joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, edx
mov edx, dword [esp + 0x3c]
mov dword [esp], ecx
lea ecx, [esp + 0x1c]
push 0xb
call fcn.10051a40
add esp, 4
mov dword [esp + 4], 0x800
mov dword [esp + 0xc], 0
call sub.KERNEL32.dll_GetProcessHeap
push 0x800
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10051e61
mov esi, dword [ebx]
mov ecx, dword [esp + 0x1c]
mov edi, eax
lea ebp, [esp + 0xc]
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x800
mov dword [esp + 0x18], 0
mov dword [esp + 8], ecx
lea eax, [esp + 4]
push eax
push edi
push ebp
push 0
push dword [esp + 0x18]
push esi
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x10051dbb
mov edx, dword [esp + 4]
mov ecx, ebx
call fcn.10116c80
mov edi, dword [esp + 0x10]
jmp 0x10051d90
test eax, eax
jne 0x10051df0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
cmp eax, 0xb
jbe 0x10051e1a
mov eax, dword [esp]
mov dword [eax + 8], 0xde
mov dword [eax + 4], 0
mov dword [eax], 1
cmp dword [esp + 0x14], 0
jne 0x10051e0a
jmp 0x10051e38
mov ecx, dword [esp]
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 1
cmp dword [esp + 0x14], 0
je 0x10051e38
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
jmp 0x10051e38
mov ecx, dword [esp + 0x18]
mov edx, dword [esp]
movsd xmm0, qword [esp + 0x10]
mov dword [edx + 0xc], ecx
movsd qword [edx + 4], xmm0
mov byte [edx + 0x10], al
mov dword [edx], 0
mov eax, closesocket
or eax, dword [esp + 0x20]
cmp eax, 0x80000000
je 0x10051e59
call sub.KERNEL32.dll_GetProcessHeap
push dword [esp + 8]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x800
mov edx, 1
call fcn.10006540
ud2
Function at 0x10052fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 1
mov ebp, edx
jne 0x10052fee
mov esi, dword [ebp + 0x30]
cmp dword [ebp + 0x24], 0xffffffff
mov edi, dword [ebp + 0x34]
mov ebx, dword [ebp + 0x38]
mov eax, dword [ebp + 0x3c]
lea edx, [ebp + 8]
je 0x10053136
push 0
jmp 0x10053138
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 0x30]
mov esi, dword [ebp + 0x34]
mov bl, byte [ebp + 0xc]
mov edi, dword [ebp + 4]
mov dword [esp + 0x14], ebp
lea edx, [ecx + esi]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 4], edx
jmp 0x10053029
mov ebp, dword [esp + 0x14]
add edi, ecx
mov dword [ebp + 4], edi
mov eax, ebx
xor bl, 1
test edi, edi
mov byte [ebp + 0xc], bl
je 0x1005304d
cmp esi, edi
je 0x1005304d
jbe 0x10053170
mov ecx, dword [esp + 8]
cmp byte [ecx + edi], 0xbf
jle 0x10053170
cmp esi, edi
je 0x10053146
mov ecx, dword [esp + 8]
mov byte [esp + 3], al
mov eax, esi
lea esi, [ecx + edi]
mov bh, byte [esi]
movzx ebp, bh
test bh, bh
jns 0x100530f0
mov edx, dword [esp + 4]
lea ecx, [esi + 1]
cmp ecx, edx
je 0x10053086
movzx ecx, byte [esi + 1]
add esi, 2
and ecx, 0x3f
jmp 0x1005308a
xor ecx, ecx
mov esi, edx
and ebp, 0x1f
cmp bh, 0xdf
jbe 0x100530a3
mov edx, dword [esp + 4]
cmp esi, edx
je 0x100530aa
movzx eax, byte [esi]
inc esi
and eax, 0x3f
jmp 0x100530ae
shl ebp, 6
or ebp, ecx
jmp 0x100530f0
xor eax, eax
mov esi, edx
shl ecx, 6
or ecx, eax
cmp bh, 0xf0
jb 0x100530ca
cmp esi, dword [esp + 4]
mov eax, dword [esp + 0x10]
je 0x100530d5
movzx esi, byte [esi]
and esi, 0x3f
jmp 0x100530d7
mov eax, dword [esp + 0x10]
shl ebp, 0xc
or ebp, ecx
jmp 0x100530f0
xor esi, esi
and ebp, 7
shl ecx, 6
shl ebp, 0x12
or ecx, ebp
or ecx, esi
mov ebp, ecx
nop word cs:[eax + eax]
cmp byte [esp + 3], 0
jne 0x10053156
cmp ebp, 0x110000
je 0x1005314a
mov esi, eax
mov ecx, 1
cmp ebp, 0x80
jb 0x10053020
mov ecx, 2
cmp ebp, 0x800
jb 0x10053020
cmp ebp, 0x10000
mov ecx, 4
sbb ecx, 0
jmp 0x10053020
push 1
push eax
push ebx
push edi
push esi
call fcn.100532f0
add esp, 0x2c
jmp 0x1005316b
test al, al
jne 0x10053158
mov eax, dword [esp + 0xc]
mov dword [eax], 0
jmp 0x10053168
mov esi, edi
mov eax, dword [esp + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax], 1
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 8]
mov edx, esi
push 0x1044b080
push esi
push edi
call fcn.10008e00
add esp, 0xc
ud2
Function at 0x1005ed30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x1005eda8
cmp eax, 1
jne 0x1005ef12
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
or ecx, dword [esi + 0xc]
je 0x1005edd8
lea ecx, [esi + 0x18]
or eax, edx
je 0x1005ee9e
mov eax, dword [ecx]
xor eax, 4
or eax, dword [ecx + 4]
je 0x1005ef12
call fcn.1005f7d0
lea ecx, [esi + 0xf0]
call fcn.1005f910
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1005ef12
lock dec dword [eax]
jne 0x1005ef12
add esi, 0x12c
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10116bf0
mov eax, dword [esi + 0x128]
xor eax, 3
or eax, dword [esi + 0x12c]
je 0x1005ef12
lea edi, [esi + 0x128]
add esi, 8
mov ecx, esi
call fcn.1005ef20
mov ecx, edi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1005efd0
mov ecx, eax
xor ecx, 2
or ecx, edx
je 0x1005ef12
lea edi, [esi + 0x18]
or eax, edx
je 0x1005eea7
cmp byte [edi], 0
je 0x1005eec6
cmp byte [esi + 0x60], 0xa
lea ebx, [esi + 0x20]
jb 0x1005ee19
cmp dword [esi + 0x68], 0
je 0x1005ee19
mov ebp, dword [ebx + 0x44]
call sub.KERNEL32.dll_GetProcessHeap
push ebp
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp byte [ebx + 0x54], 2
jb 0x1005ee45
mov eax, dword [esi + 0x78]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebp, dword [esi + 0x78]
call sub.KERNEL32.dll_GetProcessHeap
push ebp
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x88]
lea ecx, [ebx + 0x64]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x98]
lea ecx, [ebx + 0x74]
push dword [esi + 0x90]
push dword [esi + 0x8c]
push ecx
call dword [eax + 4]
add esp, 0xc
push ebx
call fcn.1004fb10
add esp, 4
lea ecx, [esi + 0xa0]
call fcn.10056e00
lea ecx, [esi + 0xa8]
call fcn.100544e0
mov esi, dword [esi + 0x1c]
jmp 0x1005eec9
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1005f7d0
push edi
call fcn.1004fb10
add esp, 4
lea ecx, [esi + 0x58]
call fcn.10056e00
add esi, 0x60
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1005f090
mov esi, dword [edi + 4]
mov eax, dword [esi]
test eax, eax
je 0x1005ef01
mov ecx, dword [esi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [esi + 4]
cmp dword [eax + 4], 0
je 0x1005ef01
mov esi, dword [esi]
cmp dword [eax + 8], 9
jae 0x1005eef1
call sub.KERNEL32.dll_GetProcessHeap
push esi
jmp 0x1005eef9
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [edi + 4]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005ef20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x1005ef50
cmp eax, 1
jne 0x1005efbf
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x1005ef91
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
je 0x1005ef9d
lea ecx, [esi + 0x18]
cmp dword [ecx], 0
je 0x1005efb9
add esi, 0x20
jmp 0x1005ef94
mov al, byte [esi + 0x28]
mov ecx, eax
and cl, 7
cmp cl, 3
je 0x1005ef73
cmp al, 4
je 0x1005efbf
lea ecx, [esi + 8]
lea edi, [esi + 0x28]
call fcn.100650d0
mov ecx, edi
call fcn.10065840
mov eax, dword [esi + 0x118]
test eax, eax
je 0x1005efbf
lock dec dword [eax]
jne 0x1005efbf
add esi, 0x118
mov ecx, esi
pop esi
pop edi
jmp fcn.10116bf0
add esi, 0x10
mov ecx, esi
pop esi
pop edi
jmp 0x100659f0
mov eax, dword [esi + 0x18]
lea ecx, [esi + 0x20]
or eax, dword [esi + 0x1c]
jne 0x1005ef96
mov eax, dword [ecx]
xor eax, 3
or eax, dword [ecx + 4]
je 0x1005efbf
pop esi
pop edi
jmp fcn.10065840
cmp byte [ecx + 4], 3
jne 0x1005efc2
pop esi
pop edi
ret
add ecx, 4
pop esi
pop edi
jmp fcn.100650d0
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 2
je 0x10065b01
mov esi, ecx
test eax, eax
jne 0x10065a11
add esi, 4
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.1005f910
cmp byte [esi + 8], 0
je 0x10065ab5
cmp byte [esi + 0x50], 0xa
jb 0x10065a38
cmp dword [esi + 0x58], 0
je 0x10065a38
mov edi, dword [esi + 0x54]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp byte [esi + 0x64], 2
lea edi, [esi + 0x10]
jb 0x10065a67
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x68]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x78]
lea ecx, [esi + 0x74]
push dword [esi + 0x70]
push dword [esi + 0x6c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x88]
lea ecx, [esi + 0x84]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
push edi
call fcn.1004fb10
add esp, 4
lea ecx, [esi + 0x90]
call fcn.10056e00
lea ecx, [esi + 0x98]
call fcn.100544e0
mov edi, dword [esi + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x10065af0
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x10065af0
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x10065ae0
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10065ae8
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi + 0xc]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
pop ebx
ret
Function at 0x10064830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [ecx]
lea eax, [esi + 8]
or ecx, dword [esi + 4]
je 0x10064869
mov edi, dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x10064897
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x10064897
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x10064887
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x1006488f
push eax
call fcn.1004fb10
add esp, 4
lea ecx, [esi + 0x48]
call fcn.10056e00
add esi, 0x50
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.1005f090
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x10]
xor eax, 3
or eax, dword [esi + 0x14]
jne 0x100648b7
pop esi
pop edi
pop ebx
ret
cmp byte [esi + 0x50], 0xa
lea edi, [esi + 0x10]
jb 0x100648d7
cmp dword [esi + 0x58], 0
je 0x100648d7
mov ebx, dword [edi + 0x44]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp byte [edi + 0x54], 2
jb 0x10064903
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x68]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x78]
lea ecx, [edi + 0x64]
push dword [esi + 0x70]
push dword [esi + 0x6c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x88]
lea ecx, [edi + 0x74]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
push edi
call fcn.1004fb10
add esp, 4
lea ecx, [esi + 0x90]
call fcn.10056e00
add esi, 0x98
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.100544e0
Function at 0x10065840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x100658ae
cmp eax, 1
jne 0x100659e1
cmp dword [esi + 8], 0
je 0x100659aa
mov eax, dword [esi + 0xc]
cmp eax, 2
je 0x100659e1
add esi, 0x10
test eax, eax
je 0x100659b7
mov edi, dword [esi]
mov eax, dword [edi]
test eax, eax
je 0x100659d1
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x100659d1
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x100659c1
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x100659c9
mov eax, dword [esi + 0x58]
lea edi, [esi + 8]
test eax, eax
je 0x100658c5
lock dec dword [eax]
jne 0x100658c5
lea ecx, [esi + 0x58]
call fcn.10061ab0
cmp byte [edi + 0x54], 2
jb 0x100658f1
mov eax, dword [esi + 0x60]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x60]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x70]
lea ecx, [edi + 0x64]
push dword [esi + 0x68]
push dword [esi + 0x64]
push ecx
call dword [eax + 4]
add esp, 0xc
mov ecx, edi
call fcn.10065b10
cmp byte [esi + 0x74], 2
jb 0x10065937
mov eax, dword [esi + 0x78]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x78]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x88]
lea ecx, [edi + 0x7c]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x98]
lea ecx, [edi + 0x8c]
push dword [esi + 0x90]
push dword [esi + 0x8c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x1006598b
lock dec dword [eax]
jne 0x1006598b
add esi, 0xa0
mov ecx, esi
call fcn.10116bf0
mov eax, dword [edi + 0xc4]
test eax, eax
je 0x100659e1
lock dec dword [eax]
jne 0x100659e1
add edi, 0xc4
mov ecx, edi
pop esi
pop edi
pop ebx
jmp fcn.10116bf0
add esi, 0x10
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.10065b70
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.1005f910
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
pop ebx
ret
Function at 0x10065b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x10065bdd
cmp eax, 1
jne 0x10065d08
cmp dword [esi + 4], 0
je 0x10065c5c
mov eax, dword [esi + 8]
cmp eax, 2
je 0x10065d08
add esi, 0xc
test eax, eax
je 0x10065cca
mov edi, dword [esi]
mov eax, dword [edi]
test eax, eax
je 0x10065ce3
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x10065ce3
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x10065cd3
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10065cdb
cmp dword [esi + 0xb0], 2
je 0x10065d08
lea ecx, [esi + 8]
cmp dword [ecx], 3
je 0x10065bf7
call fcn.10065d10
lea ecx, [esi + 0x88]
call fcn.10065dc0
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x10065c1c
lock dec dword [eax]
jne 0x10065c1c
lea ecx, [esi + 0xa4]
call fcn.10061ab0
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x10065c36
lock dec dword [eax]
jne 0x10065c36
lea ecx, [esi + 0xa8]
call fcn.10116bf0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x10065d08
lock dec dword [eax]
jne 0x10065d08
add esi, 0xd4
mov ecx, esi
pop esi
pop edi
jmp fcn.10116bf0
mov edi, dword [esi + 8]
cmp dword [edi], 3
je 0x10065cf7
mov ecx, edi
call fcn.10065f80
mov eax, dword [edi + 0x1c0]
test eax, eax
je 0x10065c89
lock dec dword [eax]
jne 0x10065c89
lea ecx, [edi + 0x1c0]
call fcn.10061ab0
lea ecx, [edi + 0x1c4]
call fcn.10065dc0
mov eax, dword [edi + 0x1e0]
test eax, eax
je 0x10065cf7
mov ecx, dword [edi + 0x1e4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 0x1e4]
cmp dword [eax + 4], 0
je 0x10065cf7
mov edi, dword [edi + 0x1e0]
cmp dword [eax + 8], 9
jae 0x10065ce7
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10065cef
mov ecx, esi
pop esi
pop edi
jmp fcn.1005f910
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi]
jmp 0x10065cfa
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
ret
Function at 0x1006f000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
cmp eax, 1
je 0x1006f029
test eax, eax
jne 0x1006f0cc
cmp dword [esi + 0x10], 3
je 0x1006f0cc
add esi, 4
mov ecx, esi
pop esi
pop edi
jmp fcn.1005f910
cmp dword [esi + 4], 0
je 0x1006f0cc
mov edi, dword [esi + 8]
test edi, edi
je 0x1006f0cc
mov eax, dword [0x104dec60]
test eax, eax
jne 0x1006f065
mov ecx, 0x10421629
mov edx, 0x17
call fcn.100f2ce0
test eax, eax
mov eax, 0x100f30b0
cmovne eax, edx
mov dword [0x104dec60], eax
cmp eax, 0x100f30b0
jne 0x1006f086
mov edi, dword [edi]
test edi, edi
je 0x1006f086
push edi
call sub.KERNEL32.dll_DeleteCriticalSection
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x14]
push dword [esi + 0x10]
call dword [eax]
add esp, 4
mov eax, dword [esi + 0x14]
cmp dword [eax + 4], 0
je 0x1006f0cc
mov esi, dword [esi + 0x10]
cmp dword [eax + 8], 9
jae 0x1006f0bc
call sub.KERNEL32.dll_GetProcessHeap
push esi
jmp 0x1006f0c4
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
ret
Function at 0x10070c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
cmp eax, 1
je 0x10070c77
test eax, eax
jne 0x10070d1a
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add eax, 0xfffffffd
adc ecx, 0xffffffff
cmp eax, 2
sbb ecx, 0
jb 0x10070d1a
add esi, 8
mov ecx, esi
pop esi
pop edi
jmp fcn.10065840
cmp dword [esi + 4], 0
je 0x10070d1a
mov edi, dword [esi + 8]
test edi, edi
je 0x10070d1a
mov eax, dword [0x104dec60]
test eax, eax
jne 0x10070cb3
mov ecx, 0x10421629
mov edx, 0x17
call fcn.100f2ce0
test eax, eax
mov eax, 0x100f30b0
cmovne eax, edx
mov dword [0x104dec60], eax
cmp eax, 0x100f30b0
jne 0x10070cd4
mov edi, dword [edi]
test edi, edi
je 0x10070cd4
push edi
call sub.KERNEL32.dll_DeleteCriticalSection
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x14]
push dword [esi + 0x10]
call dword [eax]
add esp, 4
mov eax, dword [esi + 0x14]
cmp dword [eax + 4], 0
je 0x10070d1a
mov esi, dword [esi + 0x10]
cmp dword [eax + 8], 9
jae 0x10070d0a
call sub.KERNEL32.dll_GetProcessHeap
push esi
jmp 0x10070d12
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
ret
Function at 0x100ccdd0
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x28]
cmp edx, ecx
jb 0x100ccffb
mov eax, dword [edi + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 4
lea ecx, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, esp
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], eax
lea eax, [edi + 0x4c]
push 0
push 0
push ecx
push eax
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x100ccf40
cmp eax, 0x80090318
je 0x100ccfd1
test eax, eax
jne 0x100ccfc2
mov ecx, dword [esp + 0x14]
mov ebp, dword [edi + 0x20]
mov ebx, dword [esp + 0xc]
mov edx, dword [edi + 0x28]
mov dword [edi + 0x10], 0
sub ecx, ebp
mov eax, ecx
add eax, ebx
jb 0x100cd02a
cmp edx, eax
jb 0x100cd03b
lea eax, [edi + 8]
add ebp, ecx
mov edx, ebx
mov ecx, eax
call fcn.10116c80
mov eax, dword [edi + 8]
add eax, dword [edi + 0x10]
push ebx
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi + 0x10], ebx
mov dword [edi + 4], 0
mov dword [edi], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0x18]
jne 0x100ccef1
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cd00a
test ebx, ebx
je 0x100ccf2a
mov edx, dword [edi + 0x28]
mov ebp, edx
sub ebp, ecx
jb 0x100cd023
mov dword [edi + 0x28], 0
je 0x100ccf2a
test ecx, ecx
je 0x100ccf27
mov eax, dword [edi + 0x20]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x28], ebp
xor eax, eax
test ebx, ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], 0
sete al
jmp 0x100ccfe1
cmp eax, 0x90317
je 0x100ccfee
cmp eax, 0x90321
jne 0x100ccfc2
mov dword [edi + 0x9c], 0x10000
mov byte [edi + 0xa0], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0x18]
jne 0x100ccf73
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cd00a
test ebx, ebx
je 0x100ccfac
mov edx, dword [edi + 0x28]
mov ebp, edx
sub ebp, ecx
jb 0x100cd023
mov dword [edi + 0x28], 0
je 0x100ccfac
test ecx, ecx
je 0x100ccfa9
mov eax, dword [edi + 0x20]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x28], ebp
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], 0
mov dword [edi + 0xb4], 0
jmp 0x100ccfe7
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov byte [esi], 1
jmp 0x100ccff3
cmp dword [esp + 0x10], 4
mov eax, 1
jne 0x100ccfe1
mov eax, dword [esp + 0xc]
mov dword [edi + 0xb4], eax
mov word [esi], 0
jmp 0x100ccff3
mov word [esi], 0x100
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1044ae54
call fcn.100088f0
add esp, 4
ud2
mov ecx, str.assertion_failed:_size___nread
mov edx, 0x1f
push 0x1044ae94
call fcn.1004d560
add esp, 4
ud2
push 0x1044aea4
jmp 0x100cd000
mov edx, eax
push 0x1044ae64
call fcn.10009cc0
add esp, 4
ud2
mov ecx, eax
push 0x1044ae64
jmp 0x100cd000