joyce8/EMBER2024-capa huggingface dataset:
Function at 0x352e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0352e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x352e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x352e06a
add dl, dl
jne 0x352e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x352e0dc
xor eax, eax
add dl, dl
jne 0x352e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x352e17d
add dl, dl
jne 0x352e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x352e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x352e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x352e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x352e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x352e075
mov eax, 1
add dl, dl
jne 0x352e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x352e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x352e0e1
sub eax, ebx
mov ebx, 1
jne 0x352e128
mov ecx, 1
add dl, dl
jne 0x352e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x352e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x352e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x352e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x352e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x352e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x352e136
cmp eax, 0x7d00
jae 0x352e16d
cmp eax, 0x500
jb 0x352e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x352e075
cmp eax, 0x7f
ja 0x352e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x352e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x352e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x352e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10002050
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1009e7f2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
push esi
call fcn.10002160
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.RC::RCDownloadManagerClient.0
mov dword [esi + 4], vtable.RC::RCDownloadManagerClient.1.0
mov dword [esi + 8], vtable.RC::RCDownloadManagerClient.2.0
mov dword [esi + 0x10], ebx
mov byte [esp + 0x18], 1
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
push eax
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x18], 2
lea eax, [esi + 0x1c]
push eax
call fcn.100323d0
mov byte [esp + 0x18], 3
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.10006f50
mov byte [esp + 0x18], 4
lea edx, [esi + 0x40]
push edx
mov byte [esi + 0x3c], bl
call fcn.100323d0
mov byte [esp + 0x18], 5
push 0xbc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], 6
cmp eax, ebx
je 0x1000210d
push eax
call fcn.100164d0
jmp 0x1000210f
xor eax, eax
mov byte [esp + 0x18], 5
mov dword [esi + 0x14], eax
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x10006330
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x100a4788
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0xc]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], esi
je 0x10006372
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov dword [esp + 0x24], ebp
cmp esi, ebp
mov ebx, dword [esp + 0x2c]
je 0x1000638c
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push ebx
mov ecx, esi
call edx
mov dword [esp + 0x14], eax
mov al, byte [edi + 0x38]
test al, al
je 0x100063cd
cmp ebx, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
setbe bl
add edi, 0xfffffffc
call ebp
mov esi, eax
cmp esi, dword [edi + 0x2c]
jae 0x100063b3
call ebp
test bl, bl
mov dword [edi + 0x2c], eax
je 0x100063cd
sub esi, dword [edi + 0x2c]
test bl, bl
jne 0x100063c2
cmp esi, 0x3e8
jbe 0x100063cd
call ebp
push edi
mov dword [edi + 0x2c], eax
call fcn.100060f0
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x100063e4
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x1000a2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000a35e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x1000a32f
cmp eax, 2
jne 0x1000a34a
test esi, esi
mov eax, dword [esp]
je 0x1000a358
test eax, eax
je 0x1000a353
test al, 1
jne 0x1000a34a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x1000a358
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x1000a3d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x100c60c8]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0x114
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000a42f
cmp dword [esp + 4], 6
jb 0x1000a42f
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1009176c
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.1009176c
add esp, 0x118
ret
Function at 0x1000c030
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x1009e14d
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x100c60c8]
xor eax, esp
mov dword [esp + 0x2d8], eax
push ebx
push esi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x2e8]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x2f0], ebx
mov dword [esp + 0xc], ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov dword [esp + 0x10], edi
mov word [edi + 4], bx
mov dword [esp + 0x2f0], ebx
lea esi, [esp + 0x14]
mov dword [esp + 0xc], 1
call fcn.10069d80
mov dword [esp + 0x2f0], 1
push 0x2b0
lea eax, [esp + 0x38]
push ebx
push eax
mov dword [esp + 0x3c], ebx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [esp + 0x2c], 8
jae 0x1000c0d1
lea eax, [esp + 0x18]
push 0x410
push 0x2b4
lea ecx, [esp + 0x38]
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x244]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1000c0f2
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x248]
push edx
mov esi, edi
call fcn.10011cd0
mov byte [esp + 0x2f0], bl
cmp dword [esp + 0x2c], 8
jb 0x1000c12c
mov eax, dword [esp + 0x18]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
mov eax, edi
mov ecx, dword [esp + 0x2e8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.1009176c
add esp, 0x2e8
ret
Function at 0x1000c170
Capabilities:
Access peb ldr_data
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x1009e0e3
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x100c60c8]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
push esi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x2e0]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x2e8], ebx
lea ecx, [esp + 0x2f0]
lea esi, [esp + 0xc]
call fcn.10069d80
mov byte [esp + 0x2e8], 1
push 0x2b0
lea eax, [esp + 0x30]
push ebx
push eax
mov dword [esp + 0x34], ebx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x24], 8
jae 0x1000c1f0
lea eax, [esp + 0x10]
push 0x110
push 0x2b4
lea ecx, [esp + 0x30]
push ecx
push 0x80
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x1000c253
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov esi, eax
je 0x1000c253
mov edx, dword [edi + 4]
push ebx
push eax
push 0x170
push 0x85c
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x1b0]
cmp eax, ebx
je 0x1000c24d
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [edi + 0x1b0], ebx
mov dword [edi + 0x1b0], esi
mov byte [esp + 0x2e8], bl
cmp dword [esp + 0x24], 8
jb 0x1000c26e
mov eax, dword [esp + 0x10]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esi, 7
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], bx
mov dword [esp + 0x2e8], 0xffffffff
cmp dword [esp + 0x308], 8
jb 0x1000c2a5
mov ecx, dword [esp + 0x2f4]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x308], esi
mov dword [esp + 0x304], ebx
mov word [esp + 0x2f4], bx
mov ecx, dword [esp + 0x2e0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x2d0]
xor ecx, esp
call fcn.1009176c
add esp, 0x2e0
ret 0x1c
Function at 0x1000fd00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10099bce
mov eax, dword fs:[0]
push eax
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, 7
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ecx
mov word [eax + 4], cx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], ecx
mov word [eax + 0x20], cx
mov byte [esp + 0xc], 1
mov dword [eax + 0x50], edx
mov dword [eax + 0x4c], ecx
mov word [eax + 0x3c], cx
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x10011f20
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esi + 0x54]
sub esp, 0xc
mov ecx, eax
push ebx
and ecx, 0xc
cmp cl, 0xc
push edi
mov bl, 1
jne 0x10011f79
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [esp + 0xc], eax
call edi
mov edx, dword [esi + 4]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xfffffffe
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 8]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
shr eax, 2
test al, 1
je 0x10011fb2
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esi + 4]
push ecx
movzx edx, di
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
mov eax, dword [esi + 0x28]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x10011fe5
mov ecx, dword [esi + 4]
or byte [esi + 0x58], 2
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x10013650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10099a7d
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor edx, edx
mov dword [esi], 1
mov dword [esi + 4], edx
mov byte [esi + 8], dl
mov byte [esi + 9], dl
mov dword [esp + 0x10], edx
lea eax, [esi + 0xc]
push eax
call fcn.1006bbc0
mov byte [esp + 0x10], 1
lea ecx, [esi + 0x30]
push ecx
call fcn.1006bbc0
mov byte [esp + 0x10], 2
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], edx
mov byte [esp + 0x10], 3
mov al, byte [esp + 0x1c]
mov byte [esi + 0x60], al
mov dword [esi + 0x64], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 0x68], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x10013860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009dfd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
call fcn.1007b220
mov dword [esp + 0x38], ebx
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.100076e0
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x100138c3
mov eax, dword [esp + 0x14]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [edi + 0x14]
cmp eax, 0x100
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
jae 0x10013931
cmp dword [esi], ebx
jne 0x10013931
cmp eax, ebx
jne 0x100138ea
xor eax, eax
jmp 0x100138f8
cmp dword [edi + 0x18], 8
jb 0x100138f5
mov eax, dword [edi + 4]
jmp 0x100138f8
lea eax, [edi + 4]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete cl
push 0xffffffffffffffff
mov byte [esi + 4], cl
push ebx
lea ecx, [esi + 8]
mov eax, edi
call fcn.100076e0
cmp dword [esi], ebx
setne al
cmp al, bl
je 0x10013931
cmp byte [esi + 4], bl
je 0x10013958
mov eax, dword [esp + 0xc]
add eax, 1
cmp eax, 0x20
mov dword [esp + 0xc], eax
jb 0x10013890
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015b90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1009df46
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
xor ebx, ebx
mov dword [edi], ebx
mov dword [esp + 0x54], ebx
mov dword [edi + 4], ebx
mov byte [esp + 0x54], 1
lea ebp, [edi + 0xc]
push ebp
call fcn.1006bbc0
mov byte [esp + 0x54], 2
lea eax, [edi + 0x30]
push eax
call fcn.1006bbc0
mov byte [esp + 0x54], 3
push 1
lea eax, [edi + 0x54]
push eax
call fcn.10013650
mov byte [esp + 0x54], 4
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
push eax
mov dword [edi + 0xc0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [esp + 0x54], 5
mov dword [edi + 0xc8], ebx
mov dword [edi + 0xcc], ebx
mov dword [edi + 0xd0], ebx
mov byte [esp + 0x54], 6
push ebx
push 0x100aab60
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
call fcn.10011cd0
mov byte [esp + 0x54], 7
cmp dword [ebp], ebx
jne 0x10015c9b
cmp dword [esp + 0x28], ebx
jne 0x10015c5e
xor eax, eax
jmp 0x10015c6d
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x10015c6d
lea eax, [esp + 0x18]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete cl
push 0xffffffffffffffff
mov byte [ebp + 4], cl
push ebx
lea ecx, [ebp + 8]
lea eax, [esp + 0x1c]
call fcn.100076e0
mov byte [esp + 0x54], 6
cmp dword [esp + 0x2c], 8
jb 0x10015cb4
mov edx, dword [esp + 0x18]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebx
mov ebp, 7
push 0x100aab60
lea esi, [esp + 0x38]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
call fcn.10011cd0
mov byte [esp + 0x54], 8
cmp dword [edi + 0x30], ebx
jne 0x10015d33
cmp dword [esp + 0x44], ebx
jne 0x10015cf6
xor eax, eax
jmp 0x10015d05
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x10015d05
lea eax, [esp + 0x34]
push eax
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
push 0xffffffffffffffff
mov byte [edi + 0x34], al
push ebx
lea ecx, [edi + 0x38]
lea eax, [esp + 0x38]
call fcn.100076e0
mov byte [esp + 0x54], 6
cmp dword [esp + 0x48], 8
jb 0x10015d4c
mov ecx, dword [esp + 0x34]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
mov dword [esp + 0x54], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 4
Function at 0x10016130
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009dec0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esp, [esp]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
mov edi, dword [ebp + 8]
lea eax, [esp + 0x1c]
push eax
push ebx
push 0xffffffffffffffff
lea eax, [edi + 0x54]
lea esi, [edi + 0xc]
push eax
xor edx, edx
mov ecx, esi
call fcn.100143a0
mov esi, dword [esi]
cmp esi, ebx
je 0x100161a3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x10016299
lea eax, [edi + 0xc0]
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x100161be
mov eax, dword [eax]
cmp eax, ebx
je 0x100161be
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x38], 1
xor edi, edi
mov dword [esp + 0x14], ebx
lea esp, [esp]
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x1001628f
mov ebx, dword [esp + 0x24]
mov ecx, ebx
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1001621d
mov ebx, dword [esp + 0x14]
lea ecx, [ebx + esi]
mov esi, dword [ebp + 8]
push ecx
add esi, 0xc4
call fcn.10014f40
add ebx, 0x14
add edi, 1
mov dword [esp + 0x14], ebx
xor ebx, ebx
jmp 0x100161d0
sub ebx, esi
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1001628d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
test eax, eax
je 0x10016243
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor ebx, ebx
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x10016263
mov eax, dword [eax]
cmp eax, ebx
je 0x1001625f
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x1001627c
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
jmp 0x10016160
xor ebx, ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10016245
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x100162b2
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10017140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x10017153
push 0x80004005
call fcn.1000a200
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10017160
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x100171a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x1009831b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x100c60c8]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100c60c8]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x244]
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x23c], esi
mov eax, dword [ebp]
lea ecx, [esp + 0x1c]
push ecx
push 0x2001f
push esi
push ebx
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100172d2
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x1001722e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
cmp eax, esi
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x14], ecx
jne 0x100172d2
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x24]
push edx
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x40]
push edx
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
jne 0x100172b2
jmp 0x10017270
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.100171a0
mov ebx, eax
cmp ebx, esi
jne 0x1001731c
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
je 0x10017270
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x100172c5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov edx, dword [ebp]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov dword [esp + 0x23c], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x100172f0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, edi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1009176c
add esp, 0x22c
ret 4
mov dword [esp + 0x23c], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x1001733a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, ebx
jmp 0x100172f2