joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100473e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
and esp, 0xfffffff8
push ebp
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101de570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov edi, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov eax, dword [0x1020ed34]
mov dword [ebp - 0x34], ecx
test edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
movsd xmm0, qword [0x101e1f30]
movsd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
jle 0x100475b2
movsd xmm0, qword [0x101e1f38]
movsd qword [eax + 0x10], xmm0
xor esi, esi
mov dword [eax + 8], esi
mov dword [eax], esi
test edx, edx
jle 0x1004745e
mov dword [eax + 4], edx
jmp 0x1004746a
mov dword [eax + 4], 1
mov edx, 1
push edx
add eax, 8
push eax
call fcn.1000d650
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x34]
add edx, 0x18
mov dword [ebp - 0x18], edx
test edi, edi
jle 0x100475a3
mov dword [edx], esi
mov dword [edx + 4], esi
jg 0x1004749b
mov edi, 8
mov dword [edx + 8], edi
mov dword [edx + 0xc], esi
mov dword [edx + 0x10], esi
mov eax, edi
neg eax
dec eax
mov dword [edx + 0x14], eax
add esp, 0xfffffff8
mov dword [esp], edx
mov dword [esp + 4], edi
call fcn.1002bef0
add esp, 8
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 8]
add esp, 0xfffffff8
mov dword [esp + 4], ecx
lea eax, [edx + 4]
mov dword [esp], eax
call fcn.10025ee0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
movsd qword [esi + 0x38], xmm0
mov dword [0x10210920], eax
xor edi, edi
push edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea edx, [esi + 0x10]
mov dword [esi + 0x40], edx
add ecx, 0x48
call fcn.1000ff00
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x34]
push 0
add ecx, 0x58
call fcn.1000ff00
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x34]
push 0
add ecx, 0x68
call fcn.1000ff00
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
call fcn.101bc753
mov edi, dword [ebp - 0x28]
mov eax, esi
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
mov dword [edx], esi
mov dword [edx + 4], esi
mov edi, 8
jmp 0x1004749b
mov edx, 8
test edi, edi
cmovg edx, edi
shl edx, 3
jmp 0x10047441
Function at 0x100475d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
and esp, 0xfffffff8
push ebp
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101de5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov edi, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov eax, dword [0x1020ed34]
mov dword [ebp - 0x34], ecx
test edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
movsd xmm0, qword [0x101e1f40]
movsd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
jle 0x1004777f
movsd xmm0, qword [0x101e1f48]
movsd qword [eax + 0x10], xmm0
xor esi, esi
mov dword [eax + 8], esi
mov dword [eax], esi
test edx, edx
jle 0x1004764e
mov dword [eax + 4], edx
jmp 0x1004765a
mov dword [eax + 4], 1
mov edx, 1
push edx
add eax, 8
push eax
call fcn.1000d650
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x34]
add edx, 0x18
mov dword [ebp - 0x18], edx
test edi, edi
jle 0x10047770
mov dword [edx], esi
mov dword [edx + 4], esi
jg 0x1004768b
mov edi, 8
mov dword [edx + 8], edi
mov dword [edx + 0xc], esi
mov dword [edx + 0x10], esi
mov eax, edi
neg eax
dec eax
mov dword [edx + 0x14], eax
add esp, 0xfffffff8
mov dword [esp], edx
mov dword [esp + 4], edi
call fcn.1002bef0
add esp, 8
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 8]
add esp, 0xfffffff8
mov dword [esp + 4], ecx
lea eax, [edx + 4]
mov dword [esp], eax
call fcn.10025ee0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
movsd qword [esi + 0x38], xmm0
mov dword [0x10210924], eax
xor edi, edi
push edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea edx, [esi + 0x10]
mov dword [esi + 0x40], edx
add ecx, 0x48
call fcn.1000ff00
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x34]
push 0
add ecx, 0x58
call fcn.1000ff00
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x1c]
call fcn.101bc753
mov edi, dword [ebp - 0x28]
mov eax, esi
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
mov dword [edx], esi
mov dword [edx + 4], esi
mov edi, 8
jmp 0x1004768b
mov edx, 8
test edi, edi
cmovg edx, edi
shl edx, 3
jmp 0x10047631
Function at 0x10069120
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101df0e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov eax, dword [0x1020ed34]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
movsd xmm0, qword [0x101e3fb0]
movsd qword [eax + 0x10], xmm0
xor ebx, ebx
mov dword [eax + 8], ebx
mov dword [eax], ebx
mov edx, 1
push edx
mov dword [eax + 4], edx
add eax, 8
push eax
call fcn.1000d650
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0x18
mov dword [eax + 0x14], 0xfffffff7
mov dword [eax], ebx
mov dword [ebp - 0x18], eax
mov dword [eax + 4], ebx
mov edx, 8
mov dword [eax + 8], edx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
add esp, 0xfffffff8
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.1002bef0
add esp, 8
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 8]
add esp, 0xfffffff8
mov dword [esp + 4], ecx
lea eax, [edx + 4]
mov dword [esp], eax
call fcn.10025ee0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov dword [0x10210934], eax
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x34], edx
movsd xmm0, qword [esi + 0x38]
movsd qword [ecx + 0x38], xmm0
lea ebx, [ecx + 0x10]
mov dword [ecx + 0x40], ebx
call fcn.10069260
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
call fcn.101bc753
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov eax, ebx
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006c100
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x100d2c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x14]
Function at 0x100fb7f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
and esp, 0xfffffff0
push ebp
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101df210
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov eax, dword [ebx + 8]
mov edx, dword [eax*4 + 0x102194a0]
cmp dword [ebx + 0xc], 0
mov edi, dword [edx + 0x98]
jle 0x100fb88a
mov ecx, dword [ebx + 0x10]
and ecx, 0xf
je 0x100fb851
test cl, 3
jne 0x100fb993
neg ecx
add ecx, 0x10
shr ecx, 2
lea eax, [ecx + 4]
cmp eax, dword [ebx + 0xc]
jg 0x100fb993
mov eax, dword [ebx + 0xc]
mov edx, eax
sub edx, ecx
and edx, 3
neg edx
add edx, eax
test ecx, ecx
jbe 0x100fb90a
xor eax, eax
mov esi, dword [ebx + 0x10]
mov esi, dword [esi + eax*4]
cmp esi, edi
cmovge edi, esi
inc eax
cmp eax, ecx
jb 0x100fb875
jmp 0x100fb90a
movsd xmm0, qword [0x101e1b38]
movsd qword [ebp - 0x48], xmm0
push 0
lea ecx, [ebp - 0x30]
pxor xmm1, xmm1
movsd qword [ebp - 0x40], xmm1
movsd qword [ebp - 0x38], xmm1
call fcn.1000d580
mov dword [ebp - 4], 0
mov eax, dword [ebx + 8]
mov ecx, dword [eax*4 + 0x102194a0]
mov esi, dword [ecx + 0x98]
cmp esi, edi
jg 0x100fb8e4
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
inc esi
cmp esi, edi
jg 0x100fb8e4
mov eax, dword [ebx + 8]
mov ecx, dword [eax*4 + 0x102194a0]
jmp 0x100fb8ca
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000def0
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
movd xmm0, edi
pshufd xmm2, xmm0, 0
mov eax, dword [ebx + 0x10]
movdqa xmm0, xmmword [eax + ecx*4]
movdqa xmm1, xmm0
pxor xmm0, xmm2
add ecx, 4
pcmpgtd xmm1, xmm2
pand xmm1, xmm0
pxor xmm2, xmm1
cmp ecx, edx
jb 0x100fb913
movdqa xmm0, xmm2
movdqa xmm1, xmm2
psrldq xmm0, 8
pxor xmm2, xmm0
pcmpgtd xmm1, xmm0
pand xmm1, xmm2
pxor xmm1, xmm0
movdqa xmm2, xmm1
movdqa xmm3, xmm1
psrldq xmm2, 4
pxor xmm1, xmm2
pcmpgtd xmm3, xmm2
pand xmm3, xmm1
pxor xmm3, xmm2
movd edi, xmm3
cmp edx, dword [ebx + 0xc]
jae 0x100fb88a
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + edx*4]
cmp ecx, edi
cmovge edi, ecx
inc edx
cmp edx, dword [ebx + 0xc]
jb 0x100fb97d
jmp 0x100fb88a
xor edx, edx
jmp 0x100fb974
Function at 0x10107cf0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x1012da20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x101304a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x101345c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x1013c000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x1013ce20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x101485f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
Function at 0x10161600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x1c]
Function at 0x10172fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x10191850
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x101918d7
mov eax, dword [esp + 0x10]
mov ecx, 2
sub eax, ecx
je 0x1019189c
mov word [0x1021c2a0], cx
call fcn.10194e60
add esp, 0x94
ret
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x101918ba
mov edx, dword [esp + 8]
mov eax, 1
cmp edx, eax
jb 0x10191889
mov word [0x1021c2a0], ax
jmp 0x101918c8
cmp eax, 6
jb 0x10191889
mov word [0x1021c2a0], 1
call fcn.101915a0
call fcn.10191730
call fcn.10194e60
add esp, 0x94
ret

Function at 0x101926a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov cl, 0x65
mov al, 0x72
push esi
xor esi, esi
mov byte [esp + 4], 0x54
mov byte [esp + 5], cl
mov byte [esp + 6], al
mov byte [esp + 7], 0x6d
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x61
mov byte [esp + 0xb], 0x6c
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], 0x53
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], al
mov byte [esp + 0x10], 0x76
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
jne 0x10192729
cmp al, 4
jbe 0x10192717
lea eax, [esp + 4]
push eax
call fcn.10192730
add esp, 4
pop esi
add esp, 0x10
ret
lea ecx, [esp + 4]
push ecx
call fcn.10192730
add esp, 4
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x10192730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
xor ebp, ebp
xor ebx, ebx
push str.SystemCurrentControlSetControlProductOptions
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10192805
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push ebp
push edx
push ebp
push str.ProductSuite
push eax
call esi
test eax, eax
jne 0x10192805
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x10192805
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebp
je 0x10192805
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
push ebp
push str.ProductSuite
push eax
call esi
test eax, eax
jne 0x101927f8
cmp dword [esp + 0x18], 7
jne 0x101927f8
mov al, byte [edi]
mov esi, edi
test al, al
je 0x101927f8
mov ebp, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push ebp
push esi
call ebx
test eax, eax
je 0x101927f0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x101927d6
jmp 0x101927f8
mov dword [esp + 0x1c], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x10192814
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10192f50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push esi
push 0x4e8
push 5
push 6
mov dword [esp + 0x10], 0x10
call fcn.10193440
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x10192fe4
mov edx, dword [esp + 4]
push ebx
mov ecx, edx
push edi
mov ebx, ecx
xor eax, eax
lea edi, [esp + 0x10]
push edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
mov word [esp + 0x14], 6
push eax
push esi
call sub.WSOCK32.dll_bind
pop edi
cmp eax, 0xffffffff
pop ebx
je 0x10192fe4
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push esi
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
je 0x10192fe4
lea eax, [esp + 8]
push eax
call fcn.10192ec0
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.101bc928
add esp, 0xc
push esi
call sub.WSOCK32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [esp + 0x1c]
push str.00_00_00_00_FF_FF_FF_FF_FF_FF
push edx
call fcn.101bc928
add esp, 8
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x10193700
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call fcn.10192620
test eax, eax
jne 0x10193730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x10193745
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov edx, dword [esp + 0x14]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10193789
mov edi, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push esi
call ebx
test eax, eax
je 0x10193769
cmp eax, 0x102
jne 0x10193776
mov eax, dword [esp + 0x24]
inc ebp
cmp ebp, eax
jg 0x10193780
jmp 0x1019374f
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0x73
pop ebx
ret
push esi
call fcn.10193800
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x101937a0
Capabilities:
Check mutex on windows

Disassembly:
push esi
call fcn.10192620
test eax, eax
jne 0x101937b8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push 0
push ecx
jmp 0x101937c1
mov edx, dword [esp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x101937d4
mov eax, 1
pop esi
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x101937eb
mov eax, dword [esp + 0x10]
mov dword [eax], esi
xor eax, eax
pop esi
ret
mov eax, 0x73
pop esi
ret
Function at 0x10197310
Capabilities:
Get session user name

Disassembly:
sub esp, 0x4c8
push esi
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x14], 0x40
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x101973a1
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x54]
push ecx
push edx
call fcn.1019ec30
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10197397
mov eax, dword [str.NoName]
mov cx, word [0x1020dd88]
mov dl, byte [0x1020dd8a]
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
mov byte [esp + 0x16], dl
jmp 0x101973e8
lea edi, [esp + 0x50]
lea edx, [esp + 0x10]
jmp 0x101973cb
mov dx, word [0x1020dd88]
mov ecx, dword [str.NoName]
mov al, byte [0x1020dd8a]
mov word [esp + 0x14], dx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x16], al
lea edi, [esp + 0x10]
lea edx, [esp + 0xd0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x90]
push ebx
push ecx
call fcn.1019ea90
lea edi, [esp + 0x98]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x2dc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xe0]
push ecx
call fcn.1019ec30
add esp, 0x10
cmp eax, 0xffffffff
pop ebx
jne 0x10197480
mov edx, dword [str.NoShareString]
mov eax, dword [0x1020de04]
mov ecx, dword [0x1020de08]
mov dword [esp + 0xd0], edx
mov dx, word [0x1020de0c]
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], ecx
mov word [esp + 0xdc], dx
jmp 0x101974ab
lea edi, [esp + 0x2d0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
lea edi, [esp + 0xd0]
push ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
push ecx
push edx
call fcn.1019e9a0
mov ecx, dword [esp + 0x14]
add esp, 0xc
inc eax
neg eax
sbb eax, eax
pop edi
and eax, ecx
pop esi
mov dword [0x1021d290], eax
add esp, 0x4c8
ret
Function at 0x10197b40
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x34]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
je 0x10197d7d
mov esi, dword [esp + 0x44]
cmp si, bp
jbe 0x10197d7d
cmp si, 0xffff
jne 0x10197b7f
pop edi
pop esi
pop ebp
mov ax, 3
pop ebx
add esp, 0x2c
ret 0xc
push ebx
call fcn.10196280
mov edi, eax
add edi, 0x18
cmp word [edi], 0x7242
jne 0x10197bfd
test byte [edi + 0x12], 4
jne 0x10197baa
mov eax, 2
mov word [edi + 6], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
push esi
push ebx
call fcn.101a0a60
cmp ax, bp
jne 0x10197d81
push ebx
call fcn.10197af0
add esp, 4
test ax, ax
je 0x10197be1
push ebx
call fcn.101a0c40
cmp ax, bp
jne 0x10197b71
push ebx
call fcn.10197af0
add esp, 4
test ax, ax
jne 0x10197bc8
push ebx
call fcn.10197500
mov ecx, dword [0x10283b08]
push ecx
push eax
call fcn.10197940
mov esi, eax
add esp, 0xc
cmp esi, ebp
jne 0x10197c0b
pop edi
pop esi
pop ebp
mov ax, 2
pop ebx
add esp, 0x2c
ret 0xc
cmp word [esi + 0x76], bp
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
je 0x10197c35
push 0x1000
call ebp
test eax, eax
je 0x10197c35
mov eax, 0x46
mov word [edi + 6], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
cmp word [esp + 0x48], 1
jne 0x10197d70
cmp word [0x1021d2a2], 0
jne 0x10197cc2
lea edx, [esp + 0x18]
push edx
call fcn.10192640
add esp, 4
test eax, eax
je 0x10197c6f
mov eax, 0x4a
mov word [edi + 6], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x1021d2a8], eax
jne 0x10197c9a
mov eax, 0x4a
mov word [edi + 6], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 0x10194560
push 0
push 0
call fcn.101c0e32
add esp, 0x18
mov dword [0x1021d2ac], eax
mov word [0x1021d2a2], 1
cmp word [esi + 0x76], 0
je 0x10197ce7
push 0x1000
call ebp
test eax, eax
je 0x10197ce7
mov eax, 0x46
mov word [edi + 6], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push ebx
call fcn.101976c0
add esp, 0xc
test eax, eax
jne 0x10197d11
mov eax, 0x46
mov word [edi + 6], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
mov si, word [esp + 0x10]
mov ecx, dword [0x1021d290]
neg si
sbb esi, esi
and esi, ecx
lea ecx, [esp + 0x24]
push ecx
push ebx
call fcn.101a0720
mov dx, word [edi + 0x38]
mov ax, word [edi + 0x36]
push 0
push 0
push 0
push esi
push 1
push 1
push edx
push eax
push edi
call fcn.10198490
add esp, 0x24
test ax, ax
je 0x10197d70
push 0x404
push ebx
call fcn.101a08a0
push ebx
call fcn.101a0980
pop edi
pop esi
pop ebp
mov ax, 0x46
pop ebx
add esp, 0x2c
ret 0xc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0x2c
ret 0xc
mov ax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc