joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ff8a5
Capabilities:
Initialize hashing via wincrypt

Disassembly:
add ecx, 4
xor eax, eax
push ecx
push eax
push eax
push 0x800c
mov dword [ecx], eax
push dword [0x102146c8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x100ff8db
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
ret
xor eax, eax
ret

Function at 0x100ff99d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.101642f6
mov eax, dword [0x1020f334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2004]
push edi
mov dword [ebp - 0x2014], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x2010], 0x1000
push 0x101b1a3c
lea ecx, [ebp - 0x2014]
mov byte [ebp - 0x200c], al
mov dword [ebp - 0x2008], eax
mov dword [ebp - 0x2004], eax
mov word [ebp - 0x2000], ax
call fcn.10106c96
push esi
call fcn.1011208a
push eax
push esi
lea ecx, [ebp - 0x2014]
call fcn.100f7153
push dword [ebp - 0x2014]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
lea eax, [ebp - 0x2014]
mov dword [edi], ecx
mov ecx, eax
push eax
call fcn.10007611
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100042bb
mov esp, ebp
pop ebp
ret 4
Function at 0x10100f6e
Capabilities:
Get geographical location

Disassembly:
push 0x24
mov eax, 0x10174a0a
call fcn.10004365
push 2
lea eax, [ebp - 0x24]
push eax
push 0x23
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10100fc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea eax, [ebp - 0x30]
push ecx
push 0x2e6e7664
push eax
call fcn.1010dea4
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1010934c
lea ecx, [ebp - 0x30]
call fcn.100f57fa
cmp word [ebp - 0x24], 0x30
je 0x10100fd0
xor al, al
jmp 0x10100fed
push 9
lea eax, [ebp - 0x24]
push eax
push 0x28
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10100fcc
cmp word [ebp - 0x24], 0
setne al
call fcn.100045f2
ret 4

Function at 0x10104588
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1020f334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov edx, dword [ebp + 8]
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101045ff
cmp dword [ebp - 8], 1
je 0x101045d7
cmp dword [ebp - 8], 2
je 0x101045d7
push 0xd
pop eax
jmp 0x101045ff
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x101045f9
test ecx, ecx
je 0x101045f4
test cl, 1
jne 0x101045d2
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x101045f9
jmp 0x101045d2
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100042bb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10104c93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1017504d
call fcn.10004993
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x420], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call fcn.1010f268
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x10104d08
push 2
push esi
push ebx
call fcn.1010f268
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x10104d08
call fcn.100e431a
mov esi, eax
jmp 0x10104dfb
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x10104d2b
call fcn.100e431a
jmp 0x10104dee
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x10104d21
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x428], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x10104d5e
mov esi, 0x8007000e
jmp 0x10104df0
push 2
push eax
mov byte [ebp - 4], 2
call fcn.100f2ebd
cmp eax, 0x400
jbe 0x10104d7f
push eax
lea ecx, [ebp - 0x420]
call fcn.100f705d
jmp 0x10104da1
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], eax
jmp 0x10104da1
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
je 0x10104d54
push ebx
push dword [ebp - 0x420]
push ebx
push dword [ebp - 0x424]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10104d21
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.10104b59
mov esi, eax
test edi, edi
je 0x10104dfb
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x10104e14
lea ecx, [ebp - 0x420]
call fcn.100637c7
lea ecx, [ebp - 0x430]
call fcn.100e37c5
mov eax, esi
call fcn.1000506d
ret 0x10
Function at 0x10105944
Capabilities:
Terminate process

Disassembly:
push 0x24
mov eax, 0x10175111
call fcn.10004993
mov edi, dword [ebp + 8]
push 0
call fcn.100049cd
and dword [ebp - 4], 0
mov bl, byte [ebp + 0xc]
mov byte [ebp - 4], 1
test bl, bl
je 0x10105984
test byte [0x10214584], 4
je 0x10105984
push 0x666
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x10214588]
test eax, eax
je 0x1010599a
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10105a07
mov eax, dword [ecx]
push edi
call dword [eax + 8]
test bl, bl
je 0x101059e8
test dword [edi], 0x80000000
je 0x101059e8
mov eax, dword [0x10214584]
test al, 1
jne 0x101059c3
test al, 2
je 0x101059e8
mov esi, dword [0x10214594]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, esi
jne 0x101059e8
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.100fa801
lea ecx, [ebp - 0x28]
call fcn.100f57fa
mov dword [ebp - 4], 4
call fcn.10005482
call fcn.1000506d
ret 8
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3

Function at 0x1010764f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10107662
push 0xd
pop eax
jmp 0x101076a6
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x10107675
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x1010766d
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10108327
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x10108339
push 0xd
pop eax
jmp 0x1010836b
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10108342
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x101088ad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x1020f334]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x101089dd
push ebx
push esi
push edi
lea edi, [ebp - 0x47c]
mov dword [ebp - 0x46c], 0xc
stosd dword es:[edi], eax
xor ebx, ebx
push 0x40
push ebx
mov dword [ebp - 0x468], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x460], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x45c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, 0x20a
mov edi, eax
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x41c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.100fc729
test eax, eax
je 0x101089da
push ebx
xor eax, eax
mov dword [ebp - 0x468], ebx
inc eax
push ebx
push eax
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x101089da
push esi
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.100f3947
add esp, 0x10
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x460]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x101089d7
push dword [ebp - 0x47c]
call edi
push dword [ebp - 0x478]
call edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100042bb
mov esp, ebp
pop ebp
ret

Function at 0x101089eb
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x10175465
call fcn.10004365
mov esi, ecx
xor edi, edi
cmp dword [esi], 0xffffffff
je 0x10108a25
push 0x80004005
push 0x2e68367a
lea eax, [ebp - 0x20]
push eax
call fcn.1010dea4
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.1010934c
lea ecx, [ebp - 0x20]
call fcn.100f57fa
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x1010e35b
push edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10108a56
or dword [esi], 0xffffffff
call fcn.100045f2
ret 0xc
Function at 0x10108a5e
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x101754a4
call fcn.10004164
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x14
mov dword [ebp - 4], ebx
call fcn.100045ac
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10108a9f
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.100f4883
mov edi, eax
jmp 0x10108aa1
mov edi, ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.100f9dc4
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x18]
cmp dword [esi + 0x18], 1
mov byte [ebp - 4], 2
jne 0x10108ad3
cmp dword [esi + 0x1c], ebx
jne 0x10108ad3
mov ecx, dword [esi + 0x24]
call fcn.10117591
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
push ebx
push 0x1010865c
mov dword [ebp - 0x10], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10108aff
push 0x2e6b6832
call fcn.10109837
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 3
call fcn.100f9dc4
call fcn.10004198
ret 0x10

Function at 0x10108b16
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x101754d9
call fcn.10004164
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x14
mov dword [ebp - 4], ebx
call fcn.100045ac
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10108b5a
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.100f4cf1
mov edi, eax
jmp 0x10108b5c
mov edi, ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.100f9dc4
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x18]
cmp dword [esi + 0x18], 1
mov byte [ebp - 4], 2
jne 0x10108b8e
cmp dword [esi + 0x1c], ebx
jne 0x10108b8e
mov ecx, dword [esi + 0x24]
call fcn.10117591
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
push ebx
push 0x1010931c
mov dword [ebp - 0x10], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10108bba
push 0x2e6b6831
call fcn.10109837
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 3
call fcn.100f9dc4
call fcn.10004198
ret 0x14
Function at 0x10109980
Capabilities:
Print debug messages

Disassembly:
push 0x81c
mov eax, 0x101755e6
call fcn.10004365
mov esi, dword [ebp + 8]
push esi
call fcn.1011208a
mov edi, eax
mov ecx, 0x3e8
cmp edi, ecx
jle 0x10109a45
lea eax, [edi - 0x3e9]
xor edx, edx
div ecx
inc eax
imul ecx, eax, 0xfffffc18
add edi, ecx
mov dword [ebp - 0x828], edi
mov edi, eax
and dword [ebp - 0x814], 0
lea eax, [ebp - 0x810]
and dword [ebp - 0x810], 0
mov dword [ebp - 0x820], eax
xor eax, eax
mov dword [ebp - 0x81c], 0x400
mov byte [ebp - 0x818], 0
mov word [ebp - 0x80c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x820]
push eax
push 0x3e8
push esi
call fcn.10111af9
lea ecx, [ebp - 0x820]
add esi, 0x7d0
call fcn.1010e57c
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x820]
push eax
mov ecx, eax
call fcn.10007611
sub edi, 1
jne 0x101099c2
mov edi, dword [ebp - 0x828]
test edi, edi
je 0x10109a50
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.100045f2
ret 4

Function at 0x1010c910
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x20
mov eax, 0x101759e7
call fcn.10004365
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
test edi, edi
je 0x1010ca45
test ebx, ebx
je 0x1010ca45
xor esi, esi
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push 0x8003
call fcn.100fcf4f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1010ca2e
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1010c964
push esi
sub ecx, edx
push ecx
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1010ca2e
push esi
xor edi, edi
inc edi
push edi
push 0x101b30c8
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1010ca2e
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1010c9a1
push esi
sub ecx, edx
push ecx
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1010ca2e
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1010ca2e
mov ebx, dword [ebp - 0x1c]
push esi
push 0x3c9
push ebx
push dword [ebp - 0x20]
call fcn.10164664
movzx eax, word [eax*2 + 0x10187390]
test ax, ax
je 0x1010ca2e
mov ecx, dword [ebp - 0x20]
movzx eax, ax
imul eax, eax, 0xc
cmp dword [eax + 0x10187b30], ecx
jne 0x1010ca11
cmp dword [eax + 0x10187b34], ebx
je 0x1010ca1f
movzx eax, word [eax + 0x10187b3a]
test ax, ax
jne 0x1010c9fb
jmp 0x1010ca32
mov ecx, dword [ebp - 0x2c]
mov ax, word [eax + 0x10187b38]
mov word [ecx], ax
jmp 0x1010ca30
mov edi, esi
mov esi, edi
cmp dword [ebp - 0x24], 0
je 0x1010ca41
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, esi
jmp 0x1010ca47
xor eax, eax
call fcn.100045f2
ret 0xc
Function at 0x10128816
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x1017689f
call fcn.10004164
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], 0x101cd874
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov ecx, 0x1020e774
mov dword [ebp - 4], eax
mov dword [esi + 0x14], 0x1018e3f0
call fcn.10004d0e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10214974], eax
mov eax, esi
call fcn.10004198
ret

Function at 0x1012950d
Capabilities:
Access peb ldr_data

Disassembly:
push esi
mov esi, ecx
inc dword [esi + 4]
mov dword [esi], 0x1019452c
mov dword [esi + 0x10], 0x10194540
mov dword [esi + 0x14], 0x101840f4
mov dword [esi + 0x18], 0x101945b8
mov dword [esi + 0x1c], 0x10194630
mov dword [esi + 0x20], 0x1019465c
mov dword [esi + 0x24], 0x10194674
mov dword [esi + 0x28], 0x101946ac
mov ecx, dword [0x102129c0]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
jmp fcn.1012b086

Function at 0x1012a2eb
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push esi
mov esi, ecx
inc dword [esi + 4]
mov dword [esi], 0x10195904
mov dword [esi + 0x10], 0x10195910
mov dword [esi + 0x14], 0x10195a28
mov ecx, dword [0x102129c0]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
jmp fcn.1012c2a0

Function at 0x1012a318
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push esi
mov esi, ecx
inc dword [esi + 4]
mov dword [esi], 0x10195a38
mov dword [esi + 0x10], 0x10195a44
mov dword [esi + 0x14], 0x101840f4
mov ecx, dword [0x102129c0]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, esi
pop esi
jmp fcn.1012c36f

Function at 0x1012ba78
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10176e41
mov eax, dword fs:[0]
push eax
push edi
mov eax, dword [0x1020f334]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0x7c]
call fcn.100f5169
and dword [ebp - 4], 0
lea ecx, [edi + 0x78]
call fcn.100e3807
lea ecx, [edi + 0x74]
mov dword [ebp - 4], 1
call fcn.100e3807
lea ecx, [edi + 0x70]
mov dword [ebp - 4], 2
call fcn.100e3807
lea ecx, [edi + 0x6c]
mov dword [ebp - 4], 3
call fcn.100e3807
lea ecx, [edi + 0x68]
mov dword [ebp - 4], 4
call fcn.100e3807
lea ecx, [edi + 0x64]
mov dword [ebp - 4], 5
call fcn.100e3807
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x48]
mov dword [ebp - 4], 6
call fcn.100e3807
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x14]
call fcn.10128e1d
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 7
call fcn.100e3807
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1012c1c6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016625c
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1020f334]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x50]
call fcn.1012912f
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [ebp - 4], 0
lea ecx, [esi + 0x34]
call fcn.100e3807
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 1
call fcn.100e3807
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 2
call fcn.100e3807
lea ecx, [esi + 0x28]
mov dword [ebp - 4], 3
call fcn.100e3807
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 4
call fcn.100e3807
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1013794e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x10173f92
call fcn.10004365
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x420]
push 0x200
call fcn.10005cb0
xor eax, eax
mov word [ebp - 0x40c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.100f8398
lea eax, [ebp - 0x420]
push eax
call fcn.10112053
mov edx, 0x104
cmp eax, edx
jbe 0x101379c0
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov byte [ebp - 0x418], 1
push edx
mov word [eax + 0x208], cx
lea ecx, [ebp - 0x420]
call fcn.1010e258
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x420]
setne bl
call fcn.10007608
mov al, bl
call fcn.100045f2
ret 4

Function at 0x1013a5a3
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x10214974]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, ax
cmp ecx, 0x20
jne 0x1013a5bd
mov eax, 0x2e6e6e6e
ret
cmp ecx, 2
jne 0x1013a5c8
mov eax, 0x2e746a6b
ret
xor eax, eax
cmp ecx, 5
setne al
add eax, 0x2e746a6c
ret

Function at 0x1013a5d6
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x10214974]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
movzx ecx, ax
cmp ecx, 0x91
jne 0x1013a5f3
mov eax, 0x2e6e6e6d
ret
cmp ecx, 0x20
jne 0x1013a5fe
mov eax, 0x2e746a6e
ret
cmp ecx, 2
jne 0x1013a609
mov eax, 0x2e746a6f
ret
xor eax, eax
cmp ecx, 5
setne al
add eax, 0x2e746a70
ret

Function at 0x1013fe1b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not al
and al, 1
pop ebp
ret 4
Function at 0x1013ff8a
Capabilities:
Check for time delay via gettickcount
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1020f334]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [esi + 0x5c]
mov dword [ebp - 0x28], eax
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], 1
call fcn.100f5f01
cmp eax, 0x3e8
jge 0x1013ffc3
mov al, byte [esi + 0x64]
jmp 0x1013ffe6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 4], eax
lea eax, [ebp - 0x24]
push eax
mov byte [edi], 1
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x18], 0x800000
setb al
mov byte [esi + 0x64], al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100042bb
mov esp, ebp
pop ebp
ret
Function at 0x1014c3a3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor eax, eax
or ebx, 0xffffffff
push edi
mov edi, ecx
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea esi, [edi + 0x1c]
mov dword [ebp - 8], eax
push esi
mov byte [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
cmp dword [edi + 0x58], eax
je 0x1014c3f1
lea ecx, [edi + 0x6c]
cmp byte [ecx], al
je 0x1014c3f1
lea eax, [ebp - 0xc]
push eax
call fcn.100f5f01
xor ebx, ebx
mov byte [ebp - 1], 1
test eax, eax
cmovg ebx, eax
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
je 0x1014c407
cmp ebx, 0xffffffff
je 0x1014c401
cmp dword [ebp + 8], ebx
jge 0x1014c407
mov ebx, dword [ebp + 8]
mov byte [ebp - 1], al
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
jne 0x1014c422
mov ecx, dword [edi + 0x94]
call fcn.10117e45
mov bl, 1
jmp 0x1014c44f
cmp byte [ebp - 1], 0
je 0x1014c437
test ebx, ebx
jne 0x1014c437
cmp byte [edi + 0x35], bl
je 0x1014c437
xor ecx, ecx
mov bl, cl
jmp 0x1014c44f
mov ecx, dword [edi + 0x94]
lea eax, [ebp + 0xa]
push ebx
push eax
call fcn.10117e67
xor ecx, ecx
cmp word [eax], cx
setne bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, dword [ebp - 8]
sub ecx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
test bl, bl
je 0x1014c47b
push dword [ebp + 0x14]
mov ecx, edi
mov byte [edi + 0x35], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1012e897
jmp 0x1014c493
xor eax, eax
mov byte [edi + 0x35], al
cmp byte [ebp - 1], al
jne 0x1014c489
xor al, al
jmp 0x1014c493
push dword [ebp + 0x10]
mov ecx, edi
call fcn.1012e9f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14