx
jne 0x10005f9c
cmp dword [ebp + 8], ebx
je 0x10005f9c
push dword [ebp + 8]
lea eax, [esi + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantChangeType]
mov ebx, eax
test ebx, ebx
js 0x10005fa1
lea ecx, [esi + 0x18]
call fcn.100036d4
mov ebx, eax
test ebx, ebx
js 0x10005fa1
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fef
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x10006064
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x10005f8b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10005f8f
xor esi, esi
xor ebx, ebx
test edi, edi
je 0x10005fa1
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10005fa1
mov ebx, 0x80070057
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10005fdb
mov dword [ebp - 4], 8
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fc1
and dword [esi + 0x18], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esi + 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call fcn.100036d4
pop ecx
mov eax, ebx
call fcn.1001a60f
ret 4
push 0x8007000e
call fcn.100036d4
push 0
push 0x152139a
call fcn.100036d4
int3
Function at 0x41c060
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
jmp 0x41c07a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c081
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c070
mov eax, 1
add ebx, ebx
jne 0x41c093
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c088
jne 0x41c0a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c088
xor ecx, ecx
sub eax, 3
jb 0x41c0b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c12a
mov ebp, eax
add ebx, ebx
jne 0x41c0c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c0d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c0f4
inc ecx
add ebx, ebx
jne 0x41c0e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c0d5
jne 0x41c0f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c0d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c114
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c105
jmp 0x41c076
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c114
add edi, ecx
jmp 0x41c076
pop esi
mov edi, esi
mov ecx, 0x4ea
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c132
cmp byte [edi], 1
jne 0x41c132
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41c137
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c1a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ce0c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1cebc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c164
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1cec4]
or eax, eax
je 0x41c1a0
mov dword [ebx], eax
add ebx, 4
jmp 0x41c181
call dword [esi + 0x1cec0]
mov ebp, dword [esi + 0x1cec8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41c1da
sub esp, 0xffffff80
jmp 0x409c38
Function at 0x100022b4
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push 0x48
mov eax, 0x1000c708
call fcn.1000b995
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x4c], eax
lea eax, [esi + 0x18]
push eax
mov dword [ebp - 0x54], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
lea eax, [ebp - 0x48]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.10002239
cmp dword [ebp - 0x38], ebx
jne 0x10002315
push 9
pop esi
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.1000b14a
push dword [ebp - 0x54]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.1000ba18
ret 0xc
cmp dword [edi + 0xc], 0x400
jbe 0x10002322
push 8
jmp 0x100022ef
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
cmp dword [esi + 0x14], 2
push 0xffffffffffffffff
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ebx
lea eax, [esi + 0x68]
je 0x10002348
lea eax, [esi + 0x4c]
push eax
call fcn.1000b14a
cmp dword [esi + 8], ebx
jne 0x10002384
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1000235f
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x10002384
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.1000b14a
jmp 0x100022ed
mov eax, dword [ebp - 0x48]
push 8
pop esi
mov dword [ebp - 0x50], ebx
cmp dword [ebp - 0x34], esi
jae 0x10002395
lea eax, [ebp - 0x48]
push dword [ebp + 0x10]
lea ecx, [ebp - 0x50]
push ecx
push 0x40c
push dword [ebp - 0x4c]
push 0x410
push edi
push eax
call dword [sym.imp.kernel32.dll_CallNamedPipeW]
cmp eax, ebx
jne 0x100023e2
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push 1
cmp eax, 0x5b4
jne 0x100023d8
call fcn.1000b14a
push 0xa
jmp 0x100022ef
call fcn.1000b14a
jmp 0x100022f0
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.1000b14a
xor esi, esi
jmp 0x100022f0
Function at 0x10002faf
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x10002fd0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x10002fcc
xor eax, eax
ret

Function at 0x10002fde
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x10002fff
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x10002ffb
xor eax, eax
ret

Function at 0x100068d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1000cb1e
call fcn.1000b9cb
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call fcn.10004616
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x1000692c
call fcn.100036d3
mov esi, eax
jmp 0x10006a02
push ebx
push edi
push eax
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10006945
call fcn.100036d3
jmp 0x100069f4
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x1000693b
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x1000697f
mov esi, 0x8007000e
jmp 0x100069f6
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000b14a
mov dword [ebp - 4], 1
jmp 0x100069ad
cmp dword [ebp - 0x418], esi
je 0x10006978
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x1000693b
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000b14a
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10006a1b
lea ecx, [ebp - 0x418]
call fcn.10004030
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10003fb2
mov eax, esi
call fcn.1000ba27
ret 0x10
Function at 0x10009b34
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1000cdf8
call fcn.1000b95f
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
call esi
test eax, eax
jne 0x10009c78
cmp dword [ebp - 0x18], 1
jne 0x10009c78
mov edi, dword [ebp - 0x14]
shr edi, 1
inc edi
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], ebx
neg ecx
or ecx, eax
push ecx
call fcn.1000b14a
mov edi, eax
pop ecx
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x10009c6a
push dword [ebp - 0x14]
push ebx
push edi
call fcn.1000b14a
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x10009c6a
cmp dword [ebp - 0x18], 1
jne 0x10009c6a
shr dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000b14a
mov esi, dword [ebp + 0x10]
pop ecx
mov dword [esi], eax
cmp eax, ebx
je 0x10009c6a
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.1000b14a
lea eax, [ebp - 0x20]
push eax
push 0x100102f4
push edi
call dword [sym.imp.MSVCR100.dll_wcstok_s]
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x10009c50
push edi
call fcn.1000b14a
pop ecx
cmp al, bl
je 0x10009c50
mov eax, dword [ebp - 0x14]
push edi
inc eax
push eax
push dword [esi]
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
jmp 0x10009c6a
push dword [esi]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
mov dword [esi], ebx
jmp 0x10009c6a
cmp dword [ebp - 0x1c], ebx
je 0x10009c78
push dword [ebp - 0x1c]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.1000ba04
ret