joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4697b5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4697f4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4697f4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4697f4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4697f4
cmp dword [ecx + 0x74], 0xe
jbe 0x4697f4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4703ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00469090
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00474580
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x47042c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x470588
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00482650
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4a3470]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00477e9f
mov ecx, dword [esi*4 + 0x4a3470]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x470581
cmp eax, dword [edi + ecx + 0x24]
jne 0x470581
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x470581
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00477e9f
add esp, 0x14
test edx, edx
jl 0x470581
jg 0x4704f7
test eax, eax
jb 0x470581
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x470581
jl 0x470511
cmp dword [ebp - 0x1008], eax
ja 0x470581
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x47052f
test ebx, ebx
je 0x470568
cmp ecx, edi
jae 0x470568
mov al, byte [ecx]
cmp al, 0xd
jne 0x470549
lea eax, [edi - 1]
cmp ecx, eax
jae 0x470555
cmp byte [ecx + 1], 0xa
jne 0x470555
inc ecx
jmp 0x470555
movzx eax, al
movsx eax, byte [eax + 0x4a23f0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x47052f
cmp edx, ebx
jne 0x47052f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x470586
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00469073
leave
ret

Function at 0x473fe5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x487938
push 0x487930
push str.FlsAlloc
push 0x1e
call fcn.00473ea6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x474019
push dword [ebp + 8]
mov ecx, esi
call dword [0x4851c8]
call esi
jmp 0x47401f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x474063
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x487948
push 0x487940
push str.FlsGetValue
push 0x20
call fcn.00473ea6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47409a
push dword [ebp + 8]
mov ecx, esi
call dword [0x4851c8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x477f1b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4a3470]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x477f5b
cmp byte [ebx], 0xa
jne 0x477f5b
or byte [eax + edi + 0x28], 4
jmp 0x477f60
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x47805e
mov al, byte [edx]
cmp al, 0x1a
je 0x478040
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x477f8f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x477fb4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x477fbe
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x477f71
jmp 0x47805e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47803b
cmp dword [ebp - 0xc], 0
je 0x47803b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4a3470]
test byte [eax + edi + 0x28], 0x48
je 0x478015
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x478000
mov byte [esi], dl
jmp 0x478011
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4a3470]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x47805e
cmp byte [ebp - 1], 0xa
jne 0x478024
cmp esi, ebx
jne 0x478024
mov byte [esi], 0xa
jmp 0x47805d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00477ebd
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x47805e
mov byte [esi], 0xd
jmp 0x47805d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4a3470]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x47805a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x47805e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x478067
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4a3470]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4780aa
cmp word [esi], dx
jne 0x4780aa
or byte [edi + eax + 0x28], 4
jmp 0x4780af
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x478202
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4781e2
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4780f1
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x478127
cmp eax, edx
jae 0x478133
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4780c9
jmp 0x478202
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4781de
cmp dword [ebp - 0x14], 0
je 0x4781de
mov eax, dword [ebx*4 + 0x4a3470]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4781b6
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x47817f
mov word [esi], cx
jmp 0x4781b2
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4a3470]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4a3470]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4a3470]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x478202
pop ebx
cmp word [ebp - 4], bx
jne 0x4781c7
cmp esi, dword [ebp + 0xc]
jne 0x4781c7
mov word [esi], bx
jmp 0x4781ff
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00477ebd
add esp, 0x10
cmp word [ebp - 4], bx
je 0x478202
push 0xd
jmp 0x4781fb
mov ecx, dword [ebx*4 + 0x4a3470]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4781f9
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x478202
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x479b60
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004799d1
Function at 0x47b3e7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x47b484
push ebx
push esi
call fcn.0047b3b0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00476a52
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x47b431
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x47b483
push edi
push eax
call fcn.00474d24
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x47b451
call fcn.00473d05
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x47b482
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00476a52
add esp, 0x20
test eax, eax
jne 0x47b470
push edi
call fcn.00473d05
jmp 0x47b478
push ebx
call fcn.00473d05
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x47b487
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x47b498
pop esi
ret
push ebx
push edi
push esi
call fcn.0047b3b0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00474d24
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x47b4c0
push ebx
push esi
push edi
call fcn.0046ae20
add esp, 0xc
push 0
call fcn.00473d05
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x47b884
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047b4d5
Function at 0x47fe45
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0047fdc1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x47ffbd
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x47ffbd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x47ff6c
jg 0x47fe9e
test eax, eax
je 0x47ff62
push 1
push 0x1000
call fcn.00473ca8
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x47fec4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x47ff59
push 0x8000
push ebx
call fcn.004729a2
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x47fef0
jg 0x47feeb
cmp ecx, 0x1000
jb 0x47fef0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00479579
add esp, 0x10
cmp eax, 0xffffffff
je 0x47ff35
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x47feeb
jl 0x47ff1c
test ecx, ecx
jne 0x47fedd
push dword [ebp - 0xc]
push ebx
call fcn.004729a2
push esi
call fcn.00473d05
add esp, 0xc
xor edi, edi
jmp 0x47ffce
cmp byte [edi + 0x24], 0
je 0x47ff4c
cmp dword [edi + 0x20], 5
jne 0x47ff4c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x47ff57
mov edi, dword [edi + 0x18]
jmp 0x47ff59
xor edi, edi
push esi
call fcn.00473d05
pop ecx
jmp 0x47ffce
test ecx, ecx
jg 0x47ff2e
jl 0x47ff6c
test eax, eax
jae 0x47ff2e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00477ebd
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x47ff8f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x47ff2e
jmp 0x47ffc6
push ebx
call fcn.0047a2dd
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x47ff2e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x47ffce
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x47ffcb
mov edi, dword [edi + 0x18]
jmp 0x47ffce
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00477ebd
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x482410
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48243d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48243d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x20001270
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x20023f48]
push ebx
push 0
push 0x80
push 4
push 0
push 3
add eax, 0xd
push 0x40000000
push eax
call dword [0x2001a2b8]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x20001313
push 0
push ebx
mov dword [esp + 0xc], 0
call dword [0x2001a2a0]
cmp eax, 0x3200000
jae 0x200012bf
push 2
push 0
push 0
push ebx
call dword [0x2001a298]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
call dword [0x2001a2b0]
mov edi, eax
push edi
call fcn.2001969c
add esp, 4
mov esi, eax
test edi, edi
jle 0x200012f0
mov ecx, ebp
mov ebp, edi
sub ecx, esi
mov dl, byte [ecx + eax]
xor dl, 0x44
mov byte [eax], dl
inc eax
dec ebp
jne 0x200012e4
lea eax, [esp + 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [0x2001a294]
push ebx
call dword [0x2001a2e8]
push esi
call fcn.20019696
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x20002240
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x20019933
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.200083e0
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x2001ad84
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.2001969c
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x200022a7
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.2000f690
jmp 0x200022a9
xor eax, eax
push 1
push ebx
push ebx
push esi
push sym.advapi32.dll_BuildImpersonateTrusteeW
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.200042a0
push 1
push ebx
push ebx
push esi
push 0x20001cd0
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.200042a0
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x20002530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x2000263d
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x200025db
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x200025f9
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.20004cc0
add esp, 4
push eax
push edi
call sym.advapi32.dll_BuildSecurityDescriptorA
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x200025c6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x20002583
jmp 0x200025f9
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x200025f9
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x2000263d
cmp eax, ecx
jb 0x2000263d
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x2000263f
cmp eax, esi
jb 0x2000263f
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x2000263f
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x2000263d
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x2000264a
cmp byte [esi], 0
jne 0x2000262d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x2000263d
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call sym.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmW
add esp, 4
lea eax, [esp + 0x20]
push eax
call fcn.2000c8f0
push 0
push esi
mov edi, eax
call fcn.20004cc0
add esp, 4
push eax
push esi
call sym.advapi32.dll_BuildSecurityDescriptorA
and eax, 0x7fffffff
push eax
push edi
call fcn.20002530
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret

Function at 0x200031c0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x200239ec
mov eax, edx
mov esi, 8
test al, 1
je 0x200031dc
shr eax, 1
xor eax, 0xedb88320
jmp 0x200031de
shr eax, 1
dec esi
jne 0x200031cf
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x20023dec
jl 0x200031c8
pop esi
ret
Function at 0x200067c0
Capabilities:
Suspend thread

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ebx, eax
cmp ebx, esi
je 0x20006926
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [0x2001a050]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x2001a390]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.2001969c
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x200068f6
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x200068e2
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x2001a378]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.2000b500
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x20006896
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call sym.advapi32.dll_AddAccessDeniedAce
mov eax, dword [esp + 0x28]
push eax
call dword [0x2001a38c]
push ebp
call fcn.20019696
add esp, 8
push ebx
call dword [0x2001a018]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x20007400
Capabilities:
Suspend thread

Disassembly:
sub esp, 0x400
push esi
push edi
push 0
push 0
push 0x20021318
push 1
push 0x20021304
push 0x200212cc
push 0x80000002
call fcn.2000dd10
mov ecx, 0xc
mov esi, str.BK__P_K_lhiysjOOVQKIuBuiDBY_mfVFX_YYU
lea edi, [esp + 0x24]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xf3
lea edi, [esp + 0x55]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0
stosb byte es:[edi], al
push 0
push 4
lea eax, [esp + 0x34]
push 0x20021284
push eax
push 0x80000002
call fcn.2000dd10
mov esi, dword [0x2001a2f0]
add esp, 0x38
lea ecx, [esp + 8]
push 0x20021274
push ecx
call esi
push 0
push 1
push 0
push 4
lea edx, [esp + 0x18]
push 0x20021258
push edx
push 0x80000002
call fcn.2000dd10
add esp, 0x1c
lea eax, [esp + 8]
push 0x20021240
push 0x5c
push eax
call dword [0x2001a340]
mov edi, dword [0x2001a2f4]
add esp, 8
push eax
call edi
mov ecx, dword [esp + 0x410]
push 0
push ecx
push 0
push 4
lea edx, [esp + 0x18]
push 0x20021234
push edx
push 0x80000002
call fcn.2000dd10
add esp, 0x1c
lea eax, [esp + 8]
push 0x20021204
push eax
call edi
push 0
push 2
push 0
push 4
lea ecx, [esp + 0x18]
push 0x200211fc
push ecx
push 0x80000002
call fcn.2000dd10
add esp, 0x1c
lea edx, [esp + 8]
push 0x200211f0
push edx
call esi
mov eax, dword [esp + 0x40c]
push 0
push 0
push eax
push 2
lea ecx, [esp + 0x18]
push 0x200211e4
push ecx
push 0x80000002
call fcn.2000dd10
add esp, 0x1c
push 0xf003f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, eax
test edi, edi
je 0x2000760f
mov esi, dword [0x2001a0c4]
push ebp
push 0xf01ff
push 0x200211d8
push edi
call esi
mov ebp, eax
test ebp, ebp
je 0x200075da
push ebx
push ebp
call fcn.20007ad0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x200075c7
push 0xf01ff
push 0x200211cc
push edi
call esi
mov esi, eax
push 1
push esi
call fcn.2000fe80
push 0
push ebx
call fcn.20001ba0
push esi
call fcn.20007ad0
add esp, 0x14
test eax, eax
jne 0x200075c0
mov ebx, dword [0x2001a2f8]
push 0x7d0
call ebx
push esi
call fcn.20007ad0
add esp, 4
test eax, eax
je 0x200075ac
push esi
call dword [0x2001a018]
push 0
push 0
push ebp
call dword [0x2001a0c8]
push ebp
call dword [0x2001a018]
pop ebx
push edi
call dword [0x2001a018]
mov edx, dword [0x2002222c]
lea eax, [esp + 0xc]
add edx, 0x128
push edx
push 0x20021144
push eax
call dword [0x2001a500]
add esp, 0xc
lea ecx, [esp + 0xc]
push 0
push ecx
call dword [0x2001a2fc]
pop ebp
pop edi
pop esi
add esp, 0x400
ret