joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ee80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10031210]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x1000eeb3
mov dword [esp + 0x10], 0xffffffff
jmp 0x1000eeb9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1000efa8
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000ef0b
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.10011fb0
add esp, 0xc
jmp 0x1000efde
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x1000ef35
push 0x1002d628
push 0xfe
lea edx, [eax - 7]
push str..QHImageHlp.c
call fcn.100120e0
add esp, 0xc
jmp 0x1000efde
cmp dword [esp + 0x40], ebx
je 0x1000ef7b
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x1000ef61
push 0x1002d6dc
push 0x321
mov edx, 5
push str..QHImageHlp.c
call fcn.100120e0
add esp, 0xc
jmp 0x1000efde
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x1000efd6
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x1000ef93
push 0x1002d6dc
mov ebx, esi
push 0x32d
jmp 0x1000ef4d
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1000efc3
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.10011fb0
add esp, 0xc
jmp 0x1000efde
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.1000e500
test eax, eax
je 0x1000efde
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1000efe8
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10014002
add esp, 0x28
ret
Function at 0x1000fa60
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x1000faad
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.10011fb0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x1000fb44
jg 0x1000fad3
cmp ebx, ecx
jb 0x1000fb44
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1000fb09
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.10011fb0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.1000e500
test eax, eax
je 0x1000faff
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1000fb2a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1000fb51
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x1000fb51
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x10010410
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10031210]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x10010550
cmp dword [esp + 0x28], ebp
je 0x10010550
push ebx
push 0x2800
call fcn.100167c1
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x10010473
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10014002
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x10010480
push edi
push str..PhysicalDrive_d
mov ecx, 0x2800
call fcn.1000e390
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10010526
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.10015cf0
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10010519
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x10010519
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.100101b0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x10010530
inc edi
cmp edi, 0x10
jl 0x10010480
push ebx
call fcn.10015c5a
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10014002
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.10014002
add esp, 0x1c
ret
Function at 0x10010600
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x1001063a
cmp dword [esp + 0x34], esi
je 0x1001063a
push 0x200
call fcn.100167c1
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x10010645
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100107a4
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x1001073a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1001069d
mov eax, 0x80000002
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10010713
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10010708
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.10010570
cmp edx, edi
jb 0x10010708
ja 0x10010702
cmp eax, dword [esp + 0x24]
jbe 0x10010708
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x10010690
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x10010750
cmp dword [esp + 0x24], 0
jbe 0x100107a4
mov ecx, dword [esp + 0x24]
push edi
push ecx
push str._012I64X
mov ecx, 0x200
call fcn.1000e390
add esp, 0xc
test eax, eax
jne 0x10010789
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.10015c5a
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push str.MAC:
call fcn.100101b0
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.10015c5a
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10013550
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x10026f7b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10031210]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x1007a7a0], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.100163d5
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x1001373d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100135ee
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.10015cf0
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.10013240
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x10013655
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x1002db40
push eax
call fcn.10016047
add esp, 0xc
cmp eax, 1
jne 0x10013655
mov eax, dword [ebp - 0x14]
mov dword [0x1007a7a0], eax
jmp 0x10013725
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x1001366f
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x10013683
push ebx
push esi
call fcn.100139a0
jmp 0x10013685
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x1007a7a0], eax
test eax, eax
jne 0x100136a7
push 0x1002ebc0
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.100157ab
push eax
lea edx, [ebp + 0x84]
push 0x1002db40
push edx
mov edi, 1
call fcn.100164a8
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.10013380
test eax, eax
jne 0x1001371e
push 0x1002ebc0
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.100157ab
call fcn.10013420
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x1007a7a0]
test esi, esi
je 0x1001370f
call fcn.10013a80
mov dword [0x1007a7a0], 0
jmp 0x10013716
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1001371c
ret
mov eax, dword [0x1007a7a0]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x1001373d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1007a7a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.10014002
add ebp, 0xc8
mov esp, ebp
pop ebp
ret
Function at 0x10013770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026ef0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10031210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x1007a7a0]
xor edi, edi
cmp ecx, edi
jne 0x100137bb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x100137c8
mov dword [ebp - 0x14], edi
jmp 0x100137e0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x10013876
mov ecx, dword [0x1007a7a0]
mov eax, dword [ecx]
cmp eax, edi
je 0x100137a7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100137a7
mov ebx, 0x1007a7a0
mov dword [ebp - 4], edi
call fcn.10013890
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x1001381e
push 0x1002ebc0
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.100157ab
mov ecx, dword [0x1007a7a0]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x10013838
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x10013862
push 0x1002ebc0
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.100157ab
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x10013859
call fcn.10013ba0
mov eax, 0x1001385f
ret
mov eax, dword [0x1007a7a0]
mov eax, dword [eax]
test eax, eax
je 0x10013874
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013890
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x100138bd
xor ecx, ecx
jmp 0x100138c9
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x1001397d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x100138f0
mov dword [esp + 0xc], esi
jmp 0x10013950
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x10013949
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1001393c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x10013950
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10013950
push 0x1002db48
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10013950
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x10013973
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x100138e2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x10013991
mov ecx, dword [ebx]
add ecx, 8
call fcn.10013ad0
test eax, eax
je 0x10013991
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x100139a0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x10026f4b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10031210]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.10015cf0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x10013a38
push 0x1002ebc0
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.100157ab
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x10014002
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10031210]
jne 0x1001400c
repz ret
jmp fcn.10016c2d
Function at 0x10020fd0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10016eda
and dword [ebp - 4], 0
cmp dword [0x100790ac], 0
mov ebx, eax
jne 0x10021081
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10021132
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10021132
push eax
call fcn.10016e68
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100790ac], eax
call esi
push eax
call fcn.10016e68
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100790b0], eax
call esi
push eax
call fcn.10016e68
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100790b4], eax
call esi
push eax
call fcn.10016e68
pop ecx
mov dword [0x100790bc], eax
test eax, eax
je 0x10021081
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10016e68
pop ecx
mov dword [0x100790b8], eax
mov eax, dword [0x100790b8]
cmp eax, ebx
je 0x100210d9
cmp dword [0x100790bc], ebx
je 0x100210d9
push eax
call fcn.10016ee3
push dword [0x100790bc]
mov esi, eax
call fcn.10016ee3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100210d9
test edi, edi
je 0x100210d9
call esi
test eax, eax
je 0x100210d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100210d0
test byte [ebp - 0xc], 1
jne 0x100210d9
or dword [ebp + 0x10], 0x200000
jmp 0x10021112
mov eax, dword [0x100790b0]
cmp eax, ebx
je 0x10021112
push eax
call fcn.10016ee3
pop ecx
test eax, eax
je 0x10021112
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10021112
mov eax, dword [0x100790b4]
cmp eax, ebx
je 0x10021112
push eax
call fcn.10016ee3
pop ecx
test eax, eax
je 0x10021112
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100790ac]
call fcn.10016ee3
pop ecx
test eax, eax
je 0x10021132
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10021134
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406120
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, ecx
mov dword [ebx], 0
push 0x4879dc
mov eax, dword [edi + 0x10]
mov ebp, 0x404
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4061a8
push esi
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
cmp ebp, 1
jne 0x40619c
cmp dword [esp + 0x1c], 0xa502
jne 0x406193
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 0
push ebx
push edx
push eax
mov ecx, edi
call fcn.004061c0
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 0x404
pop ebx
ret 0xc
pop edi
mov ax, bp
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x406540
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push 0x4879e0
mov ebx, ecx
push eax
mov ebp, 0x409
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x406589
push edi
mov edi, dword [ebx + 0x18]
mov ebx, dword [ebx + 0x14]
push esi
push edi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp edi, eax
pop edi
jne 0x40657f
xor ebp, ebp
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ax, bp
pop esi
pop ebp
pop ebx
ret 4

Function at 0x422dd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ecx, 0x601
mov esi, 0x4a3100
mov edi, 0x4a18e0
rep movsd dword es:[edi], dword [esi]
mov eax, 0x4a18e2
mov edx, 0xffff
mov esi, 0x1802
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
and ecx, 0xffff
shr ecx, 8
xor ecx, ebx
xor ebx, ebx
mov bh, dl
mov dx, word [ecx*2 + 0x47b08c]
xor dx, bx
inc eax
dec esi
jne 0x422df3
mov ecx, 0x601
mov esi, 0x4a5100
mov edi, 0x4c3100
mov eax, 0xffff
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4c3102
mov edi, 0x1802
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xffff
shr ecx, 8
xor ecx, ebx
xor ebx, ebx
mov bh, al
mov ax, word [ecx*2 + 0x47b08c]
xor ax, bx
inc esi
dec edi
jne 0x422e37
cmp dx, word [0x4a18e0]
jne 0x422e9a
cmp ax, word [0x4c3100]
mov ecx, 0x601
jne 0x422e8b
mov edi, 0x4c3100
mov esi, 0x4a18e0
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x422f3a
mov ecx, 0x601
mov esi, 0x4a18e0
mov edi, 0x4c3100
jmp 0x422f27
cmp ax, word [0x4c3100]
mov ecx, 0x601
jne 0x422ec5
mov esi, 0x4c3100
mov edi, 0x4a18e0
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x601
mov esi, 0x4a18e0
mov edi, 0x4a3100
jmp 0x422f38
xor eax, eax
mov edi, 0x4a18e0
rep stosd dword es:[edi], eax
mov ecx, 0x4a18e2
mov eax, 0xffff
mov esi, 0x1802
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xffff
shr edx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x47b08c]
xor ax, bx
inc ecx
dec esi
jne 0x422edd
mov ecx, 0x601
mov esi, 0x4a18e0
mov edi, 0x4c3100
mov word [0x4a18e0], ax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x601
mov esi, 0x4a18e0
mov edi, 0x4a3100
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x601
mov esi, 0x4c3100
mov edi, 0x4a5100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, 0x4a18a4
mov ecx, 8
xor edx, edx
pop ebx
mov dword [eax - 4], edx
mov word [eax], dx
mov word [eax + 2], dx
add eax, 8
dec ecx
jne 0x422f49
xor ax, ax
ret
Function at 0x440f78
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4667a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 8], vtable.CTakeSerial.0
mov eax, dword [esi]
mov dword [esp + 0xc], esi
call dword [eax]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov cl, byte [esi + 8]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x1b8]
call fcn.00463360
mov edx, dword [esi]
mov ecx, esi
mov edi, eax
mov dword [esp + 0x1c], 0xffffffff
call dword [edx]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
mov ecx, dword [esp + 0x14]
mov ax, di
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10

Function at 0x4420f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x6c
push esi
push edi
mov edi, dword [esp + 0x7c]
mov esi, ecx
test edi, edi
jne 0x442145
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esi + 0x1a4]
mov edx, dword [esi + 0x1a0]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
call fcn.00465780
mov dword [esp + 0xc], edx
push eax
lea edx, [esp + 0x14]
push str._TIME:_dms_
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x44218a
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esi + 0x1a4]
mov edx, dword [esi + 0x1a0]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
call fcn.00465780
mov dword [esp + 0xc], edx
push eax
push edi
lea edx, [esp + 0x18]
push str.__s__TIME:_dms_
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [esp + 0x78]
push 1
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.004419d0
pop edi
xor ax, ax
pop esi
add esp, 0x6c
ret 8