joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030740
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x40c]
mov eax, edx
cmp dword [ebp + 8], edx
mov edi, dword [esi]
cmova eax, dword [ebp + 8]
add eax, edx
mov dword [esi + 0x40c], eax
add eax, eax
jns 0x10030781
push dword [0x10174460]
call dword [sym.imp.kernel32.dll_TlsGetValue]
push dword [esi + 0x40c]
call sym.fpsrvutl.dll_Ordinal_2749
push eax
call fcn.10047e8b
mov eax, dword [esi + 0x40c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.1003b713
mov edx, dword [esi + 0x40c]
mov ecx, dword [esi + 0x408]
inc edx
cmp edx, ecx
mov dword [esi], eax
cmovae edx, ecx
add edx, edx
push edx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [esi + 4]
add esp, 0xc
cmp edi, eax
je 0x100307ca
push edi
call fcn.10047e8b
pop ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x10037cb2
Capabilities:
Get hostname

Disassembly:
push 0x94
mov eax, 0x100e23d8
call fcn.10001b03
mov esi, ecx
push 0x80
lea eax, [ebp - 0x94]
xor ebx, ebx
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x10037ce2
xor eax, eax
jmp 0x10037ddc
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x98]
call fcn.10047e8b
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x98]
push 0x2e
lea ecx, [ecx - 0xc]
call fcn.10047e8b
cmp eax, 0xffffffff
je 0x10037d18
push eax
lea ecx, [ebp - 0x98]
call fcn.10047e8b
lea eax, [ebp - 0x98]
mov ecx, esi
push eax
call fcn.10047e8b
lea eax, [ebp - 0x98]
lea edi, [esi + 4]
push eax
mov ecx, edi
call fcn.10047e8b
push 0x100ee700
push str.CheckedHostName
push str.MicrosoftShared_ToolsWeb_Server_Extensions
push 0x80000002
push 1
lea eax, [ebp - 0x9c]
mov byte [esi + 0xc], bl
push eax
call sym.fpsrvutl.dll_Ordinal_1532
push 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c]
push dword [esi]
call fcn.10047e8b
test eax, eax
je 0x10037d79
mov byte [esi + 0xc], 1
jmp 0x10037dbc
push 0x100ee700
push str.HostOverride
push str.MicrosoftShared_ToolsWeb_Server_Extensions
push 0x80000002
push 1
lea eax, [ebp - 0xa0]
push eax
call sym.fpsrvutl.dll_Ordinal_1532
mov esi, dword [ebp - 0xa0]
cmp dword [esi - 4], ebx
je 0x10037db4
lea eax, [ebp - 0xa0]
mov ecx, edi
push eax
call fcn.10047e8b
lea ecx, [esi - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov ecx, dword [ebp - 0x9c]
mov esi, dword [edi]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov ecx, dword [ebp - 0x98]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, esi
call fcn.10001b39
ret
Function at 0x10037f21
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1014d250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor edx, edx
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10037f5a
test esi, esi
jne 0x10037f60
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100013fd
leave
ret 8
mov dword [edi], edx
test esi, esi
je 0x10037f62
mov dword [esi], edx
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x105
push edx
push dword [ecx]
push edx
call dword [sym.imp.kernel32.dll_SearchPathA]
test eax, eax
je 0x10037f47
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebx, eax
test ebx, ebx
je 0x10037f47
mov ecx, ebx
call fcn.1003b713
push eax
push ebx
push dword [ebp - 0x114]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
mov ebx, eax
test ebx, ebx
je 0x10038002
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x100f0440
push dword [ebp - 0x110]
call dword [sym.imp.VERSION.dll_VerQueryValueA]
mov ebx, eax
test ebx, ebx
je 0x10038002
mov ecx, dword [ebp - 0x118]
test edi, edi
je 0x10037ff9
mov eax, dword [ecx + 8]
mov dword [edi], eax
test esi, esi
je 0x10038002
mov eax, dword [ecx + 0xc]
mov dword [esi], eax
push dword [ebp - 0x110]
call fcn.10047e8b
pop ecx
mov al, bl
jmp 0x10037f49
Function at 0x10038bed
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x100e25ea
call fcn.10001b03
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], ebx
mov dword [esi], 0x10181f8c
lock inc dword [0x10181f80]
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], ebx
push eax
push 0x1a
push ebx
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x21c], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x10038d2b
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10038cef
push 0x100f9a9c
lea ecx, [ebp - 0x228]
call sym.fpsrvutl.dll_Ordinal_150
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x224]
call sym.fpsrvutl.dll_Ordinal_150
push 0x100ee700
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x240]
call sym.fpsrvutl.dll_Ordinal_3585
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
lea eax, [ebp - 0x240]
mov ecx, esi
push eax
call fcn.10047e8b
lea ecx, [ebp - 0x240]
call sym.fpsrvutl.dll_Ordinal_974
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x10038d2b
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x10038d2b
cmp dword [ebp - 0x21c], 0
je 0x10038d25
push dword [ebp - 0x21c]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x220]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi]
cmp dword [eax - 4], ebx
jne 0x10038d55
push edi
lea eax, [ebp - 0x220]
push eax
call sym.fpsrvutl.dll_Ordinal_5240
push eax
mov ecx, esi
call fcn.10047e8b
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, esi
call fcn.10001b39
ret 8

Function at 0x1003926d
Capabilities:
Create directory

Disassembly:
push 0x218
mov eax, 0x100e261d
call fcn.10001b03
mov edi, ecx
call sym.fpsrvutl.dll_Ordinal_1195
push edi
lea ecx, [ebp - 0x220]
call fcn.10047e8b
xor esi, esi
mov ecx, 0x1017e06c
mov dword [ebp - 4], esi
call sym.fpsrvutl.dll_Ordinal_2694
push esi
push dword [ebp - 0x20]
cmp eax, 2
jne 0x100392af
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
jmp 0x100392b5
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x100392c0
mov esi, 0x20003
jmp 0x100392f0
cmp byte [ebp + 8], 0
je 0x10039304
push 2
pop edx
lea ecx, [ebp - 0x220]
call fcn.100a1aa9
test eax, eax
jne 0x10039304
mov ecx, edi
call sym.fpsrvutl.dll_Ordinal_2142
test eax, eax
je 0x100392eb
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov esi, 0x20051
mov edi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
mov edx, eax
mov ecx, esi
call fcn.1006a99f
mov esi, eax
lea ecx, [ebp - 0x220]
call fcn.100058ed
mov eax, esi
call fcn.10001b39
ret 4
Function at 0x1003b713
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x10181be0], 0
jne sym.fpsrvutl.dll_Ordinal_5011
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
ret

Function at 0x1003eb38
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], ebx
cmp byte [ebp + 8], bl
je 0x1003eb6d
push 4
cmp dword [0x10181be0], ebx
je 0x1003eb5a
pop ecx
call fcn.10047e8b
jmp 0x1003eb61
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
test eax, eax
je 0x1003eb6d
mov dword [eax], vtable.VmsoApi.0
jmp 0x1003eb6f
mov eax, ebx
mov dword [esi + 4], eax
mov al, byte [ebp + 8]
mov byte [esi + 8], al
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x1003eb8e
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [esi + 0xc], eax
cmp byte [0x10180b48], bl
jne 0x1003ebbc
mov ecx, 0x1017df40
call fcn.10047e8b
test al, al
je 0x1003ebaf
call fcn.100b3521
test eax, eax
je 0x1003ebaf
mov bl, 1
mov byte [0x10180b49], bl
mov byte [0x10180b48], 1
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10042abc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10
push 1
mov edi, sym.fpsrvutl.dll_Ordinal_53
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10042b01
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
test eax, eax
je 0x10042b01
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x10042b01
cmp word [eax + 2], 0
je 0x10042b01
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x10042b01
add eax, 0x30
jmp 0x10042b06
mov eax, 0x100eefec
pop edi
pop esi
ret

Function at 0x10047e8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10047e9a
pop dword [ebp - 0x10]
mov eax, 0x3a027440
sub eax, 0x29fdf5a6
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x807aa
push 0
mov eax, 0xb85dc562
sub eax, 0xa84ee332
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xdbcc3216
sub ecx, 0xdbcbd8b2
mov ebx, eax
mov esi, 0x2be76565
sub esi, 0x1bce3365
add esi, dword [ebp - 0x10]
mov edx, 0x1c85960b
mov edi, dword [esi]
add dword [ebp - 4], 0x449fe4e2
xor edi, edx
mov dword [ebp - 0xc], 0xe83294e
mov dword [ebx], edi
add ebx, 4
add esi, 4
loop 0x10047ef3
add eax, 0x15863
mov ebx, eax
add eax, 0xc3a5c693
add eax, 0x3c5a3972
mov ecx, sym.fpsrvutl.dll_Ordinal_53
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x10051777
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_2016

Function at 0x10051780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_4301

Function at 0x10051789
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_783

Function at 0x10051792
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_3995

Function at 0x1005179b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_1161

Function at 0x100517a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_2453

Function at 0x10052259
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 8]
mov edx, esi
push edi
lea edi, [ecx + 0xc]
mov ecx, esi
shr ecx, 2
test ecx, ecx
je 0x1005227b
mov eax, dword [edi]
add edi, 4
rol edx, 5
xor edx, eax
sub ecx, 1
jne 0x1005226c
and esi, 3
je 0x10052295
xor ecx, ecx
movsx eax, byte [edi]
shl ecx, 8
or ecx, eax
inc edi
sub esi, 1
jne 0x10052282
rol edx, 5
xor edx, ecx
pop edi
mov eax, edx
pop esi
ret

Function at 0x10057e7c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
push 1
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4
Function at 0x10064a48
Capabilities:
Get domain controller name

Disassembly:
push 8
mov eax, 0x100e3850
call fcn.10001371
mov ebx, 0x1017e06c
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_2694
cmp eax, 2
je 0x10064a6c
xor eax, eax
jmp 0x10064b4f
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push edi
xor esi, esi
call sym.fpsrvutl.dll_Ordinal_150
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.100a49fe
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.10047e8b
test al, al
jne 0x10064b42
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_869
cmp eax, 3
sete cl
test edi, edi
je 0x10064afd
cmp word [edi], si
je 0x10064afd
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10064aca
test cl, cl
je 0x10064ac3
call fcn.100a5159
jmp 0x10064ac8
call sym.fpsrvutl.dll_Ordinal_4523
mov eax, dword [eax]
push edi
push eax
call fcn.10047e8b
test eax, eax
je 0x10064afd
lea eax, [ebp - 0x10]
push eax
push 0x40010010
push esi
push esi
push edi
push esi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov esi, eax
test esi, esi
je 0x10064afd
mov ecx, dword [ebp + 0xc]
push 0x100ee700
call fcn.10047e8b
jmp 0x10064b2b
cmp dword [ebp - 0x10], 0
je 0x10064b18
call fcn.100a49fe
mov ecx, dword [ebp - 0x10]
push dword [ecx]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.100647d6
call fcn.100a49fe
push dword [ebp + 0xc]
lea edx, [ebp - 0x14]
mov ecx, eax
push edx
call fcn.10047e8b
cmp dword [ebp - 0x10], 0
je 0x10064b42
mov ecx, ebx
call sym.fpsrvutl.dll_Ordinal_3269
push dword [ebp - 0x10]
mov ecx, eax
call fcn.10047e8b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff4
call sym.fpsrvutl.dll_Ordinal_5727
mov eax, esi
call fcn.1000140a
ret 0xc

Function at 0x10065b23
Capabilities:
Get thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x10174460]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10065b3e
mov ecx, eax
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_2134
pop ebp
ret 0x18

Function at 0x10065b42
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x10174460]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10065b5f
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov ecx, eax
pop ebp
jmp edx
xor eax, eax
pop ebp
ret 4
Function at 0x100669aa
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
xor ecx, ecx
mov eax, edi
mov dword [ebp - 8], ecx
mov esi, ecx
mov byte [ebp - 1], cl
sub eax, ecx
je 0x100669d1
dec eax
sub eax, 1
je 0x100669e1
sub eax, 1
jne 0x100669fc
push dword [0x10181d44]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x100669ec
mov eax, dword [0x10181be4]
test eax, eax
je 0x100669fc
jmp 0x100669f5
cmp eax, 0xffffffff
je 0x100669fc
test edi, edi
jne 0x100669f9
mov esi, dword [eax]
jmp 0x100669fc
mov esi, dword [eax + 4]
cmp ebx, 0x40000000
ja 0x10066ab1
lea edx, [ebx + 0xf]
and edx, 0xfffffff8
test esi, esi
je 0x10066a39
test byte [esi + 0xc], 0x20
je 0x10066a22
add edx, 0x1f
mov byte [ebp - 1], 1
and edx, 0xfffffff8
test esi, esi
je 0x10066a39
mov ecx, dword [esi]
lea edi, [ebp - 8]
push 0
mov dword [ebp - 8], edx
push edi
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
jmp 0x10066a41
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov edi, eax
test edi, edi
je 0x10066ab1
cmp byte [ebp - 1], 0
je 0x10066aa7
test byte [esi + 0xc], 0x80
je 0x10066a5a
mov ecx, esi
call fcn.10047e8b
mov eax, dword [0x10181be4]
mov ecx, dword [eax]
test ecx, ecx
je 0x10066a74
cmp ecx, esi
je 0x10066a74
test byte [ecx + 0xc], 0x80
je 0x10066a74
call fcn.10047e8b
mov ecx, esi
call fcn.100666f2
mov dword [edi], eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
or dword [edi + 0xc], 0xffffffff
mov ecx, esi
mov dword [edi + 4], eax
mov dword [edi + 8], str._unknown_file_
mov dword [edi + 0x10], ebx
mov eax, dword [ebp - 8]
mov dword [edi + 0x14], eax
push dword [ebp - 8]
call fcn.10047e8b
add edi, 0x18
mov dword [edi], esi
lea eax, [edi + 8]
pop edi
pop esi
pop ebx
leave
ret
call fcn.10047e8b
int3

Function at 0x10066d80
Capabilities:
Get system information on windows

Disassembly:
push 0x28
mov eax, 0x100e44b1
call fcn.10001371
mov edi, ecx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x20]
xor ecx, ecx
push 0x18
mov eax, ebx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
cmp dword [0x10181be0], 0
je 0x10066dcc
push 2
pop edx
mov ecx, eax
call fcn.10047e8b
jmp 0x10066dd4
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
je 0x10066df8
push 0x1006837e
push 0x10066e02
push ebx
lea esi, [eax + 4]
mov dword [eax], ebx
push 0x18
push esi
call fcn.100de9d3
mov dword [edi], esi
mov eax, edi
call fcn.1000140a
ret
Function at 0x100676ac
Capabilities:
Get system information on windows

Disassembly:
push 0x28
mov eax, 0x100e44b1
call fcn.10001371
mov edi, ecx
xor ebx, ebx
xor esi, esi
inc ebx
mov dword [edi + 8], esi
push ebx
mov dword [edi + 0x10], esi
call fcn.100679ca
mov dword [edi], eax
cmp dword [0x10181be0], esi
je 0x100676e2
push 2
pop edx
push 4
pop ecx
call fcn.10047e8b
jmp 0x100676eb
push 4
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x100676fe
mov ecx, eax
call fcn.10066d80
jmp 0x10067700
mov eax, esi
push esi
mov esi, dword [sym.imp.kernel32.dll_CreateMemoryResourceNotification]
mov dword [edi + 4], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x1006773a
mov eax, dword [eax]
test eax, eax
je 0x1006773a
cmp dword [eax + 0x28], 0xdeadbeef
je 0x1006773c
xor ebx, ebx
mov dword [edi + 0xc], ebx
mov eax, edi
call fcn.1000140a
ret

Function at 0x1006781c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1014d250]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10181be4]
xor eax, eax
mov dword [ebp - 0x48], eax
test ecx, ecx
je 0x10067895
cmp dword [ecx + 0x10], eax
je 0x10067895
lea eax, [ebp - 0x48]
push eax
push dword [ecx + 0x10]
call dword [sym.imp.kernel32.dll_QueryMemoryResourceNotification]
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x10067895
push 0x40
push eax
lea eax, [ebp - 0x44]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x10067892
cmp dword [ebp - 0x10], 0
ja 0x1006788e
jb 0x10067889
cmp dword [ebp - 0x14], 0x18000000
jae 0x1006788e
xor eax, eax
inc eax
jmp 0x10067895
xor eax, eax
jmp 0x10067895
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100013fd
leave
ret

Function at 0x10067fbb
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
call sym.fpsrvutl.dll_Ordinal_3209
test eax, eax
je 0x10067fd1
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10067fd1
pop ebp
jmp sym.fpsrvutl.dll_Ordinal_3060
pop ebp
ret 4
Function at 0x10068080
Capabilities:
Print debug messages

Disassembly:
push 0x224
mov eax, 0x100e45e1
call fcn.10001b03
mov esi, ecx
mov eax, dword [esi + 0x10]
sub eax, 1
je 0x1006809e
sub eax, 3
jne 0x100680a5
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x54]
and dword [ebp - 0x218], 0
mov ebx, dword [esi]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [ebp - 0x22c], eax
mov edi, 0x100
mov eax, dword [esi + 0xc]
shr eax, 5
and eax, 0xffffff01
mov byte [ebp - 0x211], 0
mov dword [ebp - 0x224], eax
test dword [esi + 0xc], edi
je 0x10068261
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test dword [esi + 0xc], edi
jne 0x1006828c
jmp 0x10068261
cmp byte [ebp - 0x212], 0
je 0x10068261
mov edi, dword [ebp - 0x218]
mov eax, dword [ebp - 0x224]
lea ecx, [edi + 0x18]
test al, al
jne 0x10068117
mov ecx, edi
add ecx, 8
xor edx, edx
test al, al
mov dword [ebp - 0x230], ecx
cmove edi, edx
cmp byte [ebp - 0x211], dl
jne 0x100681a5
test dword [esi + 0xc], 0x100
je 0x1006815b
test al, al
je 0x1006814e
mov eax, dword [ebp - 0x22c]
cmp dword [edi + 4], eax
jne 0x1006825c
and dword [edi + 4], edx
push str._r_nGlobal_memory_allocations__not_freed__by_this_request__not_necessarily_a_leak__r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10068192
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10001e94
xor ecx, ecx
push str._r_nDetected_memory_leaks__r_n
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [vtable.VprocessGlobals.0]
push ecx
push 0x1017e06c
call dword [eax + 0x24]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
add esp, 0x10
call fcn.10002232
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x230]
mov byte [ebp - 0x211], 1
test al, al
je 0x100681dd
push dword [edi + 0xc]
cmp dword [edi + 8], 0
mov eax, 0x100ee700
cmovne eax, dword [edi + 8]
push eax
push 0
push dword [edi + 0x10]
lea eax, [edi + 0x18]
push eax
push dword [edi]
lea eax, [ebp - 0x210]
push str.Memory_leak:__Allocation__08d__Address_0x_08p_total__I64u_bytes__n_____________in__s_at_line__d_n
push 0xffffffffffffffff
push eax
call fcn.10047e8b
add esp, 0x24
jmp 0x10068200
mov eax, dword [ebp - 0x228]
push 0
add eax, 0xfffffffc
push eax
push ecx
push str.Memory_leak:_Address_0x_08p_approximate_total__I64u_bytes__n
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
call fcn.10047e8b
add esp, 0x18
mov edi, 0x100
mov byte [ebp - 0x11], 0
test dword [esi + 0xc], edi
je 0x1006821d
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10068261
push ecx
lea ecx, [ebp - 0x220]
call fcn.10001e94
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 1
mov eax, dword [vtable.VprocessGlobals.0]
push ecx
push 0
push 0
push 0x1017e06c
call dword [eax + 0x24]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
add esp, 0x10
call fcn.10002232
jmp 0x10068261
mov edi, 0x100
mov eax, dword [ebx]
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x218]
push ecx
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x212]
push ecx
mov ecx, ebx
call eax
test al, al
jne 0x100680f5
test dword [esi + 0xc], edi
je 0x10068293
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
call fcn.10001b39
ret
Function at 0x1006abc1
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x1017e06c
call sym.fpsrvutl.dll_Ordinal_2694
mov ecx, dword [esi + 0x200]
push ecx
cmp eax, 2
jne 0x1006abe2
call dword [sym.imp.kernel32.dll_DeleteFileW]
pop esi
ret
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop esi
ret

Function at 0x1006b34f
Capabilities:
Delete registry value

Disassembly:
push 0x214
mov eax, 0x100e4841
call fcn.10001b03
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x220]
test ebx, ebx
mov eax, 0x100ee700
cmovne eax, ebx
push eax
call fcn.10047e8b
lea eax, [ebp - 0x220]
xor edi, edi
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.10047e8b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
mov esi, dword [esi + 0xc]
mov ecx, 0x1017e06c
call sym.fpsrvutl.dll_Ordinal_2694
push dword [ebp - 0x1c]
push esi
cmp eax, 2
jne 0x1006b3c0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1006b3c6
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
je 0x1006b407
cmp dword [0x10181be0], 0
push 0x14
je 0x1006b3df
pop ecx
call fcn.10047e8b
jmp 0x1006b3e6
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1006b407
push ebx
push esi
push edi
push 0x30021
push eax
call sym.fpsrvutl.dll_Ordinal_5274
add esp, 0x14
mov edi, eax
lea ecx, [ebp - 0x21c]
call fcn.100058ed
mov eax, edi
call fcn.10001b39
ret 4