joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100445d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x80
lea eax, [ebp - 0x104]
push eax
push 2
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x10044611
lea eax, [ebp - 0x104]
jmp 0x10044613
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
call fcn.10006a6a
mov ecx, dword [eax]
and dword [eax], 0
mov dword [esi], ecx
lea ecx, [ebp - 0x108]
call fcn.10006af6
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10002069
leave
ret 4

Function at 0x10046ee0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x24]
test eax, eax
jne 0x10046f3d
push 2
lea eax, [ebp - 8]
push eax
push 0x100c
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10046f2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10046f22
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756c
call fcn.10042515
movzx eax, word [ebp - 8]
sub eax, 0x2f
cdq
push 7
pop ecx
idiv ecx
lea eax, [edx + 1]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002069
leave
ret

Function at 0x10046f49
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 8]
push eax
push 0x100d
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10046f8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10046f84
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e756e
call fcn.10042515
movzx eax, word [ebp - 8]
sub eax, 0x30
sub eax, 0
je 0x10046fa9
dec eax
je 0x10046fa5
dec eax
jne 0x10046fa9
mov al, 4
jmp 0x10046fab
mov al, 7
jmp 0x10046fab
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002069
leave
ret

Function at 0x1004859e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 8]
push eax
push 0x20001009
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [ebp - 8]
cmp eax, 8
ja 0x100485e2
je 0x100485ec
test eax, eax
je 0x100485ec
cmp eax, 5
jbe 0x100485ef
cmp eax, 6
je 0x100485ec
cmp eax, 7
jne 0x100485ec
jmp 0x100485ef
cmp eax, 9
jb 0x100485ec
cmp eax, 0xc
jbe 0x100485ef
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002069
leave
ret
Function at 0x10048c48
Capabilities:
Get geographical location

Disassembly:
push 0x24
mov eax, 0x100d17bc
call fcn.1000240f
push 2
lea eax, [ebp - 0x24]
push eax
push 0x23
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10048ca3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10048c7d
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e7664
lea eax, [ebp - 0x30]
push eax
call fcn.10043c9d
and dword [ebp - 4], 0
mov ecx, eax
call fcn.10042b2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100424ca
cmp word [ebp - 0x24], 0x30
je 0x10048cae
xor al, al
jmp 0x10048ccc
push 9
lea eax, [ebp - 0x24]
push eax
push 0x28
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10048caa
xor eax, eax
cmp word [ebp - 0x24], ax
setne al
call fcn.10002550
ret 4
Function at 0x100498ed
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x10049a69
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x10049923
mov eax, dword [ebp + 0xc]
jmp 0x1004994b
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x10049940
call edi
push eax
push 0x2e6e776a
call fcn.10042515
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x1004996b
call edi
push eax
push 0x2e6e776b
call fcn.10042515
movzx eax, word [ebp - 0x18]
push 0x30
pop ecx
sub eax, ecx
push 0xa
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
push dword [esi]
call ebx
mov dword [ebp - 0x1c], eax
test eax, eax
jg 0x1004999a
call edi
push eax
push 0x2e6e776c
call fcn.10042515
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [esi + 0x18], edx
cmp eax, 2
jl 0x100499ef
add eax, 0xfffffffe
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x100499d1
cmp word [ebp + edx*2 - 0x18], 0x3b
je 0x100499cc
mov ecx, dword [esi + 0x18]
movzx eax, word [ebp + edx*2 - 0x18]
imul ecx, ecx, 0xa
add ecx, 0xffffffd0
add eax, ecx
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x1c]
inc edx
cmp edx, eax
jl 0x100499ae
movzx eax, word [ebp + eax*2 - 0x18]
push 0x30
pop ecx
cmp ax, cx
je 0x100499ef
mov ecx, dword [esi + 0x18]
imul ecx, ecx, 0xa
add ecx, 0xffffffd0
add eax, ecx
imul eax, eax, 0xa
mov dword [esi + 0x18], eax
push 5
lea eax, [esi + 0x48]
push eax
push 0xe
push dword [esi]
call ebx
test eax, eax
jne 0x10049a0c
call edi
push eax
push 0x2e6e776d
call fcn.10042515
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x52]
push eax
push 0xf
push dword [esi]
call ebx
test eax, eax
jne 0x10049a2f
call edi
push eax
push 0x2e6e776e
call fcn.10042515
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
push 0x1010
push dword [esi]
call ebx
test eax, eax
jne 0x10049a55
call edi
push eax
push 0x2e6e776f
call fcn.10042515
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
pop edi
mov dword [esi + 0x24], eax
mov byte [esi + 0xa], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10002069
leave
ret 8
Function at 0x10049aeb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
jne 0x10049c5f
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x10049b21
mov eax, dword [ebp + 0xc]
jmp 0x10049b49
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi]
call ebx
test eax, eax
jne 0x10049b3e
call edi
push eax
push 0x2e6e7771
call fcn.10042515
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [esi]
call ebx
test eax, eax
jne 0x10049b69
call edi
push eax
push 0x2e6e7772
call fcn.10042515
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 0xa
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x18]
push eax
push 0x18
push dword [esi]
call ebx
test eax, eax
jne 0x10049b90
call edi
push eax
push 0x2e6e7773
call fcn.10042515
movzx eax, word [ebp - 0x18]
sub eax, 0x30
push 5
mov dword [esi + 0x30], eax
lea eax, [esi + 0x48]
push eax
push 0x16
push dword [esi]
call ebx
test eax, eax
jne 0x10049bb7
call edi
push eax
push 0x2e6e7774
call fcn.10042515
lea eax, [esi + 0x48]
push 5
mov dword [esi + 0x34], eax
lea eax, [esi + 0x52]
push eax
push 0x17
push dword [esi]
call ebx
test eax, eax
jne 0x10049bda
call edi
push eax
push 0x2e6e7775
call fcn.10042515
lea eax, [esi + 0x52]
push 0xa
mov dword [esi + 0x38], eax
lea eax, [ebp - 0x18]
push eax
push 0x1c
push dword [esi]
call ebx
test eax, eax
jne 0x10049bfd
call edi
push eax
push 0x2e6e7776
call fcn.10042515
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 0xa
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x18]
push eax
push 0x1b
push dword [esi]
call ebx
test eax, eax
jne 0x10049c28
call edi
push eax
push 0x2e6e7777
call fcn.10042515
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push 7
mov dword [esi + 0x40], eax
lea eax, [esi + 0x5c]
push eax
push 0x14
push dword [esi]
call ebx
test eax, eax
jne 0x10049c53
call edi
push eax
push 0x2e6e7778
call fcn.10042515
lea eax, [esi + 0x5c]
pop edi
mov dword [esi + 0x44], eax
mov byte [esi + 0xa], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10002069
leave
ret 8
Function at 0x1004b893
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
push edx
mov dword [edi], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004b90a
cmp dword [ebp - 8], 1
je 0x1004b8e2
cmp dword [ebp - 8], 2
je 0x1004b8e2
push 0xd
pop eax
jmp 0x1004b90a
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x1004b904
test ecx, ecx
je 0x1004b8ff
test cl, 1
jne 0x1004b8dd
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x1004b8dd
jmp 0x1004b904
xor eax, eax
mov word [esi], ax
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 0xc

Function at 0x1004c8b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2028
mov eax, dword fs:[0]
push eax
mov eax, 0x1060
call fcn.100048c2
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebp - 0x1060], eax
call fcn.10006af6
push ebx
push dword [ebp - 0x1060]
mov ecx, esi
call fcn.1004ce76
test al, al
je 0x1004c923
test edi, edi
je 0x1004c91c
mov dword [edi], 1
xor eax, eax
jmp 0x1004c9d9
mov ecx, esi
call fcn.10006bd5
test al, al
je 0x1004c969
cmp byte [esi + 0x18], 0
je 0x1004c964
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x106c]
push eax
call fcn.10043c9d
and dword [ebp - 4], 0
mov ecx, eax
call fcn.10042b2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x106c]
call fcn.100424ca
push 2
pop eax
jmp 0x1004c9d9
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x1058], ax
lea eax, [ebp - 0x1056]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x105c], 0x1048
test esi, esi
je 0x1004c99a
lea eax, [esi + 4]
jmp 0x1004c99c
xor eax, eax
lea ecx, [ebp - 0x105c]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
push edi
push 0
push dword [ebp - 0x1060]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006c72
mov esi, eax
test esi, esi
jne 0x1004c9d7
lea eax, [ebp - 0x1058]
push eax
mov ecx, ebx
call fcn.10006a82
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10002069
leave
ret 0xc
Function at 0x1004c9f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d208a
mov eax, dword fs:[0]
push eax
mov eax, 0x1064
call fcn.100048c2
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [eax - 4], ebx
mov eax, dword [edi]
xor edx, edx
mov byte [edi + 8], bl
mov word [eax], dx
mov dword [ebp - 0x1064], ecx
mov dword [ebp - 0x105c], ebx
lea eax, [ebp - 0x105c]
push eax
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.1004ce76
test al, al
je 0x1004ca6d
push dword [ebp - 0x105c]
jmp 0x1004cb16
mov ecx, esi
call fcn.10006bd5
test al, al
je 0x1004cab2
cmp byte [esi + 0x18], 0
je 0x1004caad
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x1070]
push eax
call fcn.10043c9d
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10042b2d
lea ecx, [ebp - 0x1070]
mov byte [ebp - 4], bl
call fcn.100424ca
push 2
pop ebx
jmp 0x1004cb1d
xor eax, eax
push 0x1046
mov word [ebp - 0x1058], ax
lea eax, [ebp - 0x1056]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x1060], 0x1048
lea eax, [esi + 4]
test esi, esi
jne 0x1004cae3
mov eax, ebx
lea ecx, [ebp - 0x1060]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
push ebx
push ebx
push dword [ebp - 0x1064]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006c72
mov ebx, eax
test ebx, ebx
jne 0x1004cb1d
lea eax, [ebp - 0x1058]
push eax
mov ecx, edi
call fcn.10047bfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x105c]
call fcn.10006af6
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10002069
leave
ret 8

Function at 0x1004cb4a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x100d1fc8
call fcn.1000240f
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
call fcn.10006bd5
test al, al
je 0x1004cba2
cmp byte [esi + 0x18], 0
je 0x1004cb9d
push 0x80070002
push 0x2e6e3576
lea eax, [ebp - 0x24]
push eax
call fcn.10043c9d
and dword [ebp - 4], 0
mov ecx, eax
call fcn.10042b2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.100424ca
push 2
pop eax
jmp 0x1004cbcc
and dword [ebp - 0x14], 0
test esi, esi
je 0x1004cbaf
lea eax, [esi + 4]
jmp 0x1004cbb1
xor eax, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ebx
push ecx
push 0
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
mov ecx, esi
call fcn.10006c72
call fcn.10002550
ret 0xc
Function at 0x1004e690
Capabilities:
Terminate process

Disassembly:
push 0x24
mov eax, 0x100d2690
call fcn.100029ef
mov edi, dword [ebp + 8]
push 0
call fcn.10002a90
and dword [ebp - 4], 0
mov bl, byte [ebp + 0xc]
mov byte [ebp - 4], 1
test bl, bl
je 0x1004e6d0
test byte [0x1013d19c], 4
je 0x1004e6d0
push 0x666
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x1013d1a0]
test ecx, ecx
je 0x1004e6e0
push edi
call fcn.1004e753
test bl, bl
je 0x1004e737
mov eax, dword [edi]
mov ecx, SysReAllocStringLen
and eax, ecx
cmp eax, ecx
jne 0x1004e737
mov eax, dword [0x1013d19c]
test al, 1
jne 0x1004e70e
test al, 2
je 0x1004e737
mov esi, dword [0x1013d1ac]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, esi
jne 0x1004e737
xor eax, eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.1005a25e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100424ca
or dword [ebp - 4], 0xffffffff
call fcn.100066af
call fcn.10005edf
ret 8

Function at 0x1004f6e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100d28d0
call fcn.1000240f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x420], eax
xor eax, eax
xor ebx, ebx
lea edi, [ebp - 0x410]
mov dword [ebp - 0x41c], 0x200
mov byte [ebp - 0x418], bl
mov dword [ebp - 0x414], ebx
mov word [ebp - 0x410], ax
stosd dword es:[edi], eax
mov word [ebp - 0x40c], ax
lea eax, [ebp - 0x420]
push eax
push ecx
mov dword [ebp - 4], ebx
call fcn.1004f339
lea eax, [ebp - 0x420]
push eax
call fcn.100400f6
cmp eax, 0x104
jbe 0x1004f77a
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov word [eax + 0x208], cx
mov eax, dword [ebp - 0x420]
mov dword [eax - 4], 0x208
mov byte [ebp - 0x418], bl
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [ebp - 0x420]
push eax
mov ecx, eax
setne bl
call fcn.1000854f
mov al, bl
call fcn.10002550
ret 4
Function at 0x100508a2
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x100d2a48
call fcn.1000240f
mov esi, ecx
xor edi, edi
cmp dword [esi], 0xffffffff
je 0x100508e0
push 0x80004005
push 0x2e68367a
lea eax, [ebp - 0x20]
push eax
call fcn.10043c9d
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.10042b2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.100424ca
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x10050938
push edi
push edi
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10050911
or dword [esi], 0xffffffff
call fcn.10002550
ret 0xc

Function at 0x10050a74
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100d2b5e
call fcn.10001e61
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x14
mov dword [ebp - 4], ebx
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10050ab8
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10058cd0
mov edi, eax
jmp 0x10050aba
mov edi, ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.10058fbb
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x18]
cmp dword [esi + 0x18], 1
mov byte [ebp - 4], 2
jne 0x10050aec
cmp dword [esi + 0x1c], ebx
jne 0x10050aec
mov ecx, dword [esi + 0x24]
call fcn.1002da33
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
push ebx
push 0x10050c30
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10050b18
push 0x2e6b6831
call fcn.100426a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10058fbb
call fcn.10001ea0
ret 0x14
Function at 0x10050b2c
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100d2bba
call fcn.10001e61
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x14
mov dword [ebp - 4], ebx
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10050b6d
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10058e7b
mov edi, eax
jmp 0x10050b6f
mov edi, ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.10058fbb
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x18]
cmp dword [esi + 0x18], 1
mov byte [ebp - 4], 2
jne 0x10050ba1
cmp dword [esi + 0x1c], ebx
jne 0x10050ba1
mov ecx, dword [esi + 0x24]
call fcn.1002da33
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
push ebx
push 0x10050c5d
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10050bcd
push 0x2e6b6832
call fcn.100426a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10058fbb
call fcn.10001ea0
ret 0x10

Function at 0x10053426
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.100048c2
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2008], 0
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2014], eax
xor eax, eax
mov word [ebp - 0x2004], ax
mov dword [ebp - 0x2010], 0x1000
mov byte [ebp - 0x200c], 0
lea edi, [ebp - 0x2004]
stosd dword es:[edi], eax
mov word [ebp - 0x2000], ax
lea eax, [ebp - 0x2014]
push eax
push edx
mov esi, ecx
call fcn.10053750
push dword [ebp - 0x2014]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x2014]
mov dword [esi], ecx
push eax
mov ecx, eax
call fcn.1000854f
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 4
Function at 0x10054fb0
Capabilities:
Print debug messages

Disassembly:
push 0x81c
mov eax, 0x100d3594
call fcn.1000240f
mov ebx, dword [ebp + 8]
push ebx
call fcn.10040105
mov esi, eax
mov ecx, 0x3e8
cmp esi, ecx
jle 0x10055080
lea eax, [esi - 0x3e9]
xor edx, edx
div ecx
inc eax
mov ecx, eax
imul ecx, ecx, 0xfffffc18
add esi, ecx
mov dword [ebp - 0x824], esi
mov esi, eax
and dword [ebp - 0x814], 0
lea eax, [ebp - 0x810]
mov dword [ebp - 0x820], eax
xor eax, eax
lea edi, [ebp - 0x810]
mov dword [ebp - 0x81c], 0x400
mov byte [ebp - 0x818], 0
mov word [ebp - 0x810], ax
stosd dword es:[edi], eax
mov word [ebp - 0x80c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x820]
push eax
push 0x3e8
push ebx
call fcn.1003fe69
lea ecx, [ebp - 0x820]
add ebx, 0x7d0
call fcn.10047f82
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x820]
push eax
mov ecx, eax
call fcn.1000854f
dec esi
jne 0x10054ff4
mov esi, dword [ebp - 0x824]
test esi, esi
je 0x1005508b
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.10002550
ret 4

Function at 0x1005559d
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x1c
mov eax, 0x100d3660
call fcn.1000240f
mov ebx, dword [ebp + 8]
mov esi, ecx
mov edi, edx
test esi, esi
je 0x100556a8
test edi, edi
je 0x100556a8
xor ecx, ecx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push 0x8003
mov dword [ebp - 4], ecx
call fcn.100520e9
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10055699
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100555ec
push 0
sub ecx, edx
push ecx
push esi
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
call esi
test eax, eax
je 0x10055699
push 0
push 1
push 0x10056da0
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x10055699
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10055623
push 0
sub ecx, edx
push ecx
push edi
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x10055699
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x10055699
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
push 0
push 0x3c9
push esi
push edi
call fcn.1001098a
movzx ecx, word [eax*2 + 0x100556d8]
jmp 0x10055694
movzx eax, cx
imul eax, eax, 0xc
cmp dword [eax + 0x10055e70], edi
jne 0x1005568d
cmp dword [eax + 0x10055e74], esi
je 0x100556b2
movzx ecx, word [eax + 0x10055e7a]
test cx, cx
jne 0x10055677
cmp dword [ebp - 0x24], 0
je 0x100556a8
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor eax, eax
call fcn.10002550
ret 4
movzx eax, cx
imul eax, eax, 0xc
cmp dword [ebp - 0x24], 0
mov cx, word [eax + 0x10055e78]
mov word [ebx], cx
je 0x100556d1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor eax, eax
inc eax
jmp 0x100556aa