joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100987f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
mov eax, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 1]
push edi
push dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0xc], eax
push ecx
push esi
mov ecx, eax
mov edi, edx
inc ebx
call fcn.100988dc
add esp, 0xc
test al, al
jne 0x1009882d
xor al, al
jmp 0x100988d5
cmp byte [ebp - 1], 0
je 0x10098826
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push ebx
push eax
mov edx, edi
call fcn.10098980
add esp, 0xc
test al, al
je 0x10098826
cmp dword [ebp - 8], 0
je 0x10098826
cmp dword [esi + 0x14], 8
jb 0x1009885c
mov eax, dword [esi]
jmp 0x1009885e
mov eax, esi
mov edi, dword [ebp + 0xc]
lea ecx, [edi + 0x1c]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x1009887f
test eax, eax
jne 0x100988c0
mov eax, dword [edi + 0x1c]
add eax, 5
push eax
push ebx
call fcn.10439606
mov dword [edi + 0x20], eax
pop ecx
pop ecx
test eax, eax
jne 0x10098899
xor bl, bl
jmp 0x100988c0
cmp dword [esi + 0x14], 8
jb 0x100988a1
mov esi, dword [esi]
lea ecx, [edi + 0x1c]
push ecx
push eax
lea eax, [edi + 0x18]
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
movzx ebx, bl
test eax, eax
cmovne ebx, edx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
movzx ecx, bl
test eax, eax
cmovne ecx, edx
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100988dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 4]
xor ebx, ebx
push 1
push eax
mov dword [ebp - 4], ebx
call fcn.10098980
add esp, 0xc
test al, al
jne 0x100988ff
xor al, al
jmp 0x10098940
cmp dword [ebp - 4], ebx
jne 0x1009890b
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
jmp 0x1009893e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x10098916
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ecx, eax
mov eax, dword [ebp + 0xc]
neg ecx
sbb cl, cl
inc cl
mov byte [eax], cl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100988fb
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100989b8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x1046049a
call fcn.1043abb3
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x234], ebx
jb 0x100989da
mov edx, dword [edx]
lea eax, [ebp - 0x234]
push eax
push 8
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100989f7
xor al, al
jmp 0x10098a9e
mov esi, ebx
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.1043c810
add esp, 0xc
mov dword [ebp - 0x238], 0x104
lea eax, [ebp - 0x238]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10098a7f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10079d71
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x230]
push eax
mov ecx, edi
call fcn.100917ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push ebx
push 1
call fcn.1007a42c
inc esi
jmp 0x100989f9
cmp dword [ebp - 0x234], 0
je 0x10098a9c
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100989f0
mov al, 1
call fcn.1043ab62
ret

Function at 0x10098aa4
Capabilities:
Query environment variable

Disassembly:
push 0x234
mov eax, 0x104604cd
call fcn.1043abb3
mov edi, edx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x23c]
mov ebx, dword [ebp + 0xc]
call fcn.100a1559
and dword [ebp - 4], 0
lea eax, [ebp - 0x23c]
push 0
push eax
push esi
mov edx, edi
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100987f6
add esp, 0xc
mov byte [ebp - 0x23d], al
test al, al
je 0x10098b5c
cmp dword [ebp - 0x224], 2
jne 0x10098b89
mov esi, dword [ebp - 0x21c]
test esi, esi
je 0x10098b89
cmp dword [ebp - 0x220], 2
jbe 0x10098b79
push esi
call fcn.100763f0
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.1007a34b
cmp dword [ebx + 0x14], 8
jb 0x10098b2b
mov eax, dword [ebx]
jmp 0x10098b2d
mov eax, ebx
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
call fcn.100763f0
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.1007a34b
mov bl, byte [ebp - 0x23d]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.100a1591
mov al, bl
call fcn.1043ab62
ret
mov esi, 0x10545e20
push esi
call fcn.100763f0
pop ecx
push eax
push esi
jmp 0x10098b55
xor bl, bl
jmp 0x10098b62
Function at 0x10098b8d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edx + 0x14], 8
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10c], ebx
jb 0x10098bb9
mov edx, dword [edx]
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10098c46
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], bl
push ebx
push eax
call fcn.1043c810
add esp, 0xc
mov dword [ebp - 0x110], 0x104
cmp dword [esi + 0x14], 8
jb 0x10098c00
mov esi, dword [esi]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10098c3a
cmp dword [ebp - 0x114], 4
jne 0x10098c3a
mov eax, dword [ebp - 0x108]
mov bl, 1
mov dword [edi], eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10436e26
mov esp, ebp
pop ebp
ret

Function at 0x10099612
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1009963e
xor al, al
jmp 0x10099680
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x10099673
mov edx, edi
lea ecx, [ebp - 0x238]
call fcn.100990da
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10099658
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10436e26
mov esp, ebp
pop ebp
ret
Function at 0x10099e6d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, ecx
lea ecx, [ebp - 8]
push edi
push ecx
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
je 0x10099f8d
push esi
lea esi, [edi + 1]
push esi
call fcn.1041fa39
push esi
push 0
push eax
mov dword [ebx], eax
call fcn.1043c810
add esp, 0x10
lea eax, [ebx + 0x28]
push dword [ebx]
push edi
push dword [ebp - 8]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x10099f8a
and dword [ebp - 4], 0
cmp dword [ebx], 0
je 0x10099f8a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1054cefc
push dword [ebx]
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x10099f8a
mov esi, dword [ebp - 4]
lea edi, [ebp - 0x40]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x38]
mov eax, ecx
shr eax, 0x10
mov word [ebx + 8], ax
mov word [ebx + 0xa], cx
mov ecx, dword [ebp - 0x34]
mov eax, ecx
shr eax, 0x10
mov word [ebx + 0xc], ax
mov word [ebx + 0xe], cx
mov ecx, dword [ebp - 0x30]
mov eax, ecx
shr eax, 0x10
mov word [ebx + 0x10], ax
mov word [ebx + 0x12], cx
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
shr eax, 0x10
mov word [ebx + 0x14], ax
mov eax, dword [ebp - 0x24]
mov word [ebx + 0x16], cx
mov ecx, ebx
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x24], eax
lea eax, [ebx + 0x230]
push eax
push 0x1054ce64
call fcn.10099f93
lea eax, [ebx + 0x640]
mov ecx, ebx
push eax
push 0x1054ce54
call fcn.10099f93
lea eax, [ebx + 0x438]
mov ecx, ebx
push eax
push 0x1054d090
call fcn.10099f93
xor eax, eax
inc eax
jmp 0x10099f8c
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1009a04c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x1077e3a0]
cmp esi, 0x1c00
jle 0x1009a085
push edi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
mov edi, 0x10786e58
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x1077e3a0], esi
pop edi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [esi + 0x10786e58]
push eax
call fcn.104396ca
add esp, 0xc
add dword [0x1077e3a0], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1009a420
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
lea eax, [esp + 0x34]
mov dword [esp + 0x10], ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x38]
xor edx, edx
mov eax, 0x40000000
xor ebx, ebx
div edi
xor esi, esi
inc ebx
shl eax, 2
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], esi
test eax, eax
je 0x1009a4ba
push 0x1c
lea eax, [esp + 0x1c]
push eax
mov eax, esi
imul eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test eax, eax
je 0x1009a4ab
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1009a4ab
div edi
add esi, eax
cmp dword [esp + 0x28], 0x1000
jne 0x1009a4b4
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0xc]
jbe 0x1009a4b4
mov ecx, dword [esp + 0x10]
push ebx
mov dword [esp + 0x10], edx
call fcn.1009a11e
pop ecx
test al, al
je 0x1009a4b4
inc ebx
jmp 0x1009a4b4
mov eax, 0x10000
div edi
add esi, eax
cmp esi, dword [esp + 0x14]
jb 0x1009a45c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009a981
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3bc
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x398]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 0x394]
lea ecx, [ebp - 0x68]
push dword [ebp - 0x398]
call fcn.1009a0a6
lea eax, [ebp - 0x68]
push eax
push str.Error_occurred_at__s._r_n
push esi
call fcn.1009a04c
push 0x208
lea eax, [ebp - 0x370]
push 0
push eax
call fcn.1043c810
add esp, 0x20
lea eax, [ebp - 0x370]
push 0x206
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1009aa07
push 0x1054d434
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x370]
push eax
push str._s__r_n
push esi
call fcn.1009a04c
add esp, 0xc
lea ecx, [ebp - 0x168]
call fcn.1009a4c1
test eax, eax
je 0x1009aa42
lea eax, [ebp - 0x168]
push eax
push str.Operating_system:___s_r_n
push esi
call fcn.1009a04c
add esp, 0xc
jmp 0x1009aa4f
push str.Operating_system:__Could_not_Determine_r_n
push esi
call fcn.1009a04c
pop ecx
pop ecx
lea eax, [ebp - 0x3bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x3a4]
push dword [ebp - 0x3a8]
push str._d_processor_s___type__d._r_n
push esi
call fcn.1009a04c
add esp, 0x10
mov dword [ebp - 0x390], 0x20
lea eax, [ebp - 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [ebp - 0x38c]
push str._d___memory_in_use._r_n
push esi
call fcn.1009a04c
mov eax, dword [ebp - 0x388]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory._r_n
push esi
call fcn.1009a04c
mov eax, dword [ebp - 0x384]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory_free._r_n
push esi
call fcn.1009a04c
mov eax, dword [ebp - 0x380]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_paging_file._r_n
push esi
call fcn.1009a04c
mov eax, dword [ebp - 0x37c]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_paging_file_free._r_n
push esi
call fcn.1009a04c
mov eax, dword [ebp - 0x378]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space._r_n
push esi
call fcn.1009a04c
mov eax, dword [ebp - 0x374]
add esp, 0x48
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space_free._r_n
push esi
call fcn.1009a04c
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
call fcn.10436e26
mov esp, ebp
pop ebp
ret
Function at 0x1009b2ce
Capabilities:
Create process memory minidump
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1075cd88], 0
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
je 0x1009b4a5
mov eax, dword [ebx]
mov byte [0x1075cd88], 0
mov esi, dword [eax]
call fcn.1009b4ec
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x310]
push eax
movzx eax, word [ebp - 0x312]
push eax
movzx eax, word [ebp - 0x314]
push eax
movzx eax, word [ebp - 0x316]
push eax
movzx eax, word [ebp - 0x31a]
push eax
movzx eax, word [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P_d_T_d_D_04ld__02ld__02ld_T_02ld__02ld__02ld
lea eax, [ebp - 0x208]
push 0x100
push eax
call fcn.104397a9
lea eax, [ebp - 0x208]
push eax
push 0x10786d50
push str._sCRASH_DUMP__s.dmp
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.104397a9
add esp, 0x40
push 2
pop ecx
cmp eax, ecx
jle 0x1009b3af
mov dl, byte [ebp + ecx - 0x108]
cmp dl, 0x2f
je 0x1009b3a2
cmp dl, 0x3a
jne 0x1009b3aa
mov byte [ebp + ecx - 0x108], 0x5f
inc ecx
cmp ecx, eax
jl 0x1009b391
mov edx, ebx
lea ecx, [ebp - 0x30c]
call fcn.1009af59
lea eax, [ebp - 0x30c]
mov edi, 0x10781548
push eax
lea eax, [ebp - 0x108]
push eax
push esi
push str._n_n_nApplication_Fatal_Error_n_nException_code_is_0x_08X_nCrash_dump_file:__s_nCrash_report_file_:_s_n
push 0x5800
push edi
call fcn.104397a9
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x18
push edi
call esi
push edi
call fcn.1043986a
pop ecx
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1009b4bb
call fcn.1007d5f1
test al, al
mov ecx, 0x71b66
mov esi, 0x61d24
cmovne esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x328]
push eax
push esi
push edi
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x320], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ebx, dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push eax
call ebx
test eax, eax
jne 0x1009b49c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80070057
jne 0x1009b49c
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push 4
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
push eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1009b4e4
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.10436e26
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_creating_dump_file__err_d
push 0x5800
mov edi, 0x10781548
push edi
call fcn.104397a9
add esp, 0x10
push edi
call esi
push edi
call fcn.1043986a
pop ecx
push 1
call fcn.10439bd1
int3
Function at 0x1009fde3
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x1009fdfd
mov ecx, dword [eax]
test ecx, ecx
je 0x1009fdfd
push 0
call fcn.10432ba0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret
Function at 0x1028c65b
Capabilities:
Accept command line arguments

Disassembly:
push 0x4c
mov eax, 0x104ba484
call fcn.1043abb3
mov esi, ecx
lea eax, [ebp - 0x28]
push eax
call fcn.1028c7d5
and dword [ebp - 4], 0
mov ecx, esi
push eax
call fcn.1007fac2
mov ebx, eax
neg ebx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
xor edi, edi
lea ecx, [ebp - 0x28]
push 0
inc edi
push edi
call fcn.1007a42c
inc bl
je 0x1028c7cd
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [ebp - 0x40]
push eax
call fcn.1028c881
mov dword [ebp - 4], edi
cmp dword [eax + 0x14], 8
jb 0x1028c6ba
mov eax, dword [eax]
push eax
push esi
call fcn.10439fad
test eax, eax
pop ecx
pop ecx
setne bl
or dword [ebp - 4], 0xffffffff
push 0
push edi
lea ecx, [ebp - 0x40]
call fcn.1007a42c
movzx ecx, byte [0x1077e3a6]
test bl, bl
movzx eax, bl
cmovne ecx, eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [0x1077e3a6], cl
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
push ebx
push 0x64
call fcn.1007ea20
lea eax, [ebp - 0x58]
push eax
call fcn.1028c9da
mov esi, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x40]
push eax
call fcn.1028c92b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x1028c745
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x1028c74d
mov eax, dword [eax]
push ebx
push 0x64
push ecx
push esi
mov edx, eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1032f83b
mov bl, al
add esp, 0x10
neg bl
sbb bl, bl
mov byte [ebp - 4], 3
push 0
push edi
lea ecx, [ebp - 0x40]
call fcn.1007a42c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
push 0
push edi
call fcn.1007a42c
inc bl
jne 0x1028c7b7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x38
cmovae eax, dword [ebp - 0x28]
pop ecx
cmp word [eax], cx
jb 0x1028c7b7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
inc bl
cmovae eax, dword [ebp - 0x28]
cmp word [eax], cx
jne 0x1028c7b9
mov byte [0x1077e3a5], 1
jmp 0x1028c7b9
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.1007a42c
mov al, bl
jmp 0x1028c7cf
xor al, al
call fcn.1043ab62
ret
Function at 0x10298626
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0x3c
mov eax, 0x104bd2f5
call fcn.1043abb3
mov ebx, ecx
lea edi, [ebx + 0x198]
mov dword [ebp - 0x40], edi
mov ecx, edi
mov eax, dword [edi]
mov byte [ebp - 0x3c], 0
call dword [eax]
mov byte [ebp - 0x3c], 1
and dword [ebp - 4], 0
cmp byte [ebx + 0x180], 0
jne 0x10298734
mov ecx, ebx
mov byte [ebx + 0x180], 1
call fcn.1029e2cb
mov ecx, ebx
call fcn.1029bece
mov ecx, ebx
call fcn.1029c5b7
call fcn.102b2842
mov dword [ebx + 0x6c], eax
lea esi, [ebx + 0x74]
call fcn.102b2c71
lea ecx, [ebp - 0x48]
mov dword [esi], eax
call fcn.10079e4d
mov byte [ebp - 4], 1
mov ecx, dword [eax]
push 0
push 0x1029ed77
push esi
push dword [esi]
call fcn.1008a7ef
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x102986b7
call fcn.10076eba
call fcn.102b0095
mov dword [ebx + 0x194], eax
mov edx, 0x10298d1b
mov ecx, dword [eax]
mov dword [ebx + 0x188], ecx
mov ecx, eax
call fcn.1032c1c5
push 0x40
push 0x3000
mov esi, 0x100
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebx + 0x18c], eax
test eax, eax
jne 0x10298725
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], str._1606
push eax
lea ecx, [ebp - 0x38]
call fcn.100783c3
mov byte [ebp - 4], 3
mov dword [ebp - 0x38], vtable.._AV2884__________________________________________________________________________________.0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x38]
push 0x10726c68
push eax
call fcn.1043aaeb
push esi
push eax
push 0x10299396
call fcn.1032c341
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov eax, dword [edi]
mov byte [ebp - 0x3c], 0
call dword [eax + 8]
call fcn.1043ab62
ret
Function at 0x102a9ed2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0x34
mov eax, 0x104bfedd
call fcn.1043abb3
mov esi, ecx
lea edi, [esi + 4]
mov dword [ebp - 0x3c], edi
mov ecx, edi
mov eax, dword [edi]
mov byte [ebp - 0x38], 0
call dword [eax]
mov byte [ebp - 0x38], 1
and dword [ebp - 4], 0
call fcn.102b21d6
push 0x40
push 0x3000
push 0x100
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x102a9f4a
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], str._1690
push eax
lea ecx, [ebp - 0x34]
call fcn.100783c3
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], vtable.._AV2887________________________________________________________________________________________.0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x34]
push 0x10726ce0
push eax
call fcn.1043aaeb
mov edx, dword [ebx]
push 0x100
push eax
lea eax, [esi + 0x24]
mov dword [esi + 0x28], edx
push eax
push edx
call fcn.1032c468
mov edx, dword [esi + 0x20]
add esp, 0x10
mov ecx, ebx
call fcn.1032c1c5
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov eax, dword [edi]
mov byte [ebp - 0x38], 0
call dword [eax + 8]
call fcn.1043ab62
ret