joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d140
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
mov eax, dword [esp + 0x58]
push edi
lea ecx, [esp + 0x5c]
push eax
push ecx
call fcn.00404030
xor edx, edx
mov ecx, 0x11
mov dword [esp + 0xc], edx
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
mov ax, word [esp + 0x68]
mov dword [esp + 0x14], edx
add esp, 8
mov dword [esp + 0x10], edx
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0
push 0
mov word [esp + 0x58], ax
mov eax, dword [esp + 0x70]
push 0
push 0
push 0
push eax
push 0
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x44d1ec
mov eax, dword [esp + 0x58]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44d1e6
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d1e6
mov edx, dword [esp + 0x58]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
xor eax, eax
add esp, 0x54
ret
mov eax, dword [esp + 0x60]
test eax, eax
je 0x44d204
mov eax, dword [esp + 0x64]
mov ecx, dword [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov eax, dword [esp + 0x5c]
mov edx, dword [0x46f430]
pop esi
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44d249
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d249
mov edx, dword [esp + 0x58]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, 1
add esp, 0x54
ret

Function at 0x44d660
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push esi
push str.QIHOO360BOX_UPDATE_SHAREDATA
push 0x254
push 0
mov esi, ecx
push 2
push 0
push 0xffffffffffffffff
mov dword [esi + 0x14], 0x254
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x18], eax
test eax, eax
jne 0x44d6a2
call ebp
test eax, eax
jle 0x44d6f7
and eax, 0xffff
or eax, 0x80070000
jmp 0x44d6f5
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov edx, dword [esi + 0x20]
push 0
push ecx
mov ecx, dword [esi + 0x24]
push edx
push ecx
push 4
push eax
mov dword [esi + 0x28], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi + 0x10], eax
jne 0x44d6fe
push edi
call ebp
test eax, eax
jle 0x44d6e6
and eax, 0xffff
or eax, 0x80070000
mov edx, dword [esi + 0x18]
mov edi, eax
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
test eax, eax
je 0x44d6fe
pop esi
xor eax, eax
pop ebp
ret
push str.QIHOO360BOX_UPDATE_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 8], eax
jne 0x44d73b
call ebp
cmp eax, 0xb7
jne 0x44d736
push str.QIHOO360BOX_UPDATE_MUTEX
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
mov dword [esi + 8], eax
jne 0x44d73b
pop esi
xor eax, eax
pop ebp
ret
pop esi
mov eax, 1
pop ebp
ret
Function at 0x44d7b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x44d7f4
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x44d7eb
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x44d800
push 0
push 0
call fcn.004555fa
add esp, 0x18
test eax, eax
je 0x44d7f4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 4
mov edx, dword [eax]
push eax
call dword [edx + 0x1c]
ret 4
xor eax, eax
ret 4

Function at 0x44d850
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44d8cc
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x44d8b8
push 0xc
call fcn.00455403
add esp, 4
test eax, eax
je 0x44d8cc
mov edx, dword [esp + 8]
mov ecx, dword [esi + 0xc]
mov dword [eax + 4], edx
lea edx, [esp + 0xc]
push edx
push 0
push eax
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
push 0x44d8e0
push 0
push 0
mov dword [eax + 8], ecx
mov dword [esp + 0x24], 0
call fcn.004555fa
add esp, 0x18
test eax, eax
je 0x44d8cc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret 0xc
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [ecx + 0x20]
pop esi
ret 0xc
xor eax, eax
pop esi
ret 0xc
Function at 0x44da70
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x465413
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x466a1c
mov eax, dword [esi + 0x44]
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 4]
push 0x3e8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [esi + 0x40]
test al, al
je 0x44dad3
mov edi, dword [esi + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push edi
call fcn.004535f0
add esp, 4
jmp 0x44dadd
mov eax, dword [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x38]
test eax, eax
je 0x44dbae
push ebp
mov eax, dword [esi + 0x18]
mov edi, eax
add eax, 0x28
mov dword [esp + 0x10], edi
mov dword [esi + 0x18], eax
lea ecx, [edi + 0x10]
mov byte [esp + 0x2c], 1
call fcn.0044df60
mov ecx, edi
mov byte [esp + 0x2c], 0
call fcn.0041f2b0
mov eax, dword [esi + 0x38]
dec eax
mov dword [esi + 0x38], eax
je 0x44db24
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
cmp edx, eax
jne 0x44dba2
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 4]
mov dword [esi + 0x1c], ecx
mov edx, dword [eax]
push edx
call fcn.004535f0
mov eax, dword [esi + 0x38]
add esp, 4
test eax, eax
jne 0x44db86
lea ecx, [esp + 0x14]
call fcn.0040c690
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0x10]
mov edx, dword [esp + 0x1c]
mov ebp, eax
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edi
lea ebp, [esi + 0x20]
mov dword [esi + 0x20], eax
mov dword [ebp + 4], ecx
mov ecx, dword [esi + 0x30]
push ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edi
call fcn.004535f0
add esp, 4
jmp 0x44dba2
mov eax, dword [esi + 0x1c]
lea ebp, [esi + 0x10]
mov ecx, dword [eax]
mov dword [ebp], ecx
mov edi, ecx
lea edx, [ecx + 0xff0]
mov dword [ebp + 4], edx
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x38]
test eax, eax
jne 0x44dae9
pop ebp
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x44ea80
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x47b8d0]
test eax, eax
jne 0x44eb3d
push esi
push edi
push str.WINTRUST.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.CryptCATAdminAcquireContext
push esi
call edi
push str.CryptCATAdminReleaseContext
push esi
mov dword [0x47b8b8], eax
call edi
push str.CryptCATAdminCalcHashFromFileHandle
push esi
mov dword [0x47b8bc], eax
call edi
push str.CryptCATAdminEnumCatalogFromHash
push esi
mov dword [0x47b8c0], eax
call edi
push str.CryptCATAdminReleaseCatalogContext
push esi
mov dword [0x47b8c4], eax
call edi
push str.WinVerifyTrust
push esi
mov dword [0x47b8c8], eax
call edi
mov ecx, dword [0x47b8b8]
pop edi
test ecx, ecx
mov dword [0x47b8cc], eax
pop esi
je 0x44eb33
mov ecx, dword [0x47b8bc]
test ecx, ecx
je 0x44eb33
mov ecx, dword [0x47b8c0]
test ecx, ecx
je 0x44eb33
mov ecx, dword [0x47b8c4]
test ecx, ecx
je 0x44eb33
mov ecx, dword [0x47b8c8]
test ecx, ecx
je 0x44eb33
test eax, eax
je 0x44eb33
mov eax, 1
mov dword [0x47b8d0], eax
ret
mov eax, 2
mov dword [0x47b8d0], eax
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, ecx
ret
Function at 0x450e60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x465758
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 4]
push ecx
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x450efb
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.004092c0
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret 4
mov eax, dword [esi + 0x7c]
push ebp
cmp eax, ebx
push edi
je 0x450f65
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x80], eax
mov eax, dword [esp + 0x1c]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sub ecx, ebp
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x84], eax
push eax
mov eax, dword [esi + 0x80]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, eax
push edi
call ebp
test eax, eax
je 0x450f5b
xor edi, edi
cmp edi, ebx
mov dword [esi + 0x7c], ebx
je 0x450f65
push edi
call ebp
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
push 0xcc0020
push ebx
push ebx
push ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
sub edx, ecx
mov ecx, dword [esi + 0x80]
sub eax, ebp
push edx
push eax
push ebx
push ebx
push ecx
call edi
mov edx, dword [esi + 0x80]
mov ecx, esi
push edx
call fcn.00451010
mov ecx, dword [esi + 0x80]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x80]
mov esi, dword [esp + 0x10]
push 0xcc0020
sub eax, ecx
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov edx, dword [esp + 0x30]
sub ecx, esi
push eax
push ecx
push ebx
push ebx
push edx
call edi
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp + 0x68]
pop edi
pop ebp
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 4
Function at 0x4520a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x454750
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
mov ecx, 0x47b914
jmp fcn.00454760

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4111fc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [eax]
mov ecx, esi
mov esp, 0xe8f18b56
dec edi
out dx, eax
push 0x5c868b00
add al, 0x70
test byte [ecx - 0x3ed403bb], 0x8b
test dword [edi + 0x4f], ebx
add ecx, dword [edi]
push edi
jne 0x506954a1
invalid
push eax
mov dword [esp + ebp*8 + 0x24], ebx
mov eax, dword [0x64c627c]
cmc
clc
add byte [ebx + 0x56], dl
push edi
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov edi, ecx
inc ebx
push 0x4923dc
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.00407f68
push ebx
lea eax, [ebp - 0x10]
mov ebx, 0xc8b77270
inc esp
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00408b3a
xor al, 0x4d
loopne 0x411245
sub cl, byte [eax - 1]
dec dword [ebx + 0x4c627035]
add byte [ecx*2 - 0x78271710], dh
invalid

Function at 0x430e1e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebx, dword [ebp + 0x57]
mov edi, dword [ebp + 8]
test edi, edi
jne 0x430e3e
call fcn.00428d8f
mov dword [eax], 0x680016
call 0x8442901d
jmp 0x430f39
mov eax, dword [edi + 0xc]
test al, 0x83
je 0x430f39
test al, 0x40
jne 0x430f39
test al, 2
je 0x430e60
or eax, 0x20
mov dword [edi + 0xc], eax
jmp 0x430f39
or eax, 1
mov dword [edi + 0xc], eax
test eax, 0x10c
jne 0x430e76
push edi
call fcn.0043625b
pop ecx
jmp 0x430e7b
mov eax, dword [edi + 8]
mov dword [edi], eax
push dword [edi + 0x18]
push dword [edi + 8]
push edi
call fcn.0042493d
pop ecx
push eax
call fcn.00430fbe
add esp, 0xc
mov dword [edi + 4], eax
test eax, eax
je 0x430f28
cmp eax, 0xffffffff
je 0x430f28
test byte [edi + 0xc], 0x82
jne 0x430efc
push edi
call fcn.0042493d
pop ecx
cmp eax, 0xffffffff
je 0x430ee7
push edi
call fcn.0042493d
pop ecx
cmp eax, 0xfffffffe
je 0x430ee7
push esi
push edi
call fcn.0042493d
mov esi, eax
push edi
sar esi, 5
call fcn.0042493d
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [esi*4 + 0x4c49e0]
pop ecx
pop esi
jmp 0x430eec
mov eax, 0x4bfe90
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x430efc
or dword [edi + 0xc], 0x2000
cmp dword [edi + 0x18], 0x200
jne 0x430f1b
test byte [edi + 0xc], 8
je 0x430f1b
test dword [edi + 0xc], 0x400
jne 0x430f1b
mov dword [edi + 0x18], 0x1000
mov ecx, dword [edi]
dec dword [edi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [edi], ecx
jmp 0x430f3c
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [edi + 0xc], eax
and dword [edi + 4], 0
or eax, 0xffffffff
and al, 0x5d
ret
Function at 0x46a159
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x5cb8478d
and byte [eax], al
add al, ch
into
jp 0x46a101
call fcn.00431bd4
cmp byte [0x458d6280], 0x45
inc dword [eax - 0x729d7fc3]
inc ebp
inc ebp
jg 0x46a116
push edi
mov edi, ecx
jne 0xc047a110
add al, al
cmp dword [edi + 0xe8dcf8], 1
je 0xdc942f10
mov esi, dword [0xfffa8253]
lea eax, [ebp - 0x7c002058]
mov ebx, 0x17e0feb
push ebx
push eax
push 0x66
push dword [0x458d6278]
cld
salc
lea eax, [ebp - 0x7c002058]
push eax
or al, 0
push ebp
mov esi, dword [esi + ebx*8]
stc
xor dword [ecx*4 - 0x20577b], 0xffffff83
push eax
push ebp
mov ebp, esp
push esi
xor eax, 0x458d6278
cld
salc
lea eax, [ebp - 0x7c002058]
push eax
or al, 0
mov esp, 0xf9de12e8
mov esp, 0x1f497ec
add byte [eax], al
push edx
call fcn.00407187
push edx
mov ebx, eax
call fcn.0045ffb9
push edx
mov dword [ebp - 4], eax
call 0x8445ffeb
add dh, byte [ebx - 0x170f7434]
jno 0x46a16e
call 0xbd407f85
in al, dx
xchg edi, eax
hlt
stc
mov esp, 0x89cc4550
push esi
call 0x8446001d
dec ebp
or byte [ebp - 0x20577b], cl
xor dword [esp + edx - 1], 0x75
int3
Function at 0x10010980
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x28
push 0x2040
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100109ac
mov eax, 0x80000004
jmp 0x10010b0c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
push str.AdvDXFReader.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
jne 0x100109ef
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x80000002
jmp 0x10010b0c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
push str.AtOpenDXF
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jne 0x10010a33
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x80000003
jmp 0x10010b0c
push str.AtCloseDXF
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x10010a6f
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x80000003
jmp 0x10010b0c
push str.AtGetLocusCount
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
push str.AtGetSampleCount
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], eax
push str.AtGetType
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
push str.AtGetLine
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], eax
push str.AtGetPoint
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x24], eax
push str.AtGetArc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], eax
push str.AtGetMostValue
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100149e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
mov eax, dword [0x1008e46c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x19c], 0
mov eax, dword [ebp + 8]
and eax, 0xff000000
shr eax, 0x18
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x60
jne 0x10014a36
mov eax, dword [ebp + 8]
and eax, 0xff000000
mov dword [ebp + 8], eax
push str.SYSTEMCurrentControlSetServicesADVANTECHAdvMotion_Device_
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push str.Dev
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str._08x
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call fcn.10042520
add esp, 8
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.10042520
add esp, 8
lea eax, [ebp - 0x90]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x6c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10014acf
mov eax, 0x80000000
jmp 0x10014b53
mov dword [ebp - 0x19c], 0x14
mov eax, dword [ebp - 0x19c]
push eax
push 0
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.10042980
add esp, 0xc
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
lea edx, [ebp - 0x198]
push edx
push 0
push str.DLL_NAME
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x10014b37
mov eax, 0x80000001
jmp 0x10014b53
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10042610
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100420d4
mov esp, ebp
pop ebp
ret 8
Function at 0x100201a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071be8
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x1008e46c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x44], 0
je 0x100201e5
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x49]
test ecx, ecx
jne 0x100201f1
mov al, 1
jmp 0x100203b8
mov dword [ebp - 0x18], 8
call fcn.1001bd40
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x98], eax
call fcn.1001bd40
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0x98]
push ecx
lea edx, [ebp - 0x94]
push edx
call fcn.1001be50
add esp, 8
movzx eax, al
test eax, eax
je 0x10020240
xor al, al
jmp 0x100203b8
push 0
push 8
lea ecx, [ebp - 0x38]
call fcn.1001eee0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x38]
call fcn.1001f2f0
mov ecx, eax
call fcn.10020c10
mov esi, eax
lea ecx, [ebp - 0x38]
call fcn.1001b5c0
add esi, eax
push esi
lea edx, [ebp - 0x8c]
push edx
lea ecx, [ebp - 0x38]
call fcn.1001f2f0
mov ecx, eax
call fcn.10020c10
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x4c
push eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x44]
call fcn.10022090
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x100202cd
cmp dword [ebp - 0x9c], 1
je 0x100202d4
cmp dword [ebp - 0x9c], 3
je 0x10020374
jmp 0x1002038c
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x49], 0
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x38]
call fcn.1001f2f0
mov ecx, eax
call fcn.10020c10
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x3c], ecx
je 0x1002033d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push 1
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x38]
call fcn.1001f2f0
mov ecx, eax
call fcn.10020c10
push eax
call fcn.10043d2b
add esp, 0x10
cmp dword [ebp - 0x3c], eax
je 0x1002033d
mov byte [ebp - 0x80], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10010b90
mov al, byte [ebp - 0x80]
jmp 0x100203b8
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x49]
test ecx, ecx
jne 0x10020360
mov byte [ebp - 0x7f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10010b90
mov al, byte [ebp - 0x7f]
jmp 0x100203b8
cmp dword [ebp - 0x3c], 0
jne 0x10020372
push 0
push 8
lea ecx, [ebp - 0x38]
call fcn.1001f0e0
jmp 0x100203a4
mov byte [ebp - 0x7e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10010b90
mov al, byte [ebp - 0x7e]
jmp 0x100203b8
mov byte [ebp - 0x7d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10010b90
mov al, byte [ebp - 0x7d]
jmp 0x100203b8
jmp 0x10020253
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100420d4
mov esp, ebp
pop ebp
ret