joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100021d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2c0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov byte [esp + 0x1a4], al
mov edi, dword [esp + 0x2d4]
lea eax, [ebp + 4]
lea ecx, [esp + 0x1a4]
push eax
push 0x12c
push ecx
push 0x100113d4
push str._Req_Capture
push str.Component
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x1a4]
test al, al
je 0x100022e5
lea edx, [esp + 0x14]
push 0x64
lea eax, [esp + 0x1a8]
push edx
push eax
call fcn.10001af0
add esp, 0xc
test eax, eax
jle 0x100022e5
xor ebx, ebx
xor esi, esi
test eax, eax
jle 0x100022e5
cmp dword [esp + esi*4 + 0x14], 1
je 0x100022c2
mov edi, dword [ebp + 0x650]
xor ecx, ecx
test edi, edi
jle 0x100022b8
mov edx, dword [esp + esi*4 + 0x14]
test edx, 0xffff0000
jne 0x10002284
or edx, 0x10020000
mov dword [esp + esi*4 + 0x14], edx
mov edx, dword [esp + esi*4 + 0x14]
test dl, dl
jne 0x100022a1
mov ebp, dword [ebp + ecx*4 + 0x5a8]
and ebp, 0xffffff00
cmp ebp, edx
mov ebp, dword [esp + 0x10]
jmp 0x100022a8
cmp dword [ebp + ecx*4 + 0x5a8], edx
jne 0x100022b3
mov ebx, 1
mov ecx, edi
mov esi, eax
inc ecx
cmp ecx, edi
jl 0x1000226e
inc esi
cmp esi, eax
jl 0x1000225b
cmp ebx, 1
jne 0x100022d1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c0
ret 4
mov eax, dword [esp + 0x2d4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c0
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c0
ret 4
Function at 0x100025e0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.Req_MMX
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jle 0x10002614
mov ecx, dword [esi + 0x6ac]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x10002620
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str._Req_MMX
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jle 0x10002654
mov ecx, dword [esi + 0x6ac]
xor eax, eax
test ecx, ecx
pop edi
pop esi
sete al
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x10002660
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.CheckMMT
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x10002695
mov ecx, dword [esi + 0x6b0]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret 4
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x10002720
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
mov dword [0x1000e074], 1
call fcn.10003740
cmp dword [0x1000e074], 1
jne 0x10002915
push 1
mov ecx, esi
call fcn.10001780
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100017c0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100018b0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100019d0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001cf0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001de0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001ed0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001fc0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100020b0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100021d0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10002300
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100025e0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10002660
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10002620
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001850
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100026a0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.100026e0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001810
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001b50
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10001c20
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10002aa0
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10002a60
cmp eax, 1
mov dword [0x1000e074], eax
jne 0x10002915
push eax
mov ecx, esi
call fcn.10002ae0
mov dword [0x1000e074], eax
add esi, 4
push esi
push 0xffffffffffffffff
push str.MeetsRequirement
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
pop esi
je 0x10002936
mov dword [0x1000e074], eax
ret

Function at 0x10002940
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
mov dword [0x10011b3c], 0x64
push ecx
push 0xffffffffffffffff
push str.Size
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x1000296a
mov dword [0x10011b3c], eax
ret

Function at 0x10002970
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
mov dword [0x10011b40], 0
push ecx
push 0xffffffffffffffff
push str.Order
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x1000299a
mov dword [0x10011b40], eax
ret
Function at 0x100029a0
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
mov dword [0x1000e078], 1
push ecx
push 0xffffffffffffffff
push str.Reboot
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x100029d2
xor ecx, ecx
test eax, eax
setg cl
mov dword [0x1000e078], ecx
ret

Function at 0x100029e0
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
mov dword [0x10011b48], 1
push ecx
push 0xffffffffffffffff
push str.Default
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x10002a12
xor ecx, ecx
test eax, eax
setg cl
mov dword [0x10011b48], ecx
ret

Function at 0x10002a20
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
mov dword [0x10011b44], 0
push ecx
push 0xffffffffffffffff
push str.Mutual
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x10002a52
xor ecx, ecx
test eax, eax
setg cl
mov dword [0x10011b44], ecx
ret

Function at 0x10002a60
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.ReqSBSMBus
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x10002a95
mov ecx, dword [esi + 0x6bc]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x10002aa0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.ReqAudio
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x10002ad5
mov ecx, dword [esi + 0x6c0]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret 4
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x10002ae0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 4]
push eax
push 0xffffffffffffffff
push str.ReqNetwork
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x10002b15
mov ecx, dword [esi + 0x6c4]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
ret 4
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x10003010
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
mov dword [0x1000e080], 1
push ecx
push 0xffffffffffffffff
push str.Visible
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x10003042
xor ecx, ecx
test eax, eax
setg cl
mov dword [0x1000e080], ecx
ret

Function at 0x10003050
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
mov dword [0x1000e084], 1
push ecx
push 0xffffffffffffffff
push str.WaitMessage
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x10003082
xor ecx, ecx
test eax, eax
setg cl
mov dword [0x1000e084], ecx
ret

Function at 0x10003320
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
mov eax, dword [esp + 0x108]
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp eax, 3
mov dword [esp + 0x10], edi
jge 0x1000334b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 8
mov ebx, dword [esp + 0x114]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x4c]
push 0xc8
push ecx
push 0x100113d4
push str.ReqComp
push str.Component
mov byte [ebx], 0
mov byte [ebx + 1], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x48]
test al, al
je 0x100033fd
lea esi, [esp + 0x48]
xor ebp, ebp
jmp 0x10003390
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0x32
push edx
push esi
mov ecx, edi
call fcn.10003090
mov esi, eax
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebp + 2]
mov ecx, dword [esp + 0x118]
cmp eax, ecx
jg 0x1000340f
mov edx, ebx
lea ecx, [esp + 0x14]
lea eax, [esp + 0x14]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100033ca
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x14]
lea ebx, [ebx + ecx + 1]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test esi, esi
lea ebp, [ecx + ebp + 1]
jne 0x1000338c
mov byte [ebx], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret 8
pop edi
mov byte [ebx], 0
pop esi
mov byte [ebx + 1], 0
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret 8

Function at 0x10003430
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
add ecx, 4
push ecx
mov ecx, dword [esp + 8]
push eax
push ecx
push 0x100113d4
push str.InstallCommandLine
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
ret 8

Function at 0x10003460
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
add ecx, 4
push ecx
mov ecx, dword [esp + 8]
push eax
push ecx
push 0x100113d4
push str.DisplayName
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
ret 8

Function at 0x10003500
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
add ecx, 4
push esi
mov esi, dword [esp + 8]
push ecx
push eax
push esi
push 0x100113d4
push 0x1000e340
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov cl, byte [esi]
xor eax, eax
test cl, cl
setne al
pop esi
ret 8
Function at 0x10003580
Capabilities:
Get installed programs
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x460
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x27c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 1
lea eax, [edi + 4]
mov dword [esp + 0x20], 0x1f4
push eax
push 0x1f4
push ecx
push 0x100113d4
push str.UninstallComp
push str.Component
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x27c]
test al, al
jne 0x100035e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x460
ret 8
mov eax, dword [esp + 0x474]
lea edx, [esp + 0x18]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
lea esi, [esp + 0x290]
mov ebp, eax
mov byte [eax], 0
mov byte [eax + 1], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10003626
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x460
ret 8
xor ebx, ebx
jmp 0x1000362e
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push 0x64
push eax
push esi
mov ecx, edi
call fcn.10003090
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
push ecx
push 0xf003f
lea edx, [esp + 0x2c]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100036fb
mov ecx, 0x7d
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.UninstallString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100036fb
lea edi, [esp + 0x88]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x478]
not ecx
dec ecx
lea edx, [ecx + ebx + 2]
cmp edx, eax
jg 0x10003719
mov edx, ebp
lea ecx, [esp + 0x88]
lea eax, [esp + 0x88]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100036c9
lea edi, [esp + 0x88]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x88]
lea ebp, [ecx + ebp + 1]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [ebx + ecx + 1]
test esi, esi
jne 0x1000362a
pop edi
mov byte [ebp], 0
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x460
ret 8
mov byte [ebp], 0
pop edi
mov byte [ebp + 1], 0
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x460
ret 8
Function at 0x10003e90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x128
mov al, byte [0x100113d4]
push esi
push edi
mov byte [esp + 0x2c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 9
xor eax, eax
lea edi, [esp + 8]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
mov dword [0x10011aa0], esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [str.kernel32.dll]
repne scasb al, byte es:[edi]
mov eax, dword [0x1000e678]
mov ecx, dword [0x1000e67c]
dec edi
mov dword [edi], edx
mov dx, word [0x1000e680]
mov dword [edi + 4], eax
lea eax, [esp + 0x2c]
push eax
mov dword [edi + 8], ecx
mov word [edi + 0xc], dx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, esi
je 0x10003f50
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [0x10011aa0], eax
je 0x10003f50
lea ecx, [esp + 8]
push ecx
call eax
mov ax, word [esp + 8]
cmp ax, 6
je 0x10003f42
cmp ax, 9
jne 0x10003f50
pop edi
mov eax, 1
pop esi
add esp, 0x128
ret
mov eax, esi
pop edi
pop esi
add esp, 0x128
ret

Function at 0x10003ff0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x188
push esi
mov dword [esp + 8], 0x50
mov esi, 1
xor eax, eax
mov cl, byte [eax + str.SOFTWAREWow6432NodeATI_Technologies]
mov byte [esp + eax + 0x5c], cl
inc eax
test cl, cl
jne 0x10004006
push edi
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str.CDSEnumDevices]
mov ecx, dword [0x1000e6a0]
mov edx, dword [0x1000e6a4]
dec edi
mov dword [edi], eax
mov eax, dword [0x1000e6a8]
mov dword [edi + 4], ecx
mov cl, byte [0x1000e6ac]
mov dword [edi + 8], edx
mov edx, dword [esp + 0x194]
and edx, 0xffff
mov dword [edi + 0xc], eax
lea eax, [esp + 0x60]
push edx
push eax
mov byte [edi + 0x10], cl
lea ecx, [esp + 0x100]
push str._s_1x
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x108]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov edx, dword [str.DeviceEnum]
mov eax, dword [0x1000e68c]
dec edi
mov ecx, dword [0x1000e690]
mov dword [edi], edx
lea edx, [esp + 8]
push edx
push 0x20019
mov dword [edi + 4], eax
lea eax, [esp + 0x100]
push 0
push eax
push 0x80000002
mov dword [edi + 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x10004101
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
push edx
push eax
push eax
mov eax, dword [esp + 0x1a4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10004101
mov edx, dword [esp + 0x198]
lea ecx, [esp + 0xc]
lea eax, [esp + 0xc]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100040f5
xor esi, esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x188
ret 0x10
Function at 0x1000787a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1000e750
cmp edx, dword [eax]
je 0x1000789c
add eax, 8
inc ecx
cmp eax, 0x1000e7e0
jl 0x1000788d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1000e750]
jne 0x100079ca
mov eax, dword [0x10011b58]
cmp eax, 1
je 0x100079a4
test eax, eax
jne 0x100078cd
cmp dword [0x10011b5c], 1
je 0x100079a4
cmp edx, 0xfc
je 0x100079ca
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10007904
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1000a120
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10005d00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10007947
lea eax, [ebp - 0x1a4]
push eax
call fcn.10005d00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1000c59c
push edi
call fcn.10004150
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1000a120
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1000a130
lea eax, [ebp - 0xa0]
push 0x1000c57c
push eax
call fcn.1000a130
push dword [esi + 0x1000e754]
lea eax, [ebp - 0xa0]
push eax
call fcn.1000a130
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1000a9df
add esp, 0x2c
pop edi
jmp 0x100079ca
lea eax, [ebp + 8]
lea esi, [esi + 0x1000e754]
push 0
push eax
push dword [esi]
call fcn.10005d00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10008d45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x56fffffc
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.100084ec
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100084a1
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.100084ec
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100084a1
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.100084ec
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100084a1
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.100084dc
int3
Function at 0x401228
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov byte [ebp - 0x100], 0x31
mov byte [ebp - 0xff], 0x37
mov byte [ebp - 0xfe], 0x32
mov byte [ebp - 0xfd], 0x2e
mov byte [ebp - 0xfc], 0x30
mov byte [ebp - 0xfb], 0x2e
mov byte [ebp - 0xfa], 0x30
mov byte [ebp - 0xf9], 0x2e
mov byte [ebp - 0xf8], 0x31
mov byte [ebp - 0xf7], 0
mov word [ebp - 0x102], 0x115c
call fcn.004012f0
mov esi, eax
lea eax, [esi - 0x1b0]
push eax
lea ecx, [esi + 0x1d17]
push ecx
call fcn.00401358
add esp, 4
pop ecx
xchg ecx, eax
xor eax, ecx
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
push eax
lea ecx, [esi + 0x1d1a]
push ecx
call fcn.00401358
add esp, 4
pop ecx
xchg ecx, eax
xor eax, ecx
mov dword [ebp - 0x10c], eax
mov eax, 5
push eax
movzx eax, word [ebp - 0x102]
push eax
lea eax, [ebp - 0x100]
push eax
call dword [ebp - 0x10c]
add esp, 0xc
mov eax, 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x83242f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x32
xor edi, edi
pop ebx
push edi
push edi
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
cmp esi, edi
je 0x8324ba
push edi
push edi
push esi
push 0x83454b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
push 1
dec ebx
call fcn.00834f7a
pop ecx
test eax, eax
je 0x83247e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, edi
jne 0x832463
jmp 0x832485
mov dword [ebp - 4], 1
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [ebp - 8]
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x8324aa
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp ebx, edi
je 0x8324ba
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x8324c2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x14
call fcn.00839041
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x832500
mov edx, dword [ebp + 0x14]
push ecx
mov dword [eax + 8], edx
mov edx, dword [ebp + 0xc]
push ecx
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0xc], edx
mov edx, dword [ebp + 0x1c]
push ecx
push ecx
mov dword [eax + 0x10], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
xor eax, eax
pop ebp
ret