joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d6d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000d6ea
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
invalid
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d72f
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b68
jmp 0x1000d767
push 0x100146b0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d75d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b64
jmp 0x1000d767
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000db40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000db5a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 8]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000dba0
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000dbba
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
in al, 0xc7
inc eax
or byte [eax], al
add byte [eax], al
add bh, al
inc ebp
cld
add dword [eax], eax
add byte [eax], al
pop eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push bind
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000dc6c
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
je 0x1000dc53
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0x124
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.100050c0
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1000dca4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1000e52a
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
inc ebp
or byte [eax + 0x68], dl
inc esi
pop ds
add byte [eax], al
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f46
mov ecx, dword [ebp - 0xc]
add ecx, 0xb4
call fcn.10004ad0
and eax, eax
je 0x1000e561
mov ecx, dword [ebp + 8]
push ecx
push 0x1f53
mov ecx, dword [ebp - 0xc]
add ecx, 0x1c8
call fcn.10004ad0
and eax, eax
jne 0x1000e565
xor eax, eax
jmp 0x1000e5ce
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x1000dff0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x1000e2b0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 8], 0
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2dc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x2e0]
mov dword [ebp - 4], edx
push 0xffffffffffffffff
push 1
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10010130
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x10010148
sub dword [edx], ebp
sub ebx, dword [eax - 0x75]
jge 0x10010148
pop eax
mov edi, dword [ebp - 4]
add edi, 8
mov ecx, 0x18
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 4]
push edx
push 0
push 0x10010050
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10010340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x1001035a
sub dword [edx], ebp
sub ebx, dword [eax - 0x39]
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7fff00
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
ja 0x10010445
push 0
lea ecx, [ebp - 8]
push ecx
push 1
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
and eax, eax
je 0x100103aa
cmp dword [ebp - 8], 0
jne 0x100103b1
xor eax, eax
jmp 0x10010448
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov al, byte [ebp - 0x14]
mov byte [edx], al
movsx ecx, byte [ebp - 0x14]
cmp ecx, 0x3e
jne 0x10010437
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 5
jb 0x10010435
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x3e
jne 0x10010435
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 2]
cmp eax, 0x52
jne 0x10010435
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 3]
cmp edx, 0x49
jne 0x10010435
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 4]
cmp ecx, 0x44
jne 0x10010435
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 5]
cmp eax, 0x3c
jne 0x10010435
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp ecx, 0x50
jge 0x10010435
jmp 0x1001037b
jmp 0x10010445
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1001037b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10010970
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
push edi
mov dword [ebp - 0x15c], ecx
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x10010990
sub dword [edx], ebp
sub ebx, dword [eax - 0x47]
adc dword [eax], eax
add byte [eax], al
pop eax
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x148]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x148], 0x44
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x114], 0
mov word [ebp - 0x116], 0
mov dword [ebp - 0x11c], 0x101
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x108], edx
mov word [ebp - 0x118], 0
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0x10014300
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
and eax, eax
jne 0x10010a26
xor eax, eax
jmp 0x10010aa2
mov edi, 0x1001465c
lea edx, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x148]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
and eax, eax
jne 0x10010a8e
xor eax, eax
jmp 0x10010aa2
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
mov dword [eax + 0x24], ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10010f20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
nop
nop
nop
je 0x10010f3a
sub dword [edx], ebp
sub ebx, dword [eax - 0x7d]
jge 0x10010f4a
pop eax
cmp dword [ebp + 0xc], 1
jne 0x10010f75
add dword [ebp + 0x34], esi
mov eax, dword [ebp + 8]
mov dword [0x10014864], eax
mov word [ebp - 0x190], 0
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0x18e]
mov dword [ebp - 0x190], 0x63b90000
add byte [eax], al
add byte [ebx], dh
ror byte [ebp - 0x18d43], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x190]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5c26a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5cad70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005c0781
mov dword [ebp - 0x14], eax
cmp dword [0xc46968], esi
jne 0x5c2798
push 0x800
push esi
push 0x5cc2fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5c2725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5c2878
push esi
push esi
push 0x5cc2fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5c2878
push 0x5cc314
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5c2878
push eax
call ebx
push 0x5cc320
push edi
mov dword [0xc46968], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5cc330
push edi
mov dword [0xc4696c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5cc344
push edi
mov dword [0xc46970], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xc46978], eax
test eax, eax
je 0x5c2795
push 0x5cc360
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xc46974], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5c27bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5c27b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5c27d2
push 4
pop eax
jmp 0x5c287a
cmp dword [ebp - 0x14], esi
je 0x5c27d2
push dword [0xc46968]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5c27b7
mov eax, dword [0xc46974]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x5c2830
cmp dword [0xc46978], edi
je 0x5c2830
push eax
call ebx
push dword [0xc46978]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5c2830
test eax, eax
je 0x5c2830
call ecx
test eax, eax
je 0x5c2825
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5c2825
test byte [ebp - 8], 1
jne 0x5c2830
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5c2860
mov eax, dword [0xc4696c]
cmp eax, edi
je 0x5c285d
push eax
call ebx
test eax, eax
je 0x5c285d
call eax
mov esi, eax
test esi, esi
je 0x5c285d
mov eax, dword [0xc46970]
cmp eax, edi
je 0x5c285d
push eax
call ebx
test eax, eax
je 0x5c285d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xc46968]
call ebx
test eax, eax
je 0x5c2878
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5c287a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c288b
mov esp, ebp
pop ebp
ret
Function at 0x710c6c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7109ec
mov ebx, ebx
inc ebx
push ebx
pop esi
call fcn.00710ca8
mov esi, 0x10fd65a8
sub ebx, ebx
xor dword [edx], eax
add ebx, ebx
add esi, 0x6d63ffd9
inc edx
and ebx, esi
or ebx, esi
cmp edx, ecx
jne fcn.00710c6c
sub esp, 4
mov dword [esp], 0x4a6f4930
pop ebx
ret
Function at 0x20001130
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
xor esi, esi
call dword [0x2001a160]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x20001155
pop esi
add esp, 0x14
ret 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
neg ecx
lea edx, [esp + 0xc]
mov dword [esp + 8], 1
sbb ecx, ecx
push edx
and ecx, 2
push eax
push 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
test eax, eax
je 0x2000119c
mov edx, dword [esp + 4]
push 0
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [0x2001a260]
mov eax, esi
pop esi
add esp, 0x14
ret 8
Function at 0x200011b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push esi
push edi
push 0x104
push eax
call dword [0x2001a2a4]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x200219e4
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [0x2001a268]
lea edx, [esp + 0x14]
push edx
call dword [0x2001a234]
lea ebx, [esp + eax + 0x14]
mov eax, dword [0x20021090]
or ecx, 0xffffffff
push ebx
lea edi, [eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.20008c00
mov edi, 0x200225a8
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x28]
push 2
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x2001a2e4]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x20001351
mov esi, dword [0x20021090]
mov ecx, 0x17e
lea edi, [esp + 0x21c]
push 0
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [0x2001a358]
push eax
call dword [0x2001a354]
mov edi, dword [0x2001a34c]
add esp, 8
call edi
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fmul qword [0x2001a770]
call fcn.200196c0
test al, al
je 0x200012c1
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x200012df
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x224]
push 0x5f8
push edx
push ebx
call dword [0x2001a304]
push ebx
call dword [0x2001a260]
mov edi, str.LzWAzPZ_7Wp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.2000f280
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x808
ret
Function at 0x20001470
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x20019ca3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.20004600
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x2001a780
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.2001967e
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x200014d7
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.20014f10
jmp 0x200014d9
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x2000a4d0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.2000f020
push 1
push ebx
push ebx
push esi
push 0x200084c0
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.2000f020
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x20001c10
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x20019cb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x2001a780
mov edi, dword [0x2001a298]
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call edi
lea ecx, [esi + 0x10]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov edi, dword [0x2001a280]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edi, dword [0x2001a260]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x20001c87
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.20010900
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x20001e90
Capabilities:
Get session information

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
mov ebx, eax
cmp ebx, esi
je 0x20001ff6
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [0x2001a0a0]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x2001a32c]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.2001967e
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x20001fc6
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x20001fb2
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x2001a320]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.20012350
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x20001f66
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call fcn.2000f9c0
mov eax, dword [esp + 0x28]
push eax
call dword [0x2001a328]
push ebp
call fcn.20019684
add esp, 8
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x20002340
Capabilities:
Get session information
Monitor local ipv4 address changes

Disassembly:
sub esp, 0x400
push esi
push edi
push 0
push 0
push 0x20021cf8
push 1
push 0x20021ce4
push 0x20021cac
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.20005f60
mov ecx, 0xc
mov esi, 0x20021c78
lea edi, [esp + 0x24]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xf3
lea edi, [esp + 0x55]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0
stosb byte es:[edi], al
push 0
push 4
lea eax, [esp + 0x34]
push 0x20021c64
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.20005f60
mov esi, dword [0x2001a268]
add esp, 0x38
lea ecx, [esp + 8]
push 0x20021c54
push ecx
call esi
push 0
push 1
push 0
push 4
lea edx, [esp + 0x18]
push 0x20021c38
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.20005f60
add esp, 0x1c
lea eax, [esp + 8]
push 0x20021c20
push 0x5c
push eax
call dword [0x2001a344]
mov edi, dword [0x2001a248]
add esp, 8
push eax
call edi
mov ecx, dword [esp + 0x410]
push 0
push ecx
push 0
push 4
lea edx, [esp + 0x18]
push 0x20021c14
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.20005f60
add esp, 0x1c
lea eax, [esp + 8]
push 0x20021be4
push eax
call edi
push 0
push 2
push 0
push 4
lea ecx, [esp + 0x18]
push 0x20021bdc
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.20005f60
add esp, 0x1c
lea edx, [esp + 8]
push 0x20021bd0
push edx
call esi
mov eax, dword [esp + 0x40c]
push 0
push 0
push eax
push 2
lea ecx, [esp + 0x18]
push 0x20021bc4
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.20005f60
add esp, 0x1c
push 0xf003f
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
mov edi, eax
test edi, edi
je 0x2000254f
mov esi, dword [sym.imp.iphlpapi.dll_NotifyAddrChange]
push ebp
push 0xf01ff
push 0x20021bb8
push edi
call esi
mov ebp, eax
test ebp, ebp
je 0x2000251a
push ebx
push ebp
call fcn.2000f1a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x20002507
push 0xf01ff
push 0x20021bac
push edi
call esi
mov esi, eax
push 1
push esi
call fcn.2000a460
push 0
push ebx
call fcn.2000be00
push esi
call fcn.2000f1a0
add esp, 0x14
test eax, eax
jne 0x20002500
mov ebx, dword [0x2001a270]
push 0x7d0
call ebx
push esi
call fcn.2000f1a0
add esp, 4
test eax, eax
je 0x200024ec
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push 0
push 0
push ebp
call dword [sym.imp.WS2_32.dll_socket]
push ebp
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
pop ebx
push edi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov edx, dword [0x20021090]
lea eax, [esp + 0xc]
add edx, 0x128
push edx
push 0x20021b24
push eax
call dword [0x2001a4fc]
add esp, 0xc
lea ecx, [esp + 0xc]
push 0
push ecx
call dword [0x2001a2b4]
pop ebp
pop edi
pop esi
add esp, 0x400
ret