joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003120
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10027770
push 0x10013990
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x10029128]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov esi, ecx
mov edi, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], 0
push 0x208
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.100119a0
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push esi
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100031c6
mov dword [ebp - 0x228], 0xffffffff
jmp 0x10003376
mov eax, dword [ebp + 0x10]
sub eax, 0
je 0x100032da
mov esi, 1
sub eax, esi
je 0x10003273
sub eax, esi
jne 0x10003376
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x10003376
cmp eax, 2
ja 0x10003376
mov dword [ebp - 0x230], 0x208
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x22c]
push eax
push 0
push edi
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003264
push 0x10025a8c
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x100031b7
lea eax, [ebp - 0x224]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x228], esi
jmp 0x10003376
mov dword [ebp - 0x228], 0
jmp 0x10003376
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x10003376
cmp eax, 2
ja 0x10003376
mov dword [ebp - 0x230], 0x208
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x22c]
push eax
push 0
push edi
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000336a
lea edx, [ebp - 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x228], esi
jmp 0x10003376
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x10003376
cmp eax, 2
ja 0x10003376
mov dword [ebp - 0x230], 0x208
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 0
push edi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000336a
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x248]
push edx
lea eax, [ebp - 0x224]
push eax
push str._s__d
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x228], 1
jmp 0x10003376
push str.error
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 4], 0xfffffffe
call fcn.100033a4
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret
Function at 0x10003950
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x10029128]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.C:Program_FilesVMwareVMware_Tools_
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x10003984
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x76
push eax
lea ecx, [ebp - 0x7e]
push ecx
mov word [ebp - 0x80], ax
call fcn.100119a0
lea esi, [ebp - 0x80]
call fcn.100033c0
mov edx, esi
push str.VMware
push edx
call fcn.10010383
add esp, 0x14
test eax, eax
jne 0x10003973
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 0xc0], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [ebp - 0xb4], 0
ja 0x100039e0
jb 0x10003973
cmp dword [ebp - 0xb8], 0x45f41500
jb 0x10003973
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret

Function at 0x10003a60
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10029128]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10003ac7
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.NtSetInformationProcess
push str.NtDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x10003af3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 1
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x1d
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret
Function at 0x100053e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
mov dword [ebp - 4], 0
cmp ebx, 0x40000
jl 0x10005440
jmp 0x10005400
xor edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2e8]
push 0
push 0x40000
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10005424
inc edi
cmp edi, 0xf
jl 0x10005402
cmp edi, 0xf
je 0x1000547e
add dword [ebp - 4], eax
sub ebx, 0x40000
add esi, 0x40000
cmp ebx, 0x40000
jge 0x10005400
test ebx, ebx
jle 0x10005476
xor edi, edi
jmp 0x10005450
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2e8]
push 0
push ebx
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1000546e
inc edi
cmp edi, 0xf
jl 0x10005450
cmp edi, 0xf
je 0x1000547e
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10005481
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100059c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov dword [esi], vtable.CManager.0
mov dword [esi + 4], edi
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push esi
mov ecx, edi
call edx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CKernelManager.0
mov dword [esi + 0x218], ebx
test ebx, ebx
je 0x10005a41
test eax, eax
je 0x10005a14
push eax
push 0x208
push 0x10030d30
call fcn.100103e9
add esp, 0xc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10005a2e
push eax
push 0x208
push 0x10031140
call fcn.100103e9
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [0x1002e36c], eax
mov dword [0x1002e378], ecx
jmp 0x10005a83
test eax, eax
je 0x10005a58
push eax
push 0x208
push 0x10030510
call fcn.100103e9
add esp, 0xc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10005a72
push eax
push 0x208
push 0x10030920
call fcn.100103e9
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [0x1002e368], edx
mov dword [0x1002e374], eax
xor eax, eax
push 0x100259e4
mov dword [esi + 0x220], eax
mov dword [esi + 0x21c], eax
mov dword [esi + 0x214], edi
mov dword [0x1002f498], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegCreateKeyExW
push eax
mov dword [esi + 0x228], eax
call edi
mov ecx, dword [esi + 0x228]
push 0x10026184
push ecx
mov dword [esi + 0x22c], eax
call edi
mov edx, dword [esi + 0x228]
push str.RegDeleteKeyW
push edx
mov dword [esi + 0x24c], eax
call edi
mov dword [esi + 0x234], eax
mov eax, dword [esi + 0x228]
push 0x100261a4
push eax
call edi
mov ecx, dword [esi + 0x228]
push 0x10025a00
push ecx
mov dword [esi + 0x238], eax
call edi
mov edx, dword [esi + 0x228]
push 0x10025a14
push edx
mov dword [esi + 0x230], eax
call edi
mov dword [esi + 0x23c], eax
mov eax, dword [esi + 0x228]
push str.RegEnumValueW
push eax
call edi
mov ecx, dword [esi + 0x228]
push str.RegEnumKeyExW
push ecx
mov dword [esi + 0x240], eax
call edi
mov edx, dword [esi + 0x228]
push 0x10025a24
push edx
mov dword [esi + 0x244], eax
call edi
mov dword [esi + 0x248], eax
mov eax, esi
pop edi
pop ebp
ret 0x10
Function at 0x100064c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5bc
mov eax, dword [0x10029128]
xor eax, esp
mov dword [esp + 0x5b8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0xb6
mov esi, ebx
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
push 0x2ce
push ecx
lea edx, [esp + 0x2fa]
push edx
mov dword [esp + 0x1c], eax
mov word [esp + 0x2fc], cx
call fcn.100119a0
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10006550
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [esp + 0x18]
push ecx
add edx, 0xfffffd28
push edx
add ebx, 0x2d8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10006537
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100065ae
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x22c]
push edx
lea eax, [esp + 0x2f8]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x100065c4
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x1c]
sub eax, 0
je 0x100065d3
dec eax
jne 0x100065e5
push eax
jmp 0x100065d5
push 5
mov ebx, dword [esp + 0x14]
lea edi, [esp + 0x2f4]
call fcn.10006610
mov ecx, dword [esp + 0x5c4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret 8
Function at 0x10006610
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa68
mov eax, dword [0x10029128]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.100119a0
push 0x2e
push edi
call fcn.1001087d
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1000665b
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x41a]
push edx
mov word [ebp - 0x41c], cx
call fcn.100119a0
push 0x20
push esi
call fcn.1001087d
add esp, 0x14
push esi
test eax, eax
je 0x100066af
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
test eax, eax
jle 0x100066cb
cmp word [esi + eax*2], 0x20
je 0x1000669f
dec eax
test eax, eax
jg 0x10006691
jmp 0x100066cb
push eax
push esi
push 0x104
lea eax, [ebp - 0x41c]
push eax
jmp 0x100066c3
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
call fcn.100108ab
add esp, 0x10
lea edx, [ebp - 0x214]
push edx
push 1
lea edx, [ebp - 0x41c]
mov ecx, ebx
call fcn.10006860
test eax, eax
je 0x10006648
push 0x3e8
lea eax, [ebp - 0xa0c]
push 0
push eax
call fcn.100119a0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0xa0c]
push str._s_shellopencommand
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.100119a0
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x622]
push edx
mov word [ebp - 0x624], cx
call fcn.100119a0
add esp, 0x30
lea eax, [ebp - 0x624]
push eax
push 2
lea edx, [ebp - 0xa0c]
mov ecx, ebx
call fcn.10006860
test eax, eax
je 0x10006648
push 0x104
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x624]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x214]
push 0x10026288
push eax
call fcn.10010383
add esp, 8
test eax, eax
jne 0x100067cd
lea ecx, [ebp - 0x214]
push 0x10026290
push ecx
call fcn.10010383
add esp, 8
test eax, eax
jne 0x100067cd
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10025654
lea edx, [ebp - 0x214]
push edx
call esi
push edi
lea eax, [ebp - 0x214]
push eax
call esi
jmp 0x100067d5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40
lea ecx, [ebp - 0xa50]
push 0
push ecx
call fcn.100119a0
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [ebp - 0xa54], 0x44
je 0x10006804
mov dword [ebp - 0xa4c], str.WinSta0Default
jmp 0x10006817
xor edx, edx
mov dword [ebp - 0xa28], 1
mov word [ebp - 0xa24], dx
lea eax, [ebp - 0xa64]
push eax
lea ecx, [ebp - 0xa54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x214]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov al, 1
pop esi
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret 4
Function at 0x10006e10
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x218], 0
mov eax, str.AppEvents
jne 0x10006e2b
mov eax, str.Network
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 4]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
cmp dword [esi + 0x218], 0
mov eax, str.AppEvents
jne 0x10006e69
mov eax, str.Network
lea ecx, [ebp - 4]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10006eac
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
add eax, eax
push eax
push esi
push 3
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006eac
mov eax, dword [ebp - 4]
push eax
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x10029128]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x80c], eax
xor eax, eax
mov ebx, 1
push str.wininet.dll
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x81c], eax
mov byte [ebp - 0x805], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.InternetOpenW
push esi
call edi
push 0
push 0
push 0
push 0
push str.MSIE_6.0
call eax
mov dword [ebp - 0x818], eax
test eax, eax
jne 0x10007040
test esi, esi
je 0x1000702d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret
push str.InternetOpenUrlW
push esi
call edi
mov edx, dword [ebp - 0x80c]
mov ecx, dword [ebp - 0x818]
push 0
push SysReAllocString
push 0
push 0
push edx
push ecx
call eax
mov dword [ebp - 0x80c], eax
test eax, eax
je 0x10007022
mov edx, dword [ebp - 0x810]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
je 0x1000712f
jmp 0x100070a0
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.100119a0
add esp, 0xc
push str.InternetReadFile
push esi
call edi
lea ecx, [ebp - 0x814]
push ecx
mov ecx, dword [ebp - 0x80c]
push 0x800
lea edx, [ebp - 0x804]
push edx
push ecx
call eax
test ebx, ebx
je 0x100070ec
mov edx, 0x5a4d
cmp word [ebp - 0x804], dx
jne 0x1000711b
mov ecx, dword [ebp - 0x814]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x81c]
push eax
mov eax, dword [ebp - 0x810]
push ecx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x814], ebx
ja 0x100070a0
jmp 0x10007122
mov byte [ebp - 0x805], 0
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push esi
call edi
mov edx, dword [ebp - 0x80c]
mov edi, eax
push edx
call edi
mov eax, dword [ebp - 0x818]
push eax
call edi
test esi, esi
je 0x1000715e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x805]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000fb9f
mov esp, ebp
pop ebp
ret
Function at 0x10007620
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x10007663
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x1000765c
mov esi, dword [eax + 0x20]
jmp 0x10007663
test bl, bl
jns 0x10007663
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x10007730
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x3c]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x100076b8
mov ecx, dword [ebx]
test cl, 0x40
je 0x100076b1
mov edi, dword [eax + 0x20]
jmp 0x100076b8
test cl, cl
jns 0x100076b8
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x100076e7
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x100076e7
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.10007570
test eax, eax
je 0x1000774e
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x1000770f
mov eax, dword [ebx]
test eax, 0x2000000
je 0x100076fe
test dword [ebp - 0x10], 0x2000000
je 0x100076fe
or dword [ebp - 0x10], eax
jmp 0x10007709
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x10007690
lea ecx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.10007570
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100081c0
Capabilities:
Check for time delay via queryperformancecounter
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [esi + 0x2f0]
push ecx
call edi
lea eax, [esi + 0xcc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ebx, [esi + 0xb8]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp + 0x10]
push edx
lea edi, [esi + 0xd4]
push 0xff
push edi
call fcn.100103e9
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push edi
mov dword [esi + 0x2d4], eax
call fcn.10011ca0
mov eax, dword [esi + 0x2d4]
lea ecx, [eax + 4]
push eax
mov dword [esi + 0x2d8], ecx
call fcn.10010127
add esp, 0x10
mov dword [esi + 0x2ec], eax
test eax, eax
je 0x100082b7
mov ecx, dword [esi + 0x2e8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
mov edx, dword [edx]
push 0
push 0
push 1
add ecx, 4
push eax
mov eax, dword [ebp + 8]
push eax
call edx
mov eax, dword [esi + 0x2f0]
push 0x1770
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100082c2
cmp eax, 0x102
je 0x100082aa
cmp eax, 0xffffffff
jne 0x100082b7
mov ecx, dword [esi + 0x2f0]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi + 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edi, [esi + 0xc0]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
sub eax, dword [ebx]
mov ecx, dword [edi + 4]
sbb ecx, dword [ebx + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
fild qword [ebp - 8]
push 1
fild qword [esi + 0xb0]
lea eax, [esi + 0xcc]
push eax
fdiv qword [0x10026488]
fdivp st(1)
fstp qword [esi + 0xa8]
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [esi + 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push 0x10008340
push 0
push 0
call fcn.10010679
add esp, 0x18
pop edi
mov dword [esi + 0x2f4], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10009270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x100092bd
cmp byte [0x1002d4b0], al
je 0x100092bd
cmp dword [0x1003155c], eax
jne 0x100092bd
push esi
call fcn.10003b30
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10008940
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008ec0
push 0
push 0
mov dword [0x1003155c], eax
call esi
pop esi
mov eax, 1
pop ebp
ret 0xc
Function at 0x100092d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1003155c], 0
jne 0x10009353
mov eax, dword [ebp + 8]
push esi
push edi
push 0x1814
push eax
push str.xiugaishiyong
call fcn.10011ca0
mov esi, dword [ebp + 0xc]
mov ecx, 0x126
mov edi, str.mainsetting
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
call fcn.10003b30
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10008940
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008ec0
push 0
push 0
mov dword [0x1003155c], eax
call esi
mov ecx, dword [0x1003155c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x1003155c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebp
ret

Function at 0x10009360
Capabilities:
Create thread

Disassembly:
cmp dword [0x1003155c], 0
jne 0x100093b8
push esi
call fcn.10003b30
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10008940
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10008ec0
push 0
push 0
mov dword [0x1003155c], eax
call esi
mov eax, dword [0x1003155c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x1003155c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
ret