joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c31c8
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
push edx
jmp 0x5c3203
push dword [esp + 2]
jmp 0x5c31b2
xchg bl, bh
jmp 0x5c321a
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0xc
mov bl, 0xa6
mov word [esp + 8], di
jmp 0x5c31ec
lea esp, [esp + 0xc]
movzx ebx, byte [esi + 0xe]
sub esp, 0x18
mov byte [esp + 0xa], ah
pushal
jmp 0x5c323e
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0x5c32a6
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
call fcn.005c32b3
pop edx
rol byte [eax + 0x27], cl
cld
pop ecx
add al, ch
aaa
add byte [eax], al
add byte [edx - 0x2e], bl
inc eax
daa
rcl byte [ecx], cl
fcom dword [edi - 0x39]
mov byte [0xc846ee51], al
pop esi
cmp eax, ecx
js 0x5c3274
cmc
sub esp, 0xa
push dword [esp + 4]
sub esp, 8
lea esp, [esp + 2]
jmp 0x5c326c
and edx, ecx
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
and ebx, ecx
jmp 0x5c328f

Function at 0x5c32b3
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x14
mov word [esp + 0x10], di
jmp 0x5c334c
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
call fcn.005c3312
arpl dx, si
pushal
pop es
inc esi
mul dword [bx + 2]
int1
cmp al, 0x6a
test dword [edi], esi
dec esi
and edx, ecx
sub esp, 2
mov word [esp], sp
clc
lea esp, [esp + 2]
jmp 0x5c332b

Function at 0x5c335c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push edx
pop dword [esp + 2]
lea esp, [esp + 8]
jmp 0x5c336b
add al, 0xd9
cmp byte [ebx], bl
jb 0x5c337b
jne 0x595138
test edi, eax
sbb eax, 0x840ffffd
fcomp dword [0xed78fffd]
je 0x59514f
js 0x5c3366
jge 0x5c337f
test dword [ebx + 0x6a], reloc.RASAPI32.dll_RasHangUpA
insb byte es:[edi], dx
or eax, dword [esi]
mov dl, 0x4f
salc
inc ecx
ret
Function at 0x6ae67b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop di
bswap edx
pop di
mov dword [esp + 1], esi
mov byte [esp + 0xb], ah
mov di, 0xc87d
jmp 0x6ae5af
mov di, 0x9013
xor dl, ch
mov dh, byte [esp + 3]
mov dword [esp], eax
mov dword [esp], ecx
sub esp, 0xc
jmp 0x6ae566
setno dh
add esp, 8
mov eax, 0x6950b1fc
rol dh, 3
jmp 0x6ae616
xchg word [esp + 8], dx
mov byte [esp + 9], dh
neg dx
mov ah, byte [esp + 6]
rdtsc
not ax
jmp 0x6ae598
pop di
mov edi, esi
mov ax, word [esp]
push edx
xchg dword [esp], edx
xchg dword [esp], edi
jmp 0x6ae583
ror edi, 7
push word [esp + 2]
rdtsc
xchg byte [esp], dh
xchg word [esp + 2], di
jmp 0x6ae663
mov edi, dword [esp]
xchg word [esp], di
mov dh, bh
rdtsc
mov eax, ebp
bswap eax
jmp 0x6ae5e0
push dword [esp + 1]
lea esp, [esp + 6]
mov dx, word [esp]
lea edi, [edx*4]
mov di, word [esp + 2]
jmp 0x6ae5f8
mov dh, bh
lea esp, [esp + 3]
cld
not edx
not dx
xchg dx, di
jmp 0x6ae5cf
mov byte [esp], ch
cmc
mov byte [esp], dh
mov edx, ebp
setns ah
btr edi, esp
jmp 0x6ae6b7
mov al, 0xa6
mov al, 0x2e
mov edi, dword [esp]
bsr di, bp
pop edi
lea edx, [edx + esi]
jmp 0x6ae646
setge ah
mov byte [esp + 4], dh
jmp 0x6ae635
mov dx, 0x524d
xchg word [esp], di
rcr dh, 5
mov word [esp + 2], bx
sub esp, 0xa
jmp 0x6ae710
xchg di, dx
ror dh, 5
xchg dx, di
push edx
lea edx, [ebx*4]
rcr edi, 0x19
jmp 0x6ae684
lea edx, [edi*4]
cmc
neg edx
add esp, 0
or edi, eax
mov eax, ebx
jmp 0x6ae69d
lea edi, [ebx + esi]
mov di, bx
xchg dh, al
lea esp, [esp + 1]
not dx
rdtsc
jmp 0x6ae72d
mov edi, 0xcf2ac7b4
push word [esp + 3]
lea esp, [esp + 0xc]
lea esp, [esp + 1]
push word [esp + 3]
mov dh, byte [esp + 1]
jmp 0x6ae6f2
pop word [esp]
sete dh
push word [esp + 2]
pop edx
bswap edi
push esp
jmp 0x6ae8f3
lea esp, [esp]
not di
mov byte [esp], bh
shr eax, 0x1f
call fcn.006ae778
cmc
btc edi, ebx
mov edi, ecx
setnp dh
not di
inc dh
jmp 0x6ae819
neg edx
bswap eax
push word [esp + 9]
not eax
mov dword [esp + 3], esi
not eax
jmp 0x6ae861
pushal
add al, dh
pop word [esp + 0x1b]
mov word [esp + 0x14], bx
bswap edi
mov byte [esp + 0x13], ch
jmp 0x6ae7fb
cmp edi, ecx
pop di
xchg dword [esp + 0x12], edx
xchg word [esp + 0xa], di
btc edi, esp
mov edi, esp
call fcn.006ae82e
xor byte [ebx], dh
sub cl, byte [edi - 0x75f5dbbc]
je 0x6ae88c
pop dword [esp + 0xa]
mov dh, byte [esp + 0xb]
dec di
or esp, dword [esi + 0x4f]
push dword [esp + 0xe]
push edx
neg edx
jmp 0x6ae847
inc ebp
lds edx, [ebp + 0x3c]
iretd
add esp, 1
mov edi, esp
bsr dx, bp
add esp, 3
mov eax, ebp
lea edi, [edx + edi]
jmp 0x6ae799

Function at 0x6ae778
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dh
rdtsc
shr edi, 0x13
mov dh, byte [esp + 0x11]
push dword [esp + 0xa]
pop di
jmp 0x6ae77f
not ah
sub esp, 0x16
jmp 0x6ae75d
neg dh
pop dx
mov word [esp + 0x18], sp
inc edx
cmc
pushal
jmp 0x6ae8d6
lea eax, [edx + esi]
mov dx, 0xbff3
mov di, 0x9859
mov dh, ch
setne dh
ror dh, 5
jmp 0x6ae7aa
rdtsc
lea edi, [ebx*4]
xchg di, dx
mov al, byte [esp]
and dh, bh
bswap edi
jmp 0x6ae7cd
mov ax, dx
bsr dx, bp
xchg dword [esp + 0x1a], edx
neg edx
sub esp, 0xc
lea esp, [esp + 0x47]
jmp 0x6ae7e6
Function at 0x6af0bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
add di, 0x5ece
jmp 0x6af12f
pushal
lea esp, [esp + 0x50]
mov di, 0xadc9
mov dl, byte [esp]
bswap edi
mov eax, ebp
jmp 0x6af113
cmc
rdtsc
lea edi, [ebx + edi]
mov edx, dword [esp + 3]
mov di, word [esp]
xchg ah, al
jmp 0x6af35a
mov edx, 0x2e529d80
pop dword [esp + 0x28]
rdtsc
mov dh, bh
xchg edi, eax
mov di, 0x8df9
jmp 0x6af0c4
mov edi, dword [esp + 0x3e]
lea esp, [esp + 0x48]
popfd
lea esp, [esp + 4]
call fcn.006af1cd
mov word [esp], dx
push dword [esp + 2]
push edx
call fcn.006af1aa
cmp ch, byte [eax + 0x4aa8593e]
inc ebp
hlt
pop word [esp + 0xf]
mov dword [esp + 3], eax
lea esp, [esp + 0x13]
xchg word [esp + 3], di
add esp, 0
lea esp, [esp + 1]
jmp 0x6af165
shl di, cl
mov di, word [esp]
mov di, word [esp]
pushal
pop di
mov edi, dword [esp + 9]
jmp 0x6af18f
mov eax, ecx
mov edi, esi
bsf di, ax
mov eax, dword [esp + 0x2e]
bsr di, bp
and di, 0x629a
jmp 0x6af1ec
xchg al, ah
inc edi
neg edi
mov di, word [esp]
mov di, bp
xchg ah, al
jmp 0x6af244

Function at 0x6af394
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x28], ebp
push esp
lea esp, [esp + 3]
mov byte [esp], bh
call fcn.006af396
jmp 0x6af36d

Function at 0x6af396
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x28], esi
pushal
lea esp, [esp + 0x1b]
lea esp, [esp + 2]
pushal
jmp 0x6af3de
mov dword [esp], eax
lea esp, [esp + 1]
jmp 0x6af37e

Function at 0x6af3af
Capabilities:
Parse pe header

Disassembly:
inc esi
pushal
pushal
lea esp, [esp + 0x45]
call fcn.006af394
jne 0x6af3ad
popal
add bl, dh
sbb byte [ebp - 0xe], dh
pushal
pop es
adc dh, byte [ebp - 9]
add dh, cl
adc dword [edx - 0x7b], ebp
Function at 0x10006ce0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10035b98]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.10006c72
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call 0xfff2960
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10006d2c
cmp dword [ebp - 0x1c], 5
jb 0x10006d44
jmp 0x10006d40
cmp dword [ebp - 0x10], 1
jne 0x10006d44
cmp dword [ebp - 0x1c], 4
ja 0x10006d40
jne 0x10006d44
cmp dword [ebp - 0x18], 0
jbe 0x10006d44
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1002f8a8
call fcn.10006b46
test eax, eax
jge 0x10006d65
mov byte [0x1003ae0c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call 0xfff0ee3
add ebp, 0x78
leave
ret
Function at 0x100557c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, dword [ebp + 0x14]
mov edi, eax
cmp edi, esi
je 0x10055df
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp + 0x10], eax
jbe 0x10055df
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x10055df
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
je 0x10055df
push ebx
push 0x15
push 0x400
push esi
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0101087e
cmp eax, esi
jge 0x10055df
mov dword [ebx], esi
jmp 0x10055ef
mov eax, dword [ebx]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x100643e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1013018]
jne 0x100644f
test ecx, 0xffff0000
jne 0x100644f
ret
jmp fcn.01006459
Function at 0x100676f
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1011850
call fcn.01006984
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x1014cfc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1006602
cmp eax, esi
jne 0x10065f5
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x1006605
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10065dc
xor esi, esi
inc esi
mov eax, dword [0x1014cf8]
cmp eax, esi
jne 0x1006618
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006647
mov eax, dword [0x1014cf8]
test eax, eax
jne 0x1006641
mov dword [0x1014cf8], esi
push 0x10011ec
push 0x10011e0
call fcn.0100653e
pop ecx
pop ecx
test eax, eax
je 0x1006647
jmp 0x1006758
mov dword [0x1014818], esi
mov eax, dword [0x1014cf8]
cmp eax, esi
jne 0x100666b
push 0x10011dc
push 0x10011d4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1014cf8], 2
cmp dword [ebp - 0x24], ebx
jne 0x1006678
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [0x1014d00]
cmp eax, ebx
je 0x1006687
push ebx
push 2
push ebx
call eax
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10066e0
cmp al, bl
je 0x10066a0
cmp dword [ebp - 0x1c], ebx
jne 0x10066e0
mov al, byte [esi]
cmp al, bl
je 0x10066b0
cmp al, 0x20
ja 0x10066b0
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10066a0
test byte [ebp - 0x40], 1
je 0x10066bc
movzx eax, word [ebp - 0x3c]
jmp 0x10066bf
push 0xa
pop eax
push eax
push esi
push ebx
push 0x1000000
call main
mov dword [0x1014814], eax
cmp dword [0x1014808], ebx
jne 0x1006735
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10066ef
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1006702
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100668e
cmp dword [0x1014818], ebx
jne 0x1006743
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1014814]
jmp 0x1006764
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010069c9
ret
call fcn.010063cb
jmp 0x100659f

Function at 0x1006ef0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1006f03
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1006eff
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x1006f30
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1006f6f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1006f65
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1006f71
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1006f55
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100c96d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1003624
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100c9c6
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x100c9c6
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x100c9c6
xor eax, eax
inc eax
jmp 0x100c9c8
xor eax, eax
leave
ret 0x10

Function at 0x100cae4
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1013018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x100cb2d
inc eax
jmp 0x100cb67
xor eax, eax
inc eax
cmp dword [ebp - 0x88], eax
jne 0x100cb5b
cmp dword [ebp - 0x94], 4
ja 0x100cb57
jne 0x100cb67
cmp dword [ebp - 0x90], 0xa
jb 0x100cb67
cmp word [ebp - 0x8c], 0x55d
jb 0x100cb67
xor eax, eax
jmp 0x100cb67
xor eax, eax
cmp dword [ebp - 0x88], 2
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100643e
leave
ret

Function at 0x100cb78
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1013018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100cbd5
cmp dword [ebp - 0x88], 2
jne 0x100cbd5
cmp dword [ebp - 0x94], 5
jb 0x100cbd5
xor eax, eax
inc eax
jmp 0x100cbd7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100643e
leave
ret
Function at 0x100f8b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x1013018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x94], eax
xor eax, eax
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edi, [ebp - 0x88]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x94]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x90]
push eax
xor edi, edi
push edi
push 0x1003a90
push ecx
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], 0x10
call ebx
cmp dword [esi + 0xc8c], edi
mov dword [ebp - 0x98], edi
jbe 0x100faed
lea eax, [esi + 0x2cc]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x100facb
mov eax, dword [esi + eax*4 + 0x13e4]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x98]
inc eax
push eax
push 0x1003938
lea eax, [ebp - 0x68]
push 0x64
push eax
call fcn.0100ddff
add esp, 0x10
push edi
lea eax, [ebp - 0x8c]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100facb
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x90]
push eax
push edi
push 0x1003914
push dword [ebp - 0x8c]
call ebx
mov esi, dword [ebp - 0xa0]
lea eax, [ebp - 0x94]
push eax
lea eax, [esi + 0x2b80]
push eax
lea eax, [ebp - 0x90]
push eax
push edi
push 0x1003a84
push dword [ebp - 0x8c]
call ebx
push 4
lea edi, [esi + 0x43c]
pop ecx
lea esi, [ebp - 0x78]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x100fa23
push 4
pop ecx
lea edi, [ebp - 0x88]
lea esi, [ebp - 0x78]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x100fab7
mov esi, dword [ebp - 0xa0]
lea eax, [ebp - 0x94]
push eax
lea eax, [esi + 0x2b84]
push eax
lea eax, [ebp - 0x90]
push eax
xor edi, edi
push edi
push 0x1003a70
push dword [ebp - 0x8c]
call ebx
lea eax, [ebp - 0x94]
push eax
lea eax, [esi + 0x2b74]
push eax
lea eax, [ebp - 0x90]
push eax
push edi
push 0x1003930
push dword [ebp - 0x8c]
call ebx
lea eax, [ebp - 0x94]
push eax
lea eax, [esi + 0x2b78]
push eax
lea eax, [ebp - 0x90]
push eax
push edi
push 0x1003928
push dword [ebp - 0x8c]
call ebx
lea eax, [ebp - 0x94]
push eax
add esi, 0x2b7c
push esi
lea eax, [ebp - 0x90]
push eax
push edi
push 0x1003920
push dword [ebp - 0x8c]
call ebx
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xac]
xor edi, edi
inc dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
add dword [ebp - 0x9c], 0x134
cmp eax, dword [esi + 0xc8c]
jb 0x100f950
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100643e
leave
ret 4
Function at 0x100fb03
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov ecx, esi
call fcn.0100d6d8
mov dword [esi + 4], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x54]
mov ecx, esi
call fcn.0100df91
mov eax, dword [esi + 4]
xor ebx, ebx
cmp eax, 1
je 0x100fb4f
cmp eax, 3
je 0x100fb4f
cmp eax, 2
jne 0x100fb61
mov ecx, esi
call fcn.0100e10c
cmp eax, ebx
jge 0x100fb61
mov byte [esi + 0x21], 1
mov dword [esi + 0x24], eax
cmp dword [esi + 4], 1
jne 0x100fbb2
push ebx
push ebx
push 0x400
push dword [esi + 0xc]
mov byte [esi + 0x18], 1
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x100fba4
push ebx
push ebx
push dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x100fbab
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp byte [esi + 0x18], bl
jne 0x100fb7d
jmp 0x100fbb2
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0x20
call sub.d3d9.dll_Direct3DCreate9
cmp eax, ebx
mov dword [esi + 0x140c], eax
jne 0x100fbcc
mov dword [esi + 0x24], 0x82000001
jmp 0x100fc1c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
cmp eax, ebx
jge 0x100fbdc
mov dword [esi + 0x24], eax
jmp 0x100fc1c
mov ecx, esi
call fcn.0100e9c9
cmp eax, ebx
jl 0x100fbd7
xor edx, edx
cmp dword [esi + 0x1408], ebx
jbe 0x100fc15
lea ecx, [esi + 0x13e4]
mov eax, dword [ecx]
cmp byte [eax + 0x2b71], bl
jne 0x100fc20
cmp byte [eax + 0x2b73], bl
jne 0x100fc20
inc edx
add ecx, 4
cmp edx, dword [esi + 0x1408]
jb 0x100fbf7
mov dword [esi + 0x24], 0x82000003
mov byte [esi + 0x21], 1
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x101175f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x1013018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
add eax, 4
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
lea eax, [ebp + 4]
mov eax, dword [eax - 4]
push 0x1003f10
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100643e
leave
ret
Function at 0x40234f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push edi
xor eax, eax
push eax
xor eax, eax
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x402381
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
push 8
pop eax
push eax
call dword [0x6b922c]
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov dword [esi], edi
add esp, 4
mov eax, dword [edi]
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4083a4
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x4083c6
mov eax, 0xfffffffd
jmp 0x40843e
mov ebx, dword [0x782890]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x40840c
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x782890]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x408434
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x40843e
mov esp, ebp
pop ebp
ret 4

Function at 0x40b580
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret