joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e48
Capabilities:
Encode data using xor

Disassembly:
call 0x403d35
mov ecx, 0x20d
call 0x403e48
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x403e4b
mov eax, 0x50402f9
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x409a32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x409a76
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x409a45
jmp 0x409a76
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x409a66
pop esi
pop ebp
ret

Function at 0x40a778
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40a7ad
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40a7d7
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40a7d7
test edi, edi
je 0x40a7a4
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40a7a4
test edi, edi
je 0x40a7df
mov eax, edi
jmp 0x40a7a6
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40a7a6
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040daee
add esp, 0xc
int3
Function at 0x40db22
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize], eax
call fcn.0040a778
pop ecx
mov ecx, dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize]
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40db5a
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.00402750
mov eax, dword [0x433100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0xfffc
push eax
mov word [ebp - 0x10004], ax
lea eax, [ebp - 0x10002]
push eax
call fcn.00402780
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x7fff
lea eax, [ebp - 0x10004]
push eax
push str.STEAM_COMPAT_PROTON
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
push 0
setne bl
call dword [sym.imp.KERNEL32.dll_SetLastError]
test bl, bl
pop ebx
jne 0x401460
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040273e
mov esp, ebp
pop ebp
ret
push 0xa
lea eax, [ebp - 0x10004]
push 0
push eax
call fcn.00402726
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0040273e
mov esp, ebp
pop ebp
ret

Function at 0x401510
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20004
call fcn.00402750
mov eax, dword [0x433100]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0xfffc
push eax
mov word [ebp - 0x20004], ax
lea eax, [ebp - 0x20002]
push eax
call fcn.00402780
xor eax, eax
push 0xfffc
push eax
mov word [ebp - 0x10004], ax
lea eax, [ebp - 0x10002]
push eax
call fcn.00402780
add esp, 0x18
lea eax, [ebp - 0x20004]
push 0x7fff
push eax
push 0x40e260
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x4341e0
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.004024ba
lea eax, [ebp - 0x20004]
push 0x7fff
push eax
call fcn.00402526
add esp, 0x14
test eax, eax
je 0x4015d6
push 0x40e25c
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.004024ba
lea eax, [ebp - 0x20004]
push eax
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.004024ba
add esp, 0x18
lea eax, [ebp - 0x10004]
push eax
push 0x40e260
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040273e
mov esp, ebp
pop ebp
ret
Function at 0x408d1a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x433100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [section..data]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404922
mov dword [ebp - 0x14], eax
cmp dword [0x444f30], esi
jne 0x408e0d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x408d9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x408eed
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x408eed
push 0x4101f8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x408eed
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x444f30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x444f34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x444f38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x444f40], eax
test eax, eax
je 0x408e0a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x444f3c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x408e32
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x408e25
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x408e47
push 4
pop eax
jmp 0x408eef
cmp dword [ebp - 0x14], esi
je 0x408e47
push dword [0x444f30]
call dword [0x413004]
push 3
jmp 0x408e2c
mov eax, dword [0x444f3c]
mov ebx, dword [0x413004]
cmp eax, edi
je 0x408ea5
cmp dword [0x444f40], edi
je 0x408ea5
push eax
call ebx
push dword [0x444f40]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x408ea5
test eax, eax
je 0x408ea5
call ecx
test eax, eax
je 0x408e9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x408e9a
test byte [ebp - 8], 1
jne 0x408ea5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x408ed5
mov eax, dword [0x444f34]
cmp eax, edi
je 0x408ed2
push eax
call ebx
test eax, eax
je 0x408ed2
call eax
mov esi, eax
test esi, esi
je 0x408ed2
mov eax, dword [0x444f38]
cmp eax, edi
je 0x408ed2
push eax
call ebx
test eax, eax
je 0x408ed2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x444f30]
call ebx
test eax, eax
je 0x408eed
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x408eef
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040273e
mov esp, ebp
pop ebp
ret
Function at 0x102e533
Capabilities:
Delete service
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov ebx, ecx
push 0x10032d4
push 0x5e
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], ebx
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::constructor_unsigned_long_int__char_const__
mov ecx, ebx
call fcn.0102de61
xor esi, esi
inc esi
cmp eax, esi
jne 0x102e56f
lea ecx, [ebp - 0xc]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::destructor_void_
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
xor esi, esi
cmp eax, esi
jl 0x102e560
push 0xf003f
push esi
push esi
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x102e597
push 0x10
push 0x68
mov ecx, ebx
call fcn.0102cefc
xor esi, esi
jmp 0x102e560
push 0x10020
push ebx
push edi
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x102e5b7
push edi
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
push 0x10
push 0x6a
jmp 0x102e58c
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.API_MS_WIN_Service_winsvc_L1_1_0.dll_ControlService]
push esi
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_DeleteService]
push esi
mov esi, dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
push 0x1001ab4
call sub.vdsutil.dll_unsigned_long_int___stdcall_RemoveEventSource_unsigned_short_int__
test ebx, ebx
je 0x102e5ef
xor esi, esi
inc esi
jmp 0x102e560
mov ecx, dword [ebp - 4]
push 0x10
push 0x6b
jmp 0x102e58e
Function at 0x1031ed9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x106b508]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1004330
mov esi, ecx
push 0x5e
lea ecx, [ebp - 0x21c]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::constructor_unsigned_long_int__char_const__
and dword [ebp - 0x20c], 0
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], 0x103139a
call dword [sym.imp.API_MS_WIN_Service_Core_L1_1_0.dll_StartServiceCtrlDispatcherW]
pop esi
test eax, eax
jne 0x1031f60
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
push eax
push 0x10042d0
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.0102f967
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.API_MS_Win_Core_Debug_L1_1_0.dll_OutputDebugStringW]
lea ecx, [ebp - 0x21c]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::destructor_void_
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010634db
leave
ret

Function at 0x1031f7c
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x106b508]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_HeapSetInformation]
test eax, eax
jne 0x1031fca
mov esi, dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
call esi
push eax
push 0x1004384
push edi
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
call esi
jmp 0x1032061
push ebx
push edi
push 0x64
push esi
mov ebx, 0x106b6a0
push 0x106b010
mov ecx, ebx
call fcn.010311ee
mov esi, 0x100437c
lea edi, [ebp - 0xc]
lea eax, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x10]
movsw word es:[edi], word [esi]
call fcn.0102cd79
mov esi, eax
call dword [sym.imp.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_GetCommandLineW]
test esi, esi
je 0x1032054
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x1004364
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1032071
push 0x1004354
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x1032084
push 2
push 0x100434c
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1032044
mov dword [0x106b700], 1
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.0102cd79
mov esi, eax
test esi, esi
jne 0x1032009
mov ecx, ebx
call fcn.01031ed9
mov eax, dword [0x106b6e4]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.010634db
leave
ret 0x10
mov ecx, ebx
call fcn.01031183
mov esi, eax
test esi, esi
jl 0x103209e
push 0
push 0x67
jmp 0x1032097
push 0
mov ecx, ebx
call fcn.01030e43
mov esi, eax
test esi, esi
jl 0x103209e
push 0
push 0x66
mov ecx, ebx
call fcn.0102cefc
mov eax, esi
jmp 0x1032060
Function at 0x1032a18
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x106b508]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
push 0x1004580
push 0x5e
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x10c], eax
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::constructor_unsigned_long_int__char_const__
xor esi, esi
lea eax, [ebp - 0x128]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x118], 0x40
push ebx
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x110], 0x80
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, esi
je 0x1032abd
cmp ebx, 0x103
je 0x1032bae
push ebx
push 0x1004554
push esi
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
jmp 0x1032bae
push edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov edi, eax
cmp edi, esi
jge 0x1032af9
push edi
push 0x1004528
push esi
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
push esi
lea eax, [ebp - 0x84]
push eax
push 0x2000007
push edi
push esi
push esi
push 0xc200000c
jmp 0x1032b9e
lea eax, [ebp - 0x108]
push eax
push 0x2000000
push esi
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x114]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
je 0x1032b27
push ebx
push 0x10044fc
jmp 0x1032aad
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push esi
push str.Clsid
push dword [ebp - 0x108]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ebx, eax
cmp ebx, esi
je 0x1032b59
push ebx
push 0x10044d0
jmp 0x1032aad
push dword [ebp - 0x10c]
xor eax, eax
mov word [ebp - 0x86], ax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov edi, eax
cmp edi, esi
jge 0x1032bd7
push edi
push 0x10044a4
push esi
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
push esi
lea eax, [ebp - 0x84]
push eax
push 0x2000008
push edi
push esi
push esi
push 0xc200000d
call fcn.0102cde4
add esp, 0x2c
and edi, 0xffff
mov ebx, edi
cmp ebx, esi
je 0x1032bd7
cmp ebx, 0x103
je 0x1032bd7
push esi
lea eax, [ebp - 0x84]
push eax
push 0x2000009
push ebx
push esi
push esi
push 0xc200000e
call fcn.0102cde4
add esp, 0x1c
cmp dword [ebp - 0x108], esi
je 0x1032bf4
cmp dword [ebp - 0x108], 0xffffffff
je 0x1032bf4
push dword [ebp - 0x108]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea ecx, [ebp - 0x120]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::destructor_void_
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.010634db
leave
ret 0x10
Function at 0x1033696
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x1005444
push 0x5e
lea ecx, [ebp - 8]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::constructor_unsigned_long_int__char_const__
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_GetDriveTypeW]
cmp eax, 3
je 0x10336e0
push eax
push 0x10053f8
push 3
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
xor esi, esi
inc esi
lea ecx, [ebp - 8]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::destructor_void_
mov eax, esi
pop esi
leave
ret 4
mov ax, word [esi]
mov ecx, dword [0x106b754]
mov word [ecx], ax
mov ax, word [esi]
mov ecx, dword [0x106b76c]
xor esi, esi
push esi
push 0x106b754
push 0x1f6
push esi
mov word [ecx], ax
call sub.srvcli.dll_NetShareAdd
cmp eax, esi
je 0x10336ce
mov ecx, 0x846
cmp eax, ecx
jne 0x1033722
push ecx
push 0x10053c0
push 1
jmp 0x1033729
push eax
push 0x10053c0
push esi
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
jmp 0x10336d1
Function at 0x10612a6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x1029ef0
push 0x5e
lea ecx, [ebp - 8]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::constructor_unsigned_long_int__char_const__
push 0x106ba40
xor esi, esi
push esi
push dword [ebp + 8]
push 0x1060e0e
push esi
push esi
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateThread]
mov dword [0x106ba3c], eax
cmp eax, esi
jne 0x1061304
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
push edi
push 0x1029ec4
push esi
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
lea ecx, [ebp - 8]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::destructor_void_
mov eax, edi
jmp 0x1061356
xor edi, edi
push 0x1f4
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
push esi
push esi
push 0x400
push dword [0x106ba40]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
inc edi
cmp eax, esi
jne 0x106134c
cmp edi, 0x258
jle 0x1061306
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
push edi
push 0x1029e94
push esi
push 0x5e
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char__
add esp, 0x10
mov esi, edi
lea ecx, [ebp - 8]
call sub.vdsutil.dll_public:_void___thiscall_CVdsCallTracer::destructor_void_
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x10634a9
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x10652b0
call fcn.010634f0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x106bdbc
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1063264
cmp eax, esi
jne 0x1063257
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1063267
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x106323e
xor esi, esi
inc esi
mov eax, dword [0x106bdb8]
cmp eax, esi
jne 0x106327a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10632a9
mov eax, dword [0x106bdb8]
test eax, eax
jne 0x10632a3
mov dword [0x106bdb8], esi
push 0x10015b4
push 0x10015a8
call fcn.010631a0
pop ecx
pop ecx
test eax, eax
je 0x10632a9
jmp 0x10633cd
mov dword [0x106ba60], esi
mov eax, dword [0x106bdb8]
cmp eax, esi
jne 0x10632cd
push 0x10015a4
push 0x100156c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x106bdb8], 2
cmp dword [ebp - 0x20], ebx
jne 0x10632da
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x106bdc8], ebx
je 0x10632fb
push 0x106bdc8
call fcn.01063839
pop ecx
test eax, eax
je 0x10632fb
push ebx
push 2
push ebx
call dword [0x106bdc8]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10633cd
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1063365
cmp cx, bx
je 0x1063320
cmp dword [ebp - 0x1c], ebx
jne 0x1063365
movzx ecx, word [eax]
cmp cx, bx
je 0x1063335
cmp cx, 0x20
ja 0x1063335
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1063320
test byte [ebp - 0x40], 1
je 0x1063341
movzx ecx, word [ebp - 0x3c]
jmp 0x1063344
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x106ba5c], eax
cmp dword [0x106ba50], ebx
jne 0x10633aa
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1063376
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x106330a
cmp dword [0x106ba60], ebx
jne 0x10633b8
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x106ba5c]
jmp 0x10633d9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01063535
ret
call fcn.0106397e
jmp 0x1063201
Function at 0x1064561
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x106b508]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x218], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 7
xor eax, eax
and dword [esi], eax
pop ecx
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
or dword [ebp - 0x238], 0xffffffff
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10645f6
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jg 0x10645ea
mov dword [ebp - 0x210], eax
jmp 0x10646b9
and eax, 0xffff
or eax, 0x80070000
jmp 0x10645df
push 0x102bc70
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01064490
mov dword [ebp - 0x210], eax
test eax, eax
jl 0x10646b9
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1064654
mov esi, dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetProcAddress]
push 0x102bc60
push ebx
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x1064670
push 0x102bc4c
push ebx
call esi
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x1064692
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jle 0x1064668
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x10646ad
push 0x102bc3c
push ebx
call esi
mov dword [ebp - 0x230], eax
test eax, eax
je 0x1064654
push 0x102bc2c
push ebx
call esi
mov dword [ebp - 0x224], eax
jmp 0x1064650
mov eax, dword [ebp - 0x218]
mov edi, dword [ebp - 0x214]
push 8
mov dword [eax], ebx
pop ecx
lea esi, [ebp - 0x238]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
je 0x10646b8
push ebx
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_FreeLibrary]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.010634db
leave
ret 8