joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024bee
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x10024c0f
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x10024c0f
cmp edx, eax
jb 0x10024c0f
add eax, 0x10000
cmp eax, ecx
jae 0x10024c3a
mov eax, dword [0x10053c10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.10026d28
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
ret

Function at 0x1002530a
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 4]
push eax
push 1
push ecx
xor esi, esi
push edx
mov dword [esp + 0x14], esi
call fcn.10036f9e
test eax, eax
jne 0x10025374
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10025374
cmp dword [esp + 0x10], 4
jne 0x10025374
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov dword [edx], eax
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x1002538b
push eax
mov dword [esp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x1002578b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1001e268]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x414], ecx
test esi, esi
jne 0x100257cb
xor eax, eax
jmp 0x1002593b
and dword [esi], 0
push ebx
push edi
mov edi, dword [ebp + 0x20]
xor ebx, ebx
inc ebx
push ebx
push edi
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x420], ebx
call fcn.100293c0
and dword [ebp - 0x410], 0
and dword [ebp - 0x418], 0
shr edi, 0x1a
not edi
mov dword [ebp - 0x408], eax
and edi, ebx
cmp dword [ebp - 0x408], 0
je 0x10025830
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x17
and eax, ebx
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [esi], eax
cmp dword [esi], 0
jne 0x100258cc
test edi, edi
je 0x100258cc
and dword [ebp - 0x40c], 0
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.10029282
test eax, eax
je 0x100258b2
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x19
and eax, ebx
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.10029009
cmp dword [ebp - 0x40c], 5
jne 0x100258b2
cmp dword [ebp - 0x418], 0
jne 0x100258b2
mov dword [ebp - 0x418], ebx
jmp 0x1002580b
cmp dword [esi], 0
je 0x100258cc
xor eax, eax
cmp dword [ebp - 0x40c], 0xb7
setne al
mov dword [ebp - 0x410], eax
mov eax, dword [esi]
xor ecx, ecx
cmp eax, ecx
je 0x100258d9
cmp eax, 0xffffffff
jne 0x100258f8
cmp edi, ecx
je 0x100258e8
push ecx
push 0x787a6c65
call fcn.10026d28
xor ecx, ecx
mov dword [esi], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x420], ecx
pop edi
pop ebx
cmp dword [ebp - 0x41c], ecx
je 0x10025923
mov eax, dword [ebp - 0x408]
cmp eax, ecx
jne 0x10025911
mov eax, 0x10003170
push dword [ebp + 0x14]
push dword [ebp - 0x41c]
push eax
call fcn.10025717
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x10025935
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1004da72
leave
ret 0x1c
Function at 0x10026161
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100896f0]
sub esp, 0x18
push ebx
push esi
push edi
mov dword [0x10084738], eax
mov eax, dword [0x10084724]
xor edi, edi
cmp eax, edi
je 0x1002619d
push eax
call fcn.10025f1c
push dword [0x100896f0]
mov dword [0x10084738], eax
push dword [0x10084724]
call fcn.10025ac5
jmp 0x10026213
mov eax, dword [0x10084728]
cmp eax, edi
je 0x10026213
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 8]
push ecx
push 0x2001f
push eax
push Ordinal_4
mov dword [ebp - 0x18], 4
call fcn.10036f77
test eax, eax
jne 0x10026213
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov esi, 0x10003178
push esi
push dword [ebp - 8]
call fcn.10025514
test eax, eax
jne 0x1002620a
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x18]
mov dword [0x10084738], eax
mov eax, dword [0x100896f0]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push esi
push dword [ebp - 8]
call fcn.10025532
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x10053c04], edi
je 0x1002622c
call fcn.10026140
push eax
push dword [0x10053c04]
call fcn.10025ac5
call fcn.10026140
mov esi, eax
call fcn.1002611f
mov ebx, eax
cmp esi, ebx
je 0x10026342
movzx eax, si
push eax
call fcn.1003fa74
test eax, eax
jne 0x10026260
movzx eax, bx
push eax
call fcn.1003fa74
test eax, eax
je 0x10026342
lea eax, [ebp - 4]
push eax
push 0x20019
push 0x10003410
call fcn.100259f7
test eax, eax
jne 0x10026342
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x10026342
imul eax, eax, 0x104
push eax
lea eax, [ebp - 0xc]
mov esi, 0x104
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
call fcn.100251dc
test eax, eax
jne 0x100262ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10026342
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x10026316
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x10026316
add dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 8]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
add ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x100262e8
mov ebx, dword [ebp - 8]
cmp ebx, edi
jle 0x10026331
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add edi, esi
dec ebx
jne 0x1002631d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.10025006
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100278ff
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0x1002791a
mov eax, 0xa0
jmp 0x100279f1
push edi
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jmp 0x1002799c
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
je 0x1002794b
push eax
call fcn.1003244b
mov edi, eax
cmp edi, ebx
jne 0x1002794b
push ebx
push 0x77626966
call fcn.10026d28
mov dword [ebp - 0xc], 8
jmp 0x10027962
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x10027957
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0xc], eax
cmp edi, ebx
je 0x1002796c
push edi
call fcn.10025006
push dword [ebp - 0xc]
call fcn.10026e6e
pop ecx
test eax, eax
je 0x100279d8
push 0x796d7466
push ebx
call fcn.10026d67
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002720f
lea ecx, [ebp - 4]
mov dword [ebp + 8], ebx
call fcn.10026ff9
lea ecx, [ebp - 4]
call fcn.10026fd5
movzx eax, word [esi + 0xc]
shr eax, 1
push ebx
and eax, 0x10
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.1002726d
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x10027923
lea ecx, [ebp - 4]
call fcn.10026ff9
mov eax, edi
jmp 0x100279f0
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002713a
lea ecx, [ebp - 4]
call fcn.10026ff9
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100279f7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
jne 0x10027a0f
xor eax, eax
jmp 0x10027b05
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x10027a1f
cmp dword [0x10084718], ebx
je 0x10027a31
mov dword [ebp - 4], ebx
call fcn.10026dd5
test eax, eax
je 0x10027a38
test byte [edi + 0xc], 0x10
jne 0x10027a38
xor eax, eax
jmp 0x10027b04
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call fcn.10026fd5
movzx eax, word [edi + 0xc]
neg esi
sbb esi, esi
shr eax, 1
and esi, 2
and eax, 0x10
mov dword [ebp - 0xc], esi
or eax, esi
jmp 0x10027ac7
mov eax, dword [edi]
cmp eax, ebx
je 0x10027a6c
push eax
call fcn.1003244b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x10027a78
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x10027a95
push dword [ebp - 4]
call fcn.10025006
push esi
call fcn.10026e6e
pop ecx
test eax, eax
je 0x10027ae8
push 0x796d7468
push ebx
call fcn.10026d67
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002720f
movzx eax, word [edi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
mov dword [ebp + 8], ebx
push ebx
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [edi + 8]
call fcn.1002726d
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x10027a5d
jmp 0x10027af5
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002713a
lea ecx, [ebp - 0x10]
call fcn.10026ff9
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop edi
pop ebx
leave
ret
Function at 0x10027ed2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x10027ee8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp + 0xc]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 2
pop ebx
mov esi, eax
cmp dword [ebp - 4], ebx
jae 0x10027f1a
cmp dword [ebp + 0xc], 1
je 0x10027f18
cmp dword [ebp + 0xc], ebx
jne 0x10027f1a
mov esi, ebx
push esi
call fcn.10026e6e
pop ecx
test eax, eax
je 0x10027f40
push 0x796d746b
push 0
call fcn.10026d67
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002720f
jmp 0x10027fa0
test esi, esi
jne 0x10027f93
cmp dword [ebp + 0xc], ebx
je 0x10027f4f
cmp dword [ebp + 0xc], 1
jne 0x10027f5b
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
cmp dword [ebp + 0xc], ebx
je 0x10027f65
cmp byte [ebp + 0x1c], bl
jne 0x10027f7e
mov eax, dword [ebp + 0x18]
shr eax, 1
push eax
push edi
call fcn.10025a0e
pop ecx
pop ecx
test eax, eax
jne 0x10027f7e
mov esi, 0xea
jmp 0x10027f93
movzx eax, byte [ebp + 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.10026dad
pop ecx
pop ecx
test eax, eax
jne 0x10027f93
mov esi, ebx
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002713a
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10027fa7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
or edi, 0xffffffff
cmp dword [ebp - 4], ebx
jne 0x10027fd1
cmp dword [0x10084718], ebx
je 0x10027fe0
mov dword [ebp - 0xc], 2
jmp 0x10027fed
cmp dword [ebp - 4], 1
jne 0x10027fe0
call fcn.10026dd5
test eax, eax
je 0x10027fea
test byte [esi + 0xc], 0x10
je 0x100280dd
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x18]
call fcn.10026fd5
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.1002726d
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x100280d3
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1002803a
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.10026e6e
pop ecx
test eax, eax
je 0x1002809f
push 0x796d746c
xor edi, edi
push edi
call fcn.10026d67
push ebx
mov ecx, 0x10086068
call fcn.1002720f
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], edi
call fcn.1002726d
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10028026
jmp 0x100280d3
push ebx
mov ecx, 0x10086068
call fcn.1002713a
test edi, edi
jne 0x100280d3
movzx eax, word [esi + 0xc]
mov ecx, eax
and ecx, 0xf
cmp dword [ebp - 0x14], ecx
je 0x100280f1
cmp dword [ebp - 0x14], 3
jne 0x100280d0
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 4
jne 0x100280d0
and al, 0xf
cmp al, 4
je 0x100280f1
push 2
pop edi
lea ecx, [ebp - 0x18]
call fcn.10026ff9
xor ebx, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10027fb8
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x18]
mov dword [eax], 1
call fcn.10026ff9
xor eax, eax
jmp 0x100280ec
Function at 0x10028326
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x1002833e
xor eax, eax
jmp 0x1002849b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.10026dd5
mov eax, dword [esi]
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x1002835b
push eax
call fcn.1003244b
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edi
push ebx
or ebx, 0xffffffff
cmp dword [ebp - 8], edi
jne 0x10028378
cmp dword [0x10084718], edi
je 0x10028387
mov dword [ebp - 0x18], 2
jmp 0x10028394
cmp dword [ebp - 8], 1
jne 0x10028387
call fcn.10026dd5
test eax, eax
je 0x10028391
test byte [esi + 0xc], 0x10
je 0x10028447
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], edi
call fcn.10026fd5
jmp 0x100283fe
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x100283ad
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
mov ebx, eax
jae 0x100283d8
cmp dword [ebp - 0x10], 1
je 0x100283d5
cmp dword [ebp - 0x10], 2
jne 0x100283d8
push 2
pop ebx
push ebx
call fcn.10026e6e
pop ecx
test eax, eax
je 0x1002842e
push 0x796d746f
push edi
call fcn.10026d67
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002720f
mov dword [ebp + 8], edi
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
mov dword [ebp - 0xc], edi
call fcn.1002726d
mov ebx, eax
add esp, 0x14
cmp ebx, edi
je 0x100283a1
jmp 0x1002843f
push dword [ebp + 8]
mov ecx, 0x10086068
call fcn.1002713a
cmp ebx, edi
je 0x10028456
lea ecx, [ebp - 0x1c]
call fcn.10026ff9
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x1002835f
jmp 0x1002845e
lea ecx, [ebp - 0x1c]
call fcn.10026ff9
cmp ebx, edi
jne 0x1002847d
cmp dword [ebp - 0x10], 2
je 0x10028471
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x1002847d
push dword [ebp - 4]
call fcn.10025aaa
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], edi
je 0x1002848a
push dword [ebp - 0x14]
call fcn.10025006
cmp ebx, edi
pop ebx
je 0x10028498
push esi
call fcn.10025e8c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x100284a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10028326
Function at 0x1002a381
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x10050190
call fcn.1004e649
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x1002a3bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x1002a3bf
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x1002a3bf
mov eax, dword [ecx + 0x50]
jmp 0x1002a3e0
mov ecx, 0x4550
cmp dx, cx
jne 0x1002a3ec
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x1002a3ec
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x1002a3ec
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x1002a3f0
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.1004e68e
ret

Function at 0x1002ab97
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1002abdd
push edi
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.10036d44
mov edi, eax
cmp edi, 0xffffffff
je 0x1002abdc
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret
Function at 0x1002bd3b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xffffffff
jne 0x1002bd4b
xor eax, eax
leave
ret
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
inc edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.1002bcd4
add esp, 0x10
test eax, eax
je 0x1002be98
cmp dword [ebp - 4], esi
je 0x1002be98
push ebx
mov ebx, 0x100896d8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.1002cc7a
pop ecx
test eax, eax
jne 0x1002bda6
xor edi, edi
jmp 0x1002be90
cmp dword [0x10089e0c], esi
je 0x1002bdb9
push esi
push 0x72766c72
call fcn.10026d28
lea eax, [ebp - 0x14]
push eax
mov dword [0x10089e0c], 1
mov dword [ebp - 0x14], esi
call fcn.1002ab03
pop ecx
cmp eax, dword [ebp - 8]
jne 0x1002bddd
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x1002be16
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.1002bd20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002bcd4
add esp, 0x18
test eax, eax
je 0x1002be09
cmp dword [ebp - 4], esi
jne 0x1002be16
push esi
push 0x72766c73
call fcn.10026d28
xor edi, edi
cmp dword [ebp + 0x14], esi
jne 0x1002be28
cmp dword [ebp - 8], 0xea60
ja 0x1002bd9f
cmp edi, esi
je 0x1002be42
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.1002ba8e
add esp, 0x10
mov edi, eax
mov dword [0x10089e0c], esi
push esi
cmp edi, esi
je 0x1002be86
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002be71
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x1002be71
xor edi, edi
inc edi
jmp 0x1002be73
xor edi, edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.1002ab97
add esp, 0xc
jmp 0x1002be90
push 0x74697970
call fcn.10026d28
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x1002beb3
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.1002bd20
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1002c16d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
jne 0x1002c18f
push edi
push 0x36717370
call fcn.10026d28
jmp 0x1002c2cc
push esi
mov esi, dword [ebp + 0x10]
cmp esi, edi
jne 0x1002c1a2
push edi
push 0x36717371
jmp 0x1002c2a1
cmp dword [ebp + 8], 2
je 0x1002c1bf
cmp dword [ebp + 8], 8
je 0x1002c1bf
cmp dword [ebp + 8], 3
je 0x1002c1bf
push edi
push 0x36717372
jmp 0x1002c2a1
cmp dword [ebx], edi
je 0x1002c1ce
push edi
push 0x36717373
call fcn.10026d28
cmp dword [esi], edi
je 0x1002c1dd
push edi
push 0x37667270
call fcn.10026d28
push esi
push edi
push dword [ebp + 8]
mov dword [esi], edi
call sub.Secur32.dll_GetUserNameExW
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x1002c2a8
cmp eax, 0xea
jne 0x1002c2a8
mov eax, dword [esi]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call fcn.10024ea1
mov dword [ebx], eax
test eax, eax
jne 0x1002c22c
push eax
push 0x36717375
jmp 0x1002c2af
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1002c24c
push 0
push 0x36717376
jmp 0x1002c2af
mov eax, dword [esi]
dec eax
cmp dword [ebp - 4], eax
je 0x1002c260
push 0
push 0x36717377
call fcn.10026d28
cmp edi, 2
jne 0x1002c27c
push dword [esi]
push dword [ebx]
call fcn.1002c0f9
pop ecx
pop ecx
test eax, eax
jne 0x1002c2cb
push eax
push 0x36717378
jmp 0x1002c2af
cmp edi, 8
jne 0x1002c295
push dword [ebx]
call fcn.1002ae9f
pop ecx
test eax, eax
jne 0x1002c2cb
push eax
push 0x36717379
jmp 0x1002c2af
cmp edi, 3
je 0x1002c2cb
push 0
push 0x3671737a
call fcn.10026d28
jmp 0x1002c2cb
push 0
push 0x36717374
call fcn.10026d28
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
je 0x1002c2c5
push eax
call fcn.1001fd7c
pop ecx
mov dword [ebx], edi
cmp dword [esi], edi
je 0x1002c2cb
mov dword [esi], edi
pop esi
pop edi
pop ebx
leave
ret