joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037ea2
Capabilities:
Delete directory

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c582a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1012f058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esi], 0x100e3ec0
cmp dword [esi + 0x24], edi
je 0x10037f67
lea eax, [esi + 0x1e4]
mov dword [ebp - 0x18], edi
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
test eax, eax
je 0x10037f0d
lea ecx, [ebp - 0x18]
call fcn.100020c8
call dword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [ebp - 0x14], eax
je 0x10037f2a
mov eax, dword [0x1012f1b0]
mov ecx, 0x1012f1b0
push 0x326a6f78
call dword [eax + 4]
cmp byte [esi + 0x20c], 0
je 0x10037f45
mov eax, dword [0x1012f1b0]
mov ecx, 0x1012f1b0
push 0x326a6f79
call dword [eax + 4]
cmp dword [esi + 0x208], edi
je 0x10037f5f
mov eax, dword [0x1012f1b0]
mov ecx, 0x1012f1b0
push 0x326a6f7a
call dword [eax + 4]
lea ecx, [ebp - 0x1c]
call fcn.10001ee8
mov eax, dword [esi + 0x218]
cmp eax, 0xffffffff
je 0x10037f80
or dword [esi + 0x218], 0xffffffff
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esi + 0x21c], edi
je 0x10037fb6
lea edi, [esi + 0x220]
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x10037fab
mov eax, dword [0x1012f1b0]
mov ecx, 0x1012f1b0
push 0x326a7030
call dword [eax + 4]
xor eax, eax
mov word [edi], ax
and dword [esi + 0x21c], eax
mov edi, dword [esi + 0x1e0]
test edi, edi
je 0x10037fd9
push ecx
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1004054a
and dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.10001ee8
mov edi, dword [esi + 8]
and dword [esi + 8], 0
test edi, edi
je 0x10037ff2
mov ecx, edi
call fcn.1004054a
push edi
call fcn.1004054a
pop ecx
mov eax, dword [esi + 0x218]
cmp eax, 0xffffffff
je 0x1003800b
or dword [esi + 0x218], 0xffffffff
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [esi + 0x1e4]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
mov ecx, dword [esi + 0x1e0]
test ecx, ecx
je 0x1003802e
and dword [esi + 0x1e0], 0
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x2c]
call fcn.1004054a
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1003804b
and dword [esi + 0xc], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esi, dword [esi + 8]
test esi, esi
je 0x10038060
mov ecx, esi
call fcn.1004054a
push esi
call fcn.1004054a
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1004054a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10040559
pop dword [ebp - 0x38]
mov eax, 0x10040559
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd0f65679
add dword [ebp - 0x48], 0x7d5beed2
mov dword [ebp - 0x44], 0x53bf1e30
add dword [ebp - 0x44], 0xde742e15
mov dword [ebp - 0x40], 0x3310bdf1
sub dword [ebp - 0x40], 0xe6c479c3
mov dword [ebp - 0x3c], 0xa4ea7e61
add dword [ebp - 0x3c], 0x5b15819f
lea eax, [ebp - 0x48]
push eax
mov eax, 0x6c6ee682
sub eax, 0x5c625536
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x512df02f
sub dword [ebp - 0x48], 0xdcbb86d9
mov dword [ebp - 0x44], 0x8a351e86
add dword [ebp - 0x44], 0xb73742ef
mov dword [ebp - 0x40], 0x1c49f4b4
sub dword [ebp - 0x40], 0xb8da8848
mov dword [ebp - 0x3c], 0x2957635a
sub dword [ebp - 0x3c], 0x2957635a
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x76a72df1
sub eax, 0x669a9dc1
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x5fe31
push 0
call eax
mov ecx, 0x3b284712
add ecx, 0xc4d80658
mov edi, eax
mov edx, 0x10145600
add edx, dword [ebp - 0x38]
mov esi, 0xe91afb9
add esi, 0xdbce7f27
add dword [ebp - 0x20], edx
mov ebx, dword [edx]
sub dword [ebp - 0x28], ecx
add ebx, esi
sub dword [ebp - 0x1c], ecx
mov dword [edi], ebx
xor dword [ebp - 0x1c], edx
add edi, 0x20f72dbc
add edi, 0xdf08d248
add edx, 0x9fea3613
sub edx, 0x9fea360f
loop 0x10040670
add eax, 0x64b3c70d
add eax, 0x9b4d616e
mov ebx, eax
add eax, 0x9a2ddfc8
sub eax, 0x9a2ddfc3
mov ecx, 0x1e2d8963
add ecx, 0xf1d2769d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1008652d
Capabilities:
Get common file path

Disassembly:
xor eax, eax
mov word [ecx], ax
cmp dword [0x10137368], eax
je 0x10086592
push ecx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
setne al
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
xor ecx, ecx
push eax
push ecx
push ecx
push 0x100c96f8
mov dword [ebp - 4], ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test esi, esi
js 0x100865cb
push dword [ebp - 4]
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test esi, esi
mov ecx, dword [ebp - 4]
setns bl
test ecx, ecx
je 0x100865e0
and dword [ebp - 4], 0
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x10003870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100038c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100038c9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100038ba
cmp esi, edx
jae 0x100038c9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100038a8
cmp esi, edx
jae 0x100038c9
cmp word [esi], 0
je 0x100038c9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10003e30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x10003e47
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebp + 0x14], 0
je 0x10003f30
push edi
push 0x1418
call fcn.1002bba2
mov edi, eax
add esp, 4
test edi, edi
je 0x10003ec0
mov ecx, dword [ebp + 8]
push esi
push 0x1000
lea esi, [edi + 4]
mov dword [edi], ecx
push 0
push esi
mov dword [edi + 0x1414], 1
call fcn.10037300
push 0x800
push ebx
push esi
call fcn.100441f3
push 0x410
lea esi, [edi + 0x1004]
push 0
push esi
call fcn.10037300
mov eax, dword [ebp + 0x10]
add esp, 0x24
test eax, eax
je 0x10003ebd
push 0x208
push eax
push esi
call fcn.100441f3
add esp, 0xc
pop esi
jmp 0x10003ec2
xor edi, edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], vtable.CSimpleThread.0
push eax
push 0
push edi
push 0x10003f50
push 0
push 0
mov dword [ebp - 8], 0x10003f50
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.1004438a
add esp, 0x18
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], vtable.CSimpleThread.0
pop edi
test eax, eax
je 0x10003f24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
call fcn.10004110
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100040d0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x100040f5
test byte [ebp - 4], 7
je 0x100040f5
mov eax, 1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x10004110
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10081708]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100041c2
cmp word [esi], 0
je 0x100041c2
test eax, eax
je 0x1000416d
cmp word [eax], 0
je 0x1000416d
push 0
push 0
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x100041c2
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret 8
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10037300
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x100041c2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002bf51
mov esp, ebp
pop ebp
ret 8

Function at 0x10005110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d5ab
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x10081708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x220], esi
call fcn.10037300
lea eax, [ebp - 0x21c]
push 1
push eax
call fcn.10029010
add esp, 0x14
push dword [eax]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x10061598
push str.act_time
push str.three_end
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100051aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10003510
mov ecx, eax
test ecx, ecx
je 0x1000522a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x100051e0
movzx eax, ax
mov ecx, esi
push eax
call fcn.10005780
jmp 0x1000520e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100051f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003730
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100031a0
int3
Function at 0x10005240
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.1002bfd0
mov eax, dword [0x10081708]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.10037300
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x10005337
test edi, edi
je 0x10005337
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10005337
cmp eax, 0x3fff
ja 0x10005337
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10005337
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x10061744
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10005337
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.10037300
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push esi
lea eax, [esi - 1]
push eax
push edi
call fcn.10006040
add esp, 0x2c
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1002bf51
mov esp, ebp
pop ebp
ret
Function at 0x100059f0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10081708]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x10005b1e
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10005b1e
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10005a43
push esi
call edi
test eax, eax
jne 0x10005b1e
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10037300
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10037300
push esi
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.1004441d
add esp, 0x24
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x100617b0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
jne 0x10005ae8
push esi
push 0x100617b8
call fcn.100133d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret
call edi
test eax, eax
jne 0x10005b1e
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x20c]
push eax
push str.write__s_to_pending_delete.
call fcn.100133d0
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002bf51
mov esp, ebp
pop ebp
ret

Function at 0x10007f70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d500
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10081708]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0xd0]
or edi, 0xffffffff
sub edx, 0x10
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10007fb6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x88]
call fcn.100253b0
lea eax, [esi + 0x70]
mov dword [esi + 0x6c], vtable._BaseModule::CCriticalSection.0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esi + 0x64]
call fcn.1001a340
mov edx, dword [esi + 0x60]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10007ff2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x54]
call fcn.10007ea0
lea ecx, [esi + 0x48]
call fcn.10007ea0
lea ecx, [esi + 0x3c]
call fcn.10007ea0
lea ecx, [esi + 0x30]
call fcn.10007ea0
lea ecx, [esi + 0x24]
call fcn.10007ea0
lea ecx, [esi + 0x18]
call fcn.10007ea0
lea ecx, [esi + 0xc]
call fcn.10007ea0
mov ecx, esi
call fcn.10007ea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100085e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push str.__hwnd
push dword [ebp + 8]
call fcn.100375cd
mov esi, eax
add esp, 8
test esi, esi
je 0x10008659
push edi
push 0x10
add esi, 0xe
push 0
push esi
call fcn.10045feb
add esp, 0xc
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10008658
push ebx
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push 0x10062ac8
push esi
push 0
call ebx
cmp eax, 1
jne 0x10008657
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x10062ac8
push esi
push 0
call ebx
cmp eax, 1
je 0x10008630
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x10009040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1000907f
mov ebx, dword [ecx + edi*4]
test ebx, ebx
je 0x1000906f
mov ecx, ebx
call fcn.10015860
push 0x20
push ebx
call fcn.1002bbd2
add esp, 8
mov eax, dword [esi + 8]
inc edi
mov ecx, dword [esi + 4]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x10009056
mov dword [esi + 8], ecx
lea ecx, [esi + 0x14]
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
call fcn.10009480
lea ecx, [esi + 0x10]
call fcn.10009480
lea ecx, [esi + 0x18]
call fcn.10009480
lea ecx, [esi + 0x1c]
call fcn.10009480
lea ecx, [esi + 0x40]
call fcn.10009480
lea ecx, [esi + 0x4c]
mov dword [esi + 0x44], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x74], 0x65
mov dword [esi + 0x78], 0x65
call fcn.10009480
lea ecx, [esi + 0x3c]
call fcn.10009480
lea ecx, [esi + 0x38]
call fcn.10009480
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov ebx, dword [esi + 0x80]
mov edi, dword [esi + 0x7c]
cmp edi, ebx
je 0x10009139
mov eax, dword [edi]
or ecx, 0xffffffff
sub eax, 0x10
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1000912f
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
add edi, 4
cmp edi, ebx
jne 0x10009115
mov edi, dword [esi + 0x7c]
lea ecx, [esi + 0x50]
mov dword [esi + 0x80], edi
call fcn.10009480
lea ecx, [esi + 0x54]
call fcn.10009480
push 0x1006196a
lea ecx, [esi + 0x58]
call fcn.100112d0
pop edi
lea ecx, [esi + 0x70]
pop esi
pop ebx
jmp fcn.10009480

Function at 0x10009720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ecx + 8]
lea eax, [ebp - 8]
push esi
push 0
push dword [ecx + 0x34]
push eax
call fcn.1000a500
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push str.test_check_repop_timer_seconds
push dword [ebp - 8]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [ebp - 8]
or eax, 0xffffffff
mov esi, dword [ebp - 4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000978a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
imul eax, esi, 0x3e8
mov ecx, 0x36ee80
pop esi
test eax, eax
cmove eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x100097a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005db3d
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10081708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
call fcn.10003510
mov ecx, eax
test ecx, ecx
je 0x100098ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
mov dword [ebp - 0x220], 1
call fcn.1000a500
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.10037300
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push str.CloseTime
push dword [ebp - 0x21c]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100098ae
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009890
sub eax, edx
mov ecx, edi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10003730
mov esi, dword [ebp - 0x21c]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100098d0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.100031a0
int3

Function at 0x10009900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push dword [ecx + 0x34]
lea eax, [ebp - 8]
push eax
call fcn.1000a500
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push str.default_repop_go_on
push dword [ebp - 8]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 8]
or ecx, 0xffffffff
mov esi, dword [ebp - 4]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x10009967
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005dc01
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10081708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0
mov dword [ebp - 0x228], esi
push dword [ecx + 0x34]
push eax
call fcn.1000a500
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10037300
add esp, 0xc
mov dword [ebp - 0x224], 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push str.latest_click
push dword [ebp - 0x21c]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10009e55
call fcn.10003510
mov ecx, eax
test ecx, ecx
je 0x10009edb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x10009e02
movzx eax, ax
mov ecx, esi
push eax
call fcn.10005780
jmp 0x10009e2e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009e10
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003730
mov edi, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10009ebc
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x10009ebc
call fcn.10003510
mov ecx, eax
test ecx, ecx
je 0x10009ee5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x10061598
mov byte [ebp - 4], 2
mov ecx, esi
test eax, 0xffff0000
jne 0x10009e8b
movzx eax, ax
push eax
call fcn.10005780
jmp 0x10009e97
push 0
push 0x10061598
call fcn.10003730
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009ebc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002bf51
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100031a0
push 0x80004005
call fcn.100031a0
int3