joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001af90
Capabilities:
Check os version
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1001b119
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x1001b0e3
mov edi, 1
mov bl, 1
lea edx, [ebp - 0x28c]
mov eax, dword [0x10177db8]
call fcn.10006d08
mov eax, dword [ebp - 0x28c]
push eax
lea eax, [ebp - 0x290]
mov edx, edi
add dl, 0x30
call fcn.10003710
mov ecx, dword [ebp - 0x290]
lea eax, [ebp - 0x14]
pop edx
call fcn.100037c8
mov eax, dword [ebp - 0x14]
call fcn.1000397c
push eax
push 0
push 4
call sub.KERNEL32.dll_OpenFileMappingA
mov esi, eax
test esi, esi
je 0x1001b0d4
push 0
push 0
push 0
push 4
push esi
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001b0ce
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x1001b061
cmp eax, dword [esp]
pop edx
pop eax
jne 0x1001b0c5
xor ebx, ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x1001b0c5
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
imul eax, dword [ebp - 8], 0x4e
mov edx, dword [ebp - 0x10]
push esi
push edi
lea esi, [edx + eax*8 + 0xc]
lea edi, [ebp - 0x288]
mov ecx, 0x9c
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp byte [ebp - 0x288], 0
jne 0x1001b0a6
mov bl, 1
jmp 0x1001b0c5
lea eax, [ebp - 0x288]
push eax
call sub.KERNEL32.dll_GetModuleHandleA
cmp eax, dword [ebp - 4]
jne 0x1001b0bd
mov byte [ebp - 9], 1
jmp 0x1001b0c5
inc dword [ebp - 8]
dec dword [ebp - 0x18]
jne 0x1001b07d
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
push esi
call sub.KERNEL32.dll_CloseHandle
or bl, byte [ebp - 9]
jne 0x1001b0e3
inc edi
cmp edi, 0xa
jne 0x1001afd7
cmp byte [ebp - 9], 0
jne 0x1001b0f3
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.1001ae40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1001b120
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.1000354c
lea eax, [ebp - 0x14]
call fcn.10003528
ret
Function at 0x1001bc80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
push ebp
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.1001b9c4
pop ecx
test al, al
jne 0x1001bda8
push 0x104
lea eax, [ebp - 0x111]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.1001b9c4
pop ecx
test al, al
jne 0x1001bda8
push 0x104
lea eax, [ebp - 0x111]
push eax
mov eax, dword [0x10179658]
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x104
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [0x10179658]
push eax
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.1001b9c4
pop ecx
test al, al
jne 0x1001bda8
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x31c]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.1001b9c4
pop ecx
test al, al
jne 0x1001bda8
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x104
lea eax, [ebp - 0x31c]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.1001b9c4
pop ecx
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001c674
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 8], 0
je 0x1001c69f
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
push ebx
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x1001c6b3
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
jne 0x1001c6b7
xor eax, eax
jmp 0x1001c6b9
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x1001c874
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
je 0x1001c90b
push 2
lea ecx, [ebp - 2]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1001c648
test al, al
je 0x1001c90b
cmp word [ebp - 2], 0x5a4d
jne 0x1001c90b
push 4
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1001c648
test al, al
je 0x1001c90b
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1001c648
test al, al
je 0x1001c90b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp dword [eax], 0x4550
jne 0x1001c90b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
test byte [eax + 0x17], 0x20
je 0x1001c90f
xor eax, eax
jmp 0x1001c911
mov al, 1
test al, al
je 0x1001c92e
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
movzx ecx, word [ebp - 2]
add edx, ecx
add edx, 0x78
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [ecx], edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x1001ce28
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, eax
xor edi, edi
push esi
push 0x2bb
call fcn.1000c024
mov ebx, eax
test ebx, ebx
je 0x1001d031
cmp dword [0x10177fe0], 0
jne 0x1001ce6a
mov dl, 1
mov eax, dword [0x10177c1c]
call fcn.1000ab88
mov dword [0x10177fe0], eax
cmp dword [0x10177fe4], 0
jne 0x1001ce84
mov dl, 1
mov eax, dword [0x10177c50]
call fcn.1000ab88
mov dword [0x10177fe4], eax
mov byte [ebp - 0x24a], 0xb8
mov dword [ebp - 0x249], ebx
mov byte [ebp - 0x245], 0xb9
lea eax, [ebx + 0x235]
mov dword [ebp - 0x244], eax
mov word [ebp - 0x240], 0xd1ff
xor eax, eax
mov dword [ebp - 0x23e], eax
xor eax, eax
mov dword [ebp - 0x23a], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.1001cdec
mov dword [ebp - 0x236], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x14]
push eax
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov word [ebp - 0x22d], ax
mov ax, word [ebp - 0x22d]
add ax, 2
mov word [ebp - 0x22b], ax
lea eax, [ebx + 0x25]
mov dword [ebp - 0x229], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x14]
push eax
lea eax, [ebp - 0x225]
push eax
call sub.KERNEL32.dll_lstrcpyW
mov eax, dword [0x10177fe4]
mov dword [ebp - 0x1d], eax
mov eax, dword [0x10177fe0]
mov dword [ebp - 0x19], eax
cmp dword [ebp - 0x236], 0
je 0x1001d031
lea eax, [ebp - 0x10]
push eax
push 0x236
lea eax, [ebp - 0x24a]
push eax
push ebx
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1001d031
cmp dword [ebp - 0x10], 0x236
jne 0x1001d031
lea eax, [ebp - 0x10]
push eax
push 0x85
push 0x1017829c
lea eax, [ebx + 0x235]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1001d031
cmp dword [ebp - 0x10], 0x85
jne 0x1001d031
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x1001d031
cmp dword [ebp - 0x10], 5
jne 0x1001d031
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
lea eax, [ebx + 0x18]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1001d031
cmp dword [ebp - 0x10], 5
jne 0x1001d031
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x1001d031
mov byte [ebp - 9], 0xe9
sub ebx, dword [ebp - 0x236]
sub ebx, 5
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 5
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001d1a4
Capabilities:
Get number of processors

Disassembly:
mov eax, dword gs:[0x60]
mov edx, dword gs:[0x64]
ret
Function at 0x1001e9ac
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
push 1
push 0
push 0
push 0
push 0xffffffffffffffff
push 1
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.1001d8c8
mov ebx, eax
test bl, bl
je 0x1001ea02
test esi, 4
jne 0x1001ea0d
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_ResumeThread
jmp 0x1001ea0d
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100210e8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
xor eax, eax
push ebp
push 0x1002118d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x150]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
call fcn.10003720
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
xor ecx, ecx
call fcn.1001f498
mov ebx, eax
test bl, bl
je 0x10021174
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0x64
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push 0
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10021194
lea eax, [ebp - 0x150]
call fcn.10003528
ret
Function at 0x1002142c
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x10021616
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x1017842c], 0
jne 0x100215fb
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x100215f4
xor eax, eax
push ebp
push 0x100215ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x100215d6
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x100215d0
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x10177d54]
call fcn.10006d08
mov eax, dword [ebp - 0x24]
call fcn.1000397c
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x10021504
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x10177d58]
call fcn.10006d08
mov eax, dword [ebp - 0x28]
call fcn.1000397c
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x10021537
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x10177d5c]
call fcn.10006d08
mov eax, dword [ebp - 0x2c]
call fcn.1000397c
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x1002156a
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x100215bc
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x10021587
cmp eax, dword [ebp - 0x10]
je 0x100215b8
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x1002159c
cmp eax, dword [ebp - 0x18]
je 0x100215b8
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x100215b1
cmp eax, dword [ebp - 0x20]
je 0x100215b8
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x10021574
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100215f4
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
mov byte [0x1017842c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1002161d
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.1000354c
ret
Function at 0x100224b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100224c9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10022504
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10022500
lea ebx, [ebx]
cmp esi, edx
jae 0x10022504
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x100224f0
cmp esi, edx
jb 0x1002250b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10027a00
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e3a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x1c]
push dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str.MatrixFileIpc.SaveToDisk_sync_d_:_saving_tree_and_emptying_DataIntegrity_value_____s
push eax
call fcn.10044f30
add esp, 0x10
mov dword [ebp - 4], 0
mov ecx, str.Cerveau
mov edx, dword [ebp - 0x10]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10027a7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], 0
je 0x10027a89
mov ecx, esi
call fcn.10031ea0
mov ecx, dword [esi + 0x1c]
call fcn.10033490
lea eax, [ebp + 8]
push str.MatrixFileIpc.SaveToDisk__:_about_to_save_tree
push eax
call fcn.10044f30
add esp, 8
mov dword [ebp - 4], 1
mov ecx, str.Cerveau
mov edx, dword [ebp + 8]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10027ad9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0x1c]
push ecx
mov ecx, esp
push dword [eax]
call fcn.10023fc0
mov ecx, dword [esi + 0x1c]
call fcn.10029220
mov eax, dword [esi + 0x1c]
add esp, 4
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x10027b42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp + 8]
push str._Lock:_failed_releasing__LE_d
push eax
call fcn.10044f30
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, str.PathTree
call fcn.10043b30
mov edx, dword [ebp + 8]
mov ecx, edi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10027b42
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.DataIntegrity
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x14]
push str.MatrixFileIpc.SaveToDisk__:_out
push eax
call fcn.10044f30
add esp, 8
mov dword [ebp - 4], 2
mov ecx, str.Cerveau
mov edx, dword [ebp - 0x14]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x10027b96
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002eeb0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x10
mov edi, ecx
call fcn.10104809
add esp, 4
mov dword [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 4]
push 0xf0000040
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1002eee9
xor bl, bl
jmp 0x1002ef13
push esi
push 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
test eax, eax
jne 0x1002ef08
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor bl, bl
jmp 0x1002ef13
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
setne bl
mov ecx, dword [edi]
lea eax, [esi + 0x10]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x1002ef28
push eax
push esi
mov ecx, edi
call fcn.1002cf60
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030940
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push 0x1013a6ac
call esi
mov edi, eax
test edi, edi
je 0x100309d9
push str.GetFinalPathNameByHandleW
push 0x1013a6dc
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtQueryObject
push edi
mov dword [0x101726a4], eax
call esi
push str.NtOpenSymbolicLinkObject
push edi
mov dword [0x101726b0], eax
call esi
push str.NtQuerySymbolicLinkObject
push edi
mov dword [0x101726ac], eax
call esi
push str.ZwClose
push edi
mov dword [0x101726b4], eax
call esi
push 0x68
push 0xff
push 0x10175238
mov dword [0x101726b8], eax
call fcn.101078f0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
push 0x10175220
call esi
push 0x10175208
call esi
mov dword [0x101726a8], 1
pop edi
pop esi
ret
Function at 0x10032ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011f4b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x1017222c]
lea ecx, [ebp - 0x10]
push 0x1012ec60
call fcn.10023fc0
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x10
je 0x10032b4b
mov eax, dword [ebp - 0x10]
mov edx, 1
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 9
or ecx, edx
jge 0x10032b27
push 9
lea ecx, [ebp - 0x10]
call fcn.100249c0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.DataIntegrity
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10032b4b
mov esi, 1
jmp 0x10032b4d
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10032b71
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10034ea0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], edx
test edi, edi
ja 0x10034ec7
jb 0x10034ec0
cmp esi, 0x400000
jae 0x10034ec7
mov eax, esi
mov dword [ebp + 0xc], edi
jmp 0x10034ecf
mov eax, 0x400000
mov dword [ebp + 0xc], ebx
push eax
push 0
push 0
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
test ecx, ecx
jne 0x10034eea
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10034f2b
mov eax, dword [ecx + 0x3c]
cdq
cmp edx, edi
ja 0x10034f2b
jb 0x10034f02
cmp eax, esi
jae 0x10034f2b
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10034f2b
mov eax, dword [edx + ecx + 0x54]
add eax, dword [edx + ecx + 0x24]
add eax, dword [edx + ecx + 0x20]
add eax, dword [edx + ecx + 0x1c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], ebx
mov ebx, 1
mov dword [edx], eax
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10034f40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011f5e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, str.PeContainer
mov edx, dword [ebp + 8]
call fcn.10043b30
lea eax, [ebp + 8]
mov edx, str.PeContainer:
push eax
lea ecx, [ebp - 0x10]
call fcn.10036300
add esp, 4
push 1
push 0x1013b6e0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10024890
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10034fcb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x10034fec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4