joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001139
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001174
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001170
lea ebx, [ebx]
cmp esi, eax
jae 0x10001174
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001160
cmp esi, eax
jb 0x1000117a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x100033f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
cmp word [eax + 6], 0
mov dword [esp + 8], ecx
movzx ecx, word [eax + 0x14]
push ebp
push esi
push edi
lea ecx, [ecx + eax + 0x18]
mov dword [esp + 0x10], 0
jbe 0x100034ce
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ecx + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x10003464
mov edx, dword [esp + 0x24]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x100034ae
mov eax, dword [esi - 4]
push 4
push 0x1000
push edi
add eax, ebx
push eax
call ebp
test eax, eax
je 0x100034dd
mov eax, dword [esi - 4]
push edi
add eax, ebx
push 0
push eax
mov dword [esi - 8], eax
call fcn.10003290
jmp 0x100034ab
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x20]
add ecx, eax
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.100033d0
test eax, eax
je 0x100034dd
mov eax, dword [esi]
mov ecx, dword [esi - 4]
push 4
push 0x1000
push eax
add ecx, ebx
push ecx
call ebp
test eax, eax
je 0x100034dd
mov eax, dword [esi + 4]
mov edx, dword [esi]
add eax, dword [esp + 0x1c]
mov edi, dword [esi - 4]
push edx
add edi, ebx
push eax
push edi
call fcn.100032c0
mov dword [esi - 8], edi
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
mov eax, dword [esp + 0x10]
movzx ecx, word [edx + 6]
add eax, 1
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x10003428
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0x10
Function at 0x100035d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov ebx, dword [ebp + 0x30]
push esi
mov esi, dword [ebp]
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
mov eax, dword [edi + 8]
sub ebx, 1
not ebx
push edi
and ebx, eax
push ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
call fcn.100034f0
mov ecx, dword [edi + 0x24]
mov dword [esp + 0x24], eax
mov eax, 1
add edi, 0x28
cmp word [esi + 6], ax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], eax
jbe 0x100036ef
nop
mov esi, dword [ebp + 0x30]
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x10]
sub esi, 1
push edi
not esi
push ebp
mov dword [esp + 0x3c], eax
and esi, eax
call fcn.100034f0
cmp ebx, esi
mov dword [esp + 0x18], eax
je 0x10003698
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
add edx, ecx
cmp edx, esi
ja 0x10003698
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebp
call fcn.10003520
test eax, eax
je 0x10003712
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 0x24]
mov ebx, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
jmp 0x100036cd
mov ecx, dword [edi + 0x24]
test ecx, 0x2000000
je 0x100036b3
test dword [esp + 0x28], 0x2000000
je 0x100036b3
or dword [esp + 0x28], ecx
jmp 0x100036c1
or ecx, dword [esp + 0x28]
and ecx, 0xfdffffff
mov dword [esp + 0x28], ecx
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov ecx, dword [ebp]
mov eax, dword [esp + 0x14]
movzx edx, word [ecx + 6]
add eax, 1
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x10003630
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.10003520
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x10003e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20
xor eax, eax
cmp dword [esp + 0x2c], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
jbe 0x1000405d
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
jmp 0x10003e75
mov eax, dword [esp + 0x1c]
add eax, 1
xor edx, edx
div dword [0x1004312c]
mov ecx, dword [0x10043138]
mov edi, dword [0x10043134]
mov ebx, edx
mov edx, dword [0x10043130]
mov eax, edx
imul eax, ecx
imul eax, ecx
lea ebp, [eax + eax*4 + 5]
mov eax, dword [0x1004313c]
imul ebp, eax
lea eax, [eax + eax*4 - 5]
imul eax, edx
mov edx, dword [0x10043140]
add eax, ebx
mov dword [esp + 0x20], eax
lea eax, [edx + 1]
imul eax, edi
mov edx, dword [esp + 0x20]
lea eax, [eax + eax*4]
add ebp, 5
imul ebp, ecx
add edx, ebp
add eax, edx
movzx eax, byte [eax + esi]
add eax, dword [esp + 0x14]
xor edx, edx
div dword [0x1004312c]
mov ebp, dword [0x10043140]
lea eax, [ecx + 2]
imul eax, dword [0x10043130]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], edx
mov edx, edi
imul edx, ebp
add eax, edx
sub eax, dword [0x1004313c]
add eax, ecx
lea edx, [ebx + eax*2]
add edx, eax
movzx eax, byte [edx + esi]
mov byte [esp + 0x13], al
lea eax, [edi + ecx]
imul eax, edi
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x14]
sub eax, edx
mov edx, edi
sub edx, ebp
sub edx, 3
imul edx, dword [0x10043130]
add ecx, 1
imul ecx, edi
sub edx, ecx
mov dword [esp + 0x20], eax
mov ecx, ebp
lea eax, [edx + ecx*2]
lea edx, [ebx + eax*2]
add edx, eax
mov eax, dword [esp + 0x20]
movzx eax, byte [eax + esi]
mov byte [edx + esi], al
mov ecx, dword [0x10043138]
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx]
movzx ecx, byte [esp + 0x13]
sub eax, edx
mov byte [eax + esi], cl
mov ecx, dword [0x10043140]
mov edx, dword [0x1004313c]
mov edi, dword [0x10043130]
mov eax, ecx
imul eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [0x10043134]
imul eax, edx
lea ebp, [ecx + 1]
mov dword [esp + 0x28], eax
imul ebp, edi
sub ebp, eax
mov eax, dword [esp + 0x18]
lea eax, [eax + ebp*4]
mov ebp, dword [esp + 0x38]
add eax, ebp
mov dword [esp + 0x2c], eax
mov eax, edx
sub eax, ecx
add eax, 2
imul eax, edi
mov edi, dword [0x10043138]
add eax, ecx
lea eax, [eax + edi*2]
add ebx, eax
mov dword [esp + 0x20], eax
mov eax, ecx
imul eax, edi
lea eax, [eax + eax*2]
mov ebp, 3
sub ebp, eax
mov eax, dword [esp + 0x20]
imul ebp, edx
sub ebp, 3
imul ebp, dword [0x10043134]
lea eax, [ebx + eax*2]
add ebp, eax
movzx eax, byte [esi + ebp]
mov ebx, edi
imul ebx, edi
or ebp, 0xffffffff
sub ebp, edx
imul ebp, dword [esp + 0x24]
add ebx, 1
imul ebx, edi
sub ebp, ebx
sub ebp, dword [esp + 0x28]
mov ebx, dword [0x10043134]
sub ebp, edx
add ebp, ebx
add ebp, dword [esp + 0x14]
movzx edx, byte [esi + ebp]
add eax, edx
xor edx, edx
div dword [0x1004312c]
lea eax, [ecx + ecx*2]
mov ecx, 3
sub ecx, eax
imul ecx, ebx
lea eax, [edi + edi*2]
add edx, ecx
sub edx, eax
movzx ecx, byte [edx + esi]
mov eax, dword [esp + 0x2c]
xor byte [eax], cl
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
jb 0x10003e71
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10004520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp method.CAboutDlg.virtual_312
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x10008ae5
cmp dword [edi + 0x54], 0
jne 0x10008ae5
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1000fd61
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.10008a8c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x10004950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x38
mov eax, dword [0x100445fc]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x40]
mov dword [0x10045ac0], edi
mov dword [0x10045ac4], eax
mov dword [0x10045ac8], ecx
call fcn.10004410
test eax, eax
jne 0x10004b64
push ebx
push ebp
push esi
xor esi, esi
mov eax, 0x65
push 0x10036d28
mov ecx, 0x64
mov word [esp + 0x2e], ax
mov edx, 0x6e
mov word [esp + 0x34], ax
mov eax, 0x6c
push 0x1ce7
mov ebx, 0x2e
push edi
mov dword [0x10043130], esi
mov dword [0x10043134], esi
mov dword [0x10043138], esi
mov dword [0x10043140], esi
mov dword [0x1004313c], esi
mov word [esp + 0x34], 0x6b
mov word [esp + 0x38], 0x72
mov word [esp + 0x3a], dx
mov word [esp + 0x3e], ax
mov word [esp + 0x40], 0x33
mov word [esp + 0x42], 0x32
mov word [esp + 0x44], bx
mov word [esp + 0x46], cx
mov word [esp + 0x48], ax
mov word [esp + 0x4a], ax
mov word [esp + 0x4c], si
mov word [esp + 0x20], dx
mov word [esp + 0x22], 0x74
mov word [esp + 0x24], cx
mov word [esp + 0x26], ax
mov word [esp + 0x28], ax
mov word [esp + 0x2a], bx
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], ax
mov word [esp + 0x30], ax
mov word [esp + 0x32], si
call dword [sym.imp.KERNEL32.dll_FindResourceW]
lea edx, [esp + 0x28]
push edx
mov ebx, eax
call fcn.10004070
mov ebp, eax
lea eax, [esp + 0x18]
push eax
call fcn.10004070
add esp, 8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0x45ae4f1b
push ebp
mov dword [esp + 0x18], eax
call fcn.100041b0
add esp, 8
push ebx
push edi
mov dword [0x10045abc], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x2c5de75e
push ebp
mov edi, eax
call fcn.100041b0
add esp, 8
cmp eax, esi
mov dword [0x10045ab8], eax
je 0x10004adc
push esi
push 0x10036d24
call fcn.10020c3a
add esp, 4
push eax
push str.8192
call fcn.10020c3a
add esp, 4
or eax, 0x1000
push eax
push edi
push esi
push 0xffffffffffffffff
call dword [0x10045ab8]
jmp 0x10004b05
push 0x10036d24
call fcn.10020c3a
add esp, 4
push eax
push str.8192
call fcn.10020c3a
add esp, 4
or eax, 0x1000
push eax
push edi
push esi
call dword [0x10045abc]
mov ecx, dword [esp + 0x10]
push edi
mov esi, eax
push ecx
push esi
call fcn.10020c40
mov edx, dword [0x1004312c]
push edx
call fcn.10020940
push 0x2e
mov ebx, eax
push str.LW0_H_rJy__XSUpyW7lpkFaVVA2L_Zk_lDR3_B_raI_
push ebx
call fcn.10003b50
push edi
push esi
push ebx
call fcn.10003e50
add esp, 0x28
push edi
push esi
mov ecx, 0x10045aa4
call fcn.10004920
pop esi
pop ebp
pop ebx
mov dword [0x10045acc], eax
mov eax, 1
pop edi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100205e4
add esp, 0x38
ret 0xc
push 0x10036cf8
call fcn.10020b64
mov ecx, dword [esp + 0x3c]
add esp, 4
pop edi
xor ecx, esp
xor eax, eax
call fcn.100205e4
add esp, 0x38
ret 0xc
Function at 0x10009085
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x100090cb
call fcn.1000fd61
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x100090cb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x1000910e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x100090f7
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x100090f7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x1000910b
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1000eba2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x1000ebe5
call fcn.1000fd61
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1000ebe5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1000ec00
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.1000e759
test ebx, ebx
mov esi, eax
je 0x1000ebfe
test edi, edi
je 0x1000ebfe
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1000f2a6
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10033f21
call fcn.100219f4
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1000f2cb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1000f317
call fcn.10005f6c
push eax
lea ecx, [ebp - 0x10]
call fcn.100013c0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100057df
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100011d0
mov eax, esi
call fcn.10021acc
ret 8
Function at 0x100205e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100445fc]
jne 0x100205ee
repz ret
jmp fcn.1002811c

Function at 0x1002e82c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10025378
xor ebx, ebx
cmp dword [0x100483ac], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1002e901
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1002e86c
xor eax, eax
jmp 0x1002e9c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1003b258
push edi
call esi
cmp eax, ebx
je 0x1002e865
push eax
call fcn.10025315
mov dword [esp], 0x1003b248
push edi
mov dword [0x100483ac], eax
call esi
push eax
call fcn.10025315
mov dword [esp], 0x1003b234
push edi
mov dword [0x100483b0], eax
call esi
push eax
call fcn.10025315
mov dword [0x100483b4], eax
lea eax, [ebp - 8]
push eax
call fcn.10021e08
test eax, eax
pop ecx
pop ecx
je 0x1002e8cf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100258bb
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1002e901
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10025315
cmp eax, ebx
pop ecx
mov dword [0x100483bc], eax
je 0x1002e901
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10025315
pop ecx
mov dword [0x100483b8], eax
mov eax, dword [0x100483b8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1002e97a
cmp dword [0x100483bc], esi
je 0x1002e97a
push eax
call fcn.10025381
pop ecx
call eax
cmp eax, ebx
je 0x1002e947
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x100483bc]
call fcn.10025381
pop ecx
call eax
test eax, eax
je 0x1002e947
test byte [ebp - 0x18], 1
jne 0x1002e97a
lea eax, [ebp - 0xc]
push eax
call fcn.10021e3f
test eax, eax
pop ecx
je 0x1002e962
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100258bb
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1002e971
or dword [ebp + 0x10], 0x200000
jmp 0x1002e9ab
or dword [ebp + 0x10], 0x40000
jmp 0x1002e9ab
mov eax, dword [0x100483b0]
cmp eax, esi
je 0x1002e9ab
push eax
call fcn.10025381
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1002e9ab
mov eax, dword [0x100483b4]
cmp eax, esi
je 0x1002e9ab
push dword [ebp - 4]
push eax
call fcn.10025381
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x100483ac]
call fcn.10025381
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5d9fb9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5d9fd4
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x1249f1f9]
pop edx
test eax, eax
je 0x5da0a6
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5da095
test dword [ebp - 0x2a8], 1
jne 0x5da095
and dword [ebp - 0x2a8], 0x100
jne 0x5da095
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2e29]
pop edx
pop esi
test eax, eax
je 0x5da038
jmp 0x5da095
cmp word [esi], 0x5a4d
jne 0x5da095
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5da095
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2d4d]
pop edx
test eax, eax
je 0x5da095
lea eax, [ebp - 0x28c]
push eax
call fcn.005d9f15
test eax, eax
jne 0x5da08e
jmp 0x5da095
mov eax, esi
jmp 0x5da0a6
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5d9fd4
pop esi
leave
ret 4
Function at 0x10021cd9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x1001e618], eax
je 0x10021cfb
cmp dword [0x1001e618], ebx
jne 0x10021d94
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x1001e618
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1001e618], esi
test esi, esi
jne 0x10021d6a
mov dword [0x1001e618], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x1001e618
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x1001e618]
not eax
mov dword [0x1013b1e4], eax
pop esi
pop ebx
leave
ret

Function at 0x1002238e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e618]
jne fcn.100c170c
ret
Function at 0x10023692
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], eax
mov eax, dword [0x1013b7d0]
push ebx
mov ebx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x1002386d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov dword [ebp - 0x2a0], edi
test edi, edi
je 0x1002386c
push esi
xor esi, esi
cmp dword [edi], esi
jne 0x1002386b
mov dword [edi], 1
cmp ebx, 0x7e
ja 0x10023869
mov ebx, dword [edi + ebx*4 + 4]
mov dword [ebp - 0x2a4], ebx
test ebx, ebx
je 0x10023869
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0x14]
and eax, 3
add esp, 0xc
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x298], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push ebx
mov dword [ebp - 0x294], eax
call fcn.100cd88b
cmp eax, dword [ebx + 0x24]
jg 0x1002378e
mov ecx, dword [ebx + 0x48]
cmp ecx, dword [ebx + 0x44]
jae 0x1002378e
test byte [ebx + 4], 1
jne 0x1002378e
test dword [ebx + 4], 0x400
jne 0x1002378e
test byte [ebp + 0x14], 0x10
jne 0x1002378e
cmp dword [0x10141898], esi
je 0x1002378e
push esi
lea eax, [ebp - 0x28c]
push eax
push 0x20
push 1
call dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
movzx eax, ax
mov dword [ebp - 0x290], eax
jmp 0x10023790
mov eax, esi
mov edi, dword [ebp - 0x298]
mov esi, ebx
mov ebx, dword [ebp - 0x29c]
push ebx
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.100cd980
test byte [esi + 4], 2
jne 0x100237cf
mov esi, dword [esi]
mov eax, dword [ebp - 0x290]
test esi, esi
jne 0x1002379e
mov ebx, dword [ebp - 0x2a4]
test edi, edi
mov edi, dword [ebp - 0x2a0]
jne 0x10023816
test byte [0x1010ac00], 2
je 0x10023816
push dword [ebp - 0x29c]
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push dword [ebx + 8]
push dword [ebx + 0x38]
push dword [ebx + 0x34]
push 0x10023880
push dword [0x1013e59c]
push dword [0x1013e598]
call fcn.100cd772
mov esi, dword [ebx + 0xc]
cmp esi, 0xffffffff
je 0x10023864
mov esi, dword [edi + esi*4 + 4]
test esi, esi
je 0x10023864
mov edi, dword [ebp - 0x298]
mov ebx, dword [ebp - 0x290]
push 0
push ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x294]
push dword [ebp + 0xc]
push edi
call fcn.100cd980
test byte [esi + 4], 2
jne 0x1002385e
mov esi, dword [esi]
test esi, esi
jne 0x10023832
mov edi, dword [ebp - 0x2a0]
and dword [edi], 0
jmp 0x1002386b
mov dword [edi], esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret 0x10
Function at 0x10023b28
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x100efd44
call fcn.10022222
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x10023b51
cmp dword [0x10140cf8], edi
je 0x10023c3b
push 2
pop ebx
jmp 0x10023b6b
cmp edi, 1
jne 0x10023c3b
mov eax, ebx
call fcn.100ca2ed
test al, al
je 0x10023c3b
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.10023c9f
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x10023c1d
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x10023bb2
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
call fcn.100ca1b3
test eax, eax
je 0x10023c4f
push 0x1c049f
push 0
call fcn.100b873b
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x1013b670], 0
push ebx
mov ecx, 0x10140d08
call fcn.100c9b31
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.10023cc0
mov esi, eax
test esi, esi
je 0x10023b9e
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.10024751
inc edi
cmp edi, 2
jl 0x10023b39
mov eax, esi
call fcn.10022255
ret 0x18
push ebx
mov ecx, 0x10140d08
call fcn.10023a81
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x10023c2f
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x10023c8a
cmp dword [ebp - 0x20], 3
jne 0x10023c85
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x10023c85
and cl, 0xf
cmp cl, 4
je 0x10023c8a
push 2
pop esi
jmp 0x10023c2f
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.10024751
xor eax, eax
jmp 0x10023c47