joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cd00
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x44cd34
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0044cc10
test eax, eax
jne 0x44cd4d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0044cc80
cmp eax, 1
je 0x44ceda
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x44cd86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x44ce02
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44ce82
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.0044cb40
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x44ce99
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x44cda2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x44ce50
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.0044c7f0
test eax, eax
je 0x44ce82
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x44ce1e
cmp dword [esp + 0x18], 1
jb 0x44ce82
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push getpeername
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.0044c6d0
cmp eax, 1
je 0x44cecb
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x44cea9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x44ce82
push ebp
mov ecx, ebx
call fcn.0044cef0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44ceda
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x44cef0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x44cf22
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.0044cc80
test eax, eax
jne 0x44cf3f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x44cf66
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x44cfb4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.0044c990
test eax, eax
jne 0x44cf9d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x44cf83
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push getpeername
mov ecx, edi
call fcn.0044c760
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x44cfd7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x453f10
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x453f76
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x453f76
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x453f57
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x454300
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x454338
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x454f60
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x454fa9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x455420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4780d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00454fd0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00455050
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00455050
lea ecx, [esi + 0xc]
call fcn.00469b98
lea ecx, [esi + 0x10]
call fcn.00469b98
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004565e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004565e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004565e0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00469c0d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00469c0d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46bfb4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46bfec
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046a068
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046a040
jmp 0x46bff8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46d6a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46d6e4
call fcn.0047341c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46d6e4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46d6db
xor eax, eax
jmp 0x46d6ec
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046d6f2
pop edi
pop esi
pop ebx
ret 4

Function at 0x47394c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47397a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x473998
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004738b2
jmp 0x473998
mov eax, dword [esi + 0x14]
test eax, eax
je 0x473998
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004738b2
test edi, edi
mov eax, edi
jne 0x473982
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001200
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
cmp word [eax], 0x5a4d
push edi
je 0x10001218
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x10], edi
cmp dword [edi], 0x4550
je 0x10001231
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov ebp, eax
test ebp, ebp
jne 0x10001268
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov ebp, eax
test ebp, ebp
jne 0x10001268
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push eax
push ebp
call esi
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push ebp
call esi
mov esi, dword [esp + 0x18]
mov edx, dword [edi + 0x54]
mov edi, eax
push ebx
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
push ecx
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], ebp
call fcn.10001350
mov ecx, dword [esi + 0x34]
mov eax, ebp
add esp, 0xc
sub eax, ecx
je 0x100012f1
push eax
push ebx
call fcn.100014e0
add esp, 8
push ebx
call fcn.10001560
add esp, 4
test eax, eax
je 0x10001321
push ebx
call fcn.10001420
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x10001339
add eax, ebp
test eax, eax
je 0x10001321
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x10001332
push ebx
call fcn.10001720
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x10001350
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x10001411
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x100013bb
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x100013ef
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x100013ef
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x1000137e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10001420
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x100014d4
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10001477
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100014ba
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x100040dc]
je 0x1000148e
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x100014a7
test al, 0x40
je 0x1000149e
mov ecx, dword [ebx + 0x20]
jmp 0x100014a5
test al, 0x80
je 0x100014ba
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x100014ba
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x10001444
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10001b5d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
mov esp, ebp
nop
pop ebp
add eax, 0
jne 0x10001aed
je 0x10001aed
call 0x7800db74
xor byte [eax], al
adc byte [eax + 0x24], ch
inc eax
add byte [eax], dl
add eax, 0
push str.PathRemoveFileSpecA
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
xor ecx, ecx
mov byte [ebp - 0x18], 0x5c
mov dword [ebp - 0x17], ecx
mov byte [ebp - 0x17], 0x74
mov dword [ebp - 0x13], ecx
mov byte [ebp - 0x16], 0x65
mov word [ebp - 0xf], cx
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xd], cl
mov byte [ebp - 0x14], 0x70
nop
nop
push ebp
nop
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 0xa
sub esp, 0xa
test esi, esi
add esp, 6
sub esp, 6
mov esp, ebp
pop ebp
push 0x100046c8
call eax
lea edx, [ebp - 0x18]
push edx
push 0x100046c8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
nop
nop
push ebp
mov ebp, esp
add esp, 0xa
add esp, 0xfffffff6
inc ecx
dec ecx
add esp, 2
sub esp, 2
push 0xffff8016
nop
mov esp, ebp
nop
nop
pop ebp
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x100046c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001c73
nop
push ebp
nop
mov ebp, esp
push 0xffffb87d
inc ecx
dec ecx
nop
nop
mov esp, ebp
nop
pop ebp
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x1d4c0
mov dword [ebp - 4], eax
jb 0x10001c73
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
nop
nop
mov ebp, esp
inc ecx
dec ecx
push esi
pop esi
nop
mov esp, ebp
nop
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push 0x10004020
push edx
push edi
call fcn.100019b0
xor eax, eax
push edi
mov dword [ebp - 0xb], eax
mov byte [ebp - 0xc], 0x52
mov word [ebp - 7], ax
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 5], al
mov byte [ebp - 0xa], 0x6e
call fcn.10001200
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10001c5a
nop
nop
push ebp
nop
mov ebp, esp
test esi, esi
add esp, 3
add esp, 0xfffffffd
mov esp, ebp
nop
pop ebp
lea ecx, [ebp - 0xc]
push ecx
push esi
call fcn.10001680
add esp, 8
call eax
push esi
call fcn.10001720
add esp, 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10007039
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007039
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000702a
cmp esi, edx
jae 0x10007039
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10007018
cmp esi, edx
jae 0x10007039
cmp word [esi], 0
je 0x10007039
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000bf80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1013b7e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
je 0x1000c050
push 0x208
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100c56b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.nBench_AIBenchmark.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000c050
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 8], eax
test eax, eax
je 0x1000c050
push str.CreateAiMarkResDownload
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 4], eax
test eax, eax
je 0x1000c050
call eax
mov ecx, eax
mov dword [esi + 0xc], ecx
test ecx, ecx
je 0x1000c038
mov edx, dword [ecx]
push esi
call dword [edx]
mov ecx, dword [esi + 0xc]
xor eax, eax
test ecx, ecx
pop esi
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10089d41
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10089d41
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f0413
mov eax, dword fs:[0]
push eax
mov eax, 0x40dc
call fcn.10089e90
mov eax, dword [0x1013b7e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x404c], ebx
mov dword [ebp - 0x4044], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
push 0x4000
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4010]
push eax
mov dword [ebp - 0x4044], 1
call fcn.100c56b0
add esp, 0xc
mov dword [ebp - 0x4048], 0x2000
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1000d510
mov eax, dword [esi]
lea ecx, [ebp - 0x4048]
push ecx
lea ecx, [ebp - 0x4010]
push ecx
lea ecx, [ebp - 0x4050]
push ecx
push str.token
push eax
push dword [esi + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1000d619
call fcn.10088cd0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1000d640
push 0x63
push str.d:jenkins.jenkinsworkspacemaster_lucomputerz_cncompuerz_cnludashi_srccommon_token_helper.cc
lea ecx, [ebp - 0x4040]
mov dword [ebp - 0x4030], eax
mov dword [ebp - 0x402c], 0xf
mov byte [ebp - 0x4040], al
call fcn.100070f0
push 3
push 0x10102f98
lea ecx, [ebp - 0x4028]
mov dword [ebp - 4], 1
mov dword [ebp - 0x4018], 0
mov dword [ebp - 0x4014], 0xf
mov byte [ebp - 0x4028], 0
call fcn.100070f0
mov byte [ebp - 4], 2
call fcn.10088cd0
mov edi, eax
lea ecx, [ebp - 0x40e8]
push 0x76
lea eax, [ebp - 0x4040]
push eax
lea eax, [ebp - 0x4028]
push eax
call fcn.10007cd0
mov esi, eax
push str.read_regedit_failed
push esi
mov byte [ebp - 4], 3
call fcn.10008a00
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x40e8]
call fcn.10008b30
lea ecx, [ebp - 0x4028]
call fcn.10005ec0
lea ecx, [ebp - 0x4040]
call fcn.10005ec0
jmp 0x1000d640
lea ecx, [ebp - 0x4010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000d622
sub ecx, edx
lea eax, [ebp - 0x4010]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.1000c350
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10089d41
mov esp, ebp
pop ebp
ret 4
Function at 0x1000df20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1013b7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push 0x50
push 0
push eax
mov esi, ecx
call fcn.100c56b0
add esp, 0xc
lea eax, [ebp - 0x54]
push dword [esi]
push 0x28
push eax
push 0x101018f8
push str.latest_auth_score
push dword [0x1013905c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x54]
push eax
push dword [edi]
call fcn.100cbf12
mov ecx, dword [ebp - 4]
add esp, 8
neg eax
sbb eax, eax
xor ecx, ebp
pop edi
inc eax
pop esi
call fcn.10089d41
mov esp, ebp
pop ebp
ret 4