joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100067c6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edi, 0x16cb3
add edi, 0x10a1a
pop edi
cmp dword [ebp - 0xcc8], 0
jne 0x10006792
mov dword [ebp - 0x2f4], 0
jmp 0x100069dd
mov ecx, dword [ebp - 0xcc8]
mov dword [ebp - 0x518], ecx
push edi
jmp 0x100067a7
sub edi, 0x8d68
and edi, 0x14e67
pop edi
push ecx
push eax
add esp, 4
call 0x100067c6
add byte [ecx + 0x37], al
inc esp
dec edi
dec ebp
dec edi
inc edx
add esp, 4
or ecx, 0x259b
pop ecx
lea edx, [ebp - 0x1740]
mov dword [ebp - 0xcc4], edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc0], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
push ecx
add esp, 4
sub esi, 0x13ea6
or esi, 0x17dda
sub esi, 0x60b2
call 0x10006820
add byte [0x3f454036], bh
cmp eax, 0x83454c49
les eax, [esi + ebx*2]
push edi
and edi, 0x3ca1
pop edi
mov ecx, dword [ebp - 0xcc0]
mov dx, word [ecx]
mov word [ebp - 0x1042], dx
mov eax, dword [ebp - 0xcc0]
add eax, 2
mov dword [ebp - 0xcc0], eax
mov cx, word [ebp - 0x1042]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc4]
mov ax, word [edx]
mov word [ebp - 0x1044], ax
mov ecx, dword [ebp - 0xcc4]
add ecx, 2
mov dword [ebp - 0xcc4], ecx
mov dx, word [ebp - 0x1044]
mov word [ebp - 0x38], dx
push edi
xor edi, 0x43f8
xor edi, 0x33d4
xor edi, 0x1192c
xor edi, 0x36a6
pop edi
push edx
push ecx
add esp, 4
add edx, 0x190b
and edx, 0xc631
and edx, 0x14390
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x100068d2
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x1000692c
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x100067fa
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x100067fa
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x10006916
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x10006920
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x10006975
push ebx
sub ebx, 0xd6d1
pop ebx
push edx
sub edx, 0x148cd
pop edx
push esi
add esi, 0xbc7a
pop esi
push edx
push edi
add esp, 4
jmp 0x1000695a
add edx, 0xae19
sub edx, 0x378d
pop edx
mov ecx, dword [ebp - 0x518]
mov dword [ebp - 0x2f4], ecx
jmp 0x100069dd
push edx
push esi
add esp, 4
add edx, 0x15a3f
pop edx
push eax
sub eax, 0x382c
pop eax
push edx
jmp 0x10006992
pop edx
push eax
sub eax, 0xbf2f
sub eax, 0xfde1
or eax, 0x58e7
pop eax
mov edx, dword [ebp - 0x518]
mov eax, dword [edx]
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [ebp - 0xcc8]
je 0x100069d3
mov edx, dword [ebp - 0x518]
cmp dword [edx + 0x30], 0
jne 0x1000679e
mov dword [ebp - 0x2f4], 0
Function at 0x10006820
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edi, 0x16cb3
add edi, 0x10a1a
pop edi
cmp dword [ebp - 0xcc8], 0
jne 0x10006792
mov dword [ebp - 0x2f4], 0
jmp 0x100069dd
mov ecx, dword [ebp - 0xcc8]
mov dword [ebp - 0x518], ecx
push edi
jmp 0x100067a7
sub edi, 0x8d68
and edi, 0x14e67
pop edi
push ecx
push eax
add esp, 4
call 0x100067c6
add byte [ecx + 0x37], al
inc esp
dec edi
dec ebp
dec edi
inc edx
add esp, 4
or ecx, 0x259b
pop ecx
lea edx, [ebp - 0x1740]
mov dword [ebp - 0xcc4], edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc0], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
push ecx
add esp, 4
sub esi, 0x13ea6
or esi, 0x17dda
sub esi, 0x60b2
call 0x10006820
add byte [0x3f454036], bh
cmp eax, 0x83454c49
les eax, [esi + ebx*2]
push edi
and edi, 0x3ca1
pop edi
mov ecx, dword [ebp - 0xcc0]
mov dx, word [ecx]
mov word [ebp - 0x1042], dx
mov eax, dword [ebp - 0xcc0]
add eax, 2
mov dword [ebp - 0xcc0], eax
mov cx, word [ebp - 0x1042]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc4]
mov ax, word [edx]
mov word [ebp - 0x1044], ax
mov ecx, dword [ebp - 0xcc4]
add ecx, 2
mov dword [ebp - 0xcc4], ecx
mov dx, word [ebp - 0x1044]
mov word [ebp - 0x38], dx
push edi
xor edi, 0x43f8
xor edi, 0x33d4
xor edi, 0x1192c
xor edi, 0x36a6
pop edi
push edx
push ecx
add esp, 4
add edx, 0x190b
and edx, 0xc631
and edx, 0x14390
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x100068d2
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x1000692c
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x100067fa
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x100067fa
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x10006916
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x10006920
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x10006975
push ebx
sub ebx, 0xd6d1
pop ebx
push edx
sub edx, 0x148cd
pop edx
push esi
add esi, 0xbc7a
pop esi
push edx
push edi
add esp, 4
jmp 0x1000695a
add edx, 0xae19
sub edx, 0x378d
pop edx
mov ecx, dword [ebp - 0x518]
mov dword [ebp - 0x2f4], ecx
jmp 0x100069dd
push edx
push esi
add esp, 4
add edx, 0x15a3f
pop edx
push eax
sub eax, 0x382c
pop eax
push edx
jmp 0x10006992
pop edx
push eax
sub eax, 0xbf2f
sub eax, 0xfde1
or eax, 0x58e7
pop eax
mov edx, dword [ebp - 0x518]
mov eax, dword [edx]
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [ebp - 0xcc8]
je 0x100069d3
mov edx, dword [ebp - 0x518]
cmp dword [edx + 0x30], 0
jne 0x1000679e
mov dword [ebp - 0x2f4], 0
Function at 0x10006e21
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x10006e51
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x10006c1c
mov dword [ebp - 0x778], 0
Function at 0x10007420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
add esp, 4
sub esi, 0x75cd
sub esi, 0x167dc
pop esi
push ebx
push edi
add esp, 4
xor ebx, 0xa3ef
and ebx, 0x1280b
xor ebx, 0x113d2
pop ebx
push ebx
add ebx, 0xa6b7
pop ebx
lea eax, [ebp - 0x1740]
mov dword [ebp - 0xce0], eax
mov ecx, dword [ebp - 0x520]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcdc], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ebx
sub ebx, 0xc4b8
sub ebx, 0x16ef7
or ebx, 0x4330
pop ebx
push ecx
and ecx, 0x174cf
call 0x100074a4
add byte [esi], bh
dec edx
dec esi
inc esp
aaa
xor eax, 0x4c4834a
dec edx
add esp, 4
add ecx, 0x359d
pop ecx
mov edx, dword [ebp - 0xcdc]
mov ax, word [edx]
mov word [ebp - 0x104a], ax
mov ecx, dword [ebp - 0xcdc]
inc dword [ebx - 0x7276fd3f]
and al, 0xf3
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov dh, 0xef
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
fdiv st(5), st(0)
invalid
dec dword [ebx - 0xcdf7b]
invalid

Function at 0x100074c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx - 0x7276fd3f]
and al, 0xf3
invalid

Function at 0x100074e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov cx, word [eax]
mov word [ebp - 0x104c], cx
mov edx, dword [ebp - 0xce0]
add edx, 2
mov dword [ebp - 0xce0], edx
invalid
invalid
invalid
invalid
Function at 0x1000768d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
inc esp
cmp eax, 0xc4833b38
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x2f4]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x36c], edx
push ecx
push ecx
add esp, 4
or ecx, 0xcf71
sub ecx, 0xcf30
sub ecx, 0x15b7c
pop ecx
push ecx
xor ecx, 0x11add
pop ecx
push esi
jmp 0x100076c6
xor esi, 0x1ef
jmp 0x100076d1
pop esi
mov dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x1690], eax
cmp dword [ebp - 0x1690], 0
jne 0x10007702
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x100079f3
mov edx, dword [ebp - 0x1690]
mov eax, dword [ebp - 0x36c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1694], eax
jne 0x1000772a
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x100079f3
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1694]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1698], edx
cmp dword [ebp - 0x1698], 0
jne 0x1000775c
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x524], eax
jmp 0x100079f3
mov ecx, dword [ebp - 0x36c]
add ecx, dword [ebp - 0x1698]
mov dword [ebp - 0x78c], ecx
jne 0x10007781
mov edx, dword [ebp - 0x798]
mov dword [ebp - 0x524], edx
jmp 0x100079f3
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19d0], ecx
mov edx, dword [ebp - 0x78c]
mov eax, dword [ebp - 0x36c]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19d4], eax
mov ecx, dword [ebp - 0x78c]
mov edx, dword [ebp - 0x36c]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19d8], edx
mov dword [ebp - 0x790], 0
jmp 0x100077db
mov eax, dword [ebp - 0x790]
add eax, 1
mov dword [ebp - 0x790], eax
mov ecx, dword [ebp - 0x78c]
mov edx, dword [ebp - 0x790]
cmp edx, dword [ecx + 0x18]
jae 0x100079e7
mov eax, dword [ebp - 0x790]
mov ecx, dword [ebp - 0x19d0]
mov edx, dword [ebp - 0x36c]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x794], edx
mov eax, dword [ebp - 0x790]
mov ecx, dword [ebp - 0x19d4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19d8]
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19dc], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x1000784b
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x794]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x100078fd
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x9d8]
test eax, eax
je 0x100078fd
push ecx
call 0x10007888
add byte [eax + 0x47], al
inc ebx
dec esi
dec ebx
dec ebp
inc esp
dec edx
add esp, 4
and ecx, 0x1800b
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0x1540c
sub ebx, 0x840f
sub ebx, 0x140b9
pop ebx
mov ecx, dword [ebp - 0x794]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
invalid
invalid
pushal
Function at 0x100184b5
Capabilities:
Encode data using xor

Disassembly:
dec edi
dec ebx
aas
xor eax, 0x8407c786
into
jmp 0xf685876d
add ebx, dword [ebp - 0x37]
mov byte [ebx], ah
test dword [edx], 0x88c95502
and al, 0xf7
add al, byte [edx]
ja 0x1001845b
mov byte [0x6f0202f7], ah
leave
mov byte [esi], ah
test dword [edx], 0x88c94c02
daa
test dword [edx], 0x88c97002
sub bh, dh
add al, byte [edx]
leave
mov byte [ecx], ch
test dword [edx], 0x88c96a02
invalid

Function at 0x1001e082
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor eax, 0xed840303
mov al, 0x76
add eax, dword [ebx]
pop ebp
mov ds, word [eax + 0x202f327]
imul ecx, dword [esi - 0x777396fb], 0x202f69d
mov ss, word [eax + 0x202f327]
xchg ah, al
add eax, 0xf327908c
add al, byte [edx]
imul ecx, dword [esi + 0x2f69d98], 0x988c6902
adc eax, dword [ecx]
add al, byte [edx]
mov cs, word [eax + 0x202f323]
imul ecx, dword [esi - 0x6f7396f5], 0x202f69b
mov ds, word [eax + 0x202f323]
xchg ch, al
add eax, 0xf323988c
add al, byte [edx]
imul ecx, dword [esi + 0x2f69b88], 0x888c6902
lar eax, word [edx]
add dl, byte [ebp - 0x7c]
in eax, 0x26
mov esi, 0xc5840303
je 0x1001e15f
add al, 3
pop ebp
push ebp
test ch, ch
cmp al, 0x89
add al, 3
test ch, dh
dec edi
js 0x1001e103
add ebx, dword [ebp + 0x54]
test ah, dh
mov byte [0x8403035f], al
in al, 0xd3
add dword [ebx], eax
add ebp, esi
or dword [eax], edi
inc eax
dec ecx
inc esp
dec ebx
inc ecx
pop esp
adc bh, byte [edx + 0x2020f90]
add cl, byte [eax + 0x121b78cc]
mov edx, 0x2011398
add dl, byte [edx]
mov edx, 0x2020f88
add ch, byte [esi]
ror dword [eax + ebx*4 + 0x202edd3], cl
out dx, al
adc bh, byte [edx + 0x2011390]
add dl, byte [edx]
mov edx, 0x2020f98
add bh, byte [esi]
int 0x12
xchg dword [edx + eax], ecx
add al, byte [edx]
adc bh, byte [edx + 0x2011388]
add al, byte [esi - 0x45eddc0d]
nop
lar eax, word [edx]
add al, byte [edx]
add bh, byte [esi]
les edx, [edx]
xchg ebx, esi
add dword [edx], eax
add dl, byte [edx]
mov edx, 0x2011398
add dl, byte [edx]
mov edx, 0x2020f88
add bh, byte [esi]
rol dword [eax - 0x287735f1], cl
in eax, dx
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
out dx, al
or eax, 0xedd788ca
add al, byte [edx]
add al, 3
add eax, dword [ebx]
mov ss, word [eax + 0x202edd7]
mov word [eax + 0x202edd3], ss
xchg al, al
shr ebp, cl
add al, byte [edx]
add edi, dword [eax + 0x43]
pop ecx
test cl, ch
push cs
fld dword [ebx]
add esp, dword [ecx + 0x54]
push esp
xchg bh, al
pop es
test ah, cl
invalid
Function at 0x1001ee8f
Capabilities:
Encode data using xor

Disassembly:
add al, byte [edx]
out dx, al
imul edx, dword [ebx - 0x15], 0xb
add eax, dword [ebx]
add eax, dword [ebx]
cmp al, 0x49
cmp al, 0x3b
dec ecx
push edx
xor eax, 0xee07c786
pop es
push ecx
cmp esi, dword [edi]
pop ebx
push esi
test dh, al
adc al, 0x43
add al, 3
pop esi
push ebx
pop ecx
xchg bh, al
pop es
test bl, dh
jne 0x1001ee92
add eax, dword [ebx]
test bl, al
enter 0x42e, 3
pop ebx
mov ss, word [eax + 0x202fe0b]
mov ss, word [esp + ecx*4]
cwde
or edi, esi
add al, byte [edx]
mov cs, word [eax + 0x202fe0b]
mov byte ds:[ebx], al
add al, byte [edx]
ja 0x1001eef4
mov ss, word [eax + 0x202fe0b]
xchg byte [ebx + esi + 3], bh
adc cl, byte [eax + 0x20200b9]
retf 0x3788
add byte [edx], al
add al, byte [ebx]
add eax, dword [ebx]
add edx, dword [ebp - 0x7c]
lds ebx, [edx + ecx - 0x3a7bfcfc]
mov ebx, 0x555d0303
push ebp
xchg bh, al
pop es
test ch, cl
movsd dword es:[edi], dword [esi]
in al, dx
add eax, dword [ebx]
pop ebp
push esp
test ah, ah
or dword [ecx + 3], 0x30beb03
add eax, dword [ebx]
add esi, dword [esi]
dec esp
inc ebp
cmp byte [ecx + 0x4f], al
cmp eax, 0x5c07c786
mov ds, word [eax + 0x2020037]
mov es, word [ebp + 0x1b]
mov word [eax + 0x202ff9b], cs
push esi
test dh, al
mov ch, 0x66
add eax, dword [ebx]
test dh, ch
sar byte [ecx], cl
add al, 3
test dh, dh
add byte [ebp + 0x595e0304], al
test cl, bh
sub ebp, dword [ebx + 0x59610303]
test cl, dl
mov al, 0x78
add eax, dword [ebx]
popal
push ebx
test bl, dh
mov esp, 0x8403033d
mov bl, 0x52
add eax, dword [ebx]
pop ebx
retf 0xd388
Function at 0x100241a2
Capabilities:
Enumerate device drivers on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10151d70
mov eax, dword fs:[0]
push eax
mov eax, 0x4834
call fcn.1012ba20
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x1c], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4840], eax
jne 0x100241ed
xor eax, eax
jmp 0x100242e0
lea eax, [ebp - 0x483c]
mov esi, 0x4000
push eax
push esi
lea eax, [ebp - 0x4830]
push eax
call sub.PSAPI.DLL_EnumDeviceDrivers
test eax, eax
je 0x100242dd
cmp dword [ebp - 0x483c], esi
jae 0x100242dd
push 0x820
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.1012db70
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x4838], esi
push 0x40f
lea eax, [ebp - 0x830]
push eax
push dword [ebp + esi*4 - 0x4830]
call sub.PSAPI.DLL_GetDeviceDriverBaseNameW
test eax, eax
je 0x100242ca
mov eax, dword [edi + 4]
xor ebx, ebx
mov ecx, dword [edi]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x100242ca
mov esi, dword [ebp - 0x4840]
push dword [ecx + ebx*4]
lea eax, [ebp - 0x830]
push eax
call fcn.100534d3
pop ecx
pop ecx
test eax, eax
je 0x100242b5
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x4834]
call fcn.100088c7
and dword [ebp - 4], 0
lea eax, [ebp - 0x4834]
push eax
mov ecx, esi
call fcn.10008790
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4834]
lea ecx, [ecx - 0x10]
call fcn.100078bc
mov eax, dword [edi + 4]
inc ebx
mov ecx, dword [edi]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x1002426a
mov esi, dword [ebp - 0x4838]
inc esi
mov dword [ebp - 0x4838], esi
cmp esi, 0x410
jb 0x10024238
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012b632
leave
ret 8
Function at 0x1002aa90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0x31
xor esi, esi
call fcn.10010082
pop ecx
test eax, eax
je 0x1002aab7
lea ecx, [ebp - 4]
push ecx
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x1002aacb
lea eax, [ebp - 4]
push eax
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1002ab35
push edi
mov edi, dword [ebp - 4]
push 0x43
mov dword [ebp - 8], 4
call fcn.10010082
pop ecx
test eax, eax
je 0x1002aafd
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push esi
push str.lqbnum
push edi
call eax
jmp 0x1002ab16
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.lqbnum
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
test eax, eax
jne 0x1002ab2d
cmp dword [ebp - 0xc], 4
jne 0x1002ab2d
cmp dword [ebp - 0x10], 0xbc
jne 0x1002ab2d
xor esi, esi
inc esi
push dword [ebp - 4]
call fcn.10017c01
mov eax, esi
pop esi
leave
ret 8

Function at 0x1002c2df
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
mov ebx, ecx
lea edi, [ebp - 0x24]
push 9
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebx], vtable.CMemoryHelper.0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
and dword [ebx + 4], 0
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
push str.ntdll
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1002c342
push str.ZwQueryVirtualMemory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push edi
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x14], eax
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10032e1d
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.10034088
test eax, eax
jne 0x10032e31
xor edi, edi
jmp 0x10032ec5
mov ecx, esi
call fcn.10034886
mov edi, eax
test edi, edi
jne 0x10032e52
mov ecx, esi
call fcn.10032eca
mov edi, eax
test edi, edi
je 0x10032ec5
mov ecx, esi
call fcn.1003691e
mov eax, dword [esi + 0x180]
push ebx
mov dword [esi + 0x300], eax
xor ebx, ebx
mov eax, dword [esi + 0x244]
push ebx
mov dword [esi + 0x304], eax
mov eax, dword [esi + 0x20c]
push 0xffff
mov dword [esi + 0x308], eax
mov eax, dword [esi + 0x284]
push ebx
mov dword [esi + 0x30c], eax
mov eax, dword [esi + 0x2a4]
push ebx
mov dword [esi + 0x310], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x2bc], eax
test eax, eax
je 0x10032ec4
push ebx
push ebx
push esi
push 0x1003645a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10032ec4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x1003f68a
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1015704a
call fcn.1012b6ae
mov esi, ecx
lea eax, [esi + 0x3c]
push eax
lea ecx, [ebp - 0x244]
call fcn.10007b01
and dword [ebp - 4], 0
lea edi, [esi + 0x18]
mov eax, dword [edi]
lea ebx, [esi + 0x24]
mov ecx, ebx
mov dword [edi + 4], eax
call fcn.10015f3e
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1003f745
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1003f73a
lea eax, [ebp - 0x234]
mov ecx, edi
push eax
call fcn.10010712
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.100088c7
mov byte [ebp - 4], 1
lea eax, [ebp - 0x240]
push eax
mov ecx, ebx
call fcn.10008790
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
call fcn.100078bc
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1003f6e9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x244], 0
je 0x1003f75e
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1012b658
ret
Function at 0x1004008f
Capabilities:
Link many functions at runtime

Disassembly:
push 0x30
mov eax, 0x10157198
call fcn.1012b6ae
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebx + 0x24]
push eax
mov dword [ebp - 0x2c], edi
call fcn.10007b01
and dword [ebp - 4], 0
cmp dword [ebx + 0x1c], 0
jne 0x100401b0
push esi
call fcn.10114081
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x1004018d
push str.CreateScannerEx
push eax
call esi
push str.CloseScanner
push dword [ebx]
mov dword [ebx + 4], eax
call esi
push str.SetScannerConfig
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.CreateScanner
push dword [ebx]
mov dword [ebx + 0x10], eax
call esi
push str.ScanProc
push dword [ebx]
mov dword [ebx + 8], eax
call esi
xor ecx, ecx
mov dword [ebx + 0x14], eax
cmp dword [ebx + 4], ecx
je 0x1004018d
cmp dword [ebx + 0xc], ecx
je 0x1004018d
cmp dword [ebx + 0x10], ecx
je 0x1004018d
cmp dword [ebx + 8], ecx
je 0x1004018d
test eax, eax
je 0x1004018d
push dword [ebp - 0x28]
mov ecx, ebx
call fcn.10040b17
test eax, eax
je 0x1004018d
cmp dword [ebx + 0x18], 0
je 0x1004018d
test edi, edi
je 0x10040186
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10040186
mov esi, 0x101811ac
lea edi, [ebp - 0x20]
push 0x1f
pop eax
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebx + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebx + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004018d
mov dword [ebx + 0x20], 1
push 0x10180be8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100401a9
push str.IsWow64Process
push eax
call esi
mov dword [0x102455cc], eax
mov dword [ebx + 0x1c], 1
mov esi, dword [ebx + 0x20]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0
je 0x100401c6
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.1012b658
ret 0xc