joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101be060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.10425990
add esp, 8
test eax, eax
je 0x101be0bf
inc eax
push 0x1046cb90
push eax
call fcn.1043ab70
add esp, 8
test eax, eax
jne 0x101be0bf
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x104
lea eax, [ebp - 0x108]
mov byte [ebp - 0x20d], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x11224e94
lea eax, [ebp - 0x108]
push eax
push 0x1046bfe0
push eax
call fcn.100086a0
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x101be2af
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1046cba0
push esi
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 0
call edi
test eax, eax
je 0x101be142
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x214]
push ecx
call eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x101be154
cmp dword [ebp - 0x214], eax
jle 0x101be168
mov dword [ebp - 0x21c], 4
mov dword [ebp - 0x214], 4
push 0x1046cb70
push esi
call edi
mov dword [ebp - 0x224], eax
test eax, eax
je 0x101be252
mov edi, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x214]
cmp edi, ecx
jl 0x101be252
mov dword [ebp - 0x220], 0
cmp edi, 3
jl 0x101be249
lea ecx, [ebp - 0x220]
push ecx
push edi
call eax
test eax, eax
jne 0x101be23d
cmp edi, 3
jne 0x101be23d
mov ebx, dword [ebp - 0x220]
push 0x11d0c5b0
push 0x11cd6988
call fcn.10425b34
mov esi, eax
mov dword [ebp - 0x218], eax
add esp, 8
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x101be1e3
push 0x11d0c5b0
push 0x11cd6988
sub esi, eax
call fcn.10425b34
push esi
push eax
push dword [ebp - 0x218]
call fcn.104349a0
add esp, 0x14
test eax, eax
je 0x101be232
push 0x11d0c5b0
push 0x11cd6964
call fcn.10425b34
push esi
push eax
push dword [ebp - 0x218]
call fcn.104349a0
add esp, 0x14
test eax, eax
jne 0x101be23d
test ebx, ebx
je 0x101be23d
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x101be269
mov ecx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x224]
dec edi
cmp edi, ecx
jge 0x101be192
mov al, byte [ebp - 0x20d]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push ecx
call eax
test eax, eax
jne 0x101be29c
cmp dword [ebp - 0x218], 1
jne 0x101be29c
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
xor ecx, ebp
pop esi
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x101be490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
mov esi, edx
push eax
mov dword [ebp - 0x114], esi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x11224e94
lea eax, [ebp - 0x110]
push eax
push 0x1046bfe0
push 0xffffffffffffffff
push 0x104
push eax
call fcn.101beef0
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [esi], 0
mov dword [0x11d23ba4], edi
mov dword [ebx], 0
test edi, edi
jne 0x101be625
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101be515
sub ecx, edx
lea eax, [ecx*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x101be5fa
lea ecx, [ebp - 0x110]
xor edx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101be543
sub ecx, edi
je 0x101be574
nop
movsx ax, byte [ebp + edx - 0x110]
lea ecx, [ebp - 0x110]
lea edi, [ecx + 1]
mov word [esi + edx*2], ax
inc edx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101be567
sub ecx, edi
cmp edx, ecx
jb 0x101be550
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call edi
movzx eax, word [esi]
cmp eax, 0x5c
je 0x101be5db
cmp eax, 0x2f
je 0x101be5db
push eax
call fcn.1043a2f0
add esp, 4
test eax, eax
je 0x101be5ad
cmp word [esi + 2], 0x3a
jne 0x101be5ad
movzx eax, word [esi + 4]
cmp eax, 0x5c
je 0x101be5db
cmp eax, 0x2f
je 0x101be5db
push 0xa0
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x11d23ba4], 0
mov eax, 0x7e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.1003fff0
test eax, eax
jne 0x101be5ed
push 0xa1
jmp 0x101be5b2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x11d23ba4], edi
test edi, edi
jne 0x101be61f
lea eax, [edi + 0x7e]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x114]
push 0x1046cbd0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x101be649
push esi
push ebx
call eax
test eax, eax
je 0x101be649
mov dword [esi], 0
mov dword [ebx], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x101bef30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x20119
push 0
push 0x1046cc10
push 0x80000002
mov esi, ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x101bef82
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push 0x1046cc10
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor cl, cl
test eax, eax
jne 0x101befda
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
xor bl, bl
push eax
push 0
push 0
push 0x1046cc40
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101befc9
mov eax, dword [ebp - 8]
test eax, 0x100
jne 0x101befc9
test eax, 0x10000
je 0x101befc9
mov bl, 1
test esi, esi
je 0x101befc9
mov dword [esi], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101beff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
push eax
push 0x20119
push 0
push 0x1046cc10
push 0x80000002
mov ebx, ecx
mov dword [ebp - 0x10], 0
mov dword [0x11d0d93c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call edi
cmp eax, 2
jne 0x101bf053
lea eax, [ebp - 0xc]
push eax
push 0x20219
push 0
push 0x1046cc10
push 0x80000002
call edi
test eax, eax
jne 0x101bf213
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 4
push eax
push 0
push 0
push 0x1046cc40
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x101bf20a
mov eax, dword [ebp - 8]
test eax, 0x100
jne 0x101bf20a
test eax, 0x10000
je 0x101bf20a
push dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dword [ebp - 0x10], 0x20000
je 0x101bf213
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push 0x1046cc50
push 0x80000002
call edi
cmp eax, 2
jne 0x101bf0f2
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push 0x1046cc50
push 0x80000002
call edi
test eax, eax
jne 0x101bf1fb
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x1046cc80
push dword [ebp - 4]
call esi
test eax, eax
jne 0x101bf1f2
mov dword [ebp - 8], 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ebx, ebx
je 0x101bf160
test dword [ebp - 0x10], 0x40000
je 0x101bf160
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x1046cc90
push dword [ebp - 4]
call esi
test eax, eax
jne 0x101bf160
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 0
push 0
push 0x1046cca0
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x1046ccb0
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x1046ccd0
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x1046ccf0
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x1046cd00
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x1046cd20
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [0x11d0d93c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101c2700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x105
lea eax, [ebp - 0x10c]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x101c2771
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101c2735
sub eax, edx
lea ecx, [ebp - 0x10c]
push esi
add eax, ecx
push 0x1046cdc0
push eax
call fcn.100086a0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x101c3490
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ecx]
mov dword [ebp - 0x10], 0
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
cmp dword [eax + 0xd45c], 1
jne 0x101c352c
lea eax, [edi + 0x1428]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi + 0x1140]
lea ecx, [ebp - 0x24]
push ecx
push dword [edi + 0x11cc]
call eax
push eax
push ecx
mov ecx, edi
call fcn.101c9e10
mov dword [ebp + 8], eax
xorps xmm0, xmm0
lea eax, [ebp - 0xc]
movlpd qword [ebp - 0xc], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 8]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
mov ecx, dword [ebp + 8]
adc dword [edi + 0x1424], eax
jmp 0x101c3549
mov eax, dword [edi + 0x1140]
lea ecx, [ebp - 0x24]
push ecx
push dword [edi + 0x11cc]
call eax
push eax
push ecx
mov ecx, edi
call fcn.101c9e10
mov ecx, eax
test ecx, ecx
js 0x101c3553
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
pop edi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101c3640
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, 0x112275c4
mov dword [esi], 2
mov eax, dword [eax + 0xf7c]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esi + 4], ecx
mov ecx, edi
mov dword [esi + 8], eax
mov dl, byte [0x11cd362c]
and dl, 1
mov byte [ebp + 0xb], dl
cmovne ecx, dword [0x11cd3a30]
xor eax, eax
cmp byte [ecx], al
je 0x101c36a1
inc eax
cmp byte [eax + ecx], 0
jne 0x101c3686
cmp eax, 0x100
jle 0x101c36a1
mov ecx, dword [0x11cd3a30]
mov edx, 0x100
jmp 0x101c36bb
mov ecx, dword [0x11cd3a30]
test dl, dl
mov eax, edi
cmovne eax, ecx
xor edx, edx
cmp byte [eax], dl
je 0x101c36bb
inc edx
cmp byte [edx + eax], 0
jne 0x101c36b4
cmp byte [ebp + 0xb], 0
cmovne edi, ecx
xor ecx, ecx
add esi, 0xc
cmp byte [edi], cl
je 0x101c36e1
nop dword [eax + eax]
cmp ecx, edx
jae 0x101c36e8
mov al, byte [ecx + edi]
inc ecx
mov byte [esi], al
inc esi
cmp byte [ecx + edi], 0
jne 0x101c36d0
cmp ecx, edx
jae 0x101c36e8
mov byte [esi], 0
test byte [0x11cd362c], 1
mov esi, 0x11229a54
mov edi, dword [ebp + 0xc]
mov eax, esi
cmovne eax, dword [0x11cd423c]
push 0xffffffffffffffff
push eax
lea eax, [edi + 0x10c]
push 0x100
push eax
call fcn.1043ab2c
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [edi + 0x71c]
push 0x104
push eax
call fcn.1043ab2c
lea eax, [edi + 0x514]
push 0x104
push eax
call fcn.1043d8ee
test byte [0x11cd362c], 1
lea eax, [edi + 0x30c]
push 0xffffffffffffffff
cmovne esi, dword [0x11cd4234]
push esi
push 0x100
push eax
call fcn.1043ab2c
add esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [edi + 0xc24], eax
lea eax, [edi + 0x924]
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp + 0xc]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x101c3850
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp + 8]
push eax
push 0
push 0
push 1
push dword [ebp + 0xc]
mov dword [ebp + 8], 0
call edi
test eax, eax
jne 0x101c37da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x101c37da
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 8]
call fcn.10450898
add esp, 4
mov esi, eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push esi
push 1
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x101c383e
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x101c3838
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
mov eax, dword [ebp - 8]
push 0x100
push dword [ebp - 4]
push eax
call fcn.1043afce
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x101c383e
mov eax, dword [ebp - 8]
mov byte [eax], 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10450877
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x101c3e30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe10
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xdec]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0xdad
push 0
push eax
mov edi, ecx
mov dword [ebp - 0xe00], ebx
call fcn.10425c00
add esp, 0xc
mov dword [ebp - 0xdfc], 0x4e564441
xorps xmm0, xmm0
mov dword [ebp - 0xdf8], 0x10004
lea eax, [ebp - 0xdec]
movq qword [ebp - 0x17], xmm0
movups xmmword [ebp - 0x27], xmm0
push 0xddd
push 0
push eax
mov dword [ebp - 0xdf4], 0xded
mov dword [ebp - 0xdf0], 0x4e564458
call fcn.10425c00
add esp, 0xc
mov dword [ebp - 0x2f], 0xffffffff
lea eax, [ebp - 0xdfc]
mov dword [ebp - 0x2b], 0xffffffff
mov ecx, edi
mov dword [ebp - 0x3f], 0xffffffff
mov dword [ebp - 0x3b], 0xffffffff
push 0
push dword [ebp + 0x18]
mov dword [ebp - 0x37], 0xffffffff
push dword [ebp + 0x14]
mov dword [ebp - 0x33], 0xffffffff
push dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
push eax
push esi
mov dword [ebx + 0x10], 0xded
call fcn.101c3860
mov ecx, edi
call fcn.101c27b0
test al, al
je 0x101c3f5b
push ebx
mov ecx, edi
call fcn.101c3490
test eax, eax
js 0x101c4019
lea eax, [ebp - 0x8c]
mov ecx, edi
push eax
push dword [ebx + 0x14]
push dword [edi]
call fcn.101c3180
test eax, eax
js 0x101c4019
push dword [edi + 0x644]
mov ecx, edi
push ebx
call fcn.101c3560
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + 0xd45c], 1
jne 0x101c3fe0
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebx + 0x1428]
push eax
call esi
push dword [ebp - 0xe00]
mov eax, dword [ebx + 0x10c8]
push dword [ebx + 0x11cc]
call eax
push eax
push ecx
mov ecx, ebx
call fcn.101c9e10
mov dword [ebp - 0xe04], eax
xorps xmm0, xmm0
lea eax, [ebp - 0xe0c]
movlpd qword [ebp - 0xe0c], xmm0
push eax
call esi
mov ecx, dword [ebp - 0xe0c]
sub ecx, dword [ebx + 0x1428]
mov eax, dword [ebp - 0xe08]
sbb eax, dword [ebx + 0x142c]
add dword [ebx + 0x1420], ecx
mov esi, dword [ebp - 0xe00]
adc dword [ebx + 0x1424], eax
mov eax, dword [ebp - 0xe04]
jmp 0x101c3ffe
mov esi, dword [ebp - 0xe00]
mov eax, dword [ebx + 0x10c8]
push esi
push dword [ebx + 0x11cc]
call eax
push eax
push ecx
mov ecx, ebx
call fcn.101c9e10
test eax, eax
js 0x101c4019
push 0
push dword [esi + 0x14]
mov ecx, edi
push dword [edi]
call fcn.101c3180
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x101c86c0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
test byte [edi + 0x604], 1
jne 0x101c886d
push 0x1046c3d0
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [edi + 0x5d8], eax
test eax, eax
je 0x101c872d
push 0x80000
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x5dc], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x5d0], eax
mov dword [edi + 0x5d4], ecx
mov ecx, dword [0x11d0c5b8]
xor ebx, ebx
mov eax, dword fs:[0x2c]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0xfd48]
test ecx, ecx
je 0x101c8763
add eax, 0xf968
cmp dword [eax], 1
je 0x101c8766
inc ebx
add eax, 0x20
cmp ebx, ecx
jb 0x101c8756
or ebx, 0xffffffff
mov ecx, dword [edi]
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0x108c]
mov dword [ebp - 0x14], eax
inc eax
mov dword [ecx + 0x108c], eax
cmp dword [edi + 0x254], 0
jbe 0x101c8866
lea eax, [edi + 0x4b8]
mov dword [ebp - 0xc], eax
lea eax, [edi + 0x498]
mov dword [ebp - 8], eax
nop
mov ecx, dword [edx + 0x10]
xor eax, eax
mov esi, dword [ecx + 0xfd48]
test esi, esi
je 0x101c87cd
add ecx, 0xf968
mov edx, ecx
nop word [eax + eax]
cmp dword [edx], 1
je 0x101c8804
inc eax
add edx, 0x20
cmp eax, esi
jb 0x101c87c0
push 1
push dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
call fcn.101c4030
test eax, eax
js 0x101c886f
mov eax, dword [ebp - 4]
add dword [ebp - 8], 4
inc eax
add dword [ebp - 0xc], 0x20
mov dword [ebp - 4], eax
cmp eax, dword [edi + 0x254]
jae 0x101c8866
mov edx, dword [ebp - 0x10]
jmp 0x101c87a0
cmp eax, 0x1f
jne 0x101c881f
xor eax, eax
nop dword [eax + eax]
cmp dword [ecx], 1
je 0x101c8829
inc eax
add ecx, 0x20
cmp eax, esi
jb 0x101c8810
jmp 0x101c87cd
cmp eax, 0xffffffff
je 0x101c87cd
cmp eax, 0x1f
jae 0x101c87cd
mov edx, dword [ebp - 0x10]
shl eax, 5
mov ecx, dword [edx + 0x10]
cmp dword [eax + ecx + 0xf970], 0
setne al
test al, al
je 0x101c87cd
push 1
push dword [ebp - 0x14]
lea eax, [edi + 0x5b8]
mov ecx, edi
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
call fcn.101c4190
jmp 0x101c87e0
or byte [edi + 0x604], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101ce7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], 1
lea ecx, [ebp - 0x10]
xorps xmm0, xmm0
push ecx
movlpd qword [ebp - 0x10], xmm0
mov eax, dword [edi + 0xf78]
call eax
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x101ce919
xor ecx, ecx
mov eax, esi
mov edx, 0x14
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10450898
add esp, 4
lea ecx, [esi + esi*4]
shl ecx, 2
mov ebx, eax
mov dword [ebp - 8], ebx
push ecx
push 0
push ebx
call fcn.10425c00
add esp, 0xc
test ebx, ebx
jne 0x101ce864
push ebx
call fcn.10450877
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xf78]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
call eax
test eax, eax
jne 0x101ce8d0
xor edx, edx
test esi, esi
je 0x101ce8d0
mov ecx, dword fs:[0x2c]
mov eax, dword [0x11d0c5b8]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 8]
add ecx, 8
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0xbe2c]
mov edi, dword [eax + 0x1410]
mov ebx, dword [edi + 0xd453]
nop dword [eax]
cmp dword [ecx - 4], ebx
jne 0x101ce8bf
mov eax, dword [ecx]
cmp eax, dword [edi + 0xd457]
je 0x101ce8c9
inc edx
add ecx, 0x14
cmp edx, esi
jb 0x101ce8b0
jmp 0x101ce8cd
mov byte [ebp - 1], 0
mov ebx, dword [ebp - 8]
push ebx
call fcn.10450877
add esp, 4
cmp byte [ebp - 1], 0
je 0x101ce919
mov eax, dword [0x11d0c5b8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0xd328]
test al, 1
je 0x101ce906
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test al, 8
je 0x101ce919
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101cffa0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0xc4
mov dword [ebp - 0xd8], eax
mov edi, ecx
lea eax, [ebp - 0xd0]
push 0
push eax
call fcn.10425c00
mov eax, dword [edi + 0x11cc]
add esp, 0xc
mov edx, dword [edi + 0x10b4]
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xd0], 0x4e564441
mov dword [ebp - 0xcc], 0x10002
mov dword [ebp - 0xc8], 0xc4
mov dword [ebp - 0xc4], 0x4e564458
mov dword [ebp - 0xc0], 0x1000071
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], 0xc4
test edx, edx
je 0x101d0103
mov eax, dword [edi]
test eax, eax
je 0x101d0103
mov ecx, dword [eax + 0xbe28]
test ecx, ecx
je 0x101d0103
mov ecx, dword [ecx + 0x14]
test ecx, ecx
je 0x101d0103
cmp dword [eax + 0xd45c], 1
jne 0x101d00f5
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x1428]
push eax
call esi
mov ecx, dword [edi + 0x10b4]
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0xbe28]
push dword [eax + 0x14]
call ecx
mov dword [ebp - 0xd4], eax
xorps xmm0, xmm0
lea eax, [ebp - 0xe0]
movlpd qword [ebp - 0xe0], xmm0
push eax
call esi
mov ecx, dword [ebp - 0xe0]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 0xdc]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
adc dword [edi + 0x1424], eax
mov eax, dword [ebp - 0xd4]
jmp 0x101d00ff
lea eax, [ebp - 0xf4]
push eax
push ecx
call edx
test eax, eax
jne 0x101d0165
mov eax, dword [edi]
mov eax, dword [eax + 0xf944]
lea esi, [eax*8 - 8]
mov ecx, dword [ebp + esi - 0x60]
mov eax, ecx
mov edx, dword [ebp + esi - 0x5c]
or eax, edx
jne 0x101d0134
mov ecx, dword [ebp + esi - 0xa0]
mov eax, ecx
mov edx, dword [ebp + esi - 0x9c]
or eax, edx
je 0x101d0165
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x101d0165
test ebx, ebx
je 0x101d0144
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov ecx, dword [ebp - 0xd8]
test ecx, ecx
je 0x101d0150
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret 0x10