joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x54]
push edi
call fcn.100022e0
add esp, 4
test eax, eax
je 0x10002e37
jmp 0x10002e20
push dword [esi]
push dword [esi + 4]
call fcn.100d22c0
push edi
call fcn.100022e0
add esp, 0xc
test eax, eax
jne 0x10002e20
cmp dword [esi + 0x78], 0
jne 0x10002ffe
lea eax, [esi + 0x58]
push eax
call fcn.100022e0
add esp, 4
test eax, eax
jne 0x10002ffe
mov eax, dword [0x1017c738]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [0x1017c73c]
mov dword [esi + 0x10], eax
mov eax, dword [0x1017c740]
mov dword [esi + 0x14], eax
mov eax, dword [0x1017c744]
mov dword [esi + 0x18], eax
mov eax, dword [0x1017c748]
mov dword [esi + 0x1c], eax
mov eax, dword [0x1017c74c]
mov dword [esi + 0x20], eax
test ecx, ecx
jne 0x10002e8f
lea ecx, [esi + 0x40]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [esi + 0x5c]
call fcn.10003090
movzx edx, word [esi + 0x40]
add esp, 8
mov ebx, dword [ebp - 0xc]
mov eax, edx
cmp dl, bl
jae 0x10002ec0
movzx eax, bx
mov edx, dword [ebp - 4]
cmp dword [esi + 0x48], edx
mov ecx, dword [ebp - 8]
cmovg edx, dword [esi + 0x48]
cmp dword [esi + 0x44], ecx
push edx
cmovg ecx, dword [esi + 0x44]
mov word [esi + 0x30], ax
mov dword [esi + 0x38], edx
mov dword [esi + 0x34], ecx
call fcn.10002920
movzx edx, word [esi + 0x30]
xor ecx, ecx
cmp edx, 8
mov dword [esi + 0x4c], eax
mov edi, 0x80
mov dword [esi + 0x78], 1
cmove ecx, edi
shr edx, 3
and edx, 0x1f
mov dword [esi + 0x50], ecx
mov ecx, dword [esi + 0x34]
imul edx, ecx
imul ecx, eax
push esi
imul edx, eax
shl ecx, 2
cmp edx, ecx
mov dword [esi + 0x3c], edx
cmovle edx, ecx
mov dword [esi + 0x70], edx
call dword [0x1017c72c]
add esp, 8
pop ebx
test eax, eax
js 0x10002fec
push esi
call fcn.10005580
add esp, 4
push dword [esi + 0x70]
call fcn.10055470
push eax
call fcn.100c9bf0
add esp, 8
mov dword [esi + 0x64], eax
test eax, eax
je 0x10002fec
mov eax, 0x8120
cmp word [esi + 0x30], ax
je 0x10002f7d
push dword [esi + 0x70]
call fcn.10055470
push eax
call fcn.100c9bf0
add esp, 8
mov dword [esi + 0x68], eax
test eax, eax
je 0x10002fec
cmp dword [0x1017c760], 0
jne 0x10002ffe
push dword [esi + 0x28]
cmp dword [esi + 0x5c], 0
mov ecx, 0x43
mov eax, 0x50
cmovne eax, ecx
push eax
push str.SDLAudio_c_d
lea eax, [ebp - 0x4c]
push 0x40
push eax
call fcn.100cb8f0
cmp dword [esi + 0x5c], 0
lea eax, [ebp - 0x4c]
push esi
push 0
push eax
mov ecx, 0x10002320
mov eax, 0x10003010
cmovne eax, ecx
push eax
call fcn.100d1c40
add esp, 0x24
mov dword [esi + 0x74], eax
test eax, eax
jne 0x10002ffe
push esi
call fcn.10002370
push str.Couldnt_create_audio_thread
call fcn.10067d40
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.10002370
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10055490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x100555a6
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dl, byte [esi + eax]
xor dl, bl
mov al, dl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr dl, 1
and eax, 0xa001
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
xor dl, cl
and dl, 1
movzx eax, dl
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr bx, 8
xor ax, cx
inc esi
movzx ecx, ax
xor bx, cx
movzx ebx, bx
cmp esi, edi
jb 0x100554a6
mov ax, bx
pop ebx
pop edi
pop esi
pop ebp
ret
mov ax, word [ebp + 8]
pop edi
pop esi
pop ebp
ret

Function at 0x100555b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x1005569d
push ebx
mov ebx, dword [ebp + 0xc]
lea esp, [esp]
movzx edx, byte [edi + ebx]
movzx ecx, al
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
mov dword [ebp + 8], 0
test cl, 1
mov edx, 0xedb88320
cmovne edx, dword [ebp + 8]
shr ecx, 1
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
mov dword [ebp + 8], 0
test cl, 1
mov edx, 0xedb88320
cmovne edx, dword [ebp + 8]
shr ecx, 1
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
mov dword [ebp + 8], 0
test cl, 1
mov edx, 0xedb88320
cmovne edx, dword [ebp + 8]
shr ecx, 1
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
shr eax, 7
xor eax, ecx
mov edx, 0xff000000
shr eax, 1
test cl, 1
mov ecx, 0x12b88320
cmovne ecx, edx
inc edi
xor eax, ecx
cmp edi, esi
jb 0x100555d0
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x1005e66d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1005e6a8
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1005e68f
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1005e6a0
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1005e6aa
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1005e685
xor eax, eax
pop edi
pop esi
ret

Function at 0x1005f870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f7], 0x3c
mov byte [ebp - 0x3f6], 0x2b
mov byte [ebp - 0x3f5], 0x2f
mov byte [ebp - 0x3f4], 0x3a
invalid
invalid
invalid
cld

Function at 0x10060000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x778], 0x6e
mov byte [ebp - 0x777], 0x17
invalid
invalid

Function at 0x10060040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + 0x40fffff8], edx
mov byte [ebp - 0x76e], 0xd
invalid
invalid
xchg ebx, eax

Function at 0x10060070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x768], 0x71
mov byte [ebp - 0x767], 0x6e
invalid
invalid

Function at 0x100600b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ecx + 0x44fffff8], esp
mov byte [ebp - 0x75e], 0x41
invalid
invalid
invalid

Function at 0x10060260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
invalid
invalid

Function at 0x10060450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx + 0x56e90cc4]
add dword [eax], eax
add byte [ebx - 0x6fb43], al
inc dword [0x9d850f]
jne 0x100604f3
and byte [ebp - 0x7cc], 0
invalid
movsd dword es:[edi], dword [esi]
invalid

Function at 0x100607e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18

Function at 0x100607f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x100607f4
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1005e62d
jl 0x1006081e
mov cl, 0x74
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
invalid

Function at 0x10060800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x100607f4
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1005e62d
jl 0x1006081e
mov cl, 0x74
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
invalid
Function at 0x100704b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x10070512
cmp byte [esi], 0
je 0x10070512
push dword [0x10181d74]
push dword [0x10181d70]
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test edi, edi
je 0x10070512
cmp edi, dword [0x10181d74]
jbe 0x10070509
push edi
push dword [0x10181d70]
call fcn.10096720
add esp, 8
test eax, eax
je 0x10070512
push edi
push eax
push esi
mov dword [0x10181d70], eax
mov dword [0x10181d74], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [0x10181d70]
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10072410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], edi
je 0x10072569
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10072569
push dword [esi + 0x1c]
call fcn.100966a0
add esp, 4
mov dword [esi + 0x1c], edi
call fcn.10067c70
mov eax, dword [esi + 0x38]
mov dword [ebp - 8], eax
cmp dword [esi + 0x20], edi
jne 0x100724c3
push dword [esi + 0x10]
mov dword [esi + 0x20], 1
push edi
push dword [esi + 0x24]
call fcn.1010bec0
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0x28]
push eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x10]
push dword [esi + 0x24]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100724f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x100724c3
lea eax, [esi + 0x1c]
push 0x10146a3c
push eax
call fcn.10077940
add esp, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [esi + 0x20], edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
test eax, eax
cmovns ecx, eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100724e5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x28]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [esi + 0x20], edi
test eax, eax
je 0x1007254e
mov eax, dword [ebp - 4]
test eax, eax
je 0x10072545
mov ecx, dword [esi + 0x24]
mov edi, ebx
cmp byte [ecx], 0
jne 0x10072532
dec eax
cmp ebx, eax
mov dword [ebp - 4], eax
cmova edi, eax
lea eax, [ecx + 1]
push edi
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.1010c020
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, eax
cmova edi, eax
mov eax, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.1010c020
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x1c]
push str.hid_read_timeout_GetOverlappedResult
push eax
call fcn.10077940
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x1c]
call fcn.100966a0
push str.Zero_buffer_length
mov dword [esi + 0x1c], edi
call fcn.100cc460
lea eax, [eax*2 + 2]
push eax
push str.Zero_buffer_length
push str.WCHAR_T
push 0x1012e9d8
call fcn.1008e3c0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x100725c1
push esi
push 0x1012fc58
call fcn.10067d40
push esi
call fcn.100966a0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10067c70
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1008c3c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x78], 0
jle 0x1008c3d9
mov eax, 0x10179a60
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x20]
sub esp, 0x10
mov ecx, esp
push dword [esi + 4]
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x28]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0xc], eax
call fcn.10094180
add esp, 0x14
test eax, eax
jne 0x1008c482
mov eax, 0x28de
cmp word [esi + 0x14], ax
je 0x1008c435
movzx eax, word [esi + 0x40]
test ax, ax
je 0x1008c41d
cmp eax, 1
jne 0x1008c482
movzx eax, word [esi + 0x42]
test ax, ax
je 0x1008c435
cmp eax, 4
je 0x1008c435
cmp eax, 5
je 0x1008c435
cmp eax, 8
jne 0x1008c482
xor edi, edi
jmp 0x1008c440
mov ebx, dword [edi + 0x1017a138]
cmp dword [ebx + 4], 0
je 0x1008c47a
push dword [esi + 0x3c]
movzx eax, word [esi + 0x18]
push dword [esi + 0x38]
push dword [esi + 0x34]
push dword [esi + 0x30]
push eax
movzx eax, word [esi + 0x16]
push eax
movzx eax, word [esi + 0x14]
push eax
push dword [esi + 0x4c]
mov eax, dword [ebx + 0x14]
push dword [esi + 4]
push esi
call eax
add esp, 0x28
test eax, eax
jne 0x1008c489
add edi, 4
cmp edi, 0x48
jb 0x1008c440
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x1009f5f0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10182c38], 0
je 0x1009f636
mov eax, dword [ebp + 8]
push 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push 1
push eax
mov dword [ebp - 0xc], 0x50001
mov dword [ebp - 8], 0x2100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1009f636
push str.Couldnt_register_for_raw_input_events
call fcn.10067d40
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1009f730
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10182c38], 0
je 0x1009f777
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x50001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1009f777
push str.Couldnt_unregister_for_raw_input_events
call fcn.10067d40
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100d07b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push edi
push 0x10
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x10
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test edi, edi
mov ecx, eax
pop edi
jne 0x100d07f7
push str.Couldnt_obtain_language_info
call fcn.10067d40
add esp, 4
mov esp, ebp
pop ebp
ret
test ecx, ecx
lea eax, [ebp - 0x10]
mov edx, 0x101289c3
cmove eax, edx
push eax
mov eax, 0x10158bd8
cmove eax, edx
push eax
lea eax, [ebp - 0x20]
push eax
push str._s_s_s
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100cb8f0
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x100d1700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0
mov edx, dword [esi + 0x2c]
mov ecx, edx
neg ecx
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0xc]
sbb ecx, ecx
and ecx, 0x10000
test eax, eax
je 0x100d1741
push edi
lea edi, [ebp + 8]
push edi
push ecx
push esi
push 0x100d16c0
push edx
push 0
call eax
add esp, 0x18
pop edi
jmp 0x100d1755
lea eax, [ebp + 8]
push eax
push ecx
push esi
push 0x100d16c0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
test eax, eax
jne 0x100d176c
push str.Not_enough_resources_to_create_thread
call fcn.10067d40
add esp, 4
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100d1a80
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp dword [0x1017b994], 0xffffffff
jne 0x100d1adb
cmp dword [0x10182f74], 0
jne 0x100d1ae4
push 0x10182f78
call fcn.100c9b40
add esp, 4
cmp dword [0x1017b994], 0xffffffff
jne 0x100d1ace
cmp dword [0x10182f74], 0
jne 0x100d1ace
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x100d1ac4
nop
mov dword [0x1017b994], eax
jmp 0x100d1ace
mov dword [0x10182f74], 1
push 0x10182f78
call fcn.100c9ba0
add esp, 4
cmp dword [0x10182f74], 0
je 0x100d1ae9
jmp 0x100d1db0
nop
push dword [0x1017b994]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
ret
push ebx
push esi
push edi
call fcn.100d16f0
xor ebx, ebx
mov esi, eax
mov edi, edx
cmp dword [0x10182f84], ebx
jne 0x100d1e0a
push 0x10182f8c
call fcn.100c9b40
add esp, 4
cmp dword [0x10182f84], ebx
jne 0x100d1dfd
call fcn.100d0ae0
nop
mov dword [0x10182f84], eax
test eax, eax
jne 0x100d1dfd
push 0x10182f8c
call fcn.100c9ba0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x10182f8c
call fcn.100c9ba0
add esp, 4
nop
push dword [0x10182f84]
call fcn.100d0be0
mov eax, dword [0x10182f88]
add esp, 4
test eax, eax
je 0x100d1e49
cmp dword [eax], esi
jne 0x100d1e2b
cmp dword [eax + 4], edi
je 0x100d1e46
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x100d1e22
push dword [0x10182f84]
call fcn.100d0c20
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
mov ebx, dword [eax + 8]
push dword [0x10182f84]
call fcn.100d0c20
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x100d1b00
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10182f74], 0
je 0x100d1b12
pop ebp
jmp fcn.100d1e60
push dword [ebp + 8]
push dword [0x1017b994]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100d1b32
mov dword [ebp + 8], str.TlsSetValue___failed
pop ebp
jmp fcn.10067d40
xor eax, eax
pop ebp
ret
Function at 0x100e25f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x7fff
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x8060402
mov al, byte [esi]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0x8060402
mov dword [ebp - 0xc4], 0x80007
mov dword [ebp - 0xc0], 0xa0009
mov dword [ebp - 0xbc], 0xc000b
mov dword [ebp - 0xb8], 0xe000d
mov dword [ebp - 0xb4], 0x110010
mov dword [ebp - 0xb0], 0x150013
mov dword [ebp - 0xac], 0x190017
mov dword [ebp - 0xa8], 0x1f001c
mov dword [ebp - 0xa4], 0x250022
mov dword [ebp - 0xa0], 0x2d0029
mov dword [ebp - 0x9c], 0x370032
mov dword [ebp - 0x98], 0x42003c
mov dword [ebp - 0x94], 0x500049
mov dword [ebp - 0x90], 0x610058
mov dword [ebp - 0x8c], 0x76006b
mov dword [ebp - 0x88], 0x8f0082
mov dword [ebp - 0x84], 0xad009d
mov dword [ebp - 0x80], 0xd100be
mov dword [ebp - 0x7c], 0xfd00e6
mov dword [ebp - 0x78], 0x1330117
mov dword [ebp - 0x74], 0x1730151
mov dword [ebp - 0x70], 0x1c10198
mov dword [ebp - 0x6c], 0x22001ee
mov dword [ebp - 0x68], 0x2920256
mov dword [ebp - 0x64], 0x31c02d4
mov dword [ebp - 0x60], 0x3c3036c
mov dword [ebp - 0x5c], 0x48e0424
mov dword [ebp - 0x58], 0x5830502
mov dword [ebp - 0x54], 0x6ab0610
mov dword [ebp - 0x50], 0x8120756
mov dword [ebp - 0x4c], 0x9c308e0
mov dword [ebp - 0x48], 0xbd00abd
mov dword [ebp - 0x44], 0xe4c0cff
mov dword [ebp - 0x40], 0x114c0fba
mov dword [ebp - 0x3c], 0x14ee1307
mov dword [ebp - 0x38], 0x19541706
mov dword [ebp - 0x34], 0x1ea51bdc
mov dword [ebp - 0x30], 0x251521b6
mov dword [ebp - 0x2c], 0x2cdf28ca
mov dword [ebp - 0x28], 0x364b315b
mov dword [ebp - 0x24], 0x41b23bb9
mov dword [ebp - 0x20], 0x4f7e4844
mov dword [ebp - 0x1c], 0x602f5771
mov dword [ebp - 0x18], 0x746269ce
cmp al, 0x58
jle 0x100e2794
mov dl, 0x58
jmp 0x100e279e
xor ecx, ecx
movzx edx, al
test al, al
cmovs edx, ecx
mov bl, byte [ebp + 0x10]
movsx eax, dl
movzx ecx, word [ebp + eax*2 - 0xc4]
movzx eax, bl
mov al, byte [ebp + eax - 0x10]
add al, dl
mov edx, ecx
shr edx, 3
mov byte [esi], al
test bl, 4
je 0x100e27c3
add edx, ecx
test bl, 2
je 0x100e27ce
mov eax, ecx
shr eax, 1
add edx, eax
test bl, 1
je 0x100e27d8
shr ecx, 2
add edx, ecx
movsx eax, word [ebp + 0xc]
mov ecx, edx
neg ecx
and bl, 8
pop esi
cmove ecx, edx
add ecx, eax
pop ebx
cmp ecx, 0x7fff
jle 0x100e27fb
mov eax, 0x7fff
mov esp, ebp
pop ebp
ret
mov eax, 0xffff8000
cmp ecx, eax
cmovl ecx, eax
mov ax, cx
mov esp, ebp
pop ebp
ret
Function at 0x100e5150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
mov esi, dword [ebp + 0xc]
push 0x10
push 0x1015aefc
push esi
mov dword [ebp - 8], 0
call fcn.100cb880
add esp, 0xc
test eax, eax
jne 0x100e51a1
mov esi, dword [ebp + 8]
push esi
call fcn.100cc460
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push 0x1012e9d8
call fcn.1008e3c0
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 0xf]
push edi
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, byte [esi + 6]
push eax
movzx eax, byte [esi + 7]
push eax
movzx eax, byte [esi + 4]
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 3]
push eax
push str.SystemCurrentControlSetControlMediaCategories_02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.100cb8f0
lea eax, [ebp - 0x88]
push eax
call fcn.100cbb10
add esp, 0x50
inc eax
push eax
lea eax, [ebp - 0x88]
push eax
push 0x1012e9d8
push str.UTF_16LE
call fcn.1008e3c0
add esp, 0x10
mov edi, eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov esi, eax
call fcn.100966a0
add esp, 4
test esi, esi
jne 0x100e528f
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.Name
push dword [ebp - 4]
call esi
test eax, eax
jne 0x100e5286
mov eax, dword [ebp - 8]
add eax, 2
push eax
call fcn.100966d0
mov edi, eax
add esp, 4
test edi, edi
jne 0x100e52b9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
push esi
call fcn.100cc460
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push 0x1012e9d8
call fcn.1008e3c0
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push str.Name
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
test esi, esi
je 0x100e530b
call fcn.100966a0
mov esi, dword [ebp + 8]
push esi
call fcn.100cc460
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push 0x1012e9d8
call fcn.1008e3c0
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
xor ecx, ecx
shr eax, 1
mov word [edi + eax*2], cx
call fcn.100cc460
lea eax, [eax*2 + 2]
push eax
push edi
push str.UTF_16LE
push 0x1012e9d8
call fcn.1008e3c0
push edi
mov esi, eax
call fcn.100966a0
add esp, 0x18
test esi, esi
jne 0x100e5368
mov esi, dword [ebp + 8]
push esi
call fcn.100cc460
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push 0x1012e9d8
call fcn.1008e3c0
add esp, 0x14
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret