joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4820de
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x48212b
mov al, cl
cmp al, 0x61
jb 0x482106
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x48212b
mov al, cl
cmp al, 0x61
jb 0x48211e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x4820f7
cmp edx, dword [esp + 0x18]
je 0x48213b
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x4820f0
xor eax, eax
jmp 0x48213e
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x482146
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x48222d
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x482233
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x482192
cmp al, 0x61
jb 0x48218a
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x48217d
cmp edx, dword [esp + 0x14]
je 0x4821a2
dec ecx
jne 0x482172
xor eax, eax
jmp 0x48222d
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x48222d
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x48222d
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x4821de
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x4821ed
jmp 0x4821d5
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.004820de
test eax, eax
je 0x48222d
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x482228
cmp al, 0x61
jb 0x482220
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x482213
call fcn.00482146
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x48224b
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x48224b
sub edx, ecx
mov ecx, edx
jmp 0x4821a2
xor eax, eax
jmp 0x48222d
Function at 0x486cd4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x486d0c
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x486cfa
mov al, 1
jmp 0x486d6b
cmp dword [ebx + 0x54], ecx
jne 0x486d03
mov al, 2
jmp 0x486d6b
cmp dword [ebx + 0x7c], ecx
jne 0x486d6b
mov al, 3
jmp 0x486d6b
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x486d21
mov al, 4
jmp 0x486d6b
cmp ecx, 5
jne 0x486d41
cmp ebx, 0
jne 0x486d2f
mov al, 5
jmp 0x486d6b
cmp ebx, 1
jne 0x486d38
mov al, 6
jmp 0x486d6b
cmp ebx, 2
jne 0x486d41
mov al, 7
jmp 0x486d6b
cmp ecx, 6
jne 0x486d69
cmp ebx, 0
jne 0x486d4f
mov al, 8
jmp 0x486d6b
cmp ebx, 1
jne 0x486d56
mov al, 9
cmp ebx, 2
jne 0x486d5d
mov al, 0xa
cmp ebx, 3
jne 0x486d64
mov al, 0xb
cmp ebx, 4
jne 0x486d6b
mov al, 0xc
pop ebx
leave
ret
Function at 0x48bd8e
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x48bdb0
mov eax, 0xfffffffd
jmp 0x48be90
mov ebx, dword [0x19ec97a]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x48be5e
mov ebx, dword [0x19ec97a]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x48bdff
mov ebx, dword [0x19ec97a]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x48bdff
mov eax, 1
jmp 0x48be04
mov eax, 0
test eax, eax
je 0x48be30
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x48be19
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x19ec97a]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x48be86
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x48be90
mov esp, ebp
pop ebp
ret 4

Function at 0x48c00d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x48c0c0
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x48cc20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.0048c00d
test eax, eax
je 0x48cc63
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x48cc63
cmp word [eax], 0x5a4d
jne 0x48cc63
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x48cc63
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.0048c0df
mov eax, dword [ebp + 8]
jmp 0x48cc7c
mov esp, ebp
pop ebp
ret 4

Function at 0x490203
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x49023b
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x490229
mov al, 1
jmp 0x49029a
cmp dword [ebx + 0x54], ecx
jne 0x490232
mov al, 2
jmp 0x49029a
cmp dword [ebx + 0x7c], ecx
jne 0x49029a
mov al, 3
jmp 0x49029a
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x490250
mov al, 4
jmp 0x49029a
cmp ecx, 5
jne 0x490270
cmp ebx, 0
jne 0x49025e
mov al, 5
jmp 0x49029a
cmp ebx, 1
jne 0x490267
mov al, 6
jmp 0x49029a
cmp ebx, 2
jne 0x490270
mov al, 7
jmp 0x49029a
cmp ecx, 6
jne 0x490298
cmp ebx, 0
jne 0x49027e
mov al, 8
jmp 0x49029a
cmp ebx, 1
jne 0x490285
mov al, 9
cmp ebx, 2
jne 0x49028c
mov al, 0xa
cmp ebx, 3
jne 0x490293
mov al, 0xb
cmp ebx, 4
jne 0x49029a
mov al, 0xc
pop ebx
leave
ret
Function at 0x49545c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x495488
add dword [esp], 5
retf

Function at 0x49551b
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x495525
add dword [esp], 5
retf

Function at 0x495ae8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x495af2
add dword [esp], 5
retf

Function at 0x495b7d
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x495b87
add dword [esp], 5
retf

Function at 0x4a4bf9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4a4c31
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4a4c1f
mov al, 1
jmp 0x4a4c90
cmp dword [ebx + 0x54], ecx
jne 0x4a4c28
mov al, 2
jmp 0x4a4c90
cmp dword [ebx + 0x7c], ecx
jne 0x4a4c90
mov al, 3
jmp 0x4a4c90
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4a4c46
mov al, 4
jmp 0x4a4c90
cmp ecx, 5
jne 0x4a4c66
cmp ebx, 0
jne 0x4a4c54
mov al, 5
jmp 0x4a4c90
cmp ebx, 1
jne 0x4a4c5d
mov al, 6
jmp 0x4a4c90
cmp ebx, 2
jne 0x4a4c66
mov al, 7
jmp 0x4a4c90
cmp ecx, 6
jne 0x4a4c8e
cmp ebx, 0
jne 0x4a4c74
mov al, 8
jmp 0x4a4c90
cmp ebx, 1
jne 0x4a4c7b
mov al, 9
cmp ebx, 2
jne 0x4a4c82
mov al, 0xa
cmp ebx, 3
jne 0x4a4c89
mov al, 0xb
cmp ebx, 4
jne 0x4a4c90
mov al, 0xc
pop ebx
leave
ret

Function at 0x4a4d8f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a4d99
add dword [esp], 5
retf

Function at 0x4a8c47
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a8c51
add dword [esp], 5
retf

Function at 0x4a8e0f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a8e19
add dword [esp], 5
retf
Function at 0x4a8ea4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x4a8f24
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x4a8f24
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x4a8f24
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x4a8f24
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x4a8f15
test bl, bl
je 0x4a8f28
dec eax
mov eax, edx
jmp 0x4a8f01
inc ebp
test al, al
je 0x4a8f28
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x4a8efc
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x4a8ee8
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x4a8f22
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x4a8fa7
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4a8fd3
add dword [esp], 5
retf

Function at 0x4a95c6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4a95fe
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4a95ec
mov al, 1
jmp 0x4a965d
cmp dword [ebx + 0x54], ecx
jne 0x4a95f5
mov al, 2
jmp 0x4a965d
cmp dword [ebx + 0x7c], ecx
jne 0x4a965d
mov al, 3
jmp 0x4a965d
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4a9613
mov al, 4
jmp 0x4a965d
cmp ecx, 5
jne 0x4a9633
cmp ebx, 0
jne 0x4a9621
mov al, 5
jmp 0x4a965d
cmp ebx, 1
jne 0x4a962a
mov al, 6
jmp 0x4a965d
cmp ebx, 2
jne 0x4a9633
mov al, 7
jmp 0x4a965d
cmp ecx, 6
jne 0x4a965b
cmp ebx, 0
jne 0x4a9641
mov al, 8
jmp 0x4a965d
cmp ebx, 1
jne 0x4a9648
mov al, 9
cmp ebx, 2
jne 0x4a964f
mov al, 0xa
cmp ebx, 3
jne 0x4a9656
mov al, 0xb
cmp ebx, 4
jne 0x4a965d
mov al, 0xc
pop ebx
leave
ret

Function at 0x4a966e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4a9678
add dword [esp], 5
retf

Function at 0x4b6635
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4b6661
add dword [esp], 5
retf
Function at 0x4bf7ca
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4bf7f6
add dword [esp], 5
retf

Function at 0x4d13b1
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4d13bb
add dword [esp], 5
retf

Function at 0x4d221a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4d2224
add dword [esp], 5
retf

Function at 0x4d592c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x4d5958
add dword [esp], 5
retf

Function at 0x5123a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x5123be
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x5123b3
pop esi
ret
Function at 0x10004050
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007ef32
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100ae254]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x100040b7
lea eax, [esi + 0x50]
mov dword [esi], 0x10089e18
mov dword [ebp + 0xc], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], 0
mov dword [eax], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 1
push 0
push 0
lea edi, [esi + 4]
mov ecx, esi
push edi
call fcn.10003e60
mov dword [ebp - 4], 2
mov eax, dword [esi]
push 8
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x50]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10051708
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000410d
push 1
call fcn.1002b9b7
add esp, 4
mov dword [ebx + 4], eax
jmp 0x1000410f
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov byte [ebp - 4], 3
mov ebx, dword [ebp + 8]
mov ecx, ebx
not ecx
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
and ecx, 1
mov dword [edi + 0x38], 0
shl ecx, 2
mov eax, ebx
mov edx, ecx
or edx, 8
and al, 8
cmove edx, ecx
mov eax, edx
or eax, 0x10
and bl, 4
cmove eax, edx
mov dword [edi + 0x3c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100060c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fa9a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100ae254]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 5
lea eax, [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
or esi, 0xffffffff
mov edx, dword [eax]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000611a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
lea eax, [ebx + 0x2c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
mov edx, dword [eax]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10006141
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
lea eax, [ebx + 0x28]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
mov edx, dword [eax]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10006168
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
lea edi, [ebx + 0x18]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0xb
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.100105c0
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 2
push 0x18
push dword [edi]
call fcn.10051738
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebx + 0x14]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov edx, dword [eax]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100061cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0x10
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.10010660
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 0
push 0x28
push dword [edi]
call fcn.10051738
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.10005cc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007b80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080048
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100ae254]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, 0x7e2
cmp word [ebp - 0x20], ax
jae 0x10007cb5
call fcn.10008b70
mov ecx, eax
test ecx, ecx
je 0x10007d55
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0x10089d40
call fcn.10007a50
test al, al
jne 0x10007c0d
push 0
push 0x10089d40
lea ecx, [ebp - 0x40]
call fcn.10010000
mov dword [ebp - 4], 1
call fcn.10008b70
mov ecx, eax
test ecx, ecx
je 0x10007d5f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
push str.svc_force_updcfg
call fcn.10007a50
test al, al
jne 0x10007c54
push 0x10
push str.svc_force_updcfg
lea ecx, [ebp - 0x3c]
call fcn.10010000
mov byte [ebp - 4], 3
lea eax, [ebp - 0x40]
push 0
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10008a30
mov ecx, eax
call fcn.10023550
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x3c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10007c8f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10007cae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x10007d3a
call fcn.10008ad0
push 0
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.100442c0
mov dword [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x10007cd6
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x44]
call fcn.10003d20
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.100058f0
push dword [ebp - 0x44]
push 0
push str.config_time
push 0x1008a498
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
test esi, esi
je 0x10007d16
call fcn.10008c70
sub eax, esi
cmp eax, 0x15180
sbb esi, esi
neg esi
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edi, dword [ebp - 0x44]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10007d38
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10051ab7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10007a30
push 0x80004005
call fcn.10007a30
int3
Function at 0x1000a420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100806e1
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100ae254]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x238], ebx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10058a20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x100af9e0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.svc.dat
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000a641
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10028c70
add esp, 8
test eax, eax
jne 0x1000a51f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10005870
jmp 0x1000a641
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
mov ecx, ebx
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.1000de40
mov byte [ebp - 4], 1
lea edx, [ebx + 0x14]
mov ecx, dword [eax]
or edi, 0xffffffff
mov esi, dword [edx]
sub esi, 0x10
lea eax, [ecx - 0x10]
mov dword [ebp - 0x234], eax
cmp eax, esi
je 0x1000a5bb
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x1000a5aa
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1000a5aa
push dword [ebp - 0x234]
call fcn.10007d80
add esp, 4
mov dword [ebp - 0x234], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x1000a59c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x238]
add eax, 0x10
mov dword [ebx + 0x14], eax
jmp 0x1000a5bb
push dword [ecx - 0xc]
push ecx
mov ecx, edx
call fcn.10010000
mov ebx, dword [ebp - 0x238]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x23c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1000a5da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, ebx
call fcn.10007b80
test eax, eax
je 0x1000a508
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x1000a626
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a61c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a65f
push edx
push ecx
call fcn.10051738
add esp, 8
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10051ab7
mov esp, ebp
pop ebp
ret
call fcn.1005bb49
int3
Function at 0x100101a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100101f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100101f9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100101ea
cmp esi, edx
jae 0x100101f9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100101d8
cmp esi, edx
jae 0x100101f9
cmp word [esi], 0
je 0x100101f9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret