joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cbf0
Capabilities:
Get local ipv4 addresses

Disassembly:
push 0x50
mov eax, 0x532478
call fcn.004e49d2
mov dword [ebp - 0x4c], ecx
mov eax, 0x3a98
xor ebx, ebx
mov dword [ebp - 0x44], eax
push 2
pop edi
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x45cd14
lea eax, [ebp - 0x44]
push eax
push esi
push 0
push 0xe
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov edi, eax
cmp edi, 0x6f
jne 0x45cc61
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
xor esi, esi
inc ebx
cmp ebx, 3
jge 0x45cce3
mov eax, dword [ebp - 0x44]
jmp 0x45cc09
test edi, edi
jne 0x45cce3
mov eax, esi
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov ebx, dword [eax + 0x10]
test ebx, ebx
je 0x45ccd4
push 2
pop edx
mov ecx, dword [ebx + 0xc]
cmp word [ecx], dx
jne 0x45ccca
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 0x16
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ecx + 4]
push eax
push edx
call dword [sym.imp.WS2_32.dll_inet_ntop]
test eax, eax
je 0x45ccc7
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0042738f
and dword [ebp - 4], 0
mov ecx, esi
push eax
call fcn.00424286
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push 0
push 1
call fcn.00427ba9
push 2
pop edx
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x45cc77
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x45cc6d
mov esi, dword [ebp - 0x50]
jmp 0x45ccfa
push edi
push str.GetLocalIPv4Addresses
push str._s___GetAdaptersAddresses_failed___d_
push 0
push 0
call fcn.0043a0a0
add esp, 0x14
test esi, esi
je 0x45cd0e
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
call fcn.004e497c
ret
push str.GetLocalIPv4Addresses
push str._s___HeapAlloc_failed
push 0
push 0
call fcn.0043a0a0
add esp, 0x10
lea ecx, [ebp - 0x5c]
push str.GetLocalIPv4Addresses:2192:_memory_allocation_failed
call fcn.0040ea4b
push 0x5dd368
lea eax, [ebp - 0x5c]
push eax
call fcn.004fda0a
int3
Function at 0x4b1640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
shr eax, 4
and edi, 0xf
inc eax
mov dword [ebp - 8], 0
movzx ecx, ax
xor esi, esi
mov dword [ebp - 4], 0x409
mov dword [ebp + 8], ecx
movzx eax, word [ebp + esi*4 - 8]
push eax
push ecx
push 6
push dword [0x5eca58]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
test eax, eax
je 0x4b16c5
push eax
push dword [0x5eca58]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4b16c5
push eax
call ebx
test eax, eax
je 0x4b16c5
test edi, edi
jle 0x4b16be
mov edx, edi
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
add eax, 2
sub edx, 1
jne 0x4b16b0
movzx ecx, word [eax]
test ecx, ecx
jne 0x4b16d0
inc esi
cmp esi, 2
jae 0x4b16da
mov ecx, dword [ebp + 8]
jmp 0x4b1671
pop edi
pop esi
add eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x5ae2ec
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401300
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40300c]
mov dword [eax], 0
jmp fcn.00401120
Function at 0x4023d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x4023e1
jmp dword [eax*4 + 0x40376c]
cmp dword [0x4062b4], 0
je 0x4024da
push 0x4062b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4062d0]
test edi, edi
je 0x4024cf
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40242b
mov edi, dword [edi + 8]
test edi, edi
je 0x4024cf
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402420
test esi, esi
je 0x402420
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x402420
call fcn.00401b80
jmp case.default.0x4023e1
cmp dword [0x4062b4], 0
je case.default.0x4023e1
push 0x4062b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4062d0]
test edi, edi
je 0x4024c2
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402487
mov edi, dword [edi + 8]
test edi, edi
je 0x4024c2
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402480
test esi, esi
je 0x402480
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x402480
cmp dword [0x4062b4], 0
jne 0x4024b6
push 0x4062b8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4062b4], 1
jmp case.default.0x4023e1
push 0x4062b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x4023e1
push 0x4062b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4062b4]
cmp eax, 1
jne case.default.0x4023e1
mov eax, dword [0x4062d0]
test eax, eax
je 0x402502
nop dword [eax]
mov esi, dword [eax + 8]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x4024f0
mov dword [0x4062d0], 0
mov dword [0x4062b4], 0
push 0x4062b8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402630
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x403004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x402696
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x402696
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x402696
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x402696
mov edx, dword [esp + 0xc]
sub edx, dword [0x403004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x402686
add esi, 0x28
dec ecx
je 0x402696
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x402680
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x402680
mov eax, esi
pop esi
pop edi
ret
Function at 0x40ada0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x40aac0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004183e3
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x6b7ff8d5
jmp 0x40ae00
mov dword [ebp - 0x14], 0x49f38dd4
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
cmp eax, 0xc51d7718
jg 0x40ae20
cmp eax, 0x8949ae04
jne 0x40ae00
jmp 0x40adf4
cmp eax, 0x7b8b6a60
jg 0x40ae80
cmp eax, 0x6b7ff8d4
jg 0x40ae97
cmp eax, 0x49f38dd3
jg 0x40aeba
cmp eax, 0x30da8316
jg 0x40aed1
cmp eax, 0xfa679ada
jg 0x40aeff
cmp eax, 0xc51d7719
je 0x40af25
cmp eax, 0xc870c3c4
jne 0x40af39
mov al, byte [ebp - 1]
test al, al
mov eax, 0xfa679adb
jne 0x40ae76
mov eax, 0xf2fe3574
mov dword [ebp - 0x14], eax
jmp 0x40ae00
cmp eax, 0x7b8b6a61
jne 0x40ae00
mov dword [ebp - 0x14], 0xc51d7719
jmp 0x40ae00
cmp eax, 0x6b7ff8d5
jne 0x40ae00
mov eax, 0x8949ae04
cmp dword [ebp - 8], 0
je 0x40aeb2
mov eax, 0x30da8317
mov dword [ebp - 0x14], eax
jmp 0x40ae00
cmp eax, 0x49f38dd4
jne 0x40ae00
mov dword [ebp - 0x14], 0xc51d7719
jmp 0x40ae00
cmp eax, 0x30da8317
jne 0x40ae00
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x14], 0x49f38dd4
jmp 0x40ae00
cmp eax, 0xfa679adb
jne 0x40ae00
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x14], 0xf2fe3574
jmp 0x40ae00
cmp dword [ebp - 0x10], 0
setne byte [ebp - 1]
mov dword [ebp - 0x14], 0xc870c3c4
jmp 0x40ae00
cmp eax, 0xf2fe3574
jne 0x40ae00
add esp, 0x2c
pop ebp
ret
Function at 0x40e330
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x20], 0x3274f5c
jmp 0x40e350
mov dword [ebp - 0x20], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
cmp eax, 0x6d394c21
jg 0x40e380
cmp eax, 0x4de527d9
jg 0x40e3a0
cmp eax, 0xba5cbbcd
jg 0x40e3ac
cmp eax, 0xb695c6d0
jne 0x40e350
jmp 0x40e44c
cmp eax, 0x6d394c22
jne 0x40e350
mov al, byte [ebp - 9]
test al, al
mov eax, 0xc8f54c9c
jne 0x40e341
mov eax, 0xba5cbbce
jmp 0x40e341
cmp eax, 0x4de527da
jne 0x40e350
jmp 0x40e57e
cmp eax, 0xc8f54c9b
jg 0x40e43a
cmp eax, 0xba5cbbce
jne 0x40e350
sub esp, 4
mov dword [esp], 0
call fcn.0040e590
add esp, 4
mov esi, eax
call fcn.00402ab0
imul eax, esi
sub esp, 4
mov dword [esp], eax
call fcn.00417e72
add esp, 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
movzx esi, word [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00404c20
add esp, 4
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add eax, edi
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
mov eax, 0x47fe9e2f
cmp ecx, dword [edx]
je 0x40e432
mov eax, 0xb695c6d0
mov dword [ebp - 0x20], eax
jmp 0x40e350
cmp eax, 0xfdaddc42
jg 0x40e461
cmp eax, 0xc8f54c9c
jne 0x40e350
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [ebp - 0x20], 0x4de527da
jmp 0x40e350
cmp eax, 0x3274f5b
jg 0x40e4c7
cmp eax, 0xfdaddc43
jne 0x40e350
mov eax, 4
call fcn.00417500
mov eax, 4
call fcn.00417500
mov esi, esp
mov eax, 4
call fcn.00417500
mov ecx, esp
mov eax, 4
call fcn.00417500
mov dword [esi], 0
mov dword [ecx], 0
mov eax, dword [0x40f6ec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esi], eax
mov dword [ebp - 0x20], 0x44f19b3e
jmp 0x40e350
cmp eax, 0x3274f5c
je 0x40e546
cmp eax, 0x44f19b3e
jne 0x40e552
mov eax, 4
call fcn.00417500
mov dword [ebp - 0x1c], esp
mov eax, 4
call fcn.00417500
mov dword [ebp - 0x18], esp
mov eax, 4
call fcn.00417500
mov dword [ebp - 0x14], esp
mov eax, 4
call fcn.00417500
mov dword [ebp - 0x10], esp
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
mov eax, dword [0x40f6ec]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
sete byte [ebp - 9]
mov dword [ebp - 0x20], 0x6d394c22
jmp 0x40e350
mov dword [ebp - 0x20], 0x44f19b3e
jmp 0x40e350
cmp eax, 0x47fe9e2f
jne 0x40e350
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x42211c], eax
call fcn.00417e4f
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov dword [ebp - 0x20], 0x4de527da
jmp 0x40e350
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x41fe9a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041ccf3
mov dword [ebp - 0x14], eax
cmp dword [0x46d5e0], edi
jne 0x41ff8b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41ff18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42006b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42006b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42006b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x46d5e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x46d5e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x46d5e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46d5f0], eax
test eax, eax
je 0x41ff88
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46d5ec], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41ffb0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41ffa3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41ffc5
push 4
pop eax
jmp 0x42006d
cmp dword [ebp - 0x14], edi
je 0x41ffc5
push dword [0x46d5e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41ffaa
mov eax, dword [0x46d5ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x420023
cmp dword [0x46d5f0], esi
je 0x420023
push eax
call ebx
push dword [0x46d5f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x420023
test eax, eax
je 0x420023
call ecx
test eax, eax
je 0x420018
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x420018
test byte [ebp - 8], 1
jne 0x420023
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x420053
mov eax, dword [0x46d5e4]
cmp eax, esi
je 0x420050
push eax
call ebx
test eax, eax
je 0x420050
call eax
mov edi, eax
test edi, edi
je 0x420050
mov eax, dword [0x46d5e8]
cmp eax, esi
je 0x420050
push eax
call ebx
test eax, eax
je 0x420050
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x46d5e0]
call ebx
test eax, eax
je 0x42006b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42006d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419df9
leave
ret
Function at 0x1000136d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x100013ac
mov byte [ebp - 1], 5
mov eax, esp
lea ecx, [ebp - 1]
mov dword [eax], ecx
mov dword [eax + 0xc], 0x878
mov dword [eax + 8], 0x3c1
mov dword [eax + 4], 0x878
mov eax, dword [sym.imp.USER32.dll_CreateIconFromResource]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x10001430
mov eax, dword [ebp - 0xc]
mov ecx, esp
mov dword [ecx + 0xc], 0xd8f
mov dword [ecx + 8], str.Y_SLGFEctK
mov dword [ecx + 4], str.Y_SLGFEctK
mov dword [ecx], 0x21f
mov ecx, dword [sym.imp.USER32.dll_CharPrevExA]
mov dword [ebp - 0x14], eax
call ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], 0x521c3c
mov ecx, dword [sym.imp.GDI32.dll_UnrealizeObject]
mov dword [ebp - 0x18], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, 0xaaaaaaab
mov dword [ebp - 0x24], eax
mul ecx
shr edx, 3
imul eax, edx, 0xc
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, ecx
sub eax, 5
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
je 0x1000137a
jmp 0x10001423
mov eax, dword [ebp - 0x28]
sub eax, 7
mov dword [ebp - 0x30], eax
jne 0x10001468
jmp 0x10001430
mov eax, esp
mov dword [eax], 0xef516b
mov eax, dword [sym.imp.GDI32.dll_FlattenPath]
call eax
sub esp, 4
mov dword [ebp - 8], 0xb9e
mov ecx, esp
lea edx, [ebp - 8]
mov dword [ecx + 4], edx
mov dword [ecx], 0x85e410
mov ecx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x34], eax
call ecx
sub esp, 8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x126
mov dword [ebp - 0x20], eax
jne 0x100013f8
mov eax, esp
mov dword [eax], 0x776e19
mov eax, dword [sym.imp.KERNEL32.dll_GetTapeStatus]
call eax
sub esp, 4
mov ecx, dword [ebp - 0x14]
sub ecx, 0xb
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x100014b7
jmp 0x100014a0
mov eax, dword [ebp - 0x14]
sub eax, 0x52
mov dword [ebp - 0x44], eax
jne 0x100014d7
jmp 0x100014ad
mov eax, dword [sym.imp.KERNEL32.dll_GetACP]
call eax
mov dword [ebp - 0x48], eax
mov eax, esp
mov dword [eax], 0x73a
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov ecx, dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebp - 0x4c], eax
call ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0xaa
mov dword [ebp - 0xc], eax
jne 0x100013ac
add esp, 0x60
pop ebp
ret
Function at 0x102a5f44
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
cmp eax, 0
sete bl
mov esi, dword [0x10337efc]
cmp ecx, 0
sete bh
add esi, 0x975
mov dword [0x10337ef8], esi
and bh, bl
test bh, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x102a6165
jmp 0x102a5fa1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x102a6165
mov dword [0x10337ef8], 0xab3
mov dword [0x10337efc], 0x104a
mov ecx, dword fs:[0x18]
mov dword [0x10337ef8], 0x1cc0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0xc]
mov ecx, eax
add ecx, 0x14
mov dword [0x10337ef8], 0xffffffd2
mov eax, dword [eax + 0x14]
cmp eax, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
je 0x102a6156
mov eax, dword [0x10337efc]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
setne dl
add eax, 0xa85
mov esi, dword [ebp - 0x24]
mov byte [ebp - 0x25], dl
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [0x10337efc], ecx
mov dx, word [eax + 0x24]
mov ecx, dword [eax + 0x28]
mov dword [0x10337ef8], 0x128b
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x25]
and bh, bl
test bh, 1
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x32], dx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], esi
jne 0x102a5f91
xor eax, eax
mov dword [0x10337ef8], 0x4e4
mov cx, word [ebp - 0x32]
shr cx, 1
movzx edx, cx
cmp cx, 0
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], eax
je 0x102a6131
mov eax, dword [ebp - 0x44]
mov ecx, 0xb88
mov edx, dword [ebp - 0x38]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov word [ebp - 0x4e], si
mov word [ebp - 0x50], bx
jb 0x102a60b8
mov ax, word [ebp - 0x4e]
mov word [ebp - 0x50], ax
mov ax, word [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x48]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov esi, dword [ebp - 0x4c]
mov byte [ebp - 0x51], bl
mov dword [ebp - 0x58], esi
jne 0x102a6103
mov eax, 0x1367
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov edx, dword [ebp - 0x40]
cmp ecx, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x58], eax
jb 0x102a607c
mov eax, dword [ebp - 0x58]
mov dword [0x10337ef8], eax
mov dword [0x10337efc], 0x1a43
mov cl, byte [ebp - 0x51]
test cl, 1
jne 0x102a611f
jmp 0x102a6131
mov dword [0x10337ef8], 0xffffff5b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
jmp 0x102a6165
mov eax, 0x270e
mov dword [0x10337efc], 0x1c89
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x20]
cmp edx, esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
jne 0x102a6011
xor eax, eax
mov dword [0x10337ef8], 0x2307
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a629c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [0x10337ef8], 0xf73
call fcn.1000108c
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x102a636e
jmp 0x102a642f
mov eax, 0x28b6
mov ecx, dword [esp + 0x28]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
jmp 0x102a639b
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.102a64d0
lea ecx, [0x102a780c]
mov edx, 0x2746
mov esi, dword [esp + 0x30]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], 0x146a00
mov esi, dword [0x10337ee4]
mov dword [esp + 0x90], esi
mov esi, dword [0x10337ee8]
mov dword [esp + 0x78], esi
mov esi, dword [0x10337eec]
mov dword [esp + 0x7c], esi
mov esi, dword [0x10337ef0]
mov dword [esp + 0x6c], esi
mov esi, dword [0x10337ef4]
mov dword [esp + 0x58], esi
mov dword [0x10337ef8], 0x1e5d
mov dword [0x10337efc], 0x24b3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
jmp 0x102a639b
lea eax, [esp + 0x40]
mov dword [0x10337efc], 0x1785
mov dword [esp + 0x18], eax
call fcn.102a7596
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
je 0x102a62f0
jmp 0x102a6427
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp word [ecx], 0x5a4d
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ecx
jne 0x102a62ce
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
jne 0x102a62ce
mov eax, dword [esp + 0x28]
mov dword [esp + 0x80], eax
mov ecx, dword [esp + 0x10]
mov dword [0x10337efc], ecx
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x74], esi
mov dword [0x10337ef8], 0x1e8f
mov esi, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.102a67af
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x102a67af
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x102a9777]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x10337efc], 0xf28
mov dword [0x10337ef8], 0x1293
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.102a6ebe
mov dword [0x10337efc], 0x1bd
call fcn.102a6a33
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.102a6c7f
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x102a68f2
jmp 0x102a684c
mov dword [0x10337ef8], 0x2066
mov eax, dword [ebp - 0x44]
add eax, 0x1850
mov dword [ebp - 0x40], eax
jmp 0x102a68f2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [0x10337ef8]
add eax, 0x712
mov dword [0x10337efc], eax
mov eax, esp
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], 0x1000
mov dword [eax + 4], 0x6000
mov dword [eax], 0
mov eax, dword [ebp - 0x48]
call eax
sub esp, 0x10
mov dword [0x10337ef8], 0xbf7
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.102a6ae0
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x28], ecx
mov dword [0x10337ef8], 0xf53
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x48], ecx
mov dword [0x10337efc], 0xb33
cmp ecx, 0
mov dword [ebp - 0x40], eax
jne 0x102a6832
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop edi
pop ebp
ret