joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e890
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1006e7e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1006285e
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.10067ec6
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.100693e2
test eax, eax
je 0x1003e9ac
mov ecx, dword [esp + 0x3c]
call fcn.10067ef3
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x1003e970
push edi
mov ecx, esi
call fcn.1006553d
mov ecx, esi
call fcn.1003eb10
cmp dword [esp + 0x38], 1
jne 0x1003e9a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.10065678
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x100413c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100413f3
push esi
call fcn.100444b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x100413ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10041479
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10041462
mov eax, dword [esi + 8]
test eax, eax
je 0x10041417
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1004145e
cmp eax, 2
je 0x10041462
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1004140a
cmp eax, 3
je 0x1004143d
cmp eax, 1
jne 0x1004140a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1004140a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1004140a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.100414a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10041488
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.100414a0
add esp, 4
pop esi
ret

Function at 0x1006363a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10063672
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100616e1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100616b9
jmp 0x1006367e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10064d2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10064d6d
call fcn.1006a6cc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10064d6d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10064d64
xor eax, eax
jmp 0x10064d75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10064d7b
pop edi
pop esi
pop ebx
ret 4
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
adc byte [edx + 0x1b131211], cl
adc al, 0x15
dec edi
pop ss
sbb byte [ecx], bl
imul esi, dword [eax + edx*4 - 0x6f6f3070], 0x90d79090
nop
push edx
nop
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
mov ebp, 0x68b8c183
je 0x401735
inc eax
add byte [ecx - 1], dl
xchg ecx, eax
add cl, 0x33
add byte [ecx + 0x4102ac], ah
sbb dword [ecx], 0xc
test eax, eax
je 0x401787
push eax
push 0xd44d254
inc esp
and eax, 0x830040c1
les ecx, [eax]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, 0xc6ec8b55
in al, dx
mov eax, 0xa1000000
js 0x40179e
inc ecx
fiadd word [ebp + 0x404ca1c0]
inc ecx
add byte [esp + edx + 0x68], dh
add dword [ecx + eax*2], edi
scasb al, byte es:[edi]
test eax, eax
mov eax, dword [0x41404c]
je 0x4017bb
push 0xae413c01
push eax
call fcn.00405850
mov cx, word [0x410274]
jmp 0x4017cf
mov edx, dword [0xc3416300]
push edx
push eax
call 0xd0410850
mov ax, word [eax]
hlt
mov dword [0x6d1808], eax
mov eax, dword [0x411288]
push ebx
push esi
mov esi, dword [0x40c159]
mov word [0x410bb4], cx
test dword [edi + edx*2 + 6], ebx
pop ebp
mov edx, dword [0x411800]
push edx
push str.Benchmarking__s
call esi
mov eax, dword [0x410278]
add esp, 0x68
test eax, eax
je 0x40181c
in eax, dx
mov bl, 2
inc ecx
aad 0x50
and eax, 0x413c33
push str.Send_request_timed_out__n
call esi
add esp, 0xc
mov eax, dword [0xe640d014]
test eax, eax

Function at 0x404560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or al, 0xa1
dec esp
inc eax
inc ecx
fst dword [ebx - 0x75]
pop ebp
or byte [eax - 0x28efaca9], dl
ficom dword [edx]
add byte [edx - 0x5d], ch
inc eax
inc eax
inc ecx
add byte [ebx - 0x367c05], cl
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [0x1bc134]
not ecx
xor eax, dword [ebx - 0x79f0f807]
xlatb
cld
add byte [eax], al
push 7
jo 0x404572
into
inc eax
in al, 0x4b
call esi
add esp, 0xc
test eax, eax
outsb dx, byte [esi]
test edx, eax
add byte [eax], al
add byte [ebx + 0x2f0a07c3], al
push 0xc17c15ff
inc eax
add byte [ebx + 0x7f8908c4], al
or byte [ebp + 0x52840fc0], al
add dword [eax], eax
add byte [esi + 0x40a9a1a4], ch
inc ecx
add byte [ebx], ch
inc esp
lea edx, [esi + 0x13]
push edx
push eax
call 0x21404a60
pop esi
into
sahf
mov edx, ecx
mov esi, edx
cmpsb byte [esi], byte es:[edi]
jmp 0x8be6390b

Function at 0x4048c6
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx + 0x74c03606], cl
into
dec ebx
or byte [eax - 0x79], dl
push cs
mov eax, dword [esi]
sal byte ss:[esi + ecx*8 + 0x4b], 8
push eax
xchg dword [esi], ecx
call edi
mov eax, dword [esi]
add esp, 4
test esi, ebp
xor dh, al
add esi, 0xffffff81
dec ebx
jne 0x4048c7
mov edx, dword [ebp + 8]
invalid
Function at 0x1009813
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
push edi
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, edi
call sub.MFC42u.DLL_CDataExchange::PrepareEditCtrl
cmp dword [edi], 0
mov esi, eax
je 0x100989a
push 0x40
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x80], 0
je 0x100988f
push ebx
mov ebx, dword [ebp + 0x10]
push ebx
lea eax, [ebp - 0x80]
mov esi, 0x1020790
push eax
mov ecx, esi
call fcn.01011b2e
test eax, eax
jne 0x1009871
push 0xffffffffffffffff
push 0x40
push 0x67
call sub.MFC42u.DLL_AfxMessageBox
mov ecx, edi
call sub.MFC42u.DLL_CDataExchange::Fail
push 2
push dword [ebx]
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.01011c16
push ebx
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.01011b2e
pop ebx
jmp 0x10098c2
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x7fffffff
jmp 0x10098c2
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, 0x7fffffff
je 0x10098c2
push 2
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x1020790
call fcn.01011c16
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
leave
ret 0xc

Function at 0x1009ada
Capabilities:
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
xor ebx, ebx
cmp dword [0x102059c], ebx
jne 0x1009bbd
push esi
push edi
mov esi, 0x101fc3c
cmp dword [esi - 4], ebx
jne 0x1009ba2
mov eax, dword [esi]
cmp eax, ebx
je 0x1009ba2
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000002
mov dword [ebp - 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebx
jne 0x1009ba0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push ebx
push 0x10036d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x1009ba0
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1009b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1009ba0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
mov dword [ebp - 0xc], eax
jne 0x1009ba0
lea eax, [ebp - 0x214]
push eax
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x1009ba2
mov dword [esi], ebx
add esi, 0x18
cmp esi, 0x101fd5c
jl 0x1009af9
pop edi
mov dword [0x102059c], 1
pop esi
pop ebx
leave
ret

Function at 0x100d4f5
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
ret 8
Function at 0x1011870
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x10118c8
push eax
lea eax, [ebp - 0x208]
push eax
call sub.MFC42u.DLL_AfxFullPath
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
test ax, ax
mov dword [ebp + 8], eax
je 0x10118c8
lea eax, [ebp + 8]
push eax
push 0x1011363
call dword [sym.imp.USER32.dll_EnumWindows]
cmp word [ebp + 8], 0
jne 0x10118bf
xor eax, eax
inc eax
jmp 0x10118ca
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
xor eax, eax
leave
ret 4
Function at 0x1012ceb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x1012cfe
xor eax, eax
jmp 0x1012d5c
push edi
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1012d23
xor eax, eax
jmp 0x1012d5b
push esi
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp + 0xa]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1012d52
cmp dword [ebp - 4], 2
jne 0x1012d52
cmp word [ebp + 0xa], 0xfeff
je 0x1012d4f
cmp word [ebp + 0xa], 0xfffe
jne 0x1012d52
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret 4

Function at 0x1015039
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push esi
push edi
xor esi, esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov edi, ecx
call ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x434
push dword [edi + 0x20]
call esi
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jbe 0x10150cf
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x10150c4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x437
push dword [edi + 0x20]
call esi
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.01018c60
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x101507a
lea eax, [ebp - 0x10]
push eax
push 0
push 0x437
push dword [edi + 0x20]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x1016df2
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1006be0
call fcn.01017220
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1016e2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016e2d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1016e45
cmp eax, 0x20b
je 0x1016e32
mov dword [ebp - 0x1c], edi
jmp 0x1016e59
cmp dword [ecx + 0x84], 0xe
jbe 0x1016e2d
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1016e53
cmp dword [ecx + 0x74], 0xe
jbe 0x1016e2d
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1020eb4], 0xffffffff
or dword [0x1020eb8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1020e90]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1020e8c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1020eb0], eax
call fcn.0101721a
cmp dword [0x1020480], edi
jne 0x1016eb6
push fcn.0101721a
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01017208
push 0x1001f48
push 0x1001f44
call sub.msvcrt.dll__initterm
mov eax, dword [0x1020e88]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1020e84]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x1001f40
push 0x1001ef4
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x1016f1c
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x1016fd6
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x1016f6a
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x1016f38
cmp ax, 0x22
jne 0x1016f25
cmp word [esi], 0x22
jne 0x1016f43
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x1016f51
cmp ax, 0x20
jbe 0x1016f3e
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x1016f77
movzx eax, word [ebp - 0x48]
jmp 0x1016f7a
cmp word [esi], 0x20
jbe 0x1016f43
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x1016f6a
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x1016f9b
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1016fd0
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01017259
ret
Function at 0x1017321
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1006c30
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1017379
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x1006c6c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101736c
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x101737b
xor eax, eax
pop esi
leave
ret 4
Function at 0x759b3ca6
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov byte [esi + 4], 0
call fcn.759b3eb3
cmp dword [0x75bcc8ec], 2
je 0x759b3cc6
cmp eax, 1
je 0x759c589e
mov eax, esi
pop esi
ret
push edi
mov edi, 0x75bcc964
push edi
call fcn.759b16ea
test al, al
jne 0x759c5a0d
mov eax, dword [0x75bcc8d8]
cmp eax, 0xffffffff
je 0x759c59f4
and dword [0x75bcc964], 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
test eax, eax
je 0x759c5a1a
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov byte [esi + 4], 1
pop edi
jmp 0x759b3cc6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x75bcc8d8], eax
cmp eax, 0xffffffff
jne 0x759c58c0
jmp 0x759f2526
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x759c58a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x759c58da
jmp 0x759c58ea
and dword [0x75bcc964], 0
jmp 0x759c58ea

Function at 0x759b3ed0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push edi
mov edi, ecx
call fcn.759b3eb3
cmp dword [0x75bcc8ec], 2
je 0x759b3eec
cmp eax, 1
je 0x759c59ac
pop edi
ret
push esi
mov esi, 0x75bcc964
push esi
call fcn.759b16ea
test al, al
jne 0x759c59ea
mov eax, dword [0x75bcc8d8]
and dword [0x75bcc964], 0
pop esi
cmp eax, 0xffffffff
je 0x759b3eec
cmp byte [edi + 4], 0
je 0x759b3eec
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x759b3eec
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x759c59b2

Function at 0x759b40be
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
xor ebx, ebx
call fcn.759b3eb3
cmp eax, 0xffffffff
je 0x759f255d
cmp dword [0x75bcc8ec], 2
push esi
je 0x759c5978
cmp eax, 1
je 0x759c5978
mov esi, dword [ebp + 0xc]
mov byte [esi], 0
cmp dword [0x75bcc8ec], 2
je 0x759cf906
call fcn.759b3ccf
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
jne 0x759b4123
push eax
push ecx
call fcn.759b412f
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x759b4123
mov byte [esi], 1
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
mov esi, 0x75bcc964
push esi
call fcn.759b16ea
test al, al
jne 0x759cf914
mov eax, dword [0x75bcc8d8]
cmp eax, 0xffffffff
je 0x759c59a1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
shr ebx, 0x1d
mov dword [0x75bcc964], edi
jmp 0x759b40f0
cmp ebx, 1
jne 0x759b4103
jmp 0x759f2565
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x759c597d
push 5
pop eax
jmp 0x759b4126
push ebx
lea ecx, [ebp - 8]
call fcn.75b314a6
push 0
push dword [ebp + 8]
call fcn.759b412f
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x759f2582
mov byte [esi], bl
lea ecx, [ebp - 8]
call fcn.75b30e87
jmp 0x759b4123
Function at 0x759b5447
Capabilities:
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [0x75bcca70], 0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
jne 0x759f471b
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [0x75bc8e60]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x759f480d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x759f47b6
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jne 0x759f47be
mov eax, dword [ebp + 0x14]
xor ebx, ebx
cmp eax, ebx
jne 0x759f47dd
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x759f47ed
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
jne 0x759f47fd
cmp byte [ebp - 1], 0
jne 0x759f482e
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
cmp word [0x75bcf0d0], 0
mov esi, 0x75bcf0d0
jne 0x759f4779
mov edi, 0x105
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov dword [0x75bcf0cc], eax
call ebx
mov ecx, dword [0x75bcf0cc]
lea eax, [ecx + eax + 2]
cmp eax, edi
ja 0x759f4779
push 0x75a0dd3c
push 0x20a
push esi
call fcn.75a5e52c
test eax, eax
jge 0x759f4771
mov eax, 0x65b
jmp 0x759b54cd
push esi
call ebx
mov dword [0x75bcf0cc], eax
push dword [0x75bcf0cc]
push esi
mov esi, dword [ebp + 8]
push esi
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x759b5463
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf70]
mov dword [eax + 0x14c0], esi
and dword [eax + 0x14c4], 0
mov byte [ebp - 1], 1
jmp 0x759b5463
or dword [eax], 2
jmp 0x759b5492
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call fcn.759c931f
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
add eax, ecx
adc edx, ebx
mov dword [esi], eax
mov dword [esi + 4], edx
jmp 0x759b549d
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
jmp 0x759b54aa
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
jmp 0x759b54b5
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
jmp 0x759b54c0
call edi
cmp eax, 0x7f
jne 0x759f4825
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
jmp 0x759b54c0
or dword [ebp - 8], 0xffffffff
jmp 0x759b54c0
call edi
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0xf70]
mov dword [ecx + 0x14c0], ebx
push eax
mov dword [ecx + 0x14c4], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x759b54ca
Function at 0x759b5885
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add eax, eax
mov dword [ebp + 0x18], eax
mov eax, dword [esi]
lea ecx, [ebp + 0x18]
push ecx
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 0xc], eax
cmp eax, 0xea
je 0x759b5a9a
cmp dword [ebp - 0xc], ebx
jne 0x759b590a
cmp dword [ebp - 4], 1
jne 0x759b8a37
xor ebx, ebx
inc ebx
mov edi, dword [ebp + 0x18]
xor ecx, ecx
and dword [ebp - 8], ecx
shr edi, 1
lea eax, [edi - 1]
test ebx, ebx
jbe 0x759b590a
test eax, eax
jl 0x759b5902
mov edx, dword [esi]
cmp word [edx + eax*2], 0
jne 0x759b5902
inc ecx
inc dword [ebp - 8]
dec eax
cmp dword [ebp - 8], ebx
jb 0x759b58eb
cmp ebx, ecx
ja 0x759e0da3
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x759e0dde
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x759b5921
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], 1
jne 0x759c2a29
add dword [ebp + 0x18], 2
mov eax, dword [ebp + 0x18]
push ebx
shr eax, 1
push eax
mov ecx, esi
call fcn.759b593b
test al, al
je 0x759e0d9b
mov eax, dword [esi]
lea ecx, [ebp + 0x18]
push ecx
push eax
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov dword [ebp - 0xc], eax
jmp 0x759b58c8
push 2
pop ebx
cmp dword [ebp - 4], ebx
je 0x759b58d7
cmp dword [ebp - 4], 7
je 0x759b58da
jmp 0x759b590a
cmp dword [ebp - 4], 2
je 0x759b5aa4
cmp dword [ebp - 4], 7
jne 0x759b5aa8
add dword [ebp + 0x18], 4
jmp 0x759b5aa8
push 0xe
pop eax
jmp 0x759b5924
sub ebx, ecx
add edi, ebx
cmp edi, dword [esi + 4]
jbe 0x759e0dba
push 1
push edi
mov ecx, esi
call fcn.759b593b
test al, al
je 0x759e0d9b
test ebx, ebx
jbe 0x759e0dd3
mov eax, edi
sub eax, ebx
add eax, eax
mov ecx, dword [esi]
xor edx, edx
mov word [eax + ecx], dx
dec ebx
inc eax
inc eax
test ebx, ebx
ja 0x759e0dc4
lea eax, [edi + edi]
mov dword [ebp + 0x18], eax
jmp 0x759b590a
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
jmp 0x759b5915